@mohasinac/appkit 4.44.0 → 4.46.0

package/dist/schemas/registry.js

@@ -24,20 +24,20 @@
 //      `src/app/api/**` has an entry, and every Firestore collection in the
 //      CLAUDE.md seed table has a `firestore.<collection>` entry.
 // ── W2 — Firestore document schemas ──────────────────────────────────────────
-import { addressFirestoreSchema } from "../features/addresses/schemas";
-import { blogPostFirestoreSchema } from "../features/blog/schemas";
-import { categoryFirestoreSchema } from "../features/categories/schemas";
-import { carouselFirestoreSchema, carouselSlideFirestoreSchema, homepageSectionFirestoreSchema, } from "../features/homepage/schemas";
-import { faqFirestoreSchema } from "../features/faq/schemas";
-import { groupedListingFirestoreSchema } from "../features/grouped/schemas";
-import { orderFirestoreSchema } from "../features/orders/schemas";
-import { payoutFirestoreSchema } from "../features/payments/schemas";
-import { claimedCouponFirestoreSchema, couponFirestoreSchema, couponUsageFirestoreSchema, } from "../features/promotions/schemas";
-import { reviewFirestoreSchema } from "../features/reviews/schemas";
-import { scammerCommentFirestoreSchema, scammerContestFirestoreSchema, scammerFirestoreSchema, scammerIncidentFirestoreSchema, } from "../features/scams/schemas";
-import { serverErrorFirestoreSchema } from "../features/server-errors/schemas";
-import { storeFirestoreSchema } from "../features/stores/schemas";
-import { supportTicketFirestoreSchema } from "../features/support/schemas";
+import { addressFirestoreSchema } from "../features/addresses/schemas/index.js";
+import { blogPostFirestoreSchema } from "../features/blog/schemas/index.js";
+import { categoryFirestoreSchema } from "../features/categories/schemas/index.js";
+import { carouselFirestoreSchema, carouselSlideFirestoreSchema, homepageSectionFirestoreSchema, } from "../features/homepage/schemas/index.js";
+import { faqFirestoreSchema } from "../features/faq/schemas/index.js";
+import { groupedListingFirestoreSchema } from "../features/grouped/schemas/index.js";
+import { orderFirestoreSchema } from "../features/orders/schemas/index.js";
+import { payoutFirestoreSchema } from "../features/payments/schemas/index.js";
+import { claimedCouponFirestoreSchema, couponFirestoreSchema, couponUsageFirestoreSchema, } from "../features/promotions/schemas/index.js";
+import { reviewFirestoreSchema } from "../features/reviews/schemas/index.js";
+import { scammerCommentFirestoreSchema, scammerContestFirestoreSchema, scammerFirestoreSchema, scammerIncidentFirestoreSchema, } from "../features/scams/schemas/index.js";
+import { serverErrorFirestoreSchema } from "../features/server-errors/schemas/index.js";
+import { storeFirestoreSchema } from "../features/stores/schemas/index.js";
+import { supportTicketFirestoreSchema } from "../features/support/schemas/index.js";
 // ---------------------------------------------------------------------------
 // Firestore document schemas — populated by W2.
 //
@@ -80,7 +80,7 @@ const firestore = {
 // `createRouteHandler` helper accepts either a direct Zod schema or one of
 // these keys.
 // ---------------------------------------------------------------------------
-import { postApiWishlist, postApiAuthSession, postApiAdminProductsIdGroup, postApiMediaSign, postApiMediaFinalize, getApiSearchSuggestions, } from "./api-routes";
+import { postApiWishlist, postApiAuthSession, postApiAdminProductsIdGroup, postApiMediaSign, postApiMediaFinalize, getApiSearchSuggestions, } from "./api-routes.js";
 const api = {
     "POST /api/wishlist": postApiWishlist,
     "POST /api/auth/session": postApiAuthSession,
@@ -106,34 +106,34 @@ const api = {
  * run, against real documents for silent field loss; an entity absent from it
  * has no such protection, which is the whole reason to register early.
  */
-import { blogDraftSchema } from "../features/blog/schemas/blog-form";
-import { eventDraftSchema } from "../features/events/schemas/event-form";
-import { productFeatureFormSchema } from "../features/products/schemas/product-features.validators";
-import { storeCategoryFormSchema } from "../features/store-extensions/schemas/store-category-form";
-import { listingTemplateFormSchema } from "../features/store-extensions/schemas/listing-template-form";
-import { payoutMethodFormSchema } from "../features/store-extensions/schemas/payout-method-form";
-import { shippingConfigFormSchema } from "../features/store-extensions/schemas/shipping-config-form";
-import { groupedListingFormSchema } from "../features/grouped/schemas/grouped-listing-form";
-import { sellerCouponFormSchema } from "../features/seller/schemas/coupon-form";
-import { productDraftSchema } from "../features/seller/schemas/product-form";
-import { customRoleFormSchema } from "../features/store-extensions/schemas/custom-role-form";
-import { moderationReviewFormSchema } from "../features/store-extensions/schemas/moderation-review-form";
-import { reportReviewFormSchema } from "../features/store-extensions/schemas/report-review-form";
-import { adminStoreUpdateSchema } from "../features/admin/schemas/admin-editor-forms";
-import { adminAddressCreateSchema } from "../features/addresses/schemas/address-form";
-import { adminOrderUpdateSchema, employeeInviteSchema, adminAdFormSchema } from "../features/admin/schemas/admin-ops-forms";
-import { adminUserUpdateSchema, whatsappSettingsSchema, lotteryPullSchema } from "../features/admin/schemas/admin-user-form";
-import { siteSettingsFormSchema } from "../features/admin/schemas/site-settings-form";
-import { orderCancelSchema, paymentProofSchema } from "../features/orders/schemas/buyer-forms";
-import { scamReportFormSchema } from "../features/scams/schemas/report-form";
-import { sublistingCategoryFormSchema } from "../features/store-extensions/schemas/sublisting-category-form";
-import { lotteryConfigWriteSchema } from "../features/lottery/schemas/config-write";
-import { reportCreateSchema } from "../features/store-extensions/schemas/report-create-form";
-import { itemRequestCreateSchema } from "../features/store-extensions/schemas/item-request-create-form";
-import { analyticsAlertCreateSchema, analyticsCardCreateSchema, } from "../features/store-extensions/schemas/analytics-forms";
-import { storeGoogleConfigUpdateSchema } from "../features/store-extensions/schemas/google-config-form";
-import { adminNotificationCreateSchema } from "../features/store-extensions/schemas/admin-notification-form";
-import { homepageSectionCreateSchema } from "../features/homepage/schemas/index";
+import { blogDraftSchema } from "../features/blog/schemas/blog-form.js";
+import { eventDraftSchema } from "../features/events/schemas/event-form.js";
+import { productFeatureFormSchema } from "../features/products/schemas/product-features.validators.js";
+import { storeCategoryFormSchema } from "../features/store-extensions/schemas/store-category-form.js";
+import { listingTemplateFormSchema } from "../features/store-extensions/schemas/listing-template-form.js";
+import { payoutMethodFormSchema } from "../features/store-extensions/schemas/payout-method-form.js";
+import { shippingConfigFormSchema } from "../features/store-extensions/schemas/shipping-config-form.js";
+import { groupedListingFormSchema } from "../features/grouped/schemas/grouped-listing-form.js";
+import { sellerCouponFormSchema } from "../features/seller/schemas/coupon-form.js";
+import { productDraftSchema } from "../features/seller/schemas/product-form.js";
+import { customRoleFormSchema } from "../features/store-extensions/schemas/custom-role-form.js";
+import { moderationReviewFormSchema } from "../features/store-extensions/schemas/moderation-review-form.js";
+import { reportReviewFormSchema } from "../features/store-extensions/schemas/report-review-form.js";
+import { adminStoreUpdateSchema } from "../features/admin/schemas/admin-editor-forms.js";
+import { adminAddressCreateSchema } from "../features/addresses/schemas/address-form.js";
+import { adminOrderUpdateSchema, employeeInviteSchema, adminAdFormSchema } from "../features/admin/schemas/admin-ops-forms.js";
+import { adminUserUpdateSchema, whatsappSettingsSchema, lotteryPullSchema } from "../features/admin/schemas/admin-user-form.js";
+import { siteSettingsFormSchema } from "../features/admin/schemas/site-settings-form.js";
+import { orderCancelSchema, paymentProofSchema } from "../features/orders/schemas/buyer-forms.js";
+import { scamReportFormSchema } from "../features/scams/schemas/report-form.js";
+import { sublistingCategoryFormSchema } from "../features/store-extensions/schemas/sublisting-category-form.js";
+import { lotteryConfigWriteSchema } from "../features/lottery/schemas/config-write.js";
+import { reportCreateSchema } from "../features/store-extensions/schemas/report-create-form.js";
+import { itemRequestCreateSchema } from "../features/store-extensions/schemas/item-request-create-form.js";
+import { analyticsAlertCreateSchema, analyticsCardCreateSchema, } from "../features/store-extensions/schemas/analytics-forms.js";
+import { storeGoogleConfigUpdateSchema } from "../features/store-extensions/schemas/google-config-form.js";
+import { adminNotificationCreateSchema } from "../features/store-extensions/schemas/admin-notification-form.js";
+import { homepageSectionCreateSchema } from "../features/homepage/schemas/index.js";
 const forms = {
     /*
      * `product` was ABSENT from this map until 2026-09-04, and that absence is
@@ -189,7 +189,7 @@ const sieve = {
 // Webhook envelope schemas — W7 cohort. Each provider registers a bucket
 // of `eventName` → schema.
 // ---------------------------------------------------------------------------
-import { googleSignInWithIdpResponseSchema, googleTokenInfoSchema, } from "./webhooks/google-oauth";
+import { googleSignInWithIdpResponseSchema, googleTokenInfoSchema, } from "./webhooks/google-oauth.js";
 const webhook = {
     googleOauth: {
         signInWithIdp: googleSignInWithIdpResponseSchema,

