@bongos/core 1.19.813 → 1.19.815

package/modules/lifecycle/routes/abandon-handler.js

@@ -0,0 +1,151 @@
+// modules/lifecycle/routes/abandon-handler.js — the HTTP half of
+// POST /tasks/:id/abandon: resolve the caller's authority, compose it with the
+// row-scoped decision, and map every refusal to its status code.
+//
+// WHY IT IS ITS OWN FILE. Two reasons, and the second is the real one:
+//
+//   1. tasks.js sits against the 1,500-line ratchet, and this handler grew when
+//      the route gained a second authority (task 1002443 / ADR 0297) — the same
+//      pressure that carved goal-route-authz.js out of goals.js.
+//   2. COMPOSITION is where this route can go wrong, and composition was the one
+//      layer no test could reach. `abandon-authz.js` pins the decision and
+//      `abandonTask` pins the transaction seam, both in isolation; a mistake in
+//      how the route wires them together — mapping a refusal to the wrong code,
+//      admitting when the government port is absent, reporting a denial that
+//      names the wrong atom — would have passed both. A plain exported function
+//      taking `{ req, res, deps }` is callable from a test with fakes, so that
+//      layer is now pinned too (tests/abandon_route.mjs).
+//
+// Everything it needs is INJECTED rather than imported: the router hands in its
+// own `db`, `governance` port, logger and validators. That is what makes the
+// handler testable without a live Express app or a DB, and it keeps the module
+// boundary intact — this file requires no core internal.
+
+'use strict';
+
+const abandonAuthz = require('../abandon-authz');
+
+// The atoms a denial should name. Both are a genuine way in, so a 403 that listed
+// only the metic-floor key would send a creator after the wrong permission.
+function requiredAtoms(governance) {
+  // The cross-owner escalation path is a DECLARED property of the own-scoped key
+  // (task 1003195), read from the catalog rather than hardcoded, so a change to
+  // that declaration reaches this route instead of silently disagreeing with it.
+  // Falls back to the named atom only when the port cannot answer — a catalog that
+  // has moved on must never be able to WIDEN this gate.
+  const declared = (governance && typeof governance.crossOwnerKeysFor === 'function')
+    ? governance.crossOwnerKeysFor(abandonAuthz.ABANDON_OWN_KEY)
+    : null;
+  const crossOwner = (Array.isArray(declared) && declared.length > 0)
+    ? declared
+    : [abandonAuthz.ABANDON_ANY_KEY];
+  return { crossOwner, required: [...crossOwner, abandonAuthz.ABANDON_OWN_KEY] };
+}
+
+// Floors resolve through the port at deny time, never hardcoded prose — a floor
+// that moves would otherwise leave a lie in the denial.
+function floorsFor(governance, keys) {
+  const out = {};
+  if (!governance || typeof governance.permissionFloor !== 'function') return out;
+  for (const k of keys) {
+    try {
+      const f = governance.permissionFloor(k);
+      if (f) out[k] = f;
+    } catch (_) { /* unknown atom — omit rather than guess */ }
+  }
+  return out;
+}
+
+// deps: { db, seams, log, validateOrRespond, parseId }
+function makeAbandonHandler(deps) {
+  const { db, seams, log, validateOrRespond, parseId } = deps;
+
+  return async function abandonHandler(req, res) {
+    if (validateOrRespond(req, res, {
+      reason: { type: 'string' },  // free-text retire reason (sliced to 2000 below)
+    })) return;
+    const id = parseId(req, res, { code: 'bad_task_id', positiveInt: true });
+    if (id === null) return;
+    const reason = typeof req.body?.reason === 'string' ? req.body.reason.slice(0, 2000) : '';
+
+    // FAIL-CLOSED on a missing government port, exactly as auth.requirePermission
+    // does: `government` is a core-domain, default:true module, so its absence means
+    // authority cannot be ESTABLISHED — and admitting there would make disabling a
+    // module a privilege escalation, the inversion ADR 0016 exists to prevent.
+    const governance = seams.resolveOptional('government');
+    const { crossOwner, required } = requiredAtoms(governance);
+    const denyUnestablished = () => res.fail('permission_forbidden', {
+      status: 403,
+      message: 'authority could not be established — denied fail-closed (ADR 0016); this route requires '
+        + `${crossOwner.join(', ')}, or ${abandonAuthz.ABANDON_OWN_KEY} on a task you created`,
+      details: { required, held: null, floors: null },
+    });
+    if (!governance || typeof governance.resolveBuilderPermissions !== 'function'
+        || typeof governance.sameOwner !== 'function') {
+      return denyUnestablished();
+    }
+    let held;
+    try {
+      held = new Set(await governance.resolveBuilderPermissions(req.builder.id));
+    } catch (permErr) {
+      log.error('[gds] POST /tasks/:id/abandon — permission resolve', permErr);
+      return denyUnestablished();
+    }
+
+    const holdsAny = crossOwner.some((k) => held.has(k));
+    // Necessary but NEVER sufficient: holding the own-scoped key is permission to be
+    // ASKED the ownership question, answered against the locked row below.
+    const holdsOwn = held.has(abandonAuthz.ABANDON_OWN_KEY);
+    const denyPermission = (message, reasonCode) => res.fail('permission_forbidden', {
+      status: 403,
+      message,
+      details: {
+        required,
+        held: required.filter((k) => held.has(k)),
+        floors: floorsFor(governance, required),
+        ...(reasonCode ? { reason: reasonCode } : {}),
+      },
+    });
+
+    // The cheap half — refuse without opening a transaction at all.
+    if (!abandonAuthz.mayAttemptAbandon({ holdsAny, holdsOwn })) {
+      return denyPermission(abandonAuthz.abandonVerdict({ holdsAny, holdsOwn }).message, null);
+    }
+
+    try {
+      const result = await db.abandonTask({
+        taskId: id,
+        reason,
+        // PURE and DB-free — closes over the grants resolved above and is handed the
+        // row under abandonTask's own lock. See that function's header, and
+        // abandon-authz.js for the decision itself.
+        authorize: ({ createdBy, status }) => abandonAuthz.abandonVerdict({
+          holdsAny,
+          holdsOwn,
+          builderId: req.builder.id,
+          createdBy,
+          status,
+          // The government resolver's own id normalization — never re-implemented
+          // here, because a duplicated owner comparison is how one quietly widens.
+          sameOwner: governance.sameOwner,
+        }),
+      });
+      res.json({ ok: true, ...result });
+    } catch (err) {
+      if (err.code === 'ABANDON_FORBIDDEN') {
+        return denyPermission(err.message, err.reason || null);
+      }
+      if (err.code === 'TASK_NOT_FOUND') return res.fail('task_not_found', 404);
+      if (err.code === 'CANNOT_ABANDON_SHIPPED') {
+        return res.fail('cannot_abandon_shipped', { status: 409, message: 'shipped tasks are immutable history' });
+      }
+      if (err.code === 'TASK_HAS_ACTIVE_CLAIM') {
+        return res.fail('task_has_active_claim', { status: 409, message: 'release the active claim before abandoning' });
+      }
+      log.error('[gds] POST /tasks/:id/abandon', err);
+      res.fail('abandon_failed', { status: 500, message: 'internal error' });
+    }
+  };
+}
+
+module.exports = { makeAbandonHandler, requiredAtoms, floorsFor };

