@bongos/core 1.19.732 → 1.19.733

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.732",
-  "core_contract": "1.19.732",
-  "source_commit": "05f95d3811b50b7da27f822578bed1bdaa6c678d",
+  "core_version": "1.19.733",
+  "core_contract": "1.19.733",
+  "source_commit": "1cf8536fa296cc05a9c0fc2a1cff4667ab628843",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T15:41:18.185Z",
+  "built_at": "2026-09-13T15:46:24.724Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 477,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2102,
+    "functional_verbatim": 2104,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2603,
-  "tree_sha256": "ff43e4e917e23173177aea01ebf8266b85bab2ff188f67ab26f5577a47c3ffe3",
+  "file_count": 2605,
+  "tree_sha256": "df29652d8de78cc03652254e561648215caacb4e49b7c6a73a7eb502d9c2e049",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2482,7 +2482,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "6a3d0cfd51a5e932d65a8634f52f4a61e62f3501453b104e2ab5d2086860d9e1"
+      "sha256": "05bbf0c615af2c986b0bad8963870a0420b3f0dee092bbbcbcaf9794c1f607a1"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4404,6 +4404,11 @@
       "mode": "0000644",
       "sha256": "b651b73c65b0da33284430b430638dbc39b34db43846a05ab431deaabcc44b3b"
     },
+    {
+      "path": "modules/grading/dead-feature-claim.js",
+      "mode": "0000644",
+      "sha256": "907d02d33fd6e593d4bfcc0d9a00a9622ceaf49dd88b0f81b29ff4718d63a3d5"
+    },
     {
       "path": "modules/grading/generated-provenance.js",
       "mode": "0000644",
@@ -4432,7 +4437,7 @@
     {
       "path": "modules/grading/grader-score.js",
       "mode": "0000644",
-      "sha256": "387d518becd0cce38ecb15cb525084bcabfef04c138d6cae3eabaf3d928ddb5d"
+      "sha256": "e361b57dd292492abf8d40ad8935dab8ad619717b9c439d70808b9325d2fcb5e"
     },
     {
       "path": "modules/grading/grader-subagent.js",
@@ -4487,7 +4492,7 @@
     {
       "path": "modules/grading/grader-workers/worker-verdict.js",
       "mode": "0000644",
-      "sha256": "9c3abb069cfdee124b4fd5c521fe1c11b44177f7af941c9ab7bbb2a4a3718bab"
+      "sha256": "52b04b281ddde638cf5a46172ad9d05d7caa8ba57a2d01c2b907b82b8524d4d2"
     },
     {
       "path": "modules/grading/grader.js",
@@ -7512,12 +7517,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "dc33512a9aebd07ee5a82a6aff3d969080aa4c7f465a2f64b65f534502043f25"
+      "sha256": "d991c248b006d2066c11468c5749e58951463ecab027b50991ff4ca28279f294"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "05b4e628ace671cc392fad7a333da1d0eea15d7f33350dd08f6bf4d21b48e972"
+      "sha256": "ed94a0e7dc7bdd1e48ebd1f9521b9aeb93a8e0289e9928393cf49461fd46dafa"
     },
     {
       "path": "public-docs/index.html",
@@ -9317,7 +9322,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "bd79c2971dd8196fe95345a663188120141c97b5b797147c81a48bad1c9ccc0e"
+      "sha256": "83f3cb9f3f8992a2b8accb6b66190e82095bfcbe1ca2fb9bb40a471a194b380a"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10174,6 +10179,11 @@
       "mode": "0000644",
       "sha256": "07d2825c812a10cd1d39182883652dec15d360d3645dd38023a00a0593d36ddc"
     },
+    {
+      "path": "tests/dead_feature_claim.mjs",
+      "mode": "0000644",
+      "sha256": "af5f2cbeb241470d4a819a8531aeb4069cbb4fe913bc479f3542661c39ce5ba7"
+    },
     {
       "path": "tests/dependencies_migration.mjs",
       "mode": "0000644",
@@ -10887,7 +10897,7 @@
     {
       "path": "tests/grade_server_authoritative.mjs",
       "mode": "0000644",
-      "sha256": "9482e5e458023b691f8e5971e232c6492d5e3e2772e927e1f6639f95808c8149"
+      "sha256": "f27ea217e74d880296db9f78aa8ed3b97d1a4a7a71496015af5f5d3e3ad69f05"
     },
     {
       "path": "tests/grade_unavailable_display.mjs",

package/docs/module-api-changelog.md

@@ -1938,5 +1938,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.730 with no explicit bump. run 34766029928. (task 1002620)
   1.19.732 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.731 with no explicit bump. run 34766314699. (task 1002620)
+  1.19.733 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.732 with no explicit bump. run 34766569496. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/grading/dead-feature-claim.js

