@coreplane/switchboard 1.254.1 → 1.256.0

package/dist/assets/src/core/reviewVerdict.ts

@@ -33,6 +33,7 @@
 
 import { normalizeHead } from "./reviewedHead.js";
 import { redactSecrets } from "./redact.js";
+import { shows, type Verbosity } from "./verbosity.js";
 
 export type ReviewVerdictKind = "approve" | "request_changes";
 
@@ -108,6 +109,14 @@ export interface Finding {
   line?: number;
   /** One line naming the issue; the full explanation lives in the prose. */
   title: string;
+  /** The finding's remedy is a receipt only a person can produce — a replay
+   *  that needs a provider credential no sandbox holds, a procedure a person
+   *  runs live — so no fix round can address it. Set by the reviewer beside the
+   *  severity through `submit_verdict`; ship's coordinator reads this flag,
+   *  never prose, and a round whose actionable findings all carry it ends
+   *  `held` (docs/reference/specs/agent-ship.md item 9). Anything but the
+   *  literal `true` is dropped and the finding stands as actionable. */
+  humanGated?: true;
   /** Machine provenance: true only on a check finding the ship round's checks
    *  step itself appended (ship/coordinator.ts `checkFinding`) — never set from
    *  a reviewer's input, whatever id the reviewer chose. */
@@ -222,6 +231,9 @@ function parseFinding(
   // dropping the whole finding over a bad line would also drop the severity
   // that the approve→request_changes downgrade keys on.
   if (typeof r.line === "number" && Number.isInteger(r.line) && r.line >= 1) finding.line = r.line;
+  // Fail-open on the flag alone: a malformed humanGated never drops the
+  // finding — it stands as actionable, which is the conservative reading.
+  if (r.humanGated === true) finding.humanGated = true;
   return { finding };
 }
 
@@ -237,11 +249,42 @@ export function verdictLine(verdict: ReviewVerdict | undefined): string {
   return summary ? `${token} ${summary}` : token;
 }
 
+/** The counted plural for a severity: `blocker` and `nit` inflect, `major`
+ *  and `minor` read as adjectives and stay uninflected. */
+function severityCount(sev: FindingSeverity, n: number): string {
+  if (sev === "blocking") return `${n} blocker${n === 1 ? "" : "s"}`;
+  if (sev === "nit") return `${n} nit${n === 1 ? "" : "s"}`;
+  return `${n} ${sev}`;
+}
+
+/** The verdict as ONE line in the user's words (record 0066): `LGTM` for an
+ *  approve, `Changes requested: 2 blockers, 1 major, 2 minor, 3 nits` — only
+ *  the non-zero counts, most severe first — for a request for changes, the
+ *  bare token word when the findings were not itemized or none were filed.
+ *  The quiet thread reply prints this and nothing more; the full verdict line
+ *  and the finding bullets are `verbose` material and stay on the pull
+ *  request, where the post-step put them. */
+export function verdictCountsLine(verdict: ReviewVerdict): string {
+  if (verdict.verdict === "approve") return "LGTM";
+  const counts = severityCounts(verdict.findings ?? []);
+  return counts ? `Changes requested: ${counts}` : "Changes requested";
+}
+
+/** The non-zero severity counts of a finding list, most severe first —
+ *  `2 blockers, 1 major, 2 minor, 3 nits` — or the empty string for none.
+ *  Shared by the quiet verdict line and the quiet round-cap report. */
+export function severityCounts(findings: readonly Finding[]): string {
+  return FINDING_SEVERITIES.map((sev) => [sev, findings.filter((f) => f.severity === sev).length] as const)
+    .filter(([, n]) => n > 0)
+    .map(([sev, n]) => severityCount(sev, n))
+    .join(", ");
+}
+
 /** One compact finding line — `[severity] id file[:line] — title` — shared by
  *  the posted body's list (bulleted below) and ship's synthesized child turns. */
 export function formatFinding(f: Finding): string {
   const location = f.line !== undefined ? `${f.file}:${f.line}` : f.file;
-  return `[${f.severity}] ${f.id} ${location} — ${f.title}`;
+  return `[${f.severity}] ${f.id} ${location} — ${f.title}${f.humanGated ? " (human-gated)" : ""}`;
 }
 
