@bongos/core 1.19.21 → 1.19.23

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.21",
-  "core_contract": "1.19.21",
-  "source_commit": "1bcacbc141d1103f3b8e89d9c3963369740c783d",
+  "core_version": "1.19.23",
+  "core_contract": "1.19.23",
+  "source_commit": "fcdc2c0100a2b96183b34980f7c33572b67c7d1f",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T00:39:38.782Z",
+  "built_at": "2026-08-11T01:44:34.493Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 285,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1510,
-  "tree_sha256": "1f7f270a9f0d217360d9126213d6c7d752039999b895385c114df75fde81f14f",
+  "tree_sha256": "80499ca716f5acc869706f3832aba22ffa0facdf31abd6eca71baec9b273d628",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -352,7 +352,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "2e321ea71ad8b24a5562b97dc76bedae62e3a313fd8cbb72f415fa575bd686a1"
+      "sha256": "7e6732aedaf7aaa3c657fc05e2dfd1dcc63e0fb06586d4077248d79d6198297e"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1277,12 +1277,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "c2e909c0f62a643dc2ff4c705cc6ffccf279dcc588945d1b39147d09d70c5f5b"
+      "sha256": "e28575936d1cb0cce684b20723743fd0d801ccd0a7ec58fff5360e160b23b5e7"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "43b270dbfaa283c2c793d8f779b497cfd0c6da4f4a4cef07f4516d1c4e582946"
+      "sha256": "b232ca69ae97842be312b76f6ac49ca66090c5c8fef392f609bb857e5f5c2979"
     },
     {
       "path": "docs/architecture.md",
@@ -2797,7 +2797,7 @@
     {
       "path": "modules/governance/routes/governance.js",
       "mode": "0000644",
-      "sha256": "6f600bb237009064f18eae7af140cd8376cf5770ff7efd89d0e4071bade9eb4d"
+      "sha256": "2b390c2c51812aa547f85045fe6d36be6c53086f3fa2468ab7c20c4a7d19dc08"
     },
     {
       "path": "modules/governance/routes/role-sync.js",
@@ -2882,7 +2882,7 @@
     {
       "path": "modules/grading/grader.js",
       "mode": "0000644",
-      "sha256": "b421b3749396e14bbfa203519a0d25083f540c222deccfc755ad6ca808239859"
+      "sha256": "a08e9c017a07bffa311a9de6df007c30d9f3766c86d0ce2ec88660fed60d37aa"
     },
     {
       "path": "modules/grading/module.json",
@@ -3247,12 +3247,12 @@
     {
       "path": "modules/hall-ui/public/shell.js",
       "mode": "0000644",
-      "sha256": "00a356cf20df11fd195c8ecce619ba5e4bc4138ccb3b66ebdef1522fa3f56c8e"
+      "sha256": "56c1450dd72fcda19841f3a0a98b918b1b875f49971e93d60218fb62e8a21dad"
     },
     {
       "path": "modules/hall-ui/public/style.css",
       "mode": "0000644",
-      "sha256": "9fa49a72160d8dd156bba5f55d2300b9188ea9ae133a6dfb8ab13f3cdc2ab76d"
+      "sha256": "41fbe46c9bbc6e9a4397733c070cb2d5e7bfd698d629445f786a44c44a35b0c4"
     },
     {
       "path": "modules/hall-ui/public/task-detail.js",
@@ -3352,7 +3352,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "44cdb3c44dcf9277e9e0661d664387f0497e7d9b11c9775e1133aeec0da9db9f"
+      "sha256": "7dc50e4e88a204583c753555c76f4103df405a143c4266dbff53793c292803f9"
     },
     {
       "path": "modules/lifecycle/done-when.js",
@@ -3437,7 +3437,7 @@
     {
       "path": "modules/lifecycle/routes/done-when.js",
       "mode": "0000644",
-      "sha256": "f77651b5418d6eb99e78ecf4c864f239ba75a149444a88eae59a5c3082f48cae"
+      "sha256": "cec4dce0ab8d11b16de73dbee8adb782f47c12a32d203dd1ff726afd23caadf3"
     },
     {
       "path": "modules/lifecycle/routes/gate-approvals.js",
@@ -3457,7 +3457,7 @@
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "14320bb5a3257a422854c41362f010042ed390bdd7efcf1b4959ed72f0ee1f9f"
+      "sha256": "add6acd00adc842e90348ca789da0a473aa2dc68d949cf2b5586c68ef5eaa1be"
     },
     {
       "path": "modules/lifecycle/routes/versions.js",
@@ -4002,12 +4002,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "a408615d881c51b175e64ca336475849090253394df3bc7e428bb0e28d79d40e"
+      "sha256": "969211290cee8ccee357109c325ff4741c8cce3319d520b22506126099beea7e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "e9e8deee79bedc058f9870901d7afdb266d99443d4877059ece4e9cbe4501e2f"
+      "sha256": "b00d5423d5019e305bb488af793202ccb4d3089da6c129851e32f85ea4219904"
     },
     {
       "path": "public-docs/index.html",
@@ -5197,7 +5197,7 @@
     {
       "path": "scripts/gds/ship.js",
       "mode": "0000644",
-      "sha256": "bea8a5d8698abf30064c005076c069d470203c86a37a1ff7a3aebc4a5ded19a6"
+      "sha256": "085a7feeff06fa7d2b833c483795161e2c4a6ee79630e2f09d7ae2f06eeb253c"
     },
     {
       "path": "scripts/gds/smoke-batch-claim.sh",
@@ -5392,7 +5392,7 @@
     {
       "path": "src/bongos/auth.js",
       "mode": "0000644",
-      "sha256": "60888e8a84fc109ce258256ed7c0af13a8a453464b4f71716bc3a018a89f1b1a"
+      "sha256": "95428c88621510a97a5bfaf89a836508501b1db0f0910f529a260fa2dafce3b5"
     },
     {
       "path": "src/bongos/cascade-dispatch.js",
@@ -5627,7 +5627,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "81389daa63b2184235f45d0eb6d9aec17debbd00a9f7ffb74d7508953f0317ba"
+      "sha256": "0e4203ec0098beb9a54a4ea56b3c5701cfca5bb02b6676114a9257f5b353aff5"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6137,7 +6137,7 @@
     {
       "path": "tests/criterion_authoring_gate.mjs",
       "mode": "0000644",
-      "sha256": "23d8c31f310e7ffb840dce3850c1eb2eab59b5513489bde19edb22c5bab6eb75"
+      "sha256": "c3cafa042f7ac9715569b9c3312e27b920e88497047415cb653bb576cf5380a9"
     },
     {
       "path": "tests/criterion_progress.mjs",
@@ -6512,7 +6512,7 @@
     {
       "path": "tests/governance_page_gates.mjs",
       "mode": "0000644",
-      "sha256": "cf0d01b58a209d9d2ad64e2c1c999ce2338fb0f69bb5ddff43ca7f24d7bc66be"
+      "sha256": "be6cc9a4070d9de107cd11bfcb7a38e074f8aeb71198839cd42438d3ea2a0c04"
     },
     {
       "path": "tests/governance_parity.mjs",
@@ -6532,7 +6532,7 @@
     {
       "path": "tests/governance_require_permission.mjs",
       "mode": "0000644",
-      "sha256": "58090f6e6cb0cb7e99b03675deeb80302986b053dc1402e254f64ae4126df084"
+      "sha256": "2e8d7f3bb58411efd79727f6edffa448136551ef1c3c6973228fdfa7903f7cb3"
     },
     {
       "path": "tests/governance_resolver.mjs",
@@ -6582,12 +6582,12 @@
     {
       "path": "tests/grade_server_authoritative.mjs",
       "mode": "0000644",
-      "sha256": "c582e967a183ac9fcff99c2059543ac34f2dd98b39f21b5053d2c463287f01e6"
+      "sha256": "c650bd3c79d469f3ffb1cdada6f23521dd09c97844affd5b9e7f340d1796daa6"
     },
     {
       "path": "tests/grade_unavailable_display.mjs",
       "mode": "0000644",
-      "sha256": "c6082286a017edc4369e4766b346d8ea981667a4270839868d7b846cde154782"
+      "sha256": "82746689da273a8bd9d53d80204b15147d87574d2331c3a70d736d95a6126a09"
     },
     {
       "path": "tests/grader.mjs",
@@ -6992,7 +6992,7 @@
     {
       "path": "tests/override_request_ownership.mjs",
       "mode": "0000644",
-      "sha256": "da77422fac6c4624315b8c51bd8974a93a5f64f0c72c1ef1a3665744e42dc15c"
+      "sha256": "dac9d9891eac706432aff97ce35e27692064a2791dc1e546215c74e68b81e8a8"
     },
     {
       "path": "tests/package_core.mjs",
@@ -7167,7 +7167,7 @@
     {
       "path": "tests/reward_gate.mjs",
       "mode": "0000644",
-      "sha256": "ace9bb9db5a25b98de4d62f5150fb17db345d78e747aca95a6628dcd2a957afe"
+      "sha256": "7ae4d9af4d389c34f0d16f921858cbbf5d0d57f3219f830d10552ebcdc43908f"
     },
     {
       "path": "tests/reward_mode_cost_plus_only.mjs",
@@ -7502,7 +7502,7 @@
     {
       "path": "tests/task_ownership_gate.mjs",
       "mode": "0000644",
-      "sha256": "0a0aa9bd7147256422f348567a67e206bafeefe88430195834ddebf405b59bdd"
+      "sha256": "cfb57e35ce65f991309e4de64c03f9252e19117a1ad406cf9bb04c1716f57746"
     },
     {
       "path": "tests/touches_overlap.mjs",

