@bongos/core 1.24.71 → 1.24.73

package/modules/government/board.js

@@ -47,6 +47,9 @@ const db = require('./db');
 // file (the reward-port delegation lesson: a destructured binding is frozen at
 // load and un-patchable).
 const governmentConfig = require('./config');
+// The durable half of applying a passed amendment (task 1005140), required as a
+// namespace for the same reason.
+const constitutionStore = require('./constitution');
 const {
   loadGovernmentConfig, PASS_RULES, MAX_WINDOW_MINUTES,
   RECOMMENDED_WINDOW_MINUTES, CLOCK_SAFE_PASS_RULES, isClockSafe,
@@ -668,17 +671,25 @@ async function closeItem(item, { cause = 'vote' } = {}) {
   // close commits (the board's decision is the durable record), loudly on
   // failure, never silently absorbed. The apply is re-drivable from the passed
   // item + amendment rows. A returned amendment applies nothing.
+  //
+  // Task 1005140: the ROW is written first (a container's file does not survive
+  // a restart), then this process's file, and then both are READ BACK. An
+  // amendment that did not take comes back as `constitution_not_applied`, which
+  // the vote route hands to the page the voter is standing on.
   let appliedConstitution = null;
+  let constitutionNotApplied = null;
   // A rules or laws amendment changes its own table, never the board block.
   if (outcome === 'passed' && closed.subject_type === 'constitutional_amendment' && !rulesAmendment && !lawsAmendment) {
-    try {
-      if (amendment) {
-        appliedConstitution = governmentConfig.applyBoardAmendment(amendment.proposed);
-      } else {
-        console.error(`[government] passed amendment item ${closed.id} names amendment ${closed.subject_id}, which does not exist — NOT applied`);
+    if (amendment) {
+      const out = await constitutionStore.recordRatified(amendment.proposed, { itemId: closed.id });
+      appliedConstitution = out.applied;
+      constitutionNotApplied = out.failure;
+      if (out.failure) {
+        console.error(`[government] amendment ${closed.subject_id} ratified but NOT in force (re-apply with POST /government/constitution/reapply): ${JSON.stringify(out.failure.problems)}`);
       }
-    } catch (applyErr) {
-      console.error(`[government] amendment ${closed.subject_id} ratified but NOT applied (re-drivable from the passed item): ${applyErr && applyErr.message}`);
+    } else {
+      console.error(`[government] passed amendment item ${closed.id} names amendment ${closed.subject_id}, which does not exist — NOT applied`);
+      constitutionNotApplied = Object.freeze({ should: null, problems: [{ where: 'database', reason: 'the amendment row does not exist' }] });
     }
   }
 
@@ -713,6 +724,7 @@ async function closeItem(item, { cause = 'vote' } = {}) {
     closed: true, item: closed, outcome, cause, author_karma: authorKarma,
     ...(credit ? { credit } : {}),
     ...(appliedConstitution ? { applied_constitution: appliedConstitution } : {}),
+    ...(constitutionNotApplied ? { constitution_not_applied: constitutionNotApplied } : {}),
     ...(appliedDecisionRules ? { applied_decision_rules: appliedDecisionRules } : {}),
     ...(appliedLaws ? { applied_laws: appliedLaws } : {}),
     ...(acted ? { acted: acted.result } : {}),

