@bongos/core 1.19.661 → 1.19.663

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.661",
-  "core_contract": "1.19.661",
-  "source_commit": "e0e4eeaf97f587e220df77e814dae6aef8a42094",
+  "core_version": "1.19.663",
+  "core_contract": "1.19.663",
+  "source_commit": "6acc4ae42df06ed3334386b6ed58fe312ae7e8a0",
   "source_ref": "HEAD",
-  "built_at": "2026-09-11T01:54:52.962Z",
+  "built_at": "2026-09-11T03:17:38.613Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 473,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2610,
-  "tree_sha256": "2cac6a01633dc2d21d448ec74a13528b7e7428ac169d17baa28cbc21f84ee8ec",
+  "tree_sha256": "42ab056c27124e80b07512a8787d678c3d74cef4f3b6dbeac2a248a39fa1dde8",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2787,7 +2787,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "010f80db3d82b3be44bc258bb27e460be7c6be66d1de67a29b590ae10da7440e"
+      "sha256": "d5e752a541b45079b1b23eb12eeb282e6f163a676c0d9b9f122fcef2864d120f"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4487,7 +4487,7 @@
     {
       "path": "modules/government/catalog.js",
       "mode": "0000644",
-      "sha256": "ce3dd2f87b0c6fbb1e2c62028bf50679fa8be316546efb6bf398a2afe22a791d"
+      "sha256": "aeb505d13076e49bd92bab1d6b3897697b7b69d285c16c551289dba50a489f22"
     },
     {
       "path": "modules/government/config.js",
@@ -5647,7 +5647,7 @@
     {
       "path": "modules/lifecycle/db-claims.js",
       "mode": "0000644",
-      "sha256": "23ed6051b8b9283410f23e10862b6b65361cbf2f95489cd1fc50dfd4584f5c71"
+      "sha256": "1b0d394ee1788decd9ea713a4379ef5322eda28a2ac11ad7adaf68298e6f4075"
     },
     {
       "path": "modules/lifecycle/db-deps-criteria.js",
@@ -5672,7 +5672,7 @@
     {
       "path": "modules/lifecycle/db-rank-authz.js",
       "mode": "0000644",
-      "sha256": "e5feff1eb42ad631b6c0165c23224d8ac56ef7f40e5d238afb09013501e9db7c"
+      "sha256": "fb8180f875828664fcd5cb17aa39f68c70b6cea3c52d03fdbd0b3e835f8b1e64"
     },
     {
       "path": "modules/lifecycle/db-shared.js",
@@ -7752,12 +7752,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "33d20d5051140813efcad7dd27825606d5f11c7c387cfde3dd9cbb3acec35857"
+      "sha256": "014c542d80e35f6e6a5572e169232eedf744e09bae83f6798c2d998ca86a18d5"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "5c5649850474d8fa629ae6562ed245243cb27cd7dfbf167acd9bef11c36cc2d2"
+      "sha256": "56f59c24967d3719f7341742409c6f57ef6551dbfd9600591d201888701dc926"
     },
     {
       "path": "public-docs/index.html",
@@ -9512,7 +9512,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c2596bcf6a5206d5b306dac65a93ad9d101d9ed2c0f7e222de297759e460769e"
+      "sha256": "3d019bf197d89274ef460bd8b86038aca8418d5071d2d76c43479ba1743c556e"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10857,7 +10857,7 @@
     {
       "path": "tests/government_claim_eligibility.mjs",
       "mode": "0000644",
-      "sha256": "1989a7e5e39a6bb177dfd86e610c0806c96fdc97f9149800de431af816f2c31a"
+      "sha256": "05a7c8f8d001bd0d2950619fb46f242d358ecae1a8901a10fbb9ecc7857500e7"
     },
     {
       "path": "tests/government_config.mjs",
@@ -10902,7 +10902,7 @@
     {
       "path": "tests/government_ownership_scope.mjs",
       "mode": "0000644",
-      "sha256": "ad627c69ede0d79a2f38030d762cbd5bcf630cd6b067441f5763f261b829d1ba"
+      "sha256": "76b81db7769290d5ef5c26ece86ce0610c5aef6c8984ffdd54a6340db66db3bc"
     },
     {
       "path": "tests/government_page_gates.mjs",
@@ -10922,7 +10922,7 @@
     {
       "path": "tests/government_protected_surfaces.mjs",
       "mode": "0000644",
-      "sha256": "cd56facc3522f17cd83b067ee1ae9dcb3e4e03dac13157013c44d7ba23508af2"
+      "sha256": "3517e05c1264fbdbeadc533884942926689952c8995548863ca1cfbfc365428e"
     },
     {
       "path": "tests/government_rank_sync.mjs",

package/docs/module-api-changelog.md

@@ -1771,5 +1771,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.659 with no explicit bump. run 34551485764. (task 1002620)
   1.19.661 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.660 with no explicit bump. run 34552525938. (task 1002620)
+  1.19.662 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.661 with no explicit bump. run 34553965204. (task 1002620)
+  1.19.663 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.662 with no explicit bump. run 34557840364. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/government/catalog.js