 /** One compact disposition line — `id: fixed|declined[ — note]` — the coding
@@ -318,6 +361,7 @@ function verdictMarker(verdict: ReviewVerdict | undefined, target: ReviewBodyTar
             severity: f.severity,
             file: f.file,
             ...(f.line !== undefined ? { line: f.line } : {}),
+            ...(f.humanGated ? { humanGated: true } : {}),
           })),
         }
       : {}),
@@ -369,6 +413,13 @@ export function buildReviewPostBody(
  * opt-out, a guard refusal) or findings not itemized (a list that says
  * nothing is no substitute) — so the review's text is always somewhere a
  * person reads it. No verdict → the bare answer with the link, as before.
+ *
+ * The request's verbosity decides how much of the verdict the thread hears
+ * (routing-and-config item 28, record 0066): below `verbose`, a verdict whose
+ * findings are itemized and posted to GitHub is ONE line — `verdictCountsLine`
+ * with the pull request link — because the full verdict, the finding lines and
+ * the prose already stand on the pull request; at `verbose`, and whenever the
+ * text would otherwise land nowhere a person reads it, the full render above.
  */
 export function buildReviewChannelReply(input: {
   answer: string;
@@ -376,8 +427,18 @@ export function buildReviewChannelReply(input: {
   /** The PR the post landed on, or undefined when nothing was posted. */
   posted: { repo: string; number: number } | undefined;
   liveUrl: string | undefined;
+  /** The request's level (default `verbose`: the full render, the row's shape). */
+  verbosity?: Verbosity;
 }): string {
   const { answer, verdict, posted, liveUrl } = input;
+  if (
+    !shows(input.verbosity ?? "verbose", "verbose") &&
+    verdict !== undefined &&
+    verdict.findings !== undefined &&
+    posted !== undefined
+  ) {
+    return `${verdictCountsLine(verdict)} — https://github.com/${posted.repo}/pull/${posted.number}`;
+  }
   const tail = [
     ...(posted && verdict ? [`Posted to ${posted.repo}#${posted.number}`] : []),
     ...(liveUrl ? [`[Live run](${liveUrl})`] : []),
@@ -463,7 +524,8 @@ function isFindingShape(v: unknown): v is Finding {
     (FINDING_SEVERITIES as readonly string[]).includes(v.severity as string) &&
     typeof v.file === "string" &&
     typeof v.title === "string" &&
-    (v.line === undefined || typeof v.line === "number")
+    (v.line === undefined || typeof v.line === "number") &&
+    (v.humanGated === undefined || v.humanGated === true)
   );
 }
 

