@bongos/core 1.19.831 → 1.19.832

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.831",
-  "core_contract": "1.19.831",
-  "source_commit": "30cc1cbe10b2f1a3d1cb907ee320d18c78e23eb0",
+  "core_version": "1.19.832",
+  "core_contract": "1.19.832",
+  "source_commit": "c8e1d760c29ed41a5d66af6b1c4f9936a7fd0f32",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T15:15:18.923Z",
+  "built_at": "2026-09-17T15:29:22.894Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 491,
+    "docs_redacted": 492,
     "agent_docs_stubbed": 26,
     "functional_verbatim": 2244,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2761,
-  "tree_sha256": "484014065f907c382c6fdbaadc2ae5bc3ff3af2f1b79a02119f7acf9d3ccd2fc",
+  "file_count": 2762,
+  "tree_sha256": "0795b0e4670053ed5c638dac4719252988b0dbfd0d863dafef3df5b466a11f45",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1984,10 +1984,15 @@
       "mode": "0000644",
       "sha256": "f52bf2568d02d5cf8589dc394dc76cbf0ea3a7ba193275f300e320c2ab64a51c"
     },
+    {
+      "path": "docs/adr/0300-a-missing-protected-surface-registry-is-a-broken-install.md",
+      "mode": "0000644",
+      "sha256": "7c5d4c49dc98d37a8a41aa0cddd158c3a46a60cdb4e79b018d68c6b5222b7e79"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "0b4e0cd78a8bd6ae3d41c0d010634dfdc29ecd4dca1f8b49127791d1b4cd7450"
+      "sha256": "8af8b8c5ea9b368bb790280eadd167b99ed9f864350e101ba18a4b0ec8f5ed5e"
     },
     {
       "path": "docs/api-reference.md",
@@ -2552,7 +2557,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "eb4a8912413adbed5f2677ea334c86aeaac50dab4acc03e618dcff866286d505"
+      "sha256": "02d7156a9ee2a022e71835b03c120059c44b36cf9358085bf2c2d1fb91a72bd4"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7837,12 +7842,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9ef226bf93c85c85d63babd32469fb3a3f4a69fdf2dc94f57d80c3b54b3e9c0d"
+      "sha256": "f833d910fdbed07c2c2a6a1597d5d6315780e4633c6015bde77629b7682f8c8d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "3a966e21858e712dbb9e8bedc875e4bc92095f1c4489b471221e51b42d701aed"
+      "sha256": "6fd9cd7067b463895344e6de0710ce6eda471f96d659161c56f9ce3cc9c0edb1"
     },
     {
       "path": "public-docs/index.html",
@@ -9592,7 +9597,7 @@
     {
       "path": "src/bongos/permission-path-check.js",
       "mode": "0000644",
-      "sha256": "14ba2ffb603cbea7d8388c196b74f8e7db92b777fb0da7c69c7d3c7c9e27f386"
+      "sha256": "75264cfa68b2a8344c38565d96d16c28e101d286ad0b5794baa83ab774269d74"
     },
     {
       "path": "src/bongos/platform-visibility-gate.js",
@@ -9762,7 +9767,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0e198cb1212d9a60178cb27ffed61166f60e097d3bed2afb564c9960b10c81e7"
+      "sha256": "8e0d57c0e24d78b95565b3c81fdae6ca50647ad6f84ea337eed213109594056e"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11377,7 +11382,7 @@
     {
       "path": "tests/government_protected_surfaces.mjs",
       "mode": "0000644",
-      "sha256": "4478853e79266130c2ad3ab7a523f0f20fb98a97e88f1dd2476ef09db6b96dcc"
+      "sha256": "1d8502e8d25eedb54ed0fcbe3ce1a0fe87495d03bd8bda7322e55d6004669a63"
     },
     {
       "path": "tests/government_rank_sync.mjs",

package/docs/adr/0300-a-missing-protected-surface-registry-is-a-broken-install.md

