@bongos/core 1.19.662 → 1.19.663

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.662",
-  "core_contract": "1.19.662",
-  "source_commit": "29f8be216571b2ec145cab49a5a7c230c79270a0",
+  "core_version": "1.19.663",
+  "core_contract": "1.19.663",
+  "source_commit": "6acc4ae42df06ed3334386b6ed58fe312ae7e8a0",
   "source_ref": "HEAD",
-  "built_at": "2026-09-11T02:16:53.563Z",
+  "built_at": "2026-09-11T03:17:38.613Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 473,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2610,
-  "tree_sha256": "c1546f9ff797a30c5dff74fa40f96d201e25291c3bb8061ca8aae6ff845e1d6f",
+  "tree_sha256": "42ab056c27124e80b07512a8787d678c3d74cef4f3b6dbeac2a248a39fa1dde8",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2787,7 +2787,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "6551b2dbf9ed520f152e8aa2ddc2888dcaae6c4f96d4babf71059fb1550f9ca6"
+      "sha256": "d5e752a541b45079b1b23eb12eeb282e6f163a676c0d9b9f122fcef2864d120f"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5647,7 +5647,7 @@
     {
       "path": "modules/lifecycle/db-claims.js",
       "mode": "0000644",
-      "sha256": "23ed6051b8b9283410f23e10862b6b65361cbf2f95489cd1fc50dfd4584f5c71"
+      "sha256": "1b0d394ee1788decd9ea713a4379ef5322eda28a2ac11ad7adaf68298e6f4075"
     },
     {
       "path": "modules/lifecycle/db-deps-criteria.js",
@@ -5672,7 +5672,7 @@
     {
       "path": "modules/lifecycle/db-rank-authz.js",
       "mode": "0000644",
-      "sha256": "e5feff1eb42ad631b6c0165c23224d8ac56ef7f40e5d238afb09013501e9db7c"
+      "sha256": "fb8180f875828664fcd5cb17aa39f68c70b6cea3c52d03fdbd0b3e835f8b1e64"
     },
     {
       "path": "modules/lifecycle/db-shared.js",
@@ -7752,12 +7752,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "7eb2f5389815f661c90a4c42111d3caf64a5ede4977a66caf27baf2edd10a59f"
+      "sha256": "014c542d80e35f6e6a5572e169232eedf744e09bae83f6798c2d998ca86a18d5"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "eb2e51ad62585ffd964894ae722d41e98372978ac8a58456efa28b945a21c4b1"
+      "sha256": "56f59c24967d3719f7341742409c6f57ef6551dbfd9600591d201888701dc926"
     },
     {
       "path": "public-docs/index.html",
@@ -9512,7 +9512,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c273737ee3e60e60268081525c1bc144940583038cd23c1779a3671a39444a93"
+      "sha256": "3d019bf197d89274ef460bd8b86038aca8418d5071d2d76c43479ba1743c556e"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10857,7 +10857,7 @@
     {
       "path": "tests/government_claim_eligibility.mjs",
       "mode": "0000644",
-      "sha256": "1989a7e5e39a6bb177dfd86e610c0806c96fdc97f9149800de431af816f2c31a"
+      "sha256": "05a7c8f8d001bd0d2950619fb46f242d358ecae1a8901a10fbb9ecc7857500e7"
     },
     {
       "path": "tests/government_config.mjs",
@@ -10902,7 +10902,7 @@
     {
       "path": "tests/government_ownership_scope.mjs",
       "mode": "0000644",
-      "sha256": "bdcb0266f38c50b0e3085271bdec4fbe726c32c8af1052104703d0afa7e89d52"
+      "sha256": "76b81db7769290d5ef5c26ece86ce0610c5aef6c8984ffdd54a6340db66db3bc"
     },
     {
       "path": "tests/government_page_gates.mjs",
@@ -10922,7 +10922,7 @@
     {
       "path": "tests/government_protected_surfaces.mjs",
       "mode": "0000644",
-      "sha256": "cd56facc3522f17cd83b067ee1ae9dcb3e4e03dac13157013c44d7ba23508af2"
+      "sha256": "3517e05c1264fbdbeadc533884942926689952c8995548863ca1cfbfc365428e"
     },
     {
       "path": "tests/government_rank_sync.mjs",

package/docs/module-api-changelog.md

@@ -1773,5 +1773,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.660 with no explicit bump. run 34552525938. (task 1002620)
   1.19.662 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.661 with no explicit bump. run 34553965204. (task 1002620)
+  1.19.663 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.662 with no explicit bump. run 34557840364. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/db-claims.js