package/clients/bongos-client/index.d.ts

@@ -131,7 +131,7 @@ export interface PatchMeSkillPrefsResponse { prefs: unknown; effective: unknown;
 export interface PatchMeSoundPrefsResponse { prefs: unknown; effective: unknown; effective_map: unknown; volume: unknown; defaults: unknown; known_sounds: unknown }
 export interface PatchProjectsIdFeaturedRequest { featured: boolean }
 export interface PatchProjectsIdFeaturedResponse { project: unknown }
-export interface PatchTasksIdRequest { kind?: string; discipline?: string; requires_rank?: string; module_key?: string; goal_id?: number; parent_task_id?: StringifiableId; parallel_safe?: unknown; newcomer_friendly?: boolean; xenos_claimable?: boolean; security_sensitive?: boolean; automation_tag?: string }
+export interface PatchTasksIdRequest { kind?: string; discipline?: string; requires_rank?: string; module_key?: string; goal_id?: number; parent_task_id?: StringifiableId; parallel_safe?: unknown; newcomer_friendly?: boolean; xenos_claimable?: boolean; security_sensitive?: boolean; automation_tag?: string; status?: unknown }
 export interface PostAccessRequestsRequest { github_login: string; display_name?: string; note?: string }
 export interface PostAccessRequestsResponse { ok: boolean; request?: unknown; already_pending?: boolean }
 export interface PostAuthAppPairApproveRequest { pair_code: string }

package/docs/api/openapi.json

@@ -12008,7 +12008,7 @@
           "versions"
         ],
         "summary": "POST /versions/:id/done-when",
-        "description": "Auth (Metic+, then the goal's own authority): create a done-when criterion at RUNTIME. ADR 0105 moved scope-truth seeds (versions/goals/criteria) out of the normal migration path, so a brand-new criterion on a RUNNING instance can no longer be added by a plain migration (migrations/instance/ applies only under the owner opt-in GDS_APPLY_INSTANCE_SEEDS=1, a DR step). This is the vector a planning session uses to add a criterion to a live version WITHOUT a droplet migrate. ADR 0154 — authority over a GOAL's criteria follows GOAL OWNERSHIP, not global rank. A Metic who may create the goal (POST /goals) and author the tasks under it (POST /tasks, ADR 0090) may now write the criteria those tasks gate — but only inside a goal they own or manage. Deliberately NOT a flat re-rank: - An unsatisfied criterion permanently blocks version close (version-close.js counts satisfied === total per VERSION, regardless of goal) and goal auto-achieve (db.achieveGoalIfComplete). There is NO delete route, so it cannot be undone via the API — the same backward ratchet as unsatisfy, which stays Archon. - So a non-Archon must name a goal_id (version-level criteria stay Archon), must be that goal's OWNER or MANAGER (isGoalOwnerOrManager — the same predicate behind visibility/invite/role management), and the goal must be open on a planning/building version. That bounds the blast radius to a workspace they already hold. An unauthorized caller is masked behind bad_goal_id so the route is not an existence oracle (ADR 0112). Pinned in route-rank-check.MODULE_EXPECTED_RANKS. rank: metic+archon — criterion create, walled by goal ownership (ADR 0154).\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `criterion.create` (all required).",
+        "description": "Auth (Metic+, then the goal's own authority): create a done-when criterion at RUNTIME. ADR 0105 moved scope-truth seeds (versions/goals/criteria) out of the normal migration path, so a brand-new criterion on a RUNNING instance can no longer be added by a plain migration (migrations/instance/ applies only under the owner opt-in GDS_APPLY_INSTANCE_SEEDS=1, a DR step). This is the vector a planning session uses to add a criterion to a live version WITHOUT a droplet migrate. ADR 0154 — authority over a GOAL's criteria follows GOAL OWNERSHIP, not global rank. A Metic who may create the goal (POST /goals) and author the tasks under it (POST /tasks, ADR 0090) may now write the criteria those tasks gate — but only inside a goal they own or manage. Deliberately NOT a flat re-rank: - An unsatisfied criterion permanently blocks version close (version-close.js counts satisfied === total per VERSION, regardless of goal) and goal auto-achieve (db.achieveGoalIfComplete). There is NO delete route, so it cannot be undone via the API — the same backward ratchet as unsatisfy, which stays Archon. - So a non-Archon must name a goal_id (version-level criteria stay Archon), must be that goal's OWNER or MANAGER (isGoalOwnerOrManager — the same predicate behind visibility/invite/role management), and the goal must be open on a planning/building version. That bounds the blast radius to a workspace they already hold. An unauthorized caller gets an honest 403 goal_not_yours (task 1002614 — goal reads are open to any builder, so there is no existence oracle for a mask to protect). Pinned in route-rank-check.MODULE_EXPECTED_RANKS. rank: metic+archon — criterion create, walled by goal ownership (ADR 0154).\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `criterion.create` (all required).",
         "x-rank": "metic+archon",
         "x-source": "modules/lifecycle/routes/done-when.js",
         "x-permissions": [
@@ -13788,7 +13788,8 @@
           "automation_tag": {
             "type": "string",
             "maxLength": 64
-          }
+          },
+          "status": {}
         },
         "additionalProperties": false
       },

