clearotron 0.3.2 → 0.3.3-beta.1

package/driver/progress.mjs

@@ -194,6 +194,16 @@ const TERMINAL_STATES = new Set(["delivered", "failed", "cancelled"]);
  * preflight before an unattended run remains the operational guard for that case; this closes the
  * invisibility for every failure short of it, which is the honest claim.
  */
+// ── THE REVIEWER'S SIGN-OFF IS NOT THE CLEARANCE'S ANSWER (ruled 2026-09-22) ─────────────────────────
+//
+// The narrative-refutation stage signs the draft off CLEAR, CONDITIONAL or BLOCKING. At the top of the run
+// record as `verdict` it read as the clearance's answer, competed with the rating, and a BLOCKING one was
+// printed to clients as "on hold" although nothing holds delivery on it. It now lives under the stage
+// that produced it, named for what it is: `review.signoff`. The rating (`tier`) is the run's headline.
+// A record written before the move carries the old field; `readSignoff` reads either.
+export const signoffPatch = (signoff) => ({ review: { signoff: signoff ?? null } });
+export const readSignoff = (s) => s?.review?.signoff ?? s?.verdict ?? null;
+
 export function writeRunStatus(ctx, patch = {}, runDirOverride = null, { critical = false } = {}) {
   const runDir = runDirOverride ?? ctx?.run?.runDir;
   // — A STATE WRITE THAT CANNOT FIND ITS RUN DIRECTORY SAYS SO. It used to `return` here, in
@@ -222,6 +232,7 @@ export function writeRunStatus(ctx, patch = {}, runDirOverride = null, { critica
   const { __stateReset, ...rest } = patch;
   const old = readRunStatus(runDir);
   const merged = { ...old, ...rest, updatedAt: nowISO() };
+  delete merged.verdict;   // the retired top-level field: a record rewritten here carries `review.signoff` alone
   if (typeof rest.stepIndex === "number" && typeof old.stepIndex === "number" && old.stepIndex > rest.stepIndex) {
     // keep the furthest step ever reached (label/n/total move together with the index)
     merged.stepIndex = old.stepIndex;
@@ -378,7 +389,7 @@ export function identitySeed() {
 // first-write-wins makes it the honest wall-clock start across any number of resumes. A resume instead
 // records itself: resumedAt (this resume's clock) + attempts (fresh run = 1, each resume +1), and
 // threads __stateReset because the resume guard has deliberately cleared a terminal sentinel. The
-// verdict/failedStage/reason resets stay (a resumed run owes a fresh outcome);
+// review/failedStage/reason resets stay (a resumed run owes a fresh outcome);
 // recoveryAttempts/recoveryHistory stay OUT of the seed (they are the park budget's memory).
 export function seedRunStatus(ctx, { resume = false } = {}) {
   const { job, run, agent } = ctx;
@@ -412,7 +423,7 @@ export function seedRunStatus(ctx, { resume = false } = {}) {
     stepIndex: first.index, stepLabel: first.label, stepN: first.n, stepTotal: first.total,
     currentStep: currentStepOf(first),
     lastStage: null,
-    verdict: null,
+    review: null,
     url: null,
     failedStage: null,
     reason: null,
@@ -489,7 +500,7 @@ export function lineFor(s) {
   // The rollup now carries the send state loudly; clearotron-deliver flips sendPending:false on send.
   const pending = s.sendPending === true ? " — 📮 SEND PENDING (email/WhatsApp NOT yet out — run clearotron-deliver)" : "";
   if (s.state === "delivered") {
-    const v = s.verdict ? ` (${s.verdict})` : "";
+    const v = s.tier ? ` (${s.tier})` : "";   // the rating, not the reviewer's sign-off word
     return `- ${head} — delivered${v}${s.url ? ` — ${s.url}` : ""}${pending}`;
   }
   if (s.state === "failed") {

