@bongos/core 1.21.181 → 1.22.1

package/tests/html_escape.mjs

@@ -0,0 +1,149 @@
+// tests/html_escape.mjs — the ONE HTML escaper per side (task 1004876, goal 1000135).
+//
+// The escaper is what keeps a builder's own words (a task title, an idea) from
+// becoming live markup on another builder's screen. ~45 private copies were
+// collapsed onto two: window.OTB.escapeHtml (modules/hall-ui/public/dom-utils.js)
+// in the browser and escapeHtml (src/html-escape.js, re-exported by the module
+// doorway) on the server. These tests pin:
+//   1. both shared escapers escape all five characters, map null/undefined to '',
+//      and agree with each other on every input;
+//   2. the module doorway hands modules the very same function;
+//   3. pages that used to carry a private copy now render user text through the
+//      shared one (a title with <, & and a quote stays text);
+//   4. the fitness check goes red on a third definition, and on a hall page that
+//      loads dom-utils.js after (or deferred behind) the scripts that need it.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import vm from 'node:vm';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const PUB = path.join(ROOT, 'modules', 'hall-ui', 'public');
+
+const { escapeHtml: serverEscape } = require('../src/html-escape.js');
+const guard = require('../scripts/bongos/escape-helper-guard.js');
+
+// Load the real dom-utils.js into a sandbox and hand back its window.OTB.
+function browserOTB() {
+  const sandbox = { window: {}, document: { querySelector: () => null } };
+  vm.createContext(sandbox);
+  vm.runInContext(fs.readFileSync(path.join(PUB, 'dom-utils.js'), 'utf8'), sandbox, { filename: 'dom-utils.js' });
+  return sandbox.window.OTB;
+}
+
+const HOSTILE = `<img src=x onerror="alert('x')"> & "quoted" 'single' a&amp;b`;
+const CASES = [HOSTILE, '', 'plain', 0, 42, -1.5, true, false, null, undefined, '&lt;', '<<>>', "it's", '"'];
+
+test('server escaper escapes all five HTML characters', () => {
+  assert.equal(serverEscape(`<a href="x" title='y'>&</a>`),
+    '&lt;a href=&quot;x&quot; title=&#39;y&#39;&gt;&amp;&lt;/a&gt;');
+});
+
+test('server escaper: null/undefined render as empty text, numbers and booleans as their string', () => {
+  assert.equal(serverEscape(null), '');
+  assert.equal(serverEscape(undefined), '');
+  assert.equal(serverEscape(0), '0');
+  assert.equal(serverEscape(42), '42');
+  assert.equal(serverEscape(false), 'false');
+});
+
+test('server escaper escapes an ampersand first, so an existing entity is shown literally', () => {
+  assert.equal(serverEscape('&lt;'), '&amp;lt;');
+});
+
+test('browser and server escapers agree on every input', () => {
+  const OTB = browserOTB();
+  for (const c of CASES) assert.equal(OTB.escapeHtml(c), serverEscape(c), `input ${JSON.stringify(c)}`);
+});
+
+test('the module doorway exports the shared server escaper', () => {
+  const api = require('../src/module-api.js');
+  assert.equal(api.escapeHtml, serverEscape);
+});
+
+test('a hall helper that dropped its private copy renders user text through window.OTB', () => {
+  // hall-kit.js used to carry its own esc() (exported as OTBKit.esc); it must now delegate, at call time.
+  const sandbox = { window: {}, document: { querySelector: () => null } };
+  vm.createContext(sandbox);
+  vm.runInContext(fs.readFileSync(path.join(PUB, 'dom-utils.js'), 'utf8'), sandbox);
+  vm.runInContext(fs.readFileSync(path.join(PUB, 'hall-kit.js'), 'utf8'), sandbox);
+  const lib = sandbox.window.OTBKit;
+  assert.ok(lib && typeof lib.esc === 'function', 'hall-kit exposes esc');
+  assert.equal(lib.esc('Fix <b> & "q" \'s\''), 'Fix &lt;b&gt; &amp; &quot;q&quot; &#39;s&#39;');
+  assert.equal(lib.esc(null), '');
+});
+
+test('fitness: a third escape table anywhere in the code is a hard fail', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'esc-guard-'));
+  try {
+    fs.mkdirSync(path.join(tmp, 'src'), { recursive: true });
+    fs.mkdirSync(path.join(tmp, 'modules', 'x', 'public'), { recursive: true });
+    fs.mkdirSync(path.join(tmp, 'modules', 'x', 'tests'), { recursive: true });
