@bongos/core 1.19.812 → 1.19.814

package/modules/lifecycle/routes/done-when.js

@@ -130,40 +130,58 @@ module.exports = function buildDoneWhenRouter() {
       goal_id: { type: 'integer', min: 1 },
       sort_order: { type: 'integer', min: 0 },
     })) return;
-    const version = await db.getVersion(versionId);
-    if (!version) return res.fail('version_not_found', { status: 404, message: `No version '${versionId}'.` });
     // bad_goal_id now means exactly what it says: the goal is absent or belongs
     // to another version. (The unauthorized case rendered through this same
     // helper until task 1002614 — see the mask note in authorizeCriterionCreate.)
     const badGoalId = () => res.fail('bad_goal_id', { status: 400, message: `goal_id ${req.body.goal_id} does not exist on version '${versionId}'.` });
-    // A goal_id, if given, must exist AND belong to this version.
-    let goal = null;
-    if (req.body.goal_id != null) {
-      goal = await db.getGoal(req.body.goal_id);
-      if (!goal || String(goal.version_id) !== String(versionId)) return badGoalId();
-    }
-    // ADR 0154: the authority wall. Checked AFTER the goal's version linkage so a
-    // bad ref is still the clearer 400. Membership is only read when a goal was
-    // named and the caller isn't an Archon — a primary-key hit on
-    // goal_members (goal_id, builder_id) (migration 160), on a low-frequency route.
-    const actorMembership = (goal && req.builder.rank !== 'archon')
-      ? await db.getGoalMember({ goalId: goal.id, builderId: req.builder.id })
-      : null;
-    const decision = authorizeCriterionCreate({
-      goal, version, actorId: req.builder.id, actorRank: req.builder.rank, actorMembership,
-    });
-    if (!decision.ok) {
-      return res.status(decision.status).json(decision.body);
-    }
     try {
-      const criterion = await db.createCriterion({
-        versionId,
-        criterionId: req.body.criterion_id,
-        criterionMd: req.body.criterion_md,
-        goalId: req.body.goal_id ?? null,
-        sortOrder: req.body.sort_order ?? null,
-      });
-      res.status(201).json({ ok: true, criterion });
+      // RESOLVE, DECIDE and WRITE in ONE transaction, with the goal row LOCKED
+      // (task 1003840). Before this, the three facts the decision rests on — the
+      // version's status, the goal's owner/version linkage, the actor's
+      // membership — were read on the pool, and the INSERT landed afterwards on
+      // another connection. Between the two, the goal could be transferred or
+      // closed, the membership revoked, or the version frozen, and the write
+      // would land on authority that no longer held.
+      //
+      // The LOCK is the part that closes it. A bare transaction around the same
+      // sequence would still read the stale rows; the lock makes a concurrent
+      // transfer wait behind this one instead of racing it.
+      const outcome = await api.withTx(async (client) => {
+        const version = await db.getVersion(versionId, { client, forUpdate: true });
+        if (!version) return { fail: ['version_not_found', { status: 404, message: `No version '${versionId}'.` }] };
+        // A goal_id, if given, must exist AND belong to this version.
+        let goal = null;
+        if (req.body.goal_id != null) {
+          goal = await db.getGoal(req.body.goal_id, { client, forUpdate: true });
+          if (!goal || String(goal.version_id) !== String(versionId)) return { badGoal: true };
+        }
+        // ADR 0154: the authority wall. Checked AFTER the goal's version linkage so a
+        // bad ref is still the clearer 400. Membership is only read when a goal was
+        // named and the caller isn't an Archon — a primary-key hit on
+        // goal_members (goal_id, builder_id) (migration 160), on a low-frequency route.