package/dist/assets/src/core/runEvents.ts

@@ -418,6 +418,16 @@ export type ShipRoundOutcome =
    *  0055): the failures become check findings and the findings step runs as
    *  for any changes-requested round. */
   | "checks_failed"
+  /** The round's coding child died on a provider transient with nothing
+   *  pushed (issue 1932): the first such boundary marks the round's one
+   *  re-run, a second the `transient` ending. */
+  | "transient"
+  /** The merge door enqueued the pull request — the base takes changes only
+   *  through a merge queue (issue 2011): the unit waits for the queue's outcome. */
+  | "enqueued"
+  /** The merge queue removed the pull request: the removal reason becomes a
+   *  finding of the round, like a red check, and a fix round follows. */
+  | "dequeued"
   | "aborted"
   | "stopped"
   /** The coding round ended at its lease with the unit unfinished and the row
@@ -1019,6 +1029,10 @@ export type RunEvent =
       command?: string;
       input?: { readonly [key: string]: RouteInputValue };
       receipt?: string;
+      /** The structured seam's attempts ([record 0067](../../docs/decisions/0067-one-seam-for-a-structured-answer-a-violation-is-re-asked-with-the-violation-named-and-the-callers-declared-floor-holds-never-a-refusal-shown-to-the-person.md)):
+       *  what each answer violated, or that it was accepted, so a flaky model
+       *  is legible on the record as re-asks, not as silent floors. */
+      attempts?: ReadonlyArray<{ outcome: "accepted" | "violation"; violation?: string }>;
       outcome?: RouteOutcome;
       /** The refusal's code (src/core/refusal.ts) when `outcome` is `refused`
        *  (record 0054): a refusal after a command was bound is a run
@@ -1031,28 +1045,33 @@ export type RunEvent =
   /** The operator's decision beside the routed request ([record 0057](../../docs/decisions/0057-the-operator-is-the-one-door-a-model-binds-every-chat-input-and-deterministic-code-authorizes-fences-and-executes.md);
    *  the one-door plan's operator unit; run-history item 60): one per admitted chat
    *  event under `routing.operator: shadow` or `on`, published beside the
-   *  `route` event. The decision is binds, a question or a refusal; a bind's
-   *  `line` is redacted and cut like the receipt (`ROUTE_RECEIPT_CAP`), never
-   *  the message text; `intake` carries the intake gate's verdict when the
-   *  gate is present; `latencyMs` and `outputTokens` feed the replay's median
-   *  rows. Under `shadow` nothing runs from it. Additive: unknown → ignored. */
+   *  `route` event. The decision is binds, a question, a refusal or — the
+   *  structured seam's floor ([record 0067](../../docs/decisions/0067-one-seam-for-a-structured-answer-a-violation-is-re-asked-with-the-violation-named-and-the-callers-declared-floor-holds-never-a-refusal-shown-to-the-person.md)),
+   *  never the model's decision — `non_decision`: under `on` the dispatcher
+   *  falls back to the readers' route for that event, this event recorded on
+   *  the run that then runs; `attempts` lists what each answer violated or
+   *  that it was accepted. A bind's `line` is redacted and cut like the
+   *  receipt (`ROUTE_RECEIPT_CAP`), never the message text; `intake` carries
+   *  the intake gate's verdict when the gate is present; `latencyMs` and
+   *  `outputTokens` feed the replay's median rows. Under `shadow` nothing
+   *  runs from it. Additive: unknown → ignored. */
   | {
       type: "operator";
       mode: "shadow" | "on";
-      outcome: "binds" | "question" | "refusal";
+      outcome: "binds" | "question" | "refusal" | "non_decision";
       reason: string;
-      binds?: ReadonlyArray<{ line: string; reason: string }>;
+      /** A bind marked `confirmed` is a pending question's confirmed proposal
+       *  (`bindFromAnswer`): the line itself carries the task — the person's
+       *  message was the word "yes" — so a confirmed preset line routes its
+       *  own tail as the request. Additive: unknown → a fresh bind. */
+      binds?: ReadonlyArray<{ line: string; reason: string; confirmed?: true }>;
       question?: string;
       /** A question's proposed line, redacted and cut like the receipt — what
        *  the next turn's "yes" binds (`bindFromAnswer`). */
       proposal?: string;
       refusalCause?: string;
       refusalText?: string;
-      /** A refusal the seam itself produced (a non-decision answer, a wrong
-       *  tool, a transport failure) — never the model's decision: under `on`
-       *  the dispatcher falls back to the readers' route for that event, this
-       *  event recorded on the run that then runs. */
-      fallback?: true;
+      attempts?: ReadonlyArray<{ outcome: "accepted" | "violation"; violation?: string }>;
       intake?: { verdict: string; reason: string };
       latencyMs?: number;
       outputTokens?: number;

package/dist/assets/src/core/runLedger/sessionLog.ts

@@ -35,6 +35,134 @@ export function sessionKey(threadKey: string, agent: string | undefined): string
   return `${threadKey}:${agent ?? "-"}`;
 }
 