@@ -0,0 +1,109 @@
+# ADR 0300 — A missing protected-surface registry is a broken install, not a module opt-out
+
+**Status:** accepted · **Date:** 2026-09-17 · **Task:** [task 1003662](https://cloudbongos.com/builders#/task/1003662) (goal 1000091 — BONGOS-V2)
+
+**Related:** [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) (the protected-surface boundary this registry enforces) · [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (core never depends on a module's behavior) · [ADR 0108](0108-instance-composition-configurable-root.md) §1 (the core is consumed as a versioned npm package, and `modules/` ships inside it)
+
+## Context
+
+[task 1003662](https://cloudbongos.com/builders#/task/1003662) was filed as a bug with a
+concrete remedy attached:
+
+> `require('./module-scope-map')` throws on any checkout where
+> `modules/government/protected-surfaces.json` is absent … This breaks any checkout that has
+> disabled or not yet materialized the government module … Make `module-scope-map.js` degrade
+> gracefully (empty protected set + a loud warning) when the government module isn't present,
+> matching the `resolveOptional` pattern used elsewhere for optional module capabilities.
+
+The throw is real and reproduces exactly as described. Moving the registry aside and requiring
+the kernel file gives:
+
+```
+protected-surface registry unreadable at <root>/modules/government/protected-surfaces.json:
+ENOENT: no such file or directory. Refusing to run with an empty protected set (ADR 0043).
+```
+
+Everything after that first sentence is wrong, in four separate ways — and the remedy it
+proposes would disable the ADR 0043 boundary on exactly the installs least able to notice.
+
+**1. The throw is not in the file the task names.** `module-scope-map.js` contains no `throw`
+and no file read. It does `require('./permission-path-check')` at line 39, and
+`permission-path-check.js`'s `loadRegistry()` throws at module scope. Any "fix" applied to the
+file in the title would be applied to the wrong file; the behavior is owned by its sibling.
+
+**2. The throw is a written contract, not an oversight.** `permission-path-check.js` states it
+in its own header, in capitals, above the code:
+
+> FAIL-CLOSED: a missing/empty/malformed registry THROWS. It never degrades to "nothing is
+> protected" — an unreadable registry is a broken install, not an opted-out module.
+
+The remedy asks for the one behavior the header names and refuses. That header also pre-answers
+the architectural worry the title gestures at (a kernel file reaching into `modules/`): the read
+is `fs`, never `require`, because ADR 0083's one-way rule forbids core from requiring a module's
+*code* — and this is not code, it is a static declarative data file. The sibling trust primitive
+`route-rank-check.js` reads `modules/*/routes/*.js` off disk the same way. Code still flows one
+way; nothing in core requires the module.
+
+**3. Disabling the government module cannot produce the ENOENT.** Module enablement is a
+runtime flag, not a file deletion — disabling a module leaves its files on disk untouched. The
+registry read never consults enablement, deliberately: per the same header, a module's
+enable/disable state must never be something the kernel depends on. So the "disabled" half of
+the premise describes a state that cannot occur.
+
+**4. The "not yet materialized" half does not occur either, because the file ships with the
+core.** `package.json` declares no `files[]` allowlist, so the whole directory ships.
+`npm pack --dry-run` on this commit puts `modules/government/protected-surfaces.json` in the
