Flip duly_duty.source default from catalog to self (#50)

A hand-created duty was born into the governed, scoreable set because
the source select's default option was 'catalog'. Every path that
legitimately produces a governed duty already stamps source
explicitly (duly_catalog_apply writes 'catalog' per #34; the
assignment fan-out writes 'assigned' on duly_task per #33), so the
field default was only ever reached by a hand-created duty, which is
by definition self-declared.

Moves default: true from the catalog option to the self option on
duly_duty.source. Adds a test pinning the direction next to the
existing invariant tests: the default is self, and both governed
values (catalog, assigned) are reachable only by explicit assignment,
never as a fallback.

Author: os-warren

src/objects/duty.object.ts

@@ -83,9 +83,16 @@ export const Duty = ObjectSchema.create({
       label: 'Source',
       required: true,
       options: [
-        { label: 'Role catalog', value: 'catalog', color: '#16515F', default: true },
+        { label: 'Role catalog', value: 'catalog', color: '#16515F' },
         { label: 'Assigned by manager', value: 'assigned', color: '#8C6512' },
-        { label: 'Self-declared', value: 'self', color: '#576B73' },
+        // The default. Every path that legitimately produces a governed duty
+        // stamps `source` explicitly — `duly_catalog_apply` writes 'catalog'
+        // (#34), the assignment fan-out writes 'assigned' (#33) — so the
+        // default is only ever reached by a hand-created duty, which is by
+        // definition self-declared. Fail-safe direction: a producer that
+        // forgets to stamp caliber produces an unscored duty, not a scored
+        // one (#50).
+        { label: 'Self-declared', value: 'self', color: '#576B73', default: true },
       ],
     }),
 

test/invariants.test.ts

@@ -59,6 +59,26 @@ describe('product invariants', () => {
     }
   });
 
+  it('a hand-created duty is self-declared, not born governed (#50)', () => {
+    // The safe default for an ambiguous duty is the UNscoreable one. A duty
+    // created with no `source` supplied must land as 'self' — never
+    // 'catalog', which would additionally expose it to duly_catalog_sync's
+    // cadence rewrite for a catalog item it never came from.
+    const options = Duty.fields.source.options ?? [];
+    const defaults = options.filter((o) => o.default);
+    expect(defaults, 'exactly one option may claim the default').toHaveLength(1);
+    expect(defaults[0]?.value).toBe('self');
+
+    // The two governed calibers are reachable only when the producer that
+    // knows states them explicitly — duly_catalog_apply writes 'catalog'
+    // (#34), the assignment fan-out writes 'assigned' (#33). Neither may ride
+    // in on the field default.
+    for (const governed of ['catalog', 'assigned'] as const) {
+      const option = options.find((o) => o.value === governed);
+      expect(option?.default, `${governed} must not be the default`).not.toBe(true);
+    }
+  });
+
   it('every object states its sharing model explicitly', () => {
     for (const schema of [Duty, Task, LogEntry, CatalogItem]) {
       expect(schema.sharingModel, `${schema.name} must state an OWD`).toBeTruthy();