@bongos/core 1.19.635 → 1.19.637

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.635",
-  "core_contract": "1.19.635",
-  "source_commit": "c97f3015861c4ca09d2c5a07f78ab33284d7c26c",
+  "core_version": "1.19.637",
+  "core_contract": "1.19.637",
+  "source_commit": "1c08a67a41a3bf7de85545460f6803cf6c68982d",
   "source_ref": "HEAD",
-  "built_at": "2026-09-10T02:33:59.187Z",
+  "built_at": "2026-09-10T04:22:04.368Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 468,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2099,
+    "functional_verbatim": 2100,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2591,
-  "tree_sha256": "c5c9267a793145efe19a63442cfbe05ee6cf03d5c6ff363084857bf151aec4cc",
+  "file_count": 2592,
+  "tree_sha256": "09c8365d205c14a4ae13cab5ab9eb561213f4e38cc9126033a3942e5dda81e3f",
   "files": [
     {
       "path": ".claude/skills/backlog-review/SKILL.md",
@@ -2777,7 +2777,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "baa05168e88c98e3fc35c1bf652bd85ef90dcfb463408c68e5132910316f8c34"
+      "sha256": "3e80809a3e33883a21335d5380c6bf9358d98f09ac1ccf6322c864bbbaa06892"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7707,12 +7707,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "f40ca54ae7693ccd7a41bb2429fa61f71b147f0aabc821535e4ca6e9055d9f49"
+      "sha256": "262eabcdc5a5a052871db03a5a334721de892e4d927f4c069787ad763d675686"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "1d7c9b3ad4172d3702cd4baa6fd5f30d1c26bedcfdcea6e8c2532d0decb9814e"
+      "sha256": "e62905214d126629233cda9c9bbb2d57e3b45771899b66139237607269e190fb"
     },
     {
       "path": "public-docs/index.html",
@@ -8144,6 +8144,11 @@
       "mode": "0000644",
       "sha256": "a34da5bd47c0410db31344ae042bae318e6daf0e774672999f14213c3c1180c5"
     },
+    {
+      "path": "scripts/gds/fitness-checks-route-pins.js",
+      "mode": "0000644",
+      "sha256": "4bd0d9c3b39a6f8af4561925835ebf9b349170be36aef926c6af2160af0d1ab5"
+    },
     {
       "path": "scripts/gds/fitness-checks-vocabulary.js",
       "mode": "0000644",
@@ -8167,7 +8172,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "cd9f61f69ef8d017a39bed129e41a3d3944cf53bfaf6ff26eb868e46611b6dc3"
+      "sha256": "610d76cee575fa1a87f2ff7bb84f5576f3c4a8cf2e727e6c372d76ebf9a0a340"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -8367,7 +8372,7 @@
     {
       "path": "scripts/gds/main-audit.js",
       "mode": "0000644",
-      "sha256": "18e14d00fead3293eb5b1c9d7a756a0a3780147938a40253ff35540740a73f4b"
+      "sha256": "35047f05c6059aee0cb64b13ef1495e4db1f3885b5b9c8cac5c60283069a059d"
     },
     {
       "path": "scripts/gds/me.js",
@@ -9312,7 +9317,7 @@
     {
       "path": "src/bongos/route-rank-check.js",
       "mode": "0000644",
-      "sha256": "514f9bb73cc74a2574272b733e0314dfe3b372497874bd7c88b763f22ddab64e"
+      "sha256": "f57293c2d157949ccb5a74511f167902adf096037b4830b0bf667a38baf6ab58"
     },
     {
       "path": "src/bongos/routes.js",
@@ -9452,7 +9457,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "79ef2ff7f2ac145450cc27389e4da2edd8079f2887ba7240c057e0e8cb8bb198"
+      "sha256": "b15a7de69ca6e8cd7c57b50dab455d6ec44a40336895c78738ad0f8ec8a25a10"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10482,7 +10487,7 @@
     {
       "path": "tests/fitness.mjs",
       "mode": "0000644",
-      "sha256": "5e5b53d5a1dce6b7ffacbea7198375aac6f77259ee948c00c24eb157f62a034d"
+      "sha256": "2208a1e4d3df3ce712c4e4dbc7908d20520833375a2c07c3da5d37252dd56b7a"
     },
     {
       "path": "tests/fitness_gds_ratchet.mjs",
@@ -10852,7 +10857,7 @@
     {
       "path": "tests/government_protected_surfaces.mjs",
       "mode": "0000644",
-      "sha256": "fd05f72404be0d007222793a6ed3a49904239f8bb354cddab6b052d74288b3b1"
+      "sha256": "cd56facc3522f17cd83b067ee1ae9dcb3e4e03dac13157013c44d7ba23508af2"
     },
     {
       "path": "tests/government_rank_sync.mjs",
@@ -11437,7 +11442,7 @@
     {
       "path": "tests/main_audit.mjs",
       "mode": "0000644",
-      "sha256": "9a1813d6036886ea07d1563e71a466e66c28554b75b22605464c795fd9fa2ebb"
+      "sha256": "eff2ce96889306f4898686c3648d302f54fff5f137ee41ddf543866fdf2f807d"
     },
     {
       "path": "tests/maintenance_goal.mjs",
@@ -12202,7 +12207,7 @@
     {
       "path": "tests/route_rank_check.mjs",
       "mode": "0000644",
-      "sha256": "9fd3762c6b171ee39b0cee336de2d41547795b2cd4898b178325cfdd321cf28a"
+      "sha256": "755f2c2c1cd929f0a4449ceb1c4bd0ac719aadf64c56484e03b4bed57e6daf7c"
     },
     {
       "path": "tests/route_shadow_guard.mjs",