@@ -0,0 +1,121 @@
+// modules/grading/dead-feature-claim.js — does a panel finding say, in its own
+// words, that the shipped code does not run at all? (task 1002665)
+//
+// WHY. On the task 1002648 ship the Quality worker found that the new PATCH
+// needs_migration path threw at runtime — a TASK_SETTER_COLUMNS allowlist gap —
+// and wrote "the feature is entirely non-operational". It then filed that at
+// severity `nit`, the grade PASSed, and the dead feature merged to main. The
+// finding TEXT was right; the SEVERITY was miscalibrated, and severity is the
+// only channel a reader's attention follows.
+//
+// Two things had to be true for that to merge, and this module addresses the
+// first. (1) Nothing re-read the finding's own claim against its own severity.
+// (2) Severity has no vote in the gate at all: `passed` in grader-score.js is
+// `bothPass && !lowConfidence && …`, computed from the rubric SCORES — a major
+// or blocker issue does not by itself stop a passing grade. So a severity floor
+// alone would not have gated this ship, which is why grader-score.js pairs this
+// classifier with a server-side guard rather than relying on the raised severity
+// to do the work. The row that asked for this proposed the floor on its own; the
+// floor on its own is decoration.
+//
+// SCOPE, deliberately narrow. This matches only ABSOLUTE claims about the
+// submitted change: always-throws, never-runs, non-operational. It does NOT
+// match conditional defects ("would throw on a null id") — those are ordinary
+// findings the scores already judge — and it does not match the word
+// "unreachable", which the originating row suggested: a reviewer writes "the old
+// branch is now unreachable" to PRAISE a dead-code deletion, and that reading is
+// at least as common as the damning one. A false positive here costs a builder a
+// manual-confirm round, so the phrase list stays at claims that have no innocent
+// reading, and the suppressors below drop the two framings that do.
+
+'use strict';
+
+// Absolute claims of runtime-deadness. Each must be unambiguous ON ITS OWN — if
+// a phrase has an innocent reading in ordinary review prose, it does not belong
+// here, it belongs in the scores.
+const DEAD_CLAIM_PATTERNS = [
+  /\bnon-?operational\b/i,
+  /\b(?:always|unconditionally) throws?\b/i,
+  /\bthrows? (?:at runtime|on every (?:call|invocation|request))\b/i,
+  /\bnever (?:executes|runs|fires|gets called)\b/i,
+  /\b(?:can|will) never (?:run|execute|be (?:called|reached))\b/i,
+  /\bdoes ?n[o']?t work at all\b/i,
+  /\b(?:completely|entirely|totally) (?:broken|dead|inoperable)\b/i,
+  /\bdead on arrival\b/i,
+];
+
+// A claim about code the change REMOVED or FIXED, or a hypothetical, is the
+// opposite of a dead-feature report — it is the reviewer describing what the
+// diff cured. These read within a short window BEFORE the matched phrase,
+// because that is where the framing sits in English ("this used to always
+// throw", "no longer non-operational", "would always throw if the id were null").
+const SUPPRESSORS = [
+  /\bused to\b/i,
+  /\bno longer\b/i,
+  /\bpreviously\b/i,
+  /\bbefore this (?:change|diff|fix|patch)\b/i,
+  /\bwas\b/i,
+  /\bwould\b/i,
+  /\bif\b/i,
+  /\bprevents?\b/i,
+  /\bavoids?\b/i,
+  /\bfix(?:e[sd])?\b/i,
+];
+
+// How far back a suppressor counts. One clause, not one paragraph: read too far
+// and an unrelated "fixed" earlier in a multi-sentence summary silences a real
+// claim; read too little and "this would always throw" trips.
+const SUPPRESSOR_WINDOW = 40;
+
+// Does `text` assert that the submitted code does not run at all? Returns the
+// matched phrase (truthy, and useful in the audit trail) or null. Pure.
+function deadFeatureClaim(text) {
+  const s = typeof text === 'string' ? text : '';
+  if (!s) return null;
+  for (const re of DEAD_CLAIM_PATTERNS) {
+    const m = re.exec(s);
+    if (!m) continue;
+    const before = s.slice(Math.max(0, m.index - SUPPRESSOR_WINDOW), m.index);
+    if (SUPPRESSORS.some((sup) => sup.test(before))) continue;
+    return m[0];
+  }
+  return null;
+}
+
+// The same question asked of one issues[] entry. Only `summary` carries the
+// worker's prose — `severity`/`file` are enumerated fields — so this reads that
+// and nothing else, which keeps a file PATH containing an unlucky word (say,
+// `always-throws.test.js`) from raising a severity.
+function issueClaimsRuntimeDead(issue) {
+  if (!issue || typeof issue !== 'object') return null;
+  return deadFeatureClaim(issue.summary);
+}
+
+// Severities in ascending order of gravity; anything at or above `major` needs no
+// floor, and an unrecognised severity is treated as below it (fail-closed: an
+// unknown label must not buy an exemption).
+const AT_LEAST_MAJOR = new Set(['major', 'blocker']);
+
+// Raise a runtime-dead finding to `major`, preserving what the worker reported.
+// Returns a NEW array when anything changed, the input array otherwise, so a
+// caller can cheaply tell whether the floor fired.
+function applyDeadFeatureFloor(issues) {
+  if (!Array.isArray(issues)) return issues;
+  let changed = false;
+  const out = issues.map((it) => {
+    const claim = issueClaimsRuntimeDead(it);
+    if (!claim) return it;
+    if (AT_LEAST_MAJOR.has(String(it.severity || '').toLowerCase())) return it;
+    changed = true;
+    return {
+      ...it,
+      severity: 'major',
+      severity_reported: it.severity,
+      severity_floor: 'runtime_dead',
+      severity_floor_claim: claim,
+    };
+  });
+  return changed ? out : issues;
+}
+
+module.exports = { deadFeatureClaim, issueClaimsRuntimeDead, applyDeadFeatureFloor };