package/modules/lifecycle/routes/lifecycle.js

@@ -44,12 +44,30 @@ const cascade = require('../cascade');
 // leave it. Nothing here can affect the ship: the emitters fire post-commit and
 // already wrap the emit, and `runCascadesForShip` resolves rather than throws.
 let _cascadeListenerOff = null;
+let _ideaCascadeListenerOff = null;
 
 function registerSeams() {
   if (!api.hasProvider('lifecycle')) {
     api.registerProvider('lifecycle', lifecycle);
   }
   if (_cascadeListenerOff) _cascadeListenerOff();
+  // Torn down with its sibling: the factory runs again every time a test rebuilds
+  // the router, and a leaked subscription would fire this cascade twice.
+  if (_ideaCascadeListenerOff) _ideaCascadeListenerOff();
+  // task 1003856: the second cross-role cascade. Same module, same runner
+  // guarantees, different trigger — an idea reaching Full rather than a ship.
+  _ideaCascadeListenerOff = api.on('idea.graded.full', (graded) => cascade.runCascadesForIdea(graded, {
+    // No getIdea: the ideas module owns that row and sends it whole. Injecting a
+    // reader here would mean lifecycle querying another module's table.
+    findTaskBySourceRef: (q) => db.findTaskBySourceRef(q),
+    createTask: (spec) => db.createTask(spec),
+    // INVOKED, like its sibling below. api.logger is a FACTORY (api.logger(ns)),
+    // so passing it bare left every log?.info?.() call resolving to undefined and
+    // silently doing nothing — the optional chaining that makes the runner safe is
+    // also what hid this.
+    log: api.logger ? api.logger('lifecycle') : null,
+  }));
+
   _cascadeListenerOff = api.on('task.shipped', (shipped) => cascade.runCascadesForShip(shipped, {
     getTask: (id) => db.getTask(id),
     findTaskBySourceRef: (ref) => db.findTaskBySourceRef(ref),

