@bongos/core 1.19.20 → 1.19.22

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.20",
-  "core_contract": "1.19.20",
-  "source_commit": "d355706e8d215aa4e9b9ee249ef71670aa067e17",
+  "core_version": "1.19.22",
+  "core_contract": "1.19.22",
+  "source_commit": "e089ef90ffdf1b4da4f4a6b7f70d0fb10426bf42",
   "source_ref": "HEAD",
-  "built_at": "2026-08-10T01:27:05.376Z",
+  "built_at": "2026-08-11T01:24:29.274Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 284,
+    "docs_redacted": 285,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1203,
+    "functional_verbatim": 1204,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1508,
-  "tree_sha256": "793f4a63c1a41cbfbc18422b85bf8f21249f8fe051e8cd6a738b84f0139f5089",
+  "file_count": 1510,
+  "tree_sha256": "0a775991e628ae986369cd819f6b384887fa20c1095f7e7263f07f13ad0e8167",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1264,10 +1264,15 @@
       "mode": "0000644",
       "sha256": "056633fe7521143b0e8ba89297426ffd7253deb9ae5aa2fad65c3dfbffddc44f"
     },
+    {
+      "path": "docs/adr/0162-review-gates-retired-rank-consistent-ci-only.md",
+      "mode": "0000644",
+      "sha256": "f6176799c7731da3d4970b75e882e0ab88e31b1a412c87957b9a5085bfc799c7"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "165327e0c447cf9e549ba9389bc7eed6406a64631a9e2d714f7eb3ee80af8be0"
+      "sha256": "b3ed6866c5042d2ee2f1c5680af8d6ef85d36c70a4f9e208eac2e5922461f6dc"
     },
     {
       "path": "docs/api-reference.md",
@@ -1297,7 +1302,7 @@
     {
       "path": "docs/canonical-permissions.md",
       "mode": "0000644",
-      "sha256": "f57f118f5b863a82895129c70311a7c87e5424e22a793b82c637db2ee7e345a0"
+      "sha256": "dd85972912629d370d8fc79eff1661001e6b4ba9abe9866181c14fb0782c3131"
     },
     {
       "path": "docs/design-contract.md",
@@ -2792,7 +2797,7 @@
     {
       "path": "modules/governance/routes/governance.js",
       "mode": "0000644",
-      "sha256": "6f600bb237009064f18eae7af140cd8376cf5770ff7efd89d0e4071bade9eb4d"
+      "sha256": "2b390c2c51812aa547f85045fe6d36be6c53086f3fa2468ab7c20c4a7d19dc08"
     },
     {
       "path": "modules/governance/routes/role-sync.js",
@@ -3242,12 +3247,12 @@
     {
       "path": "modules/hall-ui/public/shell.js",
       "mode": "0000644",
-      "sha256": "00a356cf20df11fd195c8ecce619ba5e4bc4138ccb3b66ebdef1522fa3f56c8e"
+      "sha256": "56c1450dd72fcda19841f3a0a98b918b1b875f49971e93d60218fb62e8a21dad"
     },
     {
       "path": "modules/hall-ui/public/style.css",
       "mode": "0000644",
-      "sha256": "9fa49a72160d8dd156bba5f55d2300b9188ea9ae133a6dfb8ab13f3cdc2ab76d"
+      "sha256": "41fbe46c9bbc6e9a4397733c070cb2d5e7bfd698d629445f786a44c44a35b0c4"
     },
     {
       "path": "modules/hall-ui/public/task-detail.js",
@@ -3347,7 +3352,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "44cdb3c44dcf9277e9e0661d664387f0497e7d9b11c9775e1133aeec0da9db9f"
+      "sha256": "7dc50e4e88a204583c753555c76f4103df405a143c4266dbff53793c292803f9"
     },
     {
       "path": "modules/lifecycle/done-when.js",
@@ -3997,12 +4002,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "d4a29f817b3eaff3cfc617413d909abe57556a519646db6f8e2bc0baeaeb01da"
+      "sha256": "f85ec26a3a5cbefec1aca8407043cb2eb2886120722a79126d364736f1a67584"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "b13a7ca8bef83027862f8b1aad071c74ec362bd85a1246050e7bc434fd96d346"
+      "sha256": "9275da3329d188788a0e69b719231cd23ae38b3499802edbcefebded17317067"
     },
     {
       "path": "public-docs/index.html",
@@ -4502,7 +4507,7 @@
     {
       "path": "scripts/gds/bump-version.js",
       "mode": "0000644",
-      "sha256": "91664a0a1338ded41b780179c16040e2c686f6ab92304891cb1bc6ef3ca805b6"
+      "sha256": "9709fcffab1d386c174666788687b1dfd974f141ab552ffd5641abd690259619"
     },
     {
       "path": "scripts/gds/capture.js",
@@ -4692,7 +4697,7 @@
     {
       "path": "scripts/gds/gating.js",
       "mode": "0000644",
-      "sha256": "5de3e4129006035e844efd4c5a2147060228fe6c73fe0bbbf1ead72af2cc405c"
+      "sha256": "a304965e79b5ab717626bfb9c74358334576c69f5aefcefa059d46a092f46172"
     },
     {
       "path": "scripts/gds/gds-db-backup.service",
@@ -4782,7 +4787,7 @@
     {
       "path": "scripts/gds/init.js",
       "mode": "0000644",
-      "sha256": "a58a741f11ea7d34396dcb9e242825bf88326ca2709b7c726a91b06f60f9c24c"
+      "sha256": "e9fbb7ae477a445252f1171851be93fca14f58e4906d030c93d09b37d517ac20"
     },
     {
       "path": "scripts/gds/install-git-hooks.js",
@@ -5192,7 +5197,7 @@
     {
       "path": "scripts/gds/ship.js",
       "mode": "0000644",
-      "sha256": "bea8a5d8698abf30064c005076c069d470203c86a37a1ff7a3aebc4a5ded19a6"
+      "sha256": "65af2a0d6fc54ee3dbb3c7faa44796fed2a5817fa48073cebfd9d6a15837fec7"
     },
     {
       "path": "scripts/gds/smoke-batch-claim.sh",
@@ -5387,7 +5392,7 @@
     {
       "path": "src/bongos/auth.js",
       "mode": "0000644",
-      "sha256": "60888e8a84fc109ce258256ed7c0af13a8a453464b4f71716bc3a018a89f1b1a"
+      "sha256": "95428c88621510a97a5bfaf89a836508501b1db0f0910f529a260fa2dafce3b5"
     },
     {
       "path": "src/bongos/cascade-dispatch.js",
@@ -5622,7 +5627,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "8a34aa5b02db59b8ba5e821be8a0f38c8e6a66f10fccf728187f150ce87e86b3"
+      "sha256": "937021d749587baee02de0c83fa721b99a0e23850c5c12aa5332424673e5d6af"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -5997,7 +6002,7 @@
     {
       "path": "tests/bump_version.mjs",
       "mode": "0000644",
-      "sha256": "d8493f101a0009dd550c1ccf126e5ceb6433013257aa4f307ca68b00788dc77e"
+      "sha256": "98ec16d513074b30de8cd897143e4a3df1b3e54132a09d015b99e13e870de384"
     },
     {
       "path": "tests/cap_newcomer_tasks.mjs",
@@ -6359,6 +6364,11 @@
       "mode": "0000644",
       "sha256": "a5ca654f46407a3172cfa981f399c159c2769b440058eca509f568111614b00c"
     },
+    {
+      "path": "tests/gating_review_retired.mjs",
+      "mode": "0000644",
+      "sha256": "53cd6df5521ee48909b217483163bdf52ecfcc9aa5267f0b8a213c2b4b0f76bc"
+    },
     {
       "path": "tests/gen_freshness.mjs",
       "mode": "0000644",
@@ -6502,7 +6512,7 @@
     {
       "path": "tests/governance_page_gates.mjs",
       "mode": "0000644",
-      "sha256": "cf0d01b58a209d9d2ad64e2c1c999ce2338fb0f69bb5ddff43ca7f24d7bc66be"
+      "sha256": "be6cc9a4070d9de107cd11bfcb7a38e074f8aeb71198839cd42438d3ea2a0c04"
     },
     {
       "path": "tests/governance_parity.mjs",
@@ -6522,7 +6532,7 @@
     {
       "path": "tests/governance_require_permission.mjs",
       "mode": "0000644",
-      "sha256": "58090f6e6cb0cb7e99b03675deeb80302986b053dc1402e254f64ae4126df084"
+      "sha256": "2e8d7f3bb58411efd79727f6edffa448136551ef1c3c6973228fdfa7903f7cb3"
     },
     {
       "path": "tests/governance_resolver.mjs",
@@ -7157,7 +7167,7 @@
     {
       "path": "tests/reward_gate.mjs",
       "mode": "0000644",
-      "sha256": "ace9bb9db5a25b98de4d62f5150fb17db345d78e747aca95a6628dcd2a957afe"
+      "sha256": "7ae4d9af4d389c34f0d16f921858cbbf5d0d57f3219f830d10552ebcdc43908f"
     },
     {
       "path": "tests/reward_mode_cost_plus_only.mjs",

