@sun-asterisk/sungen 3.2.34 → 3.3.0-alpha.2

package/dist/harness/gates/unit-gate-overrides.js

@@ -0,0 +1,122 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.unitScopeOfDir = unitScopeOfDir;
+exports.loadUnitGateOverrides = loadUnitGateOverrides;
+/**
+ * The gate overrides in force for ONE unit, read from the decision layer (OES-11.2/11.3, DOS-13).
+ *
+ * Sources: `qa/decisions/` (project) and `qa/<kind>/<unit>/decisions/` (the unit). Only entries that
+ * verify against themselves are considered (readDecisions); superseded ones are out of force. Per
+ * rule the override in force is the most specific — an exact unit beats a glob — then the latest, then
+ * the higher decision id (deterministic). Each carries whether git HEAD holds it: an uncommitted one
+ * still counts (the author sees its effect), release refuses it (decision.in-run, review H1).
+ * Never throws: a bad file is a `problem`, a bad override is `rejected`.
+ */
+const path = __importStar(require("path"));
+const decision_file_1 = require("../../decisions/decision-file");
+const read_decisions_1 = require("../../decisions/read-decisions");
+const gate_override_validation_1 = require("./gate-override-validation");
+const decisions_hash_1 = require("./decisions-hash");
+const in_run_decision_check_1 = require("./in-run-decision-check");
+/** The decision scope of a unit directory (`screens/login`, `api/flows/signup`), or null. */
+function unitScopeOfDir(projectRoot, unitDir) {
+    const rel = path.relative(path.join(projectRoot, 'qa'), unitDir).split(path.sep).join('/');
+    return rel && !rel.startsWith('..') && (0, decision_file_1.isValidScope)(rel) && rel !== decision_file_1.PROJECT_SCOPE ? rel : null;
+}
+const specificity = (o, unitScope) => (o.scope === unitScope ? 1 : 0);
+/** Does `a` take precedence over `b` for the same rule? valid_from is schema-checked ISO; NaN never orders. */
+function wins(a, b, unitScope) {
+    const s = specificity(a, unitScope) - specificity(b, unitScope);
+    if (s !== 0)
+        return s > 0;
+    const t = (Date.parse(a.validFrom) || 0) - (Date.parse(b.validFrom) || 0);
+    return t !== 0 ? t > 0 : a.decisionId > b.decisionId;
+}
+function loadUnitGateOverrides(projectRoot, unitScope) {
+    const scopes = unitScope ? [decision_file_1.PROJECT_SCOPE, unitScope] : [decision_file_1.PROJECT_SCOPE];
+    const entries = [];
+    const problems = [];
+    for (const s of scopes) {
+        const r = (0, read_decisions_1.readDecisions)(projectRoot, s);
+        entries.push(...r.entries);
+        problems.push(...r.problems);
+    }
+    const rel = (p) => path.relative(projectRoot, p).split(path.sep).join('/');
+    const hashItems = problems.map((p) => (0, decisions_hash_1.problemHashItem)(projectRoot, p));
+    const byRule = new Map();
+    const rejected = [];
+    const ineffective = [];
+    // HEAD membership is read once, and only when an override is in reach (two git calls).
+    let head;
+    const inHead = (p) => {
+        if (head === undefined)
+            head = (0, in_run_decision_check_1.committedDecisionPaths)(projectRoot);
+        return head ? head.has(p) : null;
+    };
+    for (const e of entries.filter((x) => x.kind === 'gate-override')) {
+        const j = (0, gate_override_validation_1.judgeOverride)(e, unitScope);
+        if (j.status === 'irrelevant')
+            continue;
+        const p = rel(e.path);
+        hashItems.push({ path: p, entryHash: e.entry_hash });
+        if (e.superseded_by)
+            continue;
+        const rule = typeof e.payload?.rule === 'string' ? e.payload.rule : undefined;
+        const issue = { decisionId: e.id, path: p, rule, entry: e, committed: inHead(p) };
+        if (j.status === 'rejected') {
+            rejected.push({ ...issue, reason: j.reason });
+            continue;
+        }
+        if (j.status === 'ineffective') {
+            ineffective.push({ ...issue, reason: j.reason });
+            continue;
+        }
+        const o = { ...j.override, committed: issue.committed };
+        const current = byRule.get(o.rule);
+        if (!current || wins(o, current, unitScope))
+            byRule.set(o.rule, o);
+    }
+    return {
+        unitScope,
+        context: { overrides: byRule },
+        inForce: [...byRule.values()].sort((a, b) => a.rule.localeCompare(b.rule, 'en')),
+        rejected,
+        ineffective,
+        problems,
+        decisionsHash: (0, decisions_hash_1.computeDecisionsHash)(hashItems),
+    };
+}
+//# sourceMappingURL=unit-gate-overrides.js.map

package/dist/harness/gates/unit-gate-overrides.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unit-gate-overrides.js","sourceRoot":"","sources":["../../../src/harness/gates/unit-gate-overrides.