clearotron 0.3.3-beta.0 → 0.3.3

package/driver/pipeline-knockout.mjs

@@ -639,7 +639,7 @@ export async function knockoutInner(ctx, job, opts = {}) {
       // for reconcile-runs' exact liveness test. The stepper and the identity are separate calls now.
       ...identitySeed(),
       stepIndex: 0, stepLabel: STEPS[0], stepN: 1, stepTotal: STEPS.length,
-      verdict: null, url: null, failedStage: null, reason: null, deliveredAt: null,
+      review: null, url: null, failedStage: null, reason: null, deliveredAt: null,
       // A5/A3: a re-run of a previously-terminal knockout may reopen the state ONLY because the resume
       // guard cleared the sentinel (ctx.stateReset threads that authority); startedAt is no longer
       // seeded anywhere — writeRunStatus backfills it first-write-wins.
@@ -1092,11 +1092,11 @@ export async function knockoutInner(ctx, job, opts = {}) {
     const deliveredAt = new Date().toISOString();
     // `tier` beside `verdict` — the same band word under the name the clearance lane records it by, so a
     // reader of either lane's status finds the rating in one place. `verdict` stays as it was.
-    writeRunStatus(ctx, { state: "delivered", verdict: overall, tier: overall, statement: published.statement, url: published.url, reports: published.reports.map((r) => ({ mark: r.mark, url: r.url })), deliveredAt, sendPending: true, stepIndex: STEPS.length - 1, stepLabel: STEPS[STEPS.length - 1], stepN: STEPS.length, stepTotal: STEPS.length });
+    writeRunStatus(ctx, { state: "delivered", tier: overall, statement: published.statement, url: published.url, reports: published.reports.map((r) => ({ mark: r.mark, url: r.url })), deliveredAt, sendPending: true, stepIndex: STEPS.length - 1, stepLabel: STEPS[STEPS.length - 1], stepN: STEPS.length, stepTotal: STEPS.length });
     // — the knockout lane's pool copy learns its terminal state the same way,
     // for the same reason: publish returns the pool dir, and `state: "delivered"` is decided after it
     // returns. Same seam, same best-effort contract, no lane-specific exception to write down.
-    const stamp = writeSettleStamp(published.poolRunDir, { state: "delivered", verdict: overall, deliveredAt, runId: published.runId ?? run.runId, lane: "knockout" });
+    const stamp = writeSettleStamp(published.poolRunDir, { state: "delivered", tier: overall, deliveredAt, runId: published.runId ?? run.runId, lane: "knockout" });
     if (!stamp.written) note(`delivery: settle stamp not written (${stamp.reason})`);
     const archived = archive(run);
     rollupStatus(run.studioRoot);

package/driver/pipeline.mjs

@@ -91,7 +91,7 @@ import { deriveScopeFacts } from "./scope-facts.mjs";
 import { documentGrowth } from "./gate-metrics.mjs";
 import { editRepairTail, abbrev } from "./repair-contract.mjs";
 import { repairFollowup } from "./repair-composers.mjs";
-import { seedRunStatus, recordTransition, writeRunStatus, rollupStatus, atomicWrite, finalStepFields, terminalRunState } from "./progress.mjs";
+import { seedRunStatus, recordTransition, writeRunStatus, rollupStatus, atomicWrite, finalStepFields, terminalRunState, signoffPatch, readSignoff } from "./progress.mjs";
 import { batchMarkName } from "./mark-name.mjs";
 import { writeOutboxPacket } from "./outbox.mjs";
 import { publishReport, composeEmailHtml, deliverySubject } from "./publish/index.mjs";
@@ -12603,7 +12603,7 @@ async function pipelineInner(job, opts = {}) {
         : "failed after retries + fallback (the ladder recorded no condition)");
     let verdict = firstRef.verdict;
     runLog(run.runDir, { event: "verdict", verdict });
-    writeRunStatus(ctx, { verdict });
+    writeRunStatus(ctx, signoffPatch(verdict));
     note(`refutation verdict: ${verdict}`);
     // qw/typed-correction-kinds — TELEMETRY ONLY (data first; the corrective-skip decision is a
     // separate owner-gated build): partition the review's flagged-correction lines by their
@@ -12847,7 +12847,7 @@ async function pipelineInner(job, opts = {}) {
       verdict = rc.ok ? (parseVerdict(readFileSync(P.seniorEyeReview, "utf8")) ?? entryVerdict) : entryVerdict;
       correctiveRecheckOk = rc.ok === true;
       runLog(run.runDir, { event: "verdict-2", verdict });
-      writeRunStatus(ctx, { verdict });
+      writeRunStatus(ctx, signoffPatch(verdict));
     }
     // AD-2 A1 — the completion receipt, written ONLY when the cycle finished with a verified recheck:
     // a fallen-back recheck kept the entry verdict WITHOUT re-verifying, and cementing that would stop
@@ -13089,7 +13089,7 @@ async function pipelineInner(job, opts = {}) {
       if (d.clamped) {
         runLog(run.runDir, { event: "terminal-guard-clamp", defect: d.record.defect, from: verdict, to: d.verdict });
         verdict = d.verdict;
-        writeRunStatus(ctx, { verdict });
+        writeRunStatus(ctx, signoffPatch(verdict));
       }
     };
 
