@bongos/core 1.24.72 → 1.24.73

package/tests/government_charter_forms.mjs

@@ -200,7 +200,11 @@ test('the founder picks Direct Democracy and ratifies it: the amendment path wri
   const originalApply = config.applyBoardAmendment;
   const applied = [];
   config.applyBoardAmendment = (proposed) => { applied.push(proposed); fs.writeFileSync(target, JSON.stringify({ board: proposed })); return proposed; };
+  // The read-back after the apply (task 1005140) reads the same temp file.
+  const originalLoad = config.loadGovernmentConfig;
+  config.loadGovernmentConfig = (opts = {}) => originalLoad({ ...opts, instancePath: target });
   let filed = null;
+  let savedRow = null;
   const votes = [];
   try {
     await withDb({
@@ -216,6 +220,9 @@ test('the founder picks Direct Democracy and ratifies it: the amendment path wri
       closeBoardItem: async ({ outcome }) => ({ id: '21', subject_type: 'constitutional_amendment', subject_id: '5', opened_by: '42', closed_at: 'T', outcome }),
       insertAuthorRatifyKarma: async () => true,
       getAmendment: async () => ({ id: '5', proposed: filed.proposed }),
+      // The durable row (task 1005140) — written first, read back after.
+      saveConstitutionRow: async (args) => { savedRow = { board: args.board }; return savedRow; },
+      getConstitutionRow: async () => savedRow,
     }, async () => {
       const out = await board.proposeCharter({ form: 'direct-democracy', proposedBy: '42' });
       assert.equal(out.ok, true);
@@ -227,11 +234,14 @@ test('the founder picks Direct Democracy and ratifies it: the amendment path wri
       await board.castVote({ itemId: '21', voterId: '42', direction: 'yes' });
       const closed = await board.maybeCloseAfterVote('21');
       assert.equal(closed.outcome, 'passed');
+      assert.equal(closed.constitution_not_applied, undefined, 'read back: it is in force');
     });
     assert.deepEqual(applied, [filed.proposed], 'the ratified text is exactly what was filed');
     assert.equal(JSON.parse(fs.readFileSync(target, 'utf8')).board.membership, 'rank:xenos+');
+    assert.equal(savedRow && savedRow.board.membership, 'rank:xenos+', 'the durable row carries it too');
   } finally {
     config.applyBoardAmendment = originalApply;
+    config.loadGovernmentConfig = originalLoad;
     fs.rmSync(dir, { recursive: true, force: true });
   }
 });

package/tests/government_constitution_durable.mjs

@@ -0,0 +1,304 @@
+// tests/government_constitution_durable.mjs — a ratified constitution survives a
+// restart (task 1005140).
+//
+// Found live on toast, 2026-11-07: the board ratified a Timocratic Republic, the
+// amendment was written to <instance root>/config/government.json, and the next
+// container start (deploy, restart, or an idle wake on a free plan) erased the
+// file. The project went back to the day-one monarchy without an error.
+//
+// DB-free: the constitution row lives in an in-memory stand-in for db.js's two
+// functions; the instance pack is a REAL temp file, and "a restart" is deleting
+// it. The invariants:
+//
+//   1. A restart does not lose a ratified constitution — the row restores it.
+//   2. A file with no row is ADOPTED into the row (nobody loses one on upgrade).
+//   3. The row wins over a stale file.
+//   4. The row is written BEFORE the file, and a write that did not take is
+//      REPORTED at the close (constitution_not_applied), never absorbed.
+//   5. The operator's re-apply only ever re-applies a PASSED constitutional
+//      amendment — it cannot invent a block.
+//   6. The restore runs at boot, immediately.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GOV = path.join(ROOT, 'modules', 'government');
+const db = require(path.join(GOV, 'db.js'));
+const config = require(path.join(GOV, 'config.js'));
+const constitution = require(path.join(GOV, 'constitution.js'));
+const board = require(path.join(GOV, 'board.js'));
+
+const MONARCHY = Object.freeze({ membership: 'rank:archon', pass_rule: 'first_ratifier', window_minutes: null, close_early_on_full_turnout: true });
+const TIMOCRACY = Object.freeze({ membership: 'rank:metic+', pass_rule: 'consent', window_minutes: null, close_early_on_full_turnout: true });
+const quiet = { log: () => {}, error: () => {} };
+
+let seq = 0;
+const tmpPack = () => path.join(os.tmpdir(), `gov-durable-${process.pid}-${Date.now()}-${seq++}`, 'config', 'government.json');
+
+// One harness: an in-memory row, and the config's instance path redirected to
+// a temp file for both the write and the read — what a real process does with
+// its own INSTANCE_PATH.