+/** The thread session's key (record 0057; the one-door plan's memory unit,
+ *  item 13): one log per thread, read and written by the operator — every
+ *  connector event the intake gate admits, every child's report, every
+ *  question and answer is a turn in it. The `@thread` half can never collide
+ *  with `sessionKey`'s agent half: no agent id starts with `@`. */
+export function threadSessionKey(threadKey: string): string {
+  return `${threadKey}:@thread`;
+}
+
+/** A working session's lane: a unit's coding rounds continue one log, its
+ *  review rounds another (item 13). */
+export type WorkingLane = "coding" | "review";
+
+/** A working session's key `<instance>:<unit>:<lane>` (item 13). A re-issue of the
+ *  same plan carries an attempt suffix on its instance id (`planInstanceId`:
+ *  `plan-<id>-<attempt>`, attempt ≥ 2); the key strips it, so a re-issue
+ *  continues the prior instance's lanes rather than starting cold. */
+export function workingSessionKey(instance: { id: string; attempt?: number }, unit: string, lane: WorkingLane): string {
+  const suffix = instance.attempt !== undefined ? `-${instance.attempt}` : "";
+  const base =
+    suffix !== "" && instance.id.endsWith(suffix)
+      ? instance.id.slice(0, instance.id.length - suffix.length)
+      : instance.id;
+  return `${base}:${unit}:${lane}`;
+}
+
+/** A connector turn's row id (item 13): the message id, with its edit timestamp
+ *  when the message was edited — an edited message appends a second row (the
+ *  first said what the person first said), a re-delivered unedited one
+ *  appends nothing. */
+export function connectorRowId(messageId: string, editedAt?: string | number): string {
+  return editedAt === undefined ? messageId : `${messageId}:edit-${editedAt}`;
+}
+
+/** The fold's row id for a hosted parent's `ship_unit` event (item 13): the
+ *  event's own identity — its unit, its state and the registry seq it was
+ *  published under — so the same event read twice folds one row. The seq is
+ *  required (the registry stamps every published event with one): without it,
+ *  a unit reopened at a second segment would repeat a state — two `started`
+ *  events — and the second fold would be dropped as a duplicate. */
+export function shipUnitRowId(event: { unit: string; state: string; seq: number }): string {
+  return `ship-unit:${event.unit}:${event.state}:${event.seq}`;
+}
+
+/** One thread-session row as its JSON is stored (item 13): a text turn with
+ *  its author when a person wrote it, `silent` when the intake gate withheld
+ *  the reply (the person's words are context all the same), `folded` when the
+ *  row is a child's report folded whole — what `operatorTail` keeps ahead of
+ *  older turns. */
+export function storedTurnRow(turn: {
+  role: "user" | "assistant";
+  text: string;
+  actor?: string;
+  silent?: boolean;
+  folded?: boolean;
+}): string {
+  return JSON.stringify({
+    role: turn.role,
+    part: { type: "text", text: turn.text },
+    ...(turn.actor !== undefined ? { actor: turn.actor } : {}),
+    ...(turn.silent === true ? { silent: true } : {}),
+    ...(turn.folded === true ? { folded: true } : {}),
