@bongos/core 1.19.889 → 1.19.891

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.889",
-  "core_contract": "1.19.889",
-  "source_commit": "b7871cd73a1ce5f73988d99ef63101a6a2d23050",
+  "core_version": "1.19.891",
+  "core_contract": "1.19.891",
+  "source_commit": "e306e6ce6ad80a4e9259cea5c81326a60ff5e7ab",
   "source_ref": "HEAD",
-  "built_at": "2026-09-19T21:23:27.620Z",
+  "built_at": "2026-09-19T21:50:27.729Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 497,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2269,
+    "functional_verbatim": 2272,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2792,
-  "tree_sha256": "b7b8bc9e53808070c5d46a211481ceef0dea2c901bc79e2b0dc0871e60c362b1",
+  "file_count": 2795,
+  "tree_sha256": "7d4974b5899a8d6ee86520b56479fb42f5256e4596ff21d29df8fd6925518fec",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2607,7 +2607,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "01a90a40951ae88d4c36c5fabbaf3debc0e02bcaa9fa8a7b70e247aa5d61d236"
+      "sha256": "d6bb312d40e0a4532550ea1faa19b5ae80e09a4dab01035513f8967aecb88f2e"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4442,12 +4442,12 @@
     {
       "path": "modules/grading/grader-rubric.json",
       "mode": "0000644",
-      "sha256": "a08fe9f320dab2d3f699700cfb9f78d1604533d930e794d556c8f9ab533cf69b"
+      "sha256": "de0ca17fedb33bd54d73759e14e6813cd9f2c8c85ef2180e49c54794c7a63a3d"
     },
     {
       "path": "modules/grading/grader-score.js",
       "mode": "0000644",
-      "sha256": "07559f7c1f53ac8de36e1fd23965a9c29344101468542d6e636a3ce4d8860b4f"
+      "sha256": "e0f665b760e2b299a7aa9098e1ab967aa330ff20f7430e0aa23d9c7c57aa0d70"
     },
     {
       "path": "modules/grading/grader-subagent.js",
@@ -4462,7 +4462,7 @@
     {
       "path": "modules/grading/grader-workers/extract-json.js",
       "mode": "0000644",
-      "sha256": "1be95c661d95cfc7f54b9f2776eed6c1cd5b6e2e852b24c80f6b638f4d775751"
+      "sha256": "b359c904c68ae8b36ac6518c79bcebf251abcf7aaef3dae4aff4a6e2175e7914"
     },
     {
       "path": "modules/grading/grader-workers/fence.js",
@@ -4477,7 +4477,7 @@
     {
       "path": "modules/grading/grader-workers/index.js",
       "mode": "0000644",
-      "sha256": "c527d3dd996b4064ae14836e305de097edea2b1a3c46776d8ec7da8c2c6afe71"
+      "sha256": "ec8046b24550ef81c26b8a421c684360873f9eaed0ec3a7e95b8546aa1e45d6f"
     },
     {
       "path": "modules/grading/grader-workers/narc.js",
@@ -4489,6 +4489,11 @@
       "mode": "0000644",
       "sha256": "1ad616532dc2c240bf94992db17b12f1334e3e74667c402d997c03c2c8df1566"
     },
+    {
+      "path": "modules/grading/grader-workers/reader.js",
+      "mode": "0000644",
+      "sha256": "b7fdf28a76914c708b628a20ee90278ed29ad1e4c886b4e4f0edb2a2515d4d2c"
+    },
     {
       "path": "modules/grading/grader-workers/rubric.js",
       "mode": "0000644",
@@ -4507,7 +4512,7 @@
     {
       "path": "modules/grading/grader.js",
       "mode": "0000644",
-      "sha256": "4c664f5080513169c35369e5406f32efa64ce24259fefc47f527a94ff8001b1f"
+      "sha256": "1234bb3c9938fd4cf71c39e4660d69c56a27de667ee7ff09b0f865374b6beba4"
     },
     {
       "path": "modules/grading/module.json",
@@ -5367,7 +5372,7 @@
     {
       "path": "modules/lifecycle/cascade.js",
       "mode": "0000644",
-      "sha256": "acc9cf557aabc3fe10efc8c7272162cf288428e8077a24f5df06648e30881337"
+      "sha256": "b168a58926ee0506d3fba4f448c797b8611bc8ae0dfeca322086f22769e7ae35"
     },
     {
       "path": "modules/lifecycle/check-rollup.js",
@@ -5797,7 +5802,7 @@
     {
       "path": "modules/lifecycle/tests/cascade.mjs",
       "mode": "0000644",
-      "sha256": "0734ad734ac5ef05c86fa81493c12fed08ffe421781d9ceeebe413c876bf9cf1"
+      "sha256": "9439accf7648ef22000c75f3e315695c806969eb5a908275d7db33e5491499f8"
     },
     {
       "path": "modules/lifecycle/version-autoclose.js",
@@ -7702,12 +7707,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "d1348f68cd79ad102a381e3d7f90b784d9df605e859269ede84ad859cc831deb"