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,wCAGC;AAYD,sDA4CC;AAlGD;;;;;;;;;GASG;AACH,2CAA6B;AAC7B,iEAA6F;AAC7F,mEAA6E;AAC7E,yEAA2D;AAE3D,qDAA4F;AAC5F,mEAAiE;AAsBjE,6FAA6F;AAC7F,SAAgB,cAAc,CAAC,WAAmB,EAAE,OAAe;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3F,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAA,4BAAY,EAAC,GAAG,CAAC,IAAI,GAAG,KAAK,6BAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACjG,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,CAAiB,EAAE,SAAwB,EAAU,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7G,+GAA+G;AAC/G,SAAS,IAAI,CAAC,CAAiB,EAAE,CAAiB,EAAE,SAAwB;IAC1E,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAChE,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;AACvD,CAAC;AAED,SAAgB,qBAAqB,CAAC,WAAmB,EAAE,SAAwB;IACjF,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,6BAAa,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,6BAAa,CAAC,CAAC;IACxE,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,IAAA,8BAAa,EAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3F,MAAM,SAAS,GAAwB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gCAAe,EAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;IACjD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,WAAW,GAAoB,EAAE,CAAC;IACxC,uFAAuF;IACvF,IAAI,IAAoC,CAAC;IACzC,MAAM,MAAM,GAAG,CAAC,CAAS,EAAkB,EAAE;QAC3C,IAAI,IAAI,KAAK,SAAS;YAAE,IAAI,GAAG,IAAA,8CAAsB,EAAC,WAAW,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,EAAE,CAAC;QAClE,MAAM,CAAC,GAAG,IAAA,wCAAa,EAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC,CAAC,MAAM,KAAK,YAAY;YAAE,SAAS;QACxC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtB,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,CAAC,aAAa;YAAE,SAAS;QAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,OAAO,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,MAAM,KAAK,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACzF,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YAAC,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC/F,MAAM,CAAC,GAAmB,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,OAAO;QACL,SAAS;QACT,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;QAC9B,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChF,QAAQ;QACR,WAAW;QACX,QAAQ;QACR,aAAa,EAAE,IAAA,qCAAoB,EAAC,SAAS,CAAC;KAC/C,CAAC;AACJ,CAAC"}

package/dist/harness/journey.d.ts

@@ -1,10 +1,13 @@
-export type ObStatus = 'satisfied' | 'needs-work' | 'pending' | 'waived';
+import { DecisionGateFinding } from './gates/journey-gate-inputs';
+/** `overridden`: the audit recorded a gate-override on the obligation's rule (OES-11.2) — accepted like a waiver. */
+export type ObStatus = 'satisfied' | 'needs-work' | 'pending' | 'waived' | 'overridden';
 export interface Obligation {
     id: string;
     title: string;
     status: ObStatus;
     detail: string;
     waivedReason?: string;
+    overriddenBy?: string;
 }
 /** S5 — a parsed anchor so an IDE can jump straight to what needs review. */
 export interface Anchor {
@@ -26,6 +29,10 @@ export interface JourneyReport {
     obligations: Obligation[];
     needsYou: ReviewItem[];
     nextSuggested: string;
+    /** T3 — set when an audit report exists but does not count (stale or untrusted). */
+    auditNotCounted?: string;
+    /** Decision files that do not verify, edited committed entries, rejected overrides — hard, block the gate. */
+    decisionFindings?: DecisionGateFinding[];
 }
 /**
  * The public entry: compute fresh, then RECONCILE with the persisted state —
@@ -33,8 +40,23 @@ export interface JourneyReport {
  *  - an active waiver (evidence unchanged) sets status='waived' (carries the reason);
  *  - a STALE waiver (audit changed since it was waived) is re-surfaced for re-decision (anti-amnesia).
  * Then persist the current evidence cursor.
+ * Waivers in force come from the decision layer; legacy waivers that match git HEAD are imported once,
+ * others are UNTRUSTED (not counted, listed for a human), and the result is dual-written back.
+ * A read-only checkout gets the same board without throwing.
  */
 export declare function runJourney(projectRoot: string, unit: string): JourneyReport;
+/** The single human gate (DOS §3.4, S5): given with `--signoff`, never waived (#936). */
+export declare const SIGNOFF_OBLIGATION = "OB-signoff";
+export declare const signoffCommand: (unit: string) => string;
+/** "Never audited" (T3): a unit is measured by `sungen audit`, never waived through (review W2). */
+export declare const CREATE_OBLIGATION = "OB-create";
+/**
+ * Throws unless `obId` is an obligation of the board that a waiver can accept. Refused in every state,
+ * each with what does it instead: OB-signoff (before any audit it is not on the board, after one a
+ * waiver would let the human gate be waived away) and OB-create (an unaudited unit would pass every
+ * gate on a waiver; the audit measures it).
+ */
+export declare function assertWaivable(report: JourneyReport, unit: string, obId: string): void;
 /**
  * Waive an obligation — REQUIRES a reason (anti-amnesia: a waiver leaves a recorded "why").
  * Records the current evidence cursor so reconcile can invalidate it if the audit changes.
@@ -45,7 +67,19 @@ export declare function waive(projectRoot: string, unit: string, obId: string, r
  * obligation is satisfied or waived (you cannot sign off an unclean suite). Records who/when +
  * the evidence cursor; reconcile invalidates it (stale → re-review) if the suite later changes.
  */
+/** Throws unless the board may be signed off: no decision problem, every other obligation accepted. */
+export declare function assertCanSignOff(before: JourneyReport): void;
+/** Who signs off: `--by`, else the git user; throws when neither names anyone (never `by: unknown`). */
+export declare function signoffSigner(projectRoot: string, unit: string, by?: string): {
+    signer: string;
+    gitUser: string;
+};
 export declare function signoff(projectRoot: string, unit: string, by?: string): JourneyReport;
+/**
+ * Write a DERIVED journey file (board, report, roll-up). Best-effort by contract (DOS-13.3): a read-only
+ * or full checkout still shows the board — the file is skipped and null returned; any other error throws.