@@ -13223,7 +13223,7 @@ async function pipelineInner(job, opts = {}) {
             runLog(run.runDir, { event: "coverage-floor-clamp", cause: "forward-actions", from: "CLEAR", to: "CONDITIONAL", legalActions: conditions.length });
             note(`deliver-conditional floor: the opinion names ${conditions.length} forward legal action(s) a human must take (${conditions[0].slice(0, 140)}${conditions.length > 1 ? `; +${conditions.length - 1} more` : ""}) — clamping CLEAR→CONDITIONAL (spec 64: the disposition is derived from the findings' named actions).`);
             verdict = "CONDITIONAL";
-            writeRunStatus(ctx, { verdict });
+            writeRunStatus(ctx, signoffPatch(verdict));
           } else if (fresh.length) {
             runLog(run.runDir, { event: "verdict-conditions-recorded", legalActions: fresh.length });
           }
@@ -13261,7 +13261,7 @@ async function pipelineInner(job, opts = {}) {
         if (droppedConditions.length && verdict === "CLEAR") {
           runLog(run.runDir, { event: "coverage-floor-clamp", cause: "dropped-actions", from: "CLEAR", to: "CONDITIONAL", actionsDropped: droppedConditions.length });
           verdict = "CONDITIONAL";
-          writeRunStatus(ctx, { verdict });
+          writeRunStatus(ctx, signoffPatch(verdict));
         }
       }
     } catch (e) { note(`legal-actions floor skipped (${String(e.message).slice(0, 80)}) — never-kill; the predelivery coherence lint is the second net`); }
@@ -13309,7 +13309,7 @@ async function pipelineInner(job, opts = {}) {
         // re-ask can flip a clamped verdict back to CLEAR, and it must meet this floor again with the
         // reason ALREADY recorded. Folding these two into one guard would let the second pass skip on
         // the dedup and deliver CLEAR — the precise defect this issue is about.
-        if (clReason && verdict === "CLEAR") { verdict = "CONDITIONAL"; writeRunStatus(ctx, { verdict }); }
+        if (clReason && verdict === "CLEAR") { verdict = "CONDITIONAL"; writeRunStatus(ctx, signoffPatch(verdict)); }
       }
     } catch (e) { note(`common-law downgrade floor skipped (${String(e.message).slice(0, 80)}) — never-kill`); }
     if (entryVerdict === "CLEAR") {
@@ -13403,7 +13403,7 @@ async function pipelineInner(job, opts = {}) {
         // The reason KINDS distinguish coverage/frame/screen-gate/senior-right/register residue for the
         // report bound line and the client conditions row (merged — legalActions survives).
         clampKinds = { ...clampKinds, coverage: coverageInsufficient || undefined, frame: frameResidual || undefined, screenGate: screenGateGap || undefined, seniorRight: seniorGap || undefined, registerGap: registerGap || undefined, deadlineCarry: deadlineGap || undefined };
-        writeRunStatus(ctx, { verdict });
+        writeRunStatus(ctx, signoffPatch(verdict));
       }
     }
     };
@@ -13591,7 +13591,7 @@ async function pipelineInner(job, opts = {}) {
         if (rr.ok) {
           verdict = parseVerdict(readReview()) ?? "BLOCKING";
           runLog(run.runDir, { event: "verdict-3", verdict, trigger: "degenerate-reask" });
-          writeRunStatus(ctx, { verdict });
+          writeRunStatus(ctx, signoffPatch(verdict));
           applyCoverageFloor();   // a re-asked CLEAR passes the same deliver-conditional floor
           try { writeVerdictSidecar(); }
           catch (e) { throw new StageFailure("verdict", `verdict sidecar write failed (the single label authority): ${String(e.message).slice(0, 120)}`); }
@@ -14616,7 +14616,7 @@ async function pipelineInner(job, opts = {}) {
         applyCoverageFloor();
         try { writeVerdictSidecar(); }