+      "sha256": "17d7b0573d81b759182725bbb1be90a3bf1da889cdef0ef97510e3bb0e263932"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "36e895c05e2aed3f97ce34ae3b3f73b0492fff7185077519068bc69dda6a8fd6"
+      "sha256": "90befa8ce40948a6ce667f2690343e2489b3ea33c08b4d6d1e2daee5227e9c9a"
     },
     {
       "path": "public-docs/index.html",
@@ -8012,7 +8017,7 @@
     {
       "path": "scripts/gds/build-cli-package.js",
       "mode": "0000644",
-      "sha256": "630bdedb252e6d77a3427d962fca94094c747c377679ec1157644d76f142b6e8"
+      "sha256": "ca0566c509fb1ea81e7c874e2676bbcb965803509c0289c577bc8f15791e6f5c"
     },
     {
       "path": "scripts/gds/bump-version.js",
@@ -9062,7 +9067,7 @@
     {
       "path": "scripts/gds/ship-grade.js",
       "mode": "0000644",
-      "sha256": "79fcf45dd254681e7f91fe83fbb8a208b30c93eebe77df569aae505a025daa68"
+      "sha256": "b1fb38635433b579fbb38d65e92b9db226cccb753866ab7a2a15227796be66cd"
     },
     {
       "path": "scripts/gds/ship-honesty.js",
@@ -9202,7 +9207,7 @@
     {
       "path": "scripts/gds/status.js",
       "mode": "0000644",
-      "sha256": "4a1efefdb099512b31538d279b8be36cc19549fb9601d48ab47dbf43437ea1a2"
+      "sha256": "191b49e9ccbcfc7b855d834535ad5e9de0970d6e91126c7a0591e7790d196a89"
     },
     {
       "path": "scripts/gds/strand-watch.js",
@@ -9277,7 +9282,7 @@
     {
       "path": "scripts/gds/version-literal-guard.js",
       "mode": "0000644",
-      "sha256": "7e27012820d6e2fb43c84140ae6f90d4ca9345658937aa75cc9f2c28cfdaf41e"
+      "sha256": "2c0e605876762f8c6607af49374f56bc0717a1aad08c3ffdbbae383ffaf1d9dd"
     },
     {
       "path": "scripts/gds/version-select.js",
@@ -9712,7 +9717,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "541b09991f4858b3255f250ef7e52e86b0d561ec69d058e74bc218fe1a104932"
+      "sha256": "4dd8bdfcb69d7c1f7a1443175bea5379ed60daec5d19ec846a14732db59559fc"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10962,7 +10967,7 @@
     {
       "path": "tests/extract_json.mjs",
       "mode": "0000644",
-      "sha256": "8bdee65e64ba4bce81f2c8aeb3068affe78ec1bc893a8b209eece8fde5b93fa5"
+      "sha256": "74f8d8852b8949dc55ac38dd6f31da85bb55aae1215a146213495db898515086"
     },
     {
       "path": "tests/figma_adapter.mjs",
@@ -11504,6 +11509,11 @@
       "mode": "0000644",
       "sha256": "cbe81b9176d6ffdd59ea8d6955e30aab9bf6d13bd15144fd79d126455aa0e1e3"
     },
+    {
+      "path": "tests/grader_reader_lens.mjs",
+      "mode": "0000644",
+      "sha256": "93e24012252c08798e3017ce9a7130ce9ece4e5e07456892b3632ab12f44ad47"
+    },
     {
       "path": "tests/grader_regrade_delta.mjs",
       "mode": "0000644",
@@ -13579,6 +13589,11 @@
       "mode": "0000644",
       "sha256": "4b92c96ae496736b0f44182e64d42a24f108cb51fbeb5cf7cd5814ad336b14f6"
     },
+    {
+      "path": "tests/status_default_version.mjs",
+      "mode": "0000644",
+      "sha256": "9a80ed43b685ea537944886a1a4a02d35580c109bd777373e30b63afd9aa73df"
+    },
     {
       "path": "tests/status_mirror_sync.mjs",
       "mode": "0000644",
@@ -13867,7 +13882,7 @@
     {
       "path": "tests/version_literals.mjs",
       "mode": "0000644",
-      "sha256": "17e872131c17bae7a061debc1fd3ee354ab704678b475edd6a8b1dfdd63ceb2f"
+      "sha256": "3b706518920bc48e1bcd5a0185a5829a179fa0e73a6ed491320327d2cb7c8c68"
     },
     {
       "path": "tests/version_override_visibility.mjs",

package/docs/module-api-changelog.md

@@ -2252,5 +2252,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.887 with no explicit bump. run 35468948342. (task 1002620)
   1.19.889 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.888 with no explicit bump. run 35470239834. (task 1002620)
+  1.19.890 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.889 with no explicit bump. run 35470624284. (task 1002620)
+  1.19.891 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.890 with no explicit bump. run 35471575521. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/grading/grader-rubric.json