package/modules/government/config.js

@@ -366,16 +366,20 @@ function loadGovernmentConfig({ neutralPath = NEUTRAL_PATH, instancePath = INSTA
 // the proposal was strictly validated at propose time, but a file on disk must
 // never hold a shape the resolver would have to guess at.
 //
-// WHY A FILE WRITE AND NOT A DB ROW: R05 made the constitution config-resolved
-// on purpose (the board block is a RULE SHAPE, not authority — who holds the
-// governing rank stays a DB row). Moving the live value into the DB on
-// ratification would fork the resolution into two paths, the exact thing the
-// board-snapshot design avoids. The instance pack is host-owned and untracked,
-// so a deploy pull never clobbers it.
+// THE FILE IS NOT THE DURABLE RECORD (task 1005140). It used to be, on the
+// reasoning that the instance pack is host-owned and untracked so a deploy pull
+// never clobbers it. True on a long-lived checkout; false on every instance this
+// platform provisions, whose container filesystem is wiped on each deploy,
+// restart and idle wake — toast's ratified Timocratic Republic vanished that way.
+// The durable record is now the government_constitution ROW, written first by
+// constitution.js recordRatified; this write is the running process's copy of
+// it, and constitution.js reconcile restores it at boot. Resolution is still
+// ONE path (env → instance → neutral): only where the instance layer comes from
+// changed.
 //
-// The caller (board.js closeItem) runs this AFTER the close commits — the
-// board's decision is the durable record; a failed apply is logged loudly and
-// re-appliable from the passed item + amendment rows, never silently absorbed.
+// The caller (constitution.recordRatified, from board.js closeItem) runs this
+// AFTER the close commits and re-reads what is in force afterwards, so an
+// amendment that did not take is reported at the close itself.
 function applyBoardAmendment(proposed, { instancePath = INSTANCE_PATH } = {}) {
   const instance = readJson(instancePath) || {};
   const next = { ...instance, board: { ...sanitizeBoard(proposed) } };
@@ -392,8 +396,16 @@ function applyBoardAmendment(proposed, { instancePath = INSTANCE_PATH } = {}) {
   return next.board;
 }
 
+// The instance pack as it is on disk (null when absent; a file that does not
+// parse throws, as the loader does). constitution.js reads the board block
+// through this so absent and malformed keep one meaning.
+function readInstancePack(instancePath = INSTANCE_PATH) {
+  return readJson(instancePath);
+}
+
 module.exports = {
   resolveGovernmentConfig,
+  readInstancePack,
   loadGovernmentConfig,
   grantableOnly,
   sanitizeBoard,

