clearotron 0.3.2 → 0.3.3-beta.1

package/driver/envelope-settle.mjs

@@ -36,6 +36,7 @@
 
 import { existsSync, readFileSync, writeFileSync, renameSync } from "node:fs";
 import { isCapabilityGapReason } from "./coverage-ledger.mjs";
+import { fullyDeferredAxes } from "./register-plan.mjs";
 
 export const SETTLE_SCHEMA_VERSION = 1;
 
@@ -52,22 +53,28 @@ export const SETTLE_SCHEMA_VERSION = 1;
  *   receipt is final. So `suspect` catches a MIS-STAMPED deferral — an executor bug flagging a transient as
  *   deterministic — and exists so that shape gets one attempt instead of silently becoming permanent.
  *
- * PURE.
+ * STICKY — a qid this run has already accepted as a capability gap, under any plan version, is accepted
+ * again whatever its current reason text says (stickyGaps below). PURE.
  */
-export function partitionReceiptDeferrals(plan, receipt) {
+export function partitionReceiptDeferrals(plan, receipt, { sticky = new Set() } = {}) {
   const axisOf = new Map((plan?.entries ?? []).map((e) => [String(e?.qid ?? ""), String(e?.axis ?? "").toLowerCase()]));
   // An axis the frozen plan says is deferred end to end is accepted whatever its per-qid reason text says:
   // there is no slice of it left for a dispatch to reach.
-  const fullyDeferred = new Set((receipt?.skeleton ?? [])
-    .filter((s) => s?.state === "deferred")
-    .map((s) => String(s?.axis ?? "").toLowerCase()));
+  //
+  // THE PLAN SAYS SO, NOT THE COVERAGE SKELETON. This read the skeleton's `deferred` state, which
+  // deriveCoverageSkeleton sets for an axis carrying ANY deferred qid and nothing missing, and at the
+  // fan-in nothing is missing. So every deferral on every axis was accepted: a provider hard error was
+  // logged "ACCEPTED as provider capability gaps … never retried", skipped the one bounded attempt the
+  // hard-error path is designed to get, and was then re-opened by the envelope, which reads the reason.
+  // fullyDeferredAxes asks the plan: every entry on the axis `unsupported`.
+  const fullyDeferred = new Set(fullyDeferredAxes(plan).map((a) => String(a.axis ?? "").toLowerCase()));
   const accepted = [], suspect = [];
   for (const d of receipt?.deferred ?? []) {
     const qid = String(d?.qid ?? "");
     const axis = axisOf.get(qid) ?? "";
     const reason = String(d?.reason ?? "");
     const row = { qid, axis, reason };
-    (isCapabilityGapReason(reason) || fullyDeferred.has(axis) ? accepted : suspect).push(row);
+    (isCapabilityGapReason(reason) || fullyDeferred.has(axis) || sticky.has(qid) ? accepted : suspect).push(row);
   }
   return { accepted, suspect };
 }
@@ -129,7 +136,7 @@ const shallowRow = (d) => ({ qid: String(d?.qid ?? ""), reason: String(d?.reason
  * the one case the file exists to make durable. `supersede()` builds the entry; it is deliberately a
  * summary rather than a full copy, because the qid-level truth is always re-derivable from the receipt.
  */
-export function buildDecisionDoc({ planVersion, deferredTotal, accepted, closed, closeFailed, decidedAt, history = [] }) {
+export function buildDecisionDoc({ planVersion, deferredTotal, accepted, closed, closeFailed, decidedAt, history = [], stickyGaps = [], settleTried = [] }) {
   return {
     schema_version: SETTLE_SCHEMA_VERSION,
     plan_version: planVersion ?? null,
@@ -138,10 +145,60 @@ export function buildDecisionDoc({ planVersion, deferredTotal, accepted, closed,
     accepted: accepted ?? [],
     closed: closed ?? [],
     close_failed: closeFailed ?? [],
+    sticky_gaps: stickyGaps ?? [],
+    settle_tried: settleTried ?? [],
     history: history ?? [],
   };
 }
 
