@event4u/agent-config 17.0.0 → 17.2.0

package/src/scripts/_lib/release_findings_ingest.ts

@@ -1,46 +1,17 @@
 /**
- * The release's side of the findings-ledger contract: verification, not
- * production.
+ * What is left of the release's side of the findings ledger: where a ledger
+ * lives, and the `Known limitations` line a cut on an override owes.
  *
- * WHY THE CONTRACT EXISTS. The findings ledger is the durable record a release
- * makes about what its own review found, and `check_finding_dispositions`
- * treats an absent one for a SHIPPED version as a failure — repo-wide, because
- * the same check runs on every pull request. Producing it was documented and
- * unowned: the self-review workflow uploaded an artifact and its own comment
- * said a human should run `--ingest`. Nobody did, so the ledger went missing
- * once per release, six times between 14.19.0 and 15.0.0, and each absence was
- * cleared by whoever happened to be pushing an unrelated change.
- *
- * WHY THE INGEST IS NOT HERE. Two review rounds established that no placement
- * inside `release.ts` works. `finding-dispositions` runs on the release PR and
- * reds while the ledger lacks a finding the review reported, so a step that
- * produced the ledger after the check wait could never run — the wait had
- * already died on that red check — and a step that produced it before the wait
- * pushed a commit the wait then had to redo, on a head whose checks had not
- * started. The owner's decision on 2026-09-11 was to move the ingest into the
- * workflow that already holds the artifact, which is the one place where the
- * ledger can exist before any gate looks for it.
- *
- * WHY THE PUSH NEEDS A PAT. A third review round found that the move alone did
- * not fix the ordering, it relocated it: the ingest job is a check run of the
- * same `pull_request` event, so its push lands inside the release's own check
- * wait — and a push authenticated with GITHUB_TOKEN creates no run, leaving a
- * head with zero checks against a protection that requires one. The job pushes
- * with `RELEASE_PR_TOKEN` instead, the pattern `release.yml` already uses, so
- * the push produces the checks the wait is waiting for. Without that secret the
- * job declines to push at all rather than produce the deadlock, and the absence
- * arrives here as a missing ledger with the cause named.
- *
- * WHAT IS LEFT HERE. Two questions and a stop for each: is the ledger on the
- * REMOTE branch, and does the disposition gate pass. Neither is repaired by
- * the release — filling a disposition states what the release ships, with a
- * rationale and a named verifier, and no automation writes one.
+ * A release no longer reads the ledger. Every commit on main is already
+ * reviewed and merged, so the cut waits for no review (owner, 2026-10-22);
+ * the 17.0.0 cut stopped for a day on a ledger whose self-review never
+ * finished. The self-review on a release PR is advisory. No release workflow
+ * waits for `check_finding_dispositions`; the consistency coverage guard still
+ * executes it, so any committed ledger must remain valid.
  */
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
-import { isBlocking, parse_ledger } from '../check_finding_dispositions.js';
-
 