+ */
+export declare function writeJourneyFileBestEffort(file: string, text: string): string | null;
 export declare function renderJourneyBoard(r: JourneyReport): string;
 export type GatePhase = 'create' | 'run' | 'deliver';
 export interface GateVerdict {
@@ -62,6 +96,14 @@ export interface GateVerdict {
         id: string;
         title: string;
     }[];
+    /** Required obligations accepted because the audit applied a gate-override to their rule. */
+    overriddenCredit?: {
+        id: string;
+        title: string;
+        by: string;
+    }[];
+    /** The phase rule itself was lowered by this gate-override: the open obligations do not halt. */
+    phaseOverriddenBy?: string;
 }
 export declare function runGate(projectRoot: string, unit: string, phase: GatePhase): GateVerdict;
 export declare function renderGate(v: GateVerdict): string;

package/dist/harness/journey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"journey.d.ts","sourceRoot":"","sources":["../../src/harness/journey.ts"],"names":[],"mappings":"AAoBA,MAAM,MAAM,QAAQ,GAAG,WAAW,GAAG,YAAY,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEzE,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,QAAQ,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,6EAA6E;AAC7E,MAAM,WAAW,MAAM;IAAG,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CAAE;AACxE,MAAM,WAAW,UAAU;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;CAAE;AAE7D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;CACvB;AA8ID;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAgC3E;AAED;;;GAGG;AACH,wBAAgB,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,CAepG;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,aAAa,CAYrF;AAID,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,aAAa,GAAG,MAAM,CAuB3D;AASD,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,KAAK,GAAG,SAAS,CAAC;AAErD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,SAAS,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC1D,YAAY,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC/C;AAWD,wBAAgB,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,WAAW,CASxF;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CAajD;AASD,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,CAAC;AACjD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,kFAAkF;AAClF,wBAAgB,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,EAAE,CAcjF;AAED,wFAAwF;AACxF,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,EAAE,CAahE;AAUD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,CA0B7D"}
+{"version":3,"file":"journey.d.ts","sourceRoot":"","sources":["../../src/harness/journey.ts"],"names":[],"mappings":"AAwBA,OAAO,EAA4C,mBAAmB,EAAkG,MAAM,6BAA6B,CAAC;AAI5M,qHAAqH;AACrH,MAAM,MAAM,QAAQ,GAAG,WAAW,GAAG,YAAY,GAAG,SAAS,GAAG,QAAQ,GAAG,YAAY,CAAC;AAExF,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,QAAQ,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,6EAA6E;AAC7E,MAAM,WAAW,MAAM;IAAG,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CAAE;AACxE,MAAM,WAAW,UAAU;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;CAAE;AAE7D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8GAA8G;IAC9G,gBAAgB,CAAC,EAAE,mBAAmB,EAAE,CAAC;CAC1C;AAgLD;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAuD3E;AAED,yFAAyF;AACzF,eAAO,MAAM,kBAAkB,eAAe,CAAC;AAC/C,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,KAAG,MAAmE,CAAC;AAElH,oGAAoG;AACpG,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAY7C;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAWtF;AAED;;;GAGG;AACH,wBAAgB,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,CAUpG;AAED;;;;GAIG;AACH,uGAAuG;AACvG,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAQ5D;AAED,wGAAwG;AACxG,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAOjH;AAED,wBAAgB,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,aAAa,CAUrF;AAID;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASpF;AAID,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,aAAa,GAAG,MAAM,CAuB3D;AASD,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,KAAK,GAAG,SAAS,CAAC;AAErD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,SAAS,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC1D,YAAY,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9C,6FAA6F;IAC7F,gBAAgB,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC/D,iGAAiG;IACjG,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAcD,wBAAgB,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,WAAW,CA8BxF;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CAqBjD;AASD,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,CAAC;AACjD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,kFAAkF;AAClF,wBAAgB,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,EAAE,CAcjF;AAED,wFAAwF;AACxF,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,EAAE,CAahE;AAUD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,CA0B7D"}

package/dist/harness/journey.js

@@ -33,9 +33,14 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.CREATE_OBLIGATION = exports.signoffCommand = exports.SIGNOFF_OBLIGATION = void 0;
 exports.runJourney = runJourney;
+exports.assertWaivable = assertWaivable;
 exports.waive = waive;
+exports.assertCanSignOff = assertCanSignOff;
+exports.signoffSigner = signoffSigner;
 exports.signoff = signoff;
+exports.writeJourneyFileBestEffort = writeJourneyFileBestEffort;
 exports.renderJourneyBoard = renderJourneyBoard;
 exports.runGate = runGate;
 exports.renderGate = renderGate;
@@ -61,6 +66,14 @@ const path = __importStar(require("path"));
 const crypto = __importStar(require("crypto"));
 const unit_paths_1 = require("./unit-paths");
 const read_text_1 = require("./read-text");
+const migration_sentinel_1 = require("../basis/migration-sentinel");
+const legacy_waiver_migration_1 = require("../decisions/legacy-waiver-migration");
+const append_decision_1 = require("../decisions/append-decision");
+const decision_source_1 = require("../decisions/decision-source");
+const resolve_rule_1 = require("./gates/resolve-rule");
+const journey_gate_inputs_1 = require("./gates/journey-gate-inputs");
+const in_run_decision_check_1 = require("./gates/in-run-decision-check");
+const decision_file_1 = require("../decisions/decision-file");
 function readJSON(p) {
     try {
         return fs.existsSync(p) ? JSON.parse((0, read_text_1.readTextFile)(p)) : null;
@@ -96,9 +109,32 @@ function extractAnchor(text) {
     return { vpId: vp ? vp[0] : undefined, file: fl ? fl[1] : undefined, line: fl ? Number(fl[2]) : undefined };
 }
 const SAT = 0.8; // axis at/above this = satisfied (below = needs-work)
+/**
+ * OB-coverage IS the audit's viewpoint gate (#934): the registry maps it to `audit.viewpoint-coverage`,
+ * whose condition is "no critical theme missing or shallow" (audit-gate-terms.ts). The coverage
+ * percentage alone can read 83% with a critical theme missing, so a gap the rule blocks on keeps the
+ * obligation open and names the themes. An override the audit applied is credited later by
+ * applyAuditOverrides — journey never re-applies one, so the rule is resolved from the catalog here.