package/modules/lifecycle/routes/tasks.js

@@ -32,6 +32,13 @@ const hierarchy = require('../hierarchy');
 const { suggestCriteria } = require('../criterion-suggest');
 // The orphan-task advisory (task 1002539) — pure, fail-open; see goal-advisory.js.
 const { buildGoalAdvisory } = require('../goal-advisory');
+// The PURE abandon decision (task 1002443, ADR 0297) — rank fact + row fact, kept
+// out of this router so every branch is unit-tested without a live route.
+const abandonAuthz = require('../abandon-authz');
+// The abandon route's HTTP half, carved out so its COMPOSITION (authority resolve
+// + the row-scoped decision + refusal mapping) is directly testable — the one
+// layer neither the pure decision nor the db seam could reach.
+const { makeAbandonHandler } = require('./abandon-handler');
 // grading carved to modules/grading/ (BV1.R73 / ADR 0091 §4): the lifecycle no
 // longer imports the grader — it resolves the `grade` kernel PORT at grade time
 // (seams.resolveOptional('grade'), in POST /tasks/:id/grade below).
@@ -668,45 +675,26 @@ module.exports = function buildTasksRouter() {
   // on a task with an active claim (release it first); idempotent on an already-
   // abandoned task. The abandon + its `reason` land in audit_log via the writing
   // middleware, so the ledger keeps a record of who retired what.
-  // rank: metic+archon — scope removal; the inverse of /promote, and re-ranked to
-  // match it (ADR 0152, was archon under ADR 0090). A Metic who may author, shape,
-  // and promote work may also retire it: leaving the kill switch an Archon rung
-  // higher than the create switch only forced the owner to clean up after the
-  // triage they already delegated. Not one-way any more — /promote restores an
-  // abandoned task to backlog at the same rank — and the guards below (shipped
-  // refused, active claim refused) plus the audit_log entry are unchanged.
-  router.post('/tasks/:id/abandon', auth.requireBuilder, auth.requirePermission('task.abandon'), async (req, res) => {
-    if (validateOrRespond(req, res, {
-      reason: { type: 'string' },  // free-text retire reason (sliced to 2000 below)
-    })) return;
-    const id = parseId(req, res, { code: 'bad_task_id', positiveInt: true });
-    if (id === null) return;
-    const reason = typeof req.body?.reason === 'string' ? req.body.reason.slice(0, 2000) : '';
-    try {
-      const result = await db.abandonTask({ taskId: id, reason });
-      res.json({ ok: true, ...result });
-    } catch (err) {
-      if (err.code === 'TASK_NOT_FOUND') return res.fail('task_not_found', 404);
-      if (err.code === 'CANNOT_ABANDON_SHIPPED') {
-        return res.fail('cannot_abandon_shipped', { status: 409, message: 'shipped tasks are immutable history' });
-      }
-      if (err.code === 'TASK_HAS_ACTIVE_CLAIM') {
-        return res.fail('task_has_active_claim', { status: 409, message: 'release the active claim before abandoning' });
-      }
-      log.error('[gds] POST /tasks/:id/abandon', err);
-      res.fail('abandon_failed', { status: 500, message: 'internal error' });
-    }
-  });
+  // rank: any-builder — DELIBERATELY, and the middleware list is not the whole gate
+  // (ADR 0297). Two authorities reach this transition: `task.abandon` (floor metic)
+  // retires ANY task, and `task.abandon.own` (floor xenos) retires one you CREATED
+  // while it is still backlog/ready/blocked. The second is a predicate over
+  // tasks.created_by, which no rank floor can express — the ADR 0151 ownership axis,
+  // and this is its first route. requirePermission structurally cannot carry it: an
+  // own-scoped key has no unconditional answer and that gate refuses one outright
+  // (auth.js, R100), so `.own` can never collapse into `.any`.
+  //
+  // The two facts are resolved in two places ON PURPOSE. The RANK fact is
+  // request-scoped and resolves here, once, uncached (ADR 0016); the OWNER fact is a
+  // column that can change under us, so it is evaluated inside abandonTask's FOR
+  // UPDATE transaction. Reading created_by here would be a TOCTOU window; resolving
+  // permissions in there would hold a row lock across a second pool acquire.
+  //
+  // Existing guards (shipped refused, active claim refused, idempotent re-abandon)
+  // and the audit_log entry are unchanged on both paths.
+  router.post('/tasks/:id/abandon', auth.requireBuilder,
+    makeAbandonHandler({ db, seams, log, validateOrRespond, parseId }));
 