+    fs.writeFileSync(path.join(tmp, 'src', 'html-escape.js'), "const T = { '<': '&lt;' };\n");
+    fs.writeFileSync(path.join(tmp, 'modules', 'x', 'tests', 't.mjs'), "const T = { '<': '&lt;' };\n");
+    let r = guard.checkOneHtmlEscaper({ root: tmp });
+    assert.equal(r.ok, true, r.violations.join('\n'));
+    // A renamed copy is still caught: the detector reads the table, not the name.
+    fs.writeFileSync(path.join(tmp, 'modules', 'x', 'public', 'page.js'),
+      "const hesc = (s) => String(s).replace(/</g, '&lt;');\n");
+    r = guard.checkOneHtmlEscaper({ root: tmp });
+    assert.equal(r.ok, false);
+    assert.equal(r.hardFail, true);
+    assert.match(r.violations[0], /modules\/x\/public\/page\.js:1/);
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+});
+
+test('fitness: a delegate to the shared escaper is not a copy', () => {
+  assert.deepEqual(guard.findEscapeTables('function esc(s) { return window.OTB.escapeHtml(s); }'), []);
+  assert.deepEqual(guard.findEscapeTables("s.replace(/&lt;/g, '<')"), [], 'a DECODER is not an escaper');
+  assert.deepEqual(guard.findEscapeTables("x\n{ '<': \"&lt;\" }"), [2]);
+});
+
+test('fitness: a local escaper name that does not delegate is a hard fail (the old primer fallback)', () => {
+  const browser = { browser: true };
+  assert.deepEqual(guard.findFakeDelegates("  const escapeHtml = (MD && MD.escapeHtml) || ((s) => String(s));", browser), [],
+    'names the shared one — but the line-level rule cannot see the fallback, so primer.js no longer has one');
+  assert.deepEqual(guard.findFakeDelegates('  const escapeHtml = (s) => String(s);', browser), [1]);
+  assert.deepEqual(guard.findFakeDelegates('  function esc(s) { return s; }', browser), [1]);
+  assert.deepEqual(guard.findFakeDelegates('  function esc(s) { return window.OTB.escapeHtml(s); }', browser), []);
+  assert.deepEqual(guard.findFakeDelegates('  var esc = kit.esc;', browser), []);
+  // server: `esc` is also a regex/markdown escaper name there, so only the HTML names are held
+  assert.deepEqual(guard.findFakeDelegates("const esc = (k) => k.replace(/[.*]/g, '\\\\$&');"), []);
+  assert.deepEqual(guard.findFakeDelegates('const hesc = (s) => String(s);'), [1]);
+  assert.deepEqual(guard.findFakeDelegates("const { escapeHtml: hesc } = require('../../src/html-escape');"), []);
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'esc-guard-'));
+  try {
+    fs.mkdirSync(path.join(tmp, 'modules', 'x', 'public'), { recursive: true });
+    fs.writeFileSync(path.join(tmp, 'modules', 'x', 'public', 'p.js'), 'const esc = (s) => String(s);\n');
+    const r = guard.checkOneHtmlEscaper({ root: tmp });
+    assert.equal(r.ok, false);
+    assert.match(r.violations[0], /p\.js:1 — defines a local HTML escaper name/);
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+});
+
+test('fitness: the guard is registered in fitness.js CHECKS, so CI runs it', () => {
+  const fitness = require('../scripts/bongos/fitness.js');
+  const checks = fitness.CHECKS || fitness.checks;
+  assert.ok(Array.isArray(checks), 'fitness.js exports its CHECKS list');
+  assert.ok(checks.includes(guard.checkOneHtmlEscaper), 'checkOneHtmlEscaper is one of the fitness checks');
+});
+
+test('fitness: a hall page must load dom-utils.js first and synchronously', () => {
+  const ok = '<script src="/builders/dom-utils.js?v=1"></script><script src="/builders/shell.js"></script>';
+  assert.equal(guard.hallPageOrderProblem(ok), null);
+  assert.equal(guard.hallPageOrderProblem('<p>no scripts</p>'), null);
+  assert.match(guard.hallPageOrderProblem('<script src="/builders/shell.js"></script><script src="/builders/dom-utils.js"></script>'), /before/);
+  assert.match(guard.hallPageOrderProblem('<script src="/builders/dom-utils.js" defer></script><script src="/builders/shell.js"></script>'), /defer/);
+  assert.match(guard.hallPageOrderProblem('<script src="/builders/shell.js"></script>'), /never/);
+});
+
+test('fitness: the real tree holds exactly the two shared escapers', () => {
+  const r = guard.checkOneHtmlEscaper();
+  assert.equal(r.ok, true, r.violations.join('\n'));
+});