package/dist/security/authorization.js

@@ -8,9 +8,9 @@
  * they depend on Firebase Admin and the user repository; implement them in your
  * app layer using these primitives.
  */
-import { AuthenticationError, AuthorizationError } from "../errors";
-import { isAccountDisabled } from "../features/auth/role-predicates";
-import { ERROR_MESSAGES } from "../errors/messages";
+import { AuthenticationError, AuthorizationError } from "../errors/index.js";
+import { isAccountDisabled } from "../features/auth/role-predicates.js";
+import { ERROR_MESSAGES } from "../errors/messages.js";
 /**
  * 🛑 THE role hierarchy. There were two until 2026-08-29 — this one and a copy
  * in `features/auth/auth-helpers.ts` — and they DISAGREED: that copy ranked

package/dist/security/browser.js

@@ -1,7 +1,7 @@
-export { generateNonce, buildCSP } from "./csp";
-export { requireAuth, requireRole, requireOwnership, requireEmailVerified, requireActiveAccount, canChangeRole, getRoleLevel, } from "./authorization";
-export { redactPii } from "./pii-redact";
-export { USER_PII_FIELDS, USER_PII_INDEX_MAP, ADDRESS_PII_FIELDS, ORDER_PII_FIELDS, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, BID_PII_FIELDS, TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, OFFER_PII_FIELDS, EVENT_ENTRY_PII_FIELDS, } from "./pii-schemas";
+export { generateNonce, buildCSP } from "./csp.js";
+export { requireAuth, requireRole, requireOwnership, requireEmailVerified, requireActiveAccount, canChangeRole, getRoleLevel, } from "./authorization.js";
+export { redactPii } from "./pii-redact.js";
+export { USER_PII_FIELDS, USER_PII_INDEX_MAP, ADDRESS_PII_FIELDS, ORDER_PII_FIELDS, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, BID_PII_FIELDS, TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, OFFER_PII_FIELDS, EVENT_ENTRY_PII_FIELDS, } from "./pii-schemas.js";
 // The `security/rbac/**` re-exports were deleted 2026-08-29 — see the note in
 // ./index.ts. The live permission surface is
 // `features/auth/permissions/constants.ts`; nothing client-side consumed the

