@bongos/core 1.19.388 → 1.19.389

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.388",
-  "core_contract": "1.19.388",
-  "source_commit": "4458912ebde20d0f871c49406b22f782bb091d55",
+  "core_version": "1.19.389",
+  "core_contract": "1.19.389",
+  "source_commit": "6025dfdf6c2020fdf22152cb9edf610790cc83b0",
   "source_ref": "HEAD",
-  "built_at": "2026-08-27T23:15:30.043Z",
+  "built_at": "2026-08-27T23:26:50.061Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 339,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1619,
+    "functional_verbatim": 1620,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1980,
-  "tree_sha256": "b54f206e331f024b81b8e2625069e9ba55b966cb845e06547fc11ac3e8faba85",
+  "file_count": 1981,
+  "tree_sha256": "1cb4d393dd04fb49bb9f7aaaea5ae98dc3b4d9ce595c3a00b3aa0d86c7db7c95",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -162,12 +162,12 @@
     {
       "path": ".claude/skills/grade-recover/SKILL.md",
       "mode": "0000644",
-      "sha256": "e0bf90fa006499aee0a7d75f10fe4b5972c9501129b1e432e7d6e192b367a54c"
+      "sha256": "db66b9abfd36829c37885e14644a9f0c2e7025e32975a1346a1adb9816df681a"
     },
     {
       "path": ".claude/skills/grader-health/SKILL.md",
       "mode": "0000644",
-      "sha256": "3268e1138e02245ddf16d11b072133168cf0f59ca0ea4656631babba5df7158c"
+      "sha256": "dcff580f864ed98f6f037d011d290a758aa76500214835df76bcf4e041445417"
     },
     {
       "path": ".claude/skills/idea-triage/SKILL.md",
@@ -1517,12 +1517,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "17ead5156e550c0c2f1754a6296d578e05c4185ea3eb27c4a5c7900f757e2688"
+      "sha256": "6b2b21a3b5812c9d344165441ffd7397f39cabe4a72f652bb977ad31edb9a65a"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "a612166dc9f945ad0a7f32d8d13c86b1cc080f2214305d1408790f1a1ddbbe4d"
+      "sha256": "460230106e7c700485a3e9f797eb96e78dca54365e9dcaf56d60b111a08c1008"
     },
     {
       "path": "docs/design-contract.md",
@@ -1792,7 +1792,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "d68a8b0fd3177afadb529f65e1953efecb66c4649161858b7d62a287bb1e1483"
+      "sha256": "c717435fcd8d12a1073419666cdeeec1ae40d988789f2980413d2c22e1c45784"
     },
     {
       "path": "docs/handoff-template.md",
@@ -3492,7 +3492,7 @@
     {
       "path": "modules/grading/grader-config.js",
       "mode": "0000644",
-      "sha256": "125d5fab993fd4276eaf3df731bdf03afe25ef1032a8bec7c1bf5a16f781b73a"
+      "sha256": "9f06f2521e00f675c74a09538d086f6cdf362dfbb08bbc96464b6db10c2d5d2b"
     },
     {
       "path": "modules/grading/grader-model.js",
@@ -3507,12 +3507,12 @@
     {
       "path": "modules/grading/grader-rubric.json",
       "mode": "0000644",
-      "sha256": "6a0a2205fee2a4b0efc422c884826a9fd2af3d8785b393d5f7123e1758f1ebfc"
+      "sha256": "a1aad082fe64bd44eeb3c80a46f750861d078e03b29f1a0544aa18a069e532e5"
     },
     {
       "path": "modules/grading/grader-score.js",
       "mode": "0000644",
-      "sha256": "fe36685ad575e49d30b9251c9e781668473ca609ebc6be627c979adde76a2896"
+      "sha256": "387d518becd0cce38ecb15cb525084bcabfef04c138d6cae3eabaf3d928ddb5d"
     },
     {
       "path": "modules/grading/grader-subagent.js",
@@ -3542,7 +3542,7 @@
     {
       "path": "modules/grading/grader-workers/index.js",
       "mode": "0000644",
-      "sha256": "186ebc1d6456f3d9d0435766744fd767005b667fc4f6020bb9041f6b66388c4b"
+      "sha256": "c527d3dd996b4064ae14836e305de097edea2b1a3c46776d8ec7da8c2c6afe71"
     },
     {
       "path": "modules/grading/grader-workers/narc.js",
@@ -3627,7 +3627,7 @@
     {
       "path": "modules/hall-ui/public/builders.js",
       "mode": "0000644",
-      "sha256": "22f1d7714524e07397354507df61ccd4bcaf7c1779317945d1ba4cb45fca7042"
+      "sha256": "e8a0e98de75cab1f595f7541c0732b032ea0060e1b56526c52f352fcbd4a26a3"
     },
     {
       "path": "modules/hall-ui/public/chime.wav",
@@ -5122,12 +5122,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "11102606096b81deac5e3d59392a487905e92010e257cbaf7136a0fe059dbaa8"
+      "sha256": "eea9d3bbfd5303579b774edd548952fb8faa1b88acc2d21a1091409a247ec3f0"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "0c4a59120f7f038cf1e01f2bc30cb083e5ac7e445a51c83961caf4c551c0c7fa"
+      "sha256": "f012bfc1226d3d1d3dbe511bdb4c734f2e6731c37f220126f773b88ef3303a8c"
     },
     {
       "path": "public-docs/index.html",
@@ -6547,7 +6547,7 @@
     {
       "path": "scripts/gds/ship-grade-steps.js",
       "mode": "0000644",
-      "sha256": "e68f4c2848cb59878cd0b96b48fdd075db4a035354d51afef52aa6225f7895e5"
+      "sha256": "f47c4a0d6a6dfdc386e3b7e1da456c0c983b727672646cb1d033d8b11c03f5f0"
     },
     {
       "path": "scripts/gds/ship-grade.js",
@@ -7107,7 +7107,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "46c4b0ff4b30df23292a087eb1c4678da2706bb8f89ff0c1025b86b6ff35aadc"
+      "sha256": "6daab593739c8b3f37576399b8ba4cdcb6fdf82f8ce914ce1cdb4322ac8d1f24"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8387,7 +8387,7 @@
     {
       "path": "tests/grader.mjs",
       "mode": "0000644",
-      "sha256": "e97bbe1f1d9bc1b602adbae26e5144675a9324c5b729d0046ffa43407a88922c"
+      "sha256": "fd1ba73b702d61774275e8a7d4af7a8f14173505d98e966744d17a17321c49e0"
     },
     {
       "path": "tests/grader_bypass.mjs",
@@ -8409,6 +8409,11 @@
       "mode": "0000644",
       "sha256": "fa155f3c5faa3763d1a51d56b7746ad870e826e3249f5e9b08108a3cfbfcbd72"
     },
+    {
+      "path": "tests/grader_quality_window_overflow.mjs",
+      "mode": "0000644",
+      "sha256": "cbe81b9176d6ffdd59ea8d6955e30aab9bf6d13bd15144fd79d126455aa0e1e3"
+    },
     {
       "path": "tests/grader_regrade_delta.mjs",
       "mode": "0000644",

package/.claude/skills/grade-recover/SKILL.md

@@ -40,7 +40,7 @@ The panel could not run (worker infra outage or a pre-spawn bypass). This is **n
 Two known sub-shapes, both recognizable because the "fail" carries **no substantive findings**:
 
 - **Server-guard trip** (`signals.server_guard.tripped` non-empty, e.g. `implausible_pass`): the server downgraded a client-asserted pass it found implausible — historically this guard has fired on genuinely clean, unanimous zero-issue passes. Explain the downgrade honestly, then re-grade: `node scripts/gds/ship.js <id> --regrade`.
-- **A FAIL scored around 4.5/10 with zero issues and a null/zero axis** (the errored-worker class): a worker error was forwarded as a real axis score. Same response — re-grade; the panel rerun replaces the forged shape with a real verdict.
+- **A FAIL scored around 4.5/10 with zero issues and a null/zero axis** (the errored-worker class): a worker error was forwarded as a real axis score. Same response — re-grade; the panel rerun replaces the forged shape with a real verdict. Since task 1003318 a Quality worker that never ran (a `Prompt is too long` window overflow, `error: PROMPT_TOO_LONG`) no longer forges a 0: the server records `signals.cq_lens_unavailable` with a json-null axis and the card reads `QUALITY LENS UNAVAILABLE` — re-grade or manual-confirm; a 4.5 with a 0 axis now only comes from a server predating it.