         catch (e) { throw new StageFailure("verdict", `verdict sidecar re-derive failed (spec-64 coherence repair): ${String(e.message).slice(0, 120)}`); }
-        if (verdict !== beforeVerdict) writeRunStatus(ctx, { verdict });
+        if (verdict !== beforeVerdict) writeRunStatus(ctx, signoffPatch(verdict));
         runLog(run.runDir, { event: "verdict-rederive-repair", from: beforeVerdict, to: verdict });
         lint = lintNow();
       }
@@ -14902,7 +14902,7 @@ async function pipelineInner(job, opts = {}) {
                   runLog(run.runDir, { event: "verdict-hardened-by-repair", was: verdict, now: hardened, stage: s2.label, adopted: true });
                   note(`stale-repair: the reviewer returned ${hardened} — adopting it as the run's verdict (the one settled earlier was decided against a review this repair has since rewritten) and rebuilding the label from it`);
                   verdict = hardened;
-                  writeRunStatus(ctx, { verdict });
+                  writeRunStatus(ctx, signoffPatch(verdict));
                   try { writeVerdictSidecar(); }
                   catch (e) { throw new StageFailure("verdict", `verdict sidecar write failed (the single label authority): ${String(e.message).slice(0, 120)}`); }
                   reassemble = true;
@@ -15468,13 +15468,13 @@ async function pipelineInner(job, opts = {}) {
     // .published + .delivered on disk must never read "7/9" on any status surface (nothing runs after
     // the packet, so no stage transition would ever finish the display sequence). finalStepFields ⇒ 9/9.
     const deliveredAt = new Date().toISOString();
-    writeRunStatus(ctx, { state: "delivered", verdict, statement: emailVerdictOpts.statement ?? undefined, caption: published.caption ?? undefined, url: published.url, deliveredAt, sendPending: true, ...finalStepFields() });
+    writeRunStatus(ctx, { state: "delivered", ...signoffPatch(verdict), statement: emailVerdictOpts.statement ?? undefined, caption: published.caption ?? undefined, url: published.url, deliveredAt, sendPending: true, ...finalStepFields() });
     // — THE POOL COPY LEARNS ITS OWN TERMINAL STATE, HERE AND NOWHERE ELSE.
     // `meta.json` cannot carry this: it is composed inside publish, before this line runs, so the state
     // did not exist yet when it was written. This is the one moment where the terminal state and the
     // pool directory are both in hand. Best-effort by construction — the report is already published
     // and the run is already settled, so a failure to stamp is logged and the delivery proceeds.
-    const stamp = writeSettleStamp(published.poolRunDir, { state: "delivered", verdict, deliveredAt, runId: published.runId ?? run.runId, lane: "clearance" });
+    const stamp = writeSettleStamp(published.poolRunDir, { state: "delivered", signoff: verdict, deliveredAt, runId: published.runId ?? run.runId, lane: "clearance" });
     if (!stamp.written) note(`delivery: settle stamp not written (${stamp.reason})`);
     const archived = archive(run);
     rollupStatus(run.studioRoot);
@@ -16043,7 +16043,7 @@ export function reconstructCtx(job, opts) {   // @internal
   } catch { /* no/corrupt frozen plan — prose axes stand, as they always did */ }
   const readJson = (f) => { try { return JSON.parse(readFileSync(join(run.runDir, f), "utf8")); } catch { return null; } };
   const status = readJson("status.json");
-  if (status?.verdict) ctx.verdict = status.verdict;
+  if (readSignoff(status)) ctx.verdict = readSignoff(status);   // `review.signoff`, or `verdict` on a record written before the move
   const pub = readJson(".published");
   if (pub?.url) ctx.publishedUrl = pub.url;
   // ── THE CTX FIELDS THIS USED TO DROP (item) ───────────────────────────────────────────────────