@@ -15,10 +15,15 @@ const { pool, withTx } = api;
 const log = api.logger('lifecycle');
 const seams = api;
 const { touchesOverlap } = api.pathMatch;
-const { claimEligibilityAllows, CLAIM_ANY, CLAIM_NEWCOMER } = require('./claim-eligibility.js');
+// CLAIM_ANY / CLAIM_NEWCOMER name the two atoms in the refusal message. The
+// decision itself moved to db-rank-authz.claimGate (task 1003196), so this file
+// no longer calls claimEligibilityAllows / rankAllowsTask / xenosClaimAllowed
+// directly — composing them at three separate call sites is what made the gate
+// un-testable except by counting.
+const { CLAIM_ANY, CLAIM_NEWCOMER } = require('./claim-eligibility.js');
 const { goalMembershipFailures } = require('./claim-feed.js');
 const { unsatisfiedDeps } = require('./db-deps-criteria.js');
-const { claimPermissionsFor, disambiguateWorktreeName, foldWorktreeName, rankAllowsTask, xenosClaimAllowed } = require('./db-rank-authz.js');
+const { claimGate, claimPermissionsFor, disambiguateWorktreeName, foldWorktreeName } = require('./db-rank-authz.js');
 const { sealSessionLog } = require('./db-shared.js');
 const { needsRebaseTasksForBuilder, shouldRefuseClaimResolve } = require('./db-ship.js');
 const { REWARD_SUGGESTION_CAP, rewardGateAssignment } = require('./db-tasks.js');
@@ -142,8 +147,18 @@ async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSess
     // is kept as an alias on the error object for callers on the pre-rename
     // release. BV1.R106 (ADR 0151): same rule, now decided on the PERMISSIONS
     // task.claim.any / task.claim.newcomer — see ./claim-eligibility.js.
+    // task 1003196: the queue+floor composition is decided ONCE, in
+    // db-rank-authz.claimGate, so a test can drive the real decision instead of
+    // counting `if`s in this file. The refusal SHAPES below are unchanged — that
+    // is why claimGate returns which gates refused rather than an error object.
     const newcomerFriendly = task.newcomer_friendly;
-    if (!claimEligibilityAllows({ heldPermissions, newcomerFriendly, rankRuleAllows: xenosClaimAllowed(builderRank, newcomerFriendly) })) {
+    const claimRefusals = claimGate({
+      builderRank,
+      newcomerFriendly,
+      requiresRank: task.requires_rank,
+      heldPermissions,
+    });
+    if (claimRefusals.includes('queue')) {
       // task 1002613 (map §4.4): the bare code reported a PERMISSION decision as
       // a rank one — no axis, no remedy. Copy INSUFFICIENT_RANK's shape below:
       // name both sides of the wall and the way forward.
@@ -168,7 +183,7 @@ async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSess
     // blocks Xenos+Metic. The DB CHECK on tasks.requires_rank enforces the
     // enum, so we trust the value here. INSUFFICIENT_RANK carries the actual
     // and required ranks so the caller can render a clean error.
-    if (!rankAllowsTask(builderRank, task.requires_rank)) {
+    if (claimRefusals.includes('floor')) {
       throw {
         code: 'INSUFFICIENT_RANK',
         required: task.requires_rank,
@@ -496,25 +511,32 @@ async function claimTasksBatch({ taskIds, builderId, worktreePrefix, creatorSess
     // never checked here, while claimTask checks every rank), so removing it would
     // change who can batch-claim. That pre-existing asymmetry is reported, not
     // fixed, under this task — closing it is an authority decision of its own.