package/modules/government/constitution.js

@@ -0,0 +1,224 @@
+'use strict';
+
+// modules/government/constitution.js — the constitution in force survives a
+// restart (task 1005140).
+//
+// THE BUG THIS EXISTS FOR. A ratified amendment was written only to
+// <instance root>/config/government.json. Every instance this platform
+// provisions runs on a container whose filesystem is wiped on each deploy,
+// restart and idle wake, so the write took effect and then vanished at the next
+// container start: toast's board ratified a Timocratic Republic on 2026-11-06
+// and the constitution went on answering the day-one monarchy. ADR 0268 fixed
+// the PATH of that write; this fixes its MEDIUM.
+//
+// THE SHAPE. The database row (government_037) is the durable record of the
+// instance's board block. The file stays as the RUNNING PROCESS's copy of that
+// row, so `config.loadGovernmentConfig()` keeps its one synchronous path
+// (env → instance → neutral) and none of its callers change:
+//
+//   • a passed amendment writes the ROW, then the file (`recordRatified`), then
+//     re-reads both and compares (`verifyInForce`) — an amendment that did not
+//     take is reported at the close, not weeks later by the divergence banner;
+//   • at boot, and on a slow interval after, `reconcile` brings the file in step
+//     with the row (a fresh container has no file; the row restores it). If the
+//     row does not exist yet but a file does, the file's board block is ADOPTED
+//     into the row and the log says so — nobody loses a constitution that
+//     happens to still be on disk. If there is NEITHER a row NOR a file but a
+//     constitutional amendment has passed, that amendment is put back in force:
+//     an instance whose ratified constitution a restart already erased (toast,
+//     2026-11-06) repairs itself on its first boot with this code. That is not
+//     the auto-heal ADR 0268 refused — with no file there is no hand edit to
+//     revert; the only thing the process could answer is a default nobody chose;
+//   • `reapplyNewestPassed` is the operator's supported path: it writes the
+//     newest PASSED constitutional amendment back into force. It never takes a
+//     free-form block — changing the constitution is a board act (owner
+//     decision 11); this only makes a decision the board already took stick.
+//
+// The ROW WINS over the file. A hand edit of the file on a long-lived checkout
+// is therefore overwritten at the next reconcile once a row exists — on a
+// container that edit was never durable anyway, and a constitution that quietly
+// differed between the database and one process is the failure being fixed.
+
+const api = require('../../src/module-api');
+const governmentConfig = require('./config');
+const db = require('./db');
+
+const logger = api.logger('government');
+
+const BOARD_KEYS = Object.freeze(['membership', 'pass_rule', 'window_minutes', 'close_early_on_full_turnout']);
+
+// Field-by-field over the four keys — the same comparison board.js
+// constitutionDivergence makes, so "in step" here and "no divergence" there
+// mean the same thing. The two answer different questions (is this process in
+// step with the row / is the newest passed amendment in force); if the board
+// block ever gains a key, change both.
+function differingFields(should, actual) {
+  const a = actual || {};
+  return BOARD_KEYS.filter((k) => should[k] !== a[k]);
+}
+
+// The file's own board block, or null when there is none. Read through the
+// config loader's reader so absent and malformed keep their meanings (absent is
+// null; a file that does not parse throws — a human must fix it).
+function fileBoard(instancePath) {
+  const pack = governmentConfig.readInstancePack(instancePath);
+  return pack && pack.board && typeof pack.board === 'object' ? pack.board : null;
+}
+
+// A missing table means this instance has not run government_037 yet: the
+// caller reports it rather than pretending the row is empty.
+const isMissingTable = (err) => !!(err && err.code === '42P01');
+
+// The newest PASSED constitution amendment (not a rules or laws one, which
+// change their own tables), or null. listAmendmentHistory is newest first.
+async function newestPassed(historyLimit = 50) {
+  const rows = await db.listAmendmentHistory(historyLimit);
+  return (rows || []).find((r) => r.outcome === 'passed' && r.proposed && r.kind === 'constitution') || null;
+}
+
+// A failure the caller hands to a voter carries a fixed reason word, never a
+// driver message (that is logged here, for the operator).
+function problem(where, reason, err) {
+  if (err) logger.error(`[government] constitution: ${where} ${reason}: ${err.message || err}`);
+  return { where, reason };
+}
+
+// Bring this process's file in step with the row, or adopt the file into an
+// empty row. Never throws; returns what it did.
+async function reconcile({ instancePath = governmentConfig.INSTANCE_PATH, log = console.log, error = console.error } = {}) {
+  let row;
+  try {
+    row = await db.getConstitutionRow();
+  } catch (err) {
+    if (isMissingTable(err)) return { action: 'no_table' };
+    error(`[government] constitution: could not read the constitution row (the file stays as it is): ${err && err.message}`);
+    return { action: 'read_failed' };
+  }
+  try {
+    if (row && row.board) {
+      const should = governmentConfig.sanitizeBoard(row.board);
+      const current = fileBoard(instancePath);
+      if (current && differingFields(should, governmentConfig.sanitizeBoard(current)).length === 0) {
+        return { action: 'in_step', board: should };
+      }
+      governmentConfig.applyBoardAmendment(should, { instancePath });
+      log(`[government] constitution: restored the constitution in force from the database (${should.pass_rule}, ${should.membership})`);
+      return { action: 'restored', board: should };
+    }
+    const current = fileBoard(instancePath);
+    if (!current) {