 /** Where a release's ledger lives, relative to the repository root. */
 export function ledgerRelPath(version: string): string {
@@ -50,11 +21,11 @@ export function ledgerRelPath(version: string): string {
 /**
  * The `Known limitations` line a cut taken on an override owes its readers.
  *
- * An override is the one way a release ships without having reviewed itself,
- * and it is recorded where only a releaser looks — inside the ledger JSON. A
- * consumer reading the published notes would see a release indistinguishable
- * from one that passed its self-review, which is the same silence-reads-as-
- * acceptance defect `assurance` was added to end one layer down.
+ * An override is a ledger's explicit statement that its release was not
+ * self-reviewed, recorded where only a releaser looks — inside the ledger JSON.
+ * Since 2026-10-22 a release needs no ledger at all, so this line appears only
+ * for a ledger that carries an override; a release with no ledger publishes no
+ * limitation, because main is reviewed before the cut.
  *
  * Returns null for every ordinary release: no ledger, a reviewed one, or one
  * carrying no override. The caller appends; it never replaces a derived line.
@@ -84,296 +55,3 @@ export function assuranceOverrideLimitation(version: string, repoRoot: string):
         + `was taken on an owner directive recorded at ${override}.`
     );
 }
-
-/**
- * The workflow that produces and commits the ledger, named so a message can
- * point the operator at the right run log.
- *
- * A rename there without one here is caught by
- * `release_findings_ingest.test.ts`, which reads the workflow file rather than
- * trusting this string.
- */
-export const FINDINGS_WORKFLOW = 'self-review-gate.yml';
-
-/**
- * Argv proving the ledger is on the REMOTE branch — the only ref that answers
- * the question the release is asking.
- *
- * Three refs give three different answers and only one is right. The working
- * tree says "a file exists here", which a by-hand ingest also satisfies. The
- * LOCAL branch ref says "a commit here carries it", which a commit that failed
- * to push has already made true — so probing it answers identically to the
- * filesystem in exactly the case the probe exists for, which is the defect a
- * second review round caught in the first attempt at this fix. The
- * remote-tracking ref is the one that goes false when a push fails, and the
- * merge reads the remote.
- *
- * `remote` is a parameter rather than a constant so a fork or a mirror is not
- * silently assumed to be `origin`.
- */
-export function ledgerOnBranchArgv(remote: string, branch: string, rel: string): string[] {
-    return ['cat-file', '-e', `${remote}/${branch}:${rel}`];
-}
-
-/**
- * Why the release refuses to continue without a ledger on the branch.
- *
- * Continuing would merge and tag with no ledger, and an absent ledger becomes a
- * repo-wide failure the moment the tag exists — that is the six-release failure
- * this mechanism ends, so it is a stop rather than a warning.
- *
- * The causes are named because the operator has to pick one and most of them
- * are ordinary. With the ingest in CI, "it has not happened yet" is the common
- * case and waiting is the answer; a repository without the review secret never
- * gets one at all and needs the ledger by hand, once per release, which is a
- * real cost and is stated here rather than discovered.
- */
-export function ledgerAbsentMessage(version: string, branch: string, remote: string): string {
-    return (
-        `${ledgerRelPath(version)} is not on ${remote}/${branch}.\n` +
-        '  The release stops: continuing would merge and tag with no findings ledger, and an ' +
-        'absent ledger for a shipped version reds every pull request in the repository.\n' +
-        `  The ${FINDINGS_WORKFLOW} workflow commits it to the release branch once it has ` +
-        'reviewed the head. Ordinary causes, in the order to check them: the review has not ' +
-        'finished yet (wait, then resume); the review found nothing and its commit is still in ' +
-        'flight (same); no ANTHROPIC_API_KEY, so no review ran in CI and no ledger will appear — ' +
-        'review it locally instead, which needs no credit because the gate resolves the ' +
-        'subscription CLI before any metered key: `./scripts-run src/scripts/self_review_gate ' +
-        '--findings-out agents/runtime/release-findings.json`, then `./scripts-run ' +
-        'src/scripts/check_finding_dispositions --ingest agents/runtime/release-findings.json --release ' +
-        `${version}\`, and push the ledger to ${branch}; no RELEASE_PR_TOKEN, in which ` +
-        'case the job refuses to push rather than deadlock this wait and says so as a warning in ' +
-        'its run log — configure the PAT, or write the ledger by hand; or the workflow could not ' +
-        'push, which its run log will say.\n' +
-        '  Then: `git pull` on the release branch, and resume.'
-    );
-}
-
-/**
- * Why the release refuses to continue when the PR is already merged and the
- * ledger is not on the trunk either.
- *
- * This is the state the whole mechanism exists to prevent, reached the one way
- * that survives every guard before it: the ingest produced nothing, step 7
- * stopped, and the PR was merged by hand anyway. A resumed run then finds