+// ── A CAPABILITY GAP IS DECIDED ONCE PER RUN, NOT ONCE PER PLAN VERSION ────────────────────────────────
+//
+// The live `accepted[]` is rebuilt from the current receipt on every settle, and a settle happens again
+// whenever the plan version moves — every supplemental fold bumps it. So an acceptance lasted exactly as
+// long as the version it was made under. On a production run on 2026-09-22 one slice the provider refused
+// was accepted ("never retried"), re-opened, re-proposed, re-executed and accepted again, several times
+// in one run, each pass paying the provider for an answer that could not change.
+//
+// `sticky_gaps` is the run's memory of them: every qid accepted with a reason that states a capability gap
+// (isCapabilityGapReason), with the reason and the plan version it was first accepted under. It is carried
+// forward on every settle and never dropped: not when the plan version moves, not when the receipt stops
+// listing the qid. Only a REASON-MATCHED gap enters it. An axis-level acceptance (the skeleton branch in
+// partitionReceiptDeferrals) and every suspect or close_failed row stay out, so a deferral a later attempt
+// could close keeps today's behaviour.
+export function stickyGapsAfter(prior, accepted, planVersion) {
+  const out = new Map((prior?.sticky_gaps ?? []).map((g) => [String(g?.qid ?? ""), g]));
+  for (const a of accepted ?? []) {
+    const qid = String(a?.qid ?? "");
+    if (!qid || out.has(qid) || !isCapabilityGapReason(a?.reason)) continue;
+    out.set(qid, { qid, axis: String(a?.axis ?? ""), reason: String(a?.reason ?? "").slice(0, 400), since_plan_version: planVersion ?? null });
+  }
+  out.delete("");
+  return [...out.values()];
+}
+
+// ── A SUSPECT DEFERRAL GETS ITS ONE ATTEMPT ONCE PER RUN ─────────────────────────────────────────────
+//
+// The settle step spends one executor attempt on a suspect deferral: a hard error the run could not
+// classify as permanent, on the chance the provider has recovered. Every supplemental fold bumps the plan
+// version and re-settles, and the repair ledger's budget is keyed on the plan version, so "one attempt"
+// was one per plan version. `settle_tried` records each qid the settle step has sent, carried forward like
+// `sticky_gaps`; a suspect already in it is recorded close_failed without another call.
+export function settleTriedAfter(prior, dispatched, planVersion) {
+  const out = new Map((prior?.settle_tried ?? []).map((t) => [String(t?.qid ?? ""), t]));
+  for (const d of dispatched ?? []) {
+    const qid = String(d?.qid ?? "");
+    if (!qid || out.has(qid)) continue;
+    out.set(qid, { qid, axis: String(d?.axis ?? ""), plan_version: planVersion ?? null, outcome: String(d?.outcome ?? "").slice(0, 160) });
+  }
+  out.delete("");
+  return [...out.values()];
+}
+
+/** The run's sticky capability gaps, by qid → row. Absent or unreadable decision ⇒ none. */
+export function readStickyGaps(P) {
+  return new Map((readEnvelopeDecision(P)?.sticky_gaps ?? []).map((g) => [String(g?.qid ?? ""), g]).filter(([q]) => q));
+}
+
 /** One history entry per superseded decision. Returns the prior history with the old decision appended. */