package/driver/publish/index.mjs

@@ -14,7 +14,7 @@ import { parseReport, parseAudit, parseSections, parseBlocks, stripInternal, par
 import { renderHtml, parseActionBuckets, actYouConditions } from './render.mjs';
 import { buildAudit } from './xlsx.mjs';
 import { parseFindingsJson, parseFindingsJsonLenient, deriveDisplayVerdict, joinFindingToBlock, CLIENT_TIER_BY_COMPOSITE, projectCoverageJudgment } from '../findings-model.mjs';
-import { readStore, requiredAbsent, nonClosingAbsences } from './publish-inputs.mjs';   // — and why an absence did not close
+import { readStore, requiredAbsent, nonClosingAbsences } from './publish-inputs.mjs'; import { coverageFormStamp, readCoverageForm } from '../coverage-form-io.mjs'; import { coverageUnitLabel } from '../coverage-ledger.mjs';   // — and why an absence did not close
 import { clearanceReportData } from './report-data.mjs';
 import { searchDepthRecord, planTerritoriesOf } from './search-depth.mjs'; import { bandRecords } from '../named-band.mjs';   // how much was read to reach the answer, as counts and tokens
 import { parseFrameworkManifest } from '../framework.mjs';
@@ -251,11 +251,11 @@ function indexRows(runs, { reportFile, linkPrefix = '', showAudit = true, client
       <td>${anonMark(r.title, { key: ck, run: r.runId })}</td>
       <td>${anonClient(r.client, ck)}</td>
       <td><span class="b b-${attrValue(r.badge)}">${esc(r.overall)}</span>${qcFailed ? ' <span class="hold" title="machine QC checks failed — see the audit workbook">⚠ QC</span>' : ''}${!client && !qcFailed && r.clientGate?.inputsAbsent?.length ? ` <span class="disc" title="${escAttr(`published without ${r.clientGate.inputsAbsent.join(', ')} — each declared optional, so the release stands; the report was built without it`)}">◦ built without an input</span>` : ''}${
-        // spec 64 — the stance clause of THE one risk statement beside the (labelled) band pill, so the
-        // index can never show a bare severity word that reads as the whole answer. The tier word leads
-        // the statement; the pill already shows it, so the cell carries the clause after the first " — ".
-        // Legacy meta.json (no statement) renders this cell byte-identically.
-        r.statement ? `<span class="stmt" title="${escAttr(r.statement)}">${esc(String(r.statement).split(' — ').slice(1).join(' — ') || r.statement)}</span>` : ''}</td>
+        // The report's own conclusion beside the band pill (ruled 2026-09-22: the report is the master),
+        // never a second summary. A meta.json written before the caption was kept shows the pill alone:
+        // its stored statement could say "on hold", which was never true. The pill carries the rating,
+        // the single headline on this short surface.
+        r.caption ? `<span class="stmt" title="${escAttr(r.caption)}">${esc(r.caption)}</span>` : ''}</td>
       <td>${runCell}</td>${showAudit ? `
       <td>${r.auditFile ? `<a ${runAttrs} href="${linkPrefix}${attrValue(r.runId)}/${attrValue(r.auditFile)}">audit.xlsx</a>` : '—'}</td>` : ''}
     </tr>`;
@@ -872,6 +872,15 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
     } catch { /* the workbook row is the record that matters; this line is the second copy */ }
   }
 