package/driver/plan-run-agreement-verdict.mjs

@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sarl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// DO describe_options AND plan_run AGREE ON WHICH PRODUCTS ARE AVAILABLE — the deployment check's arm,
+// extracted so it can be driven without a door to call (the reason surface-exit-verdict.mjs gives).
+//
+// A plan_run that THROWS compared nothing. A 429 from the door's rate limit, a timeout, a refused
+// connection: each means the question was never answered, and the check used to file it beside the real
+// disagreements and exit 1, "drifted". Three runs of the check in two minutes exhausted the ops door's
+// rate limit and the third reported a drift that a redeploy could not have fixed. So an unanswered ask is
+// a marked skip, which exits 3, and only an answer that contradicts describe_options is a drift.
+
+// The blocker wording plan_run uses for a product it will not run.
+const UNAVAILABLE = /not part of the current release|not switched on|unavailable/i;
+
+/**
+ * Ask plan_run about each product describe_options listed, and say whether the two agree.
+ *
+ * @param {{ keys: string[], doorSays: Map<string, boolean>, probeProfileKey: string|null,
+ *           ask: (key: string) => Promise<{blockers?: unknown[]}> }} input
+ *   `ask` is the plan_run call for one product; a throw is a question that was not answered.
+ * @returns {Promise<{state: "pass"|"fail"|"skip", message: string, blocked?: true}>}
+ */
+export async function planRunAgreementVerdict({ keys = [], doorSays = new Map(), probeProfileKey = null, ask }) {
+  if (!probeProfileKey) {
+    return { state: "skip", message: "no customer resolved to plan against — see the roster check" };
+  }
+  const disagreements = [];
+  const unanswered = [];
+  for (const key of keys) {
+    let plan;
+    try { plan = await ask(key); } catch (e) { unanswered.push(`${key}: ${String(e?.message ?? e).slice(0, 120)}`); continue; }
+    const unavailable = (plan?.blockers ?? []).some((b) => UNAVAILABLE.test(String(b)));
+    if (unavailable !== !doorSays.get(key)) {
+      disagreements.push(`${key}: describe_options=${doorSays.get(key) ? "available" : "unavailable"} plan_run=${unavailable ? "unavailable" : "available"}`);
+    }
+  }
+  // A drift outranks an unanswered ask, as in exitFor: the drift is actionable now. The unanswered
+  // products stay on the line so the report does not read as though they were compared.
+  if (disagreements.length) {
+    return { state: "fail", message: disagreements.join(" · ")
+      + (unanswered.length ? ` · and plan_run gave no answer for ${unanswered.length}: ${unanswered.join(" · ")}` : "") };
+  }
+  if (unanswered.length) {
+    return { state: "skip", blocked: true, message: `could not ask plan_run about ${unanswered.length} of ${keys.length} product(s), `
+      + `so those were not compared — ${unanswered.join(" · ")}` };
+  }
+  return { state: "pass", message: `${keys.length} products checked through both code paths` };
+}