@@ -201,7 +201,7 @@ const PERMISSIONS = [
   { key: 'criterion.unsatisfy', system: false, floor: 'metic', guards: 'POST /done-when/:id/unsatisfy (ADR 0157, was archon)' },
   { key: 'security.report.adjudicate', system: false, floor: 'metic', guards: 'GET /security/reports, POST /security/reports/:id/{confirm,dispute,fix,link-fix}, /security/docs CRUD (ADR 0157, was archon)' },
   { key: 'provisioning.fleet.manage', system: false, floor: 'metic', guards: 'GET /provisioning/fleet[/cost-ledger], POST .../force-teardown (ADR 0157, was archon)' },
-  { key: 'box.fleet.manage', system: false, floor: 'metic', scope: 'any', resource: 'box', guards: 'GET /boxes[/cost-ledger], POST /boxes/:b/close, PATCH .../block (ADR 0157, was archon)' },
+  { key: 'box.fleet.manage', system: false, floor: 'metic', scope: 'any', resource: 'box', verb: 'manage', guards: 'GET /boxes[/cost-ledger], POST /boxes/:b/close, PATCH .../block (ADR 0157, was archon)' },
   { key: 'autonomy.precheck', system: false, floor: 'metic', guards: 'GET /autonomy/precheck — unsupervised-runner gate (ADR 0157, was archon)' },
   { key: 'discord.channels.manage', system: false, floor: 'metic', guards: 'GET /discord/channels/plan, POST .../reconcile (ADR 0157, was archon)' },
   // Metic by the discord.channels.manage analogue — configuring a project-wide
@@ -213,7 +213,7 @@ const PERMISSIONS = [
   { key: 'project.settings.manage', system: false, floor: 'metic', guards: "PATCH /project-settings/* — the project's own live knobs (the rot timer today) and the work-category set's shape (PATCH /work-categories/:id). Metic, matching goal.create's reasoning that extending the project's vocabulary is a planning act rather than an administrative one — task 1003280, goal 1000072" },
   { key: 'project.curate', system: false, floor: 'metic', guards: 'platform-identity: GET/POST /projects, /projects/invite, PATCH /projects/:id/featured, PATCH /projects/:id/status (the takedown lever — ADR 0252 §5.1), GET /scouting (ADR 0157, was archon)' },
   { key: 'override_request.decide', system: false, floor: 'metic', guards: 'GET /override-requests, POST .../:id/decide (ADR 0157, was archon)' },
-  { key: 'claim.release.any', system: false, floor: 'metic', scope: 'any', resource: 'claim', guards: 'POST /claims/:id/release-on-behalf (ADR 0157, was archon)' },
+  { key: 'claim.release.any', system: false, floor: 'metic', scope: 'any', resource: 'claim', verb: 'release', guards: 'POST /claims/:id/release-on-behalf (ADR 0157, was archon)' },
   { key: 'idea.ratify', system: false, floor: 'metic', guards: 'POST /inbox/:id/ratify (ADR 0157, was archon)' },
   // ── the Board Room (ADR 0175, goal 1000069) ──────────────────────────────────
   // Declared BEFORE their routes exist (R07/R08 add them), and deliberately so:
@@ -236,7 +236,7 @@ const PERMISSIONS = [
   { key: 'goal.reorder', system: false, floor: 'metic', guards: 'POST /goals/reorder (ADR 0157, was archon)' },
   { key: 'builder.roster.read', system: false, floor: 'metic', guards: 'GET /builders/roster, /grades/by-builder, /builders/:id/active-claims (ADR 0157, was archon)' },
   { key: 'session.search', system: false, floor: 'metic', guards: 'GET /sessions/search (ADR 0157, was archon)' },
-  { key: 'memory.read.any', system: false, floor: 'metic', scope: 'any', resource: 'memory', guards: 'GET /memory/builders/:id/file[s] — cross-builder memory read (ADR 0157, was archon)' },
+  { key: 'memory.read.any', system: false, floor: 'metic', scope: 'any', resource: 'memory', verb: 'read', guards: 'GET /memory/builders/:id/file[s] — cross-builder memory read (ADR 0157, was archon)' },
   { key: 'audit_log.read', system: false, floor: 'metic', guards: 'GET /audit-log (ADR 0157, was archon)' },
   // ADR 0157 §4. Split from `gate_approval.decide` (system, archon) so the Gate PAGE
   // can open to Metic while APPROVING a held PR stays Archon. Without the split, a
@@ -265,20 +265,32 @@ const PERMISSIONS = [
   // deliberately NOT lowered to xenos here (the board.vote.cast option): a floor
   // feeds RANK_SEED and the live reset route, so widening it is an authority change
   // that wants its own decision, not a note in a hardening batch.
-  { key: 'goal.manage.own', system: false, floor: 'metic', scope: 'own', resource: 'goal', guards: 'PATCH /goals/:id/members/:b, POST /goals/:id/transfer — requireBuilder + in-handler owner|manager|Archon (ADR 0106); floor is not the whole gate, and sub-metic owners/managers hold it today' },
+  { key: 'goal.manage.own', system: false, floor: 'metic', scope: 'own', resource: 'goal', verb: 'manage', counterpart: [], guards: 'PATCH /goals/:id/members/:b, POST /goals/:id/transfer — requireBuilder + in-handler owner|manager|Archon (ADR 0106); floor is not the whole gate, and sub-metic owners/managers hold it today' },
   { key: 'task.claim.newcomer', system: false, floor: 'xenos', guards: 'claim a newcomer_friendly task (xenosClaimAllowed; xenos = one active claim)' },
   { key: 'task.ship', system: false, floor: 'xenos', guards: '/builder-ship own claim' },
-  { key: 'task.act.own', system: false, floor: 'xenos', scope: 'own', resource: 'claim', guards: 'act on OWN active claim (release, cost, notes) — ownership-scoped' },
-  { key: 'box.manage.own', system: false, floor: 'xenos', scope: 'own', resource: 'box', guards: 'own dev-box lifecycle — ownership-scoped' },
-  { key: 'memory.manage.own', system: false, floor: 'xenos', scope: 'own', resource: 'memory', guards: 'own builder memory — ownership-scoped' },
+  // counterpart is EMPTY, and that is the fix of task 1003195, not an omission.
+  // `act` is a BUNDLE — release + cost + notes — and the family's only cross-owner
+  // key, `claim.release.any`, carries just the release third. It is therefore not a
+  // counterpart: admitting on it would let a release-only grant post costs and notes
+  // against another builder's claim. A future `claim.manage.any` (verb `manage`)
+  // would dominate `act` and belongs here; `claim.release.any` never does.
+  { key: 'task.act.own', system: false, floor: 'xenos', scope: 'own', resource: 'claim', verb: 'act', counterpart: [], guards: 'act on OWN active claim (release, cost, notes) — ownership-scoped' },
+  // The one family whose counterpart is REAL: `box.fleet.manage` is the same `manage`
+  // verb over every owner's box, so it genuinely subsumes managing your own.
+  { key: 'box.manage.own', system: false, floor: 'xenos', scope: 'own', resource: 'box', verb: 'manage', counterpart: ['box.fleet.manage'], guards: 'own dev-box lifecycle — ownership-scoped' },
+  // Empty for the same reason as task.act.own: `memory.read.any` READS every
+  // builder's memory, which is not the authority to MANAGE one. This is the pair the
+  // task-1002671 verification probed (finding 12) — a read grant was admitting a
+  // write. A future `memory.manage.any` would belong here.
+  { key: 'memory.manage.own', system: false, floor: 'xenos', scope: 'own', resource: 'memory', verb: 'manage', counterpart: [], guards: 'own builder memory — ownership-scoped' },
   // No cross-owner counterpart, deliberately: nobody manages another builder's
   // credential, Archon included. A `credential.manage.any` would be a key no route
   // consumes — the catalog's first rule forbids minting one for symmetry.
-  { key: 'credential.manage.own', system: false, floor: 'xenos', scope: 'own', resource: 'credential', guards: 'own API key / credential — ownership-scoped' },
+  { key: 'credential.manage.own', system: false, floor: 'xenos', scope: 'own', resource: 'credential', verb: 'manage', counterpart: [], guards: 'own API key / credential — ownership-scoped' },
   // Own-scoped WITHOUT a `.own` suffix — the `me.` namespace is the ownership
   // marker here. Exactly why scope is declared data: the suffix rule only runs the
   // safe direction ('.own' ⇒ scope 'own'), never the converse.
-  { key: 'me.wandering.set', system: false, floor: 'xenos', scope: 'own', resource: 'builder_prefs', guards: 'PATCH /me/wandering (clamped by maxLevelForRank) — ownership-scoped' },
+  { key: 'me.wandering.set', system: false, floor: 'xenos', scope: 'own', resource: 'builder_prefs', verb: 'set', counterpart: [], guards: 'PATCH /me/wandering (clamped by maxLevelForRank) — ownership-scoped' },
   { key: 'cost.log', system: false, floor: 'xenos', guards: 'POST /cost' },
   { key: 'learning.create', system: false, floor: 'xenos', guards: 'POST /learnings' },
   { key: 'blocker.file', system: false, floor: 'xenos', guards: 'POST /blockers' },
@@ -296,6 +308,31 @@ const PERMISSIONS = [
 const PRINCIPAL_KEY_PREFIX = 'principal.';
 const OWN_KEY_SUFFIX = '.own';
 const OWNERSHIP_SCOPES = Object.freeze(['own', 'any']);
+
+// ── the VERB axis of an ownership-scoped key (task 1003195) ────────────────────
+// Scope answers "whose row"; VERB answers "how much of it". They are independent,
+// and conflating them is exactly the bug this vocabulary closes: `crossOwnerKeysFor`
+// used to hand back the resource family's whole `any` list VERB-BLIND, so holding
+// only `memory.read.any` satisfied a `memory.manage.own` decision on someone else's
+// row — a read grant admitting a write.
+//
+// The verb is DECLARED, never parsed out of the key string. A positional parse is
+// wrong on the live population (`box.fleet.manage` is resource `box`, verb `manage`
+// — the middle segment is not the verb), and the same reason `scope` is data:
+// "the namespace can never outrun the data".
+const OWNERSHIP_VERBS = Object.freeze(['read', 'set', 'release', 'act', 'manage']);
+// Which verbs a verb SUBSUMES, beyond itself (every verb dominates itself). Kept
+// deliberately small and explicit: `manage` is the full-control verb, so it covers
+// every narrower slice; nothing else subsumes anything. A future pair that needs a
+// wider relation adds one entry here and states why — it does not get inferred.
+const VERB_DOMINANCE = Object.freeze({
+  manage: Object.freeze(['read', 'set', 'release', 'act']),
+});
+// Does `wide` carry at least everything `narrow` carries? Unknown verbs fail closed.
+function verbDominates(wide, narrow) {
+  if (!OWNERSHIP_VERBS.includes(wide) || !OWNERSHIP_VERBS.includes(narrow)) return false;
+  return wide === narrow || (VERB_DOMINANCE[wide] || []).includes(narrow);
+}
 const _byKey = new Map();
 const _byPrincipal = new Map();
 const _byResource = new Map();
@@ -376,6 +413,36 @@ for (let i = 0; i < PERMISSIONS.length; i++) {
   if (scope !== null && p.floor === null) {
     throw new Error(`government catalog: ${p.key} is ownership-scoped but has no rank floor — the ownership axis narrows a RANK permission, never an identity one`);
   }
+  // ── the VERB axis (task 1003195) ──────────────────────────────────────────
+  // Same partition posture as scope ⟺ resource: an ownership-scoped key declares
+  // HOW MUCH of the row it reaches, and an unscoped key has no owner axis to
+  // qualify. Both directions throw, so neither field can be added without the other.
+  const verb = p.verb ?? null;
+  if ((scope === null) !== (verb === null)) {
+    throw new Error(`government catalog: ${p.key} — scope and verb must come together (an ownership scope always names the verb it reaches the row with)`);
+  }
+  if (verb !== null && !OWNERSHIP_VERBS.includes(verb)) {
+    throw new Error(`government catalog: ${p.key} has unknown verb "${verb}" (expected one of ${OWNERSHIP_VERBS.join(', ')})`);
+  }
+  // ── the COUNTERPART declaration (task 1003195) ────────────────────────────
+  // REQUIRED on every own-scoped key and forbidden everywhere else. Required,
+  // because the bug being fixed was a silent DERIVATION: crossOwnerKeysFor fell
+  // back to the resource family's whole `any` list, so a new own key inherited
+  // every cross-owner key in its family — verbs unchecked — merely by existing.
+  // Making the escalation path an explicit per-key statement means a new own key
+  // fails LOUD at load until its author decides what may escalate past it, and
+  // `counterpart: []` is that decision written down, not its absence.
+  const hasCounterpart = p.counterpart !== undefined;
+  if (scope === 'own' && !hasCounterpart) {
+    throw new Error(`government catalog: ${p.key} is own-scoped and must declare counterpart: [] explicitly — the cross-owner escalation path is never derived from the resource family (task 1003195)`);
+  }
+  if (scope !== 'own' && hasCounterpart) {
+    throw new Error(`government catalog: ${p.key} declares a counterpart but is not own-scoped — only an ownership-scoped key has an escalation path`);
+  }
+  if (hasCounterpart && (!Array.isArray(p.counterpart) || p.counterpart.some((k) => typeof k !== 'string' || !k))) {
+    throw new Error(`government catalog: ${p.key} — counterpart must be an array of permission keys`);
+  }
+  const counterpart = hasCounterpart ? Object.freeze([...p.counterpart]) : null;
   // ONE object per permission, shared by every reader. The frozen copy goes back
   // into PERMISSIONS[i] as well as the lookup maps, because the alternative —
   // freezing a COPY and leaving the original mutable in the array — splits the
@@ -383,7 +450,7 @@ for (let i = 0; i < PERMISSIONS.length; i++) {
   // seals the array's SHAPE but not its entries, so a runtime mutation of
   // PERMISSIONS[i] would change the floor seedForRank() reads (and with it the
   // live POST /government/ranks/:rankKey/reset) while byKey() kept the old value.
-  const frozen = Object.freeze({ ...p, principal, scope, resource, substrate });
+  const frozen = Object.freeze({ ...p, principal, scope, resource, verb, counterpart, substrate });
   PERMISSIONS[i] = frozen;
   _byKey.set(p.key, frozen);
   if (principal !== null) _byPrincipal.set(principal, frozen);
@@ -416,6 +483,32 @@ for (const [resource, fam] of _byResource) {
   }
 }
 