- * `state === 'MERGED'` and — until this check existed — printed "the ledger
- * rode in with it" without reading anything, tagged, and published. The absent
- * ledger for a shipped version is what reds every pull request in the
- * repository, so the assertion had to become a question.
- *
- * The release branch is gone by now, so there is no workflow run left to wait
- * for: the remaining path is a ledger written onto the trunk by hand.
- */
-export function ledgerAbsentAfterMergeMessage(
-    version: string,
-    trunk: string,
-    remote: string,
-): string {
-    return (
-        `${ledgerRelPath(version)} is on neither the release branch nor ${remote}/${trunk}, and ` +
-        'the release pull request is already merged.\n' +
-        '  The release stops: tagging now ships a version whose findings ledger does not exist, ' +
-        'and an absent ledger for a shipped version reds every pull request in the repository.\n' +
-        `  The release branch is gone, so the ${FINDINGS_WORKFLOW} run that would have committed ` +
-        'the ledger cannot be waited for. Put the ledger on the trunk instead: recover what the ' +
-        "review for this version reported in its own workflow run, or — if none ran — review it " +
-        'now with `./scripts-run src/scripts/self_review_gate --findings-out agents/runtime/release-findings.json`, ' +
-        'which needs no credit because the gate resolves the subscription CLI before any metered ' +
-        `key. Ingest with \`--ingest agents/runtime/release-findings.json --release ${version}\`, push, and resume.\n` +
-        '  A ledger that reviewed nothing no longer clears the cut on a reason string: an ' +
-        '`assurance: unreviewed` ledger is refused unless it carries an `assurance_override` ' +
-        'naming a committed owner directive.'
-    );
-}
-
-/**
- * The message a release stops with when the disposition gate refuses.
- *
- * `blocking` is what the release could count itself: findings that are blocking
- * and carry no `status`. It is deliberately NOT presented as the reason — the
- * gate refuses for more shapes than that (an unknown status, an empty rationale
- * or verifier, a `fixed` with no commit, a malformed ledger, an undeterminable
- * release status), and an earlier version of this message asserted "N blocking
- * … carry no disposition" for every one of them. At N = 0 that produced an
- * instruction nobody could follow.
- *
- * So the gate's own output is the reason, passed in and printed, and this text
- * only says where the file is, why the release stopped, and how to resume.
- */
-export function dispositionStopMessage(
-    version: string,
-    gateOutput: string,
-    blocking: number,
-    resumeCmd: string,
-): string {
-    const count =
-        blocking > 0
-            ? `  ${blocking} of them are blocking findings with no disposition yet (no status, or still_open).\n`
-            : '';
-    return (
-        `the disposition gate refuses ${version}. Its own report:\n` +
-        `${gateOutput.trim() || '  (the gate printed nothing — run it directly to see why)'}\n` +
-        count +
-        `  The ledger is at ${ledgerRelPath(version)} and the release stops here by design: a ` +
-        'disposition is an adjudication of what this release ships, with a rationale and a ' +
-        'named verifier, and no automation may write one.\n' +
-        `  Resolve what the report names, push the release branch, then: ${resumeCmd}`
-    );
-}
-
-/** The release's own subprocess result shape, mirrored so this module stays free of it. */
-interface StepRunResult {
-    returncode: number;
-    stdout: string;
-    stderr: string;
-}
-
-/**
- * What the step needs from the release script, injected rather than imported.
- *
- * `release.ts` sits past the source-size cap where every line is charged, and
- * this step is the release's side of the contract this module already owns — so
- * it lives here. Injection rather than an import of `release_publication.ts`
- * keeps `_lib` free of a dependency on its own caller.
- */
-export interface LedgerStepDeps {
-    run: (argv: string[], opts: { check: boolean; capture: boolean }) => StepRunResult;
-    die: (msg: string) => never;
-    /** Prints the step banner, so the caller keeps the step number. */
-    step: (msg: string) => void;
-    /** Where the step reports the ref it read. */
-    write: (s: string) => void;
-    /** Absolute repository root, for resolving the ledger on disk. */
-    repoRoot: string;
-    /** Remote name, never assumed to be `origin`. */
-    remote: string;
-    /** The trunk the release merges into — the ref to ask once the branch is gone. */
-    trunk: string;
-    /**
-     * The PR number for `--pr`, resolved late.
-     *
-     * Late because the release probes its PR once at the top and only on a
-     * resumed run, so on a first run the number was null here and `--pr` was
-     * silently dropped — and the release then passed a strictly weaker check
-     * than `finding-dispositions`, learning about an un-ingested finding from
-     * CI instead. By the time this step runs the PR exists either way.
-     */
-    resolvePr: () => number | null;
-}
-
-/**
- * Verify the release carries its own findings ledger, or stop.
- *
