Every surface that acts resolves availability, not just the nav

apps/web/prisma/migrations/20260821163000_index_the_manifest_lookup/migration.sql

@@ -0,0 +1,19 @@
+-- Index the read that decides capability availability.
+--
+-- `capability-registry/manifest.ts` answers "what does this tenant's manifest
+-- declare?" with the newest `Tenant.Reconciled` audit row for the institution.
+-- Until this slice that ran once per page render, from the app layout. It now
+-- also runs on every route bound to a capability and on every fifteen-second
+-- poll of /api/reports/pulse, so its cost sits on ordinary traffic.
+--
+-- The existing ("institutionId", "occurredAt") index cannot serve it: the
+-- planner walks that institution's audit history backwards, discarding every
+-- row whose action is not Tenant.Reconciled. For a tenant with NO reconcile row
+-- — which is every tenant today, the pilot included — that is a walk of the
+-- whole history to return nothing, and an append-only log only grows.
+--
+-- Putting "action" between the two makes it a single index seek. The cost is
+-- one more index to maintain on an insert-only table, which is the right side
+-- of the trade for a read that is now on the request path.
+CREATE INDEX "AuditEvent_institutionId_action_occurredAt_idx"
+  ON "AuditEvent"("institutionId", "action", "occurredAt");

apps/web/prisma/schema.prisma

@@ -1050,6 +1050,14 @@ model AuditEvent {
   @@index([institutionId, occurredAt])
   @@index([actorId, occurredAt])
   @@index([resourceType, resourceId])
+  // The capability resolver's input. `capability-registry/manifest.ts` reads the
+  // newest `Tenant.Reconciled` row for a tenant, and since the availability gate
+  // moved onto the routes and the polled endpoint that read runs on ordinary
+  // page traffic rather than once in a while. On [institutionId, occurredAt]
+  // alone, a tenant with NO reconcile row — which is every tenant today — costs
+  // a backwards walk of its entire audit history to return nothing, and that
+  // history only grows.
+  @@index([institutionId, action, occurredAt])
 }
 
 // ─── Institution role transfers ───────────────────────────────────────────────

apps/web/src/app/(app)/admin/metering/page.tsx

@@ -6,9 +6,7 @@ import { hasCapability } from "@/lib/admin/capabilities"
 import { withTenantScope } from "@/lib/tenant-scope"
 import { currentTerm } from "@/lib/tenant/term"
 import { institutionTimeZone } from "@/lib/institution-time"
-import { CAPABILITY_REGISTRY, PILOT_SCOPE } from "@/lib/capability-registry/registry"
-import { declaredModules } from "@/lib/capability-registry/manifest"
-import { resolveCapability } from "@/lib/capability-registry/resolve"
+import { offeredTo } from "@/lib/capability-registry/gate"
 import { academicYearPeriod, meteredQuantityToDate, reconcileSeatMeter } from "@/lib/billing/seat-meter"
 import { Card, CardHeader } from "@/components/ui/Card"
 import { Badge } from "@/components/ui/Badge"
@@ -26,11 +24,19 @@ export const dynamic = "force-dynamic"
  *
  * `billing.viewMeter` asks WHO MAY SEE IT and is Director-only: the quantity is
  * a term of a contract, and the seat that signs the contract is the Director's.
- * `resolveCapability("payments.seat-metering")` asks WHETHER THIS DEPLOYMENT
- * OFFERS IT AT ALL, which is a per-tenant question with no user in it. Audit
- * §8.2 requires the second — availability must never be a consequence of the
- * code existing — and `capability-registry/types.ts` is explicit that merging
- * the two would be a security bug rather than a tidy-up.
+ * `offeredTo("payments.seat-metering")` asks WHETHER THIS DEPLOYMENT OFFERS IT
+ * AT ALL, which is a per-tenant question with no user in it. Audit §8.2
+ * requires the second — availability must never be a consequence of the code
+ * existing — and `capability-registry/types.ts` is explicit that merging the
+ * two would be a security bug rather than a tidy-up.
+ *
+ * The second gate went through `resolveCapability` directly, assembling the
+ * scope, the registry and the tenant's declared modules at this call site. That
+ * predates `capability-registry/gate.ts`, which exists so that every acting
+ * surface asks the same question the same way — and a hand-assembled copy of
+ * the resolver call is how the four arguments drift apart, one surface at a
+ * time. `offeredTo` is that exact call; this now makes it rather than repeating
+ * it, and `enforcement.test.ts` holds the binding in `routes.ts` to it.
  *
  * Both refuse with `notFound()` rather than a message, matching every other
  * admin surface: a page that says "you may not see this" has told you it
@@ -61,12 +67,7 @@ export default async function AdminMeteringPage() {
   const { userId, ctx, institutionId } = await requireAdminContext()
   if (!hasCapability(ctx, "billing.viewMeter", institutionId)) notFound()
 