+async function withInstance(fn, { row = null, saveFails = false, getFails = null, history } = {}) {
+  const pack = tmpPack();
+  const store = { row, saves: [] };
+  const orig = {
+    get: db.getConstitutionRow, save: db.saveConstitutionRow,
+    apply: config.applyBoardAmendment, load: config.loadGovernmentConfig,
+    list: db.listAmendmentHistory,
+  };
+  if (history !== undefined) db.listAmendmentHistory = async () => history;
+  db.getConstitutionRow = async () => { if (getFails) throw getFails; return store.row; };
+  db.saveConstitutionRow = async (args) => {
+    if (saveFails) throw new Error('connection refused');
+    store.saves.push(args);
+    store.row = { board: args.board, source: args.source, amendment_item_id: args.itemId };
+    return store.row;
+  };
+  config.applyBoardAmendment = (proposed, opts = {}) => orig.apply(proposed, { instancePath: opts.instancePath || pack });
+  config.loadGovernmentConfig = (opts = {}) => orig.load({ ...opts, instancePath: opts.instancePath || pack });
+  try { return await fn({ pack, store, live: () => orig.load({ instancePath: pack }).board }); }
+  finally {
+    db.getConstitutionRow = orig.get; db.saveConstitutionRow = orig.save; db.listAmendmentHistory = orig.list;
+    config.applyBoardAmendment = orig.apply; config.loadGovernmentConfig = orig.load;
+    fs.rmSync(path.dirname(path.dirname(pack)), { recursive: true, force: true });
+  }
+}
+
+const restart = (pack) => fs.rmSync(pack, { force: true });
+
+// ── 1. the bug itself ────────────────────────────────────────────────────────
+
+test('a ratified constitution survives a container restart (the toast bug)', async () => {
+  await withInstance(async ({ pack, store, live }) => {
+    const out = await constitution.recordRatified(TIMOCRACY, { itemId: '7' });
+    assert.equal(out.failure, null, `the ratified amendment took: ${JSON.stringify(out.failure)}`);
+    assert.deepEqual({ ...live() }, TIMOCRACY, 'in force right after the close');
+    assert.deepEqual(store.row.board, TIMOCRACY, 'the durable row holds it');
+    assert.equal(store.row.source, 'amendment');
+
+    restart(pack); // the container's filesystem is wiped
+    assert.deepEqual({ ...live() }, MONARCHY, 'fixture: with the file gone the process alone falls back to monarchy');
+
+    const r = await constitution.reconcile({ instancePath: pack, ...quiet });
+    assert.equal(r.action, 'restored');
+    assert.deepEqual({ ...live() }, TIMOCRACY, 'after the boot restore the board\'s decision is in force again');
+  });
+});
+
+// ── 2 + 3. adopt on first read; the row wins ─────────────────────────────────
+
+test('a file with no row is adopted into the database and the log says so', async () => {
+  await withInstance(async ({ pack, store }) => {
+    fs.mkdirSync(path.dirname(pack), { recursive: true });
+    fs.writeFileSync(pack, JSON.stringify({ ranks: { metic: { label: 'Trusted' } }, board: TIMOCRACY }));
+    const lines = [];
+    const r = await constitution.reconcile({ instancePath: pack, log: (m) => lines.push(m), error: () => {} });
+    assert.equal(r.action, 'adopted');
+    assert.deepEqual(store.row.board, TIMOCRACY);
+    assert.equal(store.row.source, 'adopted_file');
+    assert.ok(lines.some((l) => /adopted/.test(l)), 'the adoption is logged');
+    const again = await constitution.reconcile({ instancePath: pack, ...quiet });
+    assert.equal(again.action, 'in_step', 'a second pass changes nothing');
+  });
+});
+
+test('no row and no file is the vanilla instance: nothing is written', async () => {
+  await withInstance(async ({ pack, store }) => {
+    const r = await constitution.reconcile({ instancePath: pack, ...quiet });
+    assert.equal(r.action, 'none');
+    assert.equal(store.saves.length, 0);
+    assert.equal(fs.existsSync(pack), false, 'no file is invented for a vanilla instance');