package/driver/portal-service.mjs

@@ -350,7 +350,7 @@ export function scanAccountRuns({ poolRoot, workspaceRoot, account = null, gener
         const docs = reportsOf(meta).filter((r) => existsSync(join(poolRoot, name, r.file)));
         const hasReport = docs.length > 0;
         const { bands, toneFor } = ladderOf(meta);
-        const band = meta.overall ?? meta.verdict ?? null;
+        const band = meta.overall ?? null;   // the rating; a meta's retired `verdict` held the reviewer's sign-off on the full-search lane
         out.push({ runId: meta.runId ?? name, account: owner, ...(owner === "generic" ? { organisation: meta.organisation ?? null } : {}),
           title: meta.title ?? meta.matter ?? name, kind: meta.kind ?? "clearance",
           // THE MARK, separate from the report's headline.
@@ -540,7 +540,7 @@ export function scanAccountRuns({ poolRoot, workspaceRoot, account = null, gener
         // hide this. Staff only: the client redaction below replaces `reason` and must drop this too,
         // or the redaction would be defeated by the field that carries the raw words.
         reasonDetail: s.reasonDetail ?? null,
-        date: (s.updatedAt ?? "").slice(0, 10), overall: s.verdict ?? null,
+        date: (s.updatedAt ?? "").slice(0, 10), overall: s.tier ?? null,   // the rating, never the reviewer's sign-off word
         // A live run has not been issued, so its last progress write is the honest ordering key — the
         // same role issuedAt plays for a delivered one, never presented as a finish time.
         issuedAt: typeof s.updatedAt === "string" ? s.updatedAt : null,
@@ -4006,7 +4006,7 @@ ${signedIn
 <div><a href="/portal">Go to the portal</a></div>
 <form method="post" action="/portal/logout"><button type="submit">Sign out</button></form>`
     : `<p>This ${escHtml(BRAND.name)} has one user: <b class="who">${escHtml(email)}</b>. Enter its passphrase.</p>
-${discarded ? `<p class="hint">A session this portal did not start, from another ${escHtml(BRAND.name)} on this address or an expired one, was set aside. Sign in below.</p>` : ""}
+${discarded ? `<p class="hint">Your earlier sign-in has expired. Sign in again.</p>` : ""}
 ${error ? `<p class="err">${escHtml(error)}</p>` : ""}
 <form method="post" action="/portal/login">
   <label for="passphrase">Passphrase</label>
@@ -4130,6 +4130,10 @@ async function readFormBody(req, limitBytes = 8192) {
   });
 }
 
+// The brief reader's model when PORTAL_READ_MODEL is unset: a TIER, like every stage's. An exact id goes to
+// the program as that model — past a cloud's ANTHROPIC_DEFAULT_SONNET_MODEL — and codex maps tiers only.
+export const PORTAL_READ_MODEL_DEFAULT = "sonnet";
+
 export function makeHttpHandler({ verify, limiter, service, log = () => {}, devIdentity = null, localAuth = null, static: staticHandler = null,
   // item 1 — PASSED IN, because this handler is its own function and the bootstrap that reads
   // the environment is another. The default is the Cloudflare Access header, so a caller that does
@@ -5211,7 +5215,7 @@ const PORT = PORT_CHOICE.port;
       // two are parameters on the shared runner for exactly this reason: `compose-read.mjs` records that
       // Haiku 4.5 refuses a thinking block outright (400), so inheriting the jx constants here would
       // have been a failure on every press.
-      const model = process.env.PORTAL_READ_MODEL || "claude-sonnet-5";
+      const model = process.env.PORTAL_READ_MODEL || PORTAL_READ_MODEL_DEFAULT;
       const runner = await makeJxTurnRunner({ model, thinking: "off", lane: "the brief reader" });
       if (runner?.error) {
         // NAMES THE CONDITION, on the operator's surface. The client-facing note stays client-facing;