package/dist/security/index.js

@@ -1,14 +1,14 @@
-export { generateNonce, buildCSP } from "./csp";
-export { rateLimit, applyRateLimit, rateLimitByIdentifier, RateLimitPresets, clearRateLimitStore, getClientIP, hashGuestIdentity, } from "./rate-limit";
-export { requireAuth, requireRole, requireOwnership, requireEmailVerified, requireActiveAccount, canChangeRole, getRoleLevel, } from "./authorization";
-export { redactPii, safeDisplayName, safeDisplayEmail, maskIp } from "./pii-redact";
-export { encryptValue, decryptValue, hmacBlindIndex, encryptPiiFields, decryptPiiFields, encryptPii, decryptPii, piiBlindIndex, piiIndicesFor, getPiiConfigError, encryptPayoutDetails, decryptPayoutDetails, encryptShippingConfig, decryptShippingConfig, encryptPayoutBankAccount, decryptPayoutBankAccount, } from "./pii-encrypt";
+export { generateNonce, buildCSP } from "./csp.js";
+export { rateLimit, applyRateLimit, rateLimitByIdentifier, RateLimitPresets, clearRateLimitStore, getClientIP, hashGuestIdentity, } from "./rate-limit.js";
+export { requireAuth, requireRole, requireOwnership, requireEmailVerified, requireActiveAccount, canChangeRole, getRoleLevel, } from "./authorization.js";
+export { redactPii, safeDisplayName, safeDisplayEmail, maskIp } from "./pii-redact.js";
+export { encryptValue, decryptValue, hmacBlindIndex, encryptPiiFields, decryptPiiFields, encryptPii, decryptPii, piiBlindIndex, piiIndicesFor, getPiiConfigError, encryptPayoutDetails, decryptPayoutDetails, encryptShippingConfig, decryptShippingConfig, encryptPayoutBankAccount, decryptPayoutBankAccount, } from "./pii-encrypt.js";
 // Crypto-free display-masking helpers -- sourced from pii-mask.ts (not
 // pii-encrypt.ts) so this barrel stays safe to re-export from the
 // universal client+server index.ts. See pii-mask.ts's header comment.
-export { isPiiEncrypted, maskName, maskEmail, maskPublicReview, maskPublicBid, maskPublicEventEntry, maskOfferForSeller, ENC_PREFIX, HMAC_PREFIX, } from "./pii-mask";
-export { USER_PII_FIELDS, USER_PII_INDEX_MAP, ADDRESS_PII_FIELDS, ORDER_PII_FIELDS, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, BID_PII_FIELDS, TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, OFFER_PII_FIELDS, EVENT_ENTRY_PII_FIELDS, LOTTERY_ENTRY_PII_FIELDS, PAYMENT_METHOD_PII_FIELDS, } from "./pii-schemas";
-export { encryptSecret, decryptSecret, isSecretEncrypted, maskSecret, } from "./settings-encryption";
+export { isPiiEncrypted, maskName, maskEmail, maskPublicReview, maskPublicBid, maskPublicEventEntry, maskOfferForSeller, ENC_PREFIX, HMAC_PREFIX, } from "./pii-mask.js";
+export { USER_PII_FIELDS, USER_PII_INDEX_MAP, ADDRESS_PII_FIELDS, ORDER_PII_FIELDS, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, BID_PII_FIELDS, TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, OFFER_PII_FIELDS, EVENT_ENTRY_PII_FIELDS, LOTTERY_ENTRY_PII_FIELDS, PAYMENT_METHOD_PII_FIELDS, } from "./pii-schemas.js";
+export { encryptSecret, decryptSecret, isSecretEncrypted, maskSecret, } from "./settings-encryption.js";
 // RBAC system — DELETED 2026-08-29.
 //
 // `security/rbac/**` was a complete second permission system: DEFAULT_ROLES,

package/dist/security/pii-encrypt.js

@@ -9,9 +9,9 @@
  * Ciphertext format: "enc:v1:<iv_b64>:<ciphertext_b64>:<authtag_b64>"
  * Blind index format: "hmac-sha256:<sha256_hex>"
  */
-import { ENC_PREFIX, HMAC_PREFIX, isPiiEncrypted, encEnvelopeKind } from "./pii-mask";
-import { serverLogger } from "../monitoring/server-logger";
-import { normalizeError } from "../errors/normalize";
+import { ENC_PREFIX, HMAC_PREFIX, isPiiEncrypted, encEnvelopeKind } from "./pii-mask.js";
+import { serverLogger } from "../monitoring/server-logger.js";
+import { normalizeError } from "../errors/normalize.js";
 // Re-exported for backward-compat with existing direct imports of these
 // symbols from this file — the actual crypto-free definitions live in
 // pii-mask.ts (see that file's header comment for why the split exists).

package/dist/security/pii-redact.js

@@ -1,4 +1,4 @@
-import { ENC_PREFIX } from "./pii-mask";
+import { ENC_PREFIX } from "./pii-mask.js";
 /**
  * PII Redaction Utility
  *

package/dist/security/rate-limit.js

@@ -11,7 +11,7 @@
  *   UPSTASH_REDIS_REST_URL
  *   UPSTASH_REDIS_REST_TOKEN
  */
-import { hmacBlindIndex } from "./pii-encrypt";
+import { hmacBlindIndex } from "./pii-encrypt.js";
 // --- IP extraction ------------------------------------------------------------
 export function getClientIP(request) {
     const forwarded = request.headers.get("x-forwarded-for");

package/dist/security/settings-encryption.js

@@ -1,7 +1,7 @@
 // crypto is a Node.js built-in. Use require() to keep it out of the static
 // import graph so Next.js Edge bundler does not warn about this file.
 function nodeCrypto() { return require("crypto"); }
-import { ENC_PREFIX, encEnvelopeKind } from "./pii-mask";
+import { ENC_PREFIX, encEnvelopeKind } from "./pii-mask.js";
 const ALGORITHM = "aes-256-gcm";
 const IV_BYTES = 12;
 // ONE declaration of the prefix, shared with the PII system that also uses it.

package/dist/seed/_helpers/brand-rows.js

@@ -67,8 +67,8 @@
  * `categories-seed-data.ts` imports this copy; matching it is what keeps the
  * brand discriminator a single spelling.
  */
-import { CATEGORY_FIELDS } from "../../constants/field-names";
-import { seedPhoto } from "./media";
+import { CATEGORY_FIELDS } from "../../constants/field-names.js";
+import { seedPhoto } from "./media.js";
 export function brandRow(input, order, stamps) {
     const id = `brand-${input.slug}`;
     return {