+ */
+function coverageObligation(coverage, audit) {
+    const id = 'OB-coverage';
+    const title = 'Viewpoint coverage';
+    const pct = coverage === undefined ? '' : `${Math.round(coverage * 100)}% (need ${Math.round(SAT * 100)}%) — `;
+    const gaps = Array.isArray(audit.gate?.gaps) ? audit.gate.gaps : [];
+    if (gaps.length && (0, resolve_rule_1.resolveRule)(journey_gate_inputs_1.OBLIGATION_RULE[id]).blocking) {
+        const themes = gaps.map((g) => `${String(g.theme)} (${g.status === 'shallow' ? 'shallow' : 'missing'})`).join(', ');
+        return { id, title, status: 'needs-work', detail: `${pct}critical theme(s) not covered: ${themes} — the audit's viewpoint gate fails on them` };
+    }
+    const status = coverage === undefined ? 'pending' : coverage >= SAT ? 'satisfied' : 'needs-work';
+    return { id, title, status, detail: `${pct}critical themes covered` };
+}
 function computeFresh(projectRoot, unit) {
     const slug = (0, unit_paths_1.reportSlug)(unit);
-    const audit = readJSON(path.join(projectRoot, '.sungen', 'reports', `${slug}-audit.json`));
+    // T3: the report is an output — read through the checks; stale or untrusted counts as never audited.
+    const read = (0, journey_gate_inputs_1.readJourneyAudit)(projectRoot, unit);
+    const notCountedReason = read.notCountedReason;
+    // The verifier checked the top-level keys and types; nested fields are read defensively below, as before.
+    const audit = read.audit;
     const phases = readLedgerPhases(path.join(projectRoot, '.sungen', 'ledger', `${slug}.jsonl`));
     const from = [];
     if (audit)
@@ -111,10 +147,11 @@ function computeFresh(projectRoot, unit) {
     const needsYou = [];
     if (!audit) {
         // Nothing measured yet — the journey hasn't really begun.
-        obligations.push({ id: 'OB-create', title: 'Generate test cases', status: 'pending', detail: 'No audit report yet — run /sungen:create-test.' });
+        obligations.push({ id: 'OB-create', title: 'Generate test cases', status: 'pending', detail: notCountedReason ?? 'No audit report yet — run /sungen:create-test.' });
         return {
-            unit, generatedFrom: from, youAreHere, phasesDone: phases, gateStatus: null, score: null,
-            obligations, needsYou, nextSuggested: 'Run `/sungen:create-test ' + unit + '` to begin.',
+            unit, generatedFrom: from, youAreHere, phasesDone: phases, gateStatus: null, score: null, obligations, needsYou,
+            nextSuggested: notCountedReason ?? 'Run `/sungen:create-test ' + unit + '` to begin.',
+            ...(notCountedReason ? { auditNotCounted: notCountedReason } : {}),
         };
     }
     const ax = (audit.calibration && audit.calibration.axes) || {};
@@ -125,7 +162,7 @@ function computeFresh(projectRoot, unit) {
         detail: val === undefined ? detail : `${Math.round(val * 100)}% (need ${Math.round(thr * 100)}%) — ${detail}`,
     });
     obligations.push(ob('OB-spec', 'Spec readiness', ax.specFR, 1, 'FR/sections sufficient to design from'));
-    obligations.push(ob('OB-coverage', 'Viewpoint coverage', ax.coverage, SAT, 'critical themes covered'));
+    obligations.push(coverageObligation(ax.coverage, audit));
     obligations.push(ob('OB-depth', 'Assertion depth', ax.businessDepth, depthThreshold, 'business-critical scenarios assert data'));
     obligations.push(ob('OB-trace', 'Traceability', ax.taxonomy ?? ax.traceability, SAT, 'scenarios trace to viewpoints'));
     // Automation obligation: automatable @manual still pending a driver = needs-work.
@@ -135,6 +172,8 @@ function computeFresh(projectRoot, unit) {
         status: autoPending ? 'needs-work' : 'satisfied',
         detail: autoPending ? `${audit.automatableManual.automatable} @manual scenario(s) a driver could automate` : 'no capability-pending automatable cases',
     });
+    // What the audit already applied — never re-applied here, and only while that override is in force.