+tarball at 13,274 bytes, one of 3,419 files. Per [ADR 0108](0108-instance-composition-configurable-root.md)
+§1 the core is consumed as a versioned npm dependency and `resolveCoreRoot()` resolves the core
+package's own `modules/` inside `node_modules`. You cannot have `@bongos/core` without this
+file. If it is absent, the install is damaged — a partial extract, a lossy copy, a `.gitignore`
+that ate a JSON file — and that is a fact worth surfacing loudly, not smoothing over.
+
+**The `resolveOptional` precedent does not transfer.** `resolveOptional` is real and used in
+roughly a dozen places, but it is the module **seam/port resolver**: `api.resolveOptional('grade')`
+lets one module degrade when another module's *runtime capability* is absent, which is exactly
+right for an optional capability. A protected-surface registry is not a capability being
+resolved at a seam. It is the static data the trust boundary is made of, read synchronously from
+disk by enforcers that run where there is no server and no database — a git hook on a laptop, a
+CI job. Borrowing the seam pattern here reads as consistency, but it silently converts "the
+boundary is unreadable" into "there is no boundary".
+
+## Decision
+
+**Fail-closed stays. The registry is not optional, and a missing registry is a broken install.**
+
+Concretely:
+
+1. **No behavior change to `permission-path-check.js` or `module-scope-map.js`.** The throw is
+   correct, its placement is correct, and the header already documents why.
+2. **The task's described remedy is rejected**, on the grounds above — chiefly that an empty
+   protected set is not a degraded mode of a trust boundary, it is the absence of one.
+3. **The error message gains a remediation line.** This is the one genuine defect the report
+   surfaced: the message states the refusal and cites ADR 0043, but never tells the reader what
+   to *do*, which is precisely how a reader concludes the module must be optional and files this
+   task. It now names the likely cause and the fix.
+
+The asymmetry is the whole point. A false "nothing is protected" is silent, permanent, and
+grants authority; a false "this install is broken" is loud, immediate, and grants nothing. Only
+one of those is safe to be wrong about.
+
+## Consequences
+
+**A damaged install fails loudly at require time, and now says what to do about it.** That was
+already true of the first half; the second half is new. The reader who hits this next gets
+pointed at reinstalling the core rather than at weakening the check.
+
+**The report will recur in some form, and that is acceptable.** Anyone meeting this ENOENT
+cold sees a kernel file reaching into `modules/` and reasonably suspects a layering bug. This
+ADR is the durable answer to that suspicion, which is why it exists rather than a won't-fix
+note: the next agent to wonder can be pointed at a number.
+
+**If a legitimate need for a core-only checkout without `modules/` ever appears, this decision
+is the thing to revisit** — and the revisit is "where should the registry live", not "should it
+be optional". Relocating the canonical data into `src/` and having the government module
+contribute to it would preserve fail-closed while removing the cross-directory read. Nothing
+today needs that, and doing it speculatively would move a trust primitive for no gain.
+
+**What this does not decide:** whether other `modules/` reads from core (`route-rank-check.js`
+reading `modules/*/routes/*.js`) should follow the same rule. They share the mechanism and the
+justification, but each is its own trust surface and none is currently in question.