 
 If an honest re-grade re-trips the guard on a diff you can defend, use the **auditable override path** — file an override-request with a real rationale (≥20 chars; only the task's most-recent claim holder or an Archon may file; an Archon then decides it):
 

package/.claude/skills/grader-health/SKILL.md

@@ -31,7 +31,7 @@ Baselines: the 14-agent evaluation window measured a **90.6%** pass rate, alread
 
 ### 3 — Cost anomalies
 
-Benchmark: mean panel cost **$2.14** per grade, and ~90% of it is **fixed** re-exploration cost, independent of diff size. Read grader spend and divide by the grade count from axis 2's window:
+Benchmark: mean panel cost **$2.14** per grade, and ~90% of it is **fixed** re-exploration cost, independent of diff size. (Measured with Quality on the haiku tier; since task 1003318 Quality runs on claude-sonnet-5, so a mean sitting somewhat above $2.14 is the new normal until re-baselined — a rise alone is not an anomaly.) Read grader spend and divide by the grade count from axis 2's window:
 
 ```
 node scripts/gds/api.js GET "/api/gds/public/cost-summary?source=grader&days=30" --quiet \

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**1519 strings** across 3 surfaces · 1332 distinct pieces of copy · 1519 certain, 0 heuristic · 144 shown in more than one place.
+**1520 strings** across 3 surfaces · 1333 distinct pieces of copy · 1520 certain, 0 heuristic · 144 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 71 | 1127 |
+| `builders-hall` | `modules/hall-ui/public` | 71 | 1128 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 98 |
 | `landing` | `public-landing` | 5 | 294 |
 
@@ -78,7 +78,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `cfe0f4c4fcc2` | 2x | Closing your box… (a few seconds) | modules/hall-ui/public/box-panel.js:265, modules/hall-ui/public/box-panel.js:370 |
 | … | | _104 more in the JSON registry_ | |
 
-## `builders-hall` — 1127 strings
+## `builders-hall` — 1128 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -131,7 +131,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `daf73127afff` | certain | A word on why | `modules/hall-ui/public/hall-render.js:275` |
 | `996edffc1966` | certain | Access requests | `modules/hall-ui/public/watch.html:38` |
 | `996edffc1966` | certain | Access requests | `modules/hall-ui/public/watch.html:53` |
-| `303f8d90266f` | certain | Achievements could not be loaded. | `modules/hall-ui/public/builders.js:1138` |
+| `303f8d90266f` | certain | Achievements could not be loaded. | `modules/hall-ui/public/builders.js:1143` |
 | `6ca31dd5eb91` | certain | Acknowledge the primer | `modules/hall-ui/public/primer.html:65` |
 | `4461b13f95c2` | certain | Actions apply at once. Closing stops and deletes the box; you can start a fresh one anytime. | `modules/hall-ui/public/settings.html:162` |
 | `f6036360c90c` | certain | Activity, by craft | `modules/hall-ui/public/profile.html:84` |
@@ -370,7 +370,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `541127601291` | certain | Download for Mac | `modules/hall-ui/public/settings.html:177` |
 | `2ed2fd8376c0` | certain | Download for Windows | `modules/hall-ui/public/settings.html:178` |
 | `c7af57097d94` | certain | Download the Dev Box app: | `modules/hall-ui/public/hall-render.js:650` |
-| `9cf07334a5a9` | certain | Downvote (−1) | `modules/hall-ui/public/builders.js:725` |
+| `9cf07334a5a9` | certain | Downvote (−1) | `modules/hall-ui/public/builders.js:730` |
 | `9c728558d6e7` | certain | Drachmae & karma | `modules/hall-ui/public/drachmae.html:15` |
 | `9c728558d6e7` | certain | Drachmae & karma | `modules/hall-ui/public/drachmae.html:15` |
 | `9d9cc4ef8557` | certain | Drachmae & karma — {{worldName}} | `modules/hall-ui/public/drachmae.html:6` |
@@ -463,7 +463,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `a4ff1e9c34e3` | certain | Idea {…} | `modules/hall-ui/public/idea.js:252` |
 | `ba82ec56f1e3` | certain | Idea — {{worldName}} | `modules/hall-ui/public/idea.html:6` |
 | `ba82ec56f1e3` | certain | Idea — {{worldName}} | `modules/hall-ui/public/idea.html:6` |
-| `e181637c5a5e` | certain | Ideas awaiting triage | `modules/hall-ui/public/builders.js:845` |
+| `e181637c5a5e` | certain | Ideas awaiting triage | `modules/hall-ui/public/builders.js:850` |
 | `d4e21769ce1c` | certain | Ideas filed, and what became of them | `modules/hall-ui/public/profile.html:103` |
 | `379b20d548ad` | certain | Ideas whose author has said "I had the thought but not the full picture". Anyone can develop one — the author  | `modules/hall-ui/public/ideas.html:33` |
 | `ef224c9de7c8` | certain | Ideas — {{worldName}} | `modules/hall-ui/public/ideas.html:6` |
@@ -497,7 +497,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `2a3c9e501f8e` | certain | Key storage isn't set up yet. As an Archon you can turn it on now — the server generates and safely stores the | `modules/hall-ui/public/settings.js:963` |
 | `7d6eaa8d4514` | certain | Kinds of work shipped | `modules/hall-ui/public/hall-render.js:1089` |
 | `d7b4392e0ea6` | certain | Largest files | `modules/hall-ui/public/watch.js:848` |
-| `81f62e066dbf` | certain | Last 14 days: {…} / 10 average across {…} graded work{…} ({…} passed). | `modules/hall-ui/public/builders.js:581` |
+| `81f62e066dbf` | certain | Last 14 days: {…} / 10 average across {…} graded work{…} ({…} passed). | `modules/hall-ui/public/builders.js:586` |
 | `35a15eb0a117` | certain | Last 30 days | `modules/hall-ui/public/hall-widgets.js:129` |
 | `9be8b839eff8` | certain | Last 7 days | `modules/hall-ui/public/hall-widgets.js:129` |
 | `59f0bc78a28f` | certain | Last 90 days | `modules/hall-ui/public/hall-widgets.js:130` |
@@ -540,7 +540,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `df335a1224ae` | certain | Member since {…} | `modules/hall-ui/public/hall-render.js:544` |
 | `df335a1224ae` | certain | Member since {…} | `modules/hall-ui/public/profile.js:58` |
 | `c7a670e9552d` | certain | Merged into | `modules/hall-ui/public/profile.js:322` |
-| `7637613c231b` | certain | Metic rank and above may vote | `modules/hall-ui/public/builders.js:729` |
+| `7637613c231b` | certain | Metic rank and above may vote | `modules/hall-ui/public/builders.js:734` |
 | `d7ce4a3bb745` | certain | Minimize the welcome panel | `modules/hall-ui/public/hall-widgets.js:52` |
 | `19b0ed5781ae` | certain | Minimum rank required to claim this task | `modules/hall-ui/public/task-lib.js:65` |
 | `64e91044df43` | certain | Mint a fresh CLI token using this browser session and paste it into your terminal — the quick way back in when | `modules/hall-ui/public/settings.html:117` |
@@ -845,7 +845,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `381f29be7497` | certain | The most recently shipped tasks. | `modules/hall-ui/public/work.html:97` |
 | `82479c539fca` | certain | The name shown beside your work — in the roster, the leaderboard, and the work feed. Your sign-in and the cred | `modules/hall-ui/public/settings.html:67` |
 | `b88dd8b96b72` | certain | The next person to notice this sentence reads your note instead of re-litigating it. | `modules/hall-ui/public/copy-desk.html:122` |
-| `aa716f3dd551` | certain | The page could not be loaded. Try again. | `modules/hall-ui/public/builders.js:1393` |
+| `aa716f3dd551` | certain | The page could not be loaded. Try again. | `modules/hall-ui/public/builders.js:1398` |
 | `3bc5ec5f35ec` | certain | The ranks, lowest to highest | `modules/hall-ui/public/ranks.html:39` |
 | `3b5260b8780a` | certain | The reserved 16-rank ladder, which ranks are live today (archon, metic, thetes, xenos), and what each may do. | `modules/hall-ui/public/diagrams.html:69` |
 | `cfa55899240b` | certain | The roadmap could not be loaded right now. Reload to try again. | `modules/hall-ui/public/roadmap.js:407` |
@@ -896,14 +896,14 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `1a64679fbb42` | certain | Typo or grammar | `modules/hall-ui/public/copy-desk.html:96` |
 | `2c1c20785a6e` | certain | Unclear — a person would not know what to do | `modules/hall-ui/public/copy-desk.html:93` |
 | `aa445f06cc5e` | certain | Unlink failed: {…} | `modules/hall-ui/public/settings.js:843` |
-| `67fbc770b3b3` | certain | Upvote (+1) | `modules/hall-ui/public/builders.js:725` |
+| `67fbc770b3b3` | certain | Upvote (+1) | `modules/hall-ui/public/builders.js:730` |
 | `e8d747720e47` | certain | View all sessions → | `modules/hall-ui/public/watch.html:96` |
 | `9b92aa01516d` | certain | View all {…} {…} → | `modules/hall-ui/public/goals-render.js:530` |
 | `4babdfeaf27f` | certain | View full standing → | `modules/hall-ui/public/hall-widgets.js:86` |
 | `f8546b3e285e` | certain | View tasks {…} | `modules/hall-ui/public/roadmap.js:134` |