package/docs/adr/0162-review-gates-retired-rank-consistent-ci-only.md

@@ -0,0 +1,67 @@
+# ADR 0162 — Review gates retired: rank-consistent CI checks only on `main`
+
+**Date:** 2026-08-10
+**Context:** Owner directive (jaxri, Archon), recorded live 2026-08-08–10; idea 1000657 → task 1002635. Amends ADR 0159 (which introduced CODEOWNERS) and the gating posture of ADR 0058/0042.
+**Status:** Accepted. The live half (dropping `require_code_owner_reviews` from branch protection) was applied by the repo-admin account on 2026-08-10 and verified behaviorally (a probe PR touching a formerly-owned path read `mergeStateStatus: CLEAN` on a green `unit` check — PR 32, closed unmerged). This ADR lands the repo half so no re-arm path resurrects the gate.
+
+## The incident that forced the decision
+
+Wave 3 of the rank choke-point remediation built the merge gates inert (required `unit`
+check, `gating.js`, a CODEOWNERS file scoped to the gate-review HARD_FLOOR_GLOBS); task
+1002619 armed them. Within a day, the code-owner review requirement had stranded two
+graded-PASS wave-4 ships (PR 28 sat `BLOCKED` behind a review only the `example-owner` account
+could give) and then blocked the fix for the strand it caused (the ship.js ci-land fix,
+task 1002629, and the release-cascade fix, task 1002636, both touch owned paths).
+
+The mechanics are structural, not incidental. GitHub can only express the gate as
+**accounts** — it has no concept of GDS ranks; PR authors cannot approve their own PRs;
+and on this instance nearly every PR is authored by agent sessions running under the
+owner-archon's daily login. So "code-owner review" degenerates into "one specific
+GitHub account must click on every gate-surface PR," which is:
+
+1. **Identity-pinned, not rank-based** — against the instance's governance principle
+   (ADR 0016; the no-hardcoded-Archon-identity rule).
+2. **The opposite of the remediation's goal.** The owner's words: builders should have
+   *fewer* rank-related shipping problems, not more; a code-owners layer "can only
+   create shipping problems for builders."
+
+## Decision
+
+Review requirements on `main` are **retired permanently**:
+
+- Branch protection carries **required status checks only** (today: `unit`; the
+  `secret-scan` / `gate-review` contexts join when their workflows ship — ADR 0058).
+- `gating.js` `DEFAULT_PROTECTION` sets `required_pull_request_reviews: null`, and
+  `cmdOn` **normalizes both restore paths** (snapshot and default) to null — a snapshot
+  taken while the review gate was live must not resurrect it on an off/on cycle.
+- The `CODEOWNERS` file is **deleted**. The `CODEOWNERS` *glob* stays in
+  `gate-review.js` `HARD_FLOOR_GLOBS`, `protected-surfaces.json`, and the publish
+  denylist — so reintroducing the file is itself a flagged gate-surface change, and the
+  hard-floor path list keeps protecting the same surfaces where it actually enforces
+  (the sandbox gate).
+
+## What now guards the safety machinery
+
+The compensating controls are all rank-consistent and automatic:
+
+| Control | When it bites | Fails |
+|---|---|---|
+| required `unit` check (suite + fitness) | before every merge | closed |
+| gate-review sandbox (task 1002607) | agent ship flow on hard-floor paths | closed |
+| subagent grader panel | every GDS ship | closed |
+| post-merge main-audit (task 1002612, every push) | after any merge, incl. a bypass | audit + revert |
+
+## Consequences
+
+- **Positive:** no human click anywhere in the land path; a graded-PASS ship lands on
+  CI alone; the wave-4/-5 strand class cannot recur; the gate posture matches the
+  rank-first governance principle.
+- **Negative / accepted trade:** there is **no pre-merge human approval on
+  safety-machinery changes**. A compromised or prompt-injected session whose work
+  passes the unit check reaches `main`, and is caught *after* merge by the main-audit
+  rather than before. The owner chose this trade explicitly (2026-08-08, reaffirmed
+  2026-08-10) with the mitigations above in place.
+- **Reversal path:** re-add a CODEOWNERS file, restore a `required_pull_request_reviews`
+  block in `gating.js`, remove the `cmdOn` normalization, and re-apply protection from
+  an admin account. All four are deliberate steps — the gate cannot come back by
+  accident, which is the point of the normalization.

package/docs/adr/README.md

@@ -233,5 +233,6 @@ This keeps the decision history honest and traceable.
 
