@bongos/core 1.19.21 → 1.19.22

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.21",
-  "core_contract": "1.19.21",
-  "source_commit": "1bcacbc141d1103f3b8e89d9c3963369740c783d",
+  "core_version": "1.19.22",
+  "core_contract": "1.19.22",
+  "source_commit": "e089ef90ffdf1b4da4f4a6b7f70d0fb10426bf42",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T00:39:38.782Z",
+  "built_at": "2026-08-11T01:24:29.274Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 285,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1510,
-  "tree_sha256": "1f7f270a9f0d217360d9126213d6c7d752039999b895385c114df75fde81f14f",
+  "tree_sha256": "0a775991e628ae986369cd819f6b384887fa20c1095f7e7263f07f13ad0e8167",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2797,7 +2797,7 @@
     {
       "path": "modules/governance/routes/governance.js",
       "mode": "0000644",
-      "sha256": "6f600bb237009064f18eae7af140cd8376cf5770ff7efd89d0e4071bade9eb4d"
+      "sha256": "2b390c2c51812aa547f85045fe6d36be6c53086f3fa2468ab7c20c4a7d19dc08"
     },
     {
       "path": "modules/governance/routes/role-sync.js",
@@ -3247,12 +3247,12 @@
     {
       "path": "modules/hall-ui/public/shell.js",
       "mode": "0000644",
-      "sha256": "00a356cf20df11fd195c8ecce619ba5e4bc4138ccb3b66ebdef1522fa3f56c8e"
+      "sha256": "56c1450dd72fcda19841f3a0a98b918b1b875f49971e93d60218fb62e8a21dad"
     },
     {
       "path": "modules/hall-ui/public/style.css",
       "mode": "0000644",
-      "sha256": "9fa49a72160d8dd156bba5f55d2300b9188ea9ae133a6dfb8ab13f3cdc2ab76d"
+      "sha256": "41fbe46c9bbc6e9a4397733c070cb2d5e7bfd698d629445f786a44c44a35b0c4"
     },
     {
       "path": "modules/hall-ui/public/task-detail.js",
@@ -3352,7 +3352,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "44cdb3c44dcf9277e9e0661d664387f0497e7d9b11c9775e1133aeec0da9db9f"
+      "sha256": "7dc50e4e88a204583c753555c76f4103df405a143c4266dbff53793c292803f9"
     },
     {
       "path": "modules/lifecycle/done-when.js",
@@ -4002,12 +4002,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "a408615d881c51b175e64ca336475849090253394df3bc7e428bb0e28d79d40e"
+      "sha256": "f85ec26a3a5cbefec1aca8407043cb2eb2886120722a79126d364736f1a67584"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "e9e8deee79bedc058f9870901d7afdb266d99443d4877059ece4e9cbe4501e2f"
+      "sha256": "9275da3329d188788a0e69b719231cd23ae38b3499802edbcefebded17317067"
     },
     {
       "path": "public-docs/index.html",
@@ -5197,7 +5197,7 @@
     {
       "path": "scripts/gds/ship.js",
       "mode": "0000644",
-      "sha256": "bea8a5d8698abf30064c005076c069d470203c86a37a1ff7a3aebc4a5ded19a6"
+      "sha256": "65af2a0d6fc54ee3dbb3c7faa44796fed2a5817fa48073cebfd9d6a15837fec7"
     },
     {
       "path": "scripts/gds/smoke-batch-claim.sh",
@@ -5392,7 +5392,7 @@
     {
       "path": "src/bongos/auth.js",
       "mode": "0000644",
-      "sha256": "60888e8a84fc109ce258256ed7c0af13a8a453464b4f71716bc3a018a89f1b1a"
+      "sha256": "95428c88621510a97a5bfaf89a836508501b1db0f0910f529a260fa2dafce3b5"
     },
     {
       "path": "src/bongos/cascade-dispatch.js",
@@ -5627,7 +5627,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "81389daa63b2184235f45d0eb6d9aec17debbd00a9f7ffb74d7508953f0317ba"
+      "sha256": "937021d749587baee02de0c83fa721b99a0e23850c5c12aa5332424673e5d6af"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6512,7 +6512,7 @@
     {
       "path": "tests/governance_page_gates.mjs",
       "mode": "0000644",
-      "sha256": "cf0d01b58a209d9d2ad64e2c1c999ce2338fb0f69bb5ddff43ca7f24d7bc66be"
+      "sha256": "be6cc9a4070d9de107cd11bfcb7a38e074f8aeb71198839cd42438d3ea2a0c04"
     },
     {
       "path": "tests/governance_parity.mjs",
@@ -6532,7 +6532,7 @@
     {
       "path": "tests/governance_require_permission.mjs",
       "mode": "0000644",
-      "sha256": "58090f6e6cb0cb7e99b03675deeb80302986b053dc1402e254f64ae4126df084"
+      "sha256": "2e8d7f3bb58411efd79727f6edffa448136551ef1c3c6973228fdfa7903f7cb3"
     },
     {
       "path": "tests/governance_resolver.mjs",
@@ -7167,7 +7167,7 @@
     {
       "path": "tests/reward_gate.mjs",
       "mode": "0000644",
-      "sha256": "ace9bb9db5a25b98de4d62f5150fb17db345d78e747aca95a6628dcd2a957afe"
+      "sha256": "7ae4d9af4d389c34f0d16f921858cbbf5d0d57f3219f830d10552ebcdc43908f"
     },
     {
       "path": "tests/reward_mode_cost_plus_only.mjs",