+        const actorMembership = (goal && req.builder.rank !== 'archon')
+          ? await db.getGoalMember({ goalId: goal.id, builderId: req.builder.id }, { client })
+          : null;
+        const decision = authorizeCriterionCreate({
+          goal, version, actorId: req.builder.id, actorRank: req.builder.rank, actorMembership,
+        });
+        if (!decision.ok) return { decision };
+        const criterion = await db.createCriterion({
+          versionId,
+          criterionId: req.body.criterion_id,
+          criterionMd: req.body.criterion_md,
+          goalId: req.body.goal_id ?? null,
+          sortOrder: req.body.sort_order ?? null,
+        }, { client });
+        return { criterion };
+      }, { pool: api.pool });
+      // Responses are sent AFTER the transaction resolves, never from inside it:
+      // a refusal must roll back rather than commit a half-written unit of work,
+      // and a 201 must not be promised before the COMMIT succeeds.
+      if (outcome.badGoal) return badGoalId();
+      if (outcome.fail) return res.fail(outcome.fail[0], outcome.fail[1]);
+      if (outcome.decision) return res.status(outcome.decision.status).json(outcome.decision.body);
+      res.status(201).json({ ok: true, criterion: outcome.criterion });
     } catch (err) {
       if (err && err.code === '23505') {
         return res.fail('criterion_exists', { status: 409, message: `criterion_id '${req.body.criterion_id}' already exists on version '${versionId}'.` });
@@ -294,64 +312,82 @@ module.exports = function buildDoneWhenRouter() {
     }
     const id = parseId(req, res, { param: 'criterionId', code: 'bad_criterion_id' });
     if (id === null) return;
-    const existing = await doneWhen.getCriterion(id);
-    if (!existing) return res.fail('criterion_not_found', 404);
-    const version = await db.getVersion(existing.version_id);
-    // The ownership wall, resolved exactly as the CREATE route resolves it: the
-    // goal + version, and membership read only for a non-Archon. One closure, so
-    // both ends of a move are decided by the same code rather than a copy.
-    const authorizeFor = async (goal) => {
-      const actorMembership = (goal && req.builder.rank !== 'archon')
-        ? await db.getGoalMember({ goalId: goal.id, builderId: req.builder.id })
-        : null;
-      return authorizeCriterionCreate({
-        goal, version, actorId: req.builder.id, actorRank: req.builder.rank, actorMembership,
-      });
-    };
-    const currentGoal = existing.goal_id != null ? await db.getGoal(existing.goal_id) : null;
-    const authority = await authorizeFor(currentGoal);
-    if (!authority.ok) return res.status(authority.status).json(authority.body);
+    // Resolve, authorize and write inside ONE transaction, both goal rows LOCKED
+    // (task 1003840) — the same window the CREATE route above had, and the same
+    // cure. A move reads authority at BOTH ends, so both ends are locked: losing
+    // the race at either would move a criterion under authority that had just
+    // been revoked. Locking in a stable order (source before destination) is what
+    // keeps two concurrent moves from deadlocking on each other's rows.
+    const outcome = await api.withTx(async (client) => {
+      const existing = await doneWhen.getCriterion(id, { client });
+      if (!existing) return { fail: ['criterion_not_found', 404] };
+      const version = await db.getVersion(existing.version_id, { client, forUpdate: true });
+      // The ownership wall, resolved exactly as the CREATE route resolves it: the
+      // goal + version, and membership read only for a non-Archon. One closure, so
+      // both ends of a move are decided by the same code rather than a copy.
+      const authorizeFor = async (goal) => {
+        const actorMembership = (goal && req.builder.rank !== 'archon')
+          ? await db.getGoalMember({ goalId: goal.id, builderId: req.builder.id }, { client })
+          : null;
+        return authorizeCriterionCreate({
+          goal, version, actorId: req.builder.id, actorRank: req.builder.rank, actorMembership,
+        });
+      };
+      const targetGoalId = movingGoal ? (req.body.goal_id ?? null) : null;
+
+      // Lock BOTH ends in ASCENDING GOAL ID, never in the order the route happens
+      // to need them (task 1003840, round 2 — the first cut locked source then
+      // destination, which is call order, not a canonical one). Two opposite
+      // moves, 5→10 and 10→5, would then take the two locks in opposite orders
+      // and deadlock; Postgres aborts one rather than corrupting anything, but an
+      // avoidable abort is still an outage for whoever loses. A single agreed
+      // order means they queue instead.