package/modules/grading/grader-score.js

@@ -14,6 +14,7 @@ const fs = require('node:fs');
 const { DEFAULT_GRADER_MODEL, FALLTHROUGH_CONFIDENCE, LOW_CONFIDENCE, THRESHOLD, VERSION, permissionPathCheck, routeRankCheck } = require('./grader-config.js');
 const { TRIVIAL_MAX_FILES, TRIVIAL_MAX_LINES, clamp, median, r1 } = require('./grader-model.js');
 const { extractJson } = require('./grader-prompt.js');
+const { issueClaimsRuntimeDead } = require('./dead-feature-claim.js');
 
 function isNum(n) {
   return Number.isFinite(n);
@@ -480,6 +481,35 @@ function serverSideGuards(gradeResult, { committedFiles, builderRank, diffStats,
     implausiblePassWaived = 'panel_evidence';
   }
 
+  // --- Guard 2b: a finding that says the change does not run (task 1002665) ---
+  // On the task 1002648 ship the Quality worker wrote that the new code path was
+  // "entirely non-operational", filed it at `nit`, and the grade PASSed — the
+  // dead feature merged to main and was caught only because the builder happened
+  // to read the finding prose. Severity alone cannot fix that, because severity
+  // has no vote here: `passed` is computed from the rubric SCORES, so a major or
+  // blocker issue does not stop a passing grade by itself. This is the vote.
+  //
+  // Re-derived server-side from the submitted summaries rather than trusting the
+  // client's `severity_floor` marker — same posture as Guard 1, and the worker's
+  // floor is the honest-panel half of the same rule.
+  //
+  // It downgrades to CONCERNS, not fail: the classifier reads a model's prose, so
+  // a false positive should cost a human glance through manual-confirm rather
+  // than a hard FAIL and a paid re-grade. That is still enough to close the hole
+  // — 1002648 merged automatically, and a concerns verdict does not.
+  const deadClaims = (base.issues || [])
+    .map((it) => ({ it, claim: issueClaimsRuntimeDead(it) }))
+    .filter((x) => x.claim);
+  if (clientPassed && deadClaims.length) {
+    const { it, claim } = deadClaims[0];
+    const where = it.file ? ` in ${it.file}` : '';
+    guardsTripped.push({ guard: 'runtime_dead_finding', severity: 'major',
+      summary: `a ${it.severity_reported || it.severity || '?'}-severity finding${where} asserts the change does not run ("${claim}") — a passing grade over a self-reported dead feature must be human-confirmed` });
+    extraIssues.push({ severity: 'major', file: it.file || '(grade)', worker: 'server-runtime-dead', summary:
+      `[server runtime-dead] the panel's own words say this does not run ("${claim}"); severity was reported as ${it.severity_reported || it.severity || '?'}` });
+    if (downgradeTo !== 'fail') downgradeTo = 'concerns';
+  }
+
   // --- Guard 3: bound the credit/achievement signals (SR-18) ---
   // The net-negative "Subtractor" bonus + shipper badges key off client-supplied
   // signals.diff_stats + committed_files the server can't re-derive. We can't
@@ -517,7 +547,7 @@ function serverSideGuards(gradeResult, { committedFiles, builderRank, diffStats,
       signals: {
         ...(base.signals || {}),
         server_guard: {
-          applied: ['route_rank', 'permission_path', 'permission_path_unprovable', 'implausible_pass', 'forged_net_negative'],