package/modules/governance/routes/governance.js

@@ -62,6 +62,9 @@ const governancePort = {
   isSystem: catalog.isSystem,
   isGrantable: catalog.isGrantable,
   permissionKeys: catalog.permissionKeys,
+  // The seeded floor of one atom, for denial text that names the rank instead of
+  // only the atom (task 1002613). Null for principal keys and unknown keys.
+  permissionFloor: (key) => (catalog.byKey(key) || {}).floor || null,
   resolvePrincipalPermissions: resolver.resolvePrincipalPermissions,
   principalHasPermission: resolver.principalHasPermission,
   isPrincipalKey: catalog.isPrincipalKey,

package/modules/hall-ui/public/shell.js

@@ -360,6 +360,36 @@
     applyZoom();
   }
 
+  // task 1002613 (map N-1): a server page-gate denial lands here with
+  // ?denied=<permission>[&reason=unavailable]. Render the refusal — "you are
+  // signed in; you lack X" — then strip the query so a refresh or a shared link
+  // doesn't re-show a stale notice. Cosmetic only; the gate already ran.
+  function renderDeniedNotice() {
+    // Hand-parsed (no URLSearchParams): shell.js is dependency-free by design,
+    // and the hall unit tests boot it in a bare vm context.
+    var search = (window.location && window.location.search) || '';
+    var m = /[?&]denied=([^&]+)/.exec(search);
+    if (!m) return;
+    var denied = decodeURIComponent(m[1]);
+    if (!/^[a-z0-9_.-]{1,80}$/i.test(denied)) return;
+    var unavailable = /[?&]reason=unavailable(?:&|$)/.test(search);
+    var topbar = document.getElementById('app-topbar');
+    if (!topbar) return;
+    var el = document.createElement('div');
+    el.className = 'denied-notice';
+    el.setAttribute('role', 'status');
+    el.innerHTML =
+      '<span>' + (unavailable
+        ? 'You’re signed in, but access to that page couldn’t be verified just now (the permission system didn’t answer), so it stayed closed. Try again in a minute.'
+        : 'You’re signed in, but that page needs the <code>' + esc(denied) + '</code> permission — your current role doesn’t hold it.') +
+      '</span>' +
+      '<button type="button" class="denied-notice__close" aria-label="Dismiss">×</button>';
+    el.querySelector('.denied-notice__close').addEventListener('click', function () { el.remove(); });
+    topbar.insertAdjacentElement('afterend', el);
+    var rest = search.replace(/[?&](?:denied|reason)=[^&]*/g, '').replace(/^&/, '?');
+    history.replaceState(null, '', window.location.pathname + rest + window.location.hash);
+  }
+
   function renderFoot() {
     var el = document.getElementById('app-foot');
     if (!el) return;
@@ -615,6 +645,7 @@
 
   renderSidebar();
   renderTopbar();
+  renderDeniedNotice();
   renderFoot();
   applyTheme();
   applyZoom();