@@ -12,16 +12,16 @@
     "assumed_builder_model": "claude-fable-5",
     "model_refresh_note": "task 1002659 (2026-08-11): pins refreshed to the Claude 5 family. Assumed builder = claude-fable-5 (the owner-top-model default per CLAUDE.md §2); default grader = claude-sonnet-5 (cross-model per ADR 0024, cost-parity with the prior sonnet-4-6 posture — opus-5 grades the sonnet/haiku builders where the grader should be the stronger model). selectGraderModel no longer throws on an unknown builder id: it warns loudly and falls back to default_model (the #117 throw stranded ships whose builder id lacked an opus/sonnet/haiku substring — exactly what claude-fable-5 is).",
     "active_panel": ["narc", "quality", "hacker", "efficiency"],
-    "worker_model_tiers": { "quality": "claude-sonnet-5" },
-    "worker_model_tiers_note": "task 1002660: per-worker cost tiering. Quality was 41% of panel spend with 75% nit findings — its cq/economy lens ran on the haiku tier. task 1003318: moved to claude-sonnet-5 — haiku 4.5's 200k window overflows on any diff over ~150 KB (`Prompt is too long`, deterministic; tasks 1003297 and 1003298 each lost three ~$5 panel runs to it) and a Quality worker that never starts is missing signal on a GATING lens. For fable/opus builders the panel model is already claude-sonnet-5, so the tier coincides with default_model and acts as a floor — a future default_model bump must not pin Quality back onto a smaller window; it stays a live cost lever only for haiku builders (whose panel runs on opus-5). workerModelFor refuses an override that lands on the builder's own model family (the ADR 0024 cross-model guarantee outranks the cost lever); gate semantics unchanged — Quality's verdict still gates identically.",
+    "worker_model_tiers": { "quality": "claude-sonnet-5", "reader": "claude-sonnet-5" },
+    "worker_model_tiers_note": "task 1002660: per-worker cost tiering. Quality was 41% of panel spend with 75% nit findings — its cq/economy lens ran on the haiku tier. task 1003318: moved to claude-sonnet-5 — haiku 4.5's 200k window overflows on any diff over ~150 KB (`Prompt is too long`, deterministic; tasks 1003297 and 1003298 each lost three ~$5 panel runs to it) and a Quality worker that never starts is missing signal on a GATING lens. For fable/opus builders the panel model is already claude-sonnet-5, so the tier coincides with default_model and acts as a floor — a future default_model bump must not pin Quality back onto a smaller window; it stays a live cost lever only for haiku builders (whose panel runs on opus-5). workerModelFor refuses an override that lands on the builder's own model family (the ADR 0024 cross-model guarantee outranks the cost lever); gate semantics unchanged — Quality's verdict still gates identically. task 1003977: the READER is pinned to claude-sonnet-5 for the same task-1003318 reason — it is Read-heavy by construction (the voice guide, then the render paths that decide whether a string is user-facing), and a small window fails deterministically with PROMPT_TOO_LONG. For a NON-GATING worker that means silently reading no copy at all on exactly the biggest copy diffs, with nothing blocking to reveal it.",
     "fallthrough_confidence": 0.3,
     "low_confidence_threshold": 0.4,
     "rationale": "GDS-V3 task #410 (MAS Phase 2.0), 2026-05-29. Supersedes v3 (single-prompt 3-shot generalist). Phase 1 calibration showed minimal between-shot disagreement on the same prompt — the strict gate fired correctly but the diversity signal was weak. v4 trades sampling-variance for lens-specialization: replace 3 identical-prompt shots with N workers (each a distinct prompt focused on one axis). Phase 2.0 ships 2 of the 3 planned workers (narc for completion, quality for cq + advisory economy) — keeps the gate at the same strictness while the framework calibrates. Phase 2.1 adds hacker (security; wraps /builder-redteam as a CI gate). Phase 2.2 adds efficiency_monger.",
     "worker_contract": {
-      "kind": "string — worker registry key (narc | quality | hacker | efficiency)",
+      "kind": "string — worker registry key (narc | quality | hacker | efficiency | reader)",
       "name": "string — display name",
       "specialty": "string — one-line description of what this worker judges",
-      "verdict": "'pass' | 'concerns' | 'fail' — per-worker verdict, sub-classification of the panel gate",
+      "verdict": "'pass' | 'concerns' | 'fail' — per-worker verdict, sub-classification of the panel gate; plus 'advisory', the ONLY verdict a NON-GATING worker emits (task 1003977 — see active_workers.reader and panel_gate.non_gating). Mirrored by WORKER_VERDICTS in grader-score.js, which hasPanelEvidence checks with an `every`.",
       "scores": "{ functional_fidelity?, code_quality?, economy? } — only the axes this worker reports",
       "issues": "[{ severity, file, summary }] — concrete problems found",
       "notes_md": "short markdown summary",
@@ -31,12 +31,22 @@