package/tests/lightbulb.mjs

@@ -17,6 +17,7 @@ import path from 'node:path';
 import vm from 'node:vm';
 import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -265,6 +266,7 @@ function boot({ storage = {}, throwing = false, respond } = {}) {
     ? { ok: true, status: 200, json: { ideas: [{ id: '5', title: '<b>Bold</b> idea', author_name: 'Bo', captured_at: '2026-10-01T00:00:00Z' }] } }
     : { ok: true, status: 201, json: { ideas: [{ id: '801', title: 'Sort drafts' }, { id: '802', title: 'Name writers' }], split_by: 'ai' } }));
   const win = {
+    OTB: realOTB(), // the page loads dom-utils.js first (task 1004876)
     location: { pathname: '/studio' },
     localStorage: store,
     fetch: (url, opts) => {

package/tests/module_api.mjs

@@ -20,6 +20,7 @@ const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
 // `withTx` was added; no enabled module at its pinned coreVersion lost a capability.
 const PUBLISHED_SURFACE = [
   'CORE_VERSION',
+  'escapeHtml', // task 1004876: THE server-side HTML escaper (1.22.0) — modules render user text through it, never a private copy
   'requireBuilder', 'requireRank', 'rankMeetsThreshold', 'requireBfgPrincipal', 'allowBoxScope', 'resolveSession',
   'requirePermission', // BV1.R105: the authority-atom gate module routes migrate onto (1.19.0; ADR 0151)
   'requireActAlone', // added by task 1004657 (ADR 0363 D5): a building's own page asks its decision-rules row before one builder acts alone. On the doorway because eight buildings' pages live in six modules and core, and each must refuse the same way People does

package/tests/module_store_howto.mjs

@@ -16,6 +16,7 @@ import os from 'node:os';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -173,7 +174,7 @@ test('a delisted module\'s how-to still reads for people who hold it, and only f
 // ---- the page: the author's markdown is untrusted input ----
 
 function loadReader() {
-  const ctx = { window: {}, location: { href: 'https://builders.example.com/builders/modules', hostname: 'builders.example.com' }, URL };
+  const ctx = { window: { OTB: realOTB() }, location: { href: 'https://builders.example.com/builders/modules', hostname: 'builders.example.com' }, URL };
   vm.createContext(ctx);
   vm.runInContext(fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/md-reader.js'), 'utf8'), ctx);
   return ctx.window.OTBMdReader;

package/tests/nav_permission_atoms.mjs

@@ -93,7 +93,7 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // says a held core version was tried and rolled back; task 1004731: the one-time
 // "Upgraded to core X" notice after a move; task 1004826: Standing is Accomplishments;
 // task 1004846: the new logo (its bump landed late, in task 1004852).
-const SHELL_SHA = '670b2f71085c13b6';
+const SHELL_SHA = 'cea38eeab6b234cc';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);

package/tests/npm_release_where.mjs

@@ -18,7 +18,7 @@ import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
 import { createRequire } from 'node:module';
-import { npmTarball, npmPackument, fakeHttpsGet } from './helpers.mjs';
+import { npmTarball, npmPackument, fakeHttpsGet, realOTB } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -193,6 +193,7 @@ function bootWidget(answer, { shown = null } = {}) {
   const listeners = {};
   const asked = [];
   const windowObj = {
+    OTB: realOTB(), // the page loads dom-utils.js first (task 1004876)
     OTBTaskShown: shown,
     BongosClient: { createClient: () => ({ request: async (m, url) => { asked.push(url); return answer(url); } }) },
   };

package/tests/page_notes_panel.mjs

@@ -13,6 +13,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HALL = path.join(ROOT, 'modules/hall-ui/public');
@@ -59,7 +60,7 @@ function boot({ session = {}, search = '' } = {}) {
   };
   const mk = (obj) => ({ getItem: (k) => (k in obj ? obj[k] : null), setItem: (k, v) => { obj[k] = String(v); }, removeItem: (k) => { delete obj[k]; } });
   const opened = [];
-  const window = { localStorage: mk({}), sessionStorage: mk(session), matchMedia: () => ({ matches: false }), location: { search } };
+  const window = { OTB: realOTB(), localStorage: mk({}), sessionStorage: mk(session), matchMedia: () => ({ matches: false }), location: { search } };
   // "Loading" page-notes.js: record the tag, then define the API it would define.
   head.onAppend = (tag) => {
     loaded.push(tag.src);
@@ -115,7 +116,7 @@ test('a ?note= link opens that doc on arrival, in any mode', async () => {
 
