@stravica-ai/digital-operator-pa 0.1.33 → 0.1.34

package/dist/engineering-pa-cli/docs/secrets.md

@@ -85,6 +85,40 @@ node core/tools/secrets/bin/secrets set API_KEY "sk-abc123" --no-canonical
 node core/tools/secrets/bin/secrets verify --values --against /path/to/other/vault/scope.enc.json
 ```
 
+### Full-scope reference form (get/set/delete/find)
+
+Barry ruling 2026-07-15 (`w-2026-07-15-023`): every secret is referred
+to by its full scope path at every non-interactive reference site. The
+scope is named at the call site so provenance is visible and same-name
+keys in different scopes cannot silently collide (a real problem today,
+`secrets find CLOUDFLARE_WORKERS_ACCOUNT_ID_STRAVICA` returns matches
+in both `hq-estate` and `wsd`).
+
+```bash
+secrets get hq-estate/CLERK_AUTH_KEY
+secrets set clients-clive/BUNNY_API_KEY_CLIVE -
+secrets delete seo-ops/OPENAI_API_KEY
+secrets find hq-estate/GITHUB_PAT_MAX_READ
+```
+
+Each is equivalent to the corresponding `--scope <name> <verb> KEY`
+form. The two may be combined when they agree; a mismatch is a hard
+error (exit 1). `--file` is not combinable with the reference form (use
+one or the other). Bare-key calls still work and remain the default for
+interactive use, but emit a one-line deprecation notice on stderr
+naming the preferred `scope/KEY` form for the target vault.
+
+### Presence check (`get KEY --exists`)
+
+`secrets get KEY --exists` (alias `--dry-run`) probes for the key
+without ever decrypting. Prints `present` and exits 0 when the key
+resolves in the target vault; prints `absent` and exits 1 when it does
+not. Combines with `--scope`, `--file`, and the `scope/KEY` reference
+form. Use it as the migration proof primitive when moving a reference
+site to the full-scope form: run `secrets get scope/KEY --exists` and
+compare against the pre-migration equivalent to prove identity, without
+ever handling the secret value itself.
+
 ### Canonical-first writes
 
 Canonical-first dual-write is the DEFAULT for scoped `set` since 0.1.20 —

package/dist/engineering-pa-cli/src/research/briefs/deep-verifier.md

@@ -57,8 +57,13 @@ Return one of three outcomes: `confirmed`, `refuted`, `unverified-infra`.
 ## 4. Tools & sources
 
 - `WebSearch` + `WebFetch` to seek contradiction, rival explanations, and counter-
-  examples. Keep it lean — a few targeted calls, not a re-research. You are testing one
-  synthesis, not rebuilding the sub-question.
+  examples. Keep it lean — you are testing one synthesis, not rebuilding the sub-
+  question.
+- **Hard tool-call cap: {{verifyToolCallCap}} calls total** (searches + fetches
+  combined). This is a real budget, not a suggestion: workflow WebSearch calls draw
+  from the PARENT session's shared budget, and a fan-out of verifiers can drain it.
+  Reach the cap without a decisive check → vote per the adversarial default (§3, §8),
+  noting in `note` that the cap was reached.
 
 ## 5. Boundaries
 

package/dist/engineering-pa-cli/src/research/briefs/verifier.md

@@ -47,8 +47,12 @@ Return one of three outcomes: `confirmed`, `refuted`, `unverified-infra`.
 ## 4. Tools & sources
 
 - `WebSearch` + `WebFetch` to seek contradiction and corroboration. Keep it lean —
-  a few targeted calls, not a re-research. You are testing one claim, not rebuilding
-  the sub-question.
+  you are testing one claim, not rebuilding the sub-question.
+- **Hard tool-call cap: {{verifyToolCallCap}} calls total** (searches + fetches
+  combined). This is a real budget, not a suggestion: workflow WebSearch calls draw
+  from the PARENT session's shared budget, and a fan-out of verifiers can drain it.
+  Reach the cap without a decisive check → vote per the adversarial default (§3,
+  §8), noting in `note` that the cap was reached.