       "error": "null | 'parse_error' | 'schema_error' | 'SUBAGENT_*' — set when the subagent comms failed; verdict will be 'fail'"
     },
     "panel_gate": {
-      "fail": "ANY worker.verdict='fail' OR worker.error != null → overall passed=false, no advance to confirmed.",
-      "concerns": "ANY worker.verdict='concerns' (and no fails) → overall passed=false, forwarded confidence = fallthrough_confidence (manual-confirm available).",
-      "pass": "ALL workers.verdict='pass' → overall passed=true, advance to confirmed."
+      "fail": "ANY GATING worker.verdict='fail' OR worker.error != null → overall passed=false, no advance to confirmed.",
+      "concerns": "ANY GATING worker.verdict='concerns' (and no fails) → overall passed=false, forwarded confidence = fallthrough_confidence (manual-confirm available).",
+      "pass": "ALL GATING workers.verdict='pass' → overall passed=true, advance to confirmed.",
+      "non_gating": "task 1003977: a worker in NON_GATING_WORKERS (today: reader) is partitioned out of workerResults BEFORE any gate arithmetic — the pass/concerns/fail counts, the missing-signal and total-outage detection, the forwarded-confidence median and every verdict branch read the gating workers only. Its scores and issues still land in rubric_scores and signals.workers. Consequence worth stating out loud: a HEALTHY non-gating worker cannot mask a total grader outage by making 'every gating worker is missing signal' false — that is the task-1003574 regression class, where an outage presented as FAIL 0/10 and routed the builder to a re-grade that could not clear it."
     },
     "severity_gate_policy": "Task 1002663: style findings (comment style/length/placement, naming conventions, doc placement, test-name conventions) are ADVISORY — severity nit, recorded in issues[] for the audit trail, never a verdict driver. Enforced deterministically in grader-workers/worker-verdict.js applySeverityGatePolicy for narc/quality/efficiency: a worker 'fail' whose only basis is a sub-threshold score with NO major/blocker finding is an inconsistent self-report and downgrades to 'concerns' (manual-confirm pause) — a worker whose findings are all nit/minor can never verdict fail. The HACKER is deliberately EXEMPT: the security lens stays fail-closed on an unbacked sub-threshold score (a real finding mislabeled minor must still hard-fail). Untouched everywhere: blocker-driven fails, non-score fail triggers (Narc missing-AC), error short-circuits. Every worker prompt carries the matching STYLE_ADVISORY paragraph (worker-prompt.js).",
     "active_workers": {
+      "reader": {
+        "specialty": "user-facing copy: truth, clarity, voice, judged against docs/voice.md",
+        "scores_reported": ["copy_score"],
+        "gating": false,
+        "verdict_rules": "NON-GATING (task 1003977, ADR 0298). Emits the single verdict 'advisory' on every path INCLUDING its own errors — computeVerdict has no branch returning pass/concerns/fail, so 'cannot block' is a property of the function, not a promise kept by callers. aggregatePanel additionally partitions it out of the gate (NON_GATING_WORKERS in grader-workers/index.js). Belt and braces: a filter is one refactor from being forgotten, a verdict is not. Stronger than the advisory treatment narc receives, which only downgrades a fail to manual-confirm — the reader cannot reach 'concerns' either. A 'blocker' severity is FLOORED to 'major' rather than dropped: the observation survives, the veto does not. Deliberately NO blocker escape hatch of the kind narc/hacker carry (grader.js isAdvisory, '... && !hasBlocker'), because that hatch is the exact hole the owner's term closes. An errored reader records NO copy_score rather than 0 — a 0 is a real reading, an outage is missing signal (the #943 distinction, per worker).",
+        "scope": "copy-bearing diffs ONLY. The caller (scripts/gds/ship-grade.js) asks hasCopyOrVisualWork(task) from modules/lifecycle/cascade.js and passes the answer to WORKERS.panelFor({ copyBearing }); the grading module may not require a sibling module (ADR 0083, CI-enforced), and a second predicate inside grading would let the at-ship lens and the after-the-fact artist review disagree about what they cover. Where false the panel is byte-identical to DEFAULT_PANEL and costs what it costs today, and the skip is recorded as signals.reader_skipped='not_copy_bearing' — never a silent absence, because a missing copy score must not read as a passing one.",
+        "standard": "docs/voice.md (task 1003976), cited by rule id. Hard rules V1-V5 are checkable and may be ASSERTED as breaks; judgement rules V6-V11 may only be FLAGGED with the line quoted. A finding that cites no rule id is not a finding — the guide's own rule, carried into the prompt, and what keeps an advisory lens from recording taste as fact.",
+        "prompt_lives_in": "modules/grading/grader-workers/reader.js"
+      },
       "narc": {
         "specialty": "semantic completion (description vs diff, line-level)",
         "scores_reported": ["functional_fidelity"],