+      const lockIds = [...new Set([
+        existing.goal_id != null ? Number(existing.goal_id) : null,
+        targetGoalId !== null ? Number(targetGoalId) : null,
+      ].filter((v) => v != null))].sort((a, b) => a - b);
+      const locked = new Map();
+      for (const gid of lockIds) locked.set(gid, await db.getGoal(gid, { client, forUpdate: true }));
+
+      const currentGoal = existing.goal_id != null ? locked.get(Number(existing.goal_id)) ?? null : null;
+      const authority = await authorizeFor(currentGoal);
+      if (!authority.ok) return { decision: authority };
 
-    const targetGoalId = movingGoal ? (req.body.goal_id ?? null) : null;
-    if (movingGoal) {
-      let targetGoal = null;
-      if (targetGoalId !== null) {
-        targetGoal = await db.getGoal(targetGoalId);
-        // Same refusal the CREATE route gives, for the same reason: a criterion may
-        // never cross versions, which would put it in one version's rollup and the
-        // other's goal at once.
-        if (!targetGoal || String(targetGoal.version_id) !== String(existing.version_id)) {
-          return res.fail('bad_goal_id', { status: 400, message: `goal_id ${targetGoalId} does not exist on version '${existing.version_id}'.` });
+      if (movingGoal) {
+        let targetGoal = null;
+        if (targetGoalId !== null) {
+          targetGoal = locked.get(Number(targetGoalId)) ?? null;
+          // Same refusal the CREATE route gives, for the same reason: a criterion may
+          // never cross versions, which would put it in one version's rollup and the
+          // other's goal at once.
+          if (!targetGoal || String(targetGoal.version_id) !== String(existing.version_id)) {
+            return { fail: ['bad_goal_id', { status: 400, message: `goal_id ${targetGoalId} does not exist on version '${existing.version_id}'.` }] };
+          }
         }
+        const destination = await authorizeFor(targetGoal);
+        if (!destination.ok) return { decision: destination };
       }
-      const destination = await authorizeFor(targetGoal);
-      if (!destination.ok) return res.status(destination.status).json(destination.body);
-    }
 
-    let criterion = existing;
-    let deltas = [];
-    let unchanged = false;
-    if (changingProse) {
-      const refusal = goalEdits.criterionProseRefusal(existing);
-      if (refusal) return res.fail(refusal.code, refusal.status, refusal.message ? { message: refusal.message } : undefined);
-      const result = await goalEdits.updateCriterionProse({ criterionId: id, criterionMd: req.body.criterion_md });
-      if (!result) return res.fail('criterion_not_found', 404);
-      await goalEdits.recordProseEdit('criterion', id, req, result.deltas);
-      criterion = result.criterion;
-      deltas = result.deltas;
-      unchanged = !!result.unchanged;
-    }
-    const achievedGoals = [];
-    const fromGoalId = existing.goal_id ?? null;
+      let criterion = existing;
+      let deltas = [];
+      let unchanged = false;
+      if (changingProse) {
+        const refusal = goalEdits.criterionProseRefusal(existing);
+        if (refusal) return { refusal };
+        const result = await goalEdits.updateCriterionProse({ criterionId: id, criterionMd: req.body.criterion_md }, { client });
+        if (!result) return { fail: ['criterion_not_found', 404] };
+        criterion = result.criterion;
+        deltas = result.deltas;
+        unchanged = !!result.unchanged;
+      }
+      const achievedGoals = [];
+      const fromGoalId = existing.goal_id ?? null;
     // A move to where it already is writes nothing at all — not the row, not the
     // audit, not a re-derive. Nothing about the world changed.