 export function supersede(prior, source) {
   if (!prior) return [];
@@ -167,30 +224,42 @@ export function supersede(prior, source) {
  */
 export async function settleReceipt({ P, plan, receipt, dispatch = null, rejoin = null, now = null }) {
   const deferred = receipt?.deferred ?? [];
-  let { accepted, suspect } = partitionReceiptDeferrals(plan, receipt);
+  const prior = readEnvelopeDecision(P);
+  const sticky = new Set((prior?.sticky_gaps ?? []).map((g) => String(g?.qid ?? "")));
+  let { accepted, suspect } = partitionReceiptDeferrals(plan, receipt, { sticky });
   const closed = [], closeFailed = [];
+  const tried = new Map((prior?.settle_tried ?? []).map((t) => [String(t?.qid ?? ""), t]));
+  for (const s of suspect.filter((x) => tried.has(x.qid)))
+    closeFailed.push({ qid: s.qid, axis: s.axis, outcome: `already tried once this run (${String(tried.get(s.qid)?.outcome ?? "").slice(0, 100)}) — not sent again` });
+  suspect = suspect.filter((x) => !tried.has(x.qid));
+  const dispatched = [];
   if (suspect.length && dispatch && rejoin) {
     const byAxis = new Map();
     for (const s of suspect) { if (!byAxis.has(s.axis)) byAxis.set(s.axis, []); byAxis.get(s.axis).push(s.qid); }
     for (const [axis, qids] of byAxis) { if (axis) await dispatch(axis, qids); }
     const after = await rejoin();
     const stillDeferred = new Map((after?.deferred ?? []).map((d) => [String(d.qid), String(d.reason ?? "")]));
-    const re = partitionReceiptDeferrals(plan, after);
+    const re = partitionReceiptDeferrals(plan, after, { sticky });
     accepted = re.accepted;
     for (const s of suspect) {
-      if (!stillDeferred.has(s.qid)) closed.push({ qid: s.qid, axis: s.axis, outcome: "ok" });
-      else if (!re.accepted.some((a) => a.qid === s.qid))
-        closeFailed.push({ qid: s.qid, axis: s.axis, outcome: `still deferred: ${stillDeferred.get(s.qid).slice(0, 140)}` });
+      // Only a qid that was actually sent (dispatch skips one with no axis) counts as tried.
+      if (!stillDeferred.has(s.qid)) { closed.push({ qid: s.qid, axis: s.axis, outcome: "ok" }); if (s.axis) dispatched.push({ ...s, outcome: "ok" }); }
+      else if (!re.accepted.some((a) => a.qid === s.qid)) {
+        const outcome = `still deferred: ${stillDeferred.get(s.qid).slice(0, 140)}`;
+        closeFailed.push({ qid: s.qid, axis: s.axis, outcome });
+        if (s.axis) dispatched.push({ ...s, outcome });
+      }
     }
   } else if (suspect.length) {
     for (const s of suspect) closeFailed.push({ qid: s.qid, axis: s.axis, outcome: "no executor lane at this seam" });
   }
-  const prior = readEnvelopeDecision(P);
   return writeEnvelopeDecision(P, buildDecisionDoc({
     planVersion: receipt?.plan_version, deferredTotal: deferred.length,
     accepted: accepted.map((a) => ({ ...a, decision: "accepted-capability-gap" })),
     closed, closeFailed, decidedAt: now ?? new Date().toISOString(),
     history: supersede(prior, prior ? "re-settled" : null),
+    stickyGaps: stickyGapsAfter(prior, accepted, receipt?.plan_version),
+    settleTried: settleTriedAfter(prior, dispatched, receipt?.plan_version),
   }));
 }
 