package/modules/grading/grader-score.js

@@ -55,7 +55,13 @@ function isSubstantiveIssue(it) {
 // grade-time input (the ADR's documented honor-system residual for Metic+);
 // its job is separating "the panel ran and unanimously found nothing" (the
 // guard's confirmed false-positive class) from "no evidence at all".
-const WORKER_VERDICTS = new Set(['pass', 'concerns', 'fail']);
+// 'advisory' (task 1003977) is the Reader's only verdict — a non-gating lens
+// whose row must still COUNT AS EVIDENCE that the panel ran. Omit it here and
+// hasPanelEvidence returns false for every copy-bearing ship, because the check
+// below is an `every`: one unrecognised verdict makes a fully-healthy five-worker
+// panel look like no evidence at all, and the implausible-pass guard then fires
+// on exactly the ships that carry the most lenses.
+const WORKER_VERDICTS = new Set(['pass', 'concerns', 'fail', 'advisory']);
 function hasPanelEvidence(signals) {
   const ws = Array.isArray(signals?.workers) ? signals.workers : null;
   if (!ws || ws.length < 3) return false;

package/modules/grading/grader-workers/extract-json.js

@@ -17,7 +17,13 @@
 
 // Score keys that mark a parsed object as the real grade (vs an incidental
 // prose object). Module-level so extractJson doesn't re-allocate per call.
-const GRADE_SHAPE_KEYS = ['functional_fidelity', 'code_quality', 'security_score', 'efficiency_score'];
+// task 1003977: 'copy_score' joins the list when the Reader joins the panel.
+// reader.js re-exports THIS extractJson, so without its key the disambiguation
+// above silently does not apply to it — an ambiguous multi-object response would
+// fall back to candidates[0] with no score-based preference. It fails safe (a
+// non-gating worker with no signal blocks nothing), but failing safe is not the
+// same as getting the protection every other worker gets.
+const GRADE_SHAPE_KEYS = ['functional_fidelity', 'code_quality', 'security_score', 'efficiency_score', 'copy_score'];
 
 function extractJson(raw) {
   if (typeof raw !== 'string') return null;

package/modules/grading/grader-workers/index.js

@@ -18,18 +18,52 @@ const narc = require('./narc');
 const quality = require('./quality');
 const hacker = require('./hacker');
 const efficiency = require('./efficiency');
+const reader = require('./reader');
 
 const REGISTRY = {
   [narc.KIND]: narc,
   [quality.KIND]: quality,
   [hacker.KIND]: hacker,
   [efficiency.KIND]: efficiency,
+  [reader.KIND]: reader,
 };
 
 // The active panel for the ship-time gate. Order is presentation-only —
 // workers run in parallel inside gradeSubagent.
 const DEFAULT_PANEL = [narc.KIND, quality.KIND, hacker.KIND, efficiency.KIND];
 