package/docs/module-api-changelog.md

@@ -1719,5 +1719,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.633 with no explicit bump. run 34429621784. (task 1002620)
   1.19.635 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.634 with no explicit bump. run 34429906252. (task 1002620)
+  1.19.636 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.635 with no explicit bump. run 34434517065. (task 1002620)
+  1.19.637 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.636 with no explicit bump. run 34436870653. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.635",
+  "version": "1.19.637",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.635",
+      "version": "1.19.637",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.635",
+  "version": "1.19.637",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness-checks-route-pins.js

@@ -0,0 +1,76 @@
+// scripts/gds/fitness-checks-route-pins.js — Check 4b (task 1003192): every
+// MODULE_EXPECTED_RANKS key names a real module directory.
+//
+// Carved out of scripts/gds/fitness.js on the task-1003206 precedent (the R03
+// de-monolith plan): that file sits against the 1,500-line ratchet with two lines
+// of headroom, so a new check lands here rather than tipping it over. fitness.js
+// imports the name straight back, so the CHECKS registry and the module's public
+// surface — which the tests read heavily — are unchanged.
+//
+// WHY THE CHECK EXISTS. src/bongos/route-rank-check.js pins the expected rank of
+// each privileged module route, but pin SCOPE derives from successfully-classified
+// routes: a MODULE_EXPECTED_RANKS key matching no discovered module is dropped and
+// its pins pass VACUOUSLY, while the loader keeps mounting modules/<key>/routes/ in
+// production by the same convention the scan discovers them by. Measured on the real
+// classifier: with modules/security/ renamed, all six security pins went inert and a
+// POST /security/reports downgraded to any-builder drew zero findings — a pinned
+// privileged WRITE route silently unguarded.
+//
+// THIS IS THE SOURCE-REPO HALF of a two-layer guard. checkRouteRanks fires when a
+// module directory is PRESENT but contributed no route (a rename/move under a live
+// module); it deliberately stays silent on a wholly absent directory, because it runs
+// on every ship and an instance may legitimately omit an optional module. Here every
+// module is expected to exist, so a whole-directory rename or a typo'd key — neither
+// of which the other layer can see — hard-fails. The governance→government rename had
+// to hand-carry double-keyed pins precisely because nothing mechanical caught this.
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { REPO_ROOT } = require('./fitness-lib.js');
+const { checkRouteRanks, MODULE_EXPECTED_RANKS } = require('../../src/bongos/route-rank-check');
+
+// ============================================================================
+// Check 4 — no route bypasses server-side rank checks (ADR 0016)  [reuses route-rank-check]
+// ============================================================================
+// Moved here with Check 4b (task 1003192): the two are the same subject — Check 4 asks
+// whether each route carries a gate, 4b whether the pins that assert those gates are
+// actually in scope — and keeping them together is what buys fitness.js headroom against
+// the 1,500-line ratchet instead of leaving it sitting exactly on the cap.
+function checkRankGuards() {
+  const r = checkRouteRanks();
+  // hardFail = an ungated WRITE route or a downgraded privileged route. Unclassified read routes
+  // are 'concerns' (the Hacker adjudicates intent) — surfaced as warnings, not a hard failure.
+  const violations = r.findings.filter((f) => f.severity === 'blocker').map((f) => `${f.route} (${f.file}) — ${f.summary}`);
+  const warnings = r.findings.filter((f) => f.severity !== 'blocker').map((f) => `${f.route} (${f.file}) — ${f.summary}`);
+  return { name: 'route rank guards (ADR 0016)', ok: !r.hardFail, hardFail: r.hardFail, violations, warnings, note: `${r.routeCount} routes classify to a known rank; no ungated writes, no privileged downgrades.` };
+}
+
+// ============================================================================
+// Check 4b — module rank-pin keys resolve to a real modules/<key>/ dir
+// ============================================================================
+function checkModulePinKeysResolve() {
+  const violations = [];
+  for (const key of Object.keys(MODULE_EXPECTED_RANKS)) {
+    if (!fs.existsSync(path.join(REPO_ROOT, 'modules', key))) {
+      violations.push(`MODULE_EXPECTED_RANKS.${key} names no modules/${key}/ directory — its `
+        + `${Object.keys(MODULE_EXPECTED_RANKS[key]).length} rank pin(s) are INERT and pass vacuously `
+        + '(src/bongos/route-rank-check.js). Rename the key to the module\'s current directory, or drop the entry.');
+    }
+  }
+  return {
+    name: 'module rank-pin keys resolve (task 1003192)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: `${Object.keys(MODULE_EXPECTED_RANKS).length} module pin blocks all name a live modules/<key>/ directory.`,
+  };
+}
+
+module.exports = {
+  checkRankGuards,
+  checkModulePinKeysResolve,
+};

package/scripts/gds/fitness.js

@@ -23,7 +23,7 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const { execFileSync } = require('node:child_process');
-const { checkRouteRanks } = require('../../src/bongos/route-rank-check');
+const { checkRankGuards, checkModulePinKeysResolve } = require('./fitness-checks-route-pins.js'); // Checks 4 + 4b — carved out by task 1003192 (the 1,500-line ratchet)
 const genApiDocs = require('./gen-api-docs'); // R12 (#1999): reuse the route model (readsBody/validated) that drives the OpenAPI spec
 const { parseRoutineFrontmatter } = require('./run-routine'); // System 4 (ADR 0078): deterministic-routine boundary
 const { filenameViolation, stemCollisions, CORE_NS, INSTANCE_NS } = require('./migration-namespace'); // ADR 0108 §5: cross-repo migration namespacing
@@ -151,18 +151,6 @@ function checkNestedDocsPresent() {
   return { name: 'nested CLAUDE.md presence', ok: violations.length === 0, hardFail: violations.length > 0, violations, warnings: [], note: `present for: ${HIGH_TRAFFIC.join(', ')}.` };
 }
 