package/docs/api-reference.md

@@ -463,7 +463,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/tasks` | `any-builder` | — | reads (filtered task list); preserved per CRITICAL §4. |
 | POST | `/api/bongos/tasks` | `metic+archon` | `version_id`, `title`, `description`, `status`, `touches`, `est_minutes`, `est_cost_usd`, `manual_degree`, `priority`, `automation_tag`, `credits_reward`, `source`, `source_ref`, `value_summary`, `kind`, `discipline`, `parallel_safe`, `newcomer_friendly`, `security_sensitive`, `requires_rank`, `auto_detect_touches`, `criterion_ids`, `module_key`, `goal_id` | Task create/promote/edit (plan/scope mutation) is Metic+ as of ADR 0090 (owner decision 2026-06-26): a Metic who can run idea-triage may … |
 | GET | `/api/bongos/tasks/:id` | `any-builder` | — | single-task read; preserved per CRITICAL §4 (supervisor hot path). |
-| PATCH | `/api/bongos/tasks/:id` | `metic+archon` | `kind`, `discipline`, `requires_rank`, `module_key`, `goal_id`, `parent_task_id`, `parallel_safe`, `newcomer_friendly`, `xenos_claimable`, `security_sensitive`, `automation_tag` | PATCH /tasks/:id — supports body.parent_task_id (V2 C2), body.kind (V2 B1), body.discipline (mig 014), body.parallel_safe (mig 028), and … |
+| PATCH | `/api/bongos/tasks/:id` | `metic+archon` | `kind`, `discipline`, `requires_rank`, `module_key`, `goal_id`, `parent_task_id`, `parallel_safe`, `newcomer_friendly`, `xenos_claimable`, `security_sensitive`, `automation_tag`, `status` | PATCH /tasks/:id — supports body.parent_task_id (V2 C2), body.kind (V2 B1), body.discipline (mig 014), body.parallel_safe (mig 028), and … |
 | POST | `/api/bongos/tasks/:id/abandon` | `metic+archon` | `reason` | POST /tasks/:id/abandon — terminal "retire this task" transition (task 987). |
 | POST | `/api/bongos/tasks/:id/attest-gate` | `any-builder` | `head_sha` | POST /tasks/:id/attest-gate — body: { head_sha }. |
 | POST | `/api/bongos/tasks/:id/confirm` | `any-builder` | `verified` |  |

package/modules/governance/routes/governance.js

@@ -62,6 +62,9 @@ const governancePort = {
   isSystem: catalog.isSystem,
   isGrantable: catalog.isGrantable,
   permissionKeys: catalog.permissionKeys,
+  // The seeded floor of one atom, for denial text that names the rank instead of
+  // only the atom (task 1002613). Null for principal keys and unknown keys.
+  permissionFloor: (key) => (catalog.byKey(key) || {}).floor || null,
   resolvePrincipalPermissions: resolver.resolvePrincipalPermissions,
   principalHasPermission: resolver.principalHasPermission,
   isPrincipalKey: catalog.isPrincipalKey,

package/modules/grading/grader.js

@@ -734,6 +734,12 @@ function serverSideGuards(gradeResult, { committedFiles, builderRank, diffStats,
         downgraded_to: downgradeTo,
         client_passed: clientPassed,
         tripped: guardsTripped,
+        // task 1002614 (map P-2): a permission_path trip is an AUTHORIZATION
+        // refusal of the builder's rank over protected paths — not a verdict on
+        // the code. Named here so clients render it as a wall, not a quality
+        // FAIL the builder should fix-and-retry (the envelope used to teach
+        // exactly that wrong lesson). route_rank stays a code finding.
+        authorization_refusal: guardsTripped.some((g) => g.guard === 'permission_path'),
       },
     },
     notes_md: `${base.notes_md || ''}${guardNote}`,

package/modules/hall-ui/public/shell.js

@@ -360,6 +360,36 @@
     applyZoom();
   }
 
+  // task 1002613 (map N-1): a server page-gate denial lands here with
+  // ?denied=<permission>[&reason=unavailable]. Render the refusal — "you are
+  // signed in; you lack X" — then strip the query so a refresh or a shared link
+  // doesn't re-show a stale notice. Cosmetic only; the gate already ran.
+  function renderDeniedNotice() {
+    // Hand-parsed (no URLSearchParams): shell.js is dependency-free by design,
+    // and the hall unit tests boot it in a bare vm context.
+    var search = (window.location && window.location.search) || '';
+    var m = /[?&]denied=([^&]+)/.exec(search);
+    if (!m) return;
+    var denied = decodeURIComponent(m[1]);
+    if (!/^[a-z0-9_.-]{1,80}$/i.test(denied)) return;
+    var unavailable = /[?&]reason=unavailable(?:&|$)/.test(search);
+    var topbar = document.getElementById('app-topbar');
+    if (!topbar) return;
+    var el = document.createElement('div');
+    el.className = 'denied-notice';
+    el.setAttribute('role', 'status');
+    el.innerHTML =
+      '<span>' + (unavailable
+        ? 'You’re signed in, but access to that page couldn’t be verified just now (the permission system didn’t answer), so it stayed closed. Try again in a minute.'
+        : 'You’re signed in, but that page needs the <code>' + esc(denied) + '</code> permission — your current role doesn’t hold it.') +
+      '</span>' +
+      '<button type="button" class="denied-notice__close" aria-label="Dismiss">×</button>';
+    el.querySelector('.denied-notice__close').addEventListener('click', function () { el.remove(); });
+    topbar.insertAdjacentElement('afterend', el);
+    var rest = search.replace(/[?&](?:denied|reason)=[^&]*/g, '').replace(/^&/, '?');
+    history.replaceState(null, '', window.location.pathname + rest + window.location.hash);
+  }
+
   function renderFoot() {
     var el = document.getElementById('app-foot');
     if (!el) return;
@@ -615,6 +645,7 @@
 
   renderSidebar();
   renderTopbar();
+  renderDeniedNotice();
   renderFoot();
   applyTheme();
   applyZoom();

package/modules/hall-ui/public/style.css

@@ -455,6 +455,30 @@ button { font-family: var(--font-body); }
   overflow: hidden;
   text-overflow: ellipsis;
 }
+/* Page-gate denial notice (task 1002613, map N-1) — rendered by shell.js from
+   the ?denied= query a refused page redirect carries. */
+.denied-notice {
+  display: flex;
+  align-items: baseline;
+  gap: 12px;
+  padding: 10px 24px;
+  font-size: 13px;
+  color: var(--warn);
+  background: var(--warn-weak);
+  border-bottom: 1px solid var(--border);
+}
+.denied-notice code {
+  font-size: 12px;
+}
+.denied-notice__close {
+  margin-left: auto;
+  border: 0;
+  background: none;
+  color: inherit;
+  font-size: 16px;
+  line-height: 1;
+  cursor: pointer;
+}
 .topbar-menu {
   display: none;
   align-items: center;