package/docs/adr/README.md

@@ -391,3 +391,4 @@ This keeps the decision history honest and traceable.
 | 0297 | [**A task’s creator may retire it, and that is the ownership axis’s first route** ([task 1002443](https://cloudbongos.com/builders#/task/1002443), goal 1000095 — owner request 2026-07-25: *"the creator of that task should be able to abandon that task directly inside of the UI"*). Attribution itself shipped earlier and elsewhere (`core_227`, [task 1003278](https://cloudbongos.com/builders#/task/1003278)); what had not moved is that **retiring a task was a rank power and nothing else** — `task.abandon` floors at `metic` (ADR 0152), so a sub-Metic builder could file a task and then could not withdraw their own proposal. The model already had the vocabulary and had never used it: ADR 0151 §3 defines an **ownership axis** where a `scope:'own'` key authorizes nothing until a handler supplies the row's owner, R100 made `requirePermission` refuse such a key outright so `.own` can never degrade into `.any`, and it recorded that **zero call sites passed one**. This is that axis’s first real consumer. **Decision: two authorities, only one rank-shaped** — `task.abandon` (metic, any task) OR new `task.abandon.own` (xenos, a task you created, while it is still backlog/ready/blocked). Route becomes `requireBuilder` + an in-handler decision (the `POST /goals/:id/members` shape), pin `metic+archon`→`any-builder` so it now catches an accidental **tightening** as loudly as a gate removal. **The two facts resolve in two places on purpose:** the RANK fact is request-scoped and resolves before the transaction (uncached, ADR 0016); the OWNER fact is a column that can change under us, so `created_by` joins `abandonTask`’s existing `FOR UPDATE` SELECT and a new optional `authorize` callback decides under that lock. Reading `created_by` in the route would be a TOCTOU window; resolving permissions inside the transaction would hold a row lock across a second pool acquire. The decision is a PURE module (`abandon-authz.js`, the `goal-route-authz.js` precedent) so every branch is pinned DB-free and the hall hint and server verdict provably read one rule. **A creator’s window stops at the grader** — completed/confirmed stay cross-owner, because past the grader a retire is a ledger correction, not an author changing their mind; nothing is subtracted from `task.abandon`, pinned by a test. `counterpart: ['task.abandon']` is declared not derived, verb `act` not `manage` — `manage` would silently dominate every future narrower `task.*.own` key (the verb-blind escalation task 1003195 closed). **A null creator belongs to nobody and that is load-bearing:** ~1,357 pre-`core_227` tasks plus seed/restock/discord vectors are unattributed, so the owner comparison is the government resolver’s own — injected, never re-implemented, since a duplicated ownership comparison is how one quietly widens — and one slip would open every historical task to a xenos grant at once. Fail-closed throughout: a missing `government` port, a throwing resolver, and anything but an explicit `{ok:true}` all deny, and `authorize` runs BEFORE the idempotent already-abandoned return and the shipped/active-claim guards so an unauthorized caller cannot probe a row through a 200. No guard removed. Does NOT widen edit/promote/dependency (still Metic), does not touch `task.merge`, and does not backfill attribution — the control simply does not appear on tasks predating `core_227`.](0297-a-tasks-creator-may-retire-it.md) | authority / lifecycle / ownership |
 | 0298 | [**The grader gets a reader lens: advisory, scoped to copy-bearing diffs, and it waits on a written voice** ([task 1003937](https://cloudbongos.com/builders#/task/1003937), goal 1000095 — Working area 6; owner decision 2026-09-17). Every artist review the cascade files opened with *“REVIEW THE GRADER … coach it”*, and it could not be followed: the v4 panel runs narc, quality, hacker and efficiency — completion, code quality, security, runtime cost — and not one of them reads a sentence for whether it is true, clear, in the project’s voice or worth a person’s attention. Four consecutive reviews hit the same wall and all four graded ships deservedly PASSED on the axes that were measured; the gate is not lenient, it is not pointed at this. `grader-prompt.js` already injects the craft’s written responsibility, but only when `discipline === ‘artist’`, so the unjudged case is copy shipped by someone whose craft is not the copy. **Decision: a fifth ADVISORY `reader` worker, on three settled terms.