+  // ── THE WAITING FAMILIES THE READING TURN WITHHELD (withheld-families.mjs) ───────────────────────
+  //
+  // Ruled 2026-09-22: a family the reading turn chose not to ask is recorded with its reason in the run's
+  // record and in the audit workbook, and NOT in the report. The coverage form keeps these rows out of
+  // the ledger the report is built from, so this sheet is their one reader-facing place. Same builder,
+  // same four columns and the same state as the probes above; the area is the driver's own label and the
+  // words are the reading turn's reason.
+  const withheldFamilies = withheldFamilyRows(runDir ?? dirname(reportMd));
+
   // doc 50 — the run's FROZEN framework manifest (band vocabulary). Present on band-doctrine runs;
   // absent on every archived run (they render byte-identically on the legacy paths).
   let framework = null;
@@ -1134,7 +1143,7 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
       // the same rule (the workbook's own BANNED gate had already started firing on the raw detail —
       // advisory, so CI stayed green). reviewReceipts.lint keeps its raw detail for the internal
       // readers above (fetchState reads registry-record-coverage's URIs out of it).
-      counts = await buildAudit({ droppedConditions, undispatchedProbes, findings, coverage, contextNotes, coverageJudgment, markAssessment, corrections: correctionsDoc, fetchState, verdict: verdictInfo, jurisdiction, commonLawJoinedTerms, registerOnly, clientGate, lintFailures: deliveryFlagLines(reviewReceipts.lint), productName, registerPublishesRecordPages: runOrigins == null ? null : runOrigins.length > 0, recordLinks: officeLinks?.byUri ?? null }, auditParsed, join(poolRunDir, auditFile), fm.title, fm);
+      counts = await buildAudit({ droppedConditions, undispatchedProbes, withheldFamilies, findings, coverage, contextNotes, coverageJudgment, markAssessment, corrections: correctionsDoc, fetchState, verdict: verdictInfo, jurisdiction, commonLawJoinedTerms, registerOnly, clientGate, lintFailures: deliveryFlagLines(reviewReceipts.lint), productName, registerPublishesRecordPages: runOrigins == null ? null : runOrigins.length > 0, recordLinks: officeLinks?.byUri ?? null }, auditParsed, join(poolRunDir, auditFile), fm.title, fm);
       grpRead(join(poolRunDir, auditFile), 0o640);
       if (counts?.gateViolations?.length) console.warn(`[audit-workbook] advisory: ${counts.gateViolations.join(' | ')}`);
     } catch (e) {
@@ -1342,7 +1351,8 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
     // writer). Absent on legacy runs — regenIndex re-reads every historical meta.json, so consumers
     // null-guard and old rows render byte-identically.
     statement: verdictInfo?.statement ?? undefined,
-    verdict: verdictInfo?.verdict ?? undefined,
+    caption: fm.overall_caption || undefined,   // the report's own conclusion, which the run list quotes
+    review: verdictInfo?.verdict ? { signoff: verdictInfo.verdict } : undefined,   // the reviewer's sign-off, not the clearance's answer (ruled 2026-09-22)
     // doc 50 — which framework rated this run (custom vs Generic default) + its ladder, for the archive
     // card, the email table sort/colour and the per-customer index; absent on archived runs forever.
     framework: framework ? { key: framework.framework_key, title: framework.title,
@@ -1369,7 +1379,8 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
   // `<origin>/<runId>/report.html` — where the documents sit on disk, which is not an application route.
   // Composed rather than spelled here so the report link is built the same way the audit link always was.
   const url = reportRouteFor(poolUrl, runId);
-  return { runId, auditFile, counts, total, url, poolRunDir, auditError, findingsError, customerKey: customerKey || 'generic', clientGate };
+  return { runId, auditFile, counts, total, url, poolRunDir, auditError, findingsError, customerKey: customerKey || 'generic', clientGate,
+    caption: fm.overall_caption || null };   // the report's own conclusion, for the run record's short surfaces
 }
 
 // Compose the notification email body — MARKDOWN (the mail tool renders markdown→HTML; raw HTML gets escaped).
@@ -1739,17 +1750,13 @@ export function composeEmailHtml(reportMdPath, url, auditFile, names = [], deliv
   // the engine clamp reasons (opts.conditions = verdict.json reasons). Machinery-only clamps (no client
   // item authored) degrade to one generic plain line — never raw engine jargon, never truncated mid-sentence.
   const emailConditions = opts?.verdict === 'CONDITIONAL' ? actYouConditions(parseActionBuckets(secs['Actions']).you) : [];
-  // THE BANNER SPEAKS THE RUN'S OWN SENTENCE. It used to print the delivery gate's word — "Delivered as
-  // BLOCKING" — which is engine vocabulary and, beside a Medium rating on the report, reads as a
-  // contradiction the reader cannot resolve (measured 2026-09-20). The statement is composed once by the
-  // sidecar writer and is what the report and the index already show; a run recorded before statements
-  // were persisted keeps the old line, which is all such a run has.
-  const bound = String(opts?.statement ?? '').trim();
-  const boundHead = bound
-    ? esc(bound)
-    : `Delivered as ${esc(opts?.verdict ?? '')}${opts?.verdict === 'CONDITIONAL' ? ' — subject to:' : '.'}`;
-  const verdictBound = (opts?.verdict && opts.verdict !== 'CLEAR')
-    ? `<p style="margin:0 0 8px;padding:8px 10px;background:#fdeeee;border:1px solid #c98a86;color:#6e1512"><b>${boundHead}</b>${opts.verdict === 'CONDITIONAL' ? `<br>${(emailConditions.length ? emailConditions : ['the open items set out in the report, before relying on a clean result']).map((r) => `• ${cell(String(r))}`).join('<br>')}` : ''}</p>`
+  // THE REPORT IS THE MASTER (ruled 2026-09-22). The banner used to print a second summary composed
+  // beside the report — "On hold — …" on a run the report called conditional, although nothing is ever
+  // held — and before that the delivery gate's word. It now quotes the report: the rating, then the
+  // report's own conclusion (below), and where the report names what only the client can close, those
+  // items under the report's own heading. Nothing here composes a sentence of its own.
+  const verdictBound = opts?.verdict === 'CONDITIONAL'
+    ? `<p style="margin:0 0 8px;padding:8px 10px;background:#fdeeee;border:1px solid #c98a86;color:#6e1512"><b>Only you can close these</b><br>${(emailConditions.length ? emailConditions : ['the open items set out in the report, before relying on a clean result']).map((r) => `• ${cell(String(r))}`).join('<br>')}</p>`
     : '';
 