package/modules/lifecycle/db.js

@@ -42,7 +42,7 @@ const doneWhen = require('./done-when.js');
 const { generalGoalTitle } = require('./goal-advisory.js');
 // BV1.R106 (ADR 0151): the permission-expressed QUEUE axis of claim eligibility.
 // Kept deliberately separate from the per-task requires_rank floor below.
-const { claimEligibilityAllows } = require('./claim-eligibility.js');
+const { claimEligibilityAllows, CLAIM_ANY, CLAIM_NEWCOMER } = require('./claim-eligibility.js');
 // Pure kernel-adjacent matchers via the doorway (never the core file).
 const { matchProtected } = api.permissionPathCheck;
 const { touchesOverlap } = api.pathMatch;
@@ -2572,7 +2572,23 @@ async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSess
     // task.claim.any / task.claim.newcomer — see ./claim-eligibility.js.
     const newcomerFriendly = task.newcomer_friendly;
     if (!claimEligibilityAllows({ heldPermissions, newcomerFriendly, rankRuleAllows: xenosClaimAllowed(builderRank, newcomerFriendly) })) {
-      throw { code: 'rank_too_low_for_task', legacy_code: 'XENOS_RESTRICTED' };
+      // task 1002613 (map §4.4): the bare code reported a PERMISSION decision as
+      // a rank one — no axis, no remedy. Copy INSUFFICIENT_RANK's shape below:
+      // name both sides of the wall and the way forward.
+      const opened = newcomerFriendly === true;
+      throw {
+        code: 'rank_too_low_for_task',
+        legacy_code: 'XENOS_RESTRICTED',
+        required: opened ? [CLAIM_ANY, CLAIM_NEWCOMER] : [CLAIM_ANY],
+        actual: builderRank,
+        newcomer_friendly: opened,
+        message: opened
+          ? `claiming this task needs ${CLAIM_ANY} or ${CLAIM_NEWCOMER}, and your role holds neither`
+          : `this task is not opened to newcomers (newcomer_friendly is not set) and your role lacks ${CLAIM_ANY}`,
+        hint: opened
+          ? 'your builder appears to hold no claim permission at all — ask for your rank-role to be re-synced'
+          : 'pick a newcomer_friendly task from the claimable feed (/builder-start), or a builder whose role holds task.claim.any can claim this one',
+      };
     }
 
     // V3.R82 (#301): the inverse gate — a task can RAISE its minimum required

package/modules/lifecycle/routes/done-when.js

@@ -26,11 +26,11 @@ const { validateOrRespond, parseId, asyncHandler, LIMITS } = api;
 // pinned by a DB-free unit test (the authorizeGoalTaskCreate precedent in
 // routes/goals.js). The route resolves goal/version first — their absence is a
 // 404/400 there — so this gate only decides AUTHORITY, in this order:
-//   archon → allow · goal named? · owner|manager? (MASKED) · goal open? · version open?
-// Authority sits ahead of both state checks on purpose — see the no-leak note below.
-// An Archon short-circuits: version-level (goal-less) criteria and any goal in any
-// state stay theirs. Returns { ok:true }, { ok:false, status, body }, or
-// { ok:false, maskAsBadGoalId:true } (the route renders the identical 400).
+//   archon → allow · goal named? · owner|manager? (403) · goal open? · version open?
+// Authority sits ahead of both state checks on purpose — an outsider never learns
+// goal state from the 409s below. An Archon short-circuits: version-level
+// (goal-less) criteria and any goal in any state stay theirs. Returns
+// { ok:true } or { ok:false, status, body }.
 //
 // "Version open" = `planning` or `building`. NOT just `building`: a planning session
 // scopes a version at status='planning', which is the main moment criteria get
@@ -47,16 +47,18 @@ function authorizeCriterionCreate({ goal, version, actorId, actorRank, actorMemb
       message: 'Name the goal this criterion belongs to — a version-level criterion is Archon-only (ADR 0154).',
     } };
   }
-  // NO-LEAK ORDERING — authority BEFORE state, and the refusal is MASKED.
-  // Before ADR 0154 this route was Archon-only, and an Archon can already read
-  // every goal, so no probe existed. Now a Metic may call it, and distinguishable
-  // refusals (400 "no such goal" vs 403 "not yours" vs 409 "not open") would turn
-  // it into an oracle for which goal ids exist on a version — including PRIVATE
-  // goals (ADR 0112). So a caller who is not the owner/manager gets byte-identical
-  // `bad_goal_id` to a caller naming a goal that does not exist. Only someone who
-  // already holds the goal learns anything further about it.
+  // Authority BEFORE state (an outsider still never sees goal state via the 409
+  // below). Until task 1002614 the refusal here was MASKED behind the same
+  // `bad_goal_id` 400 as an absent goal, as an anti-oracle for goal ids (ADR
+  // 0112). The mask asserted a falsehood about a goal that exists and bought no
+  // secrecy: ADR 0112 privacy is join-gating, not read-hiding — GET /goals/:id
+  // serves any authenticated builder the goal, its members, criteria and state
+  // (choke-point map D-3). So the refusal now names its wall.
   if (!isGoalOwnerOrManager({ goal, actorId, actorRank, actorMembership })) {
-    return { ok: false, maskAsBadGoalId: true };
+    return { ok: false, status: 403, body: {
+      error: 'goal_not_yours',
+      message: `Criteria on goal ${goal.id} can be authored only by the goal's owner or a manager (ADR 0154). Ask them to add it — or to grant you the manager role.`,
+    } };
   }
   if (goal.status !== 'open') {
     return { ok: false, status: 409, body: {
@@ -112,8 +114,9 @@ module.exports = function buildDoneWhenRouter() {
   //     must be that goal's OWNER or MANAGER (isGoalOwnerOrManager — the same
   //     predicate behind visibility/invite/role management), and the goal must be
   //     open on a planning/building version. That bounds the blast radius to a
-  //     workspace they already hold. An unauthorized caller is masked behind
-  //     bad_goal_id so the route is not an existence oracle (ADR 0112).
+  //     workspace they already hold. An unauthorized caller gets an honest 403
+  //     goal_not_yours (task 1002614 — goal reads are open to any builder, so
+  //     there is no existence oracle for a mask to protect).
   // Pinned in route-rank-check.MODULE_EXPECTED_RANKS.
   // rank: metic+archon — criterion create, walled by goal ownership (ADR 0154).
   router.post('/versions/:id/done-when', auth.requireBuilder, auth.requirePermission('criterion.create'), asyncHandler('POST /versions/:id/done-when', async (req, res) => {
@@ -127,9 +130,9 @@ module.exports = function buildDoneWhenRouter() {
     })) return;
     const version = await db.getVersion(versionId);
     if (!version) return res.fail('version_not_found', { status: 404, message: `No version '${versionId}'.` });
-    // The ONE bad_goal_id refusal, used both for a genuinely absent/foreign goal
-    // and for the masked unauthorized case below — same code, same message, same
-    // envelope, so the two are indistinguishable on the wire.
+    // bad_goal_id now means exactly what it says: the goal is absent or belongs
+    // to another version. (The unauthorized case rendered through this same
+    // helper until task 1002614 — see the mask note in authorizeCriterionCreate.)
     const badGoalId = () => res.fail('bad_goal_id', { status: 400, message: `goal_id ${req.body.goal_id} does not exist on version '${versionId}'.` });
     // A goal_id, if given, must exist AND belong to this version.
     let goal = null;
@@ -148,7 +151,6 @@ module.exports = function buildDoneWhenRouter() {
       goal, version, actorId: req.builder.id, actorRank: req.builder.rank, actorMembership,
     });
     if (!decision.ok) {
-      if (decision.maskAsBadGoalId) return badGoalId();
       return res.status(decision.status).json(decision.body);
     }
     try {

package/modules/lifecycle/routes/tasks.js

@@ -129,6 +129,15 @@ async function gateTaskOwnership(req, res, taskId, { allowSupervisor = false } =
   if (allowSupervisor && rank === 'metic') return true;
   const holder = await db.getLastClaimHolder(taskId);
   if (holder && String(holder.builder_id) === String(req.builder.id)) return true;
+  // task 1002614 (map N-2): a mistyped id used to earn the same not_your_task
+  // 403 as someone else's work — a misattribution that sent builders debugging
+  // ownership. An ABSENT task is the clean 404 an Archon already saw (they pass
+  // above and hit the handler's own lookup). A never-claimed task that EXISTS
+  // still fails closed with the 403 below (the L2 credit-theft block).
+  if (!holder && !(await db.getTask(taskId))) {
+    res.fail('task_not_found', 404);
+    return false;
+  }
   res.fail('not_your_task', { status: 403, message: 'Only the task\'s claim holder (or an Archon) may grade/confirm/ship it.' });
   return false;
 }
@@ -764,6 +773,11 @@ module.exports = function buildTasksRouter() {
       xenos_claimable: { type: 'boolean' },              // pre-rename alias for newcomer_friendly
       security_sensitive: { type: 'boolean' },           // task 990 — Archon-only ship broadcast
       automation_tag: { type: 'string', maxLength: 64 },
+      // task 1002614 (map D-18): DECLARED so strict-mode admits the request far
+      // enough to reach the deliberate status_not_patchable hint below (#514) —
+      // the hint had been unreachable dead code behind unknown_field since the
+      // R11 strict-validation sweep landed after it.
+      status: {},
     })) return;
     const id = parseId(req, res, { code: 'bad_task_id', positiveInt: true });
     if (id === null) return;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.21",
+  "version": "1.19.23",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.21",
+      "version": "1.19.23",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.21",
+  "version": "1.19.23",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/ship.js