+      // Neither a row nor a file: if the board passed a constitution, the only
+      // reason it is not in force is that a restart erased it. Put it back.
+      const last = await newestPassed();
+      if (!last) return { action: 'none' };
+      const out = await recordRatified(last.proposed, { itemId: last.item_id, source: 'reapply', instancePath });
+      if (out.failure) {
+        error(`[government] constitution: could not put back passed amendment ${last.amendment_id}: ${JSON.stringify(out.failure.problems)}`);
+        return { action: 'failed', failure: out.failure };
+      }
+      log(`[government] constitution: no constitution survived the restart — put back passed amendment ${last.amendment_id} (item ${last.item_id}: ${out.applied.pass_rule}, ${out.applied.membership})`);
+      return { action: 'recovered', board: out.applied, item_id: String(last.item_id) };
+    }
+    const adopted = governmentConfig.sanitizeBoard(current);
+    await db.saveConstitutionRow({ board: adopted, source: 'adopted_file' });
+    log(`[government] constitution: adopted the board block from ${instancePath} into the database (${adopted.pass_rule}, ${adopted.membership}) — it now survives a restart`);
+    return { action: 'adopted', board: adopted };
+  } catch (err) {
+    error(`[government] constitution: reconcile failed: ${err && err.message}`);
+    return { action: 'failed', error: err && err.message };
+  }
+}
+
+// Re-read the row and the constitution this process resolves, and compare both
+// to what should be in force. Null when both match; otherwise what is wrong.
+//
+// The row is read back on purpose even though the save RETURNed it: the point
+// is to prove what a fresh read sees, not what the driver said it wrote. Two
+// small reads, only when a constitution sitting closes.
+async function verifyInForce(should, { instancePath } = {}) {
+  const problems = [];
+  let row = null;
+  try { row = await db.getConstitutionRow(); }
+  catch (err) { problems.push(problem('database', 'read_back_failed', err)); }
+  if (!problems.length) {
+    const rowFields = row && row.board ? differingFields(should, governmentConfig.sanitizeBoard(row.board)) : BOARD_KEYS.slice();
+    if (rowFields.length) problems.push({ where: 'database', fields: rowFields });
+  }
+  let live = null;
+  try { live = governmentConfig.loadGovernmentConfig(instancePath ? { instancePath } : {}).board; }
+  catch (err) { problems.push(problem('in_force', 'resolve_failed', err)); }
+  if (live) {
+    const liveFields = differingFields(should, live);
+    if (liveFields.length) problems.push({ where: 'in_force', fields: liveFields });
+  }
+  return problems.length ? Object.freeze({ should, problems }) : null;
+}
+
+// Put a ratified board block into force: the ROW first (the durable record),
+// then the file (this process), then verify. Never throws — the board's
+// decision is already committed; the caller reports what this returns.
+async function recordRatified(proposed, { itemId = null, source = 'amendment', updatedBy = null, instancePath } = {}) {
+  const should = governmentConfig.sanitizeBoard(proposed);
+  try {
+    await db.saveConstitutionRow({ board: should, source, itemId, updatedBy });
+  } catch (err) {
+    return { applied: null, failure: Object.freeze({ should, problems: [problem('database', 'save_failed', err)] }) };
+  }
+  let applied = null;
+  try {
+    // By property lookup at call time, so a test can redirect the file write.
+    applied = instancePath
+      ? governmentConfig.applyBoardAmendment(should, { instancePath })
+      : governmentConfig.applyBoardAmendment(should);
+  } catch (err) {
+    return { applied: null, failure: Object.freeze({ should, problems: [problem('in_force', 'write_failed', err)] }) };
+  }
+  return { applied, failure: await verifyInForce(should, { instancePath }) };
+}
+
+// The operator's path: re-apply the newest PASSED constitutional amendment.
+// Refuses when there is none — it never invents a constitution.
+async function reapplyNewestPassed({ updatedBy = null, historyLimit = 50 } = {}) {
+  const last = await newestPassed(historyLimit);
+  if (!last) return { ok: false, reason: 'no_passed_amendment' };
+  const out = await recordRatified(last.proposed, { itemId: last.item_id, source: 'reapply', updatedBy });
+  return {
+    ok: !out.failure,
+    item_id: String(last.item_id),
+    amendment_id: String(last.amendment_id),
+    applied: out.applied,
+    ...(out.failure ? { reason: 'not_applied', failure: out.failure } : {}),
+  };
+}
+
+// The handler behind POST /government/constitution/reapply. The route — its
+// path, its government.manage gate and its pin — is declared in
+// routes/government.js, where route-rank-check reads it; only the body lives
+// here (the access-routes.js pattern, for the router's size ratchet). It takes
+// NO block from the request: it can only re-apply what a sitting passed, never
+// invent one (changing the constitution is a board act, owner decision 11).
+function reapplyRoute(log) {
+  return async (req, res) => {
+    try {
+      const out = await module.exports.reapplyNewestPassed({ updatedBy: req.builder.id });
+      if (!out.ok && out.reason === 'no_passed_amendment') {
+        return res.fail('no_passed_amendment', 404, { message: 'No change to the constitution has passed yet, so there is nothing to re-apply. Propose one in the Board Room; once it passes it takes effect.' });
+      }
+      if (!out.ok) return res.fail('constitution_not_applied', 500, { item_id: out.item_id, failure: out.failure });
+      res.json({ ok: true, item_id: out.item_id, amendment_id: out.amendment_id, board: out.applied });
+    } catch (err) {
+      log.error('[gds] POST /government/constitution/reapply', err);
+      res.fail('constitution_reapply_failed', { status: 500, message: 'internal error' });
+    }
+  };
+}
+
+module.exports = {
+  reapplyRoute,
+  reconcile,
+  recordRatified,
+  verifyInForce,
+  reapplyNewestPassed,
+  differingFields,
+  BOARD_KEYS,
+};