-  // POST /tasks/:id/merge — mark a duplicate task merged into its canonical one
-  // (task 1001478 — the /bug-triage counterpart to idea_inbox's merge verdict).
-  // Implemented as `abandonTask` plus a target (db.mergeTask, db-ship.js) rather
-  // than a new `tasks.status` value — see that function's header for why. Refuses
-  // a self-merge, a shipped task, a task with an active claim, a target that
-  // doesn't exist, and a target that is itself merged elsewhere (no chains);
-  // idempotent when re-merging into the SAME target already recorded.
-  // rank: metic+archon — same floor as task.abandon, which this reuses under the
-  // hood; a Metic who may retire a task may also say which task it duplicates.
   router.post('/tasks/:id/merge', auth.requireBuilder, auth.requirePermission('task.merge'), async (req, res) => {
     if (validateOrRespond(req, res, {
       into_task_id: { required: true, type: 'integer', min: 1 },

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.813",
+  "version": "1.19.815",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.813",
+      "version": "1.19.815",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.813",
+  "version": "1.19.815",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/route-rank-check.js

@@ -311,7 +311,18 @@ const MODULE_EXPECTED_RANKS = {
     // it; /promote carries the abandoned→backlog undo at the same rank.
     'POST /tasks': 'metic+archon',
     'POST /tasks/:id/promote': 'metic+archon',
-    'POST /tasks/:id/abandon': 'metic+archon',
+    // task 1002443 — DELIBERATELY 'any-builder', widened from 'metic+archon'. Two
+    // authorities reach this route and only one is rank-shaped: `task.abandon`
+    // (floor metic) retires ANY task, and `task.abandon.own` (floor xenos) retires
+    // one you CREATED while it is still backlog/ready/blocked. The second is the
+    // ADR 0151 ownership axis, which requirePermission structurally cannot gate (an
+    // own-scoped key has no unconditional answer), so the wall is requireBuilder +
+    // an in-handler authorizeOwnedOrAny — the POST /goals/:id/members shape.
+    //
+    // Pinning it here keeps catching the accidental TIGHTENING back to a rank floor,
+    // which would lock creators out of retiring their own work and silently revert
+    // the owner's 2026-07-25 request, as loudly as it catches a gate removal.
+    'POST /tasks/:id/abandon': 'any-builder',
     // override-request adjudication (lands credit + ship attribution).
     // ADR 0157: `override_request.decide` lowered archon→metic; pinned by atom.
     'GET /override-requests': 'perm:override_request.decide',

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.813'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.815'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/abandon_creator_authz.mjs