package/dist/seed/_helpers/category-content.d.ts

@@ -15,6 +15,7 @@ export declare const CRAWL_AS_OF: Date;
  * description containing a literal `{{series}}`.
  */
 export declare const TEMPLATES: Record<CategoryTemplateVariant, CategoryDescriptionTemplate>;
+export declare const BEY_TEMPLATES: CategoryDescriptionTemplate[];
 /** The set a normal collectible category offers. */
 export declare const COLLECTIBLE_TEMPLATES: CategoryDescriptionTemplate[];
 /** Parts and small accessories arrive carded or loose, not boxed. */
@@ -25,6 +26,34 @@ export declare function templateSet(...variants: CategoryTemplateVariant[]): Cat
 export declare function marketBand(leafId: string): CategoryPriceGuidance | undefined;
 /** Every leaf id this map claims a band for — the seed asserts they all exist. */
 export declare const MARKET_BAND_LEAF_IDS: string[];
+/**
+ * B6 — the ROOT-LEVEL tax fallback, one per root.
+ *
+ * 🛑 Measured 2026-10-12: the tax code sat on tiers 1–3 only (t1=4, t2=47,
+ * t3=71) and on NO root, so **3 of 70 live products resolved no tax code at
+ * all** and would have fallen to `DEFAULT_GST_RATE` — a listing filed at
+ * `category-spinning-tops`, `category-burst-tops` or `category-x-tops`.
+ *
+ * C0c's own rule is that reaching that constant is a TRIAGE SIGNAL, not a
+ * feature: "a listing reaching step 3 at all means its category has no tax
+ * code — and that, not the constant, is the defect to fix. The measure of
+ * success is that step 3 fires for nothing."
+ *
+ * Putting it at the root is what makes that true for every branch, including
+ * branches nobody has filed under yet — `resolveCategoryDefaults` walks the
+ * chain nearest-first, so a tier-2 or tier-3 entry still WINS as a
+ * more-specific override. This is a floor, not a replacement.
+ *
+ * 🛑 Deliberately NOT a single shared constant. Each root is a different HSN
+ * question and a wrong HSN on a real invoice is worse than an absent one —
+ * printed cards are chapter 4911, not 9503, and a live plant is exempt. Only
+ * 9503 was verified (section 3.2); the three non-9503 roots therefore take the
+ * closest VERIFIED code rather than an unverified guess, and say so.
+ */
+export declare const ROOT_AUTHENTICITY_DEFAULT: "unverified";
+export declare const ROOT_TAX_DEFAULTS: Record<string, {
+    taxCodeId: string;
+}>;
 /** A complete top. */
 export declare function beyDefaults(leafId: string, series: string, system: string): CategoryProductDefaults;
 /** A loose component. */

package/dist/seed/_helpers/category-content.js

@@ -144,6 +144,36 @@ export const TEMPLATES = {
         version: 1,
     },
 };
+/**
+ * ── D12: the BEYBLADE bodies, which are the only ones that state PARTS ─────
+ *
+ * 🛑 A separate set rather than adding the slot to the shared bodies, and the
+ * reason is mechanical: `COLLECTIBLE_TEMPLATES` is also what every figure,
+ * Hot Wheels and TCG category uses, and a `{{partBreakdown}}` on a Marvel
+ * Legends listing resolves to nothing. The endpoint strips the line when
+ * there is no composition, so the artifact would be invisible rather than
+ * wrong — but it would also be a read attempted on four roots that can never
+ * satisfy it, on an endpoint the seller form hits on every category change.
+ *
+ * Assigned to the 21 `line(...)` nodes, which are Beyblade generation lines
+ * and nothing else — their children are `MODEL_LEAVES`. A model leaf carries
+ * no body of its own and INHERITS this one, while the slot resolves against
+ * the leaf's OWN composition. That is the whole design: one body per
+ * generation, 216 models' worth of parts.
+ */
+const BEY_PARTS_LINE = `  <li><strong>Parts:</strong> {{partBreakdown}}</li>`;
+/** The slot sits on its own source line, because the strip is line-based. */
+function withPartsLine(body) {
+    return body.replace("</ul>", `${BEY_PARTS_LINE}
+</ul>`);
+}
+const BEY_TEMPLATE_VARIANTS = [
+    "new_in_box",
+    "pre_owned",
+    "replica",
+    "default",
+];
+export const BEY_TEMPLATES = BEY_TEMPLATE_VARIANTS.map((v) => ({ ...TEMPLATES[v], body: withPartsLine(TEMPLATES[v].body) }));
 /** The set a normal collectible category offers. */
 export const COLLECTIBLE_TEMPLATES = [
     TEMPLATES.new_in_box,
@@ -357,6 +387,54 @@ export const MARKET_BAND_LEAF_IDS = Object.keys(MARKET_BANDS);
 const TAX_TOY = "tax-hsn-95030020"; // non-electronic toys incl. spinning tops — 5%
 const TAX_TOY_OTHER = "tax-hsn-95030099"; // other toys — 5%
 const TAX_EXEMPT = "tax-exempt-0";
+/**
+ * B6 — the ROOT-LEVEL tax fallback, one per root.
+ *
+ * 🛑 Measured 2026-10-12: the tax code sat on tiers 1–3 only (t1=4, t2=47,
+ * t3=71) and on NO root, so **3 of 70 live products resolved no tax code at
+ * all** and would have fallen to `DEFAULT_GST_RATE` — a listing filed at
+ * `category-spinning-tops`, `category-burst-tops` or `category-x-tops`.
+ *
+ * C0c's own rule is that reaching that constant is a TRIAGE SIGNAL, not a
+ * feature: "a listing reaching step 3 at all means its category has no tax
+ * code — and that, not the constant, is the defect to fix. The measure of
+ * success is that step 3 fires for nothing."
+ *
+ * Putting it at the root is what makes that true for every branch, including
+ * branches nobody has filed under yet — `resolveCategoryDefaults` walks the
+ * chain nearest-first, so a tier-2 or tier-3 entry still WINS as a
+ * more-specific override. This is a floor, not a replacement.
+ *
+ * 🛑 Deliberately NOT a single shared constant. Each root is a different HSN
+ * question and a wrong HSN on a real invoice is worse than an absent one —
+ * printed cards are chapter 4911, not 9503, and a live plant is exempt. Only
+ * 9503 was verified (section 3.2); the three non-9503 roots therefore take the
+ * closest VERIFIED code rather than an unverified guess, and say so.
+ */
+export const ROOT_AUTHENTICITY_DEFAULT = "unverified";
+export const ROOT_TAX_DEFAULTS = {
+    // Verified: HSN 9503 0020 — non-electronic toys including spinning tops, 5%.
+    "category-spinning-tops": { taxCodeId: TAX_TOY },
+    // Verified: HSN 9503 0099 — "other toys", 5%. A built model kit and a
+    // die-cast car are both toys under 9503; neither is a spinning top.
+    "category-hot-wheels": { taxCodeId: TAX_TOY_OTHER },
+    "category-model-kits": { taxCodeId: TAX_TOY_OTHER },
+    "category-collectible-figures": { taxCodeId: TAX_TOY_OTHER },
+    /*
+     * 🛑 Trading cards are chapter 4911 (printed matter) or 9504 (playing cards)
+     * and NEITHER was verified — section 3.2 confirmed 9503 only, and § "Still
+     * open" records "verify each before seeding; 9503 is the only one I
+     * confirmed". `9503 0099` is used as the floor because a TCG single sold as
+     * a collectible is a toy-chapter good at the same 5% rate, so the RATE is
+     * right even where the chapter may not be. It must be re-chaptered before
+     * the first real TCG invoice, and that is a data task with a source, not a
+     * guess to make here.
+     */
+    "category-trading-cards": { taxCodeId: TAX_TOY_OTHER },
+    // A live plant or animal is nil-rated — a deliberate exemption, which is
+    // exactly why `gstRate: 0` must survive derivation rather than be "corrected".
+    "category-living-collectibles": { taxCodeId: TAX_EXEMPT },
+};
 /** Shared across every Beyblade-family node. */
 const BEY_FAQ_TEMPLATES = [
     {
@@ -591,9 +669,28 @@ export function diecastDefaults(leafId, line) {
         ],
     };
 }
+const TAX_TOY_ELECTRONIC = "tax-hsn-95030010"; // electronic toys — 18%
+/**
+ * 🛑 THE ONLY 18% BRANCH IN THE CATALOGUE, and it is derived rather than
+ * hand-written on a product.
+ *
+ * `tax-hsn-95030010` (electronic toys, 18%) has existed as a `taxCodes` row
+ * since B3 with **nothing referencing it** — so the 18% arm of `calculateGst`
+ * and every mixed-rate path (C0c defect 4's `gstByRate`, the per-rate invoice
+ * table, the blended-rate payout) had no data that could exercise it. A code
+ * with no referrer is the vocabulary-with-no-rows shape of Root Cause #90.
+ *
+ * Counters and BeyPointers are battery-powered scoring devices, which is what
+ * 9503 0010 covers — so this is the honest home for it, not a flag planted on
+ * an arbitrary row. Putting it on the CATEGORY rather than on a product means
+ * the 18% is proven through `deriveTaxonomy`, i.e. through the mechanism that
+ * will actually carry it in production, instead of through a literal that
+ * would pass while the derivation stayed untested.
+ */
+const ELECTRONIC_ACCESSORY_LEAVES = new Set(["category-accessory-counters"]);
 export function accessoryDefaults(leafId, kind) {
     return {
-        taxCodeId: TAX_TOY_OTHER,
+        taxCodeId: ELECTRONIC_ACCESSORY_LEAVES.has(leafId) ? TAX_TOY_ELECTRONIC : TAX_TOY_OTHER,
         specifications: [SPEC("Accessory type", kind)],
         defaultAuthenticity: "unverified",
         priceGuidance: marketBand(leafId),