+// ── the counterpart invariant: a declared escalation path must DOMINATE ────────
+// The floor check above orders the two keys by PRICE; this one orders them by
+// POWER, and only the pair together is the wall. A counterpart is an admit: the
+// resolver returns true on it WITHOUT consulting the owner at all, so whatever it
+// names must carry at least everything the own key carries. Naming a narrower verb
+// converts the own key into that verb's cross-owner form for free — which is
+// precisely how `memory.read.any` came to satisfy `memory.manage.own`.
+for (const p of PERMISSIONS) {
+  if (p.scope !== 'own') continue;
+  for (const key of p.counterpart) {
+    const c = _byKey.get(key);
+    if (!c) {
+      throw new Error(`government catalog: ${p.key} names counterpart "${key}", which is not a permission in this catalog`);
+    }
+    if (c.scope !== 'any') {
+      throw new Error(`government catalog: ${p.key} names counterpart ${key}, which is not cross-owner (scope "${c.scope ?? 'none'}") — only an 'any' key reaches another owner's row`);
+    }
+    if (c.resource !== p.resource) {
+      throw new Error(`government catalog: ${p.key} (resource ${p.resource}) names counterpart ${key} from resource ${c.resource} — an escalation path never crosses resource families`);
+    }
+    if (!verbDominates(c.verb, p.verb)) {
+      throw new Error(`government catalog: ${p.key} names counterpart ${key}, but verb "${c.verb}" does not dominate "${p.verb}" — a cross-owner key may only satisfy an own key it carries at least as much authority as (task 1003195)`);
+    }
+  }
+}
+
 // resource → { own: [keys], any: [keys] }. The pairing data a gate, a test, or the
 // Archon tab reads to relate "act on own X" to "act on any X"; DERIVED from the
 // rows above so it cannot drift from them.
@@ -547,6 +640,12 @@ function resourceOf(key) {
   const p = _byKey.get(key);
   return p ? p.resource : null;
 }
+// How much of the row this key reaches. Null for an unscoped or unknown key — the
+// verb only means anything alongside an ownership scope.
+function verbOf(key) {
+  const p = _byKey.get(key);
+  return p ? p.verb : null;
+}
 // Does holding this key require an ownership predicate against the concrete row?
 // This is the question a gate must ask BEFORE treating a held permission as an
 // admit — an ownership-scoped key is never sufficient on its own.
@@ -563,14 +662,21 @@ function ownershipScopedKeys() {
 function crossOwnerKeys() {
   return PERMISSIONS.filter((p) => p.scope === 'any').map((p) => p.key);
 }
-// The cross-owner keys over the SAME resource as `key` — what a route offers as
-// the escalation path ("your own claim, or claim.release.any"). Empty when the
-// resource has no cross-owner form by design.
+// The DECLARED escalation path for `key` — what a route offers as the alternative
+// to owning the row ("your own box, or box.fleet.manage"). Empty when nothing may
+// escalate past it, which is the common case.
+//
+// Read straight off the key's own `counterpart`, NOT derived from its resource
+// family (task 1003195). The family form was verb-blind: it handed back every `any`
+// key over the resource, so `memory.read.any` — a READ grant — satisfied a
+// `memory.manage.own` WRITE decision on another builder's row. Every entry returned
+// here has been checked at load to be cross-owner, same-resource, and carrying a
+// verb that dominates this key's, so the resolver can admit on one without
+// consulting the owner. An unknown or non-own key has no path at all.
 const NO_KEYS = Object.freeze([]);
 function crossOwnerKeysFor(key) {
-  const resource = resourceOf(key);
-  const fam = resource === null ? null : RESOURCE_FAMILIES[resource];
-  return fam ? fam.any : NO_KEYS;
+  const p = _byKey.get(key);
+  return p && p.counterpart ? p.counterpart : NO_KEYS;
 }
 
 // The compat seed, DERIVED from floors (cumulative supersets). A rank holds
@@ -615,4 +721,8 @@ module.exports = {
   ownershipScopedKeys,
   crossOwnerKeys,
   crossOwnerKeysFor,
+  OWNERSHIP_VERBS,
+  VERB_DOMINANCE,
+  verbDominates,
+  verbOf,
 };