package/driver/findings-model.mjs

@@ -335,14 +335,14 @@ export function isUnconditionalProceed(rec) {
 
 /**
  * Deterministically BIND a recommendation line to the verdict: on a CONDITIONAL verdict an
- * unconditional "proceed" is rewritten to carry the conditions; on BLOCKING any recommendation is
- * replaced (a BLOCKING run does not reach delivery post- — belt-and-braces for legacy paths).
+ * unconditional "proceed" is rewritten to carry the conditions. BLOCKING is the reviewer's sign-off on
+ * the draft, not a hold: a BLOCKING run delivers, so its recommendation stands as the report wrote it.
  * Code derives the bound from the model's OWN verdict + reasons; it never invents a verdict. PURE.
  */
 export function bindRecommendation(rec, verdict, reasons = [], { maxReasons, maxLen } = {}) {
   const r = String(rec ?? "").trim();
   const v = String(verdict || "").toUpperCase();
-  if (v === "BLOCKING") return "On hold — the reviewing lawyer's open questions must be resolved before any recommendation.";
+  // BLOCKING returns the recommendation as written: nothing holds delivery on it, so "on hold" was untrue (ruled 2026-09-22).
   if (v !== "CONDITIONAL" || !r || !isUnconditionalProceed(r)) return r;
   const conds = (reasons ?? []).filter(Boolean);
   if (!conds.length) return r;
@@ -600,7 +600,7 @@ export function riskStatement({ tier, verdict, reasons, basis, clauses } = {}) {
   // CLEAR, so long as it is clear on register findings ALONE).
   const registerOnly = basis === "register-only";
   const basisNote = registerOnly ? " Register findings only — no common-law or marketplace search was run." : "";
-  if (v === "BLOCKING") return `On hold — the reviewing lawyer's open questions must be resolved before any recommendation.${basisNote}`;
+  if (v === "BLOCKING") return `${t}${basisNote ? `.${basisNote}` : ""}`;   // the reviewer's sign-off is not the clearance's answer and nothing is held on it: the band stands alone, as below
   if (v === "CONDITIONAL") {
     // A clause stored as explicit null is a condition ruled to the run record alone: it is not the lede,
     // it is not counted, and its reason is never the fallback text. `undefined` (legacy/short) is not null.