- * VERIFIES, NEVER PRODUCES — the why is the module docstring above. Placed
- * between the check wait and the merge: the ledger lives on the release branch
- * and the merge deletes it, so this is the last moment the question means
- * anything, and after the wait so a red `finding-dispositions` has already
- * stopped the release with the check's own name rather than a duplicate of it.
- *
- * Two questions, each answered with a stop:
- *
- *   1. Is the ledger on the ref the merge will read? On an open PR that is the
- *      remote release branch; once the PR is merged the branch is deleted and
- *      the ledger, if it was ever produced, rode into the trunk. The merged
- *      path used to ask nothing and assert the good case.
- *   2. Does the disposition gate pass, in `--pr` mode — the same mode CI uses,
- *      so the release cannot pass a weaker check than the one it is trying to
- *      pre-satisfy.
- *
- * Neither answer is repaired here. Filling a disposition states what the release
- * ships, with a rationale and a named verifier; no automation writes one.
- */
-export function settleFindingsLedger(
-    deps: LedgerStepDeps,
-    version: string,
-    branch: string,
-    merged: boolean,
-): void {
-    deps.step(
-        merged
-            ? 'Verify the findings ledger rode in with the merge'
-            : 'Verify the self-review findings ledger',
-    );
-    const rel = ledgerRelPath(version);
-    const ref = merged ? deps.trunk : branch;
-
-    // REFRESH BEFORE READING, AND FAST-FORWARD BEFORE ASKING THE GATE. Both
-    // halves are a defect a fourth review measured, and they are the same
-    // defect seen from two sides. `cat-file -e <remote>/<ref>:<path>` reads
-    // `.git`, not GitHub — and nothing in a first run refreshes that
-    // remote-tracking ref after CI commits the ledger: preflight fetches before
-    // the branch exists, and step 4's push sets the ref to the pushed commit,
-    // which is strictly older than the ledger commit. So the probe answered
-    // "absent" on every first release. The disposition gate then reads the
-    // WORKING TREE, which the same push left equally stale, so a fetch alone
-    // would fix the probe and hand the gate an empty ledger instead.
-    //
-    // `--ff-only` on purpose: the release pushed this ref itself, so the only
-    // commit ahead of it should be CI's. Anything else means the branch moved
-    // under the run, and stopping is better than merging a tree nobody read.
-    // Both are `check: false` — a fetch that fails leaves the probe to report
-    // the absence with a message that says what to do.
-    deps.run(['git', 'fetch', deps.remote, ref], { check: false, capture: true });
-    deps.run(['git', 'pull', '--ff-only', deps.remote, ref], { check: false, capture: true });
-
-    const onBranch =
-        deps.run(['git', ...ledgerOnBranchArgv(deps.remote, ref, rel)], {
-            check: false,
-            capture: true,
-        }).returncode === 0;
-    if (!onBranch) {
-        deps.die(
-            merged
-                ? ledgerAbsentAfterMergeMessage(version, deps.trunk, deps.remote)
-                : ledgerAbsentMessage(version, branch, deps.remote),
-        );
-    }
-    deps.write(`    ledger on ${deps.remote}/${ref}: ${rel}\n`);
-
-    const argv = ['./scripts-run', 'src/scripts/check_finding_dispositions', '--release', version];
-    const pr = deps.resolvePr();
-    if (pr !== null) {
-        argv.push('--pr', String(pr));
-    }
-    const verdict = deps.run(argv, { check: false, capture: true });
-    if (verdict.returncode !== 0) {
-        deps.die(
-            dispositionStopMessage(
-                version,
-                // BOTH streams. The gate writes its scan line to stdout and its
-                // per-finding diagnosis to stderr, so preferring stdout showed
-                // the operator `scanned: N` and discarded the entire reason the
-                // release stopped.
-                [verdict.stdout, verdict.stderr].map((s) => s.trim()).filter(Boolean).join('\n'),
-                blockingWithoutDisposition(path.join(deps.repoRoot, rel), version),
-                'task release -- --resume --yes',
-            ),
-        );
-    }
-}
-
-/**
- * How many blocking findings carry no disposition — no status, or `still_open`,
- * which a blocking row may not rest on — a figure for the stop message, never
- * the reason for it.
- *
- * The gate refuses for more shapes than this counts (an unknown status, an
- * empty rationale or verifier, a `fixed` with no commit, a malformed ledger),
- * which is why the gate's own output is what the operator is shown. It
- * classifies against the version being released, the same input the gate
- * reads from `--release`, not the ledger file's own `release` field.
- */
-export function blockingWithoutDisposition(ledgerAbs: string, version: string): number {
-    if (!fs.existsSync(ledgerAbs)) {
-        return 0;
-    }
-    try {
-        const ledger = parse_ledger(fs.readFileSync(ledgerAbs, 'utf-8'), ledgerAbs);
-        return ledger.findings.filter((f) => {
-            const status = (f.status ?? '').trim();
-            return isBlocking(f, version) && (status === '' || status === 'still_open');
-        }).length;
-    } catch {
-        return 0;
-    }
-}