package/modules/hall-ui/public/style.css

@@ -455,6 +455,30 @@ button { font-family: var(--font-body); }
   overflow: hidden;
   text-overflow: ellipsis;
 }
+/* Page-gate denial notice (task 1002613, map N-1) — rendered by shell.js from
+   the ?denied= query a refused page redirect carries. */
+.denied-notice {
+  display: flex;
+  align-items: baseline;
+  gap: 12px;
+  padding: 10px 24px;
+  font-size: 13px;
+  color: var(--warn);
+  background: var(--warn-weak);
+  border-bottom: 1px solid var(--border);
+}
+.denied-notice code {
+  font-size: 12px;
+}
+.denied-notice__close {
+  margin-left: auto;
+  border: 0;
+  background: none;
+  color: inherit;
+  font-size: 16px;
+  line-height: 1;
+  cursor: pointer;
+}
 .topbar-menu {
   display: none;
   align-items: center;

package/modules/lifecycle/db.js

@@ -42,7 +42,7 @@ const doneWhen = require('./done-when.js');
 const { generalGoalTitle } = require('./goal-advisory.js');
 // BV1.R106 (ADR 0151): the permission-expressed QUEUE axis of claim eligibility.
 // Kept deliberately separate from the per-task requires_rank floor below.
-const { claimEligibilityAllows } = require('./claim-eligibility.js');
+const { claimEligibilityAllows, CLAIM_ANY, CLAIM_NEWCOMER } = require('./claim-eligibility.js');
 // Pure kernel-adjacent matchers via the doorway (never the core file).
 const { matchProtected } = api.permissionPathCheck;
 const { touchesOverlap } = api.pathMatch;
@@ -2572,7 +2572,23 @@ async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSess
     // task.claim.any / task.claim.newcomer — see ./claim-eligibility.js.
     const newcomerFriendly = task.newcomer_friendly;
     if (!claimEligibilityAllows({ heldPermissions, newcomerFriendly, rankRuleAllows: xenosClaimAllowed(builderRank, newcomerFriendly) })) {
-      throw { code: 'rank_too_low_for_task', legacy_code: 'XENOS_RESTRICTED' };
+      // task 1002613 (map §4.4): the bare code reported a PERMISSION decision as
+      // a rank one — no axis, no remedy. Copy INSUFFICIENT_RANK's shape below:
+      // name both sides of the wall and the way forward.
+      const opened = newcomerFriendly === true;
+      throw {
+        code: 'rank_too_low_for_task',
+        legacy_code: 'XENOS_RESTRICTED',
+        required: opened ? [CLAIM_ANY, CLAIM_NEWCOMER] : [CLAIM_ANY],
+        actual: builderRank,
+        newcomer_friendly: opened,
+        message: opened
+          ? `claiming this task needs ${CLAIM_ANY} or ${CLAIM_NEWCOMER}, and your role holds neither`
+          : `this task is not opened to newcomers (newcomer_friendly is not set) and your role lacks ${CLAIM_ANY}`,
+        hint: opened
+          ? 'your builder appears to hold no claim permission at all — ask for your rank-role to be re-synced'
+          : 'pick a newcomer_friendly task from the claimable feed (/builder-start), or a builder whose role holds task.claim.any can claim this one',
+      };
     }
 
     // V3.R82 (#301): the inverse gate — a task can RAISE its minimum required

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.21",
+  "version": "1.19.22",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.21",
+      "version": "1.19.22",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.21",
+  "version": "1.19.22",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/ship.js