-    if (movingGoal && fromGoalId !== targetGoalId) {
-      const moved = await db.updateCriterionGoal(id, targetGoalId);
-      if (!moved) return res.fail('criterion_not_found', 404);
-      criterion = moved;
-      await goalEdits.recordCriterionGoalMove(
-        { criterionId: id, fromGoalId, toGoalId: targetGoalId }, req
-      );
+      if (movingGoal && fromGoalId !== targetGoalId) {
+        const moved = await db.updateCriterionGoal(id, targetGoalId, { client });
+        if (!moved) return { fail: ['criterion_not_found', 404] };
+        criterion = moved;
       // BOTH ENDS are re-derived, because a move changes what each of them still
       // needs. The destination is the obvious half — adopting an already-satisfied
       // criterion can be the thing that completes a goal. The SOURCE is the half
@@ -361,13 +397,41 @@ module.exports = function buildDoneWhenRouter() {
       // will ever close again — no later ship re-checks it, because no task under
       // it changed. achieveGoalIfComplete is conservative and idempotent (open
       // goals only, and it never un-achieves), so asking twice is two reads.
-      for (const goalId of [fromGoalId, targetGoalId]) {
-        if (goalId === null) continue;
-        const outcome = await db.achieveGoalIfComplete({ goalId });
-        if (outcome && outcome.achieved) achievedGoals.push(goalId);
+        for (const goalId of [fromGoalId, targetGoalId]) {
+          if (goalId === null) continue;
+          const achieved = await db.achieveGoalIfComplete({ goalId }, { client });
+          if (achieved && achieved.achieved) achievedGoals.push(goalId);
+        }
       }
+      return { criterion, deltas, unchanged, achievedGoals, moved: movingGoal && fromGoalId !== targetGoalId, fromGoalId, targetGoalId };
+    }, { pool: api.pool });
+
+    // Everything below runs only after COMMIT. The audit writes in particular
+    // belong out here: they are announcements of a change that happened, so
+    // recording one for a unit of work that rolled back would put an edit in the
+    // ledger that never landed — the ledger lying, which is the one thing it
+    // must not do.
+    if (outcome.fail) return res.fail(outcome.fail[0], outcome.fail[1]);
+    if (outcome.decision) return res.status(outcome.decision.status).json(outcome.decision.body);
+    if (outcome.refusal) {
+      const r = outcome.refusal;
+      return res.fail(r.code, r.status, r.message ? { message: r.message } : undefined);
     }
-    return res.json({ ok: true, criterion, deltas, unchanged, achieved_goals: achievedGoals });
+    if (outcome.deltas && outcome.deltas.length) {
+      await goalEdits.recordProseEdit('criterion', id, req, outcome.deltas);
+    }
+    if (outcome.moved) {
+      await goalEdits.recordCriterionGoalMove(
+        { criterionId: id, fromGoalId: outcome.fromGoalId, toGoalId: outcome.targetGoalId }, req
+      );
+    }
+    return res.json({
+      ok: true,
+      criterion: outcome.criterion,
+      deltas: outcome.deltas,
+      unchanged: outcome.unchanged,
+      achieved_goals: outcome.achievedGoals,
+    });
   }, { errorCode: 'criterion_update_failed' }));
 
   // Auth: flip a criterion back to unsatisfied (rare; for corrections).

package/modules/lifecycle/routes/tasks.js

@@ -32,6 +32,13 @@ const hierarchy = require('../hierarchy');
 const { suggestCriteria } = require('../criterion-suggest');
 // The orphan-task advisory (task 1002539) — pure, fail-open; see goal-advisory.js.
 const { buildGoalAdvisory } = require('../goal-advisory');
+// The PURE abandon decision (task 1002443, ADR 0297) — rank fact + row fact, kept
+// out of this router so every branch is unit-tested without a live route.
+const abandonAuthz = require('../abandon-authz');
+// The abandon route's HTTP half, carved out so its COMPOSITION (authority resolve
+// + the row-scoped decision + refusal mapping) is directly testable — the one
+// layer neither the pure decision nor the db seam could reach.
+const { makeAbandonHandler } = require('./abandon-handler');
 // grading carved to modules/grading/ (BV1.R73 / ADR 0091 §4): the lifecycle no
 // longer imports the grader — it resolves the `grade` kernel PORT at grade time
 // (seams.resolveOptional('grade'), in POST /tasks/:id/grade below).
