Fail open when View recovery surfaces disappear

tests/test_views.py

@@ -310,6 +310,48 @@ class ViewsServiceTests(unittest.TestCase):
             state.effective.provenance[0]["source"],
         )
 
+    def test_required_view_falls_back_when_admin_escape_surface_is_removed(
+        self,
+    ) -> None:
+        definition = self.create_published_definition(
+            name="Required task",
+            scope_type="system",
+            visible_surface_ids=lockout_safe_surface_ids(),
+        )
+        create_assignment(
+            self.session,
+            tenant_id="tenant-1",
+            scope_type="system",
+            scope_id=None,
+            definition=definition,
+            revision_id=None,
+            mode="required",
+            priority=0,
+            is_active=True,
+            metadata={},
+            catalogue=self.catalogue,
+            actor_id="account-admin",
+        )
+        catalogue_without_admin_route = tuple(
+            surface
+            for surface in self.catalogue
+            if surface.id != "access.route.admin"
+        )
+
+        state = resolve_effective_view(
+            self.session,
+            tenant_id="tenant-1",
+            account_id="account-user",
+            catalogue=catalogue_without_admin_route,
+        )
+
+        self.assertIsNone(state.effective.view_id)
+        self.assertFalse(state.effective.locked)
+        self.assertIn(
+            "view.lockout_escape_unavailable",
+            {diagnostic.code for diagnostic in state.diagnostics},
+        )
+
     def test_required_assignment_rejects_revision_without_escape_surfaces(self) -> None:
         definition = self.create_published_definition(name="Unsafe task")