+    const ignored = (0, journey_gate_inputs_1.applyAuditOverrides)(obligations, audit, (0, journey_gate_inputs_1.unitOverrides)(projectRoot, unit).inForce);
     // Needs-you: the review queue. Prefer PRECISE per-scenario anchors from audit's structured
     // depth data — each shallow business-critical scenario carries its own VP id — over regex-parsing
     // the aggregate "DEPTH:" finding string (which names no scenario, so points nowhere). Then
@@ -146,6 +185,8 @@ function computeFresh(projectRoot, unit) {
             anchor: extractAnchor(s.name),
         });
     }
+    for (const g of ignored)
+        needsYou.push({ text: (0, journey_gate_inputs_1.ignoredOverrideText)(g), anchor: {} });
     const haveStructuredDepth = shallowBC.length > 0;
     for (const f of (audit.findings || [])) {
         if (!isHumanFinding(f))
@@ -161,7 +202,7 @@ function computeFresh(projectRoot, unit) {
         detail: `${needsYou.length} item(s) queued for your review · ${manualCount} @manual scenario(s)`,
     });
     // Next suggested = first non-satisfied obligation; if all satisfied but run-test not done → run.
-    const firstGap = obligations.find((o) => o.status !== 'satisfied' && o.id !== 'OB-signoff');
+    const firstGap = obligations.find((o) => o.status !== 'satisfied' && o.status !== 'overridden' && o.id !== 'OB-signoff');
     let nextSuggested;
     if (firstGap)
         nextSuggested = `Repair "${firstGap.title}" (${firstGap.detail}).`;
@@ -188,9 +229,14 @@ function saveState(p, s) {
     fs.mkdirSync(path.dirname(p), { recursive: true });
     fs.writeFileSync(p, JSON.stringify(s, null, 2), 'utf-8');
 }
+/** An obligation that does not block: met, waived by a human, or overridden by the audit's gate-override. */
+const accepted = (s) => s === 'satisfied' || s === 'waived' || s === 'overridden';
 /** Recompute nextSuggested AFTER waivers are applied (a waived obligation is not a gap). */
 function computeNext(r, unit) {
-    const gap = r.obligations.find((o) => o.status !== 'satisfied' && o.status !== 'waived' && o.id !== 'OB-signoff');
+    const bad = r.decisionFindings?.[0];
+    if (bad)
+        return `Resolve ${r.decisionFindings.length} decision problem(s) first — ${bad.rule} on ${bad.path}.`;
+    const gap = r.obligations.find((o) => !accepted(o.status) && o.id !== 'OB-signoff');
     if (gap)
         return `Repair "${gap.title}" (${gap.detail}).`;
     if (!r.phasesDone.some((s) => s === 'run' || s.startsWith('run')))
@@ -203,17 +249,33 @@ function computeNext(r, unit) {
  *  - an active waiver (evidence unchanged) sets status='waived' (carries the reason);
  *  - a STALE waiver (audit changed since it was waived) is re-surfaced for re-decision (anti-amnesia).
  * Then persist the current evidence cursor.
+ * Waivers in force come from the decision layer; legacy waivers that match git HEAD are imported once,
+ * others are UNTRUSTED (not counted, listed for a human), and the result is dual-written back.
+ * A read-only checkout gets the same board without throwing.
  */
 function runJourney(projectRoot, unit) {
     const slug = (0, unit_paths_1.reportSlug)(unit);
+    (0, migration_sentinel_1.assertNoPendingMigration)(projectRoot, slug);
     const report = computeFresh(projectRoot, unit);
     const sp = statePath(projectRoot, slug);
     const state = loadState(sp) || { unit, auditHash: '', waivers: {} };
     const curHash = auditHashOf(projectRoot, slug);
+    const sync = (0, legacy_waiver_migration_1.planWaiverSync)(projectRoot, unit, slug, sp, state.waivers);
+    for (const u of sync.untrusted) {
+        const title = report.obligations.find((o) => o.id === u.obligation)?.title ?? u.obligation;
+        const ignored = unwaivableWhy(u.obligation, unit);
+        report.needsYou.unshift({ text: ignored ? ignoredWaiverText(u.obligation, ignored, u.waiver.reason) : (0, legacy_waiver_migration_1.untrustedWaiverText)(unit, slug, title, u), anchor: { vpId: u.obligation } });
+    }
     for (const ob of report.obligations) {
-        const w = state.waivers[ob.id];
+        const w = sync.waivers[ob.id];
         if (!w)
             continue;
+        // A waiver recorded before `--waive` refused this obligation never opens it (review W1).
+        const ignored = unwaivableWhy(ob.id, unit);
+        if (ignored) {
+            report.needsYou.unshift({ text: ignoredWaiverText(ob.id, ignored, w.reason), anchor: { vpId: ob.id } });
+            continue;
+        }
         if (w.auditHashAtWaive === curHash) {
             ob.status = 'waived';
             ob.waivedReason = w.reason;
@@ -229,16 +291,67 @@ function runJourney(projectRoot, unit) {
     if (signoffOb && state.signoff) {
         if (state.signoff.auditHashAtSignoff === curHash) {
             signoffOb.status = 'satisfied';
-            signoffOb.detail = `signed off${state.signoff.by ? ' by ' + state.signoff.by : ''} at ${state.signoff.at}`;
+            signoffOb.detail = `signed off${state.signoff.by ? ' by ' + state.signoff.by : ''}${state.signoff.recordedBy ? ` (recorded by ${state.signoff.recordedBy})` : ''} at ${state.signoff.at}`;
         }
         else {
             report.needsYou.unshift({ text: `⚠️ Sign-off is STALE (suite changed since ${state.signoff.at}) — re-review and sign off again.`, anchor: { vpId: 'OB-signoff' } });
         }
     }
+    // Phase-03 carry-over: a decision that does not verify is a FINDING the gate blocks on, not a crash.