@@ -2776,6 +2776,36 @@ function formatGradeOutcome(g, taskId) {
     return out.join('\n');
   }
 
+  // task 1002614 (map P-2): a protected-path refusal used to render as an
+  // ordinary quality FAIL — "fix the issues and --regrade" — although no rank of
+  // the builder's can land that diff. Present it as the authorization wall it is
+  // (the #943 grader-unavailable branch is the precedent for a distinct shape).
+  // Keyed off the guard name so it also reads grades from servers predating the
+  // authorization_refusal marker.
+  const guardTripped = g.signals?.server_guard?.tripped || [];
+  const permRefusal = g.signals?.server_guard?.authorization_refusal === true
+    || guardTripped.some((t) => t.guard === 'permission_path');
+  if (!g.passed && permRefusal) {
+    out.push('');
+    out.push('Subagent grade: REFUSED (authorization)  ·  not a quality verdict — your work was not judged and rejected');
+    out.push('');
+    out.push('The committed diff touches PROTECTED surfaces above your rank, so the server');
+    out.push('refused to accept it — no re-attempt at your rank can land this diff as-is.');
+    if ((g.issues || []).length > 0) {
+      out.push('');
+      out.push('What was refused (file · rule):');
+      for (const it of g.issues.filter((i) => String(i.worker || '').includes('permission-path'))) {
+        out.push(`  ${it.file || '?'} — ${it.summary || ''}`);
+      }
+    }
+    out.push('');
+    out.push('Ways forward:');
+    out.push('  - Split the protected files out of your diff and re-ship the rest, or');
+    out.push('  - hand this task to a builder at/above the floor the refusal names.');
+    out.push(`(--regrade re-runs the same server check and will refuse again unless the diff changes.)`);
+    return out.join('\n');
+  }
+
   const verdict = g.passed ? 'PASS' : 'FAIL';
   out.push('');
   out.push(`Subagent grade: ${verdict}  ·  blended ${g.score}/10  ·  threshold ${g.threshold} (both axes)`);
@@ -3780,6 +3810,27 @@ async function shipMain() {
         console.error(`(Your work is committed and the task is at 'completed' — re-running resumes, task 941.)`);
         process.exit(1);
       }
+      // task 1002613 (map P-1): the one genuine permission wall on the ship path
+      // used to surface as a raw envelope dump — an atom name is not a rank, and
+      // no remedy printed at the one station where self-service exists. Interpret
+      // it: name the wall, the floor (from the server's floors map — never
+      // hardcoded), and both ways forward.
+      const errObj = confirm.data && confirm.data.error;
+      const errCode = typeof errObj === 'string' ? errObj : (errObj && errObj.code);
+      if (confirm.status === 403 && errCode === 'permission_forbidden') {
+        const details = (errObj && typeof errObj === 'object' && errObj.details) || {};
+        const floor = details.floors && details.floors['task.confirm.grade_bypass'];
+        const floorNote = floor ? ` (floor: ${floor})` : '';
+        console.error('');
+        console.error(`✖ Confirming without a passing grade is permission-gated: task.confirm.grade_bypass${floorNote}.`);
+        console.error('  This is an authorization wall, not a verdict on your work.');
+        console.error('  Self-service: re-run WITHOUT --skip-grade to use the subagent grader, and if a');
+        console.error('  grade fails, fix its findings and re-run (unlimited, no attempt cap):');
+        console.error(`      node scripts/gds/ship.js ${taskId} --regrade`);
+        console.error(`  If the grade genuinely cannot pass, ask a builder whose role holds`);
+        console.error(`  task.confirm.grade_bypass${floorNote} to POST /api/gds/tasks/${taskId}/confirm.`);
+        process.exit(1);
+      }
       console.error(`manual-confirm failed (${confirm.status}):`, confirm.data);
       process.exit(1);
     }
@@ -3817,7 +3868,8 @@ async function shipMain() {
       console.error('Task stays at completed. Manual options:');
       console.error(`  - Re-run /builder-ship ${taskId} to try grading again, or`);
       console.error(`  - node scripts/gds/ship.js ${taskId} --regrade after fixing findings, or`);
-      console.error(`  - POST /api/gds/tasks/${taskId}/confirm to manual-confirm.`);
+      console.error(`  - POST /api/gds/tasks/${taskId}/confirm to manual-confirm (last resort —`);
+      console.error('    permission-gated on task.confirm.grade_bypass).');
       process.exit(1);
     }
 
@@ -4000,7 +4052,8 @@ async function regradeMain() {
   });
   if (!gradePost.ok) {
     console.error(`grade POST failed (${gradePost.status}):`, gradePost.data);
-    console.error('Task stays at completed. Fix the issue and re-run --regrade, or POST /confirm to manual-confirm.');
+    console.error('Task stays at completed. Fix the issue and re-run --regrade (unlimited, no attempt cap).');
+    console.error('(POST /confirm is a last resort — it is permission-gated on task.confirm.grade_bypass.)');
     process.exit(1);
   }
 

package/src/bongos/auth.js

@@ -1502,7 +1502,12 @@ async function runPageGate(name, req, res, next) {
   }
   const held = await resolveHeldPermissions(session.builder_id, session.raw_permission_keys);
   if (held === null || !held.has(permission)) {
-    res.redirect(302, deniedTo);
+    // N-1 (task 1002613): a bare deniedTo rendered nothing — every denial read as
+    // "I signed in and got dumped at the home page". Name the permission (and an
+    // authority outage, distinctly) in the query so the hall shell can say why.
+    // Same destination, same audience — only the redirect learned to speak.
+    const reason = held === null ? '&reason=unavailable' : '';
+    res.redirect(302, `${deniedTo}?denied=${encodeURIComponent(permission)}${reason}`);
     return;
   }
   next();
@@ -1693,11 +1698,38 @@ function requireRank(...allowed) {
 // null` analogue). Reporting only the intersection explains the denial without
 // dumping the builder's entire permission set into an error body.
 //
+// The body also carries a `message` and a `floors` map (missing atom → its
+// catalog floor rank) so the denial names the rank, not just the atom (task
+// 1002613, choke-point map §4.4 P-1). Floors resolve through the port at deny
+// time — never hardcoded prose, which goes stale when a floor moves (the
+// D-16/N-3 failure shape ADR 0157 left behind).
+//
 // Usage: router.post('/roles', auth.requireBuilder, auth.requirePermission('governance.manage'), handler)
 function requirePermission(...perms) {
   const required = Object.freeze([...perms]);
   return async function permissionGate(req, res, next) {
-    const deny = (held) => res.fail('permission_forbidden', 403, { required, held });
+    const deny = (held) => {
+      const missing = held === null ? [...required] : required.filter((key) => !held.includes(key));
+      const floors = {};
+      const governance = seams.resolveOptional('governance');
+      if (governance && typeof governance.permissionFloor === 'function') {
+        for (const key of missing) {
+          const floor = governance.permissionFloor(key);
+          if (floor) floors[key] = floor;
+        }
+      }
+      const floorNote = Object.keys(floors).length > 0
+        ? ` (floor: ${[...new Set(Object.values(floors))].join(', ')})`
+        : '';
+      const message = held === null
+        ? `authority could not be established — denied fail-closed (ADR 0016); this route requires ${required.join(', ') || 'a permission list'}${floorNote}`
+        : `missing permission${missing.length === 1 ? '' : 's'}: ${missing.join(', ')}${floorNote}`;
+      return res.fail('permission_forbidden', {
+        status: 403,
+        message,
+        details: { required, held, floors: Object.keys(floors).length > 0 ? floors : null },
+      });
+    };
     const builderId = req.builder && req.builder.id;
     if (!builderId) return deny(null);
     if (required.length === 0) return deny(null);