-  const offered = resolveCapability(
-    "payments.seat-metering",
-    PILOT_SCOPE,
-    CAPABILITY_REGISTRY,
-    await declaredModules(institutionId),
-  )
+  const offered = await offeredTo("payments.seat-metering", institutionId)
   if (!offered.available) notFound()
 
   return withTenantScope(userId, async () => {

apps/web/src/app/(app)/orgs/[slug]/handoff/page.tsx

@@ -9,6 +9,8 @@ import {
   toSeatFacts,
 } from "@/lib/seats"
 import { auth } from "@/lib/auth"
+import { offeredTo } from "@/lib/capability-registry/gate"
+import { CapabilityUnavailable } from "@/components/CapabilityUnavailable"
 import { db } from "@/lib/db"
 import { canViewOrg, getUserContext } from "@/lib/rbac"
 import { withTenantScope } from "@/lib/tenant-scope"
@@ -73,6 +75,25 @@ export default async function HandoffPage({
     const ctx = await getUserContext(session.user.id)
     if (!canViewOrg(ctx, org)) notFound()
 
+    // Bound to `collaboration.institutional-memory` in routes.ts — the handoff
+    // packet is the preserved knowledge for a seat, so it is the same capability
+    // the memory route carries, and a tenant that does not have one does not
+    // have the other.
+    const memory = await offeredTo("collaboration.institutional-memory", org.institutionId)
+    if (!memory.available)
+      return (
+        <div className="w-full">
+          <div className="mb-6">
+            <h1 className="text-text-1">{org.name}</h1>
+          </div>
+          {/* The refusal keeps the club's tab strip. Members, Finance,
+              Documents and Impact are unaffected by this capability, and a page
+              that withholds one thing must not also strand the person on it. */}
+          <OrgTabs slug={slug} />
+          <CapabilityUnavailable decision={memory} />
+        </div>
+      )
+
     const now = new Date()
     const [deliverables, pendingApprovals, budgetLines] = await Promise.all([
       db.deliverable.findMany({