+    const decisionFindings = (0, journey_gate_inputs_1.journeyDecisionFindings)(projectRoot, (0, journey_gate_inputs_1.unitOverrides)(projectRoot, unit));
+    const next = { unit, auditHash: curHash, waivers: sync.stateWaivers, signoff: state.signoff };
+    try {
+        (0, legacy_waiver_migration_1.commitWaiverSync)(projectRoot, unit, slug, sync, sp, JSON.stringify(next, null, 2));
+    }
+    catch (err) {
+        if (!(err instanceof append_decision_1.DecisionConflictError))
+            throw err;
+        const rel = path.relative(projectRoot, err.path).split(path.sep).join('/');
+        if (!decisionFindings.some((f) => f.path === rel))
+            decisionFindings.push({ rule: 'decision.mutated', path: rel, message: err.message });
+    }
+    if (decisionFindings.length) {
+        report.decisionFindings = decisionFindings;
+        for (const f of [...decisionFindings].reverse())
+            report.needsYou.unshift({ text: (0, journey_gate_inputs_1.decisionFindingText)(f), anchor: { file: f.path } });
+    }
     report.nextSuggested = computeNext(report, unit);
-    saveState(sp, { unit, auditHash: curHash, waivers: state.waivers, signoff: state.signoff });
     return report;
 }
+/** The single human gate (DOS §3.4, S5): given with `--signoff`, never waived (#936). */
+exports.SIGNOFF_OBLIGATION = 'OB-signoff';
+const signoffCommand = (unit) => `sungen journey --screen ${unit} --signoff --by "<name>"`;
+exports.signoffCommand = signoffCommand;
+/** "Never audited" (T3): a unit is measured by `sungen audit`, never waived through (review W2). */
+exports.CREATE_OBLIGATION = 'OB-create';
+/** Why a waiver can never accept `obId` (and what does instead), or null when it can. */
+function unwaivableWhy(obId, unit) {
+    if (obId === exports.SIGNOFF_OBLIGATION)
+        return `sign-off is given with --signoff, never waived (${(0, exports.signoffCommand)(unit)})`;
+    if (obId === exports.CREATE_OBLIGATION)
+        return `an unaudited unit cannot be waived through — re-run \`sungen audit --screen ${unit}\``;
+    return null;
+}
+/** The review-queue line for a recorded waiver the board does not honour. */
+const ignoredWaiverText = (obId, why, reason) => `⚠️ waiver on ${obId} ignored: ${why}. Was: ${reason}`;
+/**
+ * Throws unless `obId` is an obligation of the board that a waiver can accept. Refused in every state,
+ * each with what does it instead: OB-signoff (before any audit it is not on the board, after one a
+ * waiver would let the human gate be waived away) and OB-create (an unaudited unit would pass every
+ * gate on a waiver; the audit measures it).
+ */
+function assertWaivable(report, unit, obId) {
+    if (obId === exports.SIGNOFF_OBLIGATION) {
+        throw new Error(`${exports.SIGNOFF_OBLIGATION} is the human sign-off — it is given, not waived. Once every other obligation is satisfied or waived, a human runs: ${(0, exports.signoffCommand)(unit)}`);
+    }
+    if (obId === exports.CREATE_OBLIGATION) {
+        throw new Error(`${exports.CREATE_OBLIGATION} means the unit has no audit that counts — an unaudited unit cannot be waived through. Run: sungen audit --screen ${unit}`);
+    }
+    const valid = report.obligations.map((o) => o.id).filter((id) => id !== exports.SIGNOFF_OBLIGATION && id !== exports.CREATE_OBLIGATION);
+    if (!valid.includes(obId)) {
+        throw new Error(`Unknown obligation "${obId}". Valid: ${valid.join(', ') || `none — the unit has no audit that counts; run sungen audit --screen ${unit}`}`);
+    }
+}
 /**
  * Waive an obligation — REQUIRES a reason (anti-amnesia: a waiver leaves a recorded "why").
  * Records the current evidence cursor so reconcile can invalidate it if the audit changes.