package/src/scripts/_lib/runtime_journal.ts

@@ -248,18 +248,18 @@ export const RECORDED_EVENTS: ReadonlySet<string> = new Set([
     'stop',
     'pre_compact',
     'agent_error',
-    'subagent_start',
-    'subagent_stop',
+    'subagent_start', 'subagent_stop',
+    'instructions_loaded',
 ]);
 
 /**
- * Members deliberately NOT recorded, each with the reason — silence about an
- * event is not coverage.
+ * Members deliberately NOT recorded, each with the reason — silence is not coverage.
+ * "Recorded" means accepted, not bound: see the manifest's `instructions_loaded` row.
  *
- * **Currently empty, and the emptiness is the finding.** All ten members of the
- * vocabulary are recordable: the journal stores what the dispatcher hands it
+ * **Currently empty, and the emptiness is the finding.** All eleven members of
+ * the vocabulary are recordable: the journal stores what the dispatcher hands it
  * and has no per-event exclusion. The value of the partition is therefore not
- * what it excludes today but that an eleventh member cannot arrive without a
+ * what it excludes today but that a twelfth member cannot arrive without a
  * decision — the coverage test fails until it is placed in one set or the
  * other, with a reason if it lands here.
  */

package/src/scripts/_lib/tier_downshift_verdict.ts

@@ -5,8 +5,11 @@
  * inherited tier, both verified by the same deterministic check.
  *
  * Pure: the bars are constants here, the rows come from the caller, and an
- * underpowered run backs nothing in either direction.
+ * underpowered run backs nothing in either direction. A price row that
+ * `price_freshness` refuses prices nothing, which leaves the cost verdict
+ * underpowered rather than read at a stale rate.
  */
+import { type PriceRow, selectPrice } from './price_freshness.js';
 
 /** Quality bar: the lite arm's fail-or-escalate rate may exceed inherit's by at most this. */
 export const QUALITY_MARGIN_PP = 5;
@@ -16,6 +19,12 @@ export const ESCALATION_KILL = 0.3;
 export const PAIR_CAP = 60;
 /** Below this many complete pairs no rate is read at all. */
 export const MIN_PAIRS = 30;
+/**
+ * One-sided error of every bound read here. 0.05 is the level the
+ * pre-registered verdict already used: the rule of three it replaces is the
+ * one-sided 95 % bound for zero events.
+ */
+export const BOUND_ALPHA = 0.05;
 
 export type Arm = 'lite' | 'inherit';
 