   const reviewHeadline = `<div style="${FONT};font-size:11pt;color:#1a1a2e;margin:0 0 14px">`
@@ -1757,12 +1764,11 @@ export function composeEmailHtml(reportMdPath, url, auditFile, names = [], deliv
     + verdictBound
     + `<p style="margin:0 0 8px"><b>${[opts?.productName ? esc(String(opts.productName)) : '', esc(fm.title || '')].filter(Boolean).join(' — ')} (${esc(fm.matter || '')})</b></p>`
     // T2 (H5): the derived tier (verdict sidecar, passed by the driver) outranks the
-    // model-authored fm label — one authority on every surface.
-    // spec 64: with a composed statement the headline reads band + stance as ONE sentence ("High —
-    // conditional on: …"); legacy (no statement) keeps the labelled tier line byte-identically.
-    + (opts?.statement
-      ? `<p style="margin:0 0 6px"><b>${esc(opts.statement)}</b> ${cell(fm.overall_caption || '')}</p>`
-      : ((opts?.tier ?? fm.overall_label) ? `<p style="margin:0 0 6px"><b>Overall risk: ${esc(opts?.tier ?? fm.overall_label)}.</b> ${cell(fm.overall_caption || '')}</p>` : ''))
+    // model-authored fm label — one authority on every surface. The rating leads, then the report's own
+    // conclusion verbatim (ruling 244); with no rating recorded, the conclusion stands alone.
+    + ((opts?.tier ?? fm.overall_label)
+      ? `<p style="margin:0 0 6px"><b>Overall risk: ${esc(opts?.tier ?? fm.overall_label)}.</b> ${cell(fm.overall_caption || '')}</p>`
+      : (fm.overall_caption ? `<p style="margin:0 0 6px">${cell(fm.overall_caption)}</p>` : ''))
     + reportLink
     + (fm.handling_note ? `<p style="margin:0 0 8px;color:#7a2b12"><b>Handling note:</b> ${cell(fm.handling_note)}</p>` : '')
     // T9 (K3): methodology identity — which profile/framework rated this run (+ verifiable sha).
@@ -1811,3 +1817,12 @@ function officeLinksFor(findings, recordsByUri, runOrigins) {
   if (links) console.log(`[record-links] ${links.summary}`);
   return links;
 }
+
+/** The coverage form's family rows judged withheld, as audit-workbook coverage rows. Never throws. */
+export function withheldFamilyRows(runDir) {
+  try {
+    const { rows } = readCoverageForm(runDir, coverageFormStamp(runDir).formName);
+    return (rows ?? []).filter((r) => r?.kind === 'family' && r.status === 'withheld-by-judgment' && r.reason)
+      .map((r) => ({ area: coverageUnitLabel(r.unit), state: 'not-searched', note: String(r.reason) }));
+  } catch { return []; }
+}

package/driver/publish/report-data.mjs

@@ -98,9 +98,10 @@ export function clearanceReportData({
     auditFile: auditFile || null,
     level: { searchLevel: searchLevel ?? null, stageLabel: stageLabel ?? null },
     framework: framework ? { key: framework.framework_key, title: framework.title, bands: framework.bands.map((b) => ({ label: b.label, tone: b.tone })) } : null,
-    // The one risk statement + its derivation — the exact record every other surface joins (spec 64).
-    verdict: verdictInfo ? {
-      verdict: verdictInfo.verdict ?? null,
+    // The rating + the one risk statement — the exact record every other surface joins (spec 64). Named
+    // `rating` (ruled 2026-09-22): as `verdict` it read as the clearance's answer and carried the reviewer's
+    // sign-off word beside the band. The sign-off stays in the review stage's own record, not the client's.
+    rating: verdictInfo ? {
       tier: verdictInfo.tier ?? null,
       badge: verdictInfo.badge ?? null,
       band: verdictInfo.band ?? null,