package/modules/government/db.js

@@ -1320,7 +1320,35 @@ async function insertVoteKarma({ voterId, itemId, delta }) {
   );
 }
 
+// ── the constitution in force (task 1005140) ─────────────────────────────────
+// ONE row (government_037). The board block is stored exactly as sanitizeBoard
+// returns it; constitution.js owns the rules for when it is written and how the
+// running process is brought in step with it. `q` is a client or the pool.
+async function getConstitutionRow(q = pool) {
+  const { rows } = await q.query(
+    `SELECT board, source, amendment_item_id, updated_by, updated_at
+       FROM government_constitution WHERE id = 1`,
+  );
+  return rows[0] || null;
+}
+
+async function saveConstitutionRow({ board, source, itemId = null, updatedBy = null } = {}, q = pool) {
+  const { rows } = await q.query(
+    `INSERT INTO government_constitution (id, board, source, amendment_item_id, updated_by, updated_at)
+     VALUES (1, $1::jsonb, $2, $3, $4, now())
+     ON CONFLICT (id) DO UPDATE
+       SET board = EXCLUDED.board, source = EXCLUDED.source,
+           amendment_item_id = EXCLUDED.amendment_item_id,
+           updated_by = EXCLUDED.updated_by, updated_at = now()
+     RETURNING board, source, amendment_item_id, updated_by, updated_at`,
+    [JSON.stringify(board), source, itemId, updatedBy],
+  );
+  return rows[0] || null;
+}
+
 module.exports = {
+  getConstitutionRow,
+  saveConstitutionRow,
   openBoardItemsAwaitingVoter,
   getTaskStatuses,
   listLatestGenesisStageItems,