apps/web/src/app/(app)/orgs/[slug]/memory/actions.test.ts

@@ -0,0 +1,120 @@
+import { CapabilityUnavailableError } from "@/lib/capability-registry/gate"
+import { createMemoryCard } from "./actions"
+
+/**
+ * The mutating surface refuses, and the refusal is reachable.
+ *
+ * ── Why this test exists at all ─────────────────────────────────────────────
+ *
+ * /orgs/[slug]/memory has been bound to `collaboration.institutional-memory`
+ * since the second slice, and until this one the binding was read by CI and by
+ * nothing at runtime. The side nav resolved the capability and dropped the
+ * link; the page still rendered its "Add to memory" form, and this action still
+ * wrote. A gate that only removes a link cannot refuse a form POST, and a form
+ * POST is what writes to the database.
+ *
+ * So the assertion that matters is not that an error is thrown — it is that
+ * `$transaction` is never reached. A refusal that fires after the write is not
+ * a refusal.
+ *
+ * ── The two questions, kept apart ───────────────────────────────────────────
+ *
+ * `canContribute` is mocked TRUE throughout. Every refusal below is therefore
+ * the deployment's answer, not the person's: someone who unambiguously may
+ * write is still refused because this tenant is not offered the capability.
+ * That is the property the registry exists for — promotion is not procurement
+ * — and it would be invisible in a test where the role could also explain it.
+ */
+
+const mockState: { modules: string[] | null; wrote: boolean } = {
+  modules: ["organizations@1.0.0"],
+  wrote: false,
+}
+
+jest.mock("next/cache", () => ({ revalidatePath: () => undefined }))
+
+jest.mock("@/lib/auth", () => ({ auth: async () => ({ user: { id: "user-1" } }) }))
+
+jest.mock("@/lib/tenant-scope", () => ({
+  withTenantScope: <T,>(_userId: string, fn: () => Promise<T>) => fn(),
+}))
+
+jest.mock("@/lib/rbac", () => ({
+  getUserContext: async () => ({ institutionRoles: [], orgRoles: [] }),
+  // The permission question, answered YES for every case below.
+  canContribute: () => true,
+}))
+
+jest.mock("@/lib/db", () => ({
+  db: {
+    organization: {
+      findUnique: async () => ({ id: "org-1", institutionId: "inst-1", slug: "chess" }),
+    },
+    role: { findFirst: async () => null },
+    auditEvent: {
+      findFirst: async () =>
+        mockState.modules === null ? null : { metadata: { modules: mockState.modules } },
+      create: () => ({}),
+    },
+    memoryRecord: { create: () => ({}) },
+    $transaction: async () => {
+      mockState.wrote = true
+      return []
+    },
+  },
+}))
+
+function card(): FormData {
+  const form = new FormData()
+  form.set("type", "LESSON")
+  form.set("title", "Book the hall before the caterer")
+  form.set("body", "The hall goes first every year and the caterer never does.")
+  return form
+}
+
+beforeEach(() => {
+  mockState.modules = ["organizations@1.0.0"]
+  mockState.wrote = false
+})
+
+describe("createMemoryCard resolves availability before it writes", () => {
+  it("writes when the tenant's manifest declares the module", async () => {
+    // The control's control: without this, every assertion below could pass
+    // because the action never works.
+    await createMemoryCard("chess", card())
+    expect(mockState.wrote).toBe(true)
+  })
+
+  it("refuses, and writes nothing, when the manifest does not declare it", async () => {
+    mockState.modules = ["reporting@1.0.0"]
+
+    await expect(createMemoryCard("chess", card())).rejects.toBeInstanceOf(
+      CapabilityUnavailableError,
+    )
+    expect(mockState.wrote).toBe(false)
+  })
+
+  it("names the module the tenant is missing, not just 'unavailable'", async () => {
+    mockState.modules = []
+
+    let refusal: CapabilityUnavailableError | null = null
+    try {
+      await createMemoryCard("chess", card())
+    } catch (e) {
+      refusal = e as CapabilityUnavailableError
+    }
+    if (!refusal) throw new Error("the action wrote; the capability gate never fired")
+
+    expect(refusal.decision.refusals[0].code).toBe("MODULE_NOT_DECLARED")
+    expect(refusal.decision.refusals[0].detail).toContain("organizations")
+  })
+
+  it("still writes for a tenant nobody has reconciled", async () => {
+    // null is not []. A hand-built pilot has no manifest, and refusing it here
+    // would take a working product dark on a document that does not exist.
+    mockState.modules = null
+
+    await createMemoryCard("chess", card())
+    expect(mockState.wrote).toBe(true)
+  })
+})

apps/web/src/app/(app)/orgs/[slug]/memory/actions.ts

@@ -2,6 +2,7 @@
 
 import { revalidatePath } from "next/cache"
 import { auth } from "@/lib/auth"
+import { requireOffered } from "@/lib/capability-registry/gate"
 import { db } from "@/lib/db"
 import { canContribute, getUserContext } from "@/lib/rbac"
 import { withTenantScope } from "@/lib/tenant-scope"
@@ -19,6 +20,19 @@ export async function createMemoryCard(slug: string, formData: FormData) {
     const ctx = await getUserContext(userId)
     if (!canContribute(ctx, org)) throw new Error("You need an active role to add memory")
 
