Adds an admission-time check in GrantAuthority resolution that rejects a
Subject grant nested inside a same-kind PlaceSubtree grant the holder
already has, and the reverse, using the live covering predicate. This is
admission-only: targets_overlap and verify_state_shape stay structural and
position-independent, and a later Relocate that creates the same nesting
is never re-derived as a violation.
Extends the action lane's check_delegation to gate RevokeAuthority slots
by the same monotonicity envelope it already applies to GrantAuthority:
an actor may not strip authority it does not itself hold. Adds a fixture
"revoke" affordance to exercise both the covering and non-covering cases.
Adds an end-to-end test for the fixture's "deploy" affordance (Relocate
lowering) plus its precondition's negative case.
Updates the two existing tests whose assumptions depended on the old gap
(a Subject grant silently nesting inside a PlaceSubtree grant) to assert
the new rejection instead.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
65ee2be41a