-    if (builderRank === 'xenos') {
-      for (const t of taskRows) {
-        if (!claimEligibilityAllows({
-          heldPermissions,
-          newcomerFriendly: t.newcomer_friendly,
-          rankRuleAllows: xenosClaimAllowed(builderRank, t.newcomer_friendly),
-        })) {
-          failures.push({ task_id: t.id, reason: 'rank_too_low_for_task', legacy_reason: 'XENOS_RESTRICTED' });
-        }
+    //
+    // V3.R82 (#301): the per-task requires_rank floor rides the same decision.
+    // Mirrors the single claimTask gate so a Metic can't slip through batch-claim
+    // to grab an Archon-only task. The xenos sandbox check handles the xenos case
+    // exhaustively for requires_rank='xenos' (the default); the floor gate refuses
+    // requires_rank='metic'/'archon' when the builder is below.
+    //
+    // task 1003196: both gates now come from db-rank-authz.claimGate. A row can
+    // still collect BOTH refusals, and the two passes below are deliberate — this
+    // path groups every queue refusal ahead of every floor refusal, and `failures`
+    // is returned to the caller in order, so folding them into one pass per row
+    // would reorder a response for no reason.
+    const refusalsFor = (t) => claimGate({
+      builderRank,
+      newcomerFriendly: t.newcomer_friendly,
+      requiresRank: t.requires_rank,
+      heldPermissions,
+      queueGateApplies: builderRank === 'xenos',
+    });
+    for (const t of taskRows) {
+      if (refusalsFor(t).includes('queue')) {
+        failures.push({ task_id: t.id, reason: 'rank_too_low_for_task', legacy_reason: 'XENOS_RESTRICTED' });
       }
     }
-
-    // V3.R82 (#301): the per-task requires_rank floor. Mirrors the single
-    // claimTask gate so a Metic can't slip through batch-claim to grab an
-    // Archon-only task. The xenos sandbox check above handles the xenos case
-    // exhaustively for requires_rank='xenos' (the default); this gate refuses
-    // requires_rank='metic'/'archon' when the builder is below.
     for (const t of taskRows) {
-      if (!rankAllowsTask(builderRank, t.requires_rank)) {
+      if (refusalsFor(t).includes('floor')) {
         failures.push({
           task_id: t.id,
           reason: 'INSUFFICIENT_RANK',
@@ -855,14 +877,19 @@ async function validateClaimBatch({ taskIds, builderId }) {
     const t = byId.get(id);
     if (!t) { push(id, { reason: 'TASK_NOT_FOUND' }); continue; }
     if (t.status !== 'ready') push(id, { reason: 'TASK_NOT_READY', currentStatus: t.status });
-    if (builderRank === 'xenos' && !claimEligibilityAllows({
-      heldPermissions,
+    // task 1003196: same composed decision as claimTask and claimTasksBatch, and
+    // the same deliberate xenos-only queue short-circuit the batch path carries.
+    const refusals = claimGate({
+      builderRank,
       newcomerFriendly: t.newcomer_friendly,
-      rankRuleAllows: xenosClaimAllowed(builderRank, t.newcomer_friendly),
-    })) {
+      requiresRank: t.requires_rank,
+      heldPermissions,
+      queueGateApplies: builderRank === 'xenos',
+    });
+    if (refusals.includes('queue')) {
       push(id, { reason: 'rank_too_low_for_task', legacy_reason: 'XENOS_RESTRICTED' });
     }
-    if (!rankAllowsTask(builderRank, t.requires_rank)) {
+    if (refusals.includes('floor')) {
       push(id, { reason: 'INSUFFICIENT_RANK', required: t.requires_rank, actual: builderRank });
     }
   }