 
 ## 5. Boundaries
 

package/dist/engineering-pa-cli/src/research/engine/agents.mjs

@@ -121,6 +121,9 @@ export function verifyAgent(ctx, claim, lens, model = 'sonnet', effort = 'high',
   return agent(brief(ctx, role, {
     sessionId: ctx.sessionId, claimText: claim.text, quote: claim.quote, sourceUrl: claim.url || claim.sourceId,
     subQuestionText: claim.sqText, lens,
+    // Verifier tool-call cap: shared WebSearch budget with the parent session, so keep
+    // per-verifier calls tight (w-2026-09-01-dave-010). Defaults to 2; deep can lift.
+    verifyToolCallCap: ctx.verifyToolCallCap ?? 2,
   }), { model, effort, phase: 'Verify', label: `verify:${claim.claimId}:${lens}`, schema: VERIFY_SCHEMA });
 }
 

package/dist/engineering-pa-cli/src/research/engine/deep.mjs

@@ -15,9 +15,9 @@
 //     stop, and testOverrides so a mechanical smoke run is self-identifying.
 import { flattenClaims, rankAndCapPerSq } from './rank.mjs';
 import { adjudicate } from './verify.mjs';
-import { verifyAgent, synthAgent, SYNTH_SCHEMA } from './agents.mjs';
+import { verifyAgent } from './agents.mjs';
 import { runDeepenRound, deepenStopReason } from './deepen.mjs';
-import { buildSourcesJson, buildGateRecords, bucketsFor } from './finalise.mjs';
+import { buildSourcesJson, buildGateRecords, bucketsFor, synthOrDegrade } from './finalise.mjs';
 
 // Guaranteed floor of top claims kept per sub-question when the claim budget is capped
 // (deep-mode fix for SQ starvation). 1 = every planned sub-question keeps its single best
@@ -316,60 +316,15 @@ export async function recordRunStart(ctx) {
 // claim, but a searcher/extractor that found nothing still leaves an empty SQ). Such an
 // SQ gets a DEGRADED finding: schema-valid, confidence 'low', zero claims, and a summary
 // explaining the absence. This closes the deep-judge's "only N of M sub-questions
-// answered" gap and keeps the finding count == the plan's sub-question count.
+// answered" gap and keeps the finding count == the plan's sub-question count. The
+// synthOrDegrade/degradedFinding/degradedSynthAgent primitives now live in finalise.mjs
+// (shared with normal — w-2026-09-01-dave-010 fix).
 export async function runDeepSynth(ctx, subQuestions, retained, verdictByClaimId) {
   return (await parallel(
     subQuestions.map((sq) => () => synthOrDegrade(ctx, sq, bucketsFor(retained, verdictByClaimId, sq.id))),
   )).filter(Boolean);
 }
 
-// Synthesize one sub-question, degrading to a zero-claim finding when there is nothing to
-// synthesize or the synthesizer fails to write a schema-valid finding — either way the SQ
-// keeps its file, so the invariant holds.
-async function synthOrDegrade(ctx, sq, buckets) {
-  const hasClaims = buckets.verified.length || buckets.supporting.length || buckets.refuted.length;
-  if (hasClaims) {
-    const receipt = await synthAgent(ctx, sq, buckets);
-    if (receipt && receipt.written === true) return receipt;
-    log(`synth: ${sq.id} did not write a valid finding — writing a degraded finding to preserve the finding-per-SQ invariant`);
-    return degradedSynthAgent(ctx, sq, 'the synthesizer did not produce a schema-valid finding');
-  }
-  log(`synth: ${sq.id} had no retained claims — writing a degraded (zero-claim) finding to preserve the finding-per-SQ invariant`);
-  return degradedSynthAgent(ctx, sq, 'no claims survived ranking/verification for this sub-question');
-}
-
-// Pure: the exact degraded finding for a sub-question (fits the EXISTING finding schema —
-// no store change). Empty quotes/sources/votes, confidence 'low', a self-describing
-// summary, unsourced:false.
-export function degradedFinding(sq, reason) {
-  return {
-    subQuestionId: sq.id,
-    summary: `No verifiable findings were produced for this sub-question (${sq.text}). Reason: ${reason}. `
-      + `This degraded finding is written to preserve the one-finding-per-sub-question invariant; treat the `
-      + `sub-question as unanswered and re-run research for it if a complete answer is required.`,
-    quotes: [],
-    sources: [],
-    confidence: 'low',
-    verificationVotes: [],
-    unsourced: false,
-  };
-}
-
-// Have an agent write the degraded finding verbatim and round-trip it. Returns a synth
-// receipt (claimCount 0) so the caller's aggregation (unsourced ratio, run stats) is
-// unaffected. No brief needed — this is a mechanical verbatim write.