 // ---------- the reader ----------
 function reader() {
-  const window = { location: { pathname: '/studio' } };
+  const window = { OTB: realOTB(), location: { pathname: '/studio' } };
   const document = { body: { dataset: { page: 'studio', pageTitle: 'Studio' } }, title: 'Studio — hall' };
   const sandbox = { window, document };
   vm.createContext(sandbox);
@@ -206,7 +207,7 @@ function dockedPanel({ reviewing = null, opened = false } = {}) {
     experiences: () => [{ id: 'ideating', label: 'Ideator experience', short: 'Ideating' }, { id: 'building', label: 'Building experience', short: 'Building' }],
     iconHtml: () => '<svg></svg>',
   };
-  const window = { location: { pathname: '/studio' }, OTBCraftMode: craft };
+  const window = { OTB: realOTB(), location: { pathname: '/studio' }, OTBCraftMode: craft };
   const sandbox = { window, document, fetch, setTimeout, clearTimeout, Promise };
   vm.createContext(sandbox);
   vm.runInContext(NOTES, sandbox, { filename: 'page-notes.js' });

package/tests/paintbrush.mjs

@@ -17,6 +17,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HALL = path.join(ROOT, 'modules/hall-ui/public');
@@ -157,7 +158,7 @@ function boot({ round = null, draft = null, claim = { status: 200, body: { ok: t
     return respond(404, {});
   };
   const winListeners = {};
-  const window = { location: { pathname: '/roadmap' }, addEventListener: (t, fn) => { (winListeners[t] ||= []).push(fn); }, removeEventListener: (t, fn) => { winListeners[t] = (winListeners[t] || []).filter((f) => f !== fn); } };
+  const window = { OTB: realOTB(), location: { pathname: '/roadmap' }, addEventListener: (t, fn) => { (winListeners[t] ||= []).push(fn); }, removeEventListener: (t, fn) => { winListeners[t] = (winListeners[t] || []).filter((f) => f !== fn); } };
   const sandbox = { window, document, fetch, Promise, setTimeout, clearTimeout, JSON, Math, String, Array, Object };
   window.window = window;
   vm.createContext(sandbox);

package/tests/profile_connections_ui.mjs

@@ -58,6 +58,7 @@ import vm from 'node:vm';
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
+import { realOTB } from './helpers.mjs';
 // The REAL predicates, not a copy. accountFloor() below used to spell these
 // itself, which made it a hand-maintained mirror of account-visibility.js —
 // and it drifted the moment ADR 0213 made consent two columns. Imported, the
@@ -498,7 +499,7 @@ function boot({ transport, hub = HUB } = {}) {
     window: {
       OTBAsk: require('../modules/hall-ui/public/hall-ask.js'),
       BongosClient: { createClient: () => api },
-      OTB: { $, escapeHtml, fmtDate: (d) => String(d).slice(0, 10), toast: (m) => toasts.push(m), hubOrigin: () => hub },
+      OTB: { ...realOTB(), $, escapeHtml, fmtDate: (d) => String(d).slice(0, 10), toast: (m) => toasts.push(m), hubOrigin: () => hub },
       OTBKit: {
         makePager: (prefix, key) => ({ prefix, key, page: 1, perPage: 25 }),
         makeLedger: ({ mount, rowHtml, emptyMsg }) => ({

package/tests/profile_role_headline.mjs

@@ -20,7 +20,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
-import { makeRunner } from './helpers.mjs';
+import { makeRunner, realOTB } from './helpers.mjs';
 
 process.env.NODE_ENV = 'test';
 const require = createRequire(import.meta.url);
@@ -129,7 +129,7 @@ async function boot(profileData) {
     // The real kit draws the surface bars; the section rail needs a real DOM and
     // is not what this suite is about, so it is left out (profile.js skips it).
     OTBKit: { ...OTBKit, makeSectionRail: undefined },
-    OTB: {
+    OTB: { ...realOTB(),
       $, escapeHtml,
       fmtNum: (n) => Number(n || 0).toLocaleString('en-US'),
       fmtDate: (d) => String(d).slice(0, 10),