package/driver/progress.mjs

@@ -194,6 +194,16 @@ const TERMINAL_STATES = new Set(["delivered", "failed", "cancelled"]);
  * preflight before an unattended run remains the operational guard for that case; this closes the
  * invisibility for every failure short of it, which is the honest claim.
  */
+// ── THE REVIEWER'S SIGN-OFF IS NOT THE CLEARANCE'S ANSWER (ruled 2026-09-22) ─────────────────────────
+//
+// The narrative-refutation stage signs the draft off CLEAR, CONDITIONAL or BLOCKING. At the top of the run
+// record as `verdict` it read as the clearance's answer, competed with the rating, and a BLOCKING one was
+// printed to clients as "on hold" although nothing holds delivery on it. It now lives under the stage
+// that produced it, named for what it is: `review.signoff`. The rating (`tier`) is the run's headline.
+// A record written before the move carries the old field; `readSignoff` reads either.
+export const signoffPatch = (signoff) => ({ review: { signoff: signoff ?? null } });
+export const readSignoff = (s) => s?.review?.signoff ?? s?.verdict ?? null;
+
 export function writeRunStatus(ctx, patch = {}, runDirOverride = null, { critical = false } = {}) {
   const runDir = runDirOverride ?? ctx?.run?.runDir;
   // — A STATE WRITE THAT CANNOT FIND ITS RUN DIRECTORY SAYS SO. It used to `return` here, in
@@ -222,6 +232,7 @@ export function writeRunStatus(ctx, patch = {}, runDirOverride = null, { critica
   const { __stateReset, ...rest } = patch;
   const old = readRunStatus(runDir);
   const merged = { ...old, ...rest, updatedAt: nowISO() };
+  delete merged.verdict;   // the retired top-level field: a record rewritten here carries `review.signoff` alone
   if (typeof rest.stepIndex === "number" && typeof old.stepIndex === "number" && old.stepIndex > rest.stepIndex) {
     // keep the furthest step ever reached (label/n/total move together with the index)
     merged.stepIndex = old.stepIndex;
@@ -378,7 +389,7 @@ export function identitySeed() {
 // first-write-wins makes it the honest wall-clock start across any number of resumes. A resume instead
 // records itself: resumedAt (this resume's clock) + attempts (fresh run = 1, each resume +1), and
 // threads __stateReset because the resume guard has deliberately cleared a terminal sentinel. The
-// verdict/failedStage/reason resets stay (a resumed run owes a fresh outcome);
+// review/failedStage/reason resets stay (a resumed run owes a fresh outcome);
 // recoveryAttempts/recoveryHistory stay OUT of the seed (they are the park budget's memory).
 export function seedRunStatus(ctx, { resume = false } = {}) {
   const { job, run, agent } = ctx;
@@ -412,7 +423,7 @@ export function seedRunStatus(ctx, { resume = false } = {}) {
     stepIndex: first.index, stepLabel: first.label, stepN: first.n, stepTotal: first.total,
     currentStep: currentStepOf(first),
     lastStage: null,
-    verdict: null,
+    review: null,
     url: null,
     failedStage: null,
     reason: null,
@@ -489,7 +500,7 @@ export function lineFor(s) {
   // The rollup now carries the send state loudly; clearotron-deliver flips sendPending:false on send.
   const pending = s.sendPending === true ? " — 📮 SEND PENDING (email/WhatsApp NOT yet out — run clearotron-deliver)" : "";
   if (s.state === "delivered") {
-    const v = s.verdict ? ` (${s.verdict})` : "";
+    const v = s.tier ? ` (${s.tier})` : "";   // the rating, not the reviewer's sign-off word
     return `- ${head} — delivered${v}${s.url ? ` — ${s.url}` : ""}${pending}`;
   }
   if (s.state === "failed") {

package/driver/publish/index.mjs

@@ -1352,7 +1352,7 @@ export async function publishReport({ runId, codename, reportMd, auditMd, findin
     // null-guard and old rows render byte-identically.
     statement: verdictInfo?.statement ?? undefined,
     caption: fm.overall_caption || undefined,   // the report's own conclusion, which the run list quotes
-    verdict: verdictInfo?.verdict ?? undefined,
+    review: verdictInfo?.verdict ? { signoff: verdictInfo.verdict } : undefined,   // the reviewer's sign-off, not the clearance's answer (ruled 2026-09-22)
     // doc 50 — which framework rated this run (custom vs Generic default) + its ladder, for the archive
     // card, the email table sort/colour and the per-customer index; absent on archived runs forever.
     framework: framework ? { key: framework.framework_key, title: framework.title,

package/driver/publish/report-data.mjs

@@ -98,9 +98,10 @@ export function clearanceReportData({
     auditFile: auditFile || null,
     level: { searchLevel: searchLevel ?? null, stageLabel: stageLabel ?? null },
     framework: framework ? { key: framework.framework_key, title: framework.title, bands: framework.bands.map((b) => ({ label: b.label, tone: b.tone })) } : null,
-    // The one risk statement + its derivation — the exact record every other surface joins (spec 64).
-    verdict: verdictInfo ? {
-      verdict: verdictInfo.verdict ?? null,
+    // The rating + the one risk statement — the exact record every other surface joins (spec 64). Named
+    // `rating` (ruled 2026-09-22): as `verdict` it read as the clearance's answer and carried the reviewer's
+    // sign-off word beside the band. The sign-off stays in the review stage's own record, not the client's.
+    rating: verdictInfo ? {
       tier: verdictInfo.tier ?? null,
       badge: verdictInfo.badge ?? null,
       band: verdictInfo.band ?? null,