-// ============================================================================
-// Check 4 — no route bypasses server-side rank checks (ADR 0016)  [reuses route-rank-check]
-// ============================================================================
-function checkRankGuards() {
-  const r = checkRouteRanks();
-  // hardFail = an ungated WRITE route or a downgraded privileged route. Unclassified read routes
-  // are 'concerns' (the Hacker adjudicates intent) — surfaced as warnings, not a hard failure.
-  const violations = r.findings.filter((f) => f.severity === 'blocker').map((f) => `${f.route} (${f.file}) — ${f.summary}`);
-  const warnings = r.findings.filter((f) => f.severity !== 'blocker').map((f) => `${f.route} (${f.file}) — ${f.summary}`);
-  return { name: 'route rank guards (ADR 0016)', ok: !r.hardFail, hardFail: r.hardFail, violations, warnings, note: `${r.routeCount} routes classify to a known rank; no ungated writes, no privileged downgrades.` };
-}
-
 // ============================================================================
 // Check 5 — generated artifacts are fresh (Path C enforces Path B; ADR 0063 + ADR 0062 §8)
 // ============================================================================
@@ -1357,6 +1345,7 @@ const CHECKS = [
   checkSkillFrontmatter,
   checkNestedDocsPresent,
   checkRankGuards,
+  checkModulePinKeysResolve,
   checkGeneratedArtifactsFresh,
   checkDeterministicRoutines,
   checkCoreNeverImportsModule,
@@ -1443,6 +1432,7 @@ module.exports = {
   checkClaudeMdBudget,
   checkNestedDocsPresent,
   checkRankGuards,
+  checkModulePinKeysResolve,
   checkGeneratedArtifactsFresh,
   checkDeterministicRoutines,
   checkCoreNeverImportsModule,

package/scripts/gds/main-audit.js

@@ -55,7 +55,14 @@ const { cliClient, API_BASE } = require('./cli-lib');
 // not a GDS github_login, and every builder shares one commit email — so the
 // author NAME is the only distinguishing signal, and an unresolved name is
 // 'needs a human glance', not 'definitely a violation'.
-function analyzeCommits(commits, rankByIdentity, { strict = false } = {}) {
+//
+// `registry` is the protected-surface matcher, defaulting to the real one. It
+// is a parameter for the same reason `rankByIdentity` is: this analyzer is pure
+// and its callers supply its inputs. Tests inject a MIXED-FLOOR fixture through
+// it — the real registry floors every surface at 'metic' today, so without the
+// seam the per-hit floor comparison below is untestable and would silently rot
+// back into a global-minimum test. The CLI never passes it.
+function analyzeCommits(commits, rankByIdentity, { strict = false, registry = ppc } = {}) {
   const findings = [];
   for (const c of commits || []) {
     // #863-followup (finding #5): we no longer blanket-skip merges. For a
@@ -67,28 +74,46 @@ function analyzeCommits(commits, rankByIdentity, { strict = false } = {}) {
     // changes are still attributed to their feature commits (no double-count);