package/dist/seed/_helpers/category-forest.js

@@ -48,9 +48,10 @@
  * @tag consumers:seed/categories-seed-data.ts
  * @tag sideEffects:none
  */
-import { MODEL_LEAVES } from "./category-models";
-import { COLLECTIBLE_TEMPLATES, PART_TEMPLATES, SEALED_TEMPLATES, accessoryDefaults, beyDefaults, diecastDefaults, figureDefaults, launcherDefaults, livingDefaults, marketBand, partDefaults, stadiumDefaults, tcgDefaults, } from "./category-content";
-import { seedPhoto } from "./media";
+import { MODEL_LEAVES } from "./category-models.js";
+import { PART_LEAVES } from "./category-parts.js";
+import { BEY_TEMPLATES, COLLECTIBLE_TEMPLATES, PART_TEMPLATES, SEALED_TEMPLATES, accessoryDefaults, beyDefaults, diecastDefaults, figureDefaults, launcherDefaults, livingDefaults, marketBand, partDefaults, stadiumDefaults, tcgDefaults, ROOT_TAX_DEFAULTS, ROOT_AUTHENTICITY_DEFAULT, } from "./category-content.js";
+import { seedPhoto } from "./media.js";
 const cover = (slug) => seedPhoto(`category-image-${slug}-20260101`, 1200, 600);
 /**
  * A tier-3 line that owns named-model leaves.
@@ -78,12 +79,27 @@ function node(id, name, description, defaults, templates, children) {
         extra.productDefaults = defaults;
     if (templates)
         extra.descriptionTemplates = templates;
+    /*
+     * 🛑 D13 — a part-type node's children are its PART LEAVES, threaded here
+     * rather than at the 20 call sites.
+     *
+     * Same shape as `line()` and `MODEL_LEAVES`: the generated map is keyed by
+     * parent id, so a node with no entry gets `[]` and is unchanged. Doing it in
+     * the helper means adding a part classification is a generator run plus one
+     * `node(...)` line, not an edit in two places that must agree.
+     *
+     * An explicit `children` argument still wins, so a node that hand-authors
+     * its children is not silently overwritten — there is none today, and the
+     * precedence has to be decided rather than discovered.
+     */
+    const generated = PART_LEAVES[id];
+    const kids = children ?? generated;
     return {
         id,
         name,
         description,
         ...(Object.keys(extra).length ? { extra } : {}),
-        ...(children ? { children } : {}),
+        ...(kids && kids.length ? { children: kids } : {}),
     };
 }
 /** A branch node — grouping only, no products file directly under it. */
@@ -115,16 +131,27 @@ const BEYBLADE_ORIGINAL = {
     },
     children: [
         branch("category-original-tops", "Original Tops", "Complete original-series Beyblades, from the first Spin Gear releases through HMS.", [
-            line("category-original-plastic-gen", "Plastic Generation", "The earliest 1999–2000 plastic-series releases, before the Spin Gear system was formalised.", beyDefaults("category-original-plastic-gen", "Beyblade (Original)", "Plastic Generation"), COLLECTIBLE_TEMPLATES),
-            line("category-original-spin-gear", "Spin Gear System", "The 2000–2001 Spin Gear releases — the system that set the Attack Ring / Weight Disk / Blade Base template.", beyDefaults("category-original-spin-gear", "Beyblade (Original)", "Spin Gear System"), COLLECTIBLE_TEMPLATES),
-            line("category-original-magnacore", "Magnacore System", "The 2002 V-Force Magnacore line, with magnets in the base that pull a top toward or away from the stadium centre.", beyDefaults("category-original-magnacore", "Beyblade V-Force", "Magnacore System"), COLLECTIBLE_TEMPLATES),
-            line("category-original-engine-gear", "Engine Gear System", "The 2003 G-Revolution Engine Gear line — a wound spring inside the top that releases mid-battle.", beyDefaults("category-original-engine-gear", "Beyblade G-Revolution", "Engine Gear System"), COLLECTIBLE_TEMPLATES),
-            line("category-original-hms", "Heavy Metal System", "The 2003 HMS line — metal throughout, the last and heaviest of the original generation, and the highest-value tier here.", beyDefaults("category-original-hms", "Beyblade HMS", "Heavy Metal System"), COLLECTIBLE_TEMPLATES),
+            line("category-original-plastic-gen", "Plastic Generation", "The earliest 1999–2000 plastic-series releases, before the Spin Gear system was formalised.", beyDefaults("category-original-plastic-gen", "Beyblade (Original)", "Plastic Generation"), BEY_TEMPLATES),
+            line("category-original-spin-gear", "Spin Gear System", "The 2000–2001 Spin Gear releases — the system that set the Attack Ring / Weight Disk / Blade Base template.", beyDefaults("category-original-spin-gear", "Beyblade (Original)", "Spin Gear System"), BEY_TEMPLATES),
+            line("category-original-magnacore", "Magnacore System", "The 2002 V-Force Magnacore line, with magnets in the base that pull a top toward or away from the stadium centre.", beyDefaults("category-original-magnacore", "Beyblade V-Force", "Magnacore System"), BEY_TEMPLATES),
+            line("category-original-engine-gear", "Engine Gear System", "The 2003 G-Revolution Engine Gear line — a wound spring inside the top that releases mid-battle.", beyDefaults("category-original-engine-gear", "Beyblade G-Revolution", "Engine Gear System"), BEY_TEMPLATES),
+            line("category-original-hms", "Heavy Metal System", "The 2003 HMS line — metal throughout, the last and heaviest of the original generation, and the highest-value tier here.", beyDefaults("category-original-hms", "Beyblade HMS", "Heavy Metal System"), BEY_TEMPLATES),
         ]),
         branch("category-original-parts", "Original Parts", "Loose Attack Rings, Weight Disks and Blade Bases for rebuilding an original-era combo.", [