package/modules/lifecycle/db-claims.js

@@ -15,10 +15,15 @@ const { pool, withTx } = api;
 const log = api.logger('lifecycle');
 const seams = api;
 const { touchesOverlap } = api.pathMatch;
-const { claimEligibilityAllows, CLAIM_ANY, CLAIM_NEWCOMER } = require('./claim-eligibility.js');
+// CLAIM_ANY / CLAIM_NEWCOMER name the two atoms in the refusal message. The
+// decision itself moved to db-rank-authz.claimGate (task 1003196), so this file
+// no longer calls claimEligibilityAllows / rankAllowsTask / xenosClaimAllowed
+// directly — composing them at three separate call sites is what made the gate
+// un-testable except by counting.
+const { CLAIM_ANY, CLAIM_NEWCOMER } = require('./claim-eligibility.js');
 const { goalMembershipFailures } = require('./claim-feed.js');
 const { unsatisfiedDeps } = require('./db-deps-criteria.js');
-const { claimPermissionsFor, disambiguateWorktreeName, foldWorktreeName, rankAllowsTask, xenosClaimAllowed } = require('./db-rank-authz.js');
+const { claimGate, claimPermissionsFor, disambiguateWorktreeName, foldWorktreeName } = require('./db-rank-authz.js');
 const { sealSessionLog } = require('./db-shared.js');
 const { needsRebaseTasksForBuilder, shouldRefuseClaimResolve } = require('./db-ship.js');
 const { REWARD_SUGGESTION_CAP, rewardGateAssignment } = require('./db-tasks.js');
@@ -142,8 +147,18 @@ async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSess
     // is kept as an alias on the error object for callers on the pre-rename
     // release. BV1.R106 (ADR 0151): same rule, now decided on the PERMISSIONS
     // task.claim.any / task.claim.newcomer — see ./claim-eligibility.js.
+    // task 1003196: the queue+floor composition is decided ONCE, in
+    // db-rank-authz.claimGate, so a test can drive the real decision instead of
+    // counting `if`s in this file. The refusal SHAPES below are unchanged — that
+    // is why claimGate returns which gates refused rather than an error object.
     const newcomerFriendly = task.newcomer_friendly;
-    if (!claimEligibilityAllows({ heldPermissions, newcomerFriendly, rankRuleAllows: xenosClaimAllowed(builderRank, newcomerFriendly) })) {
+    const claimRefusals = claimGate({
+      builderRank,
+      newcomerFriendly,
+      requiresRank: task.requires_rank,
+      heldPermissions,
+    });
+    if (claimRefusals.includes('queue')) {
       // task 1002613 (map §4.4): the bare code reported a PERMISSION decision as
       // a rank one — no axis, no remedy. Copy INSUFFICIENT_RANK's shape below:
       // name both sides of the wall and the way forward.
@@ -168,7 +183,7 @@ async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSess
     // blocks Xenos+Metic. The DB CHECK on tasks.requires_rank enforces the
     // enum, so we trust the value here. INSUFFICIENT_RANK carries the actual
     // and required ranks so the caller can render a clean error.
-    if (!rankAllowsTask(builderRank, task.requires_rank)) {
+    if (claimRefusals.includes('floor')) {
       throw {
         code: 'INSUFFICIENT_RANK',
         required: task.requires_rank,
@@ -496,25 +511,32 @@ async function claimTasksBatch({ taskIds, builderId, worktreePrefix, creatorSess
     // never checked here, while claimTask checks every rank), so removing it would
     // change who can batch-claim. That pre-existing asymmetry is reported, not
     // fixed, under this task — closing it is an authority decision of its own.
-    if (builderRank === 'xenos') {
-      for (const t of taskRows) {
-        if (!claimEligibilityAllows({
-          heldPermissions,
-          newcomerFriendly: t.newcomer_friendly,
-          rankRuleAllows: xenosClaimAllowed(builderRank, t.newcomer_friendly),
-        })) {
-          failures.push({ task_id: t.id, reason: 'rank_too_low_for_task', legacy_reason: 'XENOS_RESTRICTED' });
-        }
+    //
+    // V3.R82 (#301): the per-task requires_rank floor rides the same decision.
+    // Mirrors the single claimTask gate so a Metic can't slip through batch-claim
+    // to grab an Archon-only task. The xenos sandbox check handles the xenos case
+    // exhaustively for requires_rank='xenos' (the default); the floor gate refuses
+    // requires_rank='metic'/'archon' when the builder is below.
+    //
+    // task 1003196: both gates now come from db-rank-authz.claimGate. A row can
+    // still collect BOTH refusals, and the two passes below are deliberate — this
+    // path groups every queue refusal ahead of every floor refusal, and `failures`
+    // is returned to the caller in order, so folding them into one pass per row
+    // would reorder a response for no reason.
+    const refusalsFor = (t) => claimGate({
+      builderRank,
+      newcomerFriendly: t.newcomer_friendly,
+      requiresRank: t.requires_rank,
+      heldPermissions,
+      queueGateApplies: builderRank === 'xenos',
+    });
+    for (const t of taskRows) {
+      if (refusalsFor(t).includes('queue')) {
+        failures.push({ task_id: t.id, reason: 'rank_too_low_for_task', legacy_reason: 'XENOS_RESTRICTED' });
       }
     }
-
-    // V3.R82 (#301): the per-task requires_rank floor. Mirrors the single
-    // claimTask gate so a Metic can't slip through batch-claim to grab an
-    // Archon-only task. The xenos sandbox check above handles the xenos case
-    // exhaustively for requires_rank='xenos' (the default); this gate refuses
-    // requires_rank='metic'/'archon' when the builder is below.
     for (const t of taskRows) {
-      if (!rankAllowsTask(builderRank, t.requires_rank)) {
+      if (refusalsFor(t).includes('floor')) {
         failures.push({
           task_id: t.id,
           reason: 'INSUFFICIENT_RANK',
@@ -855,14 +877,19 @@ async function validateClaimBatch({ taskIds, builderId }) {
     const t = byId.get(id);
     if (!t) { push(id, { reason: 'TASK_NOT_FOUND' }); continue; }
     if (t.status !== 'ready') push(id, { reason: 'TASK_NOT_READY', currentStatus: t.status });
-    if (builderRank === 'xenos' && !claimEligibilityAllows({
-      heldPermissions,
+    // task 1003196: same composed decision as claimTask and claimTasksBatch, and
+    // the same deliberate xenos-only queue short-circuit the batch path carries.
+    const refusals = claimGate({
+      builderRank,
       newcomerFriendly: t.newcomer_friendly,
-      rankRuleAllows: xenosClaimAllowed(builderRank, t.newcomer_friendly),
-    })) {
+      requiresRank: t.requires_rank,
+      heldPermissions,
+      queueGateApplies: builderRank === 'xenos',
+    });
+    if (refusals.includes('queue')) {
       push(id, { reason: 'rank_too_low_for_task', legacy_reason: 'XENOS_RESTRICTED' });
     }
-    if (!rankAllowsTask(builderRank, t.requires_rank)) {
+    if (refusals.includes('floor')) {
       push(id, { reason: 'INSUFFICIENT_RANK', required: t.requires_rank, actual: builderRank });
     }
   }

package/modules/lifecycle/db-rank-authz.js

@@ -14,6 +14,7 @@ const api = require('../../src/module-api');
 const { pool, LIVE_RANK_LADDER, RANK_TIER } = api;
 const seams = api;
 const { matchProtected } = api.permissionPathCheck;
+const { claimEligibilityAllows } = require('./claim-eligibility.js');
 
 // -------------------------------------------------------------------------
 // Builders
@@ -166,6 +167,51 @@ function rankAllowsTask(builderRank, requiredRank) {
   return have >= needed;
 }
 
+// ── the COMPOSED per-task claim decision (task 1003196) ──────────────────────
+//
+// Claim eligibility is TWO independent gates — the QUEUE axis (permission atoms,
+// ./claim-eligibility.js) and the FLOOR axis (`requires_rank`, rankAllowsTask
+// above) — and the rule that matters is that BOTH must pass and neither
+// substitutes for the other. That composition used to exist only as a pair of
+// consecutive `if`s repeated at each of the three claim paths, which meant the
+// only thing a test could check was that the source still CONTAINED them:
+// `tests/government_claim_eligibility.mjs` counted occurrences, and neutering
+// claimTask's gate with `&& false` left the count at 3 and the suite green
+// (finding 10 of the task-1002671 verification). Counting is not a behaviour
+// oracle, so the decision lives here, once, where a test can actually drive it.
+//
+// RETURNS THE GATES THAT REFUSED, in ladder order — `[]` means allowed. It
+// deliberately does NOT return a ready-made error: each call site shapes its own
+// refusal and those shapes are API surface (claimTask THROWS
+// `{code:'rank_too_low_for_task', …, message, hint}`, while the batch paths PUSH
+// `{task_id, reason, legacy_reason}` and accumulate both refusals for one row).
+// Returning a decision instead of a wire error is what lets all three delegate
+// without any of them changing what a caller sees.
+//
+// `queueGateApplies` carries a PRE-EXISTING asymmetry rather than quietly fixing
+// it: claimTask runs the queue gate for every rank, while claimTasksBatch and
+// validateClaimBatch run it only when `builderRank === 'xenos'`. That outer
+// short-circuit is semantic, not a fast path — for the SEEDED sets the two agree
+// exactly (thetes+ all hold task.claim.any), but a custom rank granted neither
+// claim atom would be refused by claimTask and admitted by the batch paths.
+// Closing that is an authority decision of its own, already reported and
+// deliberately deferred at the call site; this parameter keeps each path's
+// current meaning exact while still routing it through one decision.
+const CLAIM_GATES = Object.freeze(['queue', 'floor']);
+
+function claimGate({ builderRank, newcomerFriendly, requiresRank, heldPermissions, queueGateApplies = true }) {
+  const refused = [];
+  if (queueGateApplies && !claimEligibilityAllows({
+    heldPermissions,
+    newcomerFriendly,
+    rankRuleAllows: xenosClaimAllowed(builderRank, newcomerFriendly),
+  })) {
+    refused.push('queue');
+  }
+  if (!rankAllowsTask(builderRank, requiresRank)) refused.push('floor');
+  return Object.freeze(refused);
+}
+
 // deriveRequiredRank — task 1498 / ADR 0084. The per-task requires_rank floor
 // (V3.R82 #301) shipped INERT: no create/edit path ever set it, so every task
 // sat at the 'xenos' default and the claim gate never bit. We now DERIVE a floor
@@ -477,6 +523,8 @@ module.exports = {
   RANKS,
   REQUIRES_RANK_TIER,
   THETES_GRADUATION_THRESHOLD,
+  CLAIM_GATES,
+  claimGate,
   claimPermissionsFor,
   countShippedTasksForBuilder,
   deriveRequiredRank,