-async function degradedSynthAgent(ctx, sq, reason) {
-  const finding = degradedFinding(sq, reason);
-  const path = `${ctx.sessionDir}/findings/${sq.id}.json`;
-  return await agent([
-    `You are writing a **degraded finding** for deep-research session \`${ctx.sessionId}\`, sub-question \`${sq.id}\`.`,
-    `Write this EXACT JSON (verbatim, no edits) to \`${path}\`:`,
-    '```json', JSON.stringify(finding, null, 2), '```',
-    `Then round-trip: run \`${ctx.cli} show ${ctx.sessionId} --json\` and confirm exit 0 (it validates findings).`,
-    `Return { subQuestionId: "${sq.id}", written: true, path: "${path}", confidence: "low", claimCount: 0,`,
-    `centralConfirmed: 0, centralRefuted: 0, unsourcedCount: 0 } once the round-trip is green.`,
-  ].join('\n'), { model: ctx.modelOverride || 'haiku', effort: 'low', phase: 'Synthesize', label: `synth-degraded:${sq.id}`, schema: SYNTH_SCHEMA });
-}
 
 // ── judge phase (advisory — spec §2.3, arch §4.2 phase 7) ──────────────────────
 export const JUDGE_RECEIPT_SCHEMA = {

package/dist/engineering-pa-cli/src/research/engine/finalise.mjs

@@ -1,6 +1,6 @@
 // Shared research engine — synthesis bucketing, deterministic aggregation
 // (sources.json / gate records), and the synth + finalise phases.
-import { synthAgent } from './agents.mjs';
+import { synthAgent, SYNTH_SCHEMA } from './agents.mjs';
 
 export const UNSOURCED_ABORT_RATIO = 0.10;      // §8 guardrail: >10% unsourced fails the run
 
@@ -71,14 +71,90 @@ export function buildGateRecords(sqResults) {
 }
 
 // -- Synthesize (per-SQ finding files — §4.1 lead tier) --
+// Every planned sub-question gets a finding, even when no claim survived ranking or
+// verification. Normal's global CLAIM_BUDGET cap (rankAndCap in wrappers/normal.mjs)
+// concentrates retention on the highest-ranked SQs; without the degrade fallback the
+// starved SQs silently vanish from the answer while the workflow still reports
+// status='done' (see w-2026-09-01-dave-010 — 4-SQ plan, sq-3/sq-4 dropped, 5 findings
+// presented as complete). runDeepSynth carries the same invariant for deep mode.
 export async function runSynth(ctx, subQuestions, retained, verdictByClaimId) {
   return (await parallel(
-    subQuestions
-      .filter((sq) => retained.some((c) => c.sqId === sq.id))
-      .map((sq) => () => synthAgent(ctx, sq, bucketsFor(retained, verdictByClaimId, sq.id))),
+    subQuestions.map((sq) => () => synthOrDegrade(ctx, sq, bucketsFor(retained, verdictByClaimId, sq.id))),
   )).filter(Boolean);
 }
 
+// Synthesize one sub-question, degrading to a zero-claim finding when there is nothing
+// to synthesize or the synthesizer fails to write a schema-valid finding — either way
+// the SQ keeps its file, so the finding-per-SQ invariant holds and the coverage gate in
+// the wrapper can see the full picture.
+export async function synthOrDegrade(ctx, sq, buckets) {
+  const hasClaims = buckets.verified.length || buckets.supporting.length || buckets.refuted.length;
+  if (hasClaims) {
+    const receipt = await synthAgent(ctx, sq, buckets);
+    if (receipt && receipt.written === true) return receipt;
+    log(`synth: ${sq.id} did not write a valid finding — writing a degraded finding to preserve the finding-per-SQ invariant`);
+    return degradedSynthAgent(ctx, sq, 'the synthesizer did not produce a schema-valid finding');
+  }
+  log(`synth: ${sq.id} had no retained claims — writing a degraded (zero-claim) finding to preserve the finding-per-SQ invariant`);
+  return degradedSynthAgent(ctx, sq, 'no claims survived ranking/verification for this sub-question');
+}
+
+// Pure: the exact degraded finding for a sub-question (fits the EXISTING finding schema —
+// no store change). Empty quotes/sources/votes, confidence 'low', a self-describing
+// summary, unsourced:false.