@@ -3780,6 +3780,27 @@ async function shipMain() {
         console.error(`(Your work is committed and the task is at 'completed' — re-running resumes, task 941.)`);
         process.exit(1);
       }
+      // task 1002613 (map P-1): the one genuine permission wall on the ship path
+      // used to surface as a raw envelope dump — an atom name is not a rank, and
+      // no remedy printed at the one station where self-service exists. Interpret
+      // it: name the wall, the floor (from the server's floors map — never
+      // hardcoded), and both ways forward.
+      const errObj = confirm.data && confirm.data.error;
+      const errCode = typeof errObj === 'string' ? errObj : (errObj && errObj.code);
+      if (confirm.status === 403 && errCode === 'permission_forbidden') {
+        const details = (errObj && typeof errObj === 'object' && errObj.details) || {};
+        const floor = details.floors && details.floors['task.confirm.grade_bypass'];
+        const floorNote = floor ? ` (floor: ${floor})` : '';
+        console.error('');
+        console.error(`✖ Confirming without a passing grade is permission-gated: task.confirm.grade_bypass${floorNote}.`);
+        console.error('  This is an authorization wall, not a verdict on your work.');
+        console.error('  Self-service: re-run WITHOUT --skip-grade to use the subagent grader, and if a');
+        console.error('  grade fails, fix its findings and re-run (unlimited, no attempt cap):');
+        console.error(`      node scripts/gds/ship.js ${taskId} --regrade`);
+        console.error(`  If the grade genuinely cannot pass, ask a builder whose role holds`);
+        console.error(`  task.confirm.grade_bypass${floorNote} to POST /api/gds/tasks/${taskId}/confirm.`);
+        process.exit(1);
+      }
       console.error(`manual-confirm failed (${confirm.status}):`, confirm.data);
       process.exit(1);
     }
@@ -3817,7 +3838,8 @@ async function shipMain() {
       console.error('Task stays at completed. Manual options:');
       console.error(`  - Re-run /builder-ship ${taskId} to try grading again, or`);
       console.error(`  - node scripts/gds/ship.js ${taskId} --regrade after fixing findings, or`);
-      console.error(`  - POST /api/gds/tasks/${taskId}/confirm to manual-confirm.`);
+      console.error(`  - POST /api/gds/tasks/${taskId}/confirm to manual-confirm (last resort —`);
+      console.error('    permission-gated on task.confirm.grade_bypass).');
       process.exit(1);
     }
 
@@ -4000,7 +4022,8 @@ async function regradeMain() {
   });
   if (!gradePost.ok) {
     console.error(`grade POST failed (${gradePost.status}):`, gradePost.data);
-    console.error('Task stays at completed. Fix the issue and re-run --regrade, or POST /confirm to manual-confirm.');
+    console.error('Task stays at completed. Fix the issue and re-run --regrade (unlimited, no attempt cap).');
+    console.error('(POST /confirm is a last resort — it is permission-gated on task.confirm.grade_bypass.)');
     process.exit(1);
   }
 

package/src/bongos/auth.js

@@ -1502,7 +1502,12 @@ async function runPageGate(name, req, res, next) {
   }
   const held = await resolveHeldPermissions(session.builder_id, session.raw_permission_keys);
   if (held === null || !held.has(permission)) {
-    res.redirect(302, deniedTo);
+    // N-1 (task 1002613): a bare deniedTo rendered nothing — every denial read as
+    // "I signed in and got dumped at the home page". Name the permission (and an
+    // authority outage, distinctly) in the query so the hall shell can say why.
+    // Same destination, same audience — only the redirect learned to speak.
+    const reason = held === null ? '&reason=unavailable' : '';
+    res.redirect(302, `${deniedTo}?denied=${encodeURIComponent(permission)}${reason}`);
     return;
   }
   next();
@@ -1693,11 +1698,38 @@ function requireRank(...allowed) {
 // null` analogue). Reporting only the intersection explains the denial without
 // dumping the builder's entire permission set into an error body.
 //
+// The body also carries a `message` and a `floors` map (missing atom → its
+// catalog floor rank) so the denial names the rank, not just the atom (task
+// 1002613, choke-point map §4.4 P-1). Floors resolve through the port at deny
+// time — never hardcoded prose, which goes stale when a floor moves (the
+// D-16/N-3 failure shape ADR 0157 left behind).
+//
 // Usage: router.post('/roles', auth.requireBuilder, auth.requirePermission('governance.manage'), handler)
 function requirePermission(...perms) {
   const required = Object.freeze([...perms]);
   return async function permissionGate(req, res, next) {
-    const deny = (held) => res.fail('permission_forbidden', 403, { required, held });
+    const deny = (held) => {
+      const missing = held === null ? [...required] : required.filter((key) => !held.includes(key));
+      const floors = {};
+      const governance = seams.resolveOptional('governance');
+      if (governance && typeof governance.permissionFloor === 'function') {
+        for (const key of missing) {
+          const floor = governance.permissionFloor(key);
+          if (floor) floors[key] = floor;
+        }
+      }
+      const floorNote = Object.keys(floors).length > 0
+        ? ` (floor: ${[...new Set(Object.values(floors))].join(', ')})`
+        : '';
+      const message = held === null
+        ? `authority could not be established — denied fail-closed (ADR 0016); this route requires ${required.join(', ') || 'a permission list'}${floorNote}`
+        : `missing permission${missing.length === 1 ? '' : 's'}: ${missing.join(', ')}${floorNote}`;
+      return res.fail('permission_forbidden', {
+        status: 403,
+        message,
+        details: { required, held, floors: Object.keys(floors).length > 0 ? floors : null },
+      });
+    };
     const builderId = req.builder && req.builder.id;
     if (!builderId) return deny(null);
     if (required.length === 0) return deny(null);