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.661",
+  "version": "1.19.663",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.661",
+      "version": "1.19.663",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.661",
+  "version": "1.19.663",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.661'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.663'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_claim_eligibility.mjs

@@ -154,16 +154,138 @@ test('the permission predicate cannot see requires_rank at all (structural)', ()
   }
 });
 
-test('every claim path in db.js still gates on requires_rank as its own check', () => {
-  // task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
-  const src = lifecycleDbSource();
-  // claimTask, claimTasksBatch, validateClaimBatch — three call sites, three
-  // separate rankAllowsTask conjuncts. If a refactor ever folds the floor into the
-  // permission predicate, this count drops and the test reds.
-  const floorChecks = src.match(/rankAllowsTask\((builderRank|builderRank), (task|t)\.requires_rank\)/g) || [];
-  assert.equal(floorChecks.length, 3, `expected 3 requires_rank gates in the claim paths, found ${floorChecks.length}`);
-  const queueChecks = src.match(/claimEligibilityAllows\(\{/g) || [];
-  assert.equal(queueChecks.length, 3, `expected 3 permission-expressed queue gates, found ${queueChecks.length}`);
+// ── the COMPOSED gate, driven behaviourally (task 1003196, finding 10) ───────
+//
+// WHAT THIS REPLACED, AND WHY. Until task 1003196 this section grepped the
+// lifecycle source for three occurrences of `rankAllowsTask(builderRank,
+// t.requires_rank)` and three of `claimEligibilityAllows({`. That verifies
+// PRESENCE, not EFFECT: neutering claimTask's gate with `&& false` left both
+// counts at 3 and the suite green. The composition now lives in one pure export,
+// db-rank-authz.claimGate, so these tests drive the real decision instead.
+//
+// claimGate returns the gates that REFUSED, in ladder order — `[]` means allowed.
+
+const { claimGate, CLAIM_GATES } = rankAuthz;
+const gatesFor = (o) => [...claimGate(o)];
+
+test('claimGate: BOTH axes must pass, and neither substitutes for the other', () => {
+  // An Archon holding everything is still stopped by nothing at requires_rank xenos...
+  assert.deepEqual(gatesFor({
+    builderRank: 'archon', newcomerFriendly: false, requiresRank: 'xenos', heldPermissions: seedSet('archon'),
+  }), []);
+
+  // ...and a builder who clears the QUEUE axis is still refused by the FLOOR axis.
+  // This is the collapse the two-gate model exists to prevent: holding
+  // task.claim.any must not buy you an archon-floored task.
+  assert.deepEqual(gatesFor({
+    builderRank: 'metic', newcomerFriendly: false, requiresRank: 'archon', heldPermissions: seedSet('metic'),
+  }), ['floor']);
+
+  // The converse: clearing the FLOOR axis does not buy you the queue. A xenos on a
+  // default-floor task that is NOT newcomer_friendly holds only task.claim.newcomer.
+  assert.deepEqual(gatesFor({
+    builderRank: 'xenos', newcomerFriendly: false, requiresRank: 'xenos', heldPermissions: seedSet('xenos'),
+  }), ['queue']);
+
+  // Both can refuse the same row, and the order is the ladder order.
+  assert.deepEqual(gatesFor({
+    builderRank: 'xenos', newcomerFriendly: false, requiresRank: 'archon', heldPermissions: seedSet('xenos'),
+  }), ['queue', 'floor']);
+
+  // ...and a newcomer_friendly flag opens the queue without lowering the floor.
+  assert.deepEqual(gatesFor({
+    builderRank: 'xenos', newcomerFriendly: true, requiresRank: 'metic', heldPermissions: seedSet('xenos'),
+  }), ['floor'], 'newcomer_friendly must never lower requires_rank');
+});
+
+test('claimGate: the composed decision matches the two axes evaluated separately', () => {
+  // The independent oracle: each axis run through its OWN production predicate
+  // (db.rankAllowsTask and eligibility.claimEligibilityAllows), composed here in
+  // the test. A claimGate that silently dropped a conjunct disagrees immediately.
+  let refusalsSeen = 0;
+  for (const rank of LIVE_RANKS) {
+    for (const nf of NF_VALUES) {
+      for (const requiresRank of [...LIVE_RANKS, null]) {
+        for (const held of [seedSet(rank), new Set(), new Set([CLAIM_ANY]), new Set([CLAIM_NEWCOMER]), null]) {
+          const expected = [];
+          if (!claimEligibilityAllows({
+            heldPermissions: held, newcomerFriendly: nf, rankRuleAllows: db.xenosClaimAllowed(rank, nf),
+          })) expected.push('queue');
+          if (!db.rankAllowsTask(rank, requiresRank)) expected.push('floor');
+          refusalsSeen += expected.length;
+          assert.deepEqual(
+            gatesFor({ builderRank: rank, newcomerFriendly: nf, requiresRank, heldPermissions: held }),
+            expected,
+            `${rank}/nf=${String(nf)}/req=${String(requiresRank)}/held=${held ? [...held].length : 'null'}`,
+          );
+        }
+      }
+    }
+  }
+  assert.ok(refusalsSeen > 0, 'a matrix that never refuses would pass vacuously');
+});
+
+test('claimGate: fail-closed on ranks and floors it does not recognise', () => {
+  // An unknown rank clears nothing — the posture rankAllowsTask already takes.
+  assert.ok(gatesFor({
+    builderRank: 'bogus', newcomerFriendly: true, requiresRank: 'xenos', heldPermissions: new Set([CLAIM_ANY]),
+  }).includes('floor'), 'an unrecognised builder rank must not clear the floor');
+  // A requires_rank the DB CHECK should have blocked refuses rather than defaults.
+  assert.ok(gatesFor({
+    builderRank: 'archon', newcomerFriendly: true, requiresRank: 'nonsense', heldPermissions: seedSet('archon'),
+  }).includes('floor'), 'an unrecognised requires_rank must fail closed');
+  // A null requires_rank is the column default — no extra gate.
+  assert.deepEqual(gatesFor({
+    builderRank: 'xenos', newcomerFriendly: true, requiresRank: null, heldPermissions: seedSet('xenos'),
+  }), []);
+});
+
+test('claimGate: queueGateApplies carries the batch paths\' pre-existing asymmetry', () => {
+  // claimTask runs the queue gate for EVERY rank; claimTasksBatch and
+  // validateClaimBatch run it only when builderRank === 'xenos'. For the SEEDED
+  // sets the two agree exactly, which is why the asymmetry has never bitten...
+  for (const rank of LIVE_RANKS) {
+    for (const nf of NF_VALUES) {
+      const held = seedSet(rank);
+      assert.deepEqual(
+        gatesFor({ builderRank: rank, newcomerFriendly: nf, requiresRank: 'xenos', heldPermissions: held }),
+        gatesFor({ builderRank: rank, newcomerFriendly: nf, requiresRank: 'xenos', heldPermissions: held, queueGateApplies: rank === 'xenos' }),
+        `${rank}/nf=${String(nf)}: seeded sets must agree across both call-site flavours`,
+      );
+    }
+  }
+  // ...and here is the case where they DIVERGE, pinned so it stays a known,
+  // deliberate difference rather than a surprise: a CUSTOM rank granted neither
+  // claim atom is refused by claimTask and admitted by the batch paths. Closing
+  // this is an authority decision of its own (see the note at the call site).
+  const neither = new Set(['cost.log']);
+  assert.deepEqual(gatesFor({
+    builderRank: 'metic', newcomerFriendly: false, requiresRank: 'xenos', heldPermissions: neither,
+  }), ['queue'], 'claimTask refuses a rank holding no claim atom');
+  assert.deepEqual(gatesFor({
+    builderRank: 'metic', newcomerFriendly: false, requiresRank: 'xenos', heldPermissions: neither, queueGateApplies: false,
+  }), [], 'the batch paths admit it — the asymmetry, recorded');
+});
+
+test('every claim path delegates to claimGate rather than re-composing the axes', () => {
+  // The cheap STRUCTURAL complement to the behavioural tests above. It can still
+  // only see presence, so it is no longer the only thing standing: what it adds is
+  // that a call site cannot quietly go back to composing the gates itself, which
+  // is what let the three copies drift apart in the first place.
+  // Counted in db-claims.js alone: the whole-family source also carries the
+  // DEFINITION in db-rank-authz.js, which would make the count read 4 and quietly
+  // tolerate one call site dropping out.
+  const claims = fs.readFileSync(path.join(LIFECYCLE, 'db-claims.js'), 'utf8');
+  const delegations = claims.match(/claimGate\(\{/g) || [];
+  assert.equal(delegations.length, 3,
+    `claimTask, claimTasksBatch and validateClaimBatch must each call claimGate — found ${delegations.length}`);
+  // ...and the raw conjuncts are gone from the claim paths, so there is exactly
+  // one place where "both gates must pass" is written down.
+  for (const banned of ['rankAllowsTask(', 'claimEligibilityAllows(']) {
+    assert.ok(!claims.includes(banned),
+      `db-claims.js must reach the axes through claimGate, not call "${banned}" itself`);
+  }
+  assert.deepEqual([...CLAIM_GATES], ['queue', 'floor'], 'the gate names are ladder-ordered');
 });
 