package/driver/publish/xlsx.mjs

@@ -302,7 +302,7 @@ export function searchRows(auditParsed, { findings = [], joinedTerms = null, reg
     const byTerm = new Map();
     for (const n of cl) {
       const key = (n.search_term || '').trim();
-      if (!byTerm.has(key)) { byTerm.set(key, { plats: new Set(), results: new Set(), notes: [], gaps: new Set() }); order.push(key); }
+      if (!byTerm.has(key)) { byTerm.set(key, { plats: new Set(), results: new Set(), notes: [], gaps: new Set(), gapReasons: new Map() }); order.push(key); }
       const g = byTerm.get(key);
       if (n.platform) g.plats.add(n.platform);
       if (n.result) g.results.add(n.result);
@@ -310,7 +310,17 @@ export function searchRows(auditParsed, { findings = [], joinedTerms = null, reg
       // — the surfaces that could NOT be searched are counted separately from the ones that came back
       // empty. The dedup unions results across platforms, so one gapped surface among many used to vanish
       // entirely into a term-level "0 — clean".
-      if (notSearched(n, n.result, n.notes)) g.gaps.add(n.platform || '?');
+      // — THE REGISTER'S OWN WORDS, KEPT. A surface that could not be searched arrives here with the
+      // reason it gave (`audit-from-spine` puts the gap's `error` into `notes`), and this row used to
+      // record only that it was a gap. So a query a provider REFUSED — "content policy (HTTP 400)" —
+      // and one that was simply never run rendered as the same sentence, and the reason was in the
+      // workbook's hand the whole time. `audit.md` kept it; this file dropped it.
+      if (notSearched(n, n.result, n.notes)) {
+        const surface = n.platform || '?';
+        g.gaps.add(surface);
+        const said = plainNote(n.notes || '').trim();
+        if (said) g.gapReasons.set(surface, said);
+      }
     }
     push({ 'Search term / variant': COMMON_LAW_SECTION, Scope: '', Result: '', Outcome: '', Note: '', _section: true });
     for (const term of order) {
@@ -329,7 +339,19 @@ export function searchRows(auditParsed, { findings = [], joinedTerms = null, reg
       // searched at all. The gap count is carried beside the hit flag, never folded into it.
       const gaps = [...g.gaps];
       const ran = Math.max(0, n - gaps.length);
-      const gapNote = gaps.length ? ` ${gaps.length} surface${gaps.length === 1 ? '' : 's'} could not be searched (${gaps.slice(0, 4).join(', ')}${gaps.length > 4 ? ', …' : ''}) — this term is NOT closed across them.` : '';
+      // A REFUSAL AND A DROP ARE DIFFERENT FACTS, and only one of them is about the register. Where the
+      // surface said why, its words are quoted; where nothing was recorded, the row says that instead of
+      // implying a reason it does not have. A reader deciding whether to re-run needs to know which:
+      // a content-policy refusal will refuse again, a query that never ran may simply run.
+      const said = gaps.map((s) => [s, g.gapReasons.get(s)]).filter(([, r]) => r);
+      const silent = gaps.filter((s) => !g.gapReasons.has(s));
+      const reasonNote = said.length
+        ? ` The surface${said.length === 1 ? '' : 's'} gave a reason: ${said.map(([s, r]) => `${s} — ${r}`).join('; ')}.`
+        : '';
+      const silentNote = silent.length && said.length
+        ? ` ${silent.length} recorded no reason (${silent.slice(0, 4).join(', ')}${silent.length > 4 ? ', …' : ''}).`
+        : silent.length ? ' No reason was recorded for any of them.' : '';
+      const gapNote = gaps.length ? ` ${gaps.length} surface${gaps.length === 1 ? '' : 's'} could not be searched (${gaps.slice(0, 4).join(', ')}${gaps.length > 4 ? ', …' : ''}) — this term is NOT closed across them.${reasonNote}${silentNote}` : '';
       const outcome = anyHit ? (joined ? '→ Findings' : 'Reviewed — not carried as a conflict')
         : gaps.length && !ran ? NOT_SEARCHED_OUTCOME          // nothing ran at all: never a closure claim
           : gaps.length ? 'No conflict — partial'             // some ran clean, some never ran: say both
@@ -637,7 +659,7 @@ export async function buildAudit(contract, auditParsed, outPath, mark = '', fm =
   // shape and not a new sheet, and the words are the run receipt's own.
   addSheet(wb, 'Coverage & gaps', COVERAGE_COLS,
     [...coverageRows(coverage), ...coverageRows(contract?.droppedConditions || []),
-     ...coverageRows(contract?.undispatchedProbes || [])], (row, _d, kept) => {
+     ...coverageRows(contract?.undispatchedProbes || []), ...coverageRows(contract?.withheldFamilies || [])], (row, _d, kept) => {
     if (!kept.has('State')) return;
     const st = row.getCell('State'); const f = STATE_FILL[String(st.value).trim()];
     if (f) { st.fill = { type: 'pattern', pattern: 'solid', fgColor: { argb: 'FF' + f } }; st.font = { bold: true }; }