+export function degradedFinding(sq, reason) {
+  return {
+    subQuestionId: sq.id,
+    summary: `No verifiable findings were produced for this sub-question (${sq.text}). Reason: ${reason}. `
+      + `This degraded finding is written to preserve the one-finding-per-sub-question invariant; treat the `
+      + `sub-question as unanswered and re-run research for it if a complete answer is required.`,
+    quotes: [],
+    sources: [],
+    confidence: 'low',
+    verificationVotes: [],
+    unsourced: false,
+  };
+}
+
+// Have an agent write the degraded finding verbatim and round-trip it. Returns a synth
+// receipt (claimCount 0) so the caller's aggregation (unsourced ratio, coverage stats)
+// is unaffected. No brief needed — this is a mechanical verbatim write.
+export async function degradedSynthAgent(ctx, sq, reason) {
+  const finding = degradedFinding(sq, reason);
+  const path = `${ctx.sessionDir}/findings/${sq.id}.json`;
+  return await agent([
+    `You are writing a **degraded finding** for research session \`${ctx.sessionId}\`, sub-question \`${sq.id}\`.`,
+    `Write this EXACT JSON (verbatim, no edits) to \`${path}\`:`,
+    '```json', JSON.stringify(finding, null, 2), '```',
+    `Then round-trip: run \`${ctx.cli} show ${ctx.sessionId} --json\` and confirm exit 0 (it validates findings).`,
+    `Return { subQuestionId: "${sq.id}", written: true, path: "${path}", confidence: "low", claimCount: 0,`,
+    `centralConfirmed: 0, centralRefuted: 0, unsourcedCount: 0 } once the round-trip is green.`,
+  ].join('\n'), { model: ctx.modelOverride || 'haiku', effort: 'low', phase: 'Synthesize', label: `synth-degraded:${sq.id}`, schema: SYNTH_SCHEMA });
+}
+
+// Pure coverage computation. Given the planner's sub-question ids and the synth
+// receipts, decide which SQs have a finding (any receipt with written=true), which ran
+// as a degraded write (empty finding, still counted as covered), and which are wholly
+// uncovered (no receipt at all — the failure this gate exists to catch). Used by the
+// wrapper to fail loudly instead of silently reporting status='done' on a partial run.
+export function coverageReport(subQuestionIds, synthReceipts) {
+  const receiptsBySq = new Map();
+  for (const r of synthReceipts || []) {
+    if (r && r.subQuestionId) receiptsBySq.set(r.subQuestionId, r);
+  }
+  const planned = subQuestionIds.length;
+  const covered = [];
+  const degraded = [];
+  const uncovered = [];
+  for (const id of subQuestionIds) {
+    const r = receiptsBySq.get(id);
+    if (!r || r.written !== true) { uncovered.push(id); continue; }
+    covered.push(id);
+    if ((r.claimCount || 0) === 0) degraded.push(id);
+  }
+  return { planned, covered, degraded, uncovered, complete: uncovered.length === 0 };
+}
+
 // -- Finalise (persist gate records, write sources.json + the session answer, round-trip, mark done) --
 export async function runFinalise(ctx, { gateRecords, sourcesJson, runStats }) {
   // The gate-persistence step is present only when searchers actually dropped gated

package/dist/engineering-pa-cli/src/research/engine/verify.mjs

@@ -6,6 +6,13 @@ import { verifyAgent } from './agents.mjs';
 
 export const VERIFY_LENSES = ['quote-support', 'contradiction-search', 'recency-source-fit'];
 
+// Hard per-verifier WebSearch/WebFetch cap. Workflow searchers observed to drain the
+// PARENT session's shared WebSearch budget (w-2026-09-01-dave-010: 200/200 consumed
+// on a normal run). The verifier brief already asks for "a few targeted calls"; this
+// makes it a schema-enforceable ceiling the brief interpolates. Two calls per lens is
+// enough to test one claim without re-researching the sub-question.