package/src/module-api.js

@@ -469,8 +469,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.19 with no explicit bump. run 31347092915. (task 1002620)
 //   1.19.21 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.20 with no explicit bump. run 31446766597. (task 1002620)
+//   1.19.22 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.21 with no explicit bump. run 31449168428. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.21'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.22'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/governance_page_gates.mjs

@@ -74,12 +74,22 @@ const PRE_R107_AUDIENCE = {
   requireGovernancePage: { xenos: false, thetes: false, metic: true, archon: true },
 };
 // Where a SIGNED-IN builder who fails the gate is sent. Never the sign-in flow —
-// they already have a session, so that would loop.
+// they already have a session, so that would loop. Since task 1002613 (map N-1)
+// the redirect carries ?denied=<permission> — and &reason=unavailable when the
+// authority system itself never answered — so the hall shell can render WHY
+// instead of silently dumping the builder at the home page.
 const DENIED_TO = {
   requireBuilderPage: '/builders',
   requireNonXenosPage: '/builders/not-ready',
   requireGovernancePage: '/builders',
 };
+const GATE_PERMISSION = {
+  requireBuilderPage: 'page.view.public',
+  requireNonXenosPage: 'page.view.builder',
+  requireGovernancePage: 'page.view.governance',
+};
+const deniedLoc = (gate, { unavailable = false } = {}) =>
+  `${DENIED_TO[gate]}?denied=${GATE_PERMISSION[gate]}${unavailable ? '&reason=unavailable' : ''}`;
 // The equivalent rank floor, for the independent cross-check below.
 const GATE_FLOOR = {
   requireBuilderPage: 'xenos',
@@ -166,8 +176,8 @@ test('A2: a denied SIGNED-IN builder is redirected to an ungated page, not JSON-
       if (PRE_R107_AUDIENCE[gate][rank]) continue;
       const { res, nexted } = await runGate(gate, { rank });
       assert.equal(nexted, false, `${gate}/${rank} must not admit`);
-      assert.deepEqual(res._redirect, { code: 302, loc: DENIED_TO[gate] },
-        `${gate}/${rank} must 302 to ${DENIED_TO[gate]}`);
+      assert.deepEqual(res._redirect, { code: 302, loc: deniedLoc(gate) },
+        `${gate}/${rank} must 302 to ${deniedLoc(gate)} — naming the permission it lacked`);
       assert.equal(res._status, null, `${gate}/${rank} must not set an HTTP error status`);
       assert.equal(res._json, null, `${gate}/${rank} must not answer a JSON body`);
       assert.notEqual(res._redirect.loc, SIGN_IN,
@@ -211,7 +221,8 @@ test('B2: an UNREGISTERED governance port denies every gate, it does not admit',
   for (const gate of GATES) {
     const { res, nexted } = await runGate(gate, { rank: 'archon', port: false });
     assert.equal(nexted, false, `${gate}: a missing authority system must never open a page gate`);
-    assert.equal(res._redirect.loc, DENIED_TO[gate]);
+    assert.equal(res._redirect.loc, deniedLoc(gate, { unavailable: true }),
+      `${gate}: an authority outage must say so (&reason=unavailable), distinct from a permission denial`);
     assert.equal(res._json, null);
   }
 });
@@ -223,7 +234,7 @@ test('B3: a throwing resolver denies (a DB blip must not open the page)', async
       resolve: async () => { throw new Error('connection terminated'); },
     });
     assert.equal(nexted, false, `${gate} must fail CLOSED on a resolve failure`);
-    assert.equal(res._redirect.loc, DENIED_TO[gate]);
+    assert.equal(res._redirect.loc, deniedLoc(gate, { unavailable: true }));
   }
 });
 