     // but a merge that smuggles a protected change is now caught and attributed
     // to the MERGE author.
-    const hits = ppc.matchProtected(c.files || []);
+    const hits = registry.matchProtected(c.files || []);
     if (hits.length === 0) continue;
 
     const rank = resolveRank(c, rankByIdentity);
     const fileList = hits.map((h) => h.file).join(', ');
     if (rank == null) {
+      const need = strictestFloorLabel(hits, registry);
       findings.push({
         severity: strict ? 'blocker' : 'review',
         sha: c.sha,
         author: c.authorName,
         rank: null,
         files: hits.map((h) => h.file),
-        summary: `commit ${short(c.sha)} by '${c.authorName}' touched permission-sensitive path(s) [${fileList}] but the author could not be resolved to a GDS rank. Verify it is Metic+ work.`,
+        summary: `commit ${short(c.sha)} by '${c.authorName}' touched permission-sensitive path(s) [${fileList}] but the author could not be resolved to a GDS rank. Verify it is ${need}+ work.`,
       });
-    } else if (ppc.isBelowFloor(rank)) {
+      continue;
+    }
+
+    // Each hit is judged against ITS OWN registry floor — not against the
+    // registry's global minimum. `isBelowFloor` tests the lowest floor any
+    // surface declares, which is identical only while every surface floors at
+    // the same rank (true today). The moment governance RAISES one surface's
+    // floor, a global-minimum test silently downgrades that raise back to the
+    // minimum here — in the one layer that catches a raw `git push origin main`
+    // (task 1003191; the cooperative layers already compare per-hit via
+    // checkPermissionPaths). Unknown ranks stay non-blocking, as before: an
+    // unresolvable rank is the `rank == null` case above.
+    const tier = registry.tierOf(rank);
+    const below = tier === null ? [] : hits.filter((h) => tier < registry.RANK_TIER[h.floor]);
+    if (below.length > 0) {
+      const need = strictestFloorLabel(below, registry);
+      const belowList = below.map((h) => `${h.file} (floor ${h.floor})`).join(', ');
       findings.push({
         severity: 'blocker',
         sha: c.sha,
         author: c.authorName,
         rank,
-        files: hits.map((h) => h.file),
-        summary: `commit ${short(c.sha)} by '${c.authorName}' (rank '${rank}', below Metic) modified permission-sensitive path(s) [${fileList}] — this is the SEC #863 violation class. It must be reverted and re-landed by a Metic+ builder if genuinely needed.`,
+        files: below.map((h) => h.file),
+        floors: below.map((h) => h.floor),
+        summary: `commit ${short(c.sha)} by '${c.authorName}' (rank '${rank}') modified permission-sensitive path(s) [${belowList}] whose registry floor it does not clear — this is the SEC #863 violation class. It must be reverted and re-landed by a ${need}+ builder if genuinely needed.`,
       });
     }
   }
@@ -115,6 +140,16 @@ function short(sha) {
   return String(sha || '').slice(0, 9);
 }
 