+  });
+}
+
+/** Whether a stored row is a reply the intake gate withheld as silent (item 13). */
+export function silentOfStoredRow(json: string): boolean {
+  const stored = parseStored(json);
+  return stored !== undefined && !("compaction" in stored) && (stored as { silent?: unknown }).silent === true;
+}
+
+/** Whether a stored row is a folded report (item 13) — kept whole by the
+ *  operator's cap ahead of older turns. */
+export function foldedOfStoredRow(json: string): boolean {
+  const stored = parseStored(json);
+  return stored !== undefined && !("compaction" in stored) && (stored as { folded?: unknown }).folded === true;
+}
+
+/** A run of an old `<thread>:<agent>` log, as the cutover migration reads it
+ *  (item 13): its log's key, when it started and the row range its record closed. */
+export interface MigrationRun {
+  key: string;
+  startedAt: number;
+  range: { from: number; to?: number };
+}
+
+/** The order the cutover migration reads an old thread's per-agent logs into
+ *  the thread session (item 13): the runs by their start times, each run's rows in
+ *  its session range in index order, and rows outside any run's range after
+ *  the runs that precede them in their own log (before every run of that log
+ *  when none does). The read is once: each row lands under the row id
+ *  `migrationRowId(key, idx)`, so a replay appends nothing twice, and the old
+ *  keys stay read-only for recall. */
+export function migrationOrder(
+  runs: readonly MigrationRun[],
+  logs: readonly { key: string; rows: readonly number[] }[],
+): Array<{ key: string; idx: number }> {
+  const byStart = [...runs].sort((a, b) => a.startedAt - b.startedAt);
+  // A row's place: inside a run's range it rides at that run's start (phase 0);
+  // past a run's closed range it rides after that run's rows (phase 1); before
+  // every run of its log it comes first of all (start -Infinity).
+  const placed = logs.flatMap((log, logOrder) =>
+    log.rows.map((idx) => {
+      let at = Number.NEGATIVE_INFINITY;
+      let phase = 1;
+      for (const r of byStart) {
+        if (r.key !== log.key) continue;
+        const to = r.range.to;
+        if (idx >= r.range.from && (to === undefined || idx <= to)) {
+          at = r.startedAt;
+          phase = 0;
+          break;
+        }
+        if (to !== undefined && to < idx && r.startedAt > at) at = r.startedAt;
+      }
+      return { key: log.key, idx, at, phase, logOrder };
+    }),
+  );
+  placed.sort((a, b) => a.at - b.at || a.phase - b.phase || a.logOrder - b.logOrder || a.idx - b.idx);
+  return placed.map(({ key, idx }) => ({ key, idx }));
+}
+
+/** The row id a migrated row lands under (item 13): the old log's key and the
+ *  row's index there — stable, so the read-once migration is idempotent. */
+export function migrationRowId(key: string, idx: number): string {
+  return `migrated:${key}#${idx}`;
+}
+
 /** The request is the seed's last user turn (`splitSeed` reads the seed the
  *  same way); a seed with no user turn — or no turns — puts its first row there. */
 export function requestIndex(seed: readonly ChatMessage[]): number {