 | `71c09cda8246` | certain | Voice for {…} | `modules/hall-ui/public/settings.js:76` |
 | `2940b7828d26` | certain | Volume {…}%. | `modules/hall-ui/public/settings.js:211` |
-| `6905f2ee5702` | certain | Vote on this work | `modules/hall-ui/public/builders.js:725` |
+| `6905f2ee5702` | certain | Vote on this work | `modules/hall-ui/public/builders.js:730` |
 | `b2937e14ee9b` | certain | Vote yes | `modules/hall-ui/public/government.js:885` |
 | `8cc425582984` | certain | Vulnerability reports | `modules/hall-ui/public/watch.html:117` |
 | `b1e63e33f739` | certain | Vulnerability reports, engagement reports, override requests, and the audit log. | `modules/hall-ui/public/watch.html:115` |
@@ -1021,7 +1021,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `77b0b2b446a1` | certain | e.g. octocat | `modules/hall-ui/public/watch.js:207` |
 | `89cc9754d633` | certain | e.g. runaway cost — paused pending review | `modules/hall-ui/public/harbor.js:146` |
 | `5321f9da0841` | certain | exists in schema, no behavior yet | `modules/hall-ui/public/diagrams.html:53` |
-| `df941da50c7c` | certain | fell short | `modules/hall-ui/public/builders.js:558` |
+| `df941da50c7c` | certain | fell short | `modules/hall-ui/public/builders.js:563` |
 | `31735e119a04` | certain | first vote | `modules/hall-ui/public/government.js:537` |
 | `9563bd9f4971` | certain | first — your username is all we need. | `modules/hall-ui/public/hall-render.js:275` |
 | `1874087e6d87` | certain | for Mac or Windows, sign in with your | `modules/hall-ui/public/hall-render.js:650` |
@@ -1066,7 +1066,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `e02979266baf` | certain | no data | `modules/hall-ui/public/hall-render.js:990` |
 | `739a4bd6bd83` | certain | node scripts/setup-builder.js | `modules/hall-ui/public/hall-render.js:717` |
 | `61f0f4b2f4ab` | certain | not categorised yet | `modules/hall-ui/public/goals-page.js:277` |
-| `01a3d68d80c1` | certain | not graded (grader outage) | `modules/hall-ui/public/builders.js:555` |
+| `01a3d68d80c1` | certain | not graded (grader outage) | `modules/hall-ui/public/builders.js:558` |
+| `d43b9bbb8d4d` | certain | not graded (quality lens unavailable) | `modules/hall-ui/public/builders.js:560` |
 | `3916a3dc8e98` | certain | not started | `modules/hall-ui/public/roadmap.js:108` |
 | `3916a3dc8e98` | certain | not started | `modules/hall-ui/public/roadmap.js:263` |
 | `e2c643fbf4d6` | certain | npm install | `modules/hall-ui/public/hall-render.js:691` |
@@ -1174,7 +1175,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `893901f11e81` | certain | · {…} permission{…} | `modules/hall-ui/public/government.js:147` |
 | `4a5ff4f662df` | certain | — ${…} of ${…} this month ({…}%). {…} | `modules/hall-ui/public/hall-render.js:452` |
 | `cbd220dd9184` | certain | — a later push must be re-approved. | `modules/hall-ui/public/gate.js:87` |
-| `a6ae9cbdee30` | certain | — all builders — | `modules/hall-ui/public/builders.js:661` |
+| `a6ae9cbdee30` | certain | — all builders — | `modules/hall-ui/public/builders.js:666` |
 | `729d4ce22b99` | certain | — any — | `modules/hall-ui/public/hall-widgets.js:132` |
 | `9ac518dfa95e` | certain | — none (the version's general bucket) — | `modules/hall-ui/public/task-detail.js:315` |
 | `da9962dc1729` | certain | — or open any diagram fullscreen. | `modules/hall-ui/public/diagrams.html:42` |
@@ -1186,7 +1187,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `ff6b84565e10` | certain | — {…}{…} | `modules/hall-ui/public/government.js:652` |
 | `5b9fa7cb4fb0` | certain | …and {…} more waiting — | `modules/hall-ui/public/goal-inbox.js:121` |
 | `b2a04abfead0` | certain | …{…} more awaiting a nod. | `modules/hall-ui/public/goal-inbox.js:251` |
-| `e35f11bdc5d7` | certain | …{…} more open ideas — triage clears them one at a time. | `modules/hall-ui/public/builders.js:843` |
+| `e35f11bdc5d7` | certain | …{…} more open ideas — triage clears them one at a time. | `modules/hall-ui/public/builders.js:848` |
 | `de8fa5223aee` | certain | ‹ Prev | `modules/hall-ui/public/hall-kit.js:71` |
 | `d4b84b7fbdeb` | certain | ← All goals | `modules/hall-ui/public/goals.html:56` |
 | `7d29dc9e0391` | certain | ← Back to Home | `modules/hall-ui/public/not-ready.html:35` |

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 1519,
-    "unique_ids": 1332,
-    "certain": 1519,
+    "strings": 1520,
+    "unique_ids": 1333,
+    "certain": 1520,
     "heuristic": 0,
     "duplicate_ids": 144
   },
@@ -13,7 +13,7 @@
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 71,
-      "strings": 1127
+      "strings": 1128
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -1969,7 +1969,7 @@
       "surface": "builders-hall",
       "text": "Achievements could not be loaded.",
       "file": "modules/hall-ui/public/builders.js",
-      "line": 1138,
+      "line": 1143,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4120,7 +4120,7 @@
       "surface": "builders-hall",
       "text": "Downvote (−1)",
       "file": "modules/hall-ui/public/builders.js",
-      "line": 725,
+      "line": 730,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4957,7 +4957,7 @@
       "surface": "builders-hall",
       "text": "Ideas awaiting triage",
       "file": "modules/hall-ui/public/builders.js",
-      "line": 845,
+      "line": 850,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5263,7 +5263,7 @@
       "surface": "builders-hall",
       "text": "Last 14 days: {…} / 10 average across {…} graded work{…} ({…} passed).",
       "file": "modules/hall-ui/public/builders.js",
-      "line": 581,
+      "line": 586,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -5650,7 +5650,7 @@
       "surface": "builders-hall",
       "text": "Metic rank and above may vote",
       "file": "modules/hall-ui/public/builders.js",
-      "line": 729,
+      "line": 734,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8395,7 +8395,7 @@
       "surface": "builders-hall",
       "text": "The page could not be loaded. Try again.",
       "file": "modules/hall-ui/public/builders.js",
-      "line": 1393,
+      "line": 1398,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -8854,7 +8854,7 @@
       "surface": "builders-hall",
       "text": "Upvote (+1)",
       "file": "modules/hall-ui/public/builders.js",
-      "line": 725,
+      "line": 730,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8917,7 +8917,7 @@
       "surface": "builders-hall",
       "text": "Vote on this work",
       "file": "modules/hall-ui/public/builders.js",
-      "line": 725,
+      "line": 730,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9979,7 +9979,7 @@
       "surface": "builders-hall",
       "text": "fell short",
       "file": "modules/hall-ui/public/builders.js",
-      "line": 558,
+      "line": 563,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10384,7 +10384,16 @@
       "surface": "builders-hall",
       "text": "not graded (grader outage)",
       "file": "modules/hall-ui/public/builders.js",
-      "line": 555,
+      "line": 558,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
+    {
+      "id": "d43b9bbb8d4d",
+      "surface": "builders-hall",
+      "text": "not graded (quality lens unavailable)",
+      "file": "modules/hall-ui/public/builders.js",
+      "line": 560,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -11356,7 +11365,7 @@
       "surface": "builders-hall",
       "text": "— all builders —",
       "file": "modules/hall-ui/public/builders.js",
-      "line": 661,
+      "line": 666,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -11464,7 +11473,7 @@
       "surface": "builders-hall",
       "text": "…{…} more open ideas — triage clears them one at a time.",
       "file": "modules/hall-ui/public/builders.js",
-      "line": 843,
+      "line": 848,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/file-map.md

@@ -335,6 +335,7 @@ tests/
 ├── terrain_picker.mjs            ← (ADR 0012): picker dispatch shape + GROUND-ONLY invariant (objects must never affect tile selection).
 ├── walkability.mjs               ← (ADR 0012): isBlocked over the actual INITIAL_MAP for sea / sand / grass / rock-on-grass / all 8 container cells / vendor cell / cell south of vendor / out-of-bounds. Loads server-side src/world/{map,terrain}.js directly so server logic is exercised.
 ├── grader.mjs                    ← (task 197): pure scoring functions + weight blending + end-to-end grade() per kind. Run with `node tests/grader.mjs`.
+├── grader_quality_window_overflow.mjs ← (task 1003318): a Quality worker that dies on a context-window overflow is PROMPT_TOO_LONG (no retry), a null axis, and a server-side lens outage → manual-confirm, never a fabricated 0/10; the card, the forged-flag and blocker-beside-outage shapes.