 | 0160 | [**The authoritative main audit gets a repo-verifiable caller** ([task 1002612](https://cloudbongos.com/builders#/task/1002612)). Findings G-3 + G-8, honest limit S-1: `main-audit.js` — the post-push layer [ADR 0043](<redacted>.md) designates authoritative — had two declared invokers that never existed in this git history, and `audit-authorship.sh` (the no-hardcoded-Archon-identity enforcer) had no caller either and turned out red with 340 pre-existing hits on untouched main (idea 1000653). Now a `main-audit` workflow audits every push to `main` over exactly the pushed `before..after` range (clamped-window fallback); the roster comes from the public leaderboard when no session exists (server-authoritative, login-only keying, an absent builder resolves as unresolved — never falsely trusted); new `--require-roster` makes an empty roster a loud DID-NOT-RUN exit 2 (an audit that cannot fire a blocker must not exit green); the lane runs non-strict per the audit's own zero-false-positive calibration; and `audit-authorship.sh` rides as an advisory job until the 1000653 triage. Detective lane, not a merge gate — deliberately outside the required PR contexts. Rider: the known-failing ratchet caught task 1002611's publish_manifest fix exactly as designed — entry removed, ceiling ratcheted 3 → 2, remaining entries re-owned to [task 1002617](https://cloudbongos.com/builders#/task/1002617), idea 1000542 superseded. Rejected: a GDS token secret (silent-fail dependency the devcontainer lane warned about), `--strict` in CI (permanent red rots into wallpaper), enforcing authorship before triage.](<redacted>.md) | governance / build pipeline |
 | 0161 | [**Publish on merge: every merge to core `main` auto-publishes `@bongos/core`** (task 1002620). Supersedes ADR 0137's manual owner-gated publish after its own "when to revisit" clause fired twice in three weeks: 171 commits/10 days, then 104 commits/5 days, sat on `main` reachable by no pin while every layer reported success. A `publish` workflow rides behind the required `unit` check (`workflow_run`, success-gated): when HEAD's `CORE_VERSION` is already on npm, CI bumps a PATCH via the shape-preserving `bump-version.js` (+ changelog line; pinned by `tests/bump_version.mjs`) and pushes the carrier commit; `package-core --self-verify --publish --live` builds through the fail-closed no-leak gate; the release is tagged `core-v<v>`. A MINOR/MAJOR stays a human in-task edit — it decides what patch-channel subscribers receive unattended (ADR 0136), a call CI must not make. Token custody knowingly reverses (owner-accepted): `NPM_TOKEN` write + `RELEASE_PUSH_TOKEN` PAT as Actions secrets, mitigated by the lane shipping INERT behind the `PUBLISH_ON_MERGE=1` repo variable — an owner kill-switch symmetrical to `gating.js`. Idempotent by version-compare; npm duplicate rejection is the backstop; queued no-cancel concurrency collapses merge races.](<redacted>.md) | build pipeline / distribution |
+| 0162 | [**Review gates retired: rank-consistent CI checks only on `main`** ([task 1002635](https://cloudbongos.com/builders#/task/1002635); owner directive, idea 1000657). Amends ADR 0159. Within a day of task 1002619 arming the merge gates, the code-owner review requirement had stranded two graded-PASS wave-4 ships (PR 28 sat BLOCKED behind a review only the repo-owner account could give) and then blocked the fixes for the strands it caused — structurally, not incidentally: GitHub can only express the gate as *accounts* (no rank concept, no self-approval), so on a solo-archon instance it degenerates into "one named login must click every gate-surface PR" — identity-pinned authority, against ADR 0016's rank principle and the remediation's own goal. Decision: branch protection carries required status checks ONLY; `gating.js` `DEFAULT_PROTECTION` sets `required_pull_request_reviews: null` and `cmdOn` normalizes BOTH restore paths so a pre-retirement snapshot cannot resurrect the gate (`tests/gating_review_retired.mjs` pins it with a counter-example); the CODEOWNERS *file* is deleted while its *glob* stays in the hard-floor lists so reintroducing it is itself gate-flagged. Accepted trade, chosen explicitly by the owner: no pre-merge human approval on safety-machinery changes — the unit check, the fail-closed gate-review sandbox, the grader panel, and the every-push main-audit are the net, catching a compromised session's merge after the fact rather than before.](<redacted>.md) | governance / build pipeline |
 
 > ⚠️ **Numbering collision (known):** two ADRs share `0008`. The numbers were assigned in parallel sessions before the lock could be enforced. The files are kept under their existing filenames to preserve git history, but the table disambiguates them as `0008-a` / `0008-b`. New ADRs should resume at `0040` to avoid further collisions. (`0024` is also a real on-disk duplicate: the cloneable-repo/local-first-memory ADR and the multi-agent-system-architecture ADR were both numbered `0024` in parallel; both keep their filenames, disambiguated as `0024-a` / `0024-b` like `0008`. Likewise `0025` ended up with two on-disk files — the offsite-backup ADR and the structured-criterion↔task-link ADR — both kept under their existing filenames and disambiguated as `0025-a` / `0025-b`; separately, the BFG ADR had also claimed `0025` on 2026-05-30 and yielded to `0026`. A third happened 2026-06-06: `0036` was claimed in parallel by the builders-subdomain ADR ([#726](https://example.com/builders#/task/726)) and this Discord-channels ADR ([#727](https://example.com/builders#/task/727)); the Discord-channels ADR yielded to `0037`. A fourth landed 2026-06-10: `0044` was claimed in parallel by the palette-replacement ADR and the per-box game-preview ADR ([#897](https://example.com/builders#/task/897)); both keep their filenames, disambiguated as `0044-a` / `0044-b` like `0008`. A fifth was caught pre-land 2026-06-13: `0050` was claimed in parallel by the device-flow-admission ADR ([#1000](https://example.com/builders#/task/1000)) and the sandbox-for-everyone ADR ([#1001](https://example.com/builders#/task/1001)); the latter yielded to `0052` before merging, so there is no `0050` duplicate. A sixth was caught pre-land 2026-06-21: the tool-agnostic-design-layer ADR ([#1375](https://example.com/builders#/task/1375)) first collided at `0079` with the value-gated-autonomous-engagement ADR, then at `0080` with the llm-cache-api-transport ADR (both part of the 0075–0080 LLM-cost-reduction series, landed on `main` in parallel); it yielded to `0081` before merging, so there is no `0079`/`0080` design-layer duplicate. A seventh landed 2026-06-23: `0084` was claimed in parallel by the auto-derived-per-task-rank-floor ADR and the remove-default-spend-cap ADR (task 1499); the rank-floor ADR landed on `main` first, so the spend-cap ADR yielded to `0085`, leaving no `0084` duplicate. An eighth landed 2026-06-27: `0095` was claimed in parallel by the borrowed-memory-and-retrieval-concepts ADR (PR #459, landed first) and the cross-agent-context-management ADR ([#1651](https://example.com/builders#/task/1651), PR #460); both keep their filenames, disambiguated as `0095-a` / `0095-b` like `0008`. These two are companions — `0095-a` adopts the memory/retrieval concepts and explicitly defers the grep-vs-semantic question to `0095-b`.)