@@ -27,14 +36,6 @@ export interface LegUsage {
     output: number;
 }
 
-/** USD per million tokens for one model family. */
-export interface Price {
-    input: number;
-    output: number;
-    cache_write: number;
-    cache_read: number;
-}
-
 export interface LegResult {
     slice_id: string;
     arm: Arm;
@@ -68,8 +69,15 @@ export interface TierDownshiftVerdict {
     inherit: ArmSummary;
     /** lite minus inherit fail-or-escalate rate, in percentage points. */
     diff_pp: number | null;
-    /** Half-width of the 95 % interval of the paired difference, in percentage points. */
-    ci_half_width_pp: number | null;
+    /**
+     * One-sided upper bound of the paired difference, in percentage points: the
+     * exact (Clopper–Pearson) bound on the rate of pairs only lite failed. The
+     * pairs only inherit failed can only lower the true difference, so leaving
+     * them out keeps the bound conservative and monotone in lite's failures.
+     */
+    upper_bound_pp: number | null;
+    /** One-sided lower bound of the paired difference, in percentage points. */
+    lower_bound_pp: number | null;
     escalation_rate_lite: number | null;
     quality: QualityVerdict;
     cost: CostVerdict;
@@ -78,27 +86,66 @@ export interface TierDownshiftVerdict {
     notes: string[];
 }
 
-const FAMILIES = ['haiku', 'sonnet', 'opus', 'fable'] as const;
+/** P(X <= k) for X ~ Binomial(n, p), summed in log space so large n stays finite. */
+function binomCdf(k: number, n: number, p: number): number {
+    if (k < 0) return 0;
+    if (k >= n) return 1;
+    if (p <= 0) return 1;
+    if (p >= 1) return 0;
+    let logC = 0;
+    let sum = 0;
+    for (let i = 0; i <= k; i++) {
+        if (i > 0) logC += Math.log(n - i + 1) - Math.log(i);
+        sum += Math.exp(logC + i * Math.log(p) + (n - i) * Math.log1p(-p));
+    }
+    return Math.min(sum, 1);
+}
+
+/** Bisection on a monotone function of p; 200 halvings is below double precision. */
+function solve(f: (p: number) => number, target: number, decreasing: boolean): number {
+    let lo = 0;
+    let hi = 1;
+    for (let i = 0; i < 200; i++) {
+        const mid = (lo + hi) / 2;
+        const above = f(mid) > target;
+        if (above === decreasing) lo = mid;
+        else hi = mid;
+    }
+    return (lo + hi) / 2;
+}
+
+/** Exact one-sided upper bound on a binomial rate after `k` events in `n` trials. */
+export function clopperPearsonUpper(k: number, n: number, alpha = BOUND_ALPHA): number {
+    if (k >= n) return 1;
+    return solve((p) => binomCdf(k, n, p), alpha, true);
+}
+
+/** Exact one-sided lower bound on a binomial rate after `k` events in `n` trials. */
+export function clopperPearsonLower(k: number, n: number, alpha = BOUND_ALPHA): number {
+    if (k <= 0) return 0;
+    return solve((p) => 1 - binomCdf(k - 1, n, p), alpha, false);
+}
 
-function priceFor(model: string, prices: Record<string, Price>): Price | null {
-    const m = model.toLowerCase();
-    const family = FAMILIES.find((f) => m.includes(f));
-    return family ? (prices[family] ?? null) : null;
+interface PriceContext {
+    rows: readonly PriceRow[];
+    asOf: Date;
 }
 