+          applied: ['route_rank', 'permission_path', 'permission_path_unprovable', 'implausible_pass', 'runtime_dead_finding', 'forged_net_negative'],
           ok: true,
           tripped: [],
           // task 1002658 / ADR 0164: the audit trail records WHY a zero-issue
@@ -556,7 +586,7 @@ function serverSideGuards(gradeResult, { committedFiles, builderRank, diffStats,
       // body already ran; this is the authoritative post-hoc adjustment).
       confidence: forwardedConfidence,
       server_guard: {
-        applied: ['route_rank', 'permission_path', 'permission_path_unprovable', 'implausible_pass', 'forged_net_negative'],
+        applied: ['route_rank', 'permission_path', 'permission_path_unprovable', 'implausible_pass', 'runtime_dead_finding', 'forged_net_negative'],
         ok: guardsTripped.length === 0,
         downgraded_to: downgradeTo,
         client_passed: clientPassed,

package/modules/grading/grader-workers/worker-verdict.js

@@ -9,6 +9,8 @@
 // (the audit's explicit warning). Behavior-neutral: the objects produced here
 // are identical (same keys, same order, same values) to the inlined copies.
 
+const { applyDeadFeatureFloor } = require('../dead-feature-claim.js');
+
 // The { verdict:'fail', scores:{}, confidence:0, ... } shape every error
 // short-circuit returns. `issues` defaults to [] (the subprocess_error and
 // parse_error paths) and is the parsed issues array on the schema_error path
@@ -19,13 +21,21 @@ function failResult({ notesMd, error, issues = [] }) {
 
 // The three identical extractions every worker does after the parse guard:
 // confidence (null-tolerant), the bounded issues array, and the subagent notes.
+//
+// The issues array also passes the runtime-dead floor (task 1002665): a worker
+// that writes "the feature is entirely non-operational" and files it at `nit`
+// has contradicted itself, and on the task 1002648 ship that contradiction is
+// what let a dead feature merge. Raising it HERE, at the one place all four
+// workers parse their own output, means the worker's own downstream logic —
+// applySeverityGatePolicy below, which asks whether a fail is backed by a
+// major/blocker — sees the corrected severity rather than the reported one.
 function parseCommon(parsed) {
   const conf = parsed.confidence == null
     ? null
     : Number.isFinite(Number(parsed.confidence)) ? Number(parsed.confidence) : null;
-  const issues = Array.isArray(parsed.issues)
+  const issues = applyDeadFeatureFloor(Array.isArray(parsed.issues)
     ? parsed.issues.filter((i) => i && typeof i === 'object').slice(0, 50)
-    : [];
+    : []);
   const notesFromSubagent = typeof parsed.notes_md === 'string' ? parsed.notes_md : '';
   return { conf, issues, notesFromSubagent };
 }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.732",
+  "version": "1.19.733",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.732",
+      "version": "1.19.733",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.732",
+  "version": "1.19.733",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.732'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.733'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/dead_feature_claim.mjs