+  }, { history: [] });
+});
+
+test('the toast case: no row, no file, a passed amendment — the first boot puts it back in force (part C)', async () => {
+  const history = [
+    { item_id: 30, amendment_id: 9, outcome: 'returned', proposed: MONARCHY, kind: 'constitution' },
+    { item_id: 21, amendment_id: 1, outcome: 'passed', proposed: TIMOCRACY, kind: 'constitution' },
+  ];
+  await withInstance(async ({ pack, store, live }) => {
+    assert.deepEqual({ ...live() }, MONARCHY, 'fixture: the erased instance answers the day-one monarchy');
+    const lines = [];
+    const r = await constitution.reconcile({ instancePath: pack, log: (m) => lines.push(m), error: () => {} });
+    assert.equal(r.action, 'recovered', JSON.stringify(r));
+    assert.equal(r.item_id, '21', 'the PASSED amendment, never the newer returned one');
+    assert.deepEqual({ ...live() }, TIMOCRACY, 'the board decision is in force again');
+    assert.deepEqual(store.row.board, TIMOCRACY, 'and durable, so the next restart keeps it');
+    assert.ok(lines.some((l) => /put back passed amendment 1/.test(l)), 'the log says so');
+    assert.equal((await constitution.reconcile({ instancePath: pack, ...quiet })).action, 'in_step');
+  }, { history });
+});
+
+test('the row wins over a stale file, and the file keeps its other keys', async () => {
+  await withInstance(async ({ pack, live }) => {
+    fs.mkdirSync(path.dirname(pack), { recursive: true });
+    fs.writeFileSync(pack, JSON.stringify({ ranks: { metic: { label: 'Trusted' } }, board: MONARCHY }));
+    const r = await constitution.reconcile({ instancePath: pack, ...quiet });
+    assert.equal(r.action, 'restored');
+    assert.deepEqual({ ...live() }, TIMOCRACY);
+    assert.equal(JSON.parse(fs.readFileSync(pack, 'utf8')).ranks.metic.label, 'Trusted', 'rank templates survive the restore');
+  }, { row: { board: TIMOCRACY, source: 'amendment' } });
+});
+
+test('an unmigrated database (no table) and an unreadable one never throw and never touch the file', async () => {
+  const missing = Object.assign(new Error('relation "government_constitution" does not exist'), { code: '42P01' });
+  await withInstance(async ({ pack }) => {
+    assert.equal((await constitution.reconcile({ instancePath: pack, ...quiet })).action, 'no_table');
+    assert.equal(fs.existsSync(pack), false);
+  }, { getFails: missing });
+  await withInstance(async ({ pack }) => {
+    assert.equal((await constitution.reconcile({ instancePath: pack, ...quiet })).action, 'read_failed');
+  }, { getFails: new Error('timeout') });
+});
+
+// ── 4. row first, and a write that did not take is reported ──────────────────
+
+test('the row is written before the file: a failed save leaves the old rule and SAYS so', async () => {
+  await withInstance(async ({ pack, live }) => {
+    const out = await constitution.recordRatified(TIMOCRACY, { itemId: '7' });
+    assert.equal(out.applied, null);
+    assert.ok(out.failure, 'reported, not absorbed');
+    assert.equal(out.failure.problems[0].where, 'database');
+    assert.equal(fs.existsSync(pack), false, 'nothing was put in force that would vanish at the next restart');
+    assert.equal(out.failure.problems[0].reason, 'save_failed');
+    assert.doesNotMatch(JSON.stringify(out.failure), /connection refused/, 'a voter sees a reason word, never the driver message');
+    assert.deepEqual({ ...live() }, MONARCHY);
+  }, { saveFails: true });
+});
+
+test('a file write that silently did not take is caught by the read-back', async () => {
+  await withInstance(async ({ store }) => {
+    config.applyBoardAmendment = (proposed) => ({ ...proposed }); // claims success, writes nothing
+    const out = await constitution.recordRatified(TIMOCRACY, { itemId: '7' });
+    assert.ok(out.failure, 'the verify caught it');
+    assert.deepEqual(out.failure.problems.map((p) => p.where), ['in_force']);