@@ -668,45 +675,26 @@ module.exports = function buildTasksRouter() {
   // on a task with an active claim (release it first); idempotent on an already-
   // abandoned task. The abandon + its `reason` land in audit_log via the writing
   // middleware, so the ledger keeps a record of who retired what.
-  // rank: metic+archon — scope removal; the inverse of /promote, and re-ranked to
-  // match it (ADR 0152, was archon under ADR 0090). A Metic who may author, shape,
-  // and promote work may also retire it: leaving the kill switch an Archon rung
-  // higher than the create switch only forced the owner to clean up after the
-  // triage they already delegated. Not one-way any more — /promote restores an
-  // abandoned task to backlog at the same rank — and the guards below (shipped
-  // refused, active claim refused) plus the audit_log entry are unchanged.
-  router.post('/tasks/:id/abandon', auth.requireBuilder, auth.requirePermission('task.abandon'), async (req, res) => {
-    if (validateOrRespond(req, res, {
-      reason: { type: 'string' },  // free-text retire reason (sliced to 2000 below)
-    })) return;
-    const id = parseId(req, res, { code: 'bad_task_id', positiveInt: true });
-    if (id === null) return;
-    const reason = typeof req.body?.reason === 'string' ? req.body.reason.slice(0, 2000) : '';
-    try {
-      const result = await db.abandonTask({ taskId: id, reason });
-      res.json({ ok: true, ...result });
-    } catch (err) {
-      if (err.code === 'TASK_NOT_FOUND') return res.fail('task_not_found', 404);
-      if (err.code === 'CANNOT_ABANDON_SHIPPED') {
-        return res.fail('cannot_abandon_shipped', { status: 409, message: 'shipped tasks are immutable history' });
-      }
-      if (err.code === 'TASK_HAS_ACTIVE_CLAIM') {
-        return res.fail('task_has_active_claim', { status: 409, message: 'release the active claim before abandoning' });
-      }
-      log.error('[gds] POST /tasks/:id/abandon', err);
-      res.fail('abandon_failed', { status: 500, message: 'internal error' });
-    }
-  });
+  // rank: any-builder — DELIBERATELY, and the middleware list is not the whole gate
+  // (ADR 0297). Two authorities reach this transition: `task.abandon` (floor metic)
+  // retires ANY task, and `task.abandon.own` (floor xenos) retires one you CREATED
+  // while it is still backlog/ready/blocked. The second is a predicate over
+  // tasks.created_by, which no rank floor can express — the ADR 0151 ownership axis,
+  // and this is its first route. requirePermission structurally cannot carry it: an
+  // own-scoped key has no unconditional answer and that gate refuses one outright
+  // (auth.js, R100), so `.own` can never collapse into `.any`.
+  //
+  // The two facts are resolved in two places ON PURPOSE. The RANK fact is
+  // request-scoped and resolves here, once, uncached (ADR 0016); the OWNER fact is a
+  // column that can change under us, so it is evaluated inside abandonTask's FOR
+  // UPDATE transaction. Reading created_by here would be a TOCTOU window; resolving
+  // permissions in there would hold a row lock across a second pool acquire.
+  //
+  // Existing guards (shipped refused, active claim refused, idempotent re-abandon)
+  // and the audit_log entry are unchanged on both paths.
+  router.post('/tasks/:id/abandon', auth.requireBuilder,
+    makeAbandonHandler({ db, seams, log, validateOrRespond, parseId }));
 
-  // POST /tasks/:id/merge — mark a duplicate task merged into its canonical one
-  // (task 1001478 — the /bug-triage counterpart to idea_inbox's merge verdict).
-  // Implemented as `abandonTask` plus a target (db.mergeTask, db-ship.js) rather
-  // than a new `tasks.status` value — see that function's header for why. Refuses
-  // a self-merge, a shipped task, a task with an active claim, a target that
-  // doesn't exist, and a target that is itself merged elsewhere (no chains);
-  // idempotent when re-merging into the SAME target already recorded.