package/modules/government/migrations/government_037_constitution.sql

@@ -0,0 +1,33 @@
+-- government_037_constitution.sql — the constitution in force is a ROW (task 1005140).
+--
+-- WHY
+--
+--   A ratified amendment used to live only in <instance root>/config/government.json.
+--   Every instance this platform provisions runs on a container whose filesystem is
+--   wiped on each deploy, restart and idle wake, so the board's decision was written,
+--   took effect, and vanished at the next container start. The project went back to
+--   the day-one monarchy without an error (found live on toast, 2026-11-07).
+--
+-- WHAT THIS ADDS
+--
+--   government_constitution — at most ONE row (id = 1): the instance's board block,
+--   exactly as sanitizeBoard (modules/government/config.js) would write it. The four
+--   keys are the whole block; nothing else rides here (rank templates stay config).
+--   `source` says how the row got here: a passed amendment, a file adopted on first
+--   read, or an operator re-applying the newest passed amendment.
+--
+--   It is NOT authority: the block names which RANK governs; who holds that rank is
+--   still a government_builder_ranks row, resolved per request.
+
+BEGIN;
+
+CREATE TABLE IF NOT EXISTS government_constitution (
+  id                 smallint    PRIMARY KEY DEFAULT 1 CHECK (id = 1),
+  board              jsonb       NOT NULL CHECK (jsonb_typeof(board) = 'object'),
+  source             text        NOT NULL CHECK (source IN ('amendment', 'adopted_file', 'reapply')),
+  amendment_item_id  bigint      REFERENCES government_board_items(id) ON DELETE SET NULL,
+  updated_by         bigint      REFERENCES builders(id) ON DELETE SET NULL,
+  updated_at         timestamptz NOT NULL DEFAULT now()
+);
+
+COMMIT;

package/modules/government/module.json

@@ -17,7 +17,8 @@
     ],
     "pollers": [
       "board-expiry",
-      "treasury-borrow"
+      "treasury-borrow",
+      "constitution-restore"
     ]
   },
   "provides": [

package/modules/government/pollers/constitution-restore.js

@@ -0,0 +1,45 @@
+'use strict';
+
+// modules/government/pollers/constitution-restore.js — the constitution in force
+// comes back after a restart (task 1005140).
+//
+// A provisioned instance boots on a fresh container: the file the running
+// process reads its constitution from is gone, and without this the project
+// silently answers the day-one monarchy until somebody notices. So the FIRST
+// reconcile runs as soon as the poller starts, not after a delay — every moment
+// before it is a moment the wrong rule is in force. After that it re-checks on a
+// slow interval, which also keeps a second process in step with an amendment
+// another one applied.
+//
+// Quiet when in step; one line when it restores or adopts (constitution.js).
+
+const api = require('../../../src/module-api');
+const constitution = require('../constitution');
+
+const logger = api.logger('government');
+
+const INTERVAL_MS = Number(process.env.CONSTITUTION_RESTORE_SWEEP_MS) || 5 * 60_000;
+
+let intervalTimer = null;
+
+function start({ reconcileFn = constitution.reconcile } = {}) {
+  if (process.env.CONSTITUTION_RESTORE_DISABLED === '1') {
+    logger.info('[constitution-restore] disabled (CONSTITUTION_RESTORE_DISABLED=1)');
+    return;
+  }
+  if (intervalTimer) return;
+  const tick = () => {
+    Promise.resolve()
+      .then(() => reconcileFn({ log: (m) => logger.info(m), error: (m) => logger.error(m) }))
+      .catch((e) => logger.error(`[constitution-restore] reconcile crashed: ${e && e.message}`));
+  };
+  tick();
+  intervalTimer = setInterval(tick, INTERVAL_MS);
+  if (intervalTimer.unref) intervalTimer.unref();
+}
+
+function stop() {
+  if (intervalTimer) { clearInterval(intervalTimer); intervalTimer = null; }
+}
+
+module.exports = { start, stop, INTERVAL_MS };

package/modules/government/routes/government.js

@@ -36,6 +36,7 @@ const asksDb = require('../asks-db');
 const routing = require('../routing');
 const { accessHandlers } = require('../access-routes');
 const governmentConfig = require('../config');
+const constitution = require('../constitution');
 const membershipPredicate = require('../membership-predicate');
 const positions = require('../positions');
 const decisionBoard = require('../decision-board');
@@ -724,8 +725,7 @@ module.exports = function buildGovernmentRouter() {
   // the live board block plus the full amendment history, passed and returned
   // alike. Same atom as the room — reading the rule you vote under is part of
   // casting, and the section teaches (criterion C5). The live value resolves
-  // fresh per request, so an amendment applied a moment ago reads back
-  // immediately (the same instant-effect posture as everything else here).
+  // fresh per request, so an amendment applied a moment ago reads back at once.
   router.get('/government/constitution', api.requireBuilder, api.requirePermission('board.vote.cast'), async (req, res) => {
     try {
       // ?type= and ?headcount= ask about another project type or size (task
@@ -741,6 +741,9 @@ module.exports = function buildGovernmentRouter() {
     }
   });
 