package/modules/lifecycle/db-rank-authz.js

@@ -14,6 +14,7 @@ const api = require('../../src/module-api');
 const { pool, LIVE_RANK_LADDER, RANK_TIER } = api;
 const seams = api;
 const { matchProtected } = api.permissionPathCheck;
+const { claimEligibilityAllows } = require('./claim-eligibility.js');
 
 // -------------------------------------------------------------------------
 // Builders
@@ -166,6 +167,51 @@ function rankAllowsTask(builderRank, requiredRank) {
   return have >= needed;
 }
 
+// ── the COMPOSED per-task claim decision (task 1003196) ──────────────────────
+//
+// Claim eligibility is TWO independent gates — the QUEUE axis (permission atoms,
+// ./claim-eligibility.js) and the FLOOR axis (`requires_rank`, rankAllowsTask
+// above) — and the rule that matters is that BOTH must pass and neither
+// substitutes for the other. That composition used to exist only as a pair of
+// consecutive `if`s repeated at each of the three claim paths, which meant the
+// only thing a test could check was that the source still CONTAINED them:
+// `tests/government_claim_eligibility.mjs` counted occurrences, and neutering
+// claimTask's gate with `&& false` left the count at 3 and the suite green
+// (finding 10 of the task-1002671 verification). Counting is not a behaviour
+// oracle, so the decision lives here, once, where a test can actually drive it.
+//
+// RETURNS THE GATES THAT REFUSED, in ladder order — `[]` means allowed. It
+// deliberately does NOT return a ready-made error: each call site shapes its own
+// refusal and those shapes are API surface (claimTask THROWS
+// `{code:'rank_too_low_for_task', …, message, hint}`, while the batch paths PUSH
+// `{task_id, reason, legacy_reason}` and accumulate both refusals for one row).
+// Returning a decision instead of a wire error is what lets all three delegate
+// without any of them changing what a caller sees.
+//
+// `queueGateApplies` carries a PRE-EXISTING asymmetry rather than quietly fixing
+// it: claimTask runs the queue gate for every rank, while claimTasksBatch and
+// validateClaimBatch run it only when `builderRank === 'xenos'`. That outer
+// short-circuit is semantic, not a fast path — for the SEEDED sets the two agree
+// exactly (thetes+ all hold task.claim.any), but a custom rank granted neither
+// claim atom would be refused by claimTask and admitted by the batch paths.
+// Closing that is an authority decision of its own, already reported and
+// deliberately deferred at the call site; this parameter keeps each path's
+// current meaning exact while still routing it through one decision.
+const CLAIM_GATES = Object.freeze(['queue', 'floor']);
+
+function claimGate({ builderRank, newcomerFriendly, requiresRank, heldPermissions, queueGateApplies = true }) {
+  const refused = [];
+  if (queueGateApplies && !claimEligibilityAllows({
+    heldPermissions,
+    newcomerFriendly,
+    rankRuleAllows: xenosClaimAllowed(builderRank, newcomerFriendly),
+  })) {
+    refused.push('queue');
+  }
+  if (!rankAllowsTask(builderRank, requiresRank)) refused.push('floor');
+  return Object.freeze(refused);
+}
+
 // deriveRequiredRank — task 1498 / ADR 0084. The per-task requires_rank floor
 // (V3.R82 #301) shipped INERT: no create/edit path ever set it, so every task
 // sat at the 'xenos' default and the claim gate never bit. We now DERIVE a floor
@@ -477,6 +523,8 @@ module.exports = {
   RANKS,
   REQUIRES_RANK_TIER,
   THETES_GRADUATION_THRESHOLD,
+  CLAIM_GATES,
+  claimGate,
   claimPermissionsFor,
   countShippedTasksForBuilder,
   deriveRequiredRank,

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.662",
+  "version": "1.19.663",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.662",
+      "version": "1.19.663",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.662",
+  "version": "1.19.663",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.662'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.663'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_claim_eligibility.mjs

@@ -154,16 +154,138 @@ test('the permission predicate cannot see requires_rank at all (structural)', ()
   }
 });
 