+export const VERIFY_TOOL_CALL_CAP_DEFAULT = 2;
+
 // Decide one claim's verdict from its votes.
 //   - `unverified-infra` votes are infrastructure failures, not evidence — they
 //     count toward neither confirmation nor refutation.

package/dist/engineering-pa-cli/src/research/workflows/research-deep.js

@@ -1,6 +1,6 @@
 // GENERATED by assemble.mjs — DO NOT EDIT. Edit wrappers/deep.mjs + engine/*.mjs and re-run `pnpm assemble`.
 // sources: wrappers/deep.mjs, engine/io.mjs, engine/plan.mjs, engine/agents.mjs, engine/finalise.mjs, engine/rank.mjs, engine/verify.mjs, engine/deepen.mjs, engine/deep.mjs
-// contentHash: sha256:c3afe42e6ee577590f7f69d13821218bd84f66440d8168162971bf0631cab4a0
+// contentHash: sha256:cbdbff5d260df77a3b56a60d37bd75a58f0fa38968dbd0f0181c71fb6d8b3d29
 
 export const meta = {
   name: 'research-deep',
@@ -331,6 +331,9 @@ function verifyAgent(ctx, claim, lens, model = 'sonnet', effort = 'high', role =
   return agent(brief(ctx, role, {
     sessionId: ctx.sessionId, claimText: claim.text, quote: claim.quote, sourceUrl: claim.url || claim.sourceId,
     subQuestionText: claim.sqText, lens,
+    // Verifier tool-call cap: shared WebSearch budget with the parent session, so keep
+    // per-verifier calls tight (w-2026-09-01-dave-010). Defaults to 2; deep can lift.
+    verifyToolCallCap: ctx.verifyToolCallCap ?? 2,
   }), { model, effort, phase: 'Verify', label: `verify:${claim.claimId}:${lens}`, schema: VERIFY_SCHEMA });
 }
 
@@ -445,14 +448,90 @@ function buildGateRecords(sqResults) {
 }
 
 // -- Synthesize (per-SQ finding files — §4.1 lead tier) --
+// Every planned sub-question gets a finding, even when no claim survived ranking or
+// verification. Normal's global CLAIM_BUDGET cap (rankAndCap in wrappers/normal.mjs)
+// concentrates retention on the highest-ranked SQs; without the degrade fallback the
+// starved SQs silently vanish from the answer while the workflow still reports
+// status='done' (see w-2026-09-01-dave-010 — 4-SQ plan, sq-3/sq-4 dropped, 5 findings
+// presented as complete). runDeepSynth carries the same invariant for deep mode.
 async function runSynth(ctx, subQuestions, retained, verdictByClaimId) {
   return (await parallel(
-    subQuestions
-      .filter((sq) => retained.some((c) => c.sqId === sq.id))
-      .map((sq) => () => synthAgent(ctx, sq, bucketsFor(retained, verdictByClaimId, sq.id))),
+    subQuestions.map((sq) => () => synthOrDegrade(ctx, sq, bucketsFor(retained, verdictByClaimId, sq.id))),
   )).filter(Boolean);
 }
 
+// Synthesize one sub-question, degrading to a zero-claim finding when there is nothing
+// to synthesize or the synthesizer fails to write a schema-valid finding — either way
+// the SQ keeps its file, so the finding-per-SQ invariant holds and the coverage gate in
+// the wrapper can see the full picture.
+async function synthOrDegrade(ctx, sq, buckets) {
+  const hasClaims = buckets.verified.length || buckets.supporting.length || buckets.refuted.length;
+  if (hasClaims) {
+    const receipt = await synthAgent(ctx, sq, buckets);
+    if (receipt && receipt.written === true) return receipt;
+    log(`synth: ${sq.id} did not write a valid finding — writing a degraded finding to preserve the finding-per-SQ invariant`);
+    return degradedSynthAgent(ctx, sq, 'the synthesizer did not produce a schema-valid finding');
+  }
+  log(`synth: ${sq.id} had no retained claims — writing a degraded (zero-claim) finding to preserve the finding-per-SQ invariant`);
+  return degradedSynthAgent(ctx, sq, 'no claims survived ranking/verification for this sub-question');
+}
+
+// Pure: the exact degraded finding for a sub-question (fits the EXISTING finding schema —
+// no store change). Empty quotes/sources/votes, confidence 'low', a self-describing
+// summary, unsourced:false.