package/docs/canonical-permissions.md

@@ -250,11 +250,14 @@ Authority over *the code itself* rides the same ladder, enforced server-side fro
 
 ADR 0016's per-request rank check covers `/api/gds/*` only. Two surfaces it does **not** cover —
 `git push` to `main` and `ssh` to the droplet — were used in the Builder 25 incident to land an
-un-graded tiering change straight on prod `main`. The repo is a free-plan private repo, so GitHub
-branch protection is unavailable; the enforcement is therefore code-side, in three layers (ADR 0043).
-**Verified still true 2026-07-24** — no classic protection, no rulesets, no CODEOWNERS, and a
-non-admin merged PR #19 to `main` with zero required checks; see ADR 0043 §"Branch-protection status"
-for the probes. `main-audit.js` is therefore still the *authoritative* layer, not a backup one:
+un-graded tiering change straight on prod `main`. **Since 2026-08-08 (task 1002619), `main` HAS
+live branch protection: the required `unit` status check blocks every direct push, so all work
+lands via PR.** The protection is *checks-only* — a code-owner review requirement was briefly
+enforced and then deliberately retired by the owner (ADR 0162, task 1002635): gates are
+rank-consistent CI checks, never a named human's approval. (The 2026-07-24 state — no protection
+at all, PR #19 merged with zero checks — is preserved in ADR 0043 §"Branch-protection status" as
+history.) `main-audit.js` remains the authoritative *post-merge* layer — it catches what any
+pre-merge gate misses, independent of the builder's cooperation:
 
 - A builder **below Metic** (`xenos`, `thetes`) may **not modify permission-sensitive paths** — the
   rank/authz machinery, the ship/grade/deploy pipeline, DB `migrations/`, `infra/`, and the

package/modules/governance/routes/governance.js

@@ -62,6 +62,9 @@ const governancePort = {
   isSystem: catalog.isSystem,
   isGrantable: catalog.isGrantable,
   permissionKeys: catalog.permissionKeys,
+  // The seeded floor of one atom, for denial text that names the rank instead of
+  // only the atom (task 1002613). Null for principal keys and unknown keys.
+  permissionFloor: (key) => (catalog.byKey(key) || {}).floor || null,
   resolvePrincipalPermissions: resolver.resolvePrincipalPermissions,
   principalHasPermission: resolver.principalHasPermission,
   isPrincipalKey: catalog.isPrincipalKey,

package/modules/hall-ui/public/shell.js

@@ -360,6 +360,36 @@
     applyZoom();
   }
 
+  // task 1002613 (map N-1): a server page-gate denial lands here with
+  // ?denied=<permission>[&reason=unavailable]. Render the refusal — "you are
+  // signed in; you lack X" — then strip the query so a refresh or a shared link
+  // doesn't re-show a stale notice. Cosmetic only; the gate already ran.
+  function renderDeniedNotice() {
+    // Hand-parsed (no URLSearchParams): shell.js is dependency-free by design,
+    // and the hall unit tests boot it in a bare vm context.
+    var search = (window.location && window.location.search) || '';
+    var m = /[?&]denied=([^&]+)/.exec(search);
+    if (!m) return;
+    var denied = decodeURIComponent(m[1]);
+    if (!/^[a-z0-9_.-]{1,80}$/i.test(denied)) return;
+    var unavailable = /[?&]reason=unavailable(?:&|$)/.test(search);
+    var topbar = document.getElementById('app-topbar');
+    if (!topbar) return;
+    var el = document.createElement('div');
+    el.className = 'denied-notice';
+    el.setAttribute('role', 'status');
+    el.innerHTML =
+      '<span>' + (unavailable
+        ? 'You’re signed in, but access to that page couldn’t be verified just now (the permission system didn’t answer), so it stayed closed. Try again in a minute.'
+        : 'You’re signed in, but that page needs the <code>' + esc(denied) + '</code> permission — your current role doesn’t hold it.') +
+      '</span>' +
+      '<button type="button" class="denied-notice__close" aria-label="Dismiss">×</button>';
+    el.querySelector('.denied-notice__close').addEventListener('click', function () { el.remove(); });
+    topbar.insertAdjacentElement('afterend', el);
+    var rest = search.replace(/[?&](?:denied|reason)=[^&]*/g, '').replace(/^&/, '?');
+    history.replaceState(null, '', window.location.pathname + rest + window.location.hash);
+  }
+
   function renderFoot() {
     var el = document.getElementById('app-foot');
     if (!el) return;
@@ -615,6 +645,7 @@
 
   renderSidebar();
   renderTopbar();
+  renderDeniedNotice();
   renderFoot();
   applyTheme();
   applyZoom();

package/modules/hall-ui/public/style.css

@@ -455,6 +455,30 @@ button { font-family: var(--font-body); }
   overflow: hidden;
   text-overflow: ellipsis;
 }
+/* Page-gate denial notice (task 1002613, map N-1) — rendered by shell.js from
+   the ?denied= query a refused page redirect carries. */
+.denied-notice {
+  display: flex;
+  align-items: baseline;
+  gap: 12px;
+  padding: 10px 24px;
+  font-size: 13px;
+  color: var(--warn);
+  background: var(--warn-weak);
+  border-bottom: 1px solid var(--border);
+}
+.denied-notice code {
+  font-size: 12px;
+}
+.denied-notice__close {
+  margin-left: auto;
+  border: 0;
+  background: none;
+  color: inherit;
+  font-size: 16px;
+  line-height: 1;
+  cursor: pointer;
+}
 .topbar-menu {
   display: none;
   align-items: center;