@@ -248,36 +361,65 @@ function waive(projectRoot, unit, obId, reason) {
         throw new Error('A reason is required to waive (anti-amnesia: a waiver must record WHY). Use --reason "...".');
     }
     const slug = (0, unit_paths_1.reportSlug)(unit);
-    const fresh = computeFresh(projectRoot, unit);
-    const valid = fresh.obligations.map((o) => o.id);
-    if (!valid.includes(obId)) {
-        throw new Error(`Unknown obligation "${obId}". Valid: ${valid.join(', ')}`);
-    }
-    const sp = statePath(projectRoot, slug);
-    const state = loadState(sp) || { unit, auditHash: '', waivers: {} };
-    state.waivers[obId] = { reason: reason.trim(), at: new Date().toISOString(), auditHashAtWaive: auditHashOf(projectRoot, slug) };
-    saveState(sp, state);
-    return runJourney(projectRoot, unit);
+    const fresh = runJourney(projectRoot, unit); // stops on a pending migration; imports legacy waivers first
+    assertWaivable(fresh, unit, obId);
+    const given = { reason: reason.trim(), at: new Date().toISOString(), auditHashAtWaive: auditHashOf(projectRoot, slug) };
+    (0, legacy_waiver_migration_1.recordWaiver)(projectRoot, unit, obId, given); // DOS-13.5: the decision layer is the record …
+    return runJourney(projectRoot, unit); // … and runJourney dual-writes it to the legacy file
 }
 /**
  * Sign off — the single human gate (S5). Allowed ONLY when every other deliver-required
  * obligation is satisfied or waived (you cannot sign off an unclean suite). Records who/when +
  * the evidence cursor; reconcile invalidates it (stale → re-review) if the suite later changes.
  */
-function signoff(projectRoot, unit, by) {
-    const before = runJourney(projectRoot, unit);
-    const blockers = before.obligations.filter((o) => o.id !== 'OB-signoff' && o.status !== 'satisfied' && o.status !== 'waived');
+/** Throws unless the board may be signed off: no decision problem, every other obligation accepted. */
+function assertCanSignOff(before) {
+    const blockers = before.obligations.filter((o) => o.id !== 'OB-signoff' && !accepted(o.status));
+    if (before.decisionFindings?.length) {
+        throw new Error(`Cannot sign off — ${before.decisionFindings.length} decision problem(s): ${before.decisionFindings.map((f) => `${f.rule} ${f.path}`).join(', ')}.`);
+    }
     if (blockers.length) {
         throw new Error(`Cannot sign off — still open: ${blockers.map((b) => b.id).join(', ')}. Fix, or waive each with a reason, first.`);
     }
+}
+/** Who signs off: `--by`, else the git user; throws when neither names anyone (never `by: unknown`). */
+function signoffSigner(projectRoot, unit, by) {
+    const gitUser = (0, decision_source_1.gitUserName)(projectRoot);
+    const signer = by?.trim() || gitUser;
+    if (signer === 'unknown') {
+        throw new Error(`Cannot sign off — no git user.name is set and no --by was given, so the sign-off would name nobody. Say who signs: ${(0, exports.signoffCommand)(unit)}`);
+    }
+    return { signer, gitUser };
+}
+function signoff(projectRoot, unit, by) {
+    // Attribution is not self-declared (review item 4): the git user is always on the record.
+    const { signer, gitUser } = signoffSigner(projectRoot, unit, by);
+    assertCanSignOff(runJourney(projectRoot, unit));
     const slug = (0, unit_paths_1.reportSlug)(unit);
     const sp = statePath(projectRoot, slug);
     const state = loadState(sp) || { unit, auditHash: '', waivers: {} };
-    state.signoff = { by, at: new Date().toISOString(), auditHashAtSignoff: auditHashOf(projectRoot, slug) };
+    state.signoff = { by: signer, ...(signer !== gitUser ? { recordedBy: gitUser } : {}), at: new Date().toISOString(), auditHashAtSignoff: auditHashOf(projectRoot, slug) };
     saveState(sp, state);
     return runJourney(projectRoot, unit);
 }
-const ICON = { satisfied: '✅', 'needs-work': '⚠️ ', pending: '⏳', waived: '🚫' };
+const UNWRITABLE = new Set(['EACCES', 'EROFS', 'ENOSPC', 'EPERM']);
+/**
+ * Write a DERIVED journey file (board, report, roll-up). Best-effort by contract (DOS-13.3): a read-only
+ * or full checkout still shows the board — the file is skipped and null returned; any other error throws.
+ */
+function writeJourneyFileBestEffort(file, text) {
+    try {
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, text, 'utf-8');
+        return file;
+    }
+    catch (err) {
+        if (UNWRITABLE.has(err?.code ?? ''))
+            return null;
+        throw err;
+    }
+}
+const ICON = { satisfied: '✅', 'needs-work': '⚠️ ', pending: '⏳', waived: '🚫', overridden: '🔓' };
 function renderJourneyBoard(r) {
     const L = [];
     L.push(`# Journey — ${r.unit}`);
@@ -314,25 +456,57 @@ const PHASE_REQUIRED = {
     // pre-delivery: everything automated PLUS the single human sign-off (S5).
     deliver: ['OB-spec', 'OB-coverage', 'OB-depth', 'OB-trace', 'OB-automation', 'OB-signoff'],
 };
+/** The catalog rule each phase boundary halts by (OES-11.2): soft, so a reasoned override may lower it. */
+const PHASE_RULE = { create: 'journey.phase-create', run: 'journey.phase-run', deliver: 'journey.phase-deliver' };
 function runGate(projectRoot, unit, phase) {
     const r = runJourney(projectRoot, unit);
     const required = PHASE_REQUIRED[phase];
-    const reqObs = r.obligations.filter((o) => required.includes(o.id));
-    const blockers = reqObs
-        .filter((o) => o.status !== 'satisfied' && o.status !== 'waived')
-        .map((o) => ({ id: o.id, title: o.title, detail: o.detail }));
+    // T3: a unit never audited (or whose report does not count) is never clean — OB-create blocks every phase.