+// Workers that are NEVER part of the gate — not a hard fail, not a downgrade to
+// concerns, not a missing-signal outage. Distinct from grader.js's
+// ADVISORY_WORKERS ('narc'), which only softens a fail into manual-confirm.
+//
+// The Reader is here because the owner's term for it (2026-09-17, ADR 0298) is
+// absolute: ADR 0241 put the artist's judgement on the DEPLOY and off the ship
+// path, and a copy lens that could hold a ship puts back what ADR 0162 retired.
+// Deliberately NO blocker escape hatch of the kind narc/hacker carry — see the
+// header of reader.js for why that hatch would be the hole the term closes.
+//
+// This set is belt; reader.js's computeVerdict, which cannot return anything but
+// 'advisory', is braces. Either alone would hold; both, because a filter is one
+// refactor from being forgotten and a verdict is not.
+const NON_GATING_WORKERS = new Set([reader.KIND]);
+function isNonGatingKind(kind) { return NON_GATING_WORKERS.has(kind); }
+
+// The panel for one ship. `copyBearing` is the CALLER's answer, never computed
+// here: the one definition is hasCopyOrVisualWork() in modules/lifecycle/
+// cascade.js, and a module may require only src/module-api.js (ADR 0083), so
+// grading cannot reach it. Writing a second predicate here is exactly what the
+// task forbids — the at-ship lens and the after-the-fact artist review must
+// never disagree about what they cover, and widening that set must widen both
+// at once. So the caller (scripts/gds/ship-grade.js, which is not a module and
+// may require both) asks lifecycle and passes the answer down.
+//
+// Where it is false the panel is BYTE-IDENTICAL to today's and costs what it
+// costs today. The skip is recorded by the caller as a visible signal, never as
+// a silent absence — a missing copy score must not read as a passing one.
+function panelFor({ copyBearing = false } = {}) {
+  return copyBearing ? [...DEFAULT_PANEL, reader.KIND] : [...DEFAULT_PANEL];
+}
+
 // #465: transient subprocess/parse errors are infra noise, not a quality
 // signal — auto-retry the worker ONCE on these before letting the error stand.
 // Deliberately EXCLUDES:
@@ -79,6 +113,11 @@ const WORKER_MAX_TIMEOUT_MS = {
   quality: 360_000,    // Read-heavy: reads changed files for cleanliness review
   hacker: 360_000,     // Read-heavy on a security diff: exploit-surface scan of every changed file
   efficiency: 360_000, // Read-heavy on a large diff: traces perf across every changed file
+  // Read-heavy by construction: the Reader's first Read is the voice guide, and
+  // the rest confirm that a string really is user-facing. Same heavy tier as the
+  // rest — worst-case panel wall time is max(), and the four already sit at 360s,
+  // so adding a fifth at the same budget does not move it (task 1003977).
+  reader: 360_000,
 };
 
 // task 1003313: the diagnostic a dark panel used to throw away.
@@ -244,6 +283,9 @@ async function runWorker(worker, { task, valueSummary, diff, changedFiles, diffS
 module.exports = {
   REGISTRY,
   DEFAULT_PANEL,
+  NON_GATING_WORKERS,
+  isNonGatingKind,
+  panelFor,
   resolvePanel,
   runWorker,
   timeoutForWorker, // public surface; WORKER_MAX_TIMEOUT_MS stays module-internal
@@ -255,4 +297,5 @@ module.exports = {
   quality,
   hacker,
   efficiency,
+  reader,
 };