package/modules/lifecycle/db.js

@@ -42,7 +42,7 @@ const doneWhen = require('./done-when.js');
 const { generalGoalTitle } = require('./goal-advisory.js');
 // BV1.R106 (ADR 0151): the permission-expressed QUEUE axis of claim eligibility.
 // Kept deliberately separate from the per-task requires_rank floor below.
-const { claimEligibilityAllows } = require('./claim-eligibility.js');
+const { claimEligibilityAllows, CLAIM_ANY, CLAIM_NEWCOMER } = require('./claim-eligibility.js');
 // Pure kernel-adjacent matchers via the doorway (never the core file).
 const { matchProtected } = api.permissionPathCheck;
 const { touchesOverlap } = api.pathMatch;
@@ -2572,7 +2572,23 @@ async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSess
     // task.claim.any / task.claim.newcomer — see ./claim-eligibility.js.
     const newcomerFriendly = task.newcomer_friendly;
     if (!claimEligibilityAllows({ heldPermissions, newcomerFriendly, rankRuleAllows: xenosClaimAllowed(builderRank, newcomerFriendly) })) {
-      throw { code: 'rank_too_low_for_task', legacy_code: 'XENOS_RESTRICTED' };
+      // task 1002613 (map §4.4): the bare code reported a PERMISSION decision as
+      // a rank one — no axis, no remedy. Copy INSUFFICIENT_RANK's shape below:
+      // name both sides of the wall and the way forward.
+      const opened = newcomerFriendly === true;
+      throw {
+        code: 'rank_too_low_for_task',
+        legacy_code: 'XENOS_RESTRICTED',
+        required: opened ? [CLAIM_ANY, CLAIM_NEWCOMER] : [CLAIM_ANY],
+        actual: builderRank,
+        newcomer_friendly: opened,
+        message: opened
+          ? `claiming this task needs ${CLAIM_ANY} or ${CLAIM_NEWCOMER}, and your role holds neither`
+          : `this task is not opened to newcomers (newcomer_friendly is not set) and your role lacks ${CLAIM_ANY}`,
+        hint: opened
+          ? 'your builder appears to hold no claim permission at all — ask for your rank-role to be re-synced'
+          : 'pick a newcomer_friendly task from the claimable feed (/builder-start), or a builder whose role holds task.claim.any can claim this one',
+      };
     }
 
     // V3.R82 (#301): the inverse gate — a task can RAISE its minimum required

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.20",
+  "version": "1.19.22",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.20",
+      "version": "1.19.22",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.20",
+  "version": "1.19.22",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/bump-version.js

@@ -72,5 +72,19 @@ function main() {
   console.log(JSON.stringify({ from, to, applied: apply }));
 }
 
-module.exports = { bumpPatch, CONST_RE };
+// The commit subject THIS lane writes for its own bump commits — publish.yml's
+// `git commit -m` mirrors it verbatim (tests/bump_version.mjs pins the two
+// against each other). isReleaseCommit is the cascade terminator (task 1002636):
+// publish.yml no-ops when current main HEAD matches, because everything at that
+// HEAD was already published by the run that created the commit. Deliberately
+// narrow — a HUMAN release commit ("release: core 1.19.2 — carrier for the
+// init-blocker fixes") must NOT match: that version is new and still needs
+// publishing.
+const RELEASE_COMMIT_RE = /^release: core \d+\.\d+\.\d+ — CI auto-patch carrier \(publish-on-merge/;
+
+function isReleaseCommit(subject) {
+  return RELEASE_COMMIT_RE.test(String(subject == null ? '' : subject));
+}
+
+module.exports = { bumpPatch, CONST_RE, RELEASE_COMMIT_RE, isReleaseCommit };
 if (require.main === module) main();

package/scripts/gds/gating.js

@@ -2,13 +2,17 @@
 // scripts/gds/gating.js — owner kill-switch for main-branch merge gating.
 //
 // What "gating" means here — TWO independent levers, both toggled together:
-//   1. GitHub branch protection on `main`: required status checks + required
-//      code-owner review (CODEOWNERS). The required contexts are ONLY checks
-//      that exist and can pass today — currently `unit` (the suite + fitness
-//      lane, task 1002610). The planned `secret-scan` and `gate-review`
-//      contexts (ADR 0058 phase 3; CORE_EXPECTED_CHECKS in adopt-preflight.js)
-//      join DEFAULT_PROTECTION when their workflows ship — requiring a context
-//      nothing reports blocks every merge indefinitely (D-12, ADR 0159).
+//   1. GitHub branch protection on `main`: required status checks ONLY — no
+//      review requirement of any kind (ADR 0162, task 1002635: the owner
+//      retired the code-owner/human-approval layer after it stranded graded
+//      work; gates are rank-consistent CI checks, and the normalization in
+//      cmdOn keeps a pre-retirement snapshot from resurrecting it). The
+//      required contexts are ONLY checks that exist and can pass today —
+//      currently `unit` (the suite + fitness lane, task 1002610). The planned
+//      `secret-scan` and `gate-review` contexts (ADR 0058 phase 3;
+//      CORE_EXPECTED_CHECKS in adopt-preflight.js) join DEFAULT_PROTECTION
+//      when their workflows ship — requiring a context nothing reports blocks
+//      every merge indefinitely (D-12, ADR 0159).
 //   2. The application-layer trust gates that run on every PR — the gate-review
 //      and grade-gate CI workflows (ADR 0058 phases 1-3; NOT YET IN THE TREE —
 //      workflowState() reports them 'absent' and the toggles below no-op until
@@ -17,7 +21,8 @@
 //      (it escalates gate-surface changes — infra/, migrations/, CODEOWNERS,
 //      scripts/gds plumbing — to owner approval). Branch protection alone does
 //      NOT neutralize these, which is why `off` also `gh workflow disable`s them.
-// With gating ON, a gate-surface PR needs owner approval / --admin to merge.
+// With gating ON, every PR — gate-surface or not — merges on the required
+// status checks alone; no human approval is ever required (ADR 0162).
 // With gating OFF, ordinary `gh pr merge N` (and every builder / autonomous
 // session) merges with no checks and no approval. `unit` keeps running either
 // way — a real safety net that forces no approval.
@@ -78,12 +83,11 @@ const DEFAULT_PROTECTION = {
     ],
   },
   enforce_admins: false,
-  required_pull_request_reviews: {
-    dismiss_stale_reviews: false,
-    require_code_owner_reviews: true,
-    required_approving_review_count: 0,
-    require_last_push_approval: false,
-  },
+  // ADR 0162 (task 1002635): review gates are RETIRED — the owner chose
+  // rank-consistent CI checks over human-approval gates after the code-owner
+  // requirement stranded graded-PASS work (PR 28). Never reintroduce a
+  // required_pull_request_reviews block here; cmdOn also normalizes snapshots.
+  required_pull_request_reviews: null,
   restrictions: null,
 };
 