package/driver/gateway.mjs

@@ -225,6 +225,8 @@ export function toolWrittenArtifact(p) {
     ?? null;
 }
 import { buildGatherMcpConfig, allowedToolsFor, toolGroupsForStage, recordAxisFor, seatWritesForGroups } from "./engine/mcp/gather-config.mjs";
+import { everyToolCallRefused } from "./engine/tool-refusal.mjs";   // one definition, shared with the engine probe
+export { everyToolCallRefused };
 // The profiles STORE root, for the write boundary only — read from the module that owns it, never
 // re-derived from CLEAROTRON_CUSTOMERS_DIR here. Acyclic: profiles.mjs imports node builtins + config.
 import { unitRefusalsFor } from "./register-unit-record.mjs";
@@ -1528,6 +1530,11 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     // appear: a postponed run resumes on its own, and a signed-out one cannot. The sentence rides after
     // the colon, as `model_mismatch:` carries its detail, so no run-level classifier needs a new token.
     else if (turn.signals?.signedOut && fail) fail = `engine_signed_out: ${turn.signals.signedOut}`;
+    // AND ONE WHOSE TOOLS WERE ALL REFUSED IS NAMED, not left as the missing file the refusal caused. The
+    // turn reported success and the stage failed for want of what its tools would have produced; a
+    // `missing_file` reads as a model that did not write, and sends the reader to the wrong place. The
+    // sentence says what fixes this host. After the sign-in, which is the more basic fault when both appear.
+    else if (turn.signals?.toolsRefused && fail) fail = `engine_tools_refused: ${turn.signals.toolsRefused}`;
     // A6 (addendum 2026-07-30): stop_reason max_tokens with ZERO usable output is a DETECTED FAULT with a
     // name — never a silent paid retry. The turn ran to its output-token ceiling and the artifact never
     // landed (a content fail on a "successful" turn), or the turn itself died at the ceiling (transport
@@ -2027,6 +2034,15 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
       note(`[${name}] the engine's sign-in could not be refreshed — breaking the ladder (a retry re-sends the same credential)`);
       break;
     }
+    // EVERY TOOL CALL THE TURN MADE WAS REFUSED. On some hosts codex's own sandbox refuses the stage's
+    // tool servers while the turn reports success, and the stage then fails for want of what the tools
+    // would have produced. The next attempt spawns the same sandbox and is refused the same way, so a
+    // retry re-buys the refusal: measured at three paid attempts per stage on a production run before the
+    // identical-failure break stopped it. Break on the first. A turn where any call completed is not this.
+    if (everyToolCallRefused(turn)) {
+      note(`[${name}] every tool call this turn made was refused (${turn.mcpToolCallsRefused}) — breaking the ladder (a retry is refused the same way)`);
+      break;
+    }
     // D3: overload (529 / status_overloaded) — stop the ladder here: an in-ladder re-attempt hammers an
     // API that just said it is overloaded, seconds apart, on the SAME model. Breaking hands the failure
     // to the existing machinery: the chain cascades models (FALLBACK_ELIGIBLE) and an exhausted chain
@@ -2816,7 +2832,7 @@ export function correctionHint(lastFail, { gridLedgerName = "common-law-grid.jso
       `The driver computed every obligation and every identifier in it — the coverage unit, the query id, the hit ` +
       `count, the unaccounted classes and terms, each deferred slice's own receipt reason. Record the named row(s) ` +
       `through the \`record_coverage\` tool — {"row_id","status","reason"} per row, never by writing or editing any ` +
-      `file: "status" EXACTLY one bare token of confirmed-clean / coverage-limited / deferred, "reason" the sentence ` +
+      `file: "status" EXACTLY one bare token of confirmed-clean / coverage-limited / deferred / withheld-by-judgment, "reason" the sentence ` +
       `the lawyer reads (qualifiers go in the reason, never in the status). ` +
       `A row marked "open" cannot be confirmed-clean, and its own "open_because" says which of the two kinds ` +
       `it is. A NEVER-SEARCHED slice — the active register provider cannot express it, so nothing can make it run — is ` +
@@ -2983,7 +2999,7 @@ export function correctionHint(lastFail, { gridLedgerName = "common-law-grid.jso
     // run the driver stamped as form-required, and the stamp is conditional. On an unstamped run
     // validators.registerFindings demands the table exactly as it did before and emits this label,
     // so dropping the arm left the one lane that can still fire it with a generic hint.
-    hint = "the file has a findings heading plus a Coverage ledger with a status row (confirmed-clean / coverage-limited / deferred)";
+    hint = "the file has a findings heading plus a Coverage ledger with a status row (confirmed-clean / coverage-limited / deferred)" + (/common-law-findings/.test(lastFail) ? ", or each ledger row's status is recorded by calling `record_coverage_status` with `grid_spec_path`, the same spec path the grid tool was given" : "");
   } else if (/negative-results|coverage-ledger|audit-trail|findings-heading/.test(lastFail)) {
     hint = "the findings file carries ALL required sections: a findings heading, the Negative results matrix " +
       "(every variant × platform row), the Coverage ledger with a status row, and the Audit trail call log";

package/driver/manager-groups-verdict.mjs

@@ -47,7 +47,7 @@ export function managerGroupsVerdict({ idGroups, managerGroups, user, uid, why =
   // was not established", and saying so is the whole point — the deployment that HAD this fault also
   // had a check that reported nothing wrong.
   if (!Array.isArray(idGroups) || !idGroups.length) {
-    return { state: "skip", message: `could not read the groups of ${user}${why ? ` — ${why}` : ""}. Not checked, not passed.` };
+    return { state: "skip", blocked: true, message: `could not read the groups of ${user}${why ? ` — ${why}` : ""}. Not checked, not passed.` };
   }
   if (!Array.isArray(managerGroups)) {
     return { state: "skip", message: `no readable systemd --user manager for ${user}${why ? ` — ${why}` : ""}. `