+// The highest rank floor demanded by a set of protected hits, title-cased for
+// prose ('Metic', 'Archon'). What a reader has to clear to own the whole commit
+// — so a finding names the floor that actually governs it rather than a
+// hardcoded 'Metic+' that a governance floor raise would make a lie.
+function strictestFloorLabel(hits, registry) {
+  const floors = hits.map((h) => h.floor);
+  const top = floors.reduce((a, b) => (registry.RANK_TIER[b] > registry.RANK_TIER[a] ? b : a), floors[0]);
+  return top ? top.charAt(0).toUpperCase() + top.slice(1) : 'Metic';
+}
+
 // ---------- git + API glue (CLI) ----------
 
 function git(args) {

package/src/bongos/route-rank-check.js

@@ -934,8 +934,34 @@ function checkRouteRanks({ routesDir = ROUTES_DIR, modulesDir } = {}) {
     if (mm) scopedModules.add(mm[1]);
   }
   const effectivePins = { ...EXPECTED_RANKS };
+  // task 1003192: the skip above is SILENT — a key matching no discovered module is
+  // dropped with no else branch, so its pins pass vacuously while the routes they
+  // guard stay live (the loader mounts modules/<key>/routes/ by the same convention
+  // this scan discovers them by). Probed: with modules/security/ renamed, all six
+  // security pins go inert and a POST /security/reports deliberately downgraded to
+  // any-builder draws ZERO findings. The governance→government rename had to
+  // hand-carry double-keyed pins precisely because nothing mechanical catches this.
+  //
+  // Fire only when the module DIRECTORY IS PRESENT but contributed no route: that is
+  // unambiguously a rename/move UNDER a live module, never a legitimately-absent
+  // optional one. A wholly-missing directory stays silent here on purpose — an
+  // instance may ship without an optional module, and this runs on every ship — so
+  // that half is caught at the SOURCE repo by fitness.js Check 4b, where every
+  // module is expected to exist. The two layers are complementary, not redundant.
   for (const [mod, pins] of Object.entries(MODULE_EXPECTED_RANKS)) {
-    if (scopedModules.has(mod)) Object.assign(effectivePins, pins);
+    if (scopedModules.has(mod)) { Object.assign(effectivePins, pins); continue; }
+    if (!fs.existsSync(path.join(modulesDir, mod))) continue; // optional module absent — legitimate
+    findings.push({
+      severity: 'major',
+      file: `modules/${mod}/`,
+      route: `(MODULE_EXPECTED_RANKS.${mod})`,
+      method: '(pins)',
+      rank: '(inert)',
+      summary: `modules/${mod}/ exists but contributed NO route to this scan, so its `
+        + `${Object.keys(pins).length} rank pin(s) were skipped and passed vacuously. `
+        + 'The routes may still be mounted in production while nothing verifies their rank. '
+        + `Point the pins at the module's current route location, or drop the ${mod} entry if the module no longer serves routes.`,
+    });
   }
   for (const [key, expected] of Object.entries(effectivePins)) {
     const r = byKey.get(key);

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.635'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.637'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/fitness.mjs