@@ -302,6 +306,10 @@ function cmdOn(repo) {
       putBody = DEFAULT_PROTECTION;
       console.log('⚠ branch protection: no snapshot — restoring the baked-in known-good default.');
     }
+    // ADR 0162 (task 1002635): review gates are retired. Normalize BOTH restore
+    // paths — a snapshot taken while the code-owner requirement was live would
+    // otherwise silently resurrect it on the next off/on cycle.
+    putBody = { ...putBody, required_pull_request_reviews: null };
     putProtection(repo, putBody);
     const after = getProtection(repo);
     if (!after) fail('PUT returned but protection still reads as OFF — check `gh` auth / admin rights');

package/scripts/gds/init.js

@@ -362,7 +362,7 @@ function kickoffTasks(spec) {
       title: 'Arm the merge gate before a second builder joins (ci deploy mode)',
       kind: 'infra',
       description: 'For a shared instance on ci deploy mode, enable branch protection on main + required checks ' +
-        '(unit / secret-scan / gate-review) + CODEOWNERS, so untrusted builders cannot push straight to production. Skippable for a solo/local instance.',
+        '(unit / secret-scan / gate-review), so untrusted builders cannot push straight to production. No review requirement — gates are CI checks, not human approvals (ADR 0162). Skippable for a solo/local instance.',
     },
   ];
   // Production topology is either AUTOMATED (the owner opted into provisioning — the

package/scripts/gds/ship.js

@@ -3780,6 +3780,27 @@ async function shipMain() {
         console.error(`(Your work is committed and the task is at 'completed' — re-running resumes, task 941.)`);
         process.exit(1);
       }
+      // task 1002613 (map P-1): the one genuine permission wall on the ship path
+      // used to surface as a raw envelope dump — an atom name is not a rank, and
+      // no remedy printed at the one station where self-service exists. Interpret
+      // it: name the wall, the floor (from the server's floors map — never
+      // hardcoded), and both ways forward.
+      const errObj = confirm.data && confirm.data.error;
+      const errCode = typeof errObj === 'string' ? errObj : (errObj && errObj.code);
+      if (confirm.status === 403 && errCode === 'permission_forbidden') {
+        const details = (errObj && typeof errObj === 'object' && errObj.details) || {};
+        const floor = details.floors && details.floors['task.confirm.grade_bypass'];
+        const floorNote = floor ? ` (floor: ${floor})` : '';
+        console.error('');
+        console.error(`✖ Confirming without a passing grade is permission-gated: task.confirm.grade_bypass${floorNote}.`);
+        console.error('  This is an authorization wall, not a verdict on your work.');
+        console.error('  Self-service: re-run WITHOUT --skip-grade to use the subagent grader, and if a');
+        console.error('  grade fails, fix its findings and re-run (unlimited, no attempt cap):');
+        console.error(`      node scripts/gds/ship.js ${taskId} --regrade`);
+        console.error(`  If the grade genuinely cannot pass, ask a builder whose role holds`);
+        console.error(`  task.confirm.grade_bypass${floorNote} to POST /api/gds/tasks/${taskId}/confirm.`);
+        process.exit(1);
+      }
       console.error(`manual-confirm failed (${confirm.status}):`, confirm.data);
       process.exit(1);
     }
@@ -3817,7 +3838,8 @@ async function shipMain() {
       console.error('Task stays at completed. Manual options:');
       console.error(`  - Re-run /builder-ship ${taskId} to try grading again, or`);
       console.error(`  - node scripts/gds/ship.js ${taskId} --regrade after fixing findings, or`);
-      console.error(`  - POST /api/gds/tasks/${taskId}/confirm to manual-confirm.`);
+      console.error(`  - POST /api/gds/tasks/${taskId}/confirm to manual-confirm (last resort —`);
+      console.error('    permission-gated on task.confirm.grade_bypass).');
       process.exit(1);
     }
 
@@ -4000,7 +4022,8 @@ async function regradeMain() {
   });
   if (!gradePost.ok) {
     console.error(`grade POST failed (${gradePost.status}):`, gradePost.data);
-    console.error('Task stays at completed. Fix the issue and re-run --regrade, or POST /confirm to manual-confirm.');
+    console.error('Task stays at completed. Fix the issue and re-run --regrade (unlimited, no attempt cap).');
+    console.error('(POST /confirm is a last resort — it is permission-gated on task.confirm.grade_bypass.)');
     process.exit(1);
   }
 

package/src/bongos/auth.js

@@ -1502,7 +1502,12 @@ async function runPageGate(name, req, res, next) {
   }
   const held = await resolveHeldPermissions(session.builder_id, session.raw_permission_keys);
   if (held === null || !held.has(permission)) {
-    res.redirect(302, deniedTo);
+    // N-1 (task 1002613): a bare deniedTo rendered nothing — every denial read as
+    // "I signed in and got dumped at the home page". Name the permission (and an
+    // authority outage, distinctly) in the query so the hall shell can say why.
+    // Same destination, same audience — only the redirect learned to speak.
+    const reason = held === null ? '&reason=unavailable' : '';
+    res.redirect(302, `${deniedTo}?denied=${encodeURIComponent(permission)}${reason}`);
     return;
   }
   next();
@@ -1693,11 +1698,38 @@ function requireRank(...allowed) {
 // null` analogue). Reporting only the intersection explains the denial without
 // dumping the builder's entire permission set into an error body.
 //
+// The body also carries a `message` and a `floors` map (missing atom → its
+// catalog floor rank) so the denial names the rank, not just the atom (task
+// 1002613, choke-point map §4.4 P-1). Floors resolve through the port at deny
+// time — never hardcoded prose, which goes stale when a floor moves (the
+// D-16/N-3 failure shape ADR 0157 left behind).
+//
 // Usage: router.post('/roles', auth.requireBuilder, auth.requirePermission('governance.manage'), handler)
 function requirePermission(...perms) {
   const required = Object.freeze([...perms]);
   return async function permissionGate(req, res, next) {
-    const deny = (held) => res.fail('permission_forbidden', 403, { required, held });
+    const deny = (held) => {
+      const missing = held === null ? [...required] : required.filter((key) => !held.includes(key));
+      const floors = {};
+      const governance = seams.resolveOptional('governance');
+      if (governance && typeof governance.permissionFloor === 'function') {
+        for (const key of missing) {
+          const floor = governance.permissionFloor(key);
+          if (floor) floors[key] = floor;
+        }
+      }
+      const floorNote = Object.keys(floors).length > 0
+        ? ` (floor: ${[...new Set(Object.values(floors))].join(', ')})`
+        : '';
+      const message = held === null
+        ? `authority could not be established — denied fail-closed (ADR 0016); this route requires ${required.join(', ') || 'a permission list'}${floorNote}`
+        : `missing permission${missing.length === 1 ? '' : 's'}: ${missing.join(', ')}${floorNote}`;
+      return res.fail('permission_forbidden', {
+        status: 403,
+        message,
+        details: { required, held, floors: Object.keys(floors).length > 0 ? floors : null },
+      });
+    };
     const builderId = req.builder && req.builder.id;
     if (!builderId) return deny(null);
     if (required.length === 0) return deny(null);

package/src/module-api.js

@@ -467,8 +467,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.18 with no explicit bump. run 31346996715. (task 1002620)
 //   1.19.20 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.19 with no explicit bump. run 31347092915. (task 1002620)
+//   1.19.21 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.20 with no explicit bump. run 31446766597. (task 1002620)
+//   1.19.22 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.21 with no explicit bump. run 31449168428. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.20'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.22'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/bump_version.mjs