package/driver/reference-score.mjs

@@ -45,6 +45,7 @@
 
 import { normalizeElement, consonantSkeleton } from "./form-neighbourhood.mjs";
 import { canonicalJurisdictionCode } from "./jurisdiction-codes.mjs";
+import { territoryTier } from "./territory-tiers.mjs";
 
 export const REFERENCE_SCHEMA_VERSION = 1;
 
@@ -378,6 +379,12 @@ export function inScope(entry, scopeClasses = [], scopeTerritories = []) {
   // that scenario it is five of fifteen entries, which is the difference between a bad round and a fine
   // one. Same shape as the class rule: an entry naming no territory is in scope, and a run that recorded
   // no scope cannot exclude anything.
+  // A WORLDWIDE SCOPE EXCLUDES NOTHING ON TERRITORY, for the reason a missing scope excludes nothing: it
+  // names no territory an entry could fall outside. Without this a worldwide run compared every entry
+  // with the word itself (`GLOBAL`), no entry names that, and the whole reference landed in `excluded`,
+  // an empty score that read as a clean one. Which words mean worldwide is the intake's own list
+  // (`territoryTier`), not a pattern restated here; `canonTerritory` still guesses nothing about `intl`.
+  if (scopeTerritories.some((t) => territoryTier(t) === "worldwide")) return true;
   const terr = (entry?.jurisdictions ?? []).map(canonTerritory).filter(Boolean);
   const scopeTerr = scopeTerritories.map(canonTerritory).filter(Boolean);
   if (scopeTerr.length && terr.length && !terr.some((t) => scopeTerr.includes(t))) return false;
@@ -911,7 +918,8 @@ export function readVerdict({ verdictDoc = null, knockoutFindings = null, status
     const rows = marks
       .map((m) => [m.name, [m.rating, m.ratingQualifier ? `(${m.ratingQualifier})` : null].filter(Boolean).join(" ")].filter(Boolean).join(": "))
       .filter((s) => s.includes(":"));
-    const text = [status?.verdict ? `worst band ${status.verdict}` : null, ...rows].filter(Boolean).join(" · ");
+    const worst = status?.tier ?? status?.verdict ?? null;   // `verdict` on a quick-search record written before the move
+    const text = [worst ? `worst band ${worst}` : null, ...rows].filter(Boolean).join(" · ");
     if (text) return { clean: clean(text), text, source: "knockout-findings.json + status.json — this lane writes no _driver/verdict.json", why: null };
   }
   return { clean: null, text: null, source: null,
@@ -2194,7 +2202,7 @@ export function deliveryLine(run) {
   }
   if (run.poolMeta) {
     const issued = run.poolMeta.issuedAt ? ` published ${run.poolMeta.issuedAt}` : " publication time not recorded";
-    const verdict = run.poolMeta.verdict ?? run.poolMeta.overall;
+    const verdict = run.poolMeta.review?.signoff ?? run.poolMeta.verdict ?? run.poolMeta.overall;
     // NOT PRESERVED stays the honest answer for a pool copy with no stamp — a run archived before the
     // stamp existed, or one whose best-effort write failed. An absent stamp is unknown, not a refusal.
     return `delivered: NOT PRESERVED — this is a pool copy carrying no settle stamp, so the terminal`