-  // rank: metic+archon — same floor as task.abandon, which this reuses under the
-  // hood; a Metic who may retire a task may also say which task it duplicates.
   router.post('/tasks/:id/merge', auth.requireBuilder, auth.requirePermission('task.merge'), async (req, res) => {
     if (validateOrRespond(req, res, {
       into_task_id: { required: true, type: 'integer', min: 1 },

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.812",
+  "version": "1.19.814",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.812",
+      "version": "1.19.814",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.812",
+  "version": "1.19.814",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/route-rank-check.js

@@ -311,7 +311,18 @@ const MODULE_EXPECTED_RANKS = {
     // it; /promote carries the abandoned→backlog undo at the same rank.
     'POST /tasks': 'metic+archon',
     'POST /tasks/:id/promote': 'metic+archon',
-    'POST /tasks/:id/abandon': 'metic+archon',
+    // task 1002443 — DELIBERATELY 'any-builder', widened from 'metic+archon'. Two
+    // authorities reach this route and only one is rank-shaped: `task.abandon`
+    // (floor metic) retires ANY task, and `task.abandon.own` (floor xenos) retires
+    // one you CREATED while it is still backlog/ready/blocked. The second is the
+    // ADR 0151 ownership axis, which requirePermission structurally cannot gate (an
+    // own-scoped key has no unconditional answer), so the wall is requireBuilder +
+    // an in-handler authorizeOwnedOrAny — the POST /goals/:id/members shape.
+    //
+    // Pinning it here keeps catching the accidental TIGHTENING back to a rank floor,
+    // which would lock creators out of retiring their own work and silently revert
+    // the owner's 2026-07-25 request, as loudly as it catches a gate removal.
+    'POST /tasks/:id/abandon': 'any-builder',
     // override-request adjudication (lands credit + ship attribution).
     // ADR 0157: `override_request.decide` lowered archon→metic; pinned by atom.
     'GET /override-requests': 'perm:override_request.decide',

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.812'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.814'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/abandon_creator_authz.mjs

@@ -0,0 +1,176 @@
+// tests/abandon_creator_authz.mjs
+//
+// Regression guard for task 1002443 / ADR 0297 — the PURE abandon decision in
+// modules/lifecycle/abandon-authz.js.
+//
+// WHAT IS BEING PROTECTED. POST /tasks/:id/abandon went from one rank-shaped
+// authority to two, only one of which a rank can express:
+//   • task.abandon     (floor metic) — retire ANY task.
+//   • task.abandon.own (floor xenos) — retire a task you CREATED, and only while
+//     it is still backlog/ready/blocked.
+// The second is the ADR 0151 ownership axis. Its whole safety property is that an
+// own-scoped key is NEVER sufficient by itself: it must be met by a predicate over
+// the concrete row. Every test below exists to stop that collapsing back into an
+// unconditional grant — the `.own` → `.any` degradation the axis was built to
+// prevent.
+//
+// DB-free and route-free by construction (the goal-route-authz.js /
+// shouldRefuseSessionClaim precedent), so every branch is pinned directly rather
+// than only through a live HTTP path.
+//
+// Run:  node --test tests/abandon_creator_authz.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const authz = require('../modules/lifecycle/abandon-authz.js');
+const {
+  abandonVerdict, mayAttemptAbandon, strictSameOwner,
+  CREATOR_ABANDONABLE, ABANDON_ANY_KEY, ABANDON_OWN_KEY,
+} = authz;
+
+const { test, summary } = makeRunner();
+
+const ME = 7;
+const SOMEONE_ELSE = 8;
+
+// ── the cross-owner branch ───────────────────────────────────────────────────
+await test('holding task.abandon admits on ANY task, whoever created it', async () => {
+  const out = abandonVerdict({ holdsAny: true, builderId: ME, createdBy: SOMEONE_ELSE, status: 'ready' });
+  assert.equal(out.ok, true);
+  assert.equal(out.via, ABANDON_ANY_KEY, 'reports WHICH authority admitted');
+});
+
+await test('task.abandon is NOT narrowed by the creator status window', async () => {
+  // A Metic+ keeps exactly the power ADR 0152 gave them. The creator window is an
+  // ADDITION for sub-metic authors, never a new ceiling on triage authority — if
+  // this ever fails, the widening has silently become a restriction.