-test('every claim path in db.js still gates on requires_rank as its own check', () => {
-  // task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
-  const src = lifecycleDbSource();
-  // claimTask, claimTasksBatch, validateClaimBatch — three call sites, three
-  // separate rankAllowsTask conjuncts. If a refactor ever folds the floor into the
-  // permission predicate, this count drops and the test reds.
-  const floorChecks = src.match(/rankAllowsTask\((builderRank|builderRank), (task|t)\.requires_rank\)/g) || [];
-  assert.equal(floorChecks.length, 3, `expected 3 requires_rank gates in the claim paths, found ${floorChecks.length}`);
-  const queueChecks = src.match(/claimEligibilityAllows\(\{/g) || [];
-  assert.equal(queueChecks.length, 3, `expected 3 permission-expressed queue gates, found ${queueChecks.length}`);
+// ── the COMPOSED gate, driven behaviourally (task 1003196, finding 10) ───────
+//
+// WHAT THIS REPLACED, AND WHY. Until task 1003196 this section grepped the
+// lifecycle source for three occurrences of `rankAllowsTask(builderRank,
+// t.requires_rank)` and three of `claimEligibilityAllows({`. That verifies
+// PRESENCE, not EFFECT: neutering claimTask's gate with `&& false` left both
+// counts at 3 and the suite green. The composition now lives in one pure export,
+// db-rank-authz.claimGate, so these tests drive the real decision instead.
+//
+// claimGate returns the gates that REFUSED, in ladder order — `[]` means allowed.
+
+const { claimGate, CLAIM_GATES } = rankAuthz;
+const gatesFor = (o) => [...claimGate(o)];
+
+test('claimGate: BOTH axes must pass, and neither substitutes for the other', () => {
+  // An Archon holding everything is still stopped by nothing at requires_rank xenos...
+  assert.deepEqual(gatesFor({
+    builderRank: 'archon', newcomerFriendly: false, requiresRank: 'xenos', heldPermissions: seedSet('archon'),
+  }), []);
+
+  // ...and a builder who clears the QUEUE axis is still refused by the FLOOR axis.
+  // This is the collapse the two-gate model exists to prevent: holding
+  // task.claim.any must not buy you an archon-floored task.
+  assert.deepEqual(gatesFor({
+    builderRank: 'metic', newcomerFriendly: false, requiresRank: 'archon', heldPermissions: seedSet('metic'),
+  }), ['floor']);
+
+  // The converse: clearing the FLOOR axis does not buy you the queue. A xenos on a
+  // default-floor task that is NOT newcomer_friendly holds only task.claim.newcomer.
+  assert.deepEqual(gatesFor({
+    builderRank: 'xenos', newcomerFriendly: false, requiresRank: 'xenos', heldPermissions: seedSet('xenos'),
+  }), ['queue']);
+
+  // Both can refuse the same row, and the order is the ladder order.
+  assert.deepEqual(gatesFor({
+    builderRank: 'xenos', newcomerFriendly: false, requiresRank: 'archon', heldPermissions: seedSet('xenos'),
+  }), ['queue', 'floor']);
+
+  // ...and a newcomer_friendly flag opens the queue without lowering the floor.
+  assert.deepEqual(gatesFor({
+    builderRank: 'xenos', newcomerFriendly: true, requiresRank: 'metic', heldPermissions: seedSet('xenos'),
+  }), ['floor'], 'newcomer_friendly must never lower requires_rank');
+});
+
+test('claimGate: the composed decision matches the two axes evaluated separately', () => {
+  // The independent oracle: each axis run through its OWN production predicate
+  // (db.rankAllowsTask and eligibility.claimEligibilityAllows), composed here in
+  // the test. A claimGate that silently dropped a conjunct disagrees immediately.
+  let refusalsSeen = 0;
+  for (const rank of LIVE_RANKS) {
+    for (const nf of NF_VALUES) {
+      for (const requiresRank of [...LIVE_RANKS, null]) {
+        for (const held of [seedSet(rank), new Set(), new Set([CLAIM_ANY]), new Set([CLAIM_NEWCOMER]), null]) {
+          const expected = [];
+          if (!claimEligibilityAllows({
+            heldPermissions: held, newcomerFriendly: nf, rankRuleAllows: db.xenosClaimAllowed(rank, nf),
+          })) expected.push('queue');
+          if (!db.rankAllowsTask(rank, requiresRank)) expected.push('floor');
+          refusalsSeen += expected.length;
+          assert.deepEqual(
+            gatesFor({ builderRank: rank, newcomerFriendly: nf, requiresRank, heldPermissions: held }),
