queue: queue add by jason or sage requires --gate-owner (#1595)

Row 101. Built by a Haiku subagent under Researcher (decision 129),
packet agents/researcher/work/queue-101/r1/, candidate manifest
ee1335a6e44610f676ade116733d180ac6f0b3603a58306110cbd1dd1e9c1f69.
Filbert approved on #1595, comment 28245.

The check runs at write time in store.mjs mutateAs, with no SEMANTICS
bump, so the live Console keeps reading the log.

Sage's gate rerun on 79e126be0 with rows 101 and 105 applied, Docker
up: node suites bus 128, business 67, cli 146, control-board 124,
conversation 182, discord 178, harness 70, ledger 78, mosaic 69,
queue 155, runs 43, seat 109, tasks 92, webui 108; scripts auth 15,
conductor 17, config 24, discord 66, extension-package 18,
foundation 44, queue 28, release 14, task 98. All pass, 0 fail.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/queue/src/cli.mjs

@@ -4,6 +4,7 @@
 // Reads:      list | show ID | next [SEAT]
 // Changes:    add --piece TEXT --gate TEXT --brief PATH#ANCHOR [--issue N]... [--note TEXT]
 //                 [--owner SEAT] [--gate-owner SEAT] [--after ID[:settled]]... [--reviewer SEAT]... [--required]
+//                 (jason and sage must pass --gate-owner; see the usage text)
 //             move ID STATE [--reason TEXT] [--candidate COMMIT|MANIFEST] [--issue N] [--evidence TEXT]
 //             release ID | assign ID SEAT | note ID TEXT | set ID FIELD VALUE [--reason TEXT]
 //             genesis --root PATH --branch NAME --map PATH
@@ -28,6 +29,7 @@ import { list, mutate, next, renderView, show, snapshot, sync, unlock, verify, v
 const USAGE = [
   "usage: queue list | show ID | next [SEAT]",
   "       queue add --op ID --piece TEXT --gate TEXT --brief PATH#ANCHOR [--issue N]... [--note TEXT] [--owner SEAT] [--gate-owner SEAT] [--after ID[:settled]]... [--reviewer SEAT]... [--required]",
+  "         jason and sage must pass --gate-owner: a privileged add has no default gate owner. Other seats can't set it; their rows get jason",
   "       queue move ID STATE --op ID [--reason TEXT] [--candidate COMMIT|MANIFEST] [--issue N] [--evidence TEXT]",
   "       queue release ID --op ID | assign ID SEAT --op ID | note ID TEXT --op ID",
   `       queue set ID FIELD VALUE --op ID [--reason TEXT]   (fields: ${SET_FIELDS.join(", ")})`,

packages/queue/src/store.mjs

@@ -527,6 +527,13 @@ function mutateAs(ctx, { verb, op, args, by, yes = false, derived = false }) {
     const view = classifyView(viewRead.text, cur.doc.log);
     if (view.state === "unknown") throw refuse(unknownMessage(view));
     if (view.state === "stale" && verb !== "accept-history") throw refuse(staleMessage(view, cur.doc.log));
+    // A privileged add names its gate owner. There is no default for it: the
+    // Jason default put a gate nobody meant on row 100. This check lives in the
+    // write path, not in applyEntry, so replay of old entries is unchanged and an
+    // older reader still loads the log.
+    if (verb === "add" && PRIVILEGED.has(actor) && cargs.gateOwner === null) {
+      throw refuse(`${actor} must pass --gate-owner SEAT on add: a privileged add has no default gate owner, so a row never gets a gate nobody meant (row 100 got jason by default)`);
+    }
     // Step 5.
     const resolved = resolveFor(ctx, loc, cur, verb, cargs, cmp);
     const rev = cur.doc.revision + 1;