@@ -247,7 +258,7 @@ test('B4: the page gates resolve per request — no memoised authority (ADR 0016
   seams._reset();
   assert.equal(calls, 2, 'the resolver must be consulted on every request');
   assert.equal(admittedAgain, false, 'a revoked role must deny on the very next request');
-  assert.equal(second._redirect.loc, '/builders');
+  assert.equal(second._redirect.loc, deniedLoc('requireGovernancePage'));
 });
 
 test('B5: every permission a page gate names is a real catalog key', async () => {

package/tests/governance_require_permission.mjs

@@ -83,6 +83,38 @@ test('multiple permissions are AND, not OR — holding one of two still denies',
   assert.equal(both.nexted, true, 'holding both must admit');
 });
 
+test('the denial names the floor rank, not just the atom (task 1002613, map P-1)', async () => {
+  // With the real port shape (permissionFloor present) the body carries a floors
+  // map and a message naming the rank. The floor is read from the catalog here so
+  // this test moves WITH a floor change instead of pinning stale prose — the
+  // D-16/N-3 failure shape the fix exists to avoid.
+  seams._reset();
+  seams.registerProvider('governance', {
+    resolveBuilderPermissions: holding('idea.triage'),
+    permissionFloor: (key) => (catalog.byKey(key) || {}).floor || null,
+  });
+  const res = fakeRes();
+  await auth.requirePermission('task.confirm.grade_bypass')({ builder: BUILDER }, res, () => {});
+  seams._reset();
+  assert.equal(res._status, 403);
+  const err = res._json.error;
+  const floor = catalog.byKey('task.confirm.grade_bypass').floor;
+  assert.deepEqual(err.details.floors, { 'task.confirm.grade_bypass': floor },
+    'floors maps each MISSING atom to its seeded floor');
+  assert.ok(err.message.includes('task.confirm.grade_bypass'), 'the message names the atom');
+  assert.ok(err.message.includes(floor), 'the message names the rank — an atom name is not a rank');
+});
+
+test('a port without permissionFloor still denies with a message; floors is null', async () => {
+  const { res } = await run(
+    auth.requirePermission('governance.manage'), { builder: BUILDER }, holding('idea.triage'),
+  );
+  assert.equal(res._status, 403);
+  assert.equal(res._json.error.details.floors, null);
+  assert.ok(res._json.error.message.includes('governance.manage'),
+    'the message names the missing atom even when no floor is resolvable');
+});
+
 test('no req.builder fails closed (gate mounted without requireBuilder)', async () => {
   const { res, nexted } = await run(auth.requirePermission('idea.triage'), {}, holding('idea.triage'));
   assert.equal(nexted, false);

package/tests/reward_gate.mjs

@@ -162,8 +162,10 @@ t('claim path AUTO-ASSIGNS inside the FOR UPDATE transaction (never refuses)', (
   // The window is a slice heuristic, not a contract: it only has to cover the
   // pre-flight half of claimTask (which spans ~13k chars). Widened 5000 -> 6000 in
   // BV1.R106, when the permission-expressed claim gate pushed the reward-gate block
-  // past the old edge. Keep it comfortably below the claimTasksBatch boundary.
-  const body = dbSrc.slice(start, start + 6000);
+  // past the old edge; 6000 -> 7000 in task 1002613, when the enriched
+  // rank_too_low_for_task denial did the same. Keep it comfortably below the
+  // claimTasksBatch boundary (~15.5k chars in).
+  const body = dbSrc.slice(start, start + 7000);
   assert.match(body, /rewardGateAssignment\(task\)/, 'claimTask must consult the auto-assign decision');
   assert.match(body, /UPDATE tasks SET credits_reward/, 'claimTask must persist the assigned reward in-tx');
   // it must SELECT the columns the gate needs.