** It runs only where `modules/lifecycle/cascade.js`’s existing `hasCopyOrVisualWork` says the ship is copy-bearing — the same predicate the after-the-fact review uses, so the two can never disagree about coverage, and every other ship costs exactly what it costs today. It records `issues[]` and a `copy_score` and can never verdict `fail` or drag the panel to `concerns`, because [ADR 0241](0241-the-artist-gate-is-a-per-project-deploy-gate-that-reads-a-state.md) put the artist’s judgement on the DEPLOY and off the ship path; gating would need that ADR amended first. And it is NOT BUILT until the instance writes a voice guide — today the whole written standard is one dash rule in `DESIGN.md`, a tagline, a registry of which 1,860 strings exist, and one responsibility sentence, so a lens built now would record taste and call it a finding. Until the reader exists, STEP 1 asks the artist to WRITE DOWN what the grade could not see rather than to coach a lens that is not listening — followable today, and the corpus both the guide and the lens get written from. Nothing in the rubric, the active panel or any existing worker changes.](0298-the-reader-lens-is-advisory-and-waits-on-a-voice-guide.md) | grading / the artist’s loop / voice |
 | 0299 | [**The nod queue stays scoped to routed filings; the backlog walk is the widening** ([task 1003748](https://cloudbongos.com/builders#/task/1003748), goal 1000089). `listRoutedAwaitingNod` filters `origin='route'`, and on 2026-09-08 showed 11 of 232 backlog rows. Re-measured after `/backlog-review` (task 1003746) shipped: 115 backlog rows = 109 dep-gated + 2 spikes (not a person's decision) + 1 stranded + 3 awaiting a nod, all four walked by `/backlog-review`. **Decision: do not widen the card.** The omitted population already has a walkable review with the dependency predicate any widening needed; the copy says *reported* work, so the name is honest; a card slice would be a second copy of the walk's four-bucket partition. Revisit if the un-routed nod bucket outgrows a daily walk (then a count + link, derived from the same partition) or if the walk stops being run.](0299-the-nod-queue-stays-scoped-to-routed-filings.md) | ideas / backlog / attention |
+| 0300 | [**A missing protected-surface registry is a broken install, not a module opt-out** ([task 1003662](https://cloudbongos.com/builders#/task/1003662), goal 1000091). Filed as a bug with a remedy attached: `require('./module-scope-map')` throws when `modules/government/protected-surfaces.json` is absent, so make it degrade to an empty protected set + a warning, matching `resolveOptional`. The throw reproduces, and the rest is wrong four times over. **The throw is not in the named file** — `module-scope-map.js` has no throw and no file read; it requires `permission-path-check.js`, whose `loadRegistry()` throws at module scope. **It is a written contract, not an oversight** — that file's header says FAIL-CLOSED in capitals and already pre-answers the layering worry (the read is `fs`, never `require`, so ADR 0083's one-way rule holds; static data, not code; `route-rank-check.js` reads `modules/*/routes/*.js` the same way). **Disabling the module cannot cause it** — enablement is a runtime flag, never a file deletion, and the read never consults it. **"Not yet materialized" cannot either** — no `files[]` allowlist, so `npm pack --dry-run` puts the 13,274-byte registry in the tarball; per ADR 0108 §1 you cannot have `@bongos/core` without it. The `resolveOptional` precedent does not transfer: that is the module **seam/port** resolver for a missing runtime *capability*, whereas this is the static data the boundary is made of, read where there is no server and no DB (a git hook, a CI job) — borrowing it converts "the boundary is unreadable" into "there is no boundary". **Decision: fail-closed stays, no behavior change, the remedy is rejected — and the one genuine defect is fixed: the message now names the cause and the fix** (reinstall the core; do not empty the set), because stating a refusal without a remedy is exactly how a reader concludes the module is optional and files this task. The asymmetry is the point: a false "nothing is protected" is silent, permanent and grants authority; a false "this install is broken" is loud and grants nothing. Revisit only if a core-only checkout without `modules/` becomes legitimate — and then the question is *where the registry lives*, not whether it is optional.](0300-a-missing-protected-surface-registry-is-a-broken-install.md) | governance / permissions |