+function degradedFinding(sq, reason) {
+  return {
+    subQuestionId: sq.id,
+    summary: `No verifiable findings were produced for this sub-question (${sq.text}). Reason: ${reason}. `
+      + `This degraded finding is written to preserve the one-finding-per-sub-question invariant; treat the `
+      + `sub-question as unanswered and re-run research for it if a complete answer is required.`,
+    quotes: [],
+    sources: [],
+    confidence: 'low',
+    verificationVotes: [],
+    unsourced: false,
+  };
+}
+
+// Have an agent write the degraded finding verbatim and round-trip it. Returns a synth
+// receipt (claimCount 0) so the caller's aggregation (unsourced ratio, coverage stats)
+// is unaffected. No brief needed — this is a mechanical verbatim write.
+async function degradedSynthAgent(ctx, sq, reason) {
+  const finding = degradedFinding(sq, reason);
+  const path = `${ctx.sessionDir}/findings/${sq.id}.json`;
+  return await agent([
+    `You are writing a **degraded finding** for research session \`${ctx.sessionId}\`, sub-question \`${sq.id}\`.`,
+    `Write this EXACT JSON (verbatim, no edits) to \`${path}\`:`,
+    '```json', JSON.stringify(finding, null, 2), '```',
+    `Then round-trip: run \`${ctx.cli} show ${ctx.sessionId} --json\` and confirm exit 0 (it validates findings).`,
+    `Return { subQuestionId: "${sq.id}", written: true, path: "${path}", confidence: "low", claimCount: 0,`,
+    `centralConfirmed: 0, centralRefuted: 0, unsourcedCount: 0 } once the round-trip is green.`,
+  ].join('\n'), { model: ctx.modelOverride || 'haiku', effort: 'low', phase: 'Synthesize', label: `synth-degraded:${sq.id}`, schema: SYNTH_SCHEMA });
+}
+
+// Pure coverage computation. Given the planner's sub-question ids and the synth
+// receipts, decide which SQs have a finding (any receipt with written=true), which ran
+// as a degraded write (empty finding, still counted as covered), and which are wholly
+// uncovered (no receipt at all — the failure this gate exists to catch). Used by the
+// wrapper to fail loudly instead of silently reporting status='done' on a partial run.
+function coverageReport(subQuestionIds, synthReceipts) {
+  const receiptsBySq = new Map();
+  for (const r of synthReceipts || []) {
+    if (r && r.subQuestionId) receiptsBySq.set(r.subQuestionId, r);
+  }
+  const planned = subQuestionIds.length;
+  const covered = [];
+  const degraded = [];
+  const uncovered = [];
+  for (const id of subQuestionIds) {
+    const r = receiptsBySq.get(id);
+    if (!r || r.written !== true) { uncovered.push(id); continue; }
+    covered.push(id);
+    if ((r.claimCount || 0) === 0) degraded.push(id);
+  }
+  return { planned, covered, degraded, uncovered, complete: uncovered.length === 0 };
+}
+
 // -- Finalise (persist gate records, write sources.json + the session answer, round-trip, mark done) --
 async function runFinalise(ctx, { gateRecords, sourcesJson, runStats }) {
   // The gate-persistence step is present only when searchers actually dropped gated
@@ -584,6 +663,13 @@ function rankAndCapPerSq(claims, budget, { floorPerSq = 1 } = {}) {
 
 const VERIFY_LENSES = ['quote-support', 'contradiction-search', 'recency-source-fit'];
 
+// Hard per-verifier WebSearch/WebFetch cap. Workflow searchers observed to drain the
+// PARENT session's shared WebSearch budget (w-2026-09-01-dave-010: 200/200 consumed
+// on a normal run). The verifier brief already asks for "a few targeted calls"; this
+// makes it a schema-enforceable ceiling the brief interpolates. Two calls per lens is
+// enough to test one claim without re-researching the sub-question.
+const VERIFY_TOOL_CALL_CAP_DEFAULT = 2;
+
 // Decide one claim's verdict from its votes.
 //   - `unverified-infra` votes are infrastructure failures, not evidence — they
 //     count toward neither confirmation nor refutation.