+            expected,
+            `${rank}/nf=${String(nf)}/req=${String(requiresRank)}/held=${held ? [...held].length : 'null'}`,
+          );
+        }
+      }
+    }
+  }
+  assert.ok(refusalsSeen > 0, 'a matrix that never refuses would pass vacuously');
+});
+
+test('claimGate: fail-closed on ranks and floors it does not recognise', () => {
+  // An unknown rank clears nothing — the posture rankAllowsTask already takes.
+  assert.ok(gatesFor({
+    builderRank: 'bogus', newcomerFriendly: true, requiresRank: 'xenos', heldPermissions: new Set([CLAIM_ANY]),
+  }).includes('floor'), 'an unrecognised builder rank must not clear the floor');
+  // A requires_rank the DB CHECK should have blocked refuses rather than defaults.
+  assert.ok(gatesFor({
+    builderRank: 'archon', newcomerFriendly: true, requiresRank: 'nonsense', heldPermissions: seedSet('archon'),
+  }).includes('floor'), 'an unrecognised requires_rank must fail closed');
+  // A null requires_rank is the column default — no extra gate.
+  assert.deepEqual(gatesFor({
+    builderRank: 'xenos', newcomerFriendly: true, requiresRank: null, heldPermissions: seedSet('xenos'),
+  }), []);
+});
+
+test('claimGate: queueGateApplies carries the batch paths\' pre-existing asymmetry', () => {
+  // claimTask runs the queue gate for EVERY rank; claimTasksBatch and
+  // validateClaimBatch run it only when builderRank === 'xenos'. For the SEEDED
+  // sets the two agree exactly, which is why the asymmetry has never bitten...
+  for (const rank of LIVE_RANKS) {
+    for (const nf of NF_VALUES) {
+      const held = seedSet(rank);
+      assert.deepEqual(
+        gatesFor({ builderRank: rank, newcomerFriendly: nf, requiresRank: 'xenos', heldPermissions: held }),
+        gatesFor({ builderRank: rank, newcomerFriendly: nf, requiresRank: 'xenos', heldPermissions: held, queueGateApplies: rank === 'xenos' }),
+        `${rank}/nf=${String(nf)}: seeded sets must agree across both call-site flavours`,
+      );
+    }
+  }
+  // ...and here is the case where they DIVERGE, pinned so it stays a known,
+  // deliberate difference rather than a surprise: a CUSTOM rank granted neither
+  // claim atom is refused by claimTask and admitted by the batch paths. Closing
+  // this is an authority decision of its own (see the note at the call site).
+  const neither = new Set(['cost.log']);
+  assert.deepEqual(gatesFor({
+    builderRank: 'metic', newcomerFriendly: false, requiresRank: 'xenos', heldPermissions: neither,
+  }), ['queue'], 'claimTask refuses a rank holding no claim atom');
+  assert.deepEqual(gatesFor({
+    builderRank: 'metic', newcomerFriendly: false, requiresRank: 'xenos', heldPermissions: neither, queueGateApplies: false,
+  }), [], 'the batch paths admit it — the asymmetry, recorded');
+});
+
+test('every claim path delegates to claimGate rather than re-composing the axes', () => {
+  // The cheap STRUCTURAL complement to the behavioural tests above. It can still
+  // only see presence, so it is no longer the only thing standing: what it adds is
+  // that a call site cannot quietly go back to composing the gates itself, which
+  // is what let the three copies drift apart in the first place.
+  // Counted in db-claims.js alone: the whole-family source also carries the
+  // DEFINITION in db-rank-authz.js, which would make the count read 4 and quietly
+  // tolerate one call site dropping out.
+  const claims = fs.readFileSync(path.join(LIFECYCLE, 'db-claims.js'), 'utf8');
+  const delegations = claims.match(/claimGate\(\{/g) || [];
+  assert.equal(delegations.length, 3,
+    `claimTask, claimTasksBatch and validateClaimBatch must each call claimGate — found ${delegations.length}`);
+  // ...and the raw conjuncts are gone from the claim paths, so there is exactly
+  // one place where "both gates must pass" is written down.
+  for (const banned of ['rankAllowsTask(', 'claimEligibilityAllows(']) {
+    assert.ok(!claims.includes(banned),
+      `db-claims.js must reach the axes through claimGate, not call "${banned}" itself`);
+  }
+  assert.deepEqual([...CLAIM_GATES], ['queue', 'floor'], 'the gate names are ladder-ordered');
 });
 