-function legCost(model: string, usage: LegUsage, prices: Record<string, Price>, notes: string[]): number {
-    const p = priceFor(model, prices);
-    if (p === null) {
-        notes.push(`no price for served model ${model}; its leg is priced at 0 and the cost verdict is underpowered`);
+function legCost(model: string, usage: LegUsage, prices: PriceContext, notes: string[]): number {
+    const pick = selectPrice(prices.rows, model, prices.asOf);
+    if ('refusal' in pick) {
+        const note = `${pick.refusal}; its leg is not priced and the cost verdict is underpowered`;
+        if (!notes.includes(note)) notes.push(note);
         return Number.NaN;
     }
+    const p = pick.price;
     return (
         (usage.input * p.input + usage.cache_read * p.cache_read + usage.cache_write * p.cache_write + usage.output * p.output) /
         1_000_000
     );
 }
 
-function summarise(legs: LegResult[], prices: Record<string, Price>, notes: string[]): ArmSummary {
+function summarise(legs: LegResult[], prices: PriceContext, notes: string[]): ArmSummary {
     let cost = 0;
     let verified = 0;
     let failedOrEscalated = 0;
@@ -129,8 +176,9 @@ function summarise(legs: LegResult[], prices: Record<string, Price>, notes: stri
  * Read the paired run. A slice counts only when both arms ran it once; extra
  * or one-sided rows are noted and left out rather than guessed at.
  */
-export function tierDownshiftVerdict(rows: readonly LegResult[], prices: Record<string, Price>): TierDownshiftVerdict {
+export function tierDownshiftVerdict(rows: readonly LegResult[], priceRows: readonly PriceRow[], asOf: Date): TierDownshiftVerdict {
     const notes: string[] = [];
+    const prices: PriceContext = { rows: priceRows, asOf };
     const bySlice = new Map<string, Partial<Record<Arm, LegResult>>>();
     for (const r of rows) {
         const entry = bySlice.get(r.slice_id) ?? {};
@@ -153,7 +201,8 @@ export function tierDownshiftVerdict(rows: readonly LegResult[], prices: Record<
     const n = pairs.length;
 
     let diffPp: number | null = null;
-    let halfWidthPp: number | null = null;
+    let upperPp: number | null = null;
+    let lowerPp: number | null = null;
     let escalationRate: number | null = null;
     if (n > 0) {
         // Paired difference of the fail-or-escalate indicator: only discordant pairs move it.
@@ -165,27 +214,23 @@ export function tierDownshiftVerdict(rows: readonly LegResult[], prices: Record<
             if (lf && !inf) b++;
             if (!lf && inf) c++;
         }
-        const diff = (b - c) / n;
-        const variance = (b + c - (b - c) ** 2 / n) / (n * n);
-        diffPp = diff * 100;
-        halfWidthPp = 1.96 * Math.sqrt(Math.max(variance, 0)) * 100;
-        // No discordant pair gives a zero-width interval; the rule of three bounds
-        // an unseen disagreement rate at 3/n instead.
-        if (b + c === 0) halfWidthPp = (3 / n) * 100;
+        diffPp = ((b - c) / n) * 100;
+        upperPp = clopperPearsonUpper(b, n) * 100;
+        lowerPp = (clopperPearsonLower(b, n) - clopperPearsonUpper(c, n)) * 100;
         escalationRate = lite.escalated / n;
     }
 
     let quality: QualityVerdict;
-    if (n < MIN_PAIRS || diffPp === null || halfWidthPp === null || escalationRate === null) {
+    if (n < MIN_PAIRS || diffPp === null || upperPp === null || lowerPp === null || escalationRate === null) {
         quality = 'underpowered';
         notes.push(`${n} complete pairs, below the floor of ${MIN_PAIRS}`);
-    } else if (escalationRate >= ESCALATION_KILL || diffPp - halfWidthPp > QUALITY_MARGIN_PP) {
+    } else if (escalationRate >= ESCALATION_KILL || lowerPp > QUALITY_MARGIN_PP) {
         quality = 'breached';
-    } else if (diffPp + halfWidthPp <= QUALITY_MARGIN_PP) {
+    } else if (upperPp < QUALITY_MARGIN_PP) {
         quality = 'held';
     } else {
         quality = 'underpowered';
-        notes.push('the interval straddles the 5 pp margin');
+        notes.push(`the upper bound ${upperPp.toFixed(2)} pp is not below the ${QUALITY_MARGIN_PP} pp margin`);
     }
 