@@ -1040,61 +1126,15 @@ async function recordRunStart(ctx) {
 // claim, but a searcher/extractor that found nothing still leaves an empty SQ). Such an
 // SQ gets a DEGRADED finding: schema-valid, confidence 'low', zero claims, and a summary
 // explaining the absence. This closes the deep-judge's "only N of M sub-questions
-// answered" gap and keeps the finding count == the plan's sub-question count.
+// answered" gap and keeps the finding count == the plan's sub-question count. The
+// synthOrDegrade/degradedFinding/degradedSynthAgent primitives now live in finalise.mjs
+// (shared with normal — w-2026-09-01-dave-010 fix).
 async function runDeepSynth(ctx, subQuestions, retained, verdictByClaimId) {
   return (await parallel(
     subQuestions.map((sq) => () => synthOrDegrade(ctx, sq, bucketsFor(retained, verdictByClaimId, sq.id))),
   )).filter(Boolean);
 }
 
-// Synthesize one sub-question, degrading to a zero-claim finding when there is nothing to
-// synthesize or the synthesizer fails to write a schema-valid finding — either way the SQ
-// keeps its file, so the invariant holds.
-async function synthOrDegrade(ctx, sq, buckets) {
-  const hasClaims = buckets.verified.length || buckets.supporting.length || buckets.refuted.length;
-  if (hasClaims) {
-    const receipt = await synthAgent(ctx, sq, buckets);
-    if (receipt && receipt.written === true) return receipt;
-    log(`synth: ${sq.id} did not write a valid finding — writing a degraded finding to preserve the finding-per-SQ invariant`);
-    return degradedSynthAgent(ctx, sq, 'the synthesizer did not produce a schema-valid finding');
-  }
-  log(`synth: ${sq.id} had no retained claims — writing a degraded (zero-claim) finding to preserve the finding-per-SQ invariant`);
-  return degradedSynthAgent(ctx, sq, 'no claims survived ranking/verification for this sub-question');
-}
-
-// Pure: the exact degraded finding for a sub-question (fits the EXISTING finding schema —
-// no store change). Empty quotes/sources/votes, confidence 'low', a self-describing
-// summary, unsourced:false.
-function degradedFinding(sq, reason) {
-  return {
-    subQuestionId: sq.id,
-    summary: `No verifiable findings were produced for this sub-question (${sq.text}). Reason: ${reason}. `
-      + `This degraded finding is written to preserve the one-finding-per-sub-question invariant; treat the `
-      + `sub-question as unanswered and re-run research for it if a complete answer is required.`,
-    quotes: [],
-    sources: [],
-    confidence: 'low',
-    verificationVotes: [],
-    unsourced: false,
-  };
-}
-
-// Have an agent write the degraded finding verbatim and round-trip it. Returns a synth
-// receipt (claimCount 0) so the caller's aggregation (unsourced ratio, run stats) is
-// unaffected. No brief needed — this is a mechanical verbatim write.
-async function degradedSynthAgent(ctx, sq, reason) {
-  const finding = degradedFinding(sq, reason);
-  const path = `${ctx.sessionDir}/findings/${sq.id}.json`;
-  return await agent([
-    `You are writing a **degraded finding** for deep-research session \`${ctx.sessionId}\`, sub-question \`${sq.id}\`.`,
-    `Write this EXACT JSON (verbatim, no edits) to \`${path}\`:`,
-    '```json', JSON.stringify(finding, null, 2), '```',
-    `Then round-trip: run \`${ctx.cli} show ${ctx.sessionId} --json\` and confirm exit 0 (it validates findings).`,
-    `Return { subQuestionId: "${sq.id}", written: true, path: "${path}", confidence: "low", claimCount: 0,`,
-    `centralConfirmed: 0, centralRefuted: 0, unsourcedCount: 0 } once the round-trip is green.`,
-  ].join('\n'), { model: ctx.modelOverride || 'haiku', effort: 'low', phase: 'Synthesize', label: `synth-degraded:${sq.id}`, schema: SYNTH_SCHEMA });
-}
-
 // ── judge phase (advisory — spec §2.3, arch §4.2 phase 7) ──────────────────────
 const JUDGE_RECEIPT_SCHEMA = {
   type: 'object', additionalProperties: false,