+    assert.deepEqual(out.failure.problems[0].fields, ['membership', 'pass_rule']);
+    assert.deepEqual(store.row.board, TIMOCRACY, 'the durable row still holds the decision, so a restore can finish the job');
+  });
+});
+
+test('closeItem hands a constitution that did not take back to the caller (and the vote route forwards it)', async () => {
+  const item = { id: '21', subject_type: 'constitutional_amendment', subject_id: '5', opened_by: '42', closed_at: null, expired: false, constitution: MONARCHY };
+  const stubs = {
+    getVotesForItem: async () => [{ id: '1', voter_id: '42', direction: 'yes' }],
+    closeBoardItem: async ({ outcome }) => ({ ...item, closed_at: 'T', outcome }),
+    getAmendment: async () => ({ id: '5', proposed: TIMOCRACY, kind: 'constitution' }),
+    insertAuthorRatifyKarma: async () => true,
+    getBoardItemAuthor: async () => '42',
+  };
+  const orig = {};
+  for (const [k, v] of Object.entries(stubs)) { orig[k] = db[k]; db[k] = v; }
+  try {
+    await withInstance(async () => {
+      const closed = await board.closeItem(item, { cause: 'vote' });
+      assert.equal(closed.outcome, 'passed');
+      assert.ok(closed.constitution_not_applied, 'the close itself reports it');
+      assert.equal(closed.constitution_not_applied.problems[0].where, 'database');
+    }, { saveFails: true });
+    await withInstance(async ({ live }) => {
+      const closed = await board.closeItem(item, { cause: 'vote' });
+      assert.equal(closed.constitution_not_applied, undefined, 'a clean apply reports nothing');
+      assert.deepEqual({ ...closed.applied_constitution }, TIMOCRACY);
+      assert.deepEqual({ ...live() }, TIMOCRACY);
+    });
+  } finally { for (const [k, v] of Object.entries(orig)) db[k] = v; }
+
+  const routeSrc = fs.readFileSync(path.join(GOV, 'routes', 'government.js'), 'utf8');
+  assert.match(routeSrc, /closure && closure\.constitution_not_applied \? \{ constitution_not_applied:/,
+    'the vote route forwards it to the page the voter is standing on');
+  for (const page of ['board-room.js', 'street-card.js']) {
+    const src = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', page), 'utf8');
+    assert.match(src, /constitution_not_applied/, `${page} says so instead of "in force"`);
+  }
+});
+
+// ── 5. the operator's re-apply ───────────────────────────────────────────────
+
+test('re-apply puts the newest PASSED constitutional amendment back, skipping returned ones and laws', async () => {
+  const history = [
+    { item_id: 30, amendment_id: 12, outcome: 'returned', proposed: MONARCHY, kind: 'constitution' },
+    { item_id: 29, amendment_id: 11, outcome: 'passed', proposed: { enact: [] }, kind: 'laws' },
+    { item_id: 21, amendment_id: 1, outcome: 'passed', proposed: TIMOCRACY, kind: 'constitution' },
+  ];
+  const origList = db.listAmendmentHistory;
+  db.listAmendmentHistory = async () => history;
+  try {
+    await withInstance(async ({ store, live }) => {
+      const out = await constitution.reapplyNewestPassed({ updatedBy: '3' });
+      assert.equal(out.ok, true, JSON.stringify(out));
+      assert.equal(out.item_id, '21');
+      assert.deepEqual({ ...live() }, TIMOCRACY);
+      assert.equal(store.row.source, 'reapply');
+      assert.equal(store.saves[0].updatedBy, '3');
+    });
+    db.listAmendmentHistory = async () => history.slice(0, 2);
+    await withInstance(async ({ store }) => {
+      const out = await constitution.reapplyNewestPassed({});
+      assert.deepEqual(out, { ok: false, reason: 'no_passed_amendment' });
+      assert.equal(store.saves.length, 0, 'it never invents a constitution');
+    });
+  } finally { db.listAmendmentHistory = origList; }
+});
+
+test('the re-apply route is pinned to the owner atom and takes no block from the request', () => {
+  const { GOVERNMENT_PINS } = require(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'));