 // ── the "authority could not be established" fallback ────────────────────────

package/tests/government_ownership_scope.mjs

@@ -40,6 +40,7 @@ const {
   PERMISSIONS, RANK_ORDER, RANK_SEED, RESOURCE_FAMILIES, permissionKeys, byKey,
   scopeOf, resourceOf, isOwnershipScoped, isCrossOwner, ownershipScopedKeys, crossOwnerKeys,
   crossOwnerKeysFor, isPrincipalKey, seedForRank,
+  OWNERSHIP_VERBS, VERB_DOMINANCE, verbDominates, verbOf,
 } = catalog;
 const {
   sameOwner, authorizeOwned, authorizeOwnedOrAny, builderHasPermissions, effectivePermissions,
@@ -106,12 +107,24 @@ test('A3: the modelled families are the ones the ownership sweep names', () => {
   // The cross-owner side is NOT derivable from spelling: box's is `box.fleet.manage`.
   assert.deepEqual([...crossOwnerKeys()].sort(),
     ['box.fleet.manage', 'claim.release.any', 'memory.read.any']);
-  assert.deepEqual(crossOwnerKeysFor('task.act.own'), ['claim.release.any']);
+  // The escalation path is DECLARED per key, never derived from the resource
+  // family (task 1003195). box is the one REAL pair in the catalog today:
+  // `box.fleet.manage` is the same `manage` verb over every owner's box, so it
+  // genuinely subsumes managing your own.
   assert.deepEqual(crossOwnerKeysFor('box.manage.own'), ['box.fleet.manage']);
+  // claim and memory each HAVE an `any` key in their family and still declare no
+  // counterpart — the distinction the family-derived version could not make.
+  // `claim.release.any` carries one third of `act` (release, not cost or notes);
+  // `memory.read.any` is a read, and reading every builder's memory is not the
+  // authority to manage one. A family-derived answer returned both.
+  assert.deepEqual(crossOwnerKeysFor('task.act.own'), []);
+  assert.deepEqual(crossOwnerKeysFor('memory.manage.own'), []);
   // Some resources have NO cross-owner form by design — nobody manages another
   // builder's credential, Archon included.
   assert.deepEqual(crossOwnerKeysFor('credential.manage.own'), []);
   assert.deepEqual(crossOwnerKeysFor('nope.not.a.key'), []);
+  // A cross-owner key is not itself own-scoped, so it has no path of its own.
+  assert.deepEqual(crossOwnerKeysFor('claim.release.any'), []);
 });
 
 test('A4: RESOURCE_FAMILIES is frozen and agrees with each row it lists', () => {
@@ -246,20 +259,112 @@ test('C5: builderHasPermissions REFUSES an ownership-scoped key rather than answ
 
 // ═══ D — `.any` DOES reach another builder's resource ═════════════════════════
 
-test('D1: the cross-owner key reaches a row the caller does not own', async () => {
-  await holding(['task.act.own', 'claim.release.any'], async () => {
-    assert.equal(await authorizeOwnedOrAny(ME, 'task.act.own', { ownerId: SOMEONE_ELSE }), true,
-      'claim.release.any is exactly the authority to act on someone else\'s claim');
-    assert.equal(await authorizeOwnedOrAny(ME, 'task.act.own', { ownerId: ME }), true);
+test('D1: a DECLARED cross-owner counterpart reaches a row the caller does not own', async () => {
+  // box is the catalog's one real pair, and it must keep working: `box.fleet.manage`
+  // is the whole point of a cross-owner key. Asserted BOTH with and without the own
+  // key, because the counterpart is a standalone admit — it does not merely widen a
+  // grant the builder already has.
+  await holding(['box.manage.own', 'box.fleet.manage'], async () => {
+    assert.equal(await authorizeOwnedOrAny(ME, 'box.manage.own', { ownerId: SOMEONE_ELSE }), true,
+      'box.fleet.manage is exactly the authority to manage someone else\'s box');
+    assert.equal(await authorizeOwnedOrAny(ME, 'box.manage.own', { ownerId: ME }), true);
   });
+  await holding(['box.fleet.manage'], async () => {
+    assert.equal(await authorizeOwnedOrAny(ME, 'box.manage.own', { ownerId: SOMEONE_ELSE }), true);
+  });
+});
+
+// ═══ D1b — a cross-owner key with a WEAKER VERB is not a counterpart ═══════════
+//
+// task 1003195, from the task-1002671 adversarial verification (finding 12). The
+// admit branch used to hand back the resource family's whole `any` list VERB-BLIND,
+// so any cross-owner key over the resource satisfied EVERY own key over it. The
+// escalation is now a per-key declaration checked for verb dominance at load.
+//
+// ORACLE DISCIPLINE, per this file's header: these two cases are driven by holding
+// the weak `any` key ALONE. The old D1 always held the own key TOO, so the admit it
+// recorded could have come from either branch — which is exactly why the defect sat
+// unpinned. Holding only the weak key leaves the counterpart branch as the sole
+// possible source of a `true`.
+test('D1b: a weaker-verb cross-owner key does not satisfy an own key', async () => {
+  // A READ grant over every builder's memory is not the authority to MANAGE one.
+  await holding(['memory.read.any'], async () => {
+    assert.equal(await authorizeOwnedOrAny(ME, 'memory.manage.own', { ownerId: SOMEONE_ELSE }), false,
+      'memory.read.any reads every memory; it does not manage another builder\'s');
+  });
+  // `act` is a BUNDLE (release + cost + notes); `claim.release.any` carries the
+  // release third only, so it must not admit the other two against someone else.
+  await holding(['claim.release.any'], async () => {
+    assert.equal(await authorizeOwnedOrAny(ME, 'task.act.own', { ownerId: SOMEONE_ELSE }), false,
+      'claim.release.any releases a claim; it does not post costs or notes on one');
+  });
+  // Holding the own key as well changes nothing about the OTHER owner's row — the
+  // shape the old D1 asserted as an admit.
   await holding(['memory.manage.own', 'memory.read.any'], async () => {
-    assert.equal(await authorizeOwnedOrAny(ME, 'memory.manage.own', { ownerId: SOMEONE_ELSE }), true);
+    assert.equal(await authorizeOwnedOrAny(ME, 'memory.manage.own', { ownerId: SOMEONE_ELSE }), false);
+    assert.equal(await authorizeOwnedOrAny(ME, 'memory.manage.own', { ownerId: ME }), true,
+      'the own branch is untouched — your own row is still yours');
   });
-  await holding(['box.manage.own', 'box.fleet.manage'], async () => {
-    assert.equal(await authorizeOwnedOrAny(ME, 'box.manage.own', { ownerId: SOMEONE_ELSE }), true);
+  await holding(['task.act.own', 'claim.release.any'], async () => {
+    assert.equal(await authorizeOwnedOrAny(ME, 'task.act.own', { ownerId: SOMEONE_ELSE }), false);
+    assert.equal(await authorizeOwnedOrAny(ME, 'task.act.own', { ownerId: ME }), true);
+  });
+  // And the strongest form: EVERY permission in the catalog still does not reach
+  // another owner's memory or claim, because nothing in it dominates those verbs.
+  await holding(EVERYTHING, async () => {
+    assert.equal(await authorizeOwnedOrAny(ME, 'memory.manage.own', { ownerId: SOMEONE_ELSE }), false,
+      'no key in the catalog dominates memory.manage.own');
+    assert.equal(await authorizeOwnedOrAny(ME, 'task.act.own', { ownerId: SOMEONE_ELSE }), false,
+      'no key in the catalog dominates task.act.own');
   });
 });
 