package/driver/matter-frame-record.mjs

@@ -195,22 +195,39 @@ export const refuseUndeclared = (params) => refuseUndeclaredShared(params, DECLA
  * The Nice classes the frame judged necessary beyond the instructed ones, as strings. IMPURE (reads
  * the run's own accepted call).
  *
- * THE PLAN COMPILE UNIONS THIS WITH THE INSTRUCTED CLASSES so every variant axis carries both. Before
- * it existed the axes carried the instructed classes alone and a class the frame had identified reached
- * the sweep only if something proposed it as supplemental work — where it competed for capped slots
- * with model-minted extras. A cap was deciding coverage the frame had already judged necessary, and on
- * the run this came from the delivered report said two such classes were "covered for the name and open
- * for its variants" while the reviewing lawyer's scope included one of them throughout.
+ * THE PLAN COMPILE DOES NOT READ THIS. It takes `frameIdentifiedClassRows` below, where each added
+ * class keeps its reason and costs one identical-mark question rather than riding every entry (decision
+ * 18). The one caller left is the house-element check, which unions this list with the instructed
+ * classes because the client's own filings are best looked for across the widest class set.
  *
  * EMPTY IS THE ORDINARY ANSWER and must stay cheap: no frame yet, a legacy or replayed run whose
  * accepted call predates the field, a frame that identified nothing — all of them return `[]`, the
- * union is a no-op, and the plan is exactly what it was.
+ * union is a no-op, and the check looks in the instructed classes alone.
  */
 export function frameIdentifiedClasses(runDir) {
   const rows = lastAcceptedMatterFrame(runDir)?.identified_classes;
   return (Array.isArray(rows) ? rows : []).map((r) => String(r?.class ?? "").trim()).filter(Boolean);
 }
 
+/**
+ * The same rows WITH THEIR REASONS, for the register plan (decision 18). IMPURE, like its sibling.
+ *
+ * The reason is why the class is here and it is half the row: the bound on this widening is that a
+ * class is added only for goods the CLIENT'S OWN business plainly reaches, and a class carrying no
+ * stated reason cannot be checked against that by anyone. The plan compiler drops such a row rather
+ * than searching it, so the reason is load-bearing and not documentation.
+ *
+ * Kept beside `frameIdentifiedClasses` rather than replacing it: the other caller verifies a proposed
+ * house element against an owner-scoped lookup, where the widest class set is the right one to look in
+ * and a reason would mean nothing.
+ */
+export function frameIdentifiedClassRows(runDir) {
+  const rows = lastAcceptedMatterFrame(runDir)?.identified_classes;
+  return (Array.isArray(rows) ? rows : [])
+    .map((r) => ({ class: String(r?.class ?? "").trim(), reason: String(r?.reason ?? "").trim() }))
+    .filter((r) => r.class);
+}
+
 /**
  * The forms of the name this run's client ratified, as strings. IMPURE (reads the run's own accepted
  * call). Empty or one form is the ordinary answer.

package/driver/named-band.mjs

@@ -137,7 +137,7 @@ export function parseNamedBand(raw) {
         // byte-identical to a slice the plan deliberately counted without fetching. Measured on a real
         // run: four capability-gap blocks carried `error:true, deferred:true` into this function and
         // reached record-carry.json with both fields gone and a sentence claiming the run "has a hit
-        // COUNT for this slice". register-plan.mjs:1835 validatePlanFeasibility already enforces the same rule one layer up
+        // COUNT for this slice". register-plan.mjs validatePlanFeasibility already enforces the same rule one layer up
         // ("a transient must not ship indistinguishable from a sanctioned descriptor") — it reads the
         // RAW blocks, which is why it could. Every consumer that reads THIS projection could not.
         // Conditional like the four keys above, so old bands carry neither key and nothing shifts.