package/driver/settle-stamp.mjs

@@ -55,12 +55,15 @@ export const SETTLE_SCHEMA_VERSION = 1;
  * reads a delivery date (turnaround, an SLA, a client-facing "delivered on") would have inherited it.
  * A backfiller must not compose this value at all: call `backfillSettleStamp`, which reads it.
  */
-export function writeSettleStamp(poolRunDir, { state, verdict = null, deliveredAt = null, runId = null, lane = null } = {}) {
+// The outcome words are named for what they are: the full-search lane's reviewer `signoff` (CLEAR /
+// CONDITIONAL / BLOCKING) and the quick-search lane's rating `tier`. Both once shared one `verdict` field,
+// which read as the clearance's answer and held a different vocabulary on each lane.
+export function writeSettleStamp(poolRunDir, { state, signoff = null, tier = null, deliveredAt = null, runId = null, lane = null } = {}) {
   if (!poolRunDir) return { written: false, reason: "no pool run directory — the run published nowhere" };
   if (!state) return { written: false, reason: "no terminal state given — a stamp with no state is the absence it would be mistaken for" };
   const path = join(poolRunDir, SETTLE_FILE);
   try {
-    writeFileSync(path, `${JSON.stringify({ schema_version: SETTLE_SCHEMA_VERSION, state, verdict, deliveredAt, runId, lane, stampedAt: new Date().toISOString() }, null, 2)}\n`);
+    writeFileSync(path, `${JSON.stringify({ schema_version: SETTLE_SCHEMA_VERSION, state, ...(signoff ? { signoff } : {}), ...(tier ? { tier } : {}), deliveredAt, runId, lane, stampedAt: new Date().toISOString() }, null, 2)}\n`);
     // Group-read like every other pool file. Best-effort on its own: a stamp nobody can chmod is still
     // a stamp, and the set-GID pool already grants the group.
     try { chmodSync(path, 0o640); } catch { /* best-effort, exactly as publish's writeRO does */ }
@@ -116,7 +119,11 @@ export function backfillSettleStamp(poolRunDir, runDir, { readStatus = defaultRe
     return { written: false, reason: "status.json says delivered but carries no deliveredAt — the delivery time this backfill exists to preserve is not recorded" };
   return writeSettleStamp(poolRunDir, {
     state: status.state,
-    verdict: status.verdict ?? null,
+    // A status.json written before the sign-off moved carries it as `verdict`, and on the quick-search
+    // lane that field held the rating; each is read back into the field it always meant.
+    ...((status.lane ?? (status.marks ? "knockout" : "clearance")) === "knockout"
+      ? { tier: status.tier ?? status.verdict ?? null }
+      : { signoff: status.review?.signoff ?? status.verdict ?? null }),
     deliveredAt: status.deliveredAt ?? null,
     runId: status.runId ?? null,
     lane: status.lane ?? (status.marks ? "knockout" : "clearance"),

package/driver/status-snapshot.mjs

@@ -80,7 +80,7 @@ const slimRun = (r) => ({
   markName: r.markName, ref: r.ref, classes: r.classes,
   state: r.state, stepN: r.stepN, stepTotal: r.stepTotal, stepLabel: r.stepLabel,
   lastStage: r.lastStage,   // spec 64 C — the RAW stage key ("register-unit:primary-sweep"): what the run is actually doing
-  verdict: r.verdict, statement: r.statement, caption: r.caption,   // spec 64 — THE one risk statement (absent on legacy runs); caption — the report's own conclusion
+  tier: r.tier, statement: r.statement, caption: r.caption,   // the rating, never the reviewer's sign-off; spec 64 — THE one risk statement (absent on legacy runs); caption — the report's own conclusion
   url: r.url, failedStage: r.failedStage, reason: r.reason,
   resetsAt: r.resetsAt,   // rate-limit POSTPONE ONLY: when the cap window clears + the run auto-resumes (ISO)
   recoveryResumesAt: r.recoveryResumesAt ?? null,   // recovery park's backoff clock (A4 split — never conflated with a provider cap)
@@ -100,7 +100,7 @@ export function buildRecentActivity({ reports = [], limit = 12 } = {}) {
     // spec 64 — a delivered run's outcome is THE one risk statement when the run carries it (band +
     // stance in one sentence), never a bare disposition word beside a severity word on another page.
     out.push({ kind: "report", ok, when: r.deliveredAt || r.updatedAt || r.startedAt || "", label: r.markName || r.slug || r.runId,
-      outcome: ok ? (r.statement || r.verdict || "delivered") : `failed${r.failedStage ? " · " + r.failedStage : ""}`,
+      outcome: ok ? (r.caption || r.statement || r.tier || "delivered") : `failed${r.failedStage ? " · " + r.failedStage : ""}`,
       url: r.url || (ok && r.runId ? `${r.runId}/report.html` : "") });
   }
   