 ├── session_records.mjs           ← (6D.1, ADR 0027): scrubSecrets (ADR 0022 shapes + JWT/DSN/assignments) + buildSessionDigest + resolveTranscriptPath (worktree-session lookup, #551). Fixtures built at runtime so no literal secret hits the scanner.
 ├── session_search.mjs            ← (6D.2): the session-search ORDER BY whitelist (injection guard) + LIMIT clamp.
 ├── session_eval.mjs              ← (6D.3 + 6D.4): classifyTurn / computeOverhead / detectFootguns / summarizeSystemicFindings, incl. a #506-shaped fixture.

package/modules/grading/grader-config.js

@@ -33,9 +33,11 @@ const ASSUMED_BUILDER_MODEL = V4.assumed_builder_model || 'claude-fable-5';
 const DEFAULT_GRADER_MODEL = V4.default_model || 'claude-sonnet-5';
 const FALLTHROUGH_CONFIDENCE = V4.fallthrough_confidence ?? 0.3;
 // task 1002660: per-worker model tier overrides (rubric-configured). The
-// Quality worker was 41% of panel spend with 75% nit findings — its cq/economy
-// judgment doesn't need the full cross-model tier. Keys are worker kinds;
-// values are model ids. workerModelFor guards the cross-model invariant.
+// Quality worker was 41% of panel spend with 75% nit findings, so it ran on
+// the haiku tier — until its 200k window overflowed on any big diff and the
+// lens went dark (task 1003318: now claude-sonnet-5, a floor that coincides
+// with default_model for top-tier builders). Keys are worker kinds; values are
+// model ids. workerModelFor guards the cross-model invariant.
 const WORKER_MODEL_TIERS = V4.worker_model_tiers || {};
 const workers = require('./grader-workers');
 const generatedProvenance = require('./generated-provenance'); // task 1002795

package/modules/grading/grader-rubric.json

@@ -12,8 +12,8 @@
     "assumed_builder_model": "claude-fable-5",
     "model_refresh_note": "task 1002659 (2026-08-11): pins refreshed to the Claude 5 family. Assumed builder = claude-fable-5 (the owner-top-model default per CLAUDE.md §2); default grader = claude-sonnet-5 (cross-model per ADR 0024, cost-parity with the prior sonnet-4-6 posture — opus-5 grades the sonnet/haiku builders where the grader should be the stronger model). selectGraderModel no longer throws on an unknown builder id: it warns loudly and falls back to default_model (the #117 throw stranded ships whose builder id lacked an opus/sonnet/haiku substring — exactly what claude-fable-5 is).",
     "active_panel": ["narc", "quality", "hacker", "efficiency"],
-    "worker_model_tiers": { "quality": "claude-haiku-4-5-20251001" },
-    "worker_model_tiers_note": "task 1002660: per-worker cost tiering. Quality was 41% of panel spend with 75% nit findings — its cq/economy lens runs on the haiku tier. workerModelFor refuses an override that lands on the builder's own model family (the ADR 0024 cross-model guarantee outranks the cost lever); gate semantics unchanged — Quality's verdict still gates identically.",
+    "worker_model_tiers": { "quality": "claude-sonnet-5" },
+    "worker_model_tiers_note": "task 1002660: per-worker cost tiering. Quality was 41% of panel spend with 75% nit findings — its cq/economy lens ran on the haiku tier. task 1003318: moved to claude-sonnet-5 — haiku 4.5's 200k window overflows on any diff over ~150 KB (`Prompt is too long`, deterministic; tasks 1003297 and 1003298 each lost three ~$5 panel runs to it) and a Quality worker that never starts is missing signal on a GATING lens. For fable/opus builders the panel model is already claude-sonnet-5, so the tier coincides with default_model and acts as a floor — a future default_model bump must not pin Quality back onto a smaller window; it stays a live cost lever only for haiku builders (whose panel runs on opus-5). workerModelFor refuses an override that lands on the builder's own model family (the ADR 0024 cross-model guarantee outranks the cost lever); gate semantics unchanged — Quality's verdict still gates identically.",
     "fallthrough_confidence": 0.3,
     "low_confidence_threshold": 0.4,
     "rationale": "GDS-V3 task #410 (MAS Phase 2.0), 2026-05-29. Supersedes v3 (single-prompt 3-shot generalist). Phase 1 calibration showed minimal between-shot disagreement on the same prompt — the strict gate fired correctly but the diversity signal was weak. v4 trades sampling-variance for lens-specialization: replace 3 identical-prompt shots with N workers (each a distinct prompt focused on one axis). Phase 2.0 ships 2 of the 3 planned workers (narc for completion, quality for cq + advisory economy) — keeps the gate at the same strictness while the framework calibrates. Phase 2.1 adds hacker (security; wraps /builder-redteam as a CI gate). Phase 2.2 adds efficiency_monger.",

package/modules/grading/grader-score.js

@@ -19,18 +19,23 @@ function isNum(n) {
   return Number.isFinite(n);
 }
 
-// #1002653 corroboration helpers for validateAndScore's null-ff lens branch.
-// A worker entry is untrusted input — w.issues may be any shape. Absent issues
-// on an errored worker is the normal outage shape (treated as none); a truthy
-// NON-ARRAY issues is malformed and must DISQUALIFY corroboration (fail-closed
-// schema_error downstream), never TypeError into a 500 on grade submission.
-const isNarcErroredClean = (w) => {
-  if (!w || w.kind !== 'narc' || !w.error) return false;
+// #1002653 / task 1003318 corroboration helpers for validateAndScore's null-axis
+// lens branches (Narc → ff, Quality → cq). A worker entry is untrusted input —
+// w.issues may be any shape. Absent issues on an errored worker is the normal
+// outage shape (treated as none); a truthy NON-ARRAY issues is malformed and
+// must DISQUALIFY corroboration (fail-closed schema_error downstream), never
+// TypeError into a 500 on grade submission.
+const isWorkerErroredClean = (kind) => (w) => {
+  if (!w || w.kind !== kind || !w.error) return false;
   const issues = w.issues == null ? [] : w.issues;
   if (!Array.isArray(issues)) return false;
   return !issues.some((i) => i && (i.severity === 'blocker' || i.severity === 'major'));
 };
-const isNarcHealthy = (w) => !!w && w.kind === 'narc' && !w.error;
+const isWorkerHealthy = (kind) => (w) => !!w && w.kind === kind && !w.error;
+const isNarcErroredClean = isWorkerErroredClean('narc');
+const isNarcHealthy = isWorkerHealthy('narc');
+const isQualityErroredClean = isWorkerErroredClean('quality');
+const isQualityHealthy = isWorkerHealthy('quality');
 
 // task 1002658 (ADR 0164): a SUBSTANTIVE issue is one a real panel emits — a
 // known severity + a non-empty summary. The old plausibility guard counted raw
@@ -95,8 +100,8 @@ function validateAndScore(rawSubagent, meta = {}) {
   // needs POSITIVE corroboration: workers[] carries an errored
   // no-substantive-finding Narc (#473 missing-signal semantics) and no healthy
   // Narc. Empty/narc-less/absent workers, ABSENT ff, and every other shape
-  // fall through to the fail-closed schema_error below. Quality has no such
-  // branch — gating lens, absence stays fail-closed.
+  // fall through to the fail-closed schema_error below. Quality's twin branch
+  // (task 1003318, below) is gating, so it never passes.
   // Trust note: workers[] is client-supplied like every SR-9 grade input — a
   // forger gains nothing here they cannot get by sending ff:9 directly; the
   // server-derivable-signals redesign is tracked separately (SR-9 residual).
@@ -105,8 +110,23 @@ function validateAndScore(rawSubagent, meta = {}) {
     metaWorkers.some(isNarcErroredClean) && !metaWorkers.some(isNarcHealthy);
   const ffExplicitNull = parsed.functional_fidelity === null;
   const ffLensUnavailable = ffExplicitNull && narcMissingSignal;
+  // task 1003318: the same shape for the GATING Quality lens. The haiku-tier
+  // Quality worker died on a context-window overflow (`Prompt is too long`)
+  // before it started; aggregatePanel forwarded code_quality: null and
+  // Number(null) === 0 fabricated "FAIL — code_quality below 6" at (9+0)/2.
+  // Unlike the advisory ff branch this NEVER passes: a gating lens that did not
+  // run is recorded as unavailable (json-null axis, score on the axis that ran,
+  // signals.cq_lens_unavailable) and the task parks at completed for
+  // manual-confirm — fail-closed, and a forger gains nothing they could not get
+  // by sending cq:9 outright. Same corroboration: an errored no-finding Quality
+  // in workers[] and no healthy one; every other null shape is schema_error.