@@ -0,0 +1,176 @@
+// tests/dead_feature_claim.mjs — the runtime-dead severity floor (task 1002665).
+//
+// Evidence: on the task 1002648 ship the Quality worker found that the new PATCH
+// needs_migration path threw at runtime, wrote "the feature is entirely
+// non-operational", filed it at severity `nit`, and the grade PASSed. The dead
+// feature merged to main; it was caught only because the builder read the prose.
+//
+// Two halves are proved here. The FLOOR raises such a finding to `major` so the
+// worker's own logic and every reader see the severity its own words imply. The
+// CLASSIFIER is deliberately narrow, and most of these cases exist to prove what
+// it does NOT match — a false positive costs a builder a manual-confirm round,
+// so conditional defects, praise for deleted code, and the ambiguous word
+// "unreachable" all have to stay out.
+//
+// Run:  node tests/dead_feature_claim.mjs
+
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { deadFeatureClaim, issueClaimsRuntimeDead, applyDeadFeatureFloor } = require('../modules/grading/dead-feature-claim.js');
+const { parseCommon, applySeverityGatePolicy } = require('../modules/grading/grader-workers/worker-verdict.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+function eq(actual, expected, msg) {
+  if (actual !== expected) throw new Error(`${msg || 'mismatch'}: expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`);
+}
+function truthy(v, msg) { if (!v) throw new Error(msg || `expected truthy, got ${JSON.stringify(v)}`); }
+function falsy(v, msg) { if (v) throw new Error(msg || `expected falsy, got ${JSON.stringify(v)}`); }
+
+// ---- the claim classifier: what it MUST catch ----------------------------
+
+test('the exact 1002648 wording is a dead-feature claim', () => {
+  truthy(deadFeatureClaim('TASK_SETTER_COLUMNS lacks needs_migration, so the feature is entirely non-operational'));
+});
+
+test('non-operational, with or without the hyphen', () => {
+  truthy(deadFeatureClaim('this path is nonoperational'));
+  truthy(deadFeatureClaim('this path is non-operational'));
+});
+
+test('always-throws and never-runs claims', () => {
+  truthy(deadFeatureClaim('the new helper always throws because the key is absent'));
+  truthy(deadFeatureClaim('this branch never executes'));
+  truthy(deadFeatureClaim('the handler can never run — nothing dispatches to it'));
+  truthy(deadFeatureClaim('the route throws at runtime on the first call'));
+});
+
+test('completely/entirely broken and dead on arrival', () => {
+  truthy(deadFeatureClaim('the migration is completely broken'));
+  truthy(deadFeatureClaim('this endpoint is dead on arrival'));
+});
+
+test('the claim is returned, not just a boolean, so the audit trail can quote it', () => {
+  eq(deadFeatureClaim('the feature is entirely non-operational'), 'non-operational');
+});
+
+// ---- the claim classifier: what it MUST NOT catch ------------------------
+
+test('a CONDITIONAL defect is not a dead-feature claim — the scores judge those', () => {
+  falsy(deadFeatureClaim('this would always throw if the id were null'));
+  falsy(deadFeatureClaim('if the cache is cold the loader never runs'));
+});
+
+test('praise for what the diff REMOVED is not a dead-feature claim', () => {
+  falsy(deadFeatureClaim('the old branch used to always throw; this fixes it'));
+  falsy(deadFeatureClaim('this path is no longer non-operational'));
+  falsy(deadFeatureClaim('previously the handler never executed'));
+  falsy(deadFeatureClaim('before this change the route was completely broken'));
+});
+
+test('"unreachable" is NOT matched — a reviewer writes it to praise a dead-code deletion', () => {
+  falsy(deadFeatureClaim('the old fallback is now unreachable and was deleted'));
+  falsy(deadFeatureClaim('this line is unreachable'));
+});
+
+test('empty and non-string input are safe', () => {
+  falsy(deadFeatureClaim(''));
+  falsy(deadFeatureClaim(null));
+  falsy(deadFeatureClaim(undefined));
+  falsy(deadFeatureClaim({ summary: 'always throws' }));
+});
+
+// ---- issueClaimsRuntimeDead reads the SUMMARY only -----------------------
+