+    // A second, different question, asked as a separate expression on purpose.
+    // `canContribute` says this PERSON may write; this says this DEPLOYMENT
+    // offers institutional memory to this club's institution at all. Merging
+    // them would let a president's seat unlock a capability the cell was never
+    // certified to offer — promotion is not procurement.
+    //
+    // The page refuses first and renders the reason, so nobody meets this throw
+    // by clicking. What reaches it is an invocation with no page behind it: a
+    // tab open since before the manifest changed, a replayed POST, a form
+    // action called directly. That is exactly the case a nav-only gate could
+    // not refuse, and the reason a mutating surface resolves for itself.
+    await requireOffered("collaboration.institutional-memory", org.institutionId)
+
     const roleIdRaw = String(formData.get("roleId") ?? "")
     const parsed = knowledgeCardSchema.safeParse({
       title: String(formData.get("title") ?? "").trim(),

apps/web/src/app/(app)/orgs/[slug]/memory/page.tsx

@@ -10,6 +10,8 @@ import {
   Timer,
 } from "@/components/ui/icons"
 import { auth } from "@/lib/auth"
+import { offeredTo } from "@/lib/capability-registry/gate"
+import { CapabilityUnavailable } from "@/components/CapabilityUnavailable"
 import { db } from "@/lib/db"
 import { canContribute, canViewOrg, getUserContext } from "@/lib/rbac"
 import { withTenantScope } from "@/lib/tenant-scope"
@@ -55,6 +57,29 @@ export default async function MemoryPage({
 
     const ctx = await getUserContext(session.user.id)
     if (!canViewOrg(ctx, org)) notFound()
+
+    // What this person may do, and what this deployment offers, asked
+    // separately. `canViewOrg` above is the first; this is the second, and it
+    // is the one the side nav has been answering alone — a club officer who
+    // typed this URL reached the page and its "Add to memory" form whatever the
+    // tenant's manifest said. `createMemoryCard` refuses too, so the form
+    // cannot be replayed past this; the page refuses first so the person gets a
+    // reason instead of an error card.
+    const memory = await offeredTo("collaboration.institutional-memory", org.institutionId)
+    if (!memory.available)
+      return (
+        <div className="w-full">
+          <div className="mb-4">
+            <h1 className="text-text-1">{org.name}</h1>
+          </div>
+          {/* The refusal keeps the club's tab strip. Members, Finance,
+              Documents and Impact are unaffected by this capability, and a page
+              that withholds one thing must not also strand the person on it. */}
+          <OrgTabs slug={slug} />
+          <CapabilityUnavailable decision={memory} />
+        </div>
+      )
+
     const canAdd = canContribute(ctx, org)
 
     const allCards = await db.memoryRecord.findMany({

apps/web/src/app/(app)/reports/finance/page.tsx

@@ -1,6 +1,8 @@
 import { notFound, redirect } from "next/navigation"
 import Link from "next/link"
 import { auth } from "@/lib/auth"
+import { offeredTo } from "@/lib/capability-registry/gate"
+import { CapabilityUnavailable } from "@/components/CapabilityUnavailable"
 import { db } from "@/lib/db"
 import { getUserContext } from "@/lib/rbac"
 import { withTenantScope } from "@/lib/tenant-scope"
@@ -30,6 +32,13 @@ export default async function PortfolioFinancePage() {
     const institutionId = ctx.institutionRoles[0]?.institutionId
     if (!institutionId) notFound() // OSE only
 
+    // Bound to the same capability as /reports, and gated the same way. A
+    // tenant without reporting must not reach the consolidation view through
+    // the link on /reports either — one binding, enforced at every route that
+    // carries it.
+    const reporting = await offeredTo("collaboration.reporting", institutionId)
+    if (!reporting.available) return <CapabilityUnavailable decision={reporting} />
+
     const orgs = await db.organization.findMany({
       where: { institutionId, status: "ACTIVE" },
       select: {