@@ -68,6 +68,17 @@ test('no route bypasses server-side rank checks (ADR 0016)', () => {
   assert.equal(r.hardFail, false, r.violations.join('\n'));
 });
 
+// task 1003192 — the source-repo half of the inert-pin guard. checkRouteRanks catches a
+// pinned module whose dir is present but yields no route; it stays silent on a wholly
+// absent dir because it runs on every ship and an instance may omit an optional module.
+// Here every module is expected to exist, so a whole-dir rename or a typo'd key — which
+// would park a block of rank pins vacuously while the routes stay mounted — must red.
+test('every MODULE_EXPECTED_RANKS key names a real module dir (task 1003192)', () => {
+  const r = fitness.checkModulePinKeysResolve();
+  assert.equal(r.hardFail, false, r.violations.join('\n'));
+  assert.equal(r.ok, true);
+});
+
 test('generated repo map is fresh (Path C enforces Path B)', () => {
   const r = fitness.checkGeneratedArtifactsFresh();
   assert.equal(r.hardFail, false, r.violations.join('\n'));

package/tests/government_protected_surfaces.mjs

@@ -172,14 +172,36 @@ test('every glob added since R101 carries a documented reason', () => {
   }
 });
 
-test('every surface floors at metic — the ADR 0043 floor, unchanged by the move', () => {
+// Metic is a FLOOR, not a fixed value (task 1003191). Pinning every surface to
+// exactly 'metic' made the registry's own contract untestable and, worse,
+// illegal: governance owns this data and raising one surface to 'archon' is a
+// policy edit the enforcers are supposed to honour. What must never happen is a
+// surface dropping BELOW Metic — that is ADR 0043 being weakened by a data edit.
+// So: no surface under Metic, and the derived minimum stays exactly Metic.
+test('no surface floors below Metic — the ADR 0043 floor (a raise above it is legal policy)', () => {
   for (const s of registry.SURFACES) {
-    assert.equal(s.floor, 'metic', `${s.glob} must keep the Metic floor`);
+    assert.ok(ppc.RANK_TIER[s.floor] >= ppc.RANK_TIER.metic,
+      `${s.glob} floors at '${s.floor}', below the Metic floor ADR 0043 sets. Governance may RAISE a floor; it may never lower one under Metic.`);
   }
-  assert.equal(registry.FLOOR, 'metic');
+  assert.equal(registry.FLOOR, 'metic', 'the lowest declared floor is the Metic floor itself');
   assert.equal(ppc.MIN_TIER, ppc.RANK_TIER.metic, 'the kernel floor must DERIVE to metic');
 });
 
+test('a floor raise flows through to the enforcers, not just the registry', () => {
+  // The registry promises a re-mapped floor reaches the substrate. Each layer
+  // must read the hit's OWN floor: the cooperative ones through
+  // checkPermissionPaths, the authoritative post-push audit through its per-hit
+  // comparison (task 1003191 — it used to test the global minimum and silently
+  // downgraded every raise).
+  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'main-audit.js'), 'utf8');
+  assert.ok(!/\bppc\.isBelowFloor\s*\(/.test(src),
+    'main-audit.js must not decide floors with isBelowFloor — that tests the registry '
+    + 'GLOBAL MINIMUM, so a governance floor raise is silently downgraded in the one '
+    + 'layer that catches a raw `git push origin main` (task 1003191).');
+  assert.ok(/RANK_TIER\[h\.floor\]/.test(src),
+    'main-audit.js must compare each hit against its own registry floor');
+});
+
 // ---------- the system-permission mapping flows from the registry ----------
 
 test('every entry maps to a permission the catalog defines as system:true', () => {

package/tests/main_audit.mjs

@@ -134,6 +134,101 @@ t('#863-followup (finding #6): a sub-Metic author NAME still resolves and BLOCKS
   assert.equal(r.findings[0].rank, 'thetes');
 });
 