+// The declaration itself, held against the verb rule that admits it. This is the
+// catalog-level twin of D1b: it fails if a future edit declares a counterpart whose
+// verb does not dominate, even before any resolver call exercises it.
+test('D1c: every declared counterpart is cross-owner, same-resource, and verb-dominant', () => {
+  let declared = 0;
+  for (const p of PERMISSIONS) {
+    if (p.scope !== 'own') continue;
+    assert.ok(Array.isArray(p.counterpart),
+      `${p.key} is own-scoped and must declare counterpart explicitly`);
+    assert.ok(OWNERSHIP_VERBS.includes(p.verb), `${p.key} must declare a known verb`);
+    assert.equal(verbOf(p.key), p.verb, 'verbOf must agree with the row it reads');
+    for (const key of p.counterpart) {
+      declared++;
+      const c = byKey(key);
+      assert.ok(c, `${p.key} names counterpart ${key}, which must exist`);
+      assert.equal(c.scope, 'any', `${p.key}'s counterpart ${key} must be cross-owner`);
+      assert.equal(c.resource, p.resource, `${p.key}'s counterpart ${key} must share its resource`);
+      assert.ok(verbDominates(c.verb, p.verb),
+        `${p.key}'s counterpart ${key} (verb ${c.verb}) must dominate verb ${p.verb}`);
+    }
+  }
+  assert.ok(declared >= 1, 'expected at least the box pair to be declared');
+  // A verb never dominates a wider one, and an unknown verb fails closed — the
+  // relation is asserted directly so a future edit to the table is caught here.
+  assert.equal(verbDominates('manage', 'read'), true);
+  assert.equal(verbDominates('manage', 'act'), true);
+  assert.equal(verbDominates('read', 'read'), true);
+  assert.equal(verbDominates('read', 'manage'), false);
+  assert.equal(verbDominates('release', 'act'), false);
+  assert.equal(verbDominates('act', 'manage'), false);
+  assert.equal(verbDominates('manage', 'nonsense'), false);
+  assert.equal(verbDominates(null, 'manage'), false);
+  // The table is the whole relation: only `manage` subsumes anything, and it is the
+  // one verb nothing else dominates. Pinned so a widening needs a deliberate edit.
+  assert.deepEqual(Object.keys(VERB_DOMINANCE), ['manage']);
+  for (const v of OWNERSHIP_VERBS) {
+    assert.equal(verbDominates('manage', v), true, `manage must dominate ${v}`);
+    if (v !== 'manage') {
+      assert.equal(verbDominates(v, 'manage'), false, `${v} must not dominate manage`);
+    }
+  }
+  // An unscoped key has no verb at all — the axis only means something with a scope.
+  assert.equal(verbOf('cost.log'), null);
+  assert.equal(verbOf('nope.not.a.key'), null);
+});
+
 test('D2: holding only the OWN key never reaches someone else, in either entry point', async () => {
   for (const [, fam] of PAIRED) {
     for (const ownKey of fam.own) {
@@ -354,7 +459,7 @@ test('F3: a cross-owner key cheaper than its own-scoped counterpart throws at mo
   assert.throws(
     () => loadMutatedCatalog('inverted floors', (s) => s.replace(
       `  { key: 'goal.manage.own',`,
-      `  { key: 'goal.manage.any', system: false, floor: 'xenos', scope: 'any', resource: 'goal', guards: 'fixture' },\n  { key: 'goal.manage.own',`)),
+      `  { key: 'goal.manage.any', system: false, floor: 'xenos', scope: 'any', resource: 'goal', verb: 'manage', guards: 'fixture' },\n  { key: 'goal.manage.own',`)),
     /must never be cheaper than own-only/,
   );
 });
@@ -363,22 +468,108 @@ test('F4: a cross-owner key with no ownership-scoped counterpart throws at modul
   assert.throws(
     () => loadMutatedCatalog('lone any', (s) => s.replace(
       `  { key: 'goal.manage.own',`,
-      `  { key: 'widget.manage.any', system: false, floor: 'archon', scope: 'any', resource: 'widget', guards: 'fixture' },\n  { key: 'goal.manage.own',`)),
+      `  { key: 'widget.manage.any', system: false, floor: 'archon', scope: 'any', resource: 'widget', verb: 'manage', guards: 'fixture' },\n  { key: 'goal.manage.own',`)),
     /with no ownership-scoped counterpart/,
   );
 });
 
+// F5–F8 are task 1003195's half: the counterpart declaration and its verb rule.
+// Same harness, so what is proven is the SHIPPED assertion block. Each fixture
+// reintroduces the exact defect the task was filed for, or a near neighbour of it.
+
+test('F5: a counterpart whose verb does not dominate throws at module load', () => {
+  // The literal finding-12 defect: memory.read.any declared as the escalation path
+  // for memory.manage.own — a read grant admitting a write on another owner's row.
+  assert.throws(
+    () => loadMutatedCatalog('weak verb counterpart', (s) => s.replace(
+      `resource: 'memory', verb: 'manage', counterpart: []`,
+      `resource: 'memory', verb: 'manage', counterpart: ['memory.read.any']`)),
+    /does not dominate/,
+  );
+  // And its sibling: release is one third of act.
+  assert.throws(
+    () => loadMutatedCatalog('partial verb counterpart', (s) => s.replace(
+      `resource: 'claim', verb: 'act', counterpart: []`,
+      `resource: 'claim', verb: 'act', counterpart: ['claim.release.any']`)),
+    /does not dominate/,
+  );
+});
+
+test('F6: an own-scoped key that declares no counterpart at all throws at module load', () => {
+  // The fail-loud that replaces the silent family derivation: a new own key cannot
+  // inherit an escalation path merely by belonging to a resource.
+  assert.throws(
+    () => loadMutatedCatalog('missing counterpart', (s) => s.replace(
+      `resource: 'credential', verb: 'manage', counterpart: []`,
+      `resource: 'credential', verb: 'manage'`)),
+    /must declare counterpart/,
+  );
+});
+
+test('F7: a counterpart that is dangling, cross-resource, or not cross-owner throws', () => {
+  assert.throws(
+    () => loadMutatedCatalog('dangling counterpart', (s) => s.replace(
+      `resource: 'credential', verb: 'manage', counterpart: []`,
+      `resource: 'credential', verb: 'manage', counterpart: ['credential.manage.any']`)),
+    /not a permission in this catalog/,
+  );
+  assert.throws(
+    () => loadMutatedCatalog('cross-resource counterpart', (s) => s.replace(
+      `resource: 'credential', verb: 'manage', counterpart: []`,
+      `resource: 'credential', verb: 'manage', counterpart: ['box.fleet.manage']`)),
+    /never crosses resource families/,
+  );
+  assert.throws(
+    () => loadMutatedCatalog('own key as counterpart', (s) => s.replace(
+      `resource: 'box', verb: 'manage', counterpart: ['box.fleet.manage']`,
+      `resource: 'box', verb: 'manage', counterpart: ['memory.manage.own']`)),
+    /is not cross-owner/,
+  );
+});
+
+test('F8: the verb field itself is partitioned with scope and checked against the vocabulary', () => {
+  assert.throws(
+    () => loadMutatedCatalog('scope without verb', (s) => s.replace(
+      `resource: 'builder_prefs', verb: 'set', counterpart: []`,
+      `resource: 'builder_prefs', counterpart: []`)),
+    /scope and verb must come together/,
+  );
+  assert.throws(
+    () => loadMutatedCatalog('unknown verb', (s) => s.replace(
+      `resource: 'builder_prefs', verb: 'set', counterpart: []`,
+      `resource: 'builder_prefs', verb: 'obliterate', counterpart: []`)),
+    /unknown verb/,
+  );
+  // A counterpart on a key that has no owner axis is a mis-declaration, not a no-op.
+  assert.throws(
+    () => loadMutatedCatalog('counterpart on an any key', (s) => s.replace(
+      `resource: 'memory', verb: 'read', guards:`,
+      `resource: 'memory', verb: 'read', counterpart: [], guards:`)),
+    /is not own-scoped/,
+  );
+});
+
 // ═══ G — the R94/R95/R98 invariants this slice must not have disturbed ════════
 