package/src/module-api.js

@@ -469,8 +469,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.19 with no explicit bump. run 31347092915. (task 1002620)
 //   1.19.21 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.20 with no explicit bump. run 31446766597. (task 1002620)
+//   1.19.22 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.21 with no explicit bump. run 31449168428. (task 1002620)
+//   1.19.23 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.22 with no explicit bump. run 31450197816. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.21'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.23'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/criterion_authoring_gate.mjs

@@ -84,13 +84,15 @@ await test('a non-Archon with NO goal_id is refused — version-level criteria s
 await test('a plain MEMBER may not author — membership is not management', () => {
   const d = ask({ goal: G_OPEN, actorId: MEMBER, actorMembership: PLAIN });
   assert.equal(d.ok, false);
-  assert.equal(d.maskAsBadGoalId, true);
+  assert.equal(d.status, 403);
+  assert.equal(d.body.error, 'goal_not_yours');
 });
 
 await test('a STRANGER (no membership at all) may not author', () => {
   const d = ask({ goal: G_OPEN, actorId: STRANGER, actorMembership: null });
   assert.equal(d.ok, false);
-  assert.equal(d.maskAsBadGoalId, true);
+  assert.equal(d.status, 403);
+  assert.equal(d.body.error, 'goal_not_yours');
 });
 
 await test('an ACHIEVED goal is closed to new criteria (409) — no reopening settled scope', () => {
@@ -107,38 +109,43 @@ await test('an ARCHIVED goal is closed to new criteria (409)', () => {
   assert.equal(d.body.error, 'goal_not_open');
 });
 
-// ---- NO-LEAK: the route must not become a goal-existence oracle (ADR 0112) ----
-// Before ADR 0154 this route was Archon-only and Archons read every goal, so no
-// probe existed. Now a Metic may call it — so an unauthorized caller must not be
-// able to tell "this goal id exists but isn't mine" from "no such goal".
+// ---- the refusal is HONEST (task 1002614, map D-3) ----
+// Until task 1002614 an unauthorized caller was MASKED behind the same
+// bad_goal_id 400 as an absent goal, as an anti-oracle for goal ids (ADR 0112).
+// The mask asserted a falsehood about a goal that exists and protected nothing:
+// ADR 0112 privacy is join-gating, not read-hiding — GET /goals/:id serves any
+// authenticated builder the goal, members, criteria and state. So the refusal
+// now names its wall, and these pins hold it honest.
 
-await test('an unauthorized caller is MASKED — no status/body of its own to compare', () => {
+await test('an unauthorized caller gets an honest 403 naming the wall — not a false bad_goal_id', () => {
   const d = ask({ goal: G_OPEN, actorId: STRANGER, actorMembership: null });
-  assert.equal(d.maskAsBadGoalId, true);
-  assert.equal(d.status, undefined, 'the gate must not pick a distinguishable status');
-  assert.equal(d.body, undefined, 'the route renders the identical bad_goal_id 400');
+  assert.equal(d.status, 403);
+  assert.equal(d.body.error, 'goal_not_yours');
+  assert.match(d.body.message, /owner or a manager/, 'the refusal names who CAN author');
+  assert.match(d.body.message, /ADR 0154/, 'and where the rule comes from');
 });
 
-await test('the mask is IDENTICAL across every unauthorized shape — open, achieved, archived, private-ish', () => {
+await test('the refusal is uniform across goal states — authority still precedes state', () => {
+  // A stranger probing open/achieved/archived/system goals sees the SAME 403 —
+  // goal state stays behind the authority wall on this route (it is readable via
+  // GET /goals/:id, but this write route does not volunteer it).
   const probes = [G_OPEN, G_ACHIEVED, G_ARCHIVED, G_SYSTEM].map((goal) =>
     ask({ goal, actorId: STRANGER, actorMembership: null }));
-  for (const d of probes) assert.deepEqual(d, { ok: false, maskAsBadGoalId: true });
-  // A goal's STATE must not leak either: an outsider cannot learn that a goal id
-  // exists-but-is-archived, which `goal_not_open` would have told them.
-  assert.equal(new Set(probes.map((d) => JSON.stringify(d))).size, 1);
+  for (const d of probes) {
+    assert.equal(d.status, 403);
+    assert.equal(d.body.error, 'goal_not_yours');
+  }
 });
 
-await test('authority is checked BEFORE goal state — the ordering that makes the mask total', () => {
-  // An owner on an archived goal DOES get goal_not_open (useful, and they already
-  // know the goal exists). A stranger on the same goal gets the mask instead.
+await test('authority is checked BEFORE goal state — an owner sees goal_not_open, a stranger never does', () => {
   assert.equal(ask({ goal: G_ARCHIVED, actorId: OWNER, actorMembership: LEAD }).body.error, 'goal_not_open');
-  assert.equal(ask({ goal: G_ARCHIVED, actorId: STRANGER, actorMembership: null }).maskAsBadGoalId, true);
+  assert.equal(ask({ goal: G_ARCHIVED, actorId: STRANGER, actorMembership: null }).body.error, 'goal_not_yours');
 });
 
-await test('the route renders the mask through the SAME bad_goal_id helper as a truly absent goal', () => {
-  assert.match(doneWhenSrc, /const badGoalId = \(\) => res\.fail\('bad_goal_id'/, 'one helper builds the refusal');
+await test('bad_goal_id now means exactly what it says — the mask branch is gone from the route', () => {
+  assert.match(doneWhenSrc, /const badGoalId = \(\) => res\.fail\('bad_goal_id'/, 'one helper builds the absent/foreign refusal');
   assert.match(doneWhenSrc, /if \(!goal \|\| String\(goal\.version_id\) !== String\(versionId\)\) return badGoalId\(\);/, 'absent/foreign goal path');
-  assert.match(doneWhenSrc, /if \(decision\.maskAsBadGoalId\) return badGoalId\(\);/, 'masked path — same helper, so same code+message+envelope');
+  assert.doesNotMatch(doneWhenSrc, /maskAsBadGoalId/, 'no code path renders an authorization refusal as bad_goal_id');
 });
 
 await test('a SHIPPED version is refused (409) — closed scope', () => {
@@ -171,7 +178,7 @@ await test('a PLANNING version is ALLOWED — that is when criteria get written'
 await test('a system goal (created_by NULL) has no owner — a Metic cannot claim it', () => {
   const d = ask({ goal: G_SYSTEM, actorId: OWNER, actorMembership: null });
   assert.equal(d.ok, false);
-  assert.equal(d.maskAsBadGoalId, true);
+  assert.equal(d.body.error, 'goal_not_yours');
   // ...but a manager row still admits, and an Archon always does (below).
   assert.equal(ask({ goal: G_SYSTEM, actorId: OWNER, actorMembership: LEAD }).ok, true);
 });
@@ -215,7 +222,7 @@ await test('ordering: goal_id_required precedes the version check', () => {
 
 await test('ordering: an unauthorized caller never reaches the goal-state branch', () => {
   const d = ask({ goal: G_ARCHIVED, actorId: STRANGER, actorMembership: null });
-  assert.equal(d.maskAsBadGoalId, true, 'goal_not_open would confirm the goal exists');
+  assert.equal(d.body.error, 'goal_not_yours', 'the refusal is the authority wall, never goal_not_open');
 });
 