package/modules/grading/grader-workers/reader.js

@@ -0,0 +1,218 @@
+// The Reader — the advisory copy lens (task 1003977, ADR 0298).
+//
+// Specialty: the SENTENCES. Is a line a person reads true, clear, in the
+// project's voice, and worth their attention? The other four workers read
+// completion (Narc), code quality (Quality), security (Hacker) and runtime cost
+// (Efficiency); not one of them reads a sentence. Task 1003937 established that
+// across four consecutive artist reviews, all of which found the same wall and
+// all of whose graded ships deservedly passed on the axes that WERE measured.
+//
+// ADVISORY, FULL STOP — and that is structural here, not a filter elsewhere.
+// This worker's computeVerdict cannot return 'fail' or 'concerns'; it returns
+// the single verdict 'advisory' on every path, including its own errors. The
+// panel then excludes it from the gate (NON_GATING_WORKERS in index.js, and the
+// partition in grader.js aggregatePanel). Two independent mechanisms, because
+// the owner's term (2026-09-17) is absolute: ADR 0241 put the artist's judgement
+// on the DEPLOY and off the ship path, after ADR 0162 retired review gates for
+// stranding graded-PASS work. A reader that could fail a ship puts that back.
+//
+// NOTE THIS IS STRONGER THAN ADVISORY_WORKERS. The Narc is "advisory" in the
+// sense that a Narc-only fail DOWNGRADES to concerns (manual-confirm). The
+// Reader cannot reach concerns either. There is deliberately NO blocker escape
+// hatch of the kind narc/hacker carry ("advisory ONLY if it carries no
+// blocker"): a copy lens finding something that genuinely blocks a ship is a
+// finding in another lens's territory, and the escape hatch would be the exact
+// hole the owner's term closes.
+//
+// THE STANDARD IS WRITTEN DOWN. docs/voice.md (task 1003976) is the rubric, and
+// its own rule is that a finding citing no rule id is not a finding. The guide
+// splits HARD rules (V1-V5, checkable — a lens may assert a break) from
+// JUDGEMENT rules (V6-V11, recognisable but not provable — a lens may only FLAG
+// a candidate and must quote the line). That split is reproduced in the prompt
+// below, because it is what keeps an advisory lens from recording taste as fact.
+
+const { buildWorkerPrompt, LLM_PROJECT } = require('./worker-prompt');
+const { parseCommon } = require('./worker-verdict');
+const { extractJson } = require('./extract-json');
+
+const KIND = 'reader';
+const NAME = 'Reader';
+const SPECIALTY = 'user-facing copy: truth, clarity, voice (docs/voice.md), against the written guide';
+
+// The ONE verdict this worker emits. Not 'pass': a pass is a claim the gate may
+// read, and an errored Reader claiming 'pass' would be a false one. Registered
+// in grader-score.js WORKER_VERDICTS so hasPanelEvidence still recognises a
+// panel that carries a Reader row.
+const ADVISORY_VERDICT = 'advisory';
+
+const PROMPT_HEADER = `You are the **Reader** — the copy lens for the ${LLM_PROJECT} project. You read the SENTENCES a person will see.
+
+You are ADVISORY. Nothing you report can block this ship, and you should not write as though it could. Your output is coaching for the artist who reviews this work afterwards, and a record of where the grade was otherwise blind.
+
+Your ONLY job is user-facing copy. You do NOT score whether the description was implemented (Narc), whether the code is well-written (Quality), whether it is secure (Hacker), or what it costs to run (Efficiency). If you notice something in those territories, say so in \`notes_md\` and move on — do not file it as an issue.
+
+## The standard is written down, and you must cite it
+
+\`docs/voice.md\` is the voice guide. **Read it first** — it is the rubric for this grade, and its rules carry ids (V1, V2, …).
+
+**A finding that cites no rule id is not a finding.** If a line is bad and no rule in the guide reaches it, say that in \`notes_md\` as a gap in the guide. Do not invent a rule at grade time. This is the guide's own instruction and it is what separates a lens from a second model's taste.
+
+The guide splits its rules in two, and the split governs what you may say:
+
+- **Hard rules (V1-V5)** can be checked. A line either breaks one or it does not. You MAY assert a break.
+- **Judgement rules (V6-V11)** name a failure a person can recognise but a checker cannot prove. You may **flag a candidate** and must quote the line and the rule id. You may NEVER assert that the line is wrong. The artist decides.
+
+Set \`kind\` on every issue to \`"break"\` (hard rule, asserted) or \`"flag"\` (judgement rule, offered). A judgement-rule issue filed as a break is the single most damaging thing you can do here, because it records taste as fact.
+
+## What counts as user-facing copy
+
+What the guide governs: every string a person reads on the builders' hall, the status dashboard and the landing surface; server-side route failures and validation text; outbound broadcast text.
+
+What it does NOT govern, and you must not score: repository documentation, ADRs, session logs, code comments, commit messages, skill prose. Those are written for builders and agents in ordinary technical prose. A diff that changes ONLY those carries no copy for you to read — say so and score 10.
+
+## How you work
+
+1. Read \`docs/voice.md\`.
+2. Walk the diff for CHANGED or ADDED user-facing strings. Quote each line you judge.
+3. For each, name the rule id it breaks or that it is a candidate against.
+4. Score \`copy_score\` (0-10):
+   - 10 = no user-facing copy changed, or every changed line is clean against the guide.
+   - 8 = clean; one or two judgement-rule flags worth the artist's eye.
+   - 6 = at least one hard-rule break in a line a person will read.
+   - 4 = several hard-rule breaks, or one in a high-traffic surface.