package/tests/profile_role_tabs.mjs

@@ -22,7 +22,7 @@ import os from 'node:os';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
-import { makeRunner, bootProfilePage, settle } from './helpers.mjs';
+import { makeRunner, bootProfilePage, settle, realOTB } from './helpers.mjs';
 
 process.env.NODE_ENV = 'test';
 const require = createRequire(import.meta.url);
@@ -95,7 +95,7 @@ await test('the route: signed in only, a bad id refused, paged, and it asks for
 // ---- 2. the ideator's trail -------------------------------------------------
 
 function loadCrafts() {
-  const sandbox = { window: {}, console };
+  const sandbox = { window: { OTB: realOTB() }, console };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
   for (const f of ['idea-objects.js', 'profile-crafts.js']) {

package/tests/projects_hub_repo_private.mjs

@@ -17,6 +17,7 @@
 import { strict as assert } from 'node:assert';
 import { readFileSync } from 'node:fs';
 import vm from 'node:vm';
+import { realOTB } from './helpers.mjs';
 
 const HUB = readFileSync(new URL('../modules/public-landing/public/projects.html', import.meta.url), 'utf8').replace(/\r\n/g, '\n');
 
@@ -30,6 +31,8 @@ async function ta(name, fn) {
 function grab(head) {
   const at = HUB.indexOf(`\n  ${head}`);
   assert.ok(at >= 0, `${head} must exist`);
+  const line = HUB.slice(at, HUB.indexOf('\n', at + 1));
+  if (/\}\s*$/.test(line)) return line; // a one-line declaration (esc, task 1004876)
   const end = HUB.indexOf('\n  }', at + 1);
   const close = HUB.slice(end, end + 5) === '\n  };' ? end + 5 : end + 4;
   return HUB.slice(at, close);
@@ -50,6 +53,7 @@ function world({ reply = RECEIPT } = {}) {
     API: '/api/bongos', manageId: '18', manageInst: null, manageRepo: null,
     mRepoPrivSeen: false, mRepoPrivState: '',
     $: (id) => els[id],
+    window: { OTB: realOTB() }, // the page loads dom-utils.js first (task 1004876)
     document: { querySelector: () => null },
     jsonOrEmpty: (res) => res.json(),
     apiError: (data) => (data && data.error) || {},

package/tests/terms_acceptance.mjs

@@ -400,6 +400,7 @@ require.cache[moduleApiPath] = {
     resolveEnv: () => null,
     userAgent: () => 'cloud-bongos-tests',
     LIVE_RANK_LADDER: ['xenos', 'thetes', 'metic', 'archon'],
+    escapeHtml: require('../src/html-escape.js').escapeHtml, // the doorway's one escaper (task 1004876)
   },
 };
 

package/tests/welcome_boot_browser.mjs

@@ -33,7 +33,7 @@ const INDEX = fs.readFileSync(path.join(HALL, 'index.html'), 'utf8')
   .replace(/<script\b[^>]*>[\s\S]*?<\/script>/g, '')
   .replace(/\{\{[^}]*\}\}/g, '');
 const STUB = '<script>window.__BRANDING__ = { identity: { worldName: "Harbor" } }; window.BongosClient = { createClient: () => ({ request: async () => ({ ok: false, status: 404, data: null }) }) };</script>';
-const SCRIPTS = ['shell-trail.js', 'craft-mode.js', 'welcome-boot.js', 'shell.js']
+const SCRIPTS = ['dom-utils.js', 'shell-trail.js', 'craft-mode.js', 'welcome-boot.js', 'shell.js'] // dom-utils first, as on the real page (task 1004876)
   .map((f) => `<script src="/builders/${f}"></script>`).join('');
 const PAGE = INDEX.replace('</body>', STUB + SCRIPTS + '</body>');
 