@@ -0,0 +1,176 @@
+// tests/abandon_creator_authz.mjs
+//
+// Regression guard for task 1002443 / ADR 0297 — the PURE abandon decision in
+// modules/lifecycle/abandon-authz.js.
+//
+// WHAT IS BEING PROTECTED. POST /tasks/:id/abandon went from one rank-shaped
+// authority to two, only one of which a rank can express:
+//   • task.abandon     (floor metic) — retire ANY task.
+//   • task.abandon.own (floor xenos) — retire a task you CREATED, and only while
+//     it is still backlog/ready/blocked.
+// The second is the ADR 0151 ownership axis. Its whole safety property is that an
+// own-scoped key is NEVER sufficient by itself: it must be met by a predicate over
+// the concrete row. Every test below exists to stop that collapsing back into an
+// unconditional grant — the `.own` → `.any` degradation the axis was built to
+// prevent.
+//
+// DB-free and route-free by construction (the goal-route-authz.js /
+// shouldRefuseSessionClaim precedent), so every branch is pinned directly rather
+// than only through a live HTTP path.
+//
+// Run:  node --test tests/abandon_creator_authz.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const authz = require('../modules/lifecycle/abandon-authz.js');
+const {
+  abandonVerdict, mayAttemptAbandon, strictSameOwner,
+  CREATOR_ABANDONABLE, ABANDON_ANY_KEY, ABANDON_OWN_KEY,
+} = authz;
+
+const { test, summary } = makeRunner();
+
+const ME = 7;
+const SOMEONE_ELSE = 8;
+
+// ── the cross-owner branch ───────────────────────────────────────────────────
+await test('holding task.abandon admits on ANY task, whoever created it', async () => {
+  const out = abandonVerdict({ holdsAny: true, builderId: ME, createdBy: SOMEONE_ELSE, status: 'ready' });
+  assert.equal(out.ok, true);
+  assert.equal(out.via, ABANDON_ANY_KEY, 'reports WHICH authority admitted');
+});
+
+await test('task.abandon is NOT narrowed by the creator status window', async () => {
+  // A Metic+ keeps exactly the power ADR 0152 gave them. The creator window is an
+  // ADDITION for sub-metic authors, never a new ceiling on triage authority — if
+  // this ever fails, the widening has silently become a restriction.
+  for (const status of ['completed', 'confirmed', 'active', 'backlog']) {
+    const out = abandonVerdict({ holdsAny: true, builderId: ME, createdBy: SOMEONE_ELSE, status });
+    assert.equal(out.ok, true, `task.abandon must still admit on '${status}'`);
+  }
+});
+
+// ── holding nothing ──────────────────────────────────────────────────────────
+await test('holding neither key is refused, even on your own ready task', async () => {
+  const out = abandonVerdict({ holdsAny: false, holdsOwn: false, builderId: ME, createdBy: ME, status: 'ready' });
+  assert.equal(out.ok, false);
+  assert.equal(out.reason, 'missing_permission');
+  assert.match(out.message, /task\.abandon/, 'the denial names the atom it wants');
+});
+
+await test('the default verdict denies — an empty call is never an admit', async () => {
+  assert.equal(abandonVerdict().ok, false, 'fail-closed with no arguments at all');
+  assert.equal(abandonVerdict({}).ok, false, 'fail-closed with an empty options object');
+});
+
+// ── the ownership branch: the key alone is NOT enough ────────────────────────
+await test('task.abandon.own alone does NOT admit on someone else\'s task', async () => {
+  const out = abandonVerdict({ holdsOwn: true, builderId: ME, createdBy: SOMEONE_ELSE, status: 'ready' });
+  assert.equal(out.ok, false, 'an own-scoped key must never reach another owner\'s row');
+  assert.equal(out.reason, 'not_task_creator');
+});
+
+await test('an UNATTRIBUTED task (created_by null) belongs to nobody', async () => {
+  // Every task filed before core_227, plus the seed / restock / discord-bug system
+  // vectors. If null ever matched, one own-scoped grant would open ~1,357 historical
+  // tasks to any builder at once — the single widest failure mode here.
+  const out = abandonVerdict({ holdsOwn: true, builderId: ME, createdBy: null, status: 'ready' });
+  assert.equal(out.ok, false);
+  assert.equal(out.reason, 'not_task_creator');
+});
+
+await test('the creator DOES admit on their own task, in each allowed status', async () => {
+  assert.ok(CREATOR_ABANDONABLE.length > 0, 'a vacuous allow-list would make every case below pass for the wrong reason');
+  for (const status of CREATOR_ABANDONABLE) {
+    const out = abandonVerdict({ holdsOwn: true, builderId: ME, createdBy: ME, status });
+    assert.equal(out.ok, true, `a creator must be able to retire their own '${status}' task`);
+    assert.equal(out.via, ABANDON_OWN_KEY, 'and it must be recorded as the OWN authority, not the any one');
+  }
+});
+
+await test('the creator is refused once the task has moved past planning', async () => {
+  // Past the grader a retire is a correction to the ledger, not an author changing