+// -- per-hit registry floors (task 1003191) --------------------------------
+//
+// The authoritative layer used to decide floors with ppc.isBelowFloor(rank),
+// which tests the registry's GLOBAL MINIMUM floor. Every live surface floors at
+// 'metic', so that was indistinguishable from a per-hit comparison — until
+// governance RAISES one surface, at which point layer 3 silently downgraded the
+// raise back to the minimum while the pre-push hook and the grader (both on
+// checkPermissionPaths, which compares per-hit) still blocked it. Layer 3 is the
+// only one that catches a raw `git push origin main`, so the authoritative net
+// was the loosest of the three.
+//
+// A uniform-floor fixture cannot tell the two implementations apart. This is the
+// shape that can: one surface raised above the minimum, one left at it.
+const ppc = require('../src/bongos/permission-path-check.js');
+
+function mixedFloorRegistry() {
+  const SURFACES = [
+    { glob: 'infra/', floor: 'archon' },     // RAISED above the global minimum
+    { glob: 'src/bongos/db.js', floor: 'metic' }, // still at the minimum
+  ];
+  return {
+    RANK_TIER: ppc.RANK_TIER,
+    tierOf: (rank) => ppc.RANK_TIER[rank] ?? null,
+    matchProtected: (files) => (files || [])
+      .map((f) => {
+        const s = SURFACES.find((x) => (x.glob.endsWith('/') ? f.startsWith(x.glob) : f === x.glob));
+        return s ? { file: f, glob: s.glob, floor: s.floor, permission: 'path.protected.modify' } : null;
+      })
+      .filter(Boolean),
+  };
+}
+
+t('a RAISED surface floor is enforced: Metic touching an archon-floored path → BLOCKER', () => {
+  const r = analyzeCommits([{
+    sha: 'r01', subject: 'touch the substrate', authorName: 'SomeMetic', authorEmail: 'm@x',
+    isMerge: false, files: ['infra/deploy.sh'],
+  }], RANKS, { registry: mixedFloorRegistry() });
+  assert.equal(r.hardFail, true, 'a governance floor raise must reach the authoritative layer');
+  assert.equal(r.findings.length, 1);
+  assert.deepEqual(r.findings[0].floors, ['archon']);
+  assert.match(r.findings[0].summary, /Archon\+ builder/);
+});
+
+t('the finding reports only the paths the author actually fails to clear', () => {
+  // db.js floors at the minimum this Metic DOES clear; infra/ does not. A
+  // per-hit comparison names the second and stays silent about the first.
+  const r = analyzeCommits([{
+    sha: 'r02', subject: 'mixed', authorName: 'SomeMetic', authorEmail: 'm@x',
+    isMerge: false, files: ['src/bongos/db.js', 'infra/deploy.sh'],
+  }], RANKS, { registry: mixedFloorRegistry() });
+  assert.equal(r.hardFail, true);
+  assert.deepEqual(r.findings[0].files, ['infra/deploy.sh']);
+  assert.equal(r.findings[0].summary.includes('src/bongos/db.js'), false,
+    'a path the author clears must not be reported as a violation');
+});
+
+t('a raised floor does not over-block: Archon touching the same path → no finding', () => {
+  const r = analyzeCommits([{
+    sha: 'r03', subject: 'x', authorName: 'somearchon', authorEmail: 'l@x',
+    isMerge: false, files: ['infra/deploy.sh'],
+  }], RANKS, { registry: mixedFloorRegistry() });
+  assert.equal(r.hardFail, false);
+  assert.equal(r.findings.length, 0);
+});
+
+t('a Metic still clears a surface left at the minimum floor', () => {
+  const r = analyzeCommits([{
+    sha: 'r04', subject: 'x', authorName: 'SomeMetic', authorEmail: 'm@x',
+    isMerge: false, files: ['src/bongos/db.js'],
+  }], RANKS, { registry: mixedFloorRegistry() });
+  assert.equal(r.hardFail, false);
+  assert.equal(r.findings.length, 0);
+});
+
+t('an unresolved author is told the floor that actually governs, not a hardcoded Metic', () => {
+  const r = analyzeCommits([{
+    sha: 'r05', subject: 'x', authorName: 'Nobody Known', authorEmail: 'n@x',
+    isMerge: false, files: ['infra/deploy.sh'],
+  }], RANKS, { registry: mixedFloorRegistry() });
+  assert.equal(r.findings.length, 1);
+  assert.equal(r.findings[0].severity, 'review');
+  assert.match(r.findings[0].summary, /Archon\+ work/);
+});
+
+t('the default registry is the real one — no injection needed in production', () => {
+  // The seam must not change what the CLI does: infra/ floors at metic today,
+  // so a Metic touching it is legal on the live registry.
+  const r = analyzeCommits([{
+    sha: 'r06', subject: 'x', authorName: 'SomeMetic', authorEmail: 'm@x',
+    isMerge: false, files: ['infra/deploy.sh'],
+  }], RANKS);
+  assert.equal(r.hardFail, false);
+  assert.equal(ppc.floorFor('infra/deploy.sh'), 'metic');
+});
+
 // -- the default range window (task 1002566) -------------------------------
 //
 // Everything above tests the pure ANALYZER. Nothing tested what FEEDS it, which