+test('only the summary is read — a file path with an unlucky name never raises a severity', () => {
+  falsy(issueClaimsRuntimeDead({ severity: 'nit', file: 'tests/always-throws.test.js', summary: 'rename this' }));
+  truthy(issueClaimsRuntimeDead({ severity: 'nit', file: 'x.js', summary: 'the setter always throws' }));
+});
+
+test('a malformed issue entry is not a claim', () => {
+  falsy(issueClaimsRuntimeDead(null));
+  falsy(issueClaimsRuntimeDead('always throws'));
+});
+
+// ---- the floor -----------------------------------------------------------
+
+test('a nit that asserts the feature is dead is raised to major', () => {
+  const out = applyDeadFeatureFloor([{ severity: 'nit', file: 'db.js', summary: 'the feature is entirely non-operational' }]);
+  eq(out[0].severity, 'major');
+  eq(out[0].severity_reported, 'nit', 'what the worker actually said is preserved');
+  eq(out[0].severity_floor, 'runtime_dead');
+  eq(out[0].severity_floor_claim, 'non-operational');
+});
+
+test('minor is raised too; major and blocker are left exactly as reported', () => {
+  const out = applyDeadFeatureFloor([
+    { severity: 'minor', summary: 'always throws' },
+    { severity: 'major', summary: 'always throws' },
+    { severity: 'blocker', summary: 'always throws' },
+  ]);
+  eq(out[0].severity, 'major');
+  eq(out[0].severity_floor, 'runtime_dead');
+  eq(out[1].severity_floor, undefined, 'an already-major finding is not re-stamped');
+  eq(out[2].severity, 'blocker', 'a blocker is never lowered to major');
+});
+
+test('an UNKNOWN severity is raised — an unrecognised label must not buy an exemption', () => {
+  const out = applyDeadFeatureFloor([{ severity: 'trivial', summary: 'always throws' }]);
+  eq(out[0].severity, 'major');
+  eq(out[0].severity_reported, 'trivial');
+});
+
+test('findings with no dead-feature claim pass through untouched, same array', () => {
+  const input = [{ severity: 'nit', summary: 'comment style' }];
+  eq(applyDeadFeatureFloor(input), input, 'the input array itself is returned when nothing changed');
+});
+
+test('the floor does not mutate the caller\'s objects', () => {
+  const it = { severity: 'nit', summary: 'always throws' };
+  applyDeadFeatureFloor([it]);
+  eq(it.severity, 'nit', 'the original entry is untouched');
+});
+
+test('a non-array is returned as-is rather than throwing', () => {
+  eq(applyDeadFeatureFloor(null), null);
+  eq(applyDeadFeatureFloor(undefined), undefined);
+});
+
+// ---- the wiring: every worker parses through parseCommon -----------------
+//
+// parseCommon is the one place all four workers turn their own JSON into issues,
+// so the floor belongs there. Without this test the floor could be unwired from
+// parseCommon and every unit above would still pass.
+
+test('parseCommon applies the floor, so all four workers get it', () => {
+  const { issues } = parseCommon({ issues: [{ severity: 'nit', file: 'db.js', summary: 'the feature is entirely non-operational' }] });
+  eq(issues[0].severity, 'major');
+  eq(issues[0].severity_floor, 'runtime_dead');
+});
+
+test('parseCommon still bounds and filters issues[] exactly as before', () => {
+  const { issues } = parseCommon({ issues: [null, 'junk', { severity: 'nit', summary: 'fine' }] });
+  eq(issues.length, 1, 'non-object entries are dropped');
+  eq(parseCommon({ issues: Array.from({ length: 80 }, () => ({ severity: 'nit', summary: 'x' })) }).issues.length, 50,
+    'the 50-entry bound is unchanged');
+  eq(parseCommon({ issues: 'not an array' }).issues.length, 0);
+});
+
+test('the raised severity reaches the worker\'s own severity gate: a dead-feature fail is no longer downgraded', () => {
+  const { issues } = parseCommon({ issues: [{ severity: 'nit', file: 'db.js', summary: 'the new setter always throws' }] });
+  const result = applySeverityGatePolicy(
+    { verdict: 'fail', scores: { code_quality: 4 }, issues, notes_md: '' },
+    { threshold: 6 }
+  );
+  eq(result.verdict, 'fail', 'a fail backed by a floor-raised finding stays a fail');
+  eq(result.policy_downgrade, undefined);
+});
+
+console.log('');
+console.log(`dead_feature_claim: ${passed} passed, ${failed} failed`);
+process.exit(failed > 0 ? 1 : 0);