 // ── the "authority could not be established" fallback ────────────────────────

package/tests/government_ownership_scope.mjs

@@ -551,15 +551,25 @@ test('F8: the verb field itself is partitioned with scope and checked against th
 
 // ═══ G — the R94/R95/R98 invariants this slice must not have disturbed ════════
 
-test('G1: the seed is still floor-derived and cumulative — the ownership axis adds no grants', () => {
+test('G1: RANK_SEED is still DERIVED from seedForRank, not hand-maintained', () => {
+  // task 1003196 (finding 8) trimmed this test, and it is worth saying exactly what
+  // it does and does not prove. It USED to re-spell seedForRank's formula
+  // (`floor !== null && RANK_ORDER.indexOf(p.floor) <= tier`) and assert it against
+  // RANK_SEED — but RANK_SEED is BUILT by seedForRank, so the two sides moved
+  // together: the copy could detect drift from the other copies of itself and never
+  // a wrong formula. That formula oracle is kept ONCE, in tests/government_catalog.mjs
+  // ("a role holds a permission iff its floor is a real rank at-or-below"), with the
+  // real independent oracles being government_parity.mjs Part A and the pinned
+  // concrete values beside it.
+  //
+  // What survives here is narrow and genuine: RANK_SEED must remain a DERIVATION.
+  // The catalog's "zero day-one change" guarantee (R103) is structural only while
+  // the seed is computed from floors — the day someone replaces RANK_SEED with a
+  // hand-written list, parity stops being a property of the code and becomes a
+  // promise someone has to keep by hand. That is what this catches.
   for (const rank of RANK_ORDER) {
-    const held = new Set(RANK_SEED[rank]);
-    const tier = RANK_ORDER.indexOf(rank);
-    for (const p of PERMISSIONS) {
-      assert.equal(held.has(p.key), p.floor !== null && RANK_ORDER.indexOf(p.floor) <= tier,
-        `${rank} vs ${p.key}: scope must not touch the floor derivation`);
-    }
-    assert.deepEqual([...seedForRank(rank)].sort(), [...RANK_SEED[rank]].sort());
+    assert.deepEqual([...seedForRank(rank)].sort(), [...RANK_SEED[rank]].sort(),
+      `${rank}: RANK_SEED must be what seedForRank computes, never a maintained copy`);
   }
 });
 

package/tests/government_protected_surfaces.mjs

@@ -214,11 +214,89 @@ test('every entry maps to a permission the catalog defines as system:true', () =
   assert.deepEqual(registry.SYSTEM_PERMISSIONS, ['path.protected.modify']);
 });
 