+  const qualityMissingSignal = !!metaWorkers &&
+    metaWorkers.some(isQualityErroredClean) && !metaWorkers.some(isQualityHealthy);
+  const cqExplicitNull = parsed.code_quality === null;
+  const cqLensUnavailable = cqExplicitNull && qualityMissingSignal;
+  const qualityErrorTag = cqLensUnavailable ? String(metaWorkers.find(isQualityErroredClean).error) : null;
   const ff = ffExplicitNull ? null : Number(parsed.functional_fidelity);
-  const cq = Number(parsed.code_quality);
+  const cq = cqExplicitNull ? null : Number(parsed.code_quality);
   const economyRaw = Number(parsed.economy);
   const economy =
     isNum(economyRaw) && economyRaw >= 0 && economyRaw <= 10 ? economyRaw : null;
@@ -138,9 +158,13 @@ function validateAndScore(rawSubagent, meta = {}) {
 
   signals.confidence = confidence;
   signals.issue_count = issues.length;
-  if (ffLensUnavailable) signals.ff_lens_unavailable = true;
+  // Set AND cleared: `signals` spreads the client's own blob, so a forged
+  // `*_lens_unavailable: true` on a judged grade must not survive into the row
+  // (the ship card keys its outage reading on these).
+  if (ffLensUnavailable) signals.ff_lens_unavailable = true; else delete signals.ff_lens_unavailable;
+  if (cqLensUnavailable) signals.cq_lens_unavailable = true; else delete signals.cq_lens_unavailable;
 
-  if ((!ffLensUnavailable && (!isNum(ff) || ff < 0 || ff > 10)) || !isNum(cq) || cq < 0 || cq > 10) {
+  if ((!ffLensUnavailable && (!isNum(ff) || ff < 0 || ff > 10)) || (!cqLensUnavailable && (!isNum(cq) || cq < 0 || cq > 10))) {
     return {
       score: 0,
       passed: false,
@@ -152,22 +176,34 @@ function validateAndScore(rawSubagent, meta = {}) {
       notes_md: `Subagent grader ${VERSION}: subagent returned scores outside [0,10] or non-numeric. Got functional_fidelity=${parsed.functional_fidelity}, code_quality=${parsed.code_quality}.`
         + (ffExplicitNull && !narcMissingSignal
           ? ' Explicit null functional_fidelity without a corroborated Narc outage in signals.workers is fail-closed.'
+          : '')
+        + (cqExplicitNull && !qualityMissingSignal
+          ? ' Explicit null code_quality without a corroborated Quality outage in signals.workers is fail-closed.'
           : ''),
       issues,
     };
   }
 
   const ffR = ffLensUnavailable ? null : r1(clamp(ff, 0, 10));
-  const cqR = r1(clamp(cq, 0, 10));
+  const cqR = cqLensUnavailable ? null : r1(clamp(cq, 0, 10));
   const economyR = economy != null ? r1(clamp(economy, 0, 10)) : null;
   const securityR = securityScore != null ? r1(clamp(securityScore, 0, 10)) : null;
   const efficiencyR = efficiencyScore != null ? r1(clamp(efficiencyScore, 0, 10)) : null;
   const economyPenalty =
     economyR != null ? Math.max(0, (THRESHOLD - economyR) / 2) : 0;
-  const cqEffective = economyR != null ? r1(clamp(cqR - economyPenalty, 0, 10)) : cqR;
-  // With the ff lens out, the score reflects only the axis that ran — never a
-  // blend with a synthetic 0 (the fabricated 4.5/10) or a synthetic threshold.
-  const blended = ffLensUnavailable ? cqR : r1((ffR + cqR) / 2);
+  const cqEffective = cqLensUnavailable
+    ? null
+    : economyR != null ? r1(clamp(cqR - economyPenalty, 0, 10)) : cqR;
+  // With a lens out, the score reflects only the axis that ran — never a blend
+  // with a synthetic 0 (the fabricated 4.5/10) or a synthetic threshold. Both
+  // out → 0: nothing was judged.
+  const blended = ffLensUnavailable && cqLensUnavailable
+    ? 0
+    : ffLensUnavailable
+      ? cqR
+      : cqLensUnavailable
+        ? ffR
+        : r1((ffR + cqR) / 2);
 
   // confidence must be present (not null) for a PASS. A subagent that omits
   // confidence entirely silently bypassed the low-confidence gate under the
@@ -182,26 +218,40 @@ function validateAndScore(rawSubagent, meta = {}) {
   // (null < THRESHOLD is true via JS coercion), and must not appear in the
   // verdict's below-threshold branches.
   const ffBelow = !ffLensUnavailable && ffR < THRESHOLD;
-  const bothPass = !ffBelow && cqR >= THRESHOLD;
-  const passed = bothPass && !lowConfidence && !confidenceAbsent;
-
+  const cqBelow = !cqLensUnavailable && cqR < THRESHOLD;
+  const bothPass = !ffBelow && !cqBelow;
+  // A GATING lens that did not run is never a PASS (ff is advisory since #481;
+  // cq is not) — manual-confirm is the only way past it (task 1003318).
+  const passed = bothPass && !lowConfidence && !confidenceAbsent && !cqLensUnavailable;
+
+  // The UNAVAILABLE reading is only honest when the lenses that DID run found
+  // nothing substantive: a Hacker blocker beside a dead Quality is a rejection
+  // with a missing axis, not an outage, and must keep the ordinary FAIL chain
+  // (the #574 posture — a dark lens hardens the outcome, never softens it).
+  const hasSubstantiveFinding = issues.some((i) => i.severity === 'blocker' || i.severity === 'major');
   const verdict = passed
     ? 'PASS'
-    : confidenceAbsent
-      ? 'FAIL — confidence absent'
-      : lowConfidence
-        ? 'FAIL — low confidence'
-        : bothPass
-          ? 'FAIL'
-          : ffBelow && cqR < THRESHOLD
-            ? `FAIL — both axes below ${THRESHOLD}`
-            : ffBelow
-              ? `FAIL — functional_fidelity below ${THRESHOLD}`
-              : `FAIL — code_quality below ${THRESHOLD}`;
+    : cqLensUnavailable && !hasSubstantiveFinding
+      ? `UNAVAILABLE — the code_quality lens did not run (Quality worker errored: ${qualityErrorTag}); not a quality rejection — manual-confirm available`
+        + (ffBelow ? ` (functional_fidelity below ${THRESHOLD})` : '')
+        // the confidence reasons the chain below would have named — kept as a
+        // tail so the #489 gate-walk signal is never hidden by the outage line
+        + (confidenceAbsent ? '; confidence absent' : lowConfidence ? `; low confidence ${confidence}` : '')
+      : confidenceAbsent
+        ? 'FAIL — confidence absent'
+        : lowConfidence
+          ? 'FAIL — low confidence'
+          : bothPass
+            ? 'FAIL'
+            : ffBelow && cqBelow
+              ? `FAIL — both axes below ${THRESHOLD}`
+              : ffBelow
+                ? `FAIL — functional_fidelity below ${THRESHOLD}`
+                : `FAIL — code_quality below ${THRESHOLD}`;
 
   const notesLines = [];
   notesLines.push(`Shot ${signals.shot_index != null ? signals.shot_index : '?'} (${signals.model}) — ${verdict}`);
-  notesLines.push(`  ff=${ffLensUnavailable ? 'n/a (lens unavailable)' : `${ffR}/10`}  cq=${cqR}/10${economyR != null ? `  econ=${economyR}/10 (advisory)` : ''}  conf=${confidence ?? '?'}`);
+  notesLines.push(`  ff=${ffLensUnavailable ? 'n/a (lens unavailable)' : `${ffR}/10`}  cq=${cqLensUnavailable ? 'n/a (lens unavailable)' : `${cqR}/10`}${economyR != null ? `  econ=${economyR}/10 (advisory)` : ''}  conf=${confidence ?? '?'}`);
   if (notesFromSubagent) {
     notesLines.push('');
     notesLines.push(notesFromSubagent.trim());
@@ -559,6 +609,9 @@ function aggregateShots(shotResults, meta = {}) {
   const cq = median(verdicts.map((v) => v.cq));
   const economy = median(verdicts.map((v) => v.economy));
   const cqEffective = median(verdicts.map((v) => v.cq_effective));
+  // NB (task 1003318): this v3 multi-shot path still collapses a null axis to
+  // 0 — it serves the trivial-diff single shot, which cannot overflow a window;
+  // the panel path's lens-outage handling lives in validateAndScore.
   const blended = ff != null && cq != null ? r1((ff + cq) / 2) : 0;
   // Top-level aggregated confidence = median of per-shot confidences. Without
   // this, ship.js forwards a null top-level confidence to /tasks/:id/grade,

package/modules/grading/grader-workers/index.js

@@ -45,6 +45,17 @@ const TRANSIENT_WORKER_ERRORS = new Set([
   'SUBAGENT_NONZERO_EXIT',
 ]);
 
+// task 1003318: a context-window overflow is NOT transient. The CLI refuses the
+// request before the worker starts (`Prompt is too long: the request is ~251248
+// tokens (limit 200000)`) and refuses the retry identically, so the #465 retry
+// only burns another round. Its own tag names the cause on the grade row and
+// in the server's verdict line (grader-score.js keys the lens outage on ANY
+// errored no-finding Quality — the tag is the diagnosis, not the trigger).