package/modules/government/protected-surfaces.js

@@ -1,88 +0,0 @@
-'use strict';
-
-// modules/government/protected-surfaces.js — the protected-surface registry's
-// GOVERNMENT-side API (ADR 0151 §4, BV1.R101).
-//
-// POLICY OWNS / SUBSTRATE ENFORCES — the whole point of this slice.
-//
-//   GOVERNMENT OWNS THE DATA. protected-surfaces.json (next to this file) says
-//   WHICH repo paths are protected, at WHAT rank floor, mapped to WHICH
-//   `system: true` catalog permission. That file is the source of truth; the
-//   Archon Government tab (R110/R111) edits it as policy. Before R101 the same
-//   information was a hardcoded PROTECTED_GLOBS constant inside the kernel.
-//
-//   THE OUT-OF-BAND SUBSTRATE STAYS THE ENFORCER. Nothing here enforces
-//   anything. The enforcers are the git pre-push hook, the grader pre-pass, the
-//   post-push main audit and the goal-scope check — they read
-//   the registry with no DB, no server and no HTTP, and they are what actually
-//   blocks a sub-floor change (ADR 0043). Re-mapping a floor here changes what
-//   the substrate protects; it can never make the request path the authority.
-//   Moving enforcement into the app is the regression R101 exists to prevent
-//   (ADR 0151 §"Alternatives considered").
-//
-//   NO DB DEPENDENCY. A DB-backed override is a government-tab concern layered
-//   on top and must never become a dependency of the hook — the hook runs on a
-//   laptop with no database and no network. This module is therefore
-//   synchronous, DB-free and requires nothing but the catalog and the doorway.
-//
-// DEPENDENCY DIRECTION (ADR 0083's one-way rule). Code flows exactly one way:
-// this module → src/module-api.js (the published doorway) → the kernel matcher
-// in src/bongos/permission-path-check.js. Core never requires this module. The
-// kernel loads the JSON data file directly (a static data read, the same way the
-// sibling trust primitive route-rank-check.js reads modules/*/routes/*.js off
-// disk to rank-gate them), and we read the parsed result back through the
-// doorway so there is exactly ONE loader and ONE matcher — no second list to
-// drift (the SEC #863 failure mode).
-
-const api = require('../../src/module-api');
-const catalog = require('./catalog');
-
-const ppc = api.permissionPathCheck;
-
-// The registry, as parsed by the single kernel loader.
-const SURFACES = ppc.PROTECTED_SURFACES;
-
-// ── invariants asserted at module load (fail loud on an authoring typo) ───────
-// The government module is where the registry meets the permission catalog, so
-// this is where "every protected surface maps to a real, non-grantable
-// permission" is checked. A surface mapping to an unknown key, or to a
-// `system: false` (grantable) key, would mean an Archon could hand a custom rank
-// the power the substrate is supposed to reserve — exactly the wall ADR 0151 §4
-// builds. Fail loud rather than silently protecting nothing.
-for (const s of SURFACES) {
-  const perm = catalog.byKey(s.permission);
-  if (!perm) {
-    throw new Error(`protected-surface registry: "${s.glob}" maps to "${s.permission}", which the permission catalog does not define`);
-  }
-  if (perm.system !== true) {
-    throw new Error(`protected-surface registry: "${s.glob}" maps to "${s.permission}", which is not system:true — a protected surface must map to a NON-GRANTABLE permission (ADR 0151 §4)`);
-  }
-  if (!catalog.RANK_ORDER.includes(s.floor)) {
-    throw new Error(`protected-surface registry: "${s.glob}" declares floor "${s.floor}", which is not a rank`);
-  }
-}
-
-// The lowest floor any surface declares — 'metic' today (ADR 0043's Metic floor,
-// now DERIVED from registry data rather than hardcoded).
-const FLOOR = catalog.RANK_ORDER[Math.min(...SURFACES.map((s) => catalog.RANK_ORDER.indexOf(s.floor)))];
-
-// The distinct system permissions the registry maps onto.
-const SYSTEM_PERMISSIONS = Object.freeze([...new Set(SURFACES.map((s) => s.permission))].sort());
-
-// Per-path lookups — the single matcher, reached through the doorway.
-const surfaceFor = (file) => ppc.surfaceFor(file);
-const floorFor = (file) => ppc.floorFor(file);
-const permissionFor = (file) => ppc.permissionFor(file);
-const isProtected = (file) => ppc.surfaceFor(file) !== null;
-
-module.exports = {
-  SURFACES,
-  PROTECTED_GLOBS: ppc.PROTECTED_GLOBS,
-  REGISTRY_PATH: ppc.REGISTRY_PATH,
-  FLOOR,
-  SYSTEM_PERMISSIONS,
-  surfaceFor,
-  floorFor,
-  permissionFor,
-  isProtected,
-};