package/docs/module-api-changelog.md

@@ -2136,5 +2136,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.829 with no explicit bump. run 35235005422. (task 1002620)
   1.19.831 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.830 with no explicit bump. run 35238952391. (task 1002620)
+  1.19.832 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.831 with no explicit bump. run 35240512571. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.831",
+  "version": "1.19.832",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.831",
+      "version": "1.19.832",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.831",
+  "version": "1.19.832",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/permission-path-check.js

@@ -73,16 +73,31 @@ const RANK_TIER = { xenos: 1, thetes: 2, metic: 3, archon: 4 };
 // hook.
 const REGISTRY_PATH = path.join(__dirname, '..', '..', 'modules', 'government', 'protected-surfaces.json');
 
+// WHY THE REFUSAL NAMES A FIX: the FAIL-CLOSED note above tells the reader what
+// this throw refuses to do, but nothing told them what to DO — and a reader who
+// meets this cold sees a core file reaching into modules/ and concludes the
+// module must be optional. That is not hypothetical: task 1003662 was filed
+// asking for exactly the degrade-to-empty-set this refuses, on that reading. The
+// registry SHIPS INSIDE @bongos/core (modules/ is in the published tarball, ADR
+// 0108 §1), so it cannot be absent on an intact install and disabling the
+// government module cannot remove it — a module's enable/disable state is a
+// runtime flag, never a file deletion. Absent therefore means the install is
+// damaged, and reinstalling is the fix. Full reasoning: ADR 0300.
+const REMEDIATION =
+  'modules/government/protected-surfaces.json ships inside @bongos/core, so an intact install always has it '
+  + '— this is a damaged install (partial extract or lossy copy), not a disabled module. Reinstall/repair the '
+  + 'core package; do NOT degrade to an empty protected set (ADR 0043, ADR 0300).';
+
 function loadRegistry(file) {
   let raw;
   try {
     raw = JSON.parse(fs.readFileSync(file, 'utf8'));
   } catch (e) {
-    throw new Error(`protected-surface registry unreadable at ${file}: ${e.message}. Refusing to run with an empty protected set (ADR 0043).`);
+    throw new Error(`protected-surface registry unreadable at ${file}: ${e.message}. Refusing to run with an empty protected set (ADR 0043). ${REMEDIATION}`);
   }
   const surfaces = Array.isArray(raw && raw.surfaces) ? raw.surfaces : null;
   if (!surfaces || surfaces.length === 0) {
-    throw new Error(`protected-surface registry ${file} declares no surfaces. Refusing to run with an empty protected set (ADR 0043).`);
+    throw new Error(`protected-surface registry ${file} declares no surfaces. Refusing to run with an empty protected set (ADR 0043). ${REMEDIATION}`);
   }
   const defaultFloor = raw.floor;
   const defaultPermission = raw.permission;

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.831'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.832'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_protected_surfaces.mjs

@@ -742,6 +742,55 @@ test('a missing registry fails CLOSED — it never degrades to "nothing is prote
   }, /unreadable|Refusing/i);
 });
 
+// The refusal text, not just the refusal. Run the kernel load in a cold subprocess
+// with a patched read and hand back stderr, so a message assertion sees what an
+// operator would actually read.
+function refusalStderr(patch) {
+  try {
+    execFileSync(process.execPath, ['-e',
+      "const fs=require('node:fs');const real=fs.readFileSync;" + patch
+      + "require('./src/bongos/permission-path-check');",
+    ], { cwd: ROOT, stdio: 'pipe' });
+  } catch (e) {
+    return String(e.stderr || '');
+  }
+  return '';
+}
+
+// WHY ASSERT ON THE WORDS (task 1003662, ADR 0300). The sibling probe above proves
+// the load REFUSES; it cannot tell whether the refusal is actionable. It was not:
+// the message stated the refusal and cited ADR 0043 but never named a fix, and a
+// reader who meets it cold sees a core file reaching into modules/ and concludes
+// the module must be optional. Task 1003662 was filed on exactly that reading,
+// asking for the degrade-to-empty-set this refuses. The remediation line is the
+// fix for that, so it is part of the contract and not decoration.
+//
+// The EMPTY-surfaces branch is covered here for the first time. Until now only the
+// unreadable branch had a probe, so `surfaces: []` — the shape an out-of-band
+// registry write most plausibly produces — could have degraded silently.
+test('both refusal branches name the fix, not just the refusal (ADR 0300)', () => {
+  const gone = refusalStderr(
+    "fs.readFileSync=(p,...r)=>{ if(String(p).includes('protected-surfaces.json')) throw new Error('gone'); return real(p,...r); };",
+  );
+  const empty = refusalStderr(
+    "fs.readFileSync=(p,...r)=>(String(p).includes('protected-surfaces.json') ? '{\"surfaces\":[]}' : real(p,...r));",
+  );
+
+  assert.match(empty, /declares no surfaces/,
+    'an empty surfaces[] must refuse too — not only an unreadable file');
+
+  for (const [name, text] of [['unreadable', gone], ['empty', empty]]) {
+    assert.match(text, /Refusing to run with an empty protected set/,
+      `the ${name} branch must still state the refusal`);
+    assert.match(text, /ships inside @bongos\/core/,
+      `the ${name} branch must say the registry ships with the core (so absent means damaged, not disabled)`);
+    assert.match(text, /[Rr]einstall/,
+      `the ${name} branch must name the action that fixes it`);
+    assert.match(text, /ADR 0300/,
+      `the ${name} branch must cite the ADR that rejected degrading to an empty set`);
+  }
+});
+
 // ---------- the matcher, driven by registry data ----------
 
 test('a known path is protected at the right floor; an unknown path is not', () => {