+// The pattern is the API's exact sentence, so a diff that merely mentions the
+// phrase cannot trip it.
+const PROMPT_TOO_LONG_RE = /prompt is too long: the request is ~?\d+ tokens/i;
+const PROMPT_TOO_LONG = 'PROMPT_TOO_LONG';
+
 // #467: per-worker subagent timeout. The global 240s applied to EVERY worker,
 // which timed out the Read-heavy ones (Narc walks ACs + reads files — hence
 // Phase 2.0.5's 5-read workaround; Quality is next-heaviest). Per-worker budgets
@@ -176,6 +187,14 @@ async function runWorker(worker, { task, valueSummary, diff, changedFiles, diffS
       // (`claude` prints its "not logged in" line there) — fall back so the tail
       // is never empty when the subprocess did explain itself.
       stderrTail = redactStderrTail(err.stderr) ?? redactStderrTail(err.stdout);
+      // Matched on the RAW stream (the redacted tail keeps only the last 400
+      // chars), stderr first and stdout only when stderr is silent — stdout
+      // carries the model's own text. A SUBAGENT_TIMEOUT keeps its tag: it is
+      // the #467 budget signal, never a refusal.
+      if (err.code !== 'SUBAGENT_TIMEOUT') {
+        const said = String(err.stderr || '').trim() || String(err.stdout || '');
+        if (PROMPT_TOO_LONG_RE.test(said)) subprocessError = PROMPT_TOO_LONG;
+      }
     }
     const parsed = subprocessError
       ? null

package/modules/hall-ui/public/builders.js

@@ -550,17 +550,22 @@
       // A grader OUTAGE row (panel_outcome 'unavailable') carries a placeholder
       // score of 0 — label it, never render it as a 0.0 fail (task 1002652).
       const isOutage = g.panel_outcome === 'unavailable';
-      const score = isOutage ? '—' : Number(g.score).toFixed(1);
+      // A json-null gating axis (task 1003318 — the Quality worker never ran)
+      // is likewise not a judgment: the score is the surviving axis, not a fail.
+      const isLensOut = !isOutage && !!g.rubric_scores && g.rubric_scores.code_quality === null;
+      const score = isOutage || isLensOut ? '—' : Number(g.score).toFixed(1);
       const verdict = isOutage
         ? `<span style="color:var(--ink-soft,#8a8577)">not graded (grader outage)</span>`
-        : g.passed
+        : isLensOut
+          ? `<span style="color:var(--ink-soft,#8a8577)">not graded (quality lens unavailable)</span>`
+          : g.passed
           ? `<span style="color:var(--olive,#5b7a4d);font-weight:600">passed</span>`
           : `<span style="color:#a04040;font-weight:600">fell short</span>`;
       return `
         <tr>
           <td class="ledger__num">#${g.task_id}</td>
           <td>${escapeHtml(g.title || '')}</td>
-          <td class="ledger__drachmae">${isOutage ? '—' : `${score} / 10`}</td>
+          <td class="ledger__drachmae">${isOutage || isLensOut ? '—' : `${score} / 10`}</td>
           <td>${verdict}</td>
           <td class="ledger__date">${fmtDate(g.graded_at)}</td>
         </tr>

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.388",
+  "version": "1.19.389",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.388",
+      "version": "1.19.389",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.388",
+  "version": "1.19.389",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/ship-grade-steps.js

@@ -306,6 +306,33 @@ function formatGradeOutcome(g, taskId, cliFinding = null) {
     return out.join('\n');
   }
 
+  // task 1003318: ONE gating lens went dark (the Quality worker died on a
+  // context-window overflow before it started) while the rest of the panel
+  // judged the diff and found nothing substantive. The server records that axis
+  // as unavailable instead of fabricating a 0 (validateAndScore
+  // cq_lens_unavailable); present it the way #943 presents a total outage —
+  // there are no findings to fix, and the paths forward are re-grade or
+  // manual-confirm. Sits BELOW the authorization wall (a refusal is never an
+  // outage) and steps aside when any lens raised a blocker/major (then the
+  // ordinary FAIL block prints the findings). The task stays at completed.
+  const cqLensOutage = !g.passed
+    && g.signals?.cq_lens_unavailable === true
+    && g.rubric_scores?.code_quality === null
+    && !(g.issues || []).some((i) => i && (i.severity === 'blocker' || i.severity === 'major'));
+  if (cqLensOutage) {
+    out.push('');
+    out.push('Subagent grade: QUALITY LENS UNAVAILABLE  ·  the Quality worker did not run — NOT a quality rejection');
+    if (g.notes_md) out.push(g.notes_md.split('\n').map((l) => '  ' + l).join('\n'));
+    out.push(...formatOutageDiagnostic(g, null));
+    out.push('');
+    out.push('The other lenses judged the diff and found nothing substantive; code_quality is recorded as unavailable, not 0. Task stays at completed.');
+    out.push('When the grader is healthy again, re-grade:');
+    out.push(`  node scripts/gds/ship.js ${taskId} --regrade`);
+    out.push('Or land it now via manual-confirm:');
+    out.push(`  curl -X POST -H "Authorization: Bearer <token>" ${resolveInstanceBase() || '<instance-origin>'}/api/gds/tasks/${taskId}/confirm`);
+    return out.join('\n');
+  }
+
   const verdict = g.passed ? 'PASS' : 'FAIL';
   out.push('');
   out.push(`Subagent grade: ${verdict}  ·  blended ${g.score}/10  ·  threshold ${g.threshold} (both axes)`);

package/src/module-api.js

@@ -1216,8 +1216,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.386 with no explicit bump. run 33121066592. (task 1002620)
 //   1.19.388 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.387 with no explicit bump. run 33125589814. (task 1002620)
+//   1.19.389 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.388 with no explicit bump. run 33126279278. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.388'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.389'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/grader.mjs

@@ -842,20 +842,20 @@ test('selectGraderModel: builder Haiku → grader Opus', () => {
 
 // --- task 1002660: per-worker model tiering (cross-model-guarded) ---
 
-test('workerModelFor: Quality tiers down to haiku; other workers keep the panel model', () => {
+test('workerModelFor: Quality runs on its sonnet tier (task 1003318 — haiku\'s window overflowed); other workers keep the panel model', () => {
   assert.equal(
-    grader.workerModelFor('quality', 'claude-sonnet-5', 'claude-fable-5'),
-    'claude-haiku-4-5-20251001'
+    grader.workerModelFor('quality', 'claude-opus-5', 'claude-fable-5'),
+    'claude-sonnet-5'
   );
   for (const kind of ['narc', 'hacker', 'efficiency']) {
-    assert.equal(grader.workerModelFor(kind, 'claude-sonnet-5', 'claude-fable-5'), 'claude-sonnet-5');
+    assert.equal(grader.workerModelFor(kind, 'claude-opus-5', 'claude-fable-5'), 'claude-opus-5');
   }
 });
 
 test('workerModelFor: a tier override landing on the BUILDER family is refused (cross-model guarantee)', () => {
-  // A haiku builder must not be quality-judged by haiku — fall back to the panel model.
+  // A sonnet builder must not be quality-judged by sonnet — fall back to the panel model.
   assert.equal(
-    grader.workerModelFor('quality', 'claude-opus-5', 'claude-haiku-4-5-20251001'),
+    grader.workerModelFor('quality', 'claude-opus-5', 'claude-sonnet-5'),
     'claude-opus-5'
   );
 });
@@ -1795,6 +1795,7 @@ test('v4 #465/#467: TRANSIENT_WORKER_ERRORS covers infra noise but NOT timeout',
     assert.ok(t.has(code), `${code} should be retryable`);
   }
   assert.ok(!t.has('SUBAGENT_TIMEOUT'), 'timeout is a real budget signal, never retried');
+  assert.ok(!t.has('PROMPT_TOO_LONG'), 'a window overflow is deterministic, never retried (task 1003318)');
 });
 
 test('v4 #467: audit-exports classifyExports — consumed / test-only / DEAD', () => {

package/tests/grader_quality_window_overflow.mjs

@@ -0,0 +1,324 @@
+// tests/grader_quality_window_overflow.mjs
+//
+// task 1003318: the grader's Quality worker ran on haiku 4.5, whose 200k context
+// window overflows on any diff over ~150 KB. The CLI exits before the worker
+// starts (`Prompt is too long: the request is ~251248 tokens (limit 200000)`),
+// the exit was retried once as if transient, the dead axis was forwarded to the
+// server as code_quality: null → Number(null) === 0 → a fabricated
+// "FAIL — code_quality below 6" at (9+0)/2 = 4.5. Deterministic, not flaky:
+// tasks 1003297 and 1003298 each burned three ~$5 panel runs on it.