package/dist/assets/src/core/runLedger/types.ts

@@ -287,6 +287,9 @@ export interface IntakeReceipt {
   verdict: "addressed" | "silent";
   reason: string;
   source: "model" | "mode" | "error" | "timeout";
+  /** The structured seam's attempts (docs/decisions/0067): what each answer
+   *  violated, or that it was accepted; absent when no model was asked. */
+  attempts?: ReadonlyArray<{ outcome: "accepted" | "violation"; violation?: string }>;
   mode: "mention" | "classify";
   /** The `<provider>/<model>` ref the verdict ran on. */
   model: string;

package/dist/assets/src/core/runRecord.ts

@@ -392,9 +392,10 @@ export function callsInFlight(events: readonly RunEvent[], status: RunStatus): C
   return [...calls.values()].filter((c) => c.state === "cut" || (c.state === "open" && !orderly)).map((c) => c.call);
 }
 
-/** The router's decision as a record carries it — the same fields the
- *  `route` event and the ledger row's `meta.route` carry (routing-and-config
- *  item 21). */
+/** The router's decision as a record carries it — the fields the `route`
+ *  event and the ledger row's `meta.route` carry (routing-and-config item 21),
+ *  minus the event's `attempts` (record 0067): the record keeps the decision,
+ *  the re-asks stay on the event. */
 export interface RunRouteDecision {
   preset: string;
   reason: string;
@@ -425,7 +426,7 @@ export function routeOfEvents(events: readonly RunEvent[]): RunRouteDecision | u
  *  fields less the stream bookkeeping (record 0057; run-history item 60). */
 export interface RunOperatorDecision {
   mode: "shadow" | "on";
-  outcome: "binds" | "question" | "refusal";
+  outcome: "binds" | "question" | "refusal" | "non_decision";
   reason: string;
   binds?: { line: string; reason: string }[];
   question?: string;
@@ -433,6 +434,9 @@ export interface RunOperatorDecision {
   proposal?: string;
   refusalCause?: string;
   refusalText?: string;
+  /** The structured seam's attempts (record 0067): what each answer violated,
+   *  or that it was accepted. */
+  attempts?: { outcome: "accepted" | "violation"; violation?: string }[];
   intake?: { verdict: string; reason: string };
   latencyMs?: number;
   outputTokens?: number;
@@ -454,6 +458,14 @@ export function operatorOfEvents(events: readonly RunEvent[]): RunOperatorDecisi
     ...(e.proposal !== undefined ? { proposal: e.proposal } : {}),
     ...(e.refusalCause !== undefined ? { refusalCause: e.refusalCause } : {}),
     ...(e.refusalText !== undefined ? { refusalText: e.refusalText } : {}),
+    ...(e.attempts
+      ? {
+          attempts: e.attempts.map((a) => ({
+            outcome: a.outcome,
+            ...(a.violation !== undefined ? { violation: a.violation } : {}),
+          })),
+        }
+      : {}),
     ...(e.intake ? { intake: { verdict: e.intake.verdict, reason: e.intake.reason } } : {}),
     ...(e.latencyMs !== undefined ? { latencyMs: e.latencyMs } : {}),
     ...(e.outputTokens !== undefined ? { outputTokens: e.outputTokens } : {}),
@@ -497,9 +509,14 @@ function isRunPullRequestShape(v: unknown): v is RunPullRequest {
  *  (item 57). `policy_refusal`: the model provider refused the run's call
  *  under its usage policy — the stop reason its wire names, never the
  *  explanation's words — so the session's next seed leaves the refused
- *  request out of its tail (docs/reference/specs/session-log.md item 9). A
- *  failure without a name here leaves the record without the field. */
-export const RUN_FAILURE_KINDS = ["policy_refusal"] as const;
+ *  request out of its tail (docs/reference/specs/session-log.md item 9).
+ *  `provider_transient`: the run's model call failed on a provider transient
+ *  (a gateway 5xx, a cut stream, a gateway timeout) with the harness's retry
+ *  ladder spent — the ship runner reads it off the child's record to re-run a
+ *  round-0 child that pushed nothing instead of aborting the unit
+ *  (docs/reference/specs/agent-ship.md item 9, issue 1932). A failure without
+ *  a name here leaves the record without the field. */
+export const RUN_FAILURE_KINDS = ["policy_refusal", "provider_transient"] as const;
 export type RunFailureKind = (typeof RUN_FAILURE_KINDS)[number];
 export interface RunFailure {
   kind: RunFailureKind;

package/dist/assets/src/core/ship/contract.ts

@@ -439,42 +439,32 @@ export const TIMEOUT_ON_LONG_COMMANDS =
   "State a timeout on any command you expect to run longer than a minute: a timeout that reaches past the loop's " +
   "end is refused before the command runs, never cut midway.";
 