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.3.2",
+  "version": "0.3.3-beta.1",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/partial-payload-baseline.json

@@ -27,6 +27,14 @@
       "tool": "record_dispositions",
       "why": "no fixture yet; accumulating semantics claimed in the tool description ('Everything already recorded is kept') and not yet planted"
     },
+    {
+      "tool": "record_coverage_status",
+      "why": "both declared fields are required, so a call has no top-level key to omit; its accumulation by unit (a later call keeps the units it omits) is pinned in a-common-law-coverage-status-is-read-as-data.test.mjs"
+    },
+    {
+      "tool": "record_withheld_families",
+      "why": "its one declared field is required, so a call has no top-level key to omit; its accumulation by qid (a later call keeps the families it omits) is pinned in every-waiting-family-is-asked-or-withheld.test.mjs"
+    },
     {
       "tool": "record_unit_note",
       "why": "no fixture yet; every field optional, which is the exposed shape — this row is the highest-priority one to close"
@@ -61,11 +69,12 @@
     {
       "tool": "record_clearance_variants",
       "fields": [
+        "goods_words",
         "incumbent_classes",
-        "watchlist_owners",
-        "search_floor"
+        "search_floor",
+        "watchlist_owners"
       ],
-      "why": "a partial silently empties the register-axis search floor, narrowing the run's own definition of coverage"
+      "why": "a partial silently empties the register-axis search floor, narrowing the run's own definition of coverage. `goods_words` joins them for the same reason and one worse: an emptied goods list reads as \"this matter named no goods\" rather than as a partial call, so the crowded sweep it exists to narrow goes back to returning more filings than anyone can read, and nothing says why. The MERGE preserves all four (mergeClearanceVariantsCall, keep-if-absent) — these rows record that the ACCEPTOR alone does not."
     },
     {
       "tool": "record_blind_frame",

package/driver/pipeline-knockout.mjs

@@ -639,7 +639,7 @@ export async function knockoutInner(ctx, job, opts = {}) {
       // for reconcile-runs' exact liveness test. The stepper and the identity are separate calls now.
       ...identitySeed(),
       stepIndex: 0, stepLabel: STEPS[0], stepN: 1, stepTotal: STEPS.length,
-      verdict: null, url: null, failedStage: null, reason: null, deliveredAt: null,
+      review: null, url: null, failedStage: null, reason: null, deliveredAt: null,
       // A5/A3: a re-run of a previously-terminal knockout may reopen the state ONLY because the resume
       // guard cleared the sentinel (ctx.stateReset threads that authority); startedAt is no longer
       // seeded anywhere — writeRunStatus backfills it first-write-wins.
@@ -1092,11 +1092,11 @@ export async function knockoutInner(ctx, job, opts = {}) {
     const deliveredAt = new Date().toISOString();
     // `tier` beside `verdict` — the same band word under the name the clearance lane records it by, so a
     // reader of either lane's status finds the rating in one place. `verdict` stays as it was.
-    writeRunStatus(ctx, { state: "delivered", verdict: overall, tier: overall, statement: published.statement, url: published.url, reports: published.reports.map((r) => ({ mark: r.mark, url: r.url })), deliveredAt, sendPending: true, stepIndex: STEPS.length - 1, stepLabel: STEPS[STEPS.length - 1], stepN: STEPS.length, stepTotal: STEPS.length });
+    writeRunStatus(ctx, { state: "delivered", tier: overall, statement: published.statement, url: published.url, reports: published.reports.map((r) => ({ mark: r.mark, url: r.url })), deliveredAt, sendPending: true, stepIndex: STEPS.length - 1, stepLabel: STEPS[STEPS.length - 1], stepN: STEPS.length, stepTotal: STEPS.length });
     // — the knockout lane's pool copy learns its terminal state the same way,
     // for the same reason: publish returns the pool dir, and `state: "delivered"` is decided after it
     // returns. Same seam, same best-effort contract, no lane-specific exception to write down.
-    const stamp = writeSettleStamp(published.poolRunDir, { state: "delivered", verdict: overall, deliveredAt, runId: published.runId ?? run.runId, lane: "knockout" });
+    const stamp = writeSettleStamp(published.poolRunDir, { state: "delivered", tier: overall, deliveredAt, runId: published.runId ?? run.runId, lane: "knockout" });
     if (!stamp.written) note(`delivery: settle stamp not written (${stamp.reason})`);
     const archived = archive(run);
     rollupStatus(run.studioRoot);