+//
+// Three things must hold now:
+//   1. the Quality tier is a model whose window covers the diffs the panel sees
+//      (claude-sonnet-5), still behind the ADR 0024 cross-model guard;
+//   2. a window overflow is recorded as its own non-transient worker error
+//      (PROMPT_TOO_LONG) — no retry, stderr tail kept — and the panel treats it
+//      as missing signal (CONCERNS), never a 0/10 axis;
+//   3. the server, seeing an explicit code_quality: null corroborated by an
+//      errored no-finding Quality worker, records the lens as UNAVAILABLE
+//      (json-null axis, score on the axis that ran, cq_lens_unavailable) and
+//      parks the task for manual-confirm — fail-closed, never an auto-pass, and
+//      never the fabricated 4.5. An uncorroborated null stays schema_error.
+//
+// Run:  node tests/grader_quality_window_overflow.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const rubric = require('../modules/grading/grader-rubric.json');
+const grader = require('../modules/grading/grader.js');
+const workersMod = require('../modules/grading/grader-workers/index.js');
+const ship = require('../scripts/gds/ship.js');
+
+const { aggregatePanel, validateAndScore, workerModelFor } = grader;
+const { runWorker, TRANSIENT_WORKER_ERRORS } = workersMod;
+const { formatGradeOutcome } = ship;
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.error(`  FAIL ${name}`); console.error(`     ${err.message}`); }
+}
+async function atest(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.error(`  FAIL ${name}`); console.error(`     ${err.message}`); }
+}
+
+const OVERFLOW_LINE = 'Prompt is too long: the request is ~251248 tokens (limit 200000)';
+
+// The exact error runSubagent throws on a nonzero exit (grader-subagent.js).
+const nonzeroExit = ({ exitCode = 1, stderr = '', stdout = '' } = {}) =>
+  Object.assign(new Error(`subagent exited with code ${exitCode}`), {
+    code: 'SUBAGENT_NONZERO_EXIT', exit_code: exitCode, run_ms: 120, stdout, stderr,
+  });
+
+// A Quality-shaped worker stub: no spawning, the real error short-circuit shape.
+const STUB_QUALITY = {
+  KIND: 'quality', NAME: 'Quality', SPECIALTY: 'stub',
+  buildPrompt: () => 'prompt',
+  extractJson: (s) => JSON.parse(s),
+  computeVerdict: (parsed, meta) => (meta.subprocess_error
+    ? { verdict: 'fail', scores: {}, issues: [], notes_md: '', confidence: 0, error: meta.subprocess_error }
+    : { verdict: 'pass', scores: { code_quality: 9 }, issues: [], notes_md: '', confidence: 0.9, error: null }),
+};
+
+const healthy = (kind, scores) => ({ kind, verdict: 'pass', scores, issues: [], confidence: 0.85, error: null });
+
+// ---------- 1. the tier ----------
+
+test('rubric: the Quality worker tier is claude-sonnet-5, not the 200k-window haiku', () => {
+  assert.equal(rubric.v4.worker_model_tiers.quality, 'claude-sonnet-5');
+  assert.doesNotMatch(String(rubric.v4.worker_model_tiers.quality), /haiku/);
+  assert.match(rubric.v4.worker_model_tiers_note, /1003318/, 'the note records why the tier moved');
+});
+
+test('workerModelFor: the sonnet tier is used for a fable builder, refused for a sonnet builder (ADR 0024 guard)', () => {
+  assert.equal(workerModelFor('quality', 'claude-sonnet-5', 'claude-fable-5'), 'claude-sonnet-5');
+  assert.equal(workerModelFor('quality', 'claude-opus-5', 'claude-sonnet-5'), 'claude-opus-5',
+    'a sonnet builder must not be graded by its own family — falls back to the panel model');
+});
+
+// ---------- 2. the worker ----------
+
+await atest('runWorker: a "Prompt is too long" exit is recorded as PROMPT_TOO_LONG and NOT retried', async () => {
+  let calls = 0;
+  const r = await runWorker(STUB_QUALITY, {
+    task: {}, diff: '', changedFiles: [], model: 'm',
+    runSubagentFn: async () => { calls++; throw nonzeroExit({ exitCode: 1, stderr: OVERFLOW_LINE }); },
+  });
+  assert.equal(calls, 1, 'a window overflow is deterministic — the retry only burns another round');
+  assert.equal(r.retried, false);
+  assert.equal(r.error, 'PROMPT_TOO_LONG');
+  assert.equal(TRANSIENT_WORKER_ERRORS.has('PROMPT_TOO_LONG'), false);
+  assert.deepEqual(r.scores, {}, 'no axis is fabricated for a worker that never ran');
+  assert.equal(r.exit_code, 1);
+  assert.match(r.stderr_tail, /Prompt is too long/, 'the CLI line survives so the grade row names its cause');
+});
+
+await atest('runWorker: the overflow line on STDOUT classifies the same way', async () => {
+  const r = await runWorker(STUB_QUALITY, {
+    task: {}, diff: '', changedFiles: [], model: 'm',
+    runSubagentFn: async () => { throw nonzeroExit({ exitCode: 1, stdout: OVERFLOW_LINE }); },
+  });
+  assert.equal(r.error, 'PROMPT_TOO_LONG');
+  assert.equal(r.retried, false);
+});
+
+await atest('runWorker: an unrelated nonzero exit keeps SUBAGENT_NONZERO_EXIT and its one retry (#465 unchanged)', async () => {
+  let calls = 0;
+  const r = await runWorker(STUB_QUALITY, {
+    task: {}, diff: '', changedFiles: [], model: 'm',
+    runSubagentFn: async () => { calls++; throw nonzeroExit({ exitCode: 1, stderr: 'Invalid API key · Run /login' }); },
+  });
+  assert.equal(calls, 2);
+  assert.equal(r.retried, true);
+  assert.equal(r.error, 'SUBAGENT_NONZERO_EXIT');
+});
+
+const DEAD_QUALITY = {
+  kind: 'quality', verdict: 'fail', error: 'PROMPT_TOO_LONG', scores: {}, issues: [],
+  confidence: 0, exit_code: 1, stderr_tail: OVERFLOW_LINE,
+};
+const PANEL_WITH_DEAD_QUALITY = [
+  healthy('narc', { functional_fidelity: 9 }),
+  DEAD_QUALITY,
+  healthy('hacker', { security_score: 9 }),
+  healthy('efficiency', { efficiency_score: 8 }),
+];
+
+test('aggregatePanel: an overflowed Quality is missing signal → CONCERNS with a null code_quality axis, not a 0', () => {
+  const r = aggregatePanel(PANEL_WITH_DEAD_QUALITY);
+  assert.equal(r.signals.panel_outcome, 'concerns');
+  assert.equal(r.passed, false);
+  assert.equal(r.rubric_scores.code_quality, null);
+  assert.equal(r.signals.error_count, 1);
+  assert.equal(r.signals.fail_count, 0);
+  assert.match(r.notes_md, /quality\s+ERROR.*PROMPT_TOO_LONG/);
+});
+
+// ---------- 3. the server ----------
+
+// What ship-grade-steps.buildGradePayload forwards for the panel above.