+  const pins = GOVERNMENT_PINS || {};
+  const src = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'), 'utf8');
+  assert.match(src, /'POST \/government\/constitution\/reapply': 'perm:government\.manage'/);
+  if (Object.keys(pins).length) assert.equal(pins['POST /government/constitution/reapply'], 'perm:government.manage');
+  const routeSrc = fs.readFileSync(path.join(GOV, 'routes', 'government.js'), 'utf8');
+  assert.match(routeSrc, /router\.post\('\/government\/constitution\/reapply', api\.requireBuilder, api\.requirePermission\('government\.manage'\), constitution\.reapplyRoute\(log\)\)/,
+    'the route exists, gated on the owner atom');
+  assert.doesNotMatch(constitution.reapplyRoute.toString(), /req\.body/, 'the block comes from a passed amendment, never the request');
+});
+
+test('the re-apply handler answers 404 with nothing passed and 200 with the board it put back', async () => {
+  const call = async () => {
+    const res = { code: 200, body: null,
+      status(c) { this.code = c; return this; }, json(b) { this.body = b; return this; },
+      fail(code, status, extra) { this.code = typeof status === 'number' ? status : status.status; this.body = { code, ...extra }; return this; } };
+    await constitution.reapplyRoute({ error: () => {} })({ builder: { id: '3' }, body: { board: MONARCHY } }, res);
+    return res;
+  };
+  const origList = db.listAmendmentHistory;
+  try {
+    db.listAmendmentHistory = async () => [];
+    await withInstance(async () => {
+      const res = await call();
+      assert.equal(res.code, 404);
+      assert.equal(res.body.code, 'no_passed_amendment');
+    });
+    db.listAmendmentHistory = async () => [{ item_id: 21, amendment_id: 1, outcome: 'passed', proposed: TIMOCRACY, kind: 'constitution' }];
+    await withInstance(async ({ live }) => {
+      const res = await call();
+      assert.equal(res.code, 200);
+      assert.deepEqual({ ...res.body.board }, TIMOCRACY, 'the passed amendment, not the request body');
+      assert.deepEqual({ ...live() }, TIMOCRACY);
+    });
+  } finally { db.listAmendmentHistory = origList; }
+});
+
+// ── 6. at boot ───────────────────────────────────────────────────────────────
+
+test('the restore runs the moment the poller starts, not after a delay', () => {
+  const poller = require(path.join(GOV, 'pollers', 'constitution-restore.js'));
+  let calls = 0;
+  poller.start({ reconcileFn: async () => { calls += 1; return { action: 'in_step' }; } });
+  try {
+    return new Promise((resolve) => setImmediate(() => { assert.equal(calls, 1); resolve(); }));
+  } finally { poller.stop(); }
+});
+
+test('the module declares the poller and the migration creates the one-row table', () => {
+  const manifest = JSON.parse(fs.readFileSync(path.join(GOV, 'module.json'), 'utf8'));
+  assert.ok(manifest.contributes.pollers.includes('constitution-restore'));
+  const sql = fs.readFileSync(path.join(GOV, 'migrations', 'government_037_constitution.sql'), 'utf8');
+  assert.match(sql, /CREATE TABLE IF NOT EXISTS government_constitution/);
+  assert.match(sql, /CHECK \(id = 1\)/, 'one row, by construction');
+});

package/tests/government_seed.mjs

@@ -53,6 +53,7 @@ const NON_GRANT_MIGRATIONS = new Set([
   'government_031_treasury.sql',                   // the treasury: a pot per goal and the loans a dry pot asks the reserve for (task 1004712)
   'government_032_ask_flags.sql',                  // the reword list: matters a reader flagged as unclear (owner 2026-10-23)
   'government_036_access_holders.sql',             // who holds the keys outside Bongos + the access:<key> ask seat (task 1005000)
+  'government_037_constitution.sql',               // the constitution in force as a durable row (task 1005140)
 ]);
 
 // Permission keys RENAMED after the grant migrations that first granted them.