-test('a surface mapped to a grantable or unknown permission fails loud', () => {
-  // The guard must actually catch a bad mapping, not pass vacuously.
+// Feed a BAD registry through the real loader in a cold subprocess and assert the
+// module refuses to load. The pattern is the sibling probe below ("a missing
+// registry fails CLOSED"): patch fs.readFileSync for the registry path only, then
+// require the module under test and let its load-time throw be the result.
+//
+// WHY A SUBPROCESS AND NOT AN IN-PROCESS ASSERTION (task 1003196, finding 9). The
+// version of this test before that task read the catalog and checked that a
+// grantable key exists and an unknown key returns null — both true regardless of
+// whether the guard exists. Demonstrated: deleting the whole validation loop from
+// modules/government/protected-surfaces.js left the entire suite green. The guard
+// is load-time, so only a fresh module load can exercise it, and the registry is
+// read from disk, so only a patched read can make it bad.
+//
+// This matters because the sibling test above ("every entry maps to a permission
+// the catalog defines as system:true") only checks the COMMITTED file. The
+// load-time throw is what protects an out-of-band registry write — the Government
+// tab editing an instance file at runtime — and nothing was watching it.
+function loadWithRegistry(registryJson) {
+  execFileSync(process.execPath, ['-e',
+    "const fs=require('node:fs');const real=fs.readFileSync;" +
+    'const fake=' + JSON.stringify(JSON.stringify(registryJson)) + ';' +
+    "fs.readFileSync=(p,...r)=>(String(p).includes('protected-surfaces.json') ? fake : real(p,...r));" +
+    "require('./modules/government/protected-surfaces.js');",
+  ], { cwd: ROOT, stdio: 'pipe' });
+}
+
+test('a surface mapped to a GRANTABLE permission fails loud at load', () => {
+  // A grantable (system:false) key is the dangerous case ADR 0151 §4 names: a
+  // custom rank could be handed the very power the substrate reserves.
   const grantable = catalog.grantableKeys()[0];
-  assert.ok(grantable && catalog.isSystem(grantable) === false);
-  assert.equal(catalog.byKey('not.a.real.permission'), null);
+  assert.ok(grantable, 'the catalog must define at least one grantable key for this probe');
+  assert.equal(catalog.isSystem(grantable), false, 'fixture sanity: the probe key must be grantable');
+  assert.throws(
+    () => loadWithRegistry({
+      floor: 'metic',
+      permission: grantable,
+      surfaces: [{ glob: 'src/probe/grantable-surface.js' }],
+    }),
+    /which is not system:true/,
+    'a surface mapping to a grantable permission must refuse to load',
+  );
+});
+
+test('a surface mapped to an UNKNOWN permission fails loud at load', () => {
+  assert.equal(catalog.byKey('not.a.real.permission'), null, 'fixture sanity: the key must be unknown');
+  assert.throws(
+    () => loadWithRegistry({
+      floor: 'metic',
+      permission: 'not.a.real.permission',
+      surfaces: [{ glob: 'src/probe/unknown-surface.js' }],
+    }),
+    /which the permission catalog does not define/,
+    'a surface mapping to a permission the catalog never defines must refuse to load',
+  );
+});
+
+test('the probe itself is honest — a GOOD registry loads clean through the same path', () => {
+  // Without this, both assertions above would pass if the subprocess threw for an
+  // unrelated reason (a bad patch, a missing cwd, a syntax error in the -e script).
+  assert.doesNotThrow(() => loadWithRegistry({
+    floor: 'metic',
+    permission: registry.SYSTEM_PERMISSIONS[0],
+    surfaces: [{ glob: 'src/probe/good-surface.js' }],
+  }), 'a well-formed registry must still load — otherwise the probes above prove nothing');
+});
+
+test('an unknown FLOOR is refused before the catalog check ever sees it', () => {
+  // The validation loop's third branch (`!catalog.RANK_ORDER.includes(s.floor)`) is
+  // a DRIFT guard, not dead code, and this test records why it cannot be provoked
+  // through the registry: the kernel loader keeps its own local RANK_TIER map
+  // (permission-path-check.js) and rejects an unknown floor first. The government
+  // branch only becomes reachable if those two rank lists ever disagree — which is
+  // exactly the drift it exists to catch, and is not craftable from JSON alone.
+  assert.throws(
+    () => loadWithRegistry({
+      floor: 'emperor',
+      permission: registry.SYSTEM_PERMISSIONS[0],
+      surfaces: [{ glob: 'src/probe/bad-floor.js' }],
+    }),
+    /unknown floor/,
+  );
+  assert.deepEqual(catalog.RANK_ORDER, ['xenos', 'thetes', 'metic', 'archon'],
+    'if this list and the kernel RANK_TIER drift, the government floor branch wakes up');
 });
 
 // ---------- synchronous, no DB, no server ----------