package/tests/route_rank_check.mjs

@@ -487,6 +487,56 @@ test('EXPECTED_RANKS: a MISSING pinned route trips a blocker (a protected route
   assert.equal(res.hardFail, true);
 });
 
+// ---------- task 1003192: a module pin block must never go SILENTLY inert ----------
+//
+// From the task-1002671 adversarial verification (finding 4). Pin scope derives from
+// successfully-classified routes, and the skip had no else branch: a MODULE_EXPECTED_RANKS
+// key matching no discovered module was dropped without a word, while the loader kept
+// mounting modules/<key>/routes/ by the same convention this scan discovers them by.
+// Measured before the fix, with the security module's directory renamed: all six pins went
+// inert and a POST /security/reports deliberately downgraded to any-builder drew ZERO
+// findings — a pinned privileged WRITE route silently unguarded.
+//
+// The guard is deliberately split. checkRouteRanks fires only when the directory IS
+// PRESENT but contributed no route (a rename/move under a live module); a wholly-absent
+// directory stays silent here because this runs on every ship and an instance may
+// legitimately omit an optional module. fitness.js Check 4b owns that half, at the source
+// repo where every module is expected to exist — see tests/fitness.mjs.
+
+test('a module whose dir EXISTS but yields no route surfaces an inert-pins finding [task 1003192]', () => {
+  const os = require('node:os');
+  const fs = require('node:fs');
+  const path = require('node:path');
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'rrc-inert-'));
+  // modules/security/ is present, but its routes live under handlers/ — so the scan
+  // discovers nothing for the key and all six security pins would be skipped.
+  fs.mkdirSync(path.join(dir, 'security', 'handlers'), { recursive: true });
+  fs.writeFileSync(path.join(dir, 'security', 'handlers', 'reports.js'),
+    `router.post('/security/reports', auth.requireBuilder, h);\n`);
+  const res = rrc.checkRouteRanks({ modulesDir: dir });
+  fs.rmSync(dir, { recursive: true, force: true });
+
+  const inert = res.findings.find((f) => f.rank === '(inert)');
+  assert.ok(inert, `a present-but-routeless pinned module must surface a finding; got: ${res.findings.map((f) => f.route).join(', ')}`);
+  assert.equal(inert.severity, 'major');
+  assert.match(inert.route, /security/);
+  assert.match(inert.summary, /passed vacuously/);
+});
+
+test('an ABSENT optional module stays silent — no false alarm for an instance without it [task 1003192]', () => {
+  // The counter-test, and the reason the guard is split across two layers: this runs on
+  // every ship, so a module an instance legitimately does not ship must not red the board.
+  const os = require('node:os');
+  const fs = require('node:fs');
+  const path = require('node:path');
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'rrc-absent-'));
+  // An empty modules dir: no pinned module directory exists at all.
+  const res = rrc.checkRouteRanks({ modulesDir: dir });
+  fs.rmSync(dir, { recursive: true, force: true });
+  assert.equal(res.findings.filter((f) => f.rank === '(inert)').length, 0,
+    'a module directory that is simply absent must not raise an inert-pins finding');
+});
+
 // ---------- LIVE: every real route classifies to a known rank ----------
 
 test('LIVE: checkRouteRanks() on src/bongos/routes/ has zero unknowns', () => {