+  // their mind, so completed/confirmed stay with the cross-owner authority.
+  for (const status of ['active', 'completed', 'confirmed', 'shipped']) {
+    const out = abandonVerdict({ holdsOwn: true, builderId: ME, createdBy: ME, status });
+    assert.equal(out.ok, false, `a creator must NOT retire their own '${status}' task`);
+    assert.equal(out.reason, 'creator_status_not_abandonable');
+    assert.match(out.message, new RegExp(status), 'the denial says which status refused it');
+  }
+});
+
+await test('an unknown or missing status is refused, not admitted', async () => {
+  for (const status of [undefined, null, '', 'READY', 'not-a-status']) {
+    const out = abandonVerdict({ holdsOwn: true, builderId: ME, createdBy: ME, status });
+    assert.equal(out.ok, false, `status ${JSON.stringify(status)} must fail closed`);
+  }
+});
+
+// ── the owner comparison ─────────────────────────────────────────────────────
+await test('owner ids compare across the string/number boundary', async () => {
+  // Postgres hands bigints back as strings; JS code carries them as numbers. If
+  // these stopped matching, every creator would be refused on their own task and
+  // the feature would be silently dead.
+  assert.equal(abandonVerdict({ holdsOwn: true, builderId: 7, createdBy: '7', status: 'ready' }).ok, true);
+  assert.equal(abandonVerdict({ holdsOwn: true, builderId: '7', createdBy: 7, status: 'ready' }).ok, true);
+});
+
+await test('nothing without a real identity matches anything', async () => {
+  // Mirrors the government resolver's ownerIdentity contract EXACTLY, which is the
+  // point — a second, subtly different normalization is how an ownership
+  // comparison quietly widens. Note what is deliberately absent from this list:
+  // any FINITE number is a real identity there (ids arrive as bigints from
+  // Postgres and as numbers in JS), so asserting otherwise here would pin a rule
+  // the two halves do not actually share.
+  for (const v of [null, undefined, '', NaN, Infinity, {}, [], true]) {
+    assert.equal(strictSameOwner(v, v), false, `${String(v)} must not match itself`);
+  }
+  assert.equal(strictSameOwner(7, 7), true, 'a real id still matches itself');
+  assert.equal(strictSameOwner(7, 8), false);
+  assert.equal(strictSameOwner(7, '7'), true, 'and across the bigint/number boundary');
+});
+
+await test('the INJECTED comparator is the one actually used', async () => {
+  // The route injects the government resolver's own normalization so the owner
+  // comparison exists in exactly one place. A refusing comparator must refuse a
+  // pair the built-in would have admitted — otherwise the injection is decorative
+  // and the two halves can drift apart unnoticed.
+  let saw = null;
+  const refuseAll = (a, b) => { saw = [a, b]; return false; };
+  const out = abandonVerdict({ holdsOwn: true, builderId: ME, createdBy: ME, status: 'ready', sameOwner: refuseAll });
+  assert.equal(out.ok, false, 'the injected comparator must be consulted, not bypassed');
+  assert.equal(out.reason, 'not_task_creator');
+  assert.deepEqual(saw, [ME, ME], 'and it must be handed (createdBy, builderId)');
+});
+
+await test('a non-function comparator falls back to the strict one, never to admit', async () => {
+  for (const bogus of [null, 'yes', 42, {}]) {
+    const out = abandonVerdict({ holdsOwn: true, builderId: ME, createdBy: SOMEONE_ELSE, status: 'ready', sameOwner: bogus });
+    assert.equal(out.ok, false, 'a broken comparator must not open the gate');
+  }
+  const ok = abandonVerdict({ holdsOwn: true, builderId: ME, createdBy: ME, status: 'ready', sameOwner: null });
+  assert.equal(ok.ok, true, 'and the fallback must still admit a genuine creator');
+});
+
+// ── the cheap pre-transaction half ───────────────────────────────────────────
+await test('mayAttemptAbandon opens the transaction for either key, and for neither', async () => {
+  assert.equal(mayAttemptAbandon({ holdsAny: true, holdsOwn: false }), true);
+  assert.equal(mayAttemptAbandon({ holdsAny: false, holdsOwn: true }), true, 'an own-holder must be let as far as the row question');
+  assert.equal(mayAttemptAbandon({ holdsAny: false, holdsOwn: false }), false);
+  assert.equal(mayAttemptAbandon({}), false, 'fail-closed on an empty call');
+  assert.equal(mayAttemptAbandon(), false);
+});
+
+await test('only a strict true counts as holding a key', async () => {
+  // Guards a caller that hands in a truthy non-boolean (a permission array, a
+  // string) and would otherwise be read as a grant.
+  for (const truthy of ['task.abandon', 1, ['task.abandon'], {}]) {
+    assert.equal(mayAttemptAbandon({ holdsAny: truthy }), false, `${JSON.stringify(truthy)} must not read as a grant`);
+    assert.equal(abandonVerdict({ holdsAny: truthy, builderId: ME, createdBy: SOMEONE_ELSE, status: 'ready' }).ok, false);
+  }
+});
+
+summary();