 // ---- the wall is the SAME one the sibling goal routes use ----

package/tests/governance_page_gates.mjs

@@ -74,12 +74,22 @@ const PRE_R107_AUDIENCE = {
   requireGovernancePage: { xenos: false, thetes: false, metic: true, archon: true },
 };
 // Where a SIGNED-IN builder who fails the gate is sent. Never the sign-in flow —
-// they already have a session, so that would loop.
+// they already have a session, so that would loop. Since task 1002613 (map N-1)
+// the redirect carries ?denied=<permission> — and &reason=unavailable when the
+// authority system itself never answered — so the hall shell can render WHY
+// instead of silently dumping the builder at the home page.
 const DENIED_TO = {
   requireBuilderPage: '/builders',
   requireNonXenosPage: '/builders/not-ready',
   requireGovernancePage: '/builders',
 };
+const GATE_PERMISSION = {
+  requireBuilderPage: 'page.view.public',
+  requireNonXenosPage: 'page.view.builder',
+  requireGovernancePage: 'page.view.governance',
+};
+const deniedLoc = (gate, { unavailable = false } = {}) =>
+  `${DENIED_TO[gate]}?denied=${GATE_PERMISSION[gate]}${unavailable ? '&reason=unavailable' : ''}`;
 // The equivalent rank floor, for the independent cross-check below.
 const GATE_FLOOR = {
   requireBuilderPage: 'xenos',
@@ -166,8 +176,8 @@ test('A2: a denied SIGNED-IN builder is redirected to an ungated page, not JSON-
       if (PRE_R107_AUDIENCE[gate][rank]) continue;
       const { res, nexted } = await runGate(gate, { rank });
       assert.equal(nexted, false, `${gate}/${rank} must not admit`);
-      assert.deepEqual(res._redirect, { code: 302, loc: DENIED_TO[gate] },
-        `${gate}/${rank} must 302 to ${DENIED_TO[gate]}`);
+      assert.deepEqual(res._redirect, { code: 302, loc: deniedLoc(gate) },
+        `${gate}/${rank} must 302 to ${deniedLoc(gate)} — naming the permission it lacked`);
       assert.equal(res._status, null, `${gate}/${rank} must not set an HTTP error status`);
       assert.equal(res._json, null, `${gate}/${rank} must not answer a JSON body`);
       assert.notEqual(res._redirect.loc, SIGN_IN,
@@ -211,7 +221,8 @@ test('B2: an UNREGISTERED governance port denies every gate, it does not admit',
   for (const gate of GATES) {
     const { res, nexted } = await runGate(gate, { rank: 'archon', port: false });
     assert.equal(nexted, false, `${gate}: a missing authority system must never open a page gate`);
-    assert.equal(res._redirect.loc, DENIED_TO[gate]);
+    assert.equal(res._redirect.loc, deniedLoc(gate, { unavailable: true }),
+      `${gate}: an authority outage must say so (&reason=unavailable), distinct from a permission denial`);
     assert.equal(res._json, null);
   }
 });
@@ -223,7 +234,7 @@ test('B3: a throwing resolver denies (a DB blip must not open the page)', async
       resolve: async () => { throw new Error('connection terminated'); },
     });
     assert.equal(nexted, false, `${gate} must fail CLOSED on a resolve failure`);
-    assert.equal(res._redirect.loc, DENIED_TO[gate]);
+    assert.equal(res._redirect.loc, deniedLoc(gate, { unavailable: true }));
   }
 });
 
@@ -247,7 +258,7 @@ test('B4: the page gates resolve per request — no memoised authority (ADR 0016
   seams._reset();
   assert.equal(calls, 2, 'the resolver must be consulted on every request');
   assert.equal(admittedAgain, false, 'a revoked role must deny on the very next request');
-  assert.equal(second._redirect.loc, '/builders');
+  assert.equal(second._redirect.loc, deniedLoc('requireGovernancePage'));
 });
 
 test('B5: every permission a page gate names is a real catalog key', async () => {

package/tests/governance_require_permission.mjs

@@ -83,6 +83,38 @@ test('multiple permissions are AND, not OR — holding one of two still denies',
   assert.equal(both.nexted, true, 'holding both must admit');
 });
 
+test('the denial names the floor rank, not just the atom (task 1002613, map P-1)', async () => {
+  // With the real port shape (permissionFloor present) the body carries a floors
+  // map and a message naming the rank. The floor is read from the catalog here so
+  // this test moves WITH a floor change instead of pinning stale prose — the
+  // D-16/N-3 failure shape the fix exists to avoid.
+  seams._reset();
+  seams.registerProvider('governance', {
+    resolveBuilderPermissions: holding('idea.triage'),
+    permissionFloor: (key) => (catalog.byKey(key) || {}).floor || null,
+  });
+  const res = fakeRes();
+  await auth.requirePermission('task.confirm.grade_bypass')({ builder: BUILDER }, res, () => {});
+  seams._reset();
+  assert.equal(res._status, 403);
+  const err = res._json.error;
+  const floor = catalog.byKey('task.confirm.grade_bypass').floor;
+  assert.deepEqual(err.details.floors, { 'task.confirm.grade_bypass': floor },
+    'floors maps each MISSING atom to its seeded floor');
+  assert.ok(err.message.includes('task.confirm.grade_bypass'), 'the message names the atom');
+  assert.ok(err.message.includes(floor), 'the message names the rank — an atom name is not a rank');
+});
+
+test('a port without permissionFloor still denies with a message; floors is null', async () => {
+  const { res } = await run(
+    auth.requirePermission('governance.manage'), { builder: BUILDER }, holding('idea.triage'),
+  );
+  assert.equal(res._status, 403);
+  assert.equal(res._json.error.details.floors, null);
+  assert.ok(res._json.error.message.includes('governance.manage'),
+    'the message names the missing atom even when no floor is resolvable');
+});
+
 test('no req.builder fails closed (gate mounted without requireBuilder)', async () => {
   const { res, nexted } = await run(auth.requirePermission('idea.triage'), {}, holding('idea.triage'));
   assert.equal(nexted, false);

package/tests/grade_server_authoritative.mjs

@@ -106,6 +106,11 @@ await test('sub-Metic forged PASS touching protected path → hard FAIL', () =>
   assert.equal(g.signals.confidence, 0, 'fail forwards confidence 0 so the server gate also fails');
   assert.ok(g.signals.server_guard.tripped.some((t) => t.guard === 'permission_path'));
   assert.ok(g.issues.some((i) => i.worker === 'server-permission-path'));
+  // task 1002614 (map P-2): this FAIL is an AUTHORIZATION refusal, and the
+  // envelope must say so — a quality-verdict shape taught builders to
+  // fix-and-retry a diff no rank of theirs can land.
+  assert.equal(g.signals.server_guard.authorization_refusal, true,
+    'a permission_path trip is named an authorization refusal, not a quality verdict');
 });
 
 await test('xenos forged PASS touching migrations/ → hard FAIL', () => {
@@ -129,6 +134,8 @@ await test('route-rank hard-fail (forged routes dir) flips a client PASS to FAIL
     assert.equal(g.passed, false, 'an ungated write route in the audited routes hard-fails the grade');
     assert.equal(g.signals.server_guard.downgraded_to, 'fail');
     assert.ok(g.signals.server_guard.tripped.some((t) => t.guard === 'route_rank'));
+    assert.equal(g.signals.server_guard.authorization_refusal, false,
+      'route_rank is a CODE finding — only permission_path is an authorization refusal (task 1002614)');
   } finally {
     fs.rmSync(dir, { recursive: true, force: true });
   }

package/tests/grade_unavailable_display.mjs

@@ -50,6 +50,34 @@ test('a real FAIL still prints the FAIL block + fix-the-issues guidance (#943 re
   assert.doesNotMatch(out, /GRADER UNAVAILABLE/);
 });
 