+  // rank: perm government.manage — re-apply the newest PASSED amendment (task 1005140; constitution.js).
+  router.post('/government/constitution/reapply', api.requireBuilder, api.requirePermission('government.manage'), constitution.reapplyRoute(log));
+
   // rank: perm board.vote.cast — the founding band's read (task 1004429): each
   // genesis stage's latest sitting, and who it is still waiting on under the
   // item's own snapshot. Same atom as the room — seeing who is still to vote is
@@ -1454,11 +1457,7 @@ module.exports = function buildGovernmentRouter() {
         const status =
           out.reason === 'item_not_found' ? 404 :
           out.reason === 'not_board_member' ? 403 :
-          // 'anti_self_vote' was retired by task 1003273 — an author may cast;
-          // what they cannot do is decide alone, which the close trigger and the
-          // tally enforce rather than the route. The mapping is left OUT rather
-          // than kept "just in case": a reason castVote can no longer return
-          // would be dead code pretending to be a wall.
+          // 'anti_self_vote' was retired by task 1003273 (an author may cast, never decide alone) — left OUT on purpose.
 
           out.reason === 'item_closed' ? 409 :
           out.reason === 'vote_window_expired' ? 409 :
@@ -1486,6 +1485,7 @@ module.exports = function buildGovernmentRouter() {
         already_voted: !out.fresh,
         ...(out.fresh ? { karma_delta: out.karma_delta } : {}),
         ...(closure && closure.closed ? { item_closed: true, outcome: closure.outcome } : {}),
+        ...(closure && closure.constitution_not_applied ? { constitution_not_applied: closure.constitution_not_applied } : {}),
       });
     } catch (err) {
       log.error('[gds] POST /government/board/items/:itemId/votes', err);

package/modules/hall-ui/public/board-room.js

@@ -415,9 +415,13 @@
     }
     try {
       const out = await sendJson('POST', `/government/board/items/${encodeURIComponent(itemId)}/votes`, body);
-      toast(out.item_closed
-        ? `Vote cast — the sitting closed: ${out.outcome}.`
-        : 'Vote cast.');
+      // Task 1005140: a ratified change that did not take is said now, loudly,
+      // not weeks later in the Constitution tab's warning.
+      toast(out.constitution_not_applied
+        ? 'Passed, but the new constitution did not take effect. The old rules are still in force; the owner can re-apply it.'
+        : out.item_closed
+          ? `Vote cast — the sitting closed: ${out.outcome}.`
+          : 'Vote cast.');
     } catch (err) {
       if (err && err.kind === '401') return;
       toast(`Could not vote: ${err.message || err}`);

package/modules/hall-ui/public/street-card.js

@@ -801,6 +801,8 @@
       return { toast: 'Sent to the council. It is carried out when they pass it.', building: b, kind: 'light', close: false };
     }
     if (key === 'for') {
+      // Task 1005140: never say "in force" about a change that did not take.
+      if (r.item_closed && r.outcome === 'passed' && r.constitution_not_applied) return { toast: 'Passed, but it did not take effect. The old rules are still in force.', building: b, kind: 'settle', close: false };
       if (r.item_closed && r.outcome === 'passed') return { toast: 'Passed. It is in force from today.', building: b, kind: 'rise', close: false };
       if (r.item_closed) return { toast: 'The sitting closed: it went back to its author.', building: b, kind: 'settle', close: false };
       return { toast: r.already_voted ? 'Your vote was already on the record.' : 'Your yes is on the record.', building: b, kind: 'light', close: false };