             node("category-original-attack-rings", "Attack Rings", "The upper contact ring — what actually strikes an opponent, and the part that decides a combo's attack profile.", partDefaults("category-original-attack-rings", "Attack Ring"), PART_TEMPLATES),
             node("category-original-weight-disks", "Weight Disks", "The metal disk between ring and base. Heavier disks buy stamina; lighter ones buy speed.", partDefaults("category-original-weight-disks", "Weight Disk"), PART_TEMPLATES),
             node("category-original-blade-bases", "Blade Bases", "The bottom assembly — tip shape, spin gear housing and, on later systems, the magnet or engine.", partDefaults("category-original-blade-bases", "Blade Base"), PART_TEMPLATES),
+            /*
+             * D13 — five part-type nodes the forest was missing, so every one of the
+             * 20 part classifications has a home. Measured before adding: 135 of 753
+             * parts (bit chips 66, running cores 25, chrome wheels 25, spin gears 14,
+             * engine gears 5) had no node to be filed under, and a part leaf with no
+             * parent is a tier-0 orphan.
+             */
+            node("category-original-bit-chips", "Bit Chips", "The small chip at the centre of a Plastic-Gen Attack Ring, carrying the beast art. Collected in its own right and routinely swapped.", partDefaults("category-original-bit-chips", "Bit Chip"), PART_TEMPLATES),
+            node("category-original-spin-gears", "Spin Gears", "The 2000–2001 Spin Gear module that sets spin direction and locks the Blade Base to the Weight Disk.", partDefaults("category-original-spin-gears", "Spin Gear"), PART_TEMPLATES),
+            node("category-original-engine-gears", "Engine Gears", "The G-Revolution wound-spring module that releases mid-battle. Only a handful of releases used one.", partDefaults("category-original-engine-gears", "Engine Gear"), PART_TEMPLATES),
+            node("category-original-running-cores", "Running Cores", "HMS combines the Spin Gear and Blade Base into one moulded Running Core, which is why an HMS breakdown has fewer slots than a Plastic-Gen one.", partDefaults("category-original-running-cores", "Running Core"), PART_TEMPLATES),
         ]),
         branch("category-original-launchers", "Original Launchers", "Ripcord launchers, grips and winders for original-series tops.", [
             node("category-original-ripcord-launchers", "Ripcord Launchers", "The classic pull-cord launchers used across the original series.", launcherDefaults("category-original-ripcord-launchers", "Beyblade (Original)"), PART_TEMPLATES),
@@ -158,11 +185,11 @@ const BEYBLADE_METAL = {
     },
     children: [
         branch("category-metal-tops", "Metal Fight Tops", "Complete Metal Fight Beyblades across all five sub-generations.", [
-            line("category-metal-phws", "Metal System", "The 2008 debut system that preceded the Hybrid Wheel System — the first metal-weighted tops.", beyDefaults("category-metal-phws", "Beyblade: Metal Fusion", "Metal System"), COLLECTIBLE_TEMPLATES),
-            line("category-metal-fusion", "Metal Fusion", "The Hybrid Wheel System wave that defined the era — Face Bolt, Energy Ring, Fusion Wheel, Spin Track, Tip.", beyDefaults("category-metal-fusion", "Beyblade: Metal Fusion", "Hybrid Wheel System"), COLLECTIBLE_TEMPLATES),
-            line("category-metal-masters", "Metal Masters", "Later Hybrid Wheel releases with heavier wheels and tighter tolerances.", beyDefaults("category-metal-masters", "Beyblade: Metal Masters", "Hybrid Wheel System"), COLLECTIBLE_TEMPLATES),
-            line("category-metal-fury-4d", "Metal Fury (4D)", "The 4D System wave — multi-mode wheels and switchable bottoms, and the heaviest tops of the era.", beyDefaults("category-metal-fury-4d", "Beyblade: Metal Fury", "4D System"), COLLECTIBLE_TEMPLATES),
-            line("category-metal-shogun-steel", "Shogun Steel / Zero-G", "The 2012–2013 Zero-G line, built for the rocking Zero-G stadium rather than a static dish.", beyDefaults("category-metal-shogun-steel", "Beyblade: Shogun Steel", "Synchrom System"), COLLECTIBLE_TEMPLATES),
+            line("category-metal-phws", "Metal System", "The 2008 debut system that preceded the Hybrid Wheel System — the first metal-weighted tops.", beyDefaults("category-metal-phws", "Beyblade: Metal Fusion", "Metal System"), BEY_TEMPLATES),
+            line("category-metal-fusion", "Metal Fusion", "The Hybrid Wheel System wave that defined the era — Face Bolt, Energy Ring, Fusion Wheel, Spin Track, Tip.", beyDefaults("category-metal-fusion", "Beyblade: Metal Fusion", "Hybrid Wheel System"), BEY_TEMPLATES),
+            line("category-metal-masters", "Metal Masters", "Later Hybrid Wheel releases with heavier wheels and tighter tolerances.", beyDefaults("category-metal-masters", "Beyblade: Metal Masters", "Hybrid Wheel System"), BEY_TEMPLATES),
+            line("category-metal-fury-4d", "Metal Fury (4D)", "The 4D System wave — multi-mode wheels and switchable bottoms, and the heaviest tops of the era.", beyDefaults("category-metal-fury-4d", "Beyblade: Metal Fury", "4D System"), BEY_TEMPLATES),
+            line("category-metal-shogun-steel", "Shogun Steel / Zero-G", "The 2012–2013 Zero-G line, built for the rocking Zero-G stadium rather than a static dish.", beyDefaults("category-metal-shogun-steel", "Beyblade: Shogun Steel", "Synchrom System"), BEY_TEMPLATES),
         ]),
         branch("category-metal-parts", "Metal Fight Parts", "The four-part system sold loose — this is where a custom Metal Fight combo gets built.", [