package/driver/queue-markers.mjs

@@ -78,6 +78,50 @@ export const PROSE_PARTS = {
   campaignShape: ".campaignShape.txt",   // P2-C (Round-2 §8a): campaign-shape facts — stated launch shape
 };
 
+// ── ONE GOODS DESCRIPTION, TWO SPELLINGS, AND EVERY READER GETS THE SAME ANSWER ────────────────────
+//
+// Intake accepts a goods description under the current field or under the older spelling a forwarding
+// agent may still send. That acceptance was the gate's private knowledge: the scope stamp read the
+// current field alone, so a job written the older way passed intake and recorded that the matter named
+// no goods. Both sites were individually right and nothing compared them.
+//
+// Fixing the scope stamp alone moved the seam rather than closing it. Ten other readers — the clearance
+// and knockout prompts, the pharmaceutical test, the product-context derivation, the portal's own row
+// and the plan preview — still read the current field, so the scope file would carry a value the
+// prompts never saw, and the validator comparing the two would report the disagreement as a fault in
+// the frame.
+//
+// SO THE FOLD HAPPENS ONCE, WHERE THE JOB IS ASSEMBLED FOR A RUN, and every reader downstream sees one
+// field. Nothing is written back to the queue file: the manifest stays exactly as it was filed, which is
+// the same rule the intake gate follows about stamping derived values onto a job.
+//
+// Here, in the module that already owns the queue's own vocabulary, because the gate and the assembly
+// must never hold two opinions about what counts. A hand-copied predicate is how they drifted the first
+// time.
+
+/** The field names a goods description may arrive under, newest first. */
+export const GOODS_FIELDS = ["goods", "use"];
+
+/** The goods description a job carries under any accepted spelling, or null. Pure. */
+export function goodsOf(job) {
+  for (const f of GOODS_FIELDS) {
+    const v = job?.[f];
+    if (v != null && String(v).trim()) return v;
+  }
+  return null;
+}
+
+/**
+ * The same job with its goods description under the current field, whichever spelling it arrived in.
+ * Returns the job unchanged when there is nothing to fold, so a job already on the current field is
+ * byte-identical and no caller has to ask which it got.
+ */
+export function withFoldedGoods(job) {
+  const goods = goodsOf(job);
+  if (goods == null || job?.goods === goods) return job;
+  return { ...job, goods };
+}
+
 /** A consumed claim's sidecars, swept together by runner.mjs cleanupClaimSidecars. */
 export const CLAIM_SIDECAR_SUFFIXES = [".pid", ".meta", ".skips"];
 

package/driver/queue-watch-verdict.mjs

@@ -91,8 +91,8 @@ export function queueWatchVerdict({ queueDirs, watched, unitPath, unitError = nu
   // anywhere else; a privilege-limited read that answers "fine" is the exact failure this family of
   // checks exists to refuse, and it is the one that would make this guard decoration on the box that
   // matters most.
-  if (unitError) return { state: "skip", message: `the .path unit could not be read — ${unitPath}: ${unitError}` };
-  if (resolveError) return { state: "skip", message: `the queue dirs could not be resolved — ${resolveError}` };
+  if (unitError) return { state: "skip", blocked: true, message: `the .path unit could not be read — ${unitPath}: ${unitError}` };
+  if (resolveError) return { state: "skip", blocked: true, message: `the queue dirs could not be resolved — ${resolveError}` };
 
   const q = Array.isArray(queueDirs) ? queueDirs : null;
   const w = Array.isArray(watched) ? watched : [];

package/driver/reference-score.mjs

@@ -45,6 +45,7 @@
 
 import { normalizeElement, consonantSkeleton } from "./form-neighbourhood.mjs";
 import { canonicalJurisdictionCode } from "./jurisdiction-codes.mjs";
+import { territoryTier } from "./territory-tiers.mjs";
 
 export const REFERENCE_SCHEMA_VERSION = 1;
 