@@ -69,3 +69,45 @@ test('the REAL src/module-api.js is bumpable right now (shape not drifted)', ()
   assert.match(from, /^\d+\.\d+\.\d+$/);
   assert.ok(text.includes(`const CORE_VERSION = '${to}';`));
 });
+
+// ---- isReleaseCommit: the cascade terminator (task 1002636) ----
+//
+// The bug: publish.yml's bump+publish push re-fired the workflow, which found
+// the just-published version "taken" — the BUMP trigger, not a no-op — so every
+// release armed the next one (core 1.19.6 → 1.19.20+ from two work merges).
+// The terminator no-ops the run when main HEAD is this lane's own release
+// commit. These tests pin the predicate to the EXACT subject the workflow
+// writes (extracted from publish.yml, not retyped — the two can't drift apart)
+// and pin that a HUMAN release commit never matches (skipping one would
+// swallow its publish entirely).
+
+const { isReleaseCommit, RELEASE_COMMIT_RE } = require(path.join(ROOT, 'scripts', 'gds', 'bump-version.js'));
+const PUBLISH_YML = fs.readFileSync(path.join(ROOT, '.github', 'workflows', 'publish.yml'), 'utf8');
+
+test('matches the exact -m subject publish.yml writes (extracted, not retyped)', () => {
+  const m = PUBLISH_YML.match(/git commit -m "([^"]+)"/);
+  assert.ok(m, 'publish.yml must contain the bump git commit -m literal');
+  const subject = m[1].replace('${TO}', '9.9.9');
+  assert.ok(isReleaseCommit(subject), `predicate must match the workflow's own subject: ${subject}`);
+});
+
+test('a HUMAN release commit never matches — skipping it would swallow its publish', () => {
+  assert.equal(isReleaseCommit('release: core 1.19.2 — carrier for the init-blocker fixes (task 1002624)'), false);
+  assert.equal(isReleaseCommit('release: core 2.0.0 — the doorway break (ADR 9999)'), false);
+});
+
+test('work-merge subjects, junk, and empties never match', () => {
+  assert.equal(isReleaseCommit('Merge pull request #30 from lars589/claude/cloudbongos-npm-registry-b9a57f'), false);
+  assert.equal(isReleaseCommit('fix(ship): protection-aware deploy mode'), false);
+  assert.equal(isReleaseCommit(''), false);
+  assert.equal(isReleaseCommit(null), false);
+  assert.equal(isReleaseCommit(undefined), false);
+  assert.equal(RELEASE_COMMIT_RE.source.startsWith('^'), true, 'anchored — a subject QUOTING a release message must not match');
+});
+
+test('publish.yml wires the terminator: guard step present, every armed step gated', () => {
+  assert.ok(PUBLISH_YML.includes('id: relhead'), 'the Already released? guard step exists');
+  assert.match(PUBLISH_YML, /isReleaseCommit/, 'the guard delegates to bump-version.js — single source');
+  const gates = (PUBLISH_YML.match(/steps\.relhead\.outputs\.release_head == 'false'/g) || []).length;
+  assert.ok(gates >= 7, `every post-guard armed step must carry the gate (setup-node, install, resolve, bump, pack, publish, tag) — found ${gates}`);
+});

package/tests/gating_review_retired.mjs

@@ -0,0 +1,63 @@
+// tests/gating_review_retired.mjs — review gates stay retired (ADR 0162, task 1002635).
+//
+// The owner retired the code-owner/human-approval layer after it stranded
+// graded-PASS work (PR 28) — gates are rank-consistent CI checks only. Two
+// resurrection paths existed and both are pinned shut here:
+//   1. gating.js DEFAULT_PROTECTION carrying a required_pull_request_reviews
+//      block (the baked-in re-arm), and
+//   2. cmdOn replaying a pre-retirement SNAPSHOT whose put_body still holds
+//      require_code_owner_reviews: true.
+// gating.js is a CLI (main() runs on require), so these are source-shape pins
+// (the goal_advisory.mjs pattern), with a counter-example proving the checker
+// catches the old shape.
+//
+// Run:  node --test tests/gating_review_retired.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GATING = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'gating.js'), 'utf8');
+
+// The retirement invariant, as a checkable predicate over the source.
+function reviewGateRetired(src) {
+  const defaultHasNull = /required_pull_request_reviews:\s*null/.test(src);
+  const noRequireTrue = !/require_code_owner_reviews:\s*true/.test(src);
+  const cmdOnNormalizes = /putBody\s*=\s*\{\s*\.\.\.putBody,\s*required_pull_request_reviews:\s*null\s*\}/.test(src);
+  return { defaultHasNull, noRequireTrue, cmdOnNormalizes, ok: defaultHasNull && noRequireTrue && cmdOnNormalizes };
+}
+
+test('DEFAULT_PROTECTION requires no reviews and no code-owner block exists anywhere', () => {
+  const r = reviewGateRetired(GATING);
+  assert.ok(r.defaultHasNull, 'DEFAULT_PROTECTION must set required_pull_request_reviews: null');
+  assert.ok(r.noRequireTrue, 'no require_code_owner_reviews: true may exist in gating.js (ADR 0162)');
+});
+
+test('cmdOn normalizes BOTH restore paths — a pre-retirement snapshot cannot resurrect the gate', () => {
+  const r = reviewGateRetired(GATING);
+  assert.ok(r.cmdOnNormalizes, 'cmdOn must overwrite required_pull_request_reviews to null before putProtection');
+});
+
+test('the CODEOWNERS file is gone; its GLOB guards remain where they enforce', () => {
+  assert.ok(!fs.existsSync(path.join(ROOT, 'CODEOWNERS')), 'CODEOWNERS must not exist (ADR 0162)');
+  const gateReview = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'gate-review.js'), 'utf8');
+  assert.match(gateReview, /'CODEOWNERS'/, 'the HARD_FLOOR glob stays — reintroducing the file is itself gate-flagged');
+});
+
+test('the checker actually CATCHES the pre-retirement shape (not a no-op)', () => {
+  const oldShape = `
+const DEFAULT_PROTECTION = {
+  required_pull_request_reviews: {
+    dismiss_stale_reviews: false,
+    require_code_owner_reviews: true,
+    required_approving_review_count: 0,
+  },
+};
+function cmdOn(repo) { putProtection(repo, putBody); }`;
+  const r = reviewGateRetired(oldShape);
+  assert.equal(r.ok, false, 'the old review-gated shape must fail the predicate');
+  assert.equal(r.noRequireTrue, false, 'require_code_owner_reviews: true must be the detected offender');
+});