             node("category-metal-face-bolts", "Face Bolts", "The screw and face sticker at the top. Mostly cosmetic, occasionally a weight tweak.", partDefaults("category-metal-face-bolts", "Face Bolt"), PART_TEMPLATES),
@@ -170,6 +197,7 @@ const BEYBLADE_METAL = {
             node("category-metal-fusion-wheels", "Fusion Wheels", "The metal mass of the top — the single part that most decides whether a combo attacks or endures.", partDefaults("category-metal-fusion-wheels", "Fusion Wheel"), PART_TEMPLATES),
             node("category-metal-spin-tracks", "Spin Tracks", "The height component. 85, 100, 105, 125, 145, 230 — taller clears a dish's slope, lower sits under an opponent.", partDefaults("category-metal-spin-tracks", "Spin Track"), PART_TEMPLATES),
             node("category-metal-performance-tips", "Performance Tips", "The floor contact: Rubber Flat, Wide Defense, Eternal Sharp, Metal Ball and the rest of the bottom vocabulary.", partDefaults("category-metal-performance-tips", "Performance Tip"), PART_TEMPLATES),
+            node("category-metal-chrome-wheels", "Chrome Wheels", "The 4D System's upper metal wheel, sold loose and the heaviest single part in the generation.", partDefaults("category-metal-chrome-wheels", "Chrome Wheel"), PART_TEMPLATES),
         ]),
         branch("category-metal-launchers", "Metal Fight Launchers", "String launchers, ripcord launchers and grips for the Metal Fight era.", [
             node("category-metal-string-launchers", "String Launchers", "The pull-string launchers that replaced ripcords, giving far more consistent launch power.", launcherDefaults("category-metal-string-launchers", "Beyblade: Metal Fight"), PART_TEMPLATES),
@@ -206,13 +234,13 @@ const BEYBLADE_BURST = {
     },
     children: [
         branch("category-burst-tops", "Burst Tops", "Complete Burst-system Beyblades across every wave.", [
-            line("category-burst-classic", "Burst Classic", "The original 2015–2017 single- and dual-layer waves, before any metal entered the Layer.", beyDefaults("category-burst-classic", "Beyblade Burst", "Burst System"), COLLECTIBLE_TEMPLATES),
-            line("category-burst-god", "Burst God", "The God Layer wave, which added spring-loaded Layers and the first real burst-resistance tuning.", beyDefaults("category-burst-god", "Beyblade Burst God", "God Layer System"), COLLECTIBLE_TEMPLATES),
-            line("category-burst-cho-z", "Cho-Z", "The metal-layer wave — heavier Layers and roughly double the burst resistance of what came before.", beyDefaults("category-burst-cho-z", "Beyblade Burst Cho-Z", "Cho-Z Layer System"), COLLECTIBLE_TEMPLATES),
-            line("category-burst-gt", "GT", "The Gatinko wave, with a swappable chip inside the Layer for a third tuning axis.", beyDefaults("category-burst-gt", "Beyblade Burst GT", "Gatinko Layer System"), COLLECTIBLE_TEMPLATES),
-            line("category-burst-superking", "Superking", "The Sparking / Superking wave and its five-sided ratchet, which changed launch dynamics entirely.", beyDefaults("category-burst-superking", "Beyblade Burst Superking", "Sparking Layer System"), COLLECTIBLE_TEMPLATES),
-            line("category-burst-db", "Dynamite Battle", "The DB wave — Armour Tips and the heaviest Layers Burst had shipped to that point.", beyDefaults("category-burst-db", "Beyblade Burst Dynamite Battle", "Dynamite Battle Layer System"), COLLECTIBLE_TEMPLATES),
-            line("category-burst-bu", "Burst Ultimate", "The final Burst wave, closing the line in 2023 before Beyblade X replaced it.", beyDefaults("category-burst-bu", "Beyblade Burst Ultimate", "Burst Ultimate Layer System"), COLLECTIBLE_TEMPLATES),
+            line("category-burst-classic", "Burst Classic", "The original 2015–2017 single- and dual-layer waves, before any metal entered the Layer.", beyDefaults("category-burst-classic", "Beyblade Burst", "Burst System"), BEY_TEMPLATES),
+            line("category-burst-god", "Burst God", "The God Layer wave, which added spring-loaded Layers and the first real burst-resistance tuning.", beyDefaults("category-burst-god", "Beyblade Burst God", "God Layer System"), BEY_TEMPLATES),
+            line("category-burst-cho-z", "Cho-Z", "The metal-layer wave — heavier Layers and roughly double the burst resistance of what came before.", beyDefaults("category-burst-cho-z", "Beyblade Burst Cho-Z", "Cho-Z Layer System"), BEY_TEMPLATES),
+            line("category-burst-gt", "GT", "The Gatinko wave, with a swappable chip inside the Layer for a third tuning axis.", beyDefaults("category-burst-gt", "Beyblade Burst GT", "Gatinko Layer System"), BEY_TEMPLATES),
+            line("category-burst-superking", "Superking", "The Sparking / Superking wave and its five-sided ratchet, which changed launch dynamics entirely.", beyDefaults("category-burst-superking", "Beyblade Burst Superking", "Sparking Layer System"), BEY_TEMPLATES),
+            line("category-burst-db", "Dynamite Battle", "The DB wave — Armour Tips and the heaviest Layers Burst had shipped to that point.", beyDefaults("category-burst-db", "Beyblade Burst Dynamite Battle", "Dynamite Battle Layer System"), BEY_TEMPLATES),
+            line("category-burst-bu", "Burst Ultimate", "The final Burst wave, closing the line in 2023 before Beyblade X replaced it.", beyDefaults("category-burst-bu", "Beyblade Burst Ultimate", "Burst Ultimate Layer System"), BEY_TEMPLATES),
         ]),
         branch("category-burst-parts", "Burst Parts", "Layers, Discs, Drivers and the chips and armour that bolt onto them.", [