@@ -378,6 +379,12 @@ export function inScope(entry, scopeClasses = [], scopeTerritories = []) {
   // that scenario it is five of fifteen entries, which is the difference between a bad round and a fine
   // one. Same shape as the class rule: an entry naming no territory is in scope, and a run that recorded
   // no scope cannot exclude anything.
+  // A WORLDWIDE SCOPE EXCLUDES NOTHING ON TERRITORY, for the reason a missing scope excludes nothing: it
+  // names no territory an entry could fall outside. Without this a worldwide run compared every entry
+  // with the word itself (`GLOBAL`), no entry names that, and the whole reference landed in `excluded`,
+  // an empty score that read as a clean one. Which words mean worldwide is the intake's own list
+  // (`territoryTier`), not a pattern restated here; `canonTerritory` still guesses nothing about `intl`.
+  if (scopeTerritories.some((t) => territoryTier(t) === "worldwide")) return true;
   const terr = (entry?.jurisdictions ?? []).map(canonTerritory).filter(Boolean);
   const scopeTerr = scopeTerritories.map(canonTerritory).filter(Boolean);
   if (scopeTerr.length && terr.length && !terr.some((t) => scopeTerr.includes(t))) return false;
@@ -911,7 +918,8 @@ export function readVerdict({ verdictDoc = null, knockoutFindings = null, status
     const rows = marks
       .map((m) => [m.name, [m.rating, m.ratingQualifier ? `(${m.ratingQualifier})` : null].filter(Boolean).join(" ")].filter(Boolean).join(": "))
       .filter((s) => s.includes(":"));
-    const text = [status?.verdict ? `worst band ${status.verdict}` : null, ...rows].filter(Boolean).join(" · ");
+    const worst = status?.tier ?? status?.verdict ?? null;   // `verdict` on a quick-search record written before the move
+    const text = [worst ? `worst band ${worst}` : null, ...rows].filter(Boolean).join(" · ");
     if (text) return { clean: clean(text), text, source: "knockout-findings.json + status.json — this lane writes no _driver/verdict.json", why: null };
   }
   return { clean: null, text: null, source: null,
@@ -2194,7 +2202,7 @@ export function deliveryLine(run) {
   }
   if (run.poolMeta) {
     const issued = run.poolMeta.issuedAt ? ` published ${run.poolMeta.issuedAt}` : " publication time not recorded";
-    const verdict = run.poolMeta.verdict ?? run.poolMeta.overall;
+    const verdict = run.poolMeta.review?.signoff ?? run.poolMeta.verdict ?? run.poolMeta.overall;
     // NOT PRESERVED stays the honest answer for a pool copy with no stamp — a run archived before the
     // stamp existed, or one whose best-effort write failed. An absent stamp is unknown, not a refusal.
     return `delivered: NOT PRESERVED — this is a pool copy carrying no settle stamp, so the terminal`

package/driver/register-availability.mjs

@@ -41,9 +41,9 @@
 // CORRECTED 2026-08-11 — THIS PARAGRAPH USED TO SAY "one qid per office … which is the shape
 // joinPlanToBands already has", AND THAT WAS FALSE ABOUT THE COMPILER IT DOCUMENTS. There is no
 // per-office qid. compileRegisterPlan narrows ONE shared `regions` array and hands it to every entry
-// (register-plan.mjs:846 compileRegisterPlan); the unreachable office produces no entry, so no qid, so no band block, so
+// (register-plan.mjs compileRegisterPlan); the unreachable office produces no entry, so no qid, so no band block, so
 // nothing ever reaches joinPlanToBands' deferred bucket — whose only source is a block stamped
-// `error:true && deferred:true` (register-plan.mjs:1489 extendRegisterPlan).
+// `error:true && deferred:true` (register-plan.mjs extendRegisterPlan).
 //
 // The consequence was not academic. `deferred_coverage` rode the plan and nothing that a reader sees
 // read it: coverage-form.mjs seeded its deferred rows from skeleton qids alone, so an EU+US matter on a