package/tests/governance_page_gates.mjs

@@ -74,12 +74,22 @@ const PRE_R107_AUDIENCE = {
   requireGovernancePage: { xenos: false, thetes: false, metic: true, archon: true },
 };
 // Where a SIGNED-IN builder who fails the gate is sent. Never the sign-in flow —
-// they already have a session, so that would loop.
+// they already have a session, so that would loop. Since task 1002613 (map N-1)
+// the redirect carries ?denied=<permission> — and &reason=unavailable when the
+// authority system itself never answered — so the hall shell can render WHY
+// instead of silently dumping the builder at the home page.
 const DENIED_TO = {
   requireBuilderPage: '/builders',
   requireNonXenosPage: '/builders/not-ready',
   requireGovernancePage: '/builders',
 };
+const GATE_PERMISSION = {
+  requireBuilderPage: 'page.view.public',
+  requireNonXenosPage: 'page.view.builder',
+  requireGovernancePage: 'page.view.governance',
+};
+const deniedLoc = (gate, { unavailable = false } = {}) =>
+  `${DENIED_TO[gate]}?denied=${GATE_PERMISSION[gate]}${unavailable ? '&reason=unavailable' : ''}`;
 // The equivalent rank floor, for the independent cross-check below.
 const GATE_FLOOR = {
   requireBuilderPage: 'xenos',
@@ -166,8 +176,8 @@ test('A2: a denied SIGNED-IN builder is redirected to an ungated page, not JSON-
       if (PRE_R107_AUDIENCE[gate][rank]) continue;
       const { res, nexted } = await runGate(gate, { rank });
       assert.equal(nexted, false, `${gate}/${rank} must not admit`);
-      assert.deepEqual(res._redirect, { code: 302, loc: DENIED_TO[gate] },
-        `${gate}/${rank} must 302 to ${DENIED_TO[gate]}`);
+      assert.deepEqual(res._redirect, { code: 302, loc: deniedLoc(gate) },
+        `${gate}/${rank} must 302 to ${deniedLoc(gate)} — naming the permission it lacked`);
       assert.equal(res._status, null, `${gate}/${rank} must not set an HTTP error status`);
       assert.equal(res._json, null, `${gate}/${rank} must not answer a JSON body`);
       assert.notEqual(res._redirect.loc, SIGN_IN,
@@ -211,7 +221,8 @@ test('B2: an UNREGISTERED governance port denies every gate, it does not admit',
   for (const gate of GATES) {
     const { res, nexted } = await runGate(gate, { rank: 'archon', port: false });
     assert.equal(nexted, false, `${gate}: a missing authority system must never open a page gate`);
-    assert.equal(res._redirect.loc, DENIED_TO[gate]);
+    assert.equal(res._redirect.loc, deniedLoc(gate, { unavailable: true }),
+      `${gate}: an authority outage must say so (&reason=unavailable), distinct from a permission denial`);
     assert.equal(res._json, null);
   }
 });
@@ -223,7 +234,7 @@ test('B3: a throwing resolver denies (a DB blip must not open the page)', async
       resolve: async () => { throw new Error('connection terminated'); },
     });
     assert.equal(nexted, false, `${gate} must fail CLOSED on a resolve failure`);
-    assert.equal(res._redirect.loc, DENIED_TO[gate]);
+    assert.equal(res._redirect.loc, deniedLoc(gate, { unavailable: true }));
   }
 });
 
@@ -247,7 +258,7 @@ test('B4: the page gates resolve per request — no memoised authority (ADR 0016
   seams._reset();
   assert.equal(calls, 2, 'the resolver must be consulted on every request');
   assert.equal(admittedAgain, false, 'a revoked role must deny on the very next request');
-  assert.equal(second._redirect.loc, '/builders');
+  assert.equal(second._redirect.loc, deniedLoc('requireGovernancePage'));
 });
 
 test('B5: every permission a page gate names is a real catalog key', async () => {

package/tests/governance_require_permission.mjs

@@ -83,6 +83,38 @@ test('multiple permissions are AND, not OR — holding one of two still denies',
   assert.equal(both.nexted, true, 'holding both must admit');
 });
 
+test('the denial names the floor rank, not just the atom (task 1002613, map P-1)', async () => {
+  // With the real port shape (permissionFloor present) the body carries a floors
+  // map and a message naming the rank. The floor is read from the catalog here so
+  // this test moves WITH a floor change instead of pinning stale prose — the
+  // D-16/N-3 failure shape the fix exists to avoid.
+  seams._reset();
+  seams.registerProvider('governance', {
+    resolveBuilderPermissions: holding('idea.triage'),
+    permissionFloor: (key) => (catalog.byKey(key) || {}).floor || null,
+  });
+  const res = fakeRes();
+  await auth.requirePermission('task.confirm.grade_bypass')({ builder: BUILDER }, res, () => {});
+  seams._reset();
+  assert.equal(res._status, 403);
+  const err = res._json.error;
+  const floor = catalog.byKey('task.confirm.grade_bypass').floor;
+  assert.deepEqual(err.details.floors, { 'task.confirm.grade_bypass': floor },
+    'floors maps each MISSING atom to its seeded floor');
+  assert.ok(err.message.includes('task.confirm.grade_bypass'), 'the message names the atom');
+  assert.ok(err.message.includes(floor), 'the message names the rank — an atom name is not a rank');
+});
+
+test('a port without permissionFloor still denies with a message; floors is null', async () => {
+  const { res } = await run(
+    auth.requirePermission('governance.manage'), { builder: BUILDER }, holding('idea.triage'),
+  );
+  assert.equal(res._status, 403);
+  assert.equal(res._json.error.details.floors, null);
+  assert.ok(res._json.error.message.includes('governance.manage'),
+    'the message names the missing atom even when no floor is resolvable');
+});
+
 test('no req.builder fails closed (gate mounted without requireBuilder)', async () => {
   const { res, nexted } = await run(auth.requirePermission('idea.triage'), {}, holding('idea.triage'));
   assert.equal(nexted, false);

package/tests/reward_gate.mjs

@@ -162,8 +162,10 @@ t('claim path AUTO-ASSIGNS inside the FOR UPDATE transaction (never refuses)', (
   // The window is a slice heuristic, not a contract: it only has to cover the
   // pre-flight half of claimTask (which spans ~13k chars). Widened 5000 -> 6000 in
   // BV1.R106, when the permission-expressed claim gate pushed the reward-gate block
-  // past the old edge. Keep it comfortably below the claimTasksBatch boundary.
-  const body = dbSrc.slice(start, start + 6000);
+  // past the old edge; 6000 -> 7000 in task 1002613, when the enriched
+  // rank_too_low_for_task denial did the same. Keep it comfortably below the
+  // claimTasksBatch boundary (~15.5k chars in).
+  const body = dbSrc.slice(start, start + 7000);
   assert.match(body, /rewardGateAssignment\(task\)/, 'claimTask must consult the auto-assign decision');
   assert.match(body, /UPDATE tasks SET credits_reward/, 'claimTask must persist the assigned reward in-tx');
   // it must SELECT the columns the gate needs.