test(policy): Seam B — production-altitude successor floor pin via the REAL SeatHandoverService + stale resolveRestorePosture comment fix (Guard proof/comment finding at c203812f; production logic frozen)

Co-Authored-By: Claude Fable 5 <[email protected]>

packages/daemon/src/domain/restore-orchestrator.ts

@@ -1249,7 +1249,8 @@ export class RestoreOrchestrator {
    *   2. No provenance (e.g. organic claim/self-attach seats): the persisted RIG-level ref
    *      resolves — builtin refs resolve dirlessly; a custom rig ref without provenance
    *      degrades to the resolver's advisory floor (honest absence of a declaring dir).
-   *   3. Nothing attached → undefined (the env-driven 0.4.8.2 decision, unchanged).
+   *   3. Nothing attached (or a resolution error) → EXPLICIT "floor" — the locked
+   *      minimum-floor absence contract; never undefined/env-delegation for managed seats.
    */
   private resolveRestorePosture(nodeId: string, rigId: string): "floor" | "full_bypass" {
     try {

packages/daemon/test/permission-policy-lifecycle.test.ts

@@ -642,17 +642,9 @@ describe("ABSENCE = locked floor at every lifecycle surface (R2 HIGH at 954d97a0
     } finally { rmSync(dir, { recursive: true, force: true }); vi.unstubAllEnvs(); }
   });
 
-  it("RED: successor continuity for a NO-attachment seat carries EXPLICIT floor", async () => {
-    const db = createFullTestDb();
-    const setup = createTestApp(db, { podInstantiatorFsOps: fsOps() });
-    const rig = setup.rigRepo.createRig("absent-rig-2");
-    const organic = setup.rigRepo.addNode(rig.id, "dev.bare2", { runtime: "claude-code", cwd: "/w" });
-    const successorPosture = setup.rigRepo.getNodePolicyProvenance(organic.id)?.launchPosture
-      ?? setup.rigRepo.getRigPolicyProvenance(rig.id)?.launchPosture
-      ?? "floor";
-    expect(successorPosture).toBe("floor");
-    db.close();
-  });
+  // (successor-absence pin lives at PRODUCTION altitude in seat-handover-service.test.ts —
+  //  the helper-only variant was removed per Guard at c203812f: it re-computed the fallback
+  //  chain instead of driving SeatHandoverService.)
 
   it("adapter parity under env YOLO: an ABSENT-attachment lifecycle binding (explicit floor) emits FLOOR commands on all three families", async () => {
     vi.stubEnv("OPENRIG_YOLO", "1");

packages/daemon/test/seat-handover-service.test.ts

@@ -233,6 +233,28 @@ describe("SeatHandoverService", () => {
 
   const SUCCESSOR_NAME = "dev-impl@seat-rig-h1SUCCID0";
 
+  it("Seam B (R2/Guard): a fresh handover for a NO-policy seat launches the REAL successor at EXPLICIT floor, even under ambient OPENRIG_YOLO", async () => {
+    // Production altitude: the pin drives SeatHandoverService.handover() end-to-end and
+    // asserts the binding the REAL launchHarness call received — never a re-computed
+    // fallback chain (the helper-only false-green Guard rejected at c203812f).
+    vi.stubEnv("OPENRIG_YOLO", "1");
+    try {
+      seedSeat({ runtime: "codex" }); // no node/rig policy provenance anywhere
+      const result = await service.handover({
+        seatRef: "dev-impl@seat-rig",
+        reason: "context-wall",
+        source: "fresh",
+        operator: "orch-lead@seat-rig",
+      });
+      expect(result.ok).toBe(true);
+      expect(launchHarness).toHaveBeenCalledTimes(1);
+      const successorBinding = launchHarness.mock.calls[0]![0] as { launchPosture?: string };
+      // locked absence contract: the continuity edge binds the minimum floor explicitly —
+      // ambient YOLO must not widen an attachment-less successor.
+      expect(successorBinding.launchPosture).toBe("floor");
+    } finally { vi.unstubAllEnvs(); }
+  });
+
   it("composes the full cycle for a fresh source: create -> deliver -> verify -> rebind", async () => {
     const { node } = seedSeat({ runtime: "codex" });