package/tests/grade_server_authoritative.mjs

@@ -478,6 +478,63 @@ await test('applyGrade on a server-downgraded (passed=false) grade awards no cre
   assert.ok(!queries.some((q) => /INSERT INTO credit_log/.test(q.sql)), 'no credit_log insert');
 });
 
+// ========================================================================
+// Guard 2b — a finding whose own words say the change does not run (task 1002665).
+//
+// The 1002648 regression, reconstructed: the Quality worker wrote "the feature is
+// entirely non-operational", filed it at `nit`, the rubric scores were high, and
+// the grade PASSed straight to a merge. Note WHY a severity floor alone could not
+// have stopped it — `passed` is computed from the scores, so even at `major` the
+// grade still passes. This guard is the vote severity never had.
+// ========================================================================
+
+await test('a nit-severity finding that says the change does not run downgrades a PASS', () => {
+  const g = grader.serverSideGuards(
+    clientGrade({ issues: [{ severity: 'nit', file: 'src/bongos/db.js', summary: 'TASK_SETTER_COLUMNS lacks needs_migration, so the feature is entirely non-operational' }] }),
+    { committedFiles: ['src/bongos/db.js'], builderRank: 'metic', diffStats: { files_changed: 2, lines_added: 40, lines_removed: 3 } }
+  );
+  assert.equal(g.passed, false, 'the 1002648 grade must no longer pass');
+  assert.equal(g.signals.server_guard.downgraded_to, 'concerns',
+    'a prose heuristic downgrades to manual-confirm, not a hard FAIL');
+  assert.ok(g.signals.server_guard.tripped.some((t) => t.guard === 'runtime_dead_finding'),
+    'the guard names itself in the audit trail');
+  assert.ok(g.issues.some((i) => i.worker === 'server-runtime-dead'),
+    'the finding is surfaced so the builder sees why');
+});
+
+await test('high rubric scores do NOT rescue it — that is the hole severity alone left open', () => {
+  const g = grader.serverSideGuards(
+    clientGrade({ ff: 10, cq: 10, issues: [{ severity: 'nit', file: 'x.js', summary: 'the new handler always throws' }] }),
+    { committedFiles: ['x.js'], builderRank: 'metic', diffStats: { files_changed: 1, lines_added: 20, lines_removed: 0 } }
+  );
+  assert.equal(g.passed, false, 'a 10/10 grade over a self-reported dead feature must still stop');
+});
+
+await test('an ordinary conditional finding is untouched — no false block', () => {
+  const g = grader.serverSideGuards(
+    clientGrade({ issues: [{ severity: 'nit', file: 'x.js', summary: 'this would throw if the id were null' }] }),
+    { committedFiles: ['x.js'], builderRank: 'metic', diffStats: { files_changed: 1, lines_added: 20, lines_removed: 0 } }
+  );
+  assert.equal(g.passed, true, 'a conditional defect is ordinary review prose, not a dead-feature claim');
+  assert.equal(g.signals.server_guard.ok, true);
+});
+
+await test('praise for deleted dead code is untouched — no false block', () => {
+  const g = grader.serverSideGuards(
+    clientGrade({ issues: [{ severity: 'nit', file: 'x.js', summary: 'the old fallback used to always throw; this removes it' }] }),
+    { committedFiles: ['x.js'], builderRank: 'metic', diffStats: { files_changed: 1, lines_added: 5, lines_removed: 30 } }
+  );
+  assert.equal(g.passed, true, 'describing what the diff CURED must not be read as a dead feature');
+});
+
+await test('a grade that was ALREADY failing is not resurrected by the guard', () => {
+  const g = grader.serverSideGuards(
+    clientGrade({ ff: 2, cq: 2, issues: [{ severity: 'nit', file: 'x.js', summary: 'always throws' }] }),
+    { committedFiles: ['x.js'], builderRank: 'metic', diffStats: { files_changed: 1, lines_added: 20, lines_removed: 0 } }
+  );
+  assert.equal(g.passed, false);
+});
+
 // ------------------------------------------------------------------------
 process.on('exit', () => {
   console.log(`\ngrade_server_authoritative: ${passed} passed, ${failed} failed`);