v0.25.1
config:set derives its ceiling from what this app can actually do, instead of assuming the maximum.
Built from config/operations.php a provider gets no catalogue, so it borrowed from an empty one and GOV-05 made that the maximum of every axis. app-runtime v0.18.0 hands the finished catalogue back in a second pass:
mutation Persistent · externality ThirdParty · reversibility ManualRecovery
authority Privileged · subject Executable — all five strictly below the maximum
Consent does not change; subject and authority are exactly what S2 demands. What changes is that the number is derived, so it drops when the app is milder and never drops while it is assumed.