Test-only. No production code changes: nothing here found a real bug.
PA.f27: require_ruler's own coverage gaps.
- apply_effect_re_decides_the_ruler_for_the_owner_too: a forged
PatchAdmitted under the owner (CallerId::Principal), carrying a Ruled
fact, is refused at apply exactly as it is for an elaborator. Kills an
exemption for Principal in apply_effect's re-decision.
- require_ruler_catches_a_mint_past_the_first_operation: a harmless
Relocate at index 0 followed by a Mint at index 1, from a non-Play
author, is refused at index 1. Kills a scan narrowed to .take(1).
- require_ruler_reports_every_ruled_fact: two Ruled facts from a non-Play
author are both reported. Kills a check narrowed to the first fact.
PA.f29: the evidence gate, extended and carried to the document path.
- the_evidence_gate_is_unchanged_for_every_author now also covers the
owner in Draft (the seed's caller), the owner in Active with a real
boundary answer, an answered elaborator, and a consumer on its own
mirror. Each pair proves an uncited Canonical fact or Admit is refused
(FactWithoutEvidence / AdmitWithoutEvidence) and the same content, cited,
is admitted. The owner/elaborator "cited" patches also seat a fresh
occupant at the dead end so the Boundary answer they must supply in
Active is genuinely cleared, rather than masked by AnswerNotSatisfied.
- a_document_carrying_a_mint_is_refused_through_admit_document (in
consumer.rs): a consumer document carrying a Mint is refused through the
real decode path, admit_document, not only the in-process as_consumer
fixture caller other tests use.
PA.f30: confinement and controller edge cases.
- a_consumer_cannot_retire_grant_or_revoke (consumer.rs): Retire,
GrantAffordance and RevokeAffordance from a consumer are refused.
Soul: every subject choice available to a consumer is also caught by an
upstream structural gate (a mirror can never hold a grant or be retired;
no non-mirror subject can ever bind to a consumer's own ground), so this
specific narrowing — confine_to_ground confining only for an elaborator
jurisdiction, not a consumer — is not independently killable from the
consumer side. The refusal itself is real and the finding calls for the
test, so it is kept; the redundancy is recorded in the test's own
comment rather than dropped silently.
- a_revoke_cannot_leave_a_human_subject_mute: the last-verb refusal for
RevokeAffordance holds for a Human-controlled subject exactly as for any
other controller kind.
- retired_expects_no_caller: a direct unit pin that
ControllerAssignment::Retired.expected_caller() is None.
All three production-touching mutations described by the finding (the two
require_ruler scans, and a hypothetical Human exemption on the last-verb
check) were applied by hand, confirmed to fail the new test, and reverted;
git status is clean.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
c97fad2483