     let cost: CostVerdict;
@@ -200,7 +245,8 @@ export function tierDownshiftVerdict(rows: readonly LegResult[], prices: Record<
         lite,
         inherit,
         diff_pp: diffPp,
-        ci_half_width_pp: halfWidthPp,
+        upper_bound_pp: upperPp,
+        lower_bound_pp: lowerPp,
         escalation_rate_lite: escalationRate,
         quality,
         cost,

package/src/scripts/ai_council/chairman.ts

@@ -26,6 +26,8 @@ export interface ChairmanCandidate {
     tier: number | null;
     /** The seat's billing class; an unpaid one never chairs (ADR-257). Absent = paid. */
     billing?: string | null;
+    /** A `base_url` route member; it never chairs, whatever its billing. */
+    route?: boolean;
 }
 
 export interface ChairmanSelection {
@@ -60,7 +62,8 @@ export function select_chairman(
                 annotation: `Chairman: host (member ${_q(member)} unavailable — host fallback)`,
             };
         }
-        const refusal = seatRoleRefusal('synthesis', candidates.find((c) => c.name === member)?.billing, member);
+        const c = candidates.find((x) => x.name === member);
+        const refusal = seatRoleRefusal('synthesis', c?.billing, member, c?.route === true);
         if (refusal !== null) {
             return {
                 member: null,
@@ -85,7 +88,7 @@ export function select_chairman(
             annotation: 'Chairman: host (no non-panel member available)',
         };
     }
-    const pool = nonPanel.filter((c) => seatRoleRefusal('synthesis', c.billing) === null);
+    const pool = nonPanel.filter((c) => seatRoleRefusal('synthesis', c.billing, c.name, c.route === true) === null);
     if (pool.length === 0) {
         return { member: null, annotation: 'Chairman: host (no paid non-panel member available)' };
     }

package/src/scripts/ai_council/clients.ts

@@ -1189,9 +1189,10 @@ export abstract class CliClient extends ExternalAIClient {
     protected _cli_calls_path: string | null;
     /** Attribution label for every booking this client makes. */
     protected _consumer: string;
-    /** The session the last answered call ran in; `resumeNext` continues it once, non-blind only. */
+    /** The session the last answered call ran in; `resumeNext` continues it once, never while `blind`. */
     lastSession: SeatSession | null = null;
     resumeNext: SeatSession | null = null;
+    blind = false;
 
     static _AUTH_FAILURE_PATTERNS: readonly string[] = [
         'authentication',
@@ -1675,7 +1676,7 @@ export class AnthropicCliClient extends CliClient {
         void max_tokens;
         return [
             this.binary,
-            ...seatResumeArgs(this.name, this.resumeNext, { blind: false, now_ms: Date.now() }),
+            ...seatResumeArgs(this.name, this.resumeNext, { blind: this.blind, now_ms: Date.now() }),
             '--print',
             // The seat never needs the user environment; only a version the light
             // launch was probed on gets the flag (`LIGHT_LAUNCH_PROBES`).
@@ -1822,7 +1823,7 @@ export class OpenAICliClient extends CliClient {
         // the payload itself is assembled in `_stdin_payload`.
         const modelArgs =
             this.model === OPENAI_CLI_VENDOR_DEFAULT ? [] : ['--model', this.model];
-        const resume = seatResumeArgs(this.name, this.resumeNext, { blind: false, now_ms: Date.now() });
+        const resume = seatResumeArgs(this.name, this.resumeNext, { blind: this.blind, now_ms: Date.now() });
         const bound = resume.length === 0 ? boundFor('openai') : resumeBound(boundFor('openai'));
         return [this.binary, 'exec', ...resume, '--json', '--skip-git-repo-check', ...bound, ...modelArgs, '-'];
     }