-test('G1: the seed is still floor-derived and cumulative — the ownership axis adds no grants', () => {
+test('G1: RANK_SEED is still DERIVED from seedForRank, not hand-maintained', () => {
+  // task 1003196 (finding 8) trimmed this test, and it is worth saying exactly what
+  // it does and does not prove. It USED to re-spell seedForRank's formula
+  // (`floor !== null && RANK_ORDER.indexOf(p.floor) <= tier`) and assert it against
+  // RANK_SEED — but RANK_SEED is BUILT by seedForRank, so the two sides moved
+  // together: the copy could detect drift from the other copies of itself and never
+  // a wrong formula. That formula oracle is kept ONCE, in tests/government_catalog.mjs
+  // ("a role holds a permission iff its floor is a real rank at-or-below"), with the
+  // real independent oracles being government_parity.mjs Part A and the pinned
+  // concrete values beside it.
+  //
+  // What survives here is narrow and genuine: RANK_SEED must remain a DERIVATION.
+  // The catalog's "zero day-one change" guarantee (R103) is structural only while
+  // the seed is computed from floors — the day someone replaces RANK_SEED with a
+  // hand-written list, parity stops being a property of the code and becomes a
+  // promise someone has to keep by hand. That is what this catches.
   for (const rank of RANK_ORDER) {
-    const held = new Set(RANK_SEED[rank]);
-    const tier = RANK_ORDER.indexOf(rank);
-    for (const p of PERMISSIONS) {
-      assert.equal(held.has(p.key), p.floor !== null && RANK_ORDER.indexOf(p.floor) <= tier,
-        `${rank} vs ${p.key}: scope must not touch the floor derivation`);
-    }
-    assert.deepEqual([...seedForRank(rank)].sort(), [...RANK_SEED[rank]].sort());
+    assert.deepEqual([...seedForRank(rank)].sort(), [...RANK_SEED[rank]].sort(),
+      `${rank}: RANK_SEED must be what seedForRank computes, never a maintained copy`);
   }
 });
 

package/tests/government_protected_surfaces.mjs

@@ -214,11 +214,89 @@ test('every entry maps to a permission the catalog defines as system:true', () =
   assert.deepEqual(registry.SYSTEM_PERMISSIONS, ['path.protected.modify']);
 });
 
-test('a surface mapped to a grantable or unknown permission fails loud', () => {
-  // The guard must actually catch a bad mapping, not pass vacuously.
+// Feed a BAD registry through the real loader in a cold subprocess and assert the
+// module refuses to load. The pattern is the sibling probe below ("a missing
+// registry fails CLOSED"): patch fs.readFileSync for the registry path only, then
+// require the module under test and let its load-time throw be the result.
+//
+// WHY A SUBPROCESS AND NOT AN IN-PROCESS ASSERTION (task 1003196, finding 9). The
+// version of this test before that task read the catalog and checked that a
+// grantable key exists and an unknown key returns null — both true regardless of
+// whether the guard exists. Demonstrated: deleting the whole validation loop from
+// modules/government/protected-surfaces.js left the entire suite green. The guard
+// is load-time, so only a fresh module load can exercise it, and the registry is
+// read from disk, so only a patched read can make it bad.
+//
+// This matters because the sibling test above ("every entry maps to a permission
+// the catalog defines as system:true") only checks the COMMITTED file. The
+// load-time throw is what protects an out-of-band registry write — the Government
+// tab editing an instance file at runtime — and nothing was watching it.
+function loadWithRegistry(registryJson) {
+  execFileSync(process.execPath, ['-e',
+    "const fs=require('node:fs');const real=fs.readFileSync;" +
+    'const fake=' + JSON.stringify(JSON.stringify(registryJson)) + ';' +
+    "fs.readFileSync=(p,...r)=>(String(p).includes('protected-surfaces.json') ? fake : real(p,...r));" +
+    "require('./modules/government/protected-surfaces.js');",
+  ], { cwd: ROOT, stdio: 'pipe' });
+}
+
+test('a surface mapped to a GRANTABLE permission fails loud at load', () => {
+  // A grantable (system:false) key is the dangerous case ADR 0151 §4 names: a
+  // custom rank could be handed the very power the substrate reserves.
   const grantable = catalog.grantableKeys()[0];
-  assert.ok(grantable && catalog.isSystem(grantable) === false);
-  assert.equal(catalog.byKey('not.a.real.permission'), null);
+  assert.ok(grantable, 'the catalog must define at least one grantable key for this probe');
+  assert.equal(catalog.isSystem(grantable), false, 'fixture sanity: the probe key must be grantable');
+  assert.throws(
+    () => loadWithRegistry({
+      floor: 'metic',
+      permission: grantable,
+      surfaces: [{ glob: 'src/probe/grantable-surface.js' }],
+    }),
+    /which is not system:true/,
+    'a surface mapping to a grantable permission must refuse to load',
+  );
+});
+
+test('a surface mapped to an UNKNOWN permission fails loud at load', () => {
+  assert.equal(catalog.byKey('not.a.real.permission'), null, 'fixture sanity: the key must be unknown');
+  assert.throws(
+    () => loadWithRegistry({
+      floor: 'metic',
+      permission: 'not.a.real.permission',
+      surfaces: [{ glob: 'src/probe/unknown-surface.js' }],
+    }),
+    /which the permission catalog does not define/,
+    'a surface mapping to a permission the catalog never defines must refuse to load',
+  );
+});
+
+test('the probe itself is honest — a GOOD registry loads clean through the same path', () => {
+  // Without this, both assertions above would pass if the subprocess threw for an
+  // unrelated reason (a bad patch, a missing cwd, a syntax error in the -e script).
+  assert.doesNotThrow(() => loadWithRegistry({
+    floor: 'metic',
+    permission: registry.SYSTEM_PERMISSIONS[0],
+    surfaces: [{ glob: 'src/probe/good-surface.js' }],
+  }), 'a well-formed registry must still load — otherwise the probes above prove nothing');
+});
+
+test('an unknown FLOOR is refused before the catalog check ever sees it', () => {
+  // The validation loop's third branch (`!catalog.RANK_ORDER.includes(s.floor)`) is
+  // a DRIFT guard, not dead code, and this test records why it cannot be provoked
+  // through the registry: the kernel loader keeps its own local RANK_TIER map
+  // (permission-path-check.js) and rejects an unknown floor first. The government
+  // branch only becomes reachable if those two rank lists ever disagree — which is
+  // exactly the drift it exists to catch, and is not craftable from JSON alone.
+  assert.throws(
+    () => loadWithRegistry({
+      floor: 'emperor',
+      permission: registry.SYSTEM_PERMISSIONS[0],
+      surfaces: [{ glob: 'src/probe/bad-floor.js' }],
+    }),
+    /unknown floor/,
+  );
+  assert.deepEqual(catalog.RANK_ORDER, ['xenos', 'thetes', 'metic', 'archon'],
+    'if this list and the kernel RANK_TIER drift, the government floor branch wakes up');
 });
 
 // ---------- synchronous, no DB, no server ----------