+   - 2 = the copy actively misleads (a word that means something else here, a claim the code does not support).
+   - 0 = the copy is wrong in a way that would embarrass the project in front of a user.
+
+   The score is a RECORD, not a gate. Nothing happens to the ship at any value.
+
+5. Severities: \`major\` for a hard-rule break on a line a person reads; \`minor\` for a hard-rule break somewhere quiet; \`nit\` for a judgement-rule flag. Never \`blocker\` — you cannot block, and a blocker severity from this lens is a category error.
+
+## Read budget
+
+**5 Read calls.** Spend the first on \`docs/voice.md\`. Spend the rest confirming that a string you are judging really is user-facing — the surrounding render path tells you, and a string in a code comment is not copy.
+
+## Sanity checks
+
+- A diff with no user-facing string changes scores 10 with no issues. That is a normal, common outcome. Do not manufacture findings to look useful.
+- Every issue quotes the line and names a rule id.
+- No issue carries severity \`blocker\`.
+- Do not rewrite the copy for them unless the fix is obvious and one line; the artist owns the remake.
+
+## Return ONLY JSON
+
+No prose, no markdown fences:
+
+\`\`\`
+{
+  "copy_score": <number 0-10>,
+  "confidence": <number 0-1>,
+  "reads_used": <integer 0-5>,
+  "strings_reviewed": [
+    { "where": "<file:line>", "line": "<the string, quoted>", "verdict": "ok"|"break"|"flag", "rule": "<V-id or null>" }
+  ],
+  "issues": [
+    { "severity": "major"|"minor"|"nit", "kind": "break"|"flag", "rule": "<V-id>", "file": "<path>", "summary": "<one line, quotes the copy and names the rule>" }
+  ],
+  "notes_md": "<short markdown — which surfaces carried copy, what you could not judge, and any gap in the guide you hit>"
+}
+\`\`\`
+
+You have a Read tool with a hard budget of 5 calls. Do not run tests, do not edit files, do not call the network.`;
+
+function buildPrompt({ task, valueSummary, diff, changedFiles, diffStats, priorRound, contextBundle }) {
+  return buildWorkerPrompt({
+    priorRound,
+    contextBundle,
+    header: PROMPT_HEADER,
+    task: task || {},
+    valueSummary,
+    diff,
+    changedFiles,
+    taskHeader: '## Task (context — you judge the copy, not the completion)',
+    descLabel: '**Description:**',
+    emptyFilesText: '(no files changed)',
+    readFilesHint: 'You can Read any of these files to see their post-merge state (5-call budget — spend the first on docs/voice.md).',
+    finalInstruction: 'Now read the copy. Cite a rule id on every finding, or do not file it. Output ONLY the JSON object.',
+  });
+}
+
+// The Reader's verdict is 'advisory' on EVERY path — a clean read, a bad read,
+// a crashed subagent, a timeout. There is no branch that returns anything else,
+// which is what makes "it cannot block" a property of this function rather than
+// a promise kept by its callers.
+//
+// An error still travels: `error` is set, the notes say so, and copy_score is
+// null rather than 0. A 0 would be a real score meaning "the copy is wrong in a
+// way that would embarrass the project", and an outage is not that. The same
+// distinction #943 draws for the panel — missing signal is not a bad signal.
+function computeVerdict(parsed, meta = {}) {
+  const advisory = (extra) => ({
+    verdict: ADVISORY_VERDICT,
+    scores: {},
+    issues: [],
+    confidence: null,
+    error: null,
+    ...extra,
+  });
+
+  if (meta.subprocess_error) {
+    return advisory({
+      notes_md: `Reader — ADVISORY, no signal: subagent error (${meta.subprocess_error}). The copy was not read; this does not affect the ship.`,
+      error: meta.subprocess_error,
+    });
+  }
+  if (!parsed || typeof parsed !== 'object') {
+    return advisory({
+      notes_md: 'Reader — ADVISORY, no signal: could not parse subagent output as JSON. The copy was not read; this does not affect the ship.',
+      error: 'parse_error',
+    });
+  }
+
+  const { conf, issues: rawIssues, notesFromSubagent } = parseCommon(parsed);
+  const score = Number(parsed.copy_score);
+  const reviewed = Array.isArray(parsed.strings_reviewed) ? parsed.strings_reviewed : [];
+
+  // A blocker from this lens is a category error, not a blocking finding. It is
+  // FLOORED to major rather than dropped: the observation may be real and the
+  // artist should see it; what it may not be is a severity the gate reads as
+  // blocking. Dropping it would hide a finding; honouring it would hand this
+  // worker the veto the owner's term denies it.
+  const issues = rawIssues.map((i) => (
+    i && i.severity === 'blocker'
+      ? { ...i, severity: 'major', severity_floored_from: 'blocker' }
+      : i
+  ));
+
+  if (!Number.isFinite(score) || score < 0 || score > 10) {
+    return advisory({
+      issues,
+      notes_md: `Reader — ADVISORY, no score: copy_score was non-numeric or out of range (got ${parsed.copy_score}). Findings below still stand.`,
+      error: 'schema_error',
+      confidence: conf,
+    });
+  }
+
+  const s = Math.round(score * 10) / 10;
+  const breaks = issues.filter((i) => i.kind === 'break').length;
+  const flags = issues.filter((i) => i.kind === 'flag').length;
+  const prefix = `Reader — ADVISORY (copy=${s}/10, ${breaks} rule break${breaks === 1 ? '' : 's'}, ${flags} flag${flags === 1 ? '' : 's'}, ${reviewed.length} string${reviewed.length === 1 ? '' : 's'} reviewed, conf=${conf ?? '?'})`;
+
+  return advisory({
+    scores: { copy_score: s },
+    issues,
+    strings_reviewed: reviewed,
+    notes_md: `${prefix}\n${notesFromSubagent.trim()}`.trim(),
+    confidence: conf,
+  });
+}
+
+module.exports = {
+  KIND,
+  NAME,
+  SPECIALTY,
+  ADVISORY_VERDICT,
+  PROMPT_HEADER,
+  buildPrompt,
+  extractJson,
+  computeVerdict,
+};