package/modules/hall-ui/public/style.css

@@ -757,7 +757,7 @@ html[data-theme="dark"] .brand-mark__mark { --mark-ink: #e2e1e4; }
 .genesis__step-n { display: inline-grid; place-items: center; width: 16px; height: 16px; border-radius: 50%; font-size: 10px; background: var(--rule-soft); }
 .genesis__step.is-done { color: var(--ink-soft); }
 .genesis__step.is-now { color: var(--ink); border-color: color-mix(in srgb, var(--accent) 45%, transparent); background: color-mix(in srgb, var(--accent) 10%, transparent); }
-.genesis__step.is-now .genesis__step-n { background: var(--accent); color: var(--bg); }
+.genesis__step.is-now .genesis__step-n { background: var(--accent); color: var(--accent-on); }
 .genesis__plan, .genesis__stages, .genesis__tasks, .genesis__life { list-style: none; margin: 0; padding: 0; }
 .genesis__plan-row, .genesis__stage, .genesis__task { display: flex; align-items: center; gap: 12px; padding: 12px 0; border-top: 1px solid var(--rule-soft); }
 .genesis__plan-row:first-child, .genesis__stage:first-child, .genesis__task:first-child { border-top: 0; }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.71",
+  "version": "1.24.73",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.71",
+      "version": "1.24.73",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.71",
+  "version": "1.24.73",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11451,5 +11451,17 @@
       "id": "1002450",
       "text": "New projects can no longer be born on an outdated or mislabelled copy of the core. When the hub's saved core file is stale or doesn't match the published one, provisioning now says so loudly and uses the current, published cor"
     }
+  ],
+  "1.24.72": [
+    {
+      "id": "1005103",
+      "text": "The current step number in the project-setup steps is now dark ink on the orange dot, so it's readable in light mode too."
+    }
+  ],
+  "1.24.73": [
+    {
+      "id": "1005140",
+      "text": "When a project's board votes in a new form of government, that choice now stays in force after the server restarts. Before, it was quietly lost on every restart and the project fell back to the original one-person rule. A proj"
+    }
   ]
 }

package/scripts/bongos/government-walk.js

@@ -169,6 +169,7 @@ function makeStore(catalog) {
     items: [],
     votes: [],
     amendments: new Map(),
+    constitutionRow: null,
     matters: new Map(),
     leads: [], // { id, building, builder_id, charter, appointed_by_item_id, removed_by_item_id, removed_at }
     laws: [], // { id, text, effect_on_ai, locks, proposed_by, passed_by_item_id, passed_at, repealed_by_item_id, repealed_at }
@@ -298,6 +299,12 @@ function makeStore(catalog) {
       return copy(row);
     },
     async getAmendment(id) { return copy(s.amendments.get(String(id))) || null; },
+    // The constitution in force as a durable row (task 1005140).
+    async getConstitutionRow() { return copy(s.constitutionRow) || null; },
+    async saveConstitutionRow({ board, source, itemId = null, updatedBy = null } = {}) {
+      s.constitutionRow = { board: copy(board), source, amendment_item_id: itemId, updated_by: updatedBy };
+      return copy(s.constitutionRow);
+    },
     async listAmendmentHistory(limit = 50) {
       return s.items
         .filter((i) => i.subject_type === 'constitutional_amendment' && i.closed_at)

package/src/bongos/route-rank-check.js

@@ -297,6 +297,10 @@ const GOVERNMENT_PINS = {
   // R18: the Constitution view — the live rule + the amendment history; reading
   // the rule you vote under is part of casting.
   'GET /government/constitution': 'perm:board.vote.cast',
+  // task 1005140: put the newest PASSED constitutional amendment back into force
+  // (a container restart had erased it). Decides nothing — the board already did —
+  // so it is the owner's operational atom, not a board one.
+  'POST /government/constitution/reapply': 'perm:government.manage',
   // task 1004429: the founding band — who each genesis stage is waiting on. A
   // read of the open ballot, so the same atom as the room.
   'GET /government/board/genesis-stages': 'perm:board.vote.cast',

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.71'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.73'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');