+const OVERFLOW_PAYLOAD = {
+  functional_fidelity: 9,
+  code_quality: null,
+  security_score: 9,
+  efficiency_score: 8,
+  notes_md: 'quality overflowed; the rest passed',
+  confidence: 0.3,
+  issues: [],
+};
+const OVERFLOW_META = { workers: PANEL_WITH_DEAD_QUALITY, panel_outcome: 'concerns' };
+
+test('validateAndScore: corroborated null cq → lens UNAVAILABLE, score on the axis that ran, never the fabricated 4.5', () => {
+  const r = validateAndScore(OVERFLOW_PAYLOAD, OVERFLOW_META);
+  assert.equal(r.passed, false, 'a gating lens that did not run can never auto-pass');
+  assert.equal(r.signals.cq_lens_unavailable, true);
+  assert.notEqual(r.signals.schema_error, true);
+  assert.equal(r.rubric_scores.code_quality, null, 'json-null axis — the DB buckets it as unavailable, not a 0 fail');
+  assert.equal(r.rubric_scores.code_quality_effective, null);
+  assert.equal(r.rubric_scores.functional_fidelity, 9);
+  assert.equal(r.score, 9, 'the axis that ran — not (9+0)/2');
+  assert.match(r.notes_md, /lens unavailable/);
+  assert.match(r.notes_md, /manual-confirm/);
+  assert.doesNotMatch(r.notes_md, /code_quality below/);
+  assert.doesNotMatch(r.notes_md, /cq=0\//);
+});
+
+test('validateAndScore: null cq with a HEALTHY Quality in signals → fail-closed schema_error (injection shape)', () => {
+  const r = validateAndScore(OVERFLOW_PAYLOAD, { workers: [
+    healthy('narc', { functional_fidelity: 9 }),
+    { ...healthy('quality', { code_quality: null }) },
+    healthy('hacker', { security_score: 9 }),
+  ] });
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.schema_error, true);
+  assert.notEqual(r.signals.cq_lens_unavailable, true);
+  assert.match(r.notes_md, /without a corroborated Quality outage/);
+});
+
+test('validateAndScore: null cq with an errored Quality that still raised a major issue → fail-closed (a finding wins)', () => {
+  const r = validateAndScore(OVERFLOW_PAYLOAD, { workers: [
+    healthy('narc', { functional_fidelity: 9 }),
+    { ...DEAD_QUALITY, issues: [{ severity: 'major', file: 'x.js', summary: 'real finding' }] },
+    healthy('hacker', { security_score: 9 }),
+  ] });
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.schema_error, true);
+  assert.notEqual(r.signals.cq_lens_unavailable, true);
+});
+
+test('validateAndScore: null cq with NO workers signal at all → fail-closed schema_error', () => {
+  const r = validateAndScore(OVERFLOW_PAYLOAD, {});
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.schema_error, true);
+});
+
+test('validateAndScore: a JUDGED cq of 0 beside an errored Quality is still a real FAIL (only corroborated null is a lens outage)', () => {
+  const r = validateAndScore({ ...OVERFLOW_PAYLOAD, code_quality: 0, confidence: 0.9 }, OVERFLOW_META);
+  assert.equal(r.passed, false);
+  assert.notEqual(r.signals.cq_lens_unavailable, true);
+  assert.equal(r.rubric_scores.code_quality, 0);
+  assert.match(r.notes_md, /code_quality below/);
+});
+
+test('validateAndScore: both lenses out (null ff + null cq, both corroborated) → unavailable, score 0, no pass', () => {
+  const r = validateAndScore({ ...OVERFLOW_PAYLOAD, functional_fidelity: null }, { workers: [
+    { kind: 'narc', verdict: 'fail', error: 'SUBAGENT_TIMEOUT', scores: {}, issues: [] },
+    DEAD_QUALITY,
+    healthy('hacker', { security_score: 9 }),
+  ] });
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.ff_lens_unavailable, true);
+  assert.equal(r.signals.cq_lens_unavailable, true);
+  assert.equal(r.score, 0);
+  assert.equal(r.rubric_scores.functional_fidelity, null);
+  assert.equal(r.rubric_scores.code_quality, null);
+});
+
+test('validateAndScore: the healthy path is byte-for-byte unchanged (both axes judged → PASS at (9+8)/2)', () => {
+  const r = validateAndScore({ functional_fidelity: 9, code_quality: 8, confidence: 0.9, issues: [], notes_md: '' }, {
+    workers: [healthy('narc', { functional_fidelity: 9 }), healthy('quality', { code_quality: 8 }), healthy('hacker', { security_score: 9 })],
+  });
+  assert.equal(r.passed, true);
+  assert.equal(r.score, 8.5);
+  assert.notEqual(r.signals.cq_lens_unavailable, true);
+});
+
+// ---------- the builder-facing card ----------
+
+test('formatGradeOutcome: a Quality-lens outage reads as UNAVAILABLE + manual-confirm, never "FAIL 4.5 — fix the issues"', () => {
+  const g = validateAndScore(OVERFLOW_PAYLOAD, OVERFLOW_META);
+  const out = formatGradeOutcome(g, 1003318);
+  assert.match(out, /QUALITY LENS UNAVAILABLE/i);
+  assert.match(out, /not a quality rejection/i);
+  assert.match(out, /Prompt is too long/, 'the CLI line explains the outage');
+  assert.match(out, /--regrade/);
+  assert.match(out, /\/confirm/, 'manual-confirm is the release valve');
+  assert.doesNotMatch(out, /Fix the issues above/);
+  assert.doesNotMatch(out, /blended 4\.5/);
+  assert.doesNotMatch(out, /code_quality:\s+0\/10/);
+});
+
+// ---------- the review's adversarial shapes (a dark lens never softens the gate) ----------
+
+await atest('runWorker: a SUBAGENT_TIMEOUT whose partial stdout quotes the overflow sentence keeps its timeout tag', async () => {
+  const r = await runWorker(STUB_QUALITY, {
+    task: {}, diff: '', changedFiles: [], model: 'm',
+    runSubagentFn: async () => {
+      throw Object.assign(new Error('timeout'), { code: 'SUBAGENT_TIMEOUT', run_ms: 360000, stdout: `quoting: ${OVERFLOW_LINE}`, stderr: '' });
+    },
+  });
+  assert.equal(r.error, 'SUBAGENT_TIMEOUT', 'the #467 budget signal is never relabelled');
+});
+
+await atest('runWorker: stdout is consulted only when stderr is silent (the model may quote a diff that mentions the phrase)', async () => {
+  const r = await runWorker(STUB_QUALITY, {
+    task: {}, diff: '', changedFiles: [], model: 'm',
+    runSubagentFn: async () => { throw nonzeroExit({ exitCode: 1, stderr: 'Invalid API key · Run /login', stdout: `diff says: ${OVERFLOW_LINE}` }); },
+  });
+  assert.equal(r.error, 'SUBAGENT_NONZERO_EXIT');
+  assert.equal(r.retried, true);
+});
+
+const BLOCKER = { severity: 'blocker', file: 'src/gds/routes/x.js', summary: 'ungated write route' };
+const HACKER_FAIL_META = { workers: [
+  healthy('narc', { functional_fidelity: 9 }),
+  DEAD_QUALITY,
+  { kind: 'hacker', verdict: 'fail', scores: { security_score: 2 }, issues: [BLOCKER], confidence: 0.9, error: null },
+], panel_outcome: 'fail' };
+
+test('validateAndScore: a Hacker BLOCKER beside a dead Quality is a FAIL with a missing axis, never an outage', () => {
+  const r = validateAndScore({ ...OVERFLOW_PAYLOAD, security_score: 2, confidence: 0, issues: [BLOCKER] }, HACKER_FAIL_META);
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.cq_lens_unavailable, true, 'the axis really is unavailable');
+  assert.equal(r.rubric_scores.code_quality, null);
+  assert.doesNotMatch(r.notes_md, /not a quality rejection/);
+  assert.doesNotMatch(r.notes_md, /manual-confirm available/);
+  assert.match(r.notes_md, /FAIL/);
+});
+
+test('formatGradeOutcome: with a blocker from another lens the card prints the findings, not the outage invitation', () => {
+  const g = validateAndScore({ ...OVERFLOW_PAYLOAD, security_score: 2, confidence: 0, issues: [BLOCKER] }, HACKER_FAIL_META);
+  const out = formatGradeOutcome(g, 1003318);
+  assert.doesNotMatch(out, /QUALITY LENS UNAVAILABLE/);
+  assert.match(out, /Issues \(1\)/);
+  assert.match(out, /ungated write route/);
+  assert.match(out, /Fix the issues above/);
+});
+
+test('formatGradeOutcome: an authorization refusal outranks the lens outage (task 1002614 stays closed)', () => {
+  const r = validateAndScore(OVERFLOW_PAYLOAD, OVERFLOW_META);
+  const g = { ...r, signals: { ...r.signals, server_guard: { tripped: [{ guard: 'permission_path' }], authorization_refusal: true } } };
+  const out = formatGradeOutcome(g, 1003318);
+  assert.match(out, /REFUSED \(authorization\)/);
+  assert.doesNotMatch(out, /QUALITY LENS UNAVAILABLE/);
+  assert.doesNotMatch(out, /--regrade re-runs the same server check[\s\S]*\/confirm/, 'no confirm curl after a refusal');
+});
+
+test('validateAndScore: a forged cq_lens_unavailable flag on a judged grade is cleared, and the card prints the ordinary FAIL', () => {
+  const r = validateAndScore({ functional_fidelity: 3, code_quality: 2, confidence: 0.9, issues: [], notes_md: '' }, {
+    cq_lens_unavailable: true, ff_lens_unavailable: true,
+    workers: [healthy('narc', { functional_fidelity: 3 }), healthy('quality', { code_quality: 2 }), healthy('hacker', { security_score: 9 })],
+  });
+  assert.equal(r.passed, false);
+  assert.equal('cq_lens_unavailable' in r.signals, false, 'client flag must not survive');
+  assert.equal('ff_lens_unavailable' in r.signals, false);
+  assert.equal(r.rubric_scores.code_quality, 2);
+  const out = formatGradeOutcome(r, 1003318);
+  assert.doesNotMatch(out, /QUALITY LENS UNAVAILABLE/);
+  assert.match(out, /Subagent grade: FAIL/);
+});
+
+test('validateAndScore: the outage line still names an absent / low confidence (the #489 signal is not hidden)', () => {
+  const absent = validateAndScore({ ...OVERFLOW_PAYLOAD, confidence: null }, OVERFLOW_META);
+  assert.equal(absent.passed, false);
+  assert.match(absent.notes_md, /UNAVAILABLE —[^\n]*confidence absent/);
+  const low = validateAndScore(OVERFLOW_PAYLOAD, OVERFLOW_META); // confidence 0.3 — the panel's fallthrough value
+  assert.match(low.notes_md, /UNAVAILABLE —[^\n]*low confidence 0\.3/);
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);