+  for (const status of ['completed', 'confirmed', 'active', 'backlog']) {
+    const out = abandonVerdict({ holdsAny: true, builderId: ME, createdBy: SOMEONE_ELSE, status });
+    assert.equal(out.ok, true, `task.abandon must still admit on '${status}'`);
+  }
+});
+
+// ── holding nothing ──────────────────────────────────────────────────────────
+await test('holding neither key is refused, even on your own ready task', async () => {
+  const out = abandonVerdict({ holdsAny: false, holdsOwn: false, builderId: ME, createdBy: ME, status: 'ready' });
+  assert.equal(out.ok, false);
+  assert.equal(out.reason, 'missing_permission');
+  assert.match(out.message, /task\.abandon/, 'the denial names the atom it wants');
+});
+
+await test('the default verdict denies — an empty call is never an admit', async () => {
+  assert.equal(abandonVerdict().ok, false, 'fail-closed with no arguments at all');
+  assert.equal(abandonVerdict({}).ok, false, 'fail-closed with an empty options object');
+});
+
+// ── the ownership branch: the key alone is NOT enough ────────────────────────
+await test('task.abandon.own alone does NOT admit on someone else\'s task', async () => {
+  const out = abandonVerdict({ holdsOwn: true, builderId: ME, createdBy: SOMEONE_ELSE, status: 'ready' });
+  assert.equal(out.ok, false, 'an own-scoped key must never reach another owner\'s row');
+  assert.equal(out.reason, 'not_task_creator');
+});
+
+await test('an UNATTRIBUTED task (created_by null) belongs to nobody', async () => {
+  // Every task filed before core_227, plus the seed / restock / discord-bug system
+  // vectors. If null ever matched, one own-scoped grant would open ~1,357 historical
+  // tasks to any builder at once — the single widest failure mode here.
+  const out = abandonVerdict({ holdsOwn: true, builderId: ME, createdBy: null, status: 'ready' });
+  assert.equal(out.ok, false);
+  assert.equal(out.reason, 'not_task_creator');
+});
+
+await test('the creator DOES admit on their own task, in each allowed status', async () => {
+  assert.ok(CREATOR_ABANDONABLE.length > 0, 'a vacuous allow-list would make every case below pass for the wrong reason');
+  for (const status of CREATOR_ABANDONABLE) {
+    const out = abandonVerdict({ holdsOwn: true, builderId: ME, createdBy: ME, status });
+    assert.equal(out.ok, true, `a creator must be able to retire their own '${status}' task`);
+    assert.equal(out.via, ABANDON_OWN_KEY, 'and it must be recorded as the OWN authority, not the any one');
+  }
+});
+
+await test('the creator is refused once the task has moved past planning', async () => {
+  // Past the grader a retire is a correction to the ledger, not an author changing
+  // their mind, so completed/confirmed stay with the cross-owner authority.
+  for (const status of ['active', 'completed', 'confirmed', 'shipped']) {
+    const out = abandonVerdict({ holdsOwn: true, builderId: ME, createdBy: ME, status });
+    assert.equal(out.ok, false, `a creator must NOT retire their own '${status}' task`);
+    assert.equal(out.reason, 'creator_status_not_abandonable');
+    assert.match(out.message, new RegExp(status), 'the denial says which status refused it');
+  }
+});
+
+await test('an unknown or missing status is refused, not admitted', async () => {
+  for (const status of [undefined, null, '', 'READY', 'not-a-status']) {
+    const out = abandonVerdict({ holdsOwn: true, builderId: ME, createdBy: ME, status });
+    assert.equal(out.ok, false, `status ${JSON.stringify(status)} must fail closed`);
+  }
+});
+
+// ── the owner comparison ─────────────────────────────────────────────────────
+await test('owner ids compare across the string/number boundary', async () => {
+  // Postgres hands bigints back as strings; JS code carries them as numbers. If
+  // these stopped matching, every creator would be refused on their own task and
+  // the feature would be silently dead.