-/** The fast gates a plan child runs before every push, named one by one and
- *  each scoped to the changed set (agent-ship item 13; agent-coding item 9).
- *  "Its cheapest proving checks" left the choice to the child, and children
- *  chose wrong in both directions: prettier was reported clean while
- *  `format:check` was red, hygiene imprints reached CI that `hygiene:check`
- *  would have caught locally — and children ran the whole suite and the whole
- *  typecheck on the shared resident, minutes each call, time-sliced against
- *  every other run. So the gates are the changed-set forms, the full runs are
- *  said to be CI's alone in the same breath, and each gate is a receipt — the
- *  exit line goes into the PR description's validation table as the row's proof
- *  (the handoff has no verified list; parseHandoff carries deviations, followUps,
- *  unproven and landed), and a gate the child could not run goes under the
- *  handoff's unproven list, never claimed clean. The test gate is the touched
- *  files by name, never a changed-set or directory run. */
-/** The test command the contract hands a child: the touched files by name, once.
- *  Never `--changed`: against a base that moves, it selects most of the suite, and on the
- *  shared resident that is the memory incident the coding contract exists to prevent. */
-export const TOUCHED_TESTS_COMMAND = "`npx vitest run` on the test files you touched, by name,";
-
-export const FAST_GATES_BEFORE_PUSH =
-  "The fast gates, before every push — each scoped to the changed set, never the whole project: " +
-  `${TOUCHED_TESTS_COMMAND} once (never \`--changed\`, never a directory: on a moving base that is most of the suite), ` +
-  "`tsc --noEmit -p` the touched tsconfig under `NODE_OPTIONS=--max-old-space-size=6144`, " +
-  "`npx prettier --check` on the changed files, `npm run hygiene:check` and `npm run specs:check` — " +
-  "then your judgement on what else this change needs, not a longer checklist. Every CI pipeline runs the " +
-  "tests, the types, the formatting and the full verification on your push, so you never run them again: " +
-  "you validate and fix your own change before pushing, at the changed-set scope. Passing the full test suite " +
-  "and the full typecheck is NOT part of your criteria: CI is that gate and the only place they run — on a " +
-  "shared resident they cost minutes that every other run pays for. " +
+/** The fast gates a plan child runs before every push live in the coding
+ *  preset's own instructions (`FAST_GATES_BEFORE_PUSH`,
+ *  src/agents/registry.ts — agent-coding item 13; issue 1796): the changed-set
+ *  forms with their commands named, the full verification named as CI's gate.
+ *  The contract used to restate the whole paragraph, so every ask that was not
+ *  a plan unit had to repeat it by hand; now the first instruction points at
+ *  the preset's paragraph — the child reads the sentence once — and keeps only
+ *  what is the contract's own: the receipts. Each gate is a receipt — the exit
+ *  line goes into the PR description's validation table as the row's proof
+ *  (the handoff has no verified list; parseHandoff carries deviations,
+ *  followUps, unproven and landed), and a gate the child could not run goes
+ *  under the handoff's unproven list, never claimed clean — because only a
+ *  plan child has a handoff to route them to. */
+export const FAST_GATES_POINTER =
+  "The fast gates are the ones your preset instructions name (THE FAST GATES): the changed-set forms, " +
+  "never the whole project — the full suite, the full typecheck and the full verification are CI's, " +
+  "never yours to run.";
+
+export const GATE_RECEIPTS =
   "Paste each command's exit line into the PR description's validation table as the row's proof; a gate you " +
   "could not run goes under the handoff's unproven list and is never claimed clean.";
 
 function renderFirstInstruction(rebase: ChildContract["rebase"]): string {
   const branch = rebase.branch ? `\`${rebase.branch}\`` : "the unit's branch";
   const onto = rebase.onto ? `\`${rebase.onto}\`` : "the merged parent";
-  const gates = FAST_GATES_BEFORE_PUSH;
+  const gates = `${FAST_GATES_POINTER} ${GATE_RECEIPTS}`;
   return (
     `Rebase ${branch} onto ${onto} before any other work — the parent unit has merged and the base has moved; ` +
     `the only writes are your own on that branch. A conflict ends the unit: report it as the handoff and stop. ` +