+    const reqObs = r.obligations.filter((o) => required.includes(o.id) || o.id === 'OB-create');
+    const asBlocker = (o) => ({ id: o.id, title: o.title, detail: o.detail });
+    // Never audited is not something a lowered phase rule may wave through (review M4).
+    const neverAudited = reqObs.filter((o) => o.id === 'OB-create' && !accepted(o.status)).map(asBlocker);
+    const open = reqObs.filter((o) => o.id !== 'OB-create' && !accepted(o.status)).map(asBlocker);
+    const overrides = (0, journey_gate_inputs_1.unitOverrides)(projectRoot, unit);
+    // Decision problems are hard rules: no phase override lowers them. At the release boundary an
+    // override, waiver or approval git HEAD does not hold is refused too (decision.in-run, review H1).
+    const scopes = [decision_file_1.PROJECT_SCOPE, ...(overrides.unitScope ? [overrides.unitScope] : [])];
+    const hard = [
+        ...(r.decisionFindings ?? []).filter((f) => (0, resolve_rule_1.resolveRule)(f.rule).blocking)
+            .map((f) => ({ id: f.rule, title: 'Decision integrity', detail: `${f.path} — ${f.message}` })),
+        ...(phase === 'deliver' && (0, resolve_rule_1.resolveRule)(in_run_decision_check_1.IN_RUN_RULE).blocking ? (0, in_run_decision_check_1.uncommittedReleaseDecisions)(projectRoot, scopes) : [])
+            .map((d) => ({ id: in_run_decision_check_1.IN_RUN_RULE, title: 'Decision not reviewed', detail: `${d.kind} ${d.id} (${d.path}) — ${d.why.join('; ')}` })),
+        ...neverAudited,
+    ];
+    const phaseRule = (0, resolve_rule_1.resolveRule)(PHASE_RULE[phase], overrides.context);
+    const blockers = [...hard, ...open];
+    const halt = hard.length > 0 || (open.length > 0 && phaseRule.blocking);
     const waivedCredit = reqObs.filter((o) => o.status === 'waived').map((o) => ({ id: o.id, title: o.title }));
-    return { unit, phase, status: blockers.length ? 'halt' : 'pass', required, blockers, waivedCredit };
+    const overriddenCredit = reqObs.filter((o) => o.status === 'overridden').map((o) => ({ id: o.id, title: o.title, by: o.overriddenBy ?? '' }));
+    return {
+        unit, phase, status: halt ? 'halt' : 'pass', required, blockers, waivedCredit,
+        ...(overriddenCredit.length ? { overriddenCredit } : {}),
+        ...(open.length && phaseRule.overriddenBy ? { phaseOverriddenBy: phaseRule.overriddenBy } : {}),
+    };
 }
 function renderGate(v) {
     const L = [];
     L.push('');
     L.push(`━━━ Gate: ${v.unit} @ phase "${v.phase}" → ${v.status === 'pass' ? '✅ PASS' : '⛔ HALT'} ━━━`);
+    if (v.phaseOverriddenBy)
+        L.push(`  Phase rule lowered by ${v.phaseOverriddenBy}: open obligations are advisory (decision problems still block).`);
     if (v.blockers.length) {
-        L.push('  Blocking obligations (must be satisfied or explicitly waived):');
+        L.push(v.phaseOverriddenBy ? '  Open obligations:' : '  Blocking obligations (must be satisfied or explicitly waived):');
         for (const b of v.blockers)
             L.push(`   • ${b.id} ${b.title} — ${b.detail}`);
-        L.push('  → Self-correct (repair / run-test), or `sungen journey --screen ' + v.unit + ' --waive <OB> --reason "..."` if accepted.');
+        // Name what each kind of blocker takes (#936): never offer to waive the sign-off or "never audited".
+        const waivable = v.blockers.map((b) => b.id).filter((id) => id.startsWith('OB-') && id !== exports.SIGNOFF_OBLIGATION && id !== 'OB-create');
+        if (waivable.length) {
+            L.push(`  → Self-correct (repair / run-test), or, if accepted, waive with a reason: \`sungen journey --screen ${v.unit} --waive ${waivable.length === 1 ? waivable[0] : `<${waivable.join('|')}>`} --reason "..."\`.`);
+        }
+        if (v.blockers.some((b) => b.id === exports.SIGNOFF_OBLIGATION)) {
+            L.push(`  → Human sign-off: once everything else is satisfied or waived, a human runs \`${(0, exports.signoffCommand)(v.unit)}\`.`);
+        }
     }
     else {
         L.push('  All required obligations satisfied' + (v.waivedCredit.length ? ` (${v.waivedCredit.length} accepted via waiver)` : '') + '.');
@@ -363,7 +537,7 @@ function rollupJourney(projectRoot) {
     return listUnits(projectRoot).map(({ unit, kind }) => {
         const r = runJourney(projectRoot, unit);
         const signedOff = r.obligations.find((o) => o.id === 'OB-signoff')?.status === 'satisfied';
-        const obligationsOpen = r.obligations.filter((o) => o.id !== 'OB-signoff' && o.status !== 'satisfied' && o.status !== 'waived').length;
+        const obligationsOpen = r.obligations.filter((o) => o.id !== 'OB-signoff' && !accepted(o.status)).length;
         return {
             unit, kind, score: r.score, gateStatus: r.gateStatus, youAreHere: r.youAreHere,
             obligationsOpen, reviewQueue: r.needsYou.length, signedOff,