+test('an authorization refusal (permission_path guard) → REFUSED, not a quality FAIL (task 1002614 / P-2)', () => {
+  // The server guard refused a sub-Metic diff over protected paths. The old
+  // rendering was a plain FAIL + "fix the issues" — teaching a re-attempt no
+  // rank of the builder's could ever land.
+  const g = {
+    passed: false, score: 0, threshold: 6, notes_md: '',
+    issues: [{ severity: 'blocker', file: 'migrations/099_x.sql',
+      summary: '[server permission-path] protected surface — an Archon must own it', worker: 'server-permission-path' }],
+    signals: { server_guard: { downgraded_to: 'fail', authorization_refusal: true,
+      tripped: [{ guard: 'permission_path', severity: 'blocker', summary: 'protected machinery' }] } },
+  };
+  const out = formatGradeOutcome(g, 1002614);
+  assert.match(out, /REFUSED \(authorization\)/, 'must label the outcome as an authorization refusal');
+  assert.match(out, /not a quality verdict/, 'must say the work was not judged and rejected');
+  assert.match(out, /migrations\/099_x\.sql/, 'names the refused file');
+  assert.doesNotMatch(out, /Fix the issues above/, 'must NOT teach fix-and-retry against a wall');
+  assert.doesNotMatch(out, /blended .*\/10/, 'a refusal is not a score');
+});
+
+test('the guard-name fallback also triggers the refusal shape (grades from pre-marker servers)', () => {
+  const g = {
+    passed: false, score: 0, threshold: 6, issues: [],
+    signals: { server_guard: { tripped: [{ guard: 'permission_path' }] } },
+  };
+  const out = formatGradeOutcome(g, 1);
+  assert.match(out, /REFUSED \(authorization\)/);
+});
+
 test('a PASS prints the PASS block, no failure guidance (#943 regression guard)', () => {
   const g = {
     passed: true, score: 9, threshold: 6,

package/tests/override_request_ownership.mjs

@@ -71,8 +71,12 @@ const TASK = { id: 996, title: 'fixture task', credits_reward: 15, kind: 'featur
 // ===========================================================================
 
 const savedGetLastClaimHolder = db.getLastClaimHolder;
-function stubHolder(holderId) {
+const savedGetTask = db.getTask;
+// taskExists backs the N-2 absent-task 404 (task 1002614): the gate consults
+// db.getTask only when no claim holder exists.
+function stubHolder(holderId, { taskExists = true } = {}) {
   db.getLastClaimHolder = async () => (holderId == null ? null : { builder_id: holderId });
+  db.getTask = async () => (taskExists ? { id: TASK.id } : undefined);
 }
 function mkReq(id, rank) {
   return { builder: { id, rank, github_login: `b${id}` } };
@@ -133,9 +137,10 @@ await test('gate (L2): an Archon may still file an override-request on a never-c
   assert.equal(res.statusCode, null);
 });
 
-// Restore the real lookup before the attribution layer (which uses the deps.pool
-// seam and never touches getLastClaimHolder).
+// Restore the real lookups before the attribution layer (which uses the deps.pool
+// seam and never touches getLastClaimHolder/getTask).
 db.getLastClaimHolder = savedGetLastClaimHolder;
+db.getTask = savedGetTask;
 
 // ===========================================================================
 // Layer 2 — on approval, credit + tasks.shipped_by go to the CLAIM HOLDER.

package/tests/reward_gate.mjs

@@ -162,8 +162,10 @@ t('claim path AUTO-ASSIGNS inside the FOR UPDATE transaction (never refuses)', (
   // The window is a slice heuristic, not a contract: it only has to cover the
   // pre-flight half of claimTask (which spans ~13k chars). Widened 5000 -> 6000 in
   // BV1.R106, when the permission-expressed claim gate pushed the reward-gate block
-  // past the old edge. Keep it comfortably below the claimTasksBatch boundary.
-  const body = dbSrc.slice(start, start + 6000);
+  // past the old edge; 6000 -> 7000 in task 1002613, when the enriched
+  // rank_too_low_for_task denial did the same. Keep it comfortably below the
+  // claimTasksBatch boundary (~15.5k chars in).
+  const body = dbSrc.slice(start, start + 7000);
   assert.match(body, /rewardGateAssignment\(task\)/, 'claimTask must consult the auto-assign decision');
   assert.match(body, /UPDATE tasks SET credits_reward/, 'claimTask must persist the assigned reward in-tx');
   // it must SELECT the columns the gate needs.

package/tests/task_ownership_gate.mjs

@@ -41,8 +41,12 @@ const WORKER = 25;   // the claim holder who did the work
 const OTHER = 99;    // an unrelated builder
 
 // Stub the claim-holder lookup. holderId === null → no claim on record.
-function stubHolder(holderId) {
+// taskExists backs the N-2 absent-task 404 (task 1002614): the gate consults
+// db.getTask only when no claim holder exists, to tell a mistyped id from a
+// never-claimed task.
+function stubHolder(holderId, { taskExists = true } = {}) {
   db.getLastClaimHolder = async () => (holderId == null ? null : { builder_id: holderId });
+  db.getTask = async () => (taskExists ? { id: 123 } : undefined);
 }
 
 function mkReq(id, rank) {
@@ -108,6 +112,27 @@ await test('L2: a never-claimed task FAILS CLOSED for a non-Archon (the bypass-c
   assert.equal(res.body.error.code, 'not_your_task');
 });
 
+await test('N-2 (task 1002614): a NONEXISTENT task id is a clean 404, not not_your_task', async () => {
+  // A sub-Metic who mistypes an id used to be told the task was not theirs —
+  // the same 403 as someone else's task — while an Archon saw a clean 404.
+  stubHolder(null, { taskExists: false });
+  const res = mkRes();
+  assert.equal(await gateTaskOwnership(mkReq(OTHER, 'thetes'), res, 999999), false);
+  assert.equal(res.statusCode, 404);
+  assert.equal(res.body.error.code, 'task_not_found');
+});
+
+await test('N-2: the 404 never overrides ownership — someone ELSE\'s task stays 403 even if getTask errs', async () => {
+  // The existence lookup runs ONLY when no claim holder exists: with a holder
+  // on record the gate must answer not_your_task without consulting getTask.
+  db.getLastClaimHolder = async () => ({ builder_id: WORKER });
+  db.getTask = async () => { throw new Error('must not be called when a holder exists'); };
+  const res = mkRes();
+  assert.equal(await gateTaskOwnership(mkReq(OTHER, 'thetes'), res, 123), false);
+  assert.equal(res.statusCode, 403);
+  assert.equal(res.body.error.code, 'not_your_task');
+});
+
 await test('L2: a never-claimed task is still landable by an Archon (legit /confirm /grade path)', async () => {
   stubHolder(null);
   const res = mkRes();