+  assert.equal(abandonVerdict({ holdsOwn: true, builderId: 7, createdBy: '7', status: 'ready' }).ok, true);
+  assert.equal(abandonVerdict({ holdsOwn: true, builderId: '7', createdBy: 7, status: 'ready' }).ok, true);
+});
+
+await test('nothing without a real identity matches anything', async () => {
+  // Mirrors the government resolver's ownerIdentity contract EXACTLY, which is the
+  // point — a second, subtly different normalization is how an ownership
+  // comparison quietly widens. Note what is deliberately absent from this list:
+  // any FINITE number is a real identity there (ids arrive as bigints from
+  // Postgres and as numbers in JS), so asserting otherwise here would pin a rule
+  // the two halves do not actually share.
+  for (const v of [null, undefined, '', NaN, Infinity, {}, [], true]) {
+    assert.equal(strictSameOwner(v, v), false, `${String(v)} must not match itself`);
+  }
+  assert.equal(strictSameOwner(7, 7), true, 'a real id still matches itself');
+  assert.equal(strictSameOwner(7, 8), false);
+  assert.equal(strictSameOwner(7, '7'), true, 'and across the bigint/number boundary');
+});
+
+await test('the INJECTED comparator is the one actually used', async () => {
+  // The route injects the government resolver's own normalization so the owner
+  // comparison exists in exactly one place. A refusing comparator must refuse a
+  // pair the built-in would have admitted — otherwise the injection is decorative
+  // and the two halves can drift apart unnoticed.
+  let saw = null;
+  const refuseAll = (a, b) => { saw = [a, b]; return false; };
+  const out = abandonVerdict({ holdsOwn: true, builderId: ME, createdBy: ME, status: 'ready', sameOwner: refuseAll });
+  assert.equal(out.ok, false, 'the injected comparator must be consulted, not bypassed');
+  assert.equal(out.reason, 'not_task_creator');
+  assert.deepEqual(saw, [ME, ME], 'and it must be handed (createdBy, builderId)');
+});
+
+await test('a non-function comparator falls back to the strict one, never to admit', async () => {
+  for (const bogus of [null, 'yes', 42, {}]) {
+    const out = abandonVerdict({ holdsOwn: true, builderId: ME, createdBy: SOMEONE_ELSE, status: 'ready', sameOwner: bogus });
+    assert.equal(out.ok, false, 'a broken comparator must not open the gate');
+  }
+  const ok = abandonVerdict({ holdsOwn: true, builderId: ME, createdBy: ME, status: 'ready', sameOwner: null });
+  assert.equal(ok.ok, true, 'and the fallback must still admit a genuine creator');
+});
+
+// ── the cheap pre-transaction half ───────────────────────────────────────────
+await test('mayAttemptAbandon opens the transaction for either key, and for neither', async () => {
+  assert.equal(mayAttemptAbandon({ holdsAny: true, holdsOwn: false }), true);
+  assert.equal(mayAttemptAbandon({ holdsAny: false, holdsOwn: true }), true, 'an own-holder must be let as far as the row question');
+  assert.equal(mayAttemptAbandon({ holdsAny: false, holdsOwn: false }), false);
+  assert.equal(mayAttemptAbandon({}), false, 'fail-closed on an empty call');
+  assert.equal(mayAttemptAbandon(), false);
+});
+
+await test('only a strict true counts as holding a key', async () => {
+  // Guards a caller that hands in a truthy non-boolean (a permission array, a
+  // string) and would otherwise be read as a grant.
+  for (const truthy of ['task.abandon', 1, ['task.abandon'], {}]) {
+    assert.equal(mayAttemptAbandon({ holdsAny: truthy }), false, `${JSON.stringify(truthy)} must not read as a grant`);
+    assert.equal(abandonVerdict({ holdsAny: truthy, builderId: ME, createdBy: SOMEONE_ELSE, status: 'ready' }).ok, false);
+  }
+});
+
+summary();