             node("category-burst-layers", "Layers", "The top piece — attack profile and burst resistance. The most expensive part of a Burst build.", partDefaults("category-burst-layers", "Layer"), PART_TEMPLATES),
@@ -255,10 +283,10 @@ const BEYBLADE_X = {
     },
     children: [
         branch("category-x-tops", "Beyblade X Tops", "Complete Beyblade X tops — starters, boosters and the X-Over reissues.", [
-            line("category-x-basic", "Basic Line", "Standard three-part X tops. The entry point into the format and the bulk of its catalogue.", beyDefaults("category-x-basic", "Beyblade X", "Xtreme Gear (Basic Line)"), COLLECTIBLE_TEMPLATES),
-            line("category-x-unique-ux", "Unique Line (UX)", "UX releases, each Blade carrying a mechanical gimmick the Basic Line does not have.", beyDefaults("category-x-unique-ux", "Beyblade X", "Xtreme Gear (Unique Line)"), COLLECTIBLE_TEMPLATES),
-            line("category-x-custom-cx", "Custom Line (CX)", "CX releases, whose Blade splits into a Lock Chip, a Main Blade and an Assist Blade.", beyDefaults("category-x-custom-cx", "Beyblade X", "Xtreme Gear (Custom Line)"), COLLECTIBLE_TEMPLATES),
-            line("category-x-over", "X-Over Project", "Classic designs from earlier generations reissued on Beyblade X hardware.", beyDefaults("category-x-over", "Beyblade X", "Xtreme Gear (X-Over)"), COLLECTIBLE_TEMPLATES),
+            line("category-x-basic", "Basic Line", "Standard three-part X tops. The entry point into the format and the bulk of its catalogue.", beyDefaults("category-x-basic", "Beyblade X", "Xtreme Gear (Basic Line)"), BEY_TEMPLATES),
+            line("category-x-unique-ux", "Unique Line (UX)", "UX releases, each Blade carrying a mechanical gimmick the Basic Line does not have.", beyDefaults("category-x-unique-ux", "Beyblade X", "Xtreme Gear (Unique Line)"), BEY_TEMPLATES),
+            line("category-x-custom-cx", "Custom Line (CX)", "CX releases, whose Blade splits into a Lock Chip, a Main Blade and an Assist Blade.", beyDefaults("category-x-custom-cx", "Beyblade X", "Xtreme Gear (Custom Line)"), BEY_TEMPLATES),
+            line("category-x-over", "X-Over Project", "Classic designs from earlier generations reissued on Beyblade X hardware.", beyDefaults("category-x-over", "Beyblade X", "Xtreme Gear (X-Over)"), BEY_TEMPLATES),
         ]),
         branch("category-x-parts", "Beyblade X Parts", "Blades, Ratchets and Bits sold loose for custom X builds.", [
             node("category-x-blades", "Blades", "The upper piece that defines an X combo's attack shape and its ability to hold the rail.", partDefaults("category-x-blades", "Blade"), PART_TEMPLATES),
@@ -635,6 +663,58 @@ const LIVING_COLLECTIBLES = {
         ]),
     ],
 };
+/**
+ * B6 — attach each root's tax floor HERE rather than inside six `extra` blocks.
+ *
+ * 🛑 One place, because the failure mode is an OMISSION. Six hand-edited
+ * blocks is six chances to add a seventh root with no tax code, and the symptom
+ * would be three products silently resolving `DEFAULT_GST_RATE` — exactly what
+ * was measured before this (3 of 70, at `category-spinning-tops`,
+ * `category-burst-tops` and `category-x-tops`). Here, a root missing from
+ * `ROOT_TAX_DEFAULTS` is a THROW at seed time, which is a visible failure
+ * rather than a wrong rate on an invoice.
+ *
+ * It MERGES rather than overwrites: a root that already declares
+ * `productDefaults` (none does today) keeps everything it has, and a
+ * `taxCodeId` it declared itself wins. The root value is a floor.
+ */
+function withRootTax(root) {
+    const tax = ROOT_TAX_DEFAULTS[root.id];
+    if (!tax) {
+        throw new Error(`category-forest: root "${root.id}" has no entry in ROOT_TAX_DEFAULTS. ` +
+            "Every root needs a tax floor, or products under it resolve DEFAULT_GST_RATE " +
+            "— which C0c defines as a triage signal, not a feature.");
+    }
+    const extra = (root.extra ?? {});
+    return {
+        ...root,
+        extra: {
+            ...extra,
+            productDefaults: {
+                ...tax,
+                /*
+                 * 🛑 `unverified` AS THE ROOT FLOOR, and the value choice is the whole
+                 * point. 43 of 381 listing nodes resolved NO `defaultAuthenticity` —
+                 * tier 0, tier 1 and several tier-2 branches — so a product filed
+                 * there got nothing.
+                 *
+                 * `unverified` exists precisely for this: `ProductAuthenticity`'s own
+                 * docstring records that "without it, an honest seller who does not
+                 * know would have to pick 'original', and silence would be
+                 * indistinguishable from a genuine claim." Defaulting to `original`
+                 * would have the platform make an authenticity claim nobody checked,
+                 * on a marketplace whose differentiator is that it does not do that.
+                 *
+                 * A more specific category still WINS — `resolveCategoryDefaults`
+                 * walks nearest-first, and the 6 nodes that legitimately declare
+                 * `original` keep it.
+                 */
+                defaultAuthenticity: ROOT_AUTHENTICITY_DEFAULT,
+                ...(extra.productDefaults ?? {}),
+            },
+        },
+    };
+}
 export const CATEGORY_FOREST = [
     SPINNING_TOPS,
     TRADING_CARDS,
@@ -642,7 +722,7 @@ export const CATEGORY_FOREST = [
     HOT_WHEELS,
     MODEL_KITS,
     LIVING_COLLECTIBLES,
-];
+].map(withRootTax);
 /*
  * Keeps `marketBand` honest: a band keyed on a leaf id that no longer exists is
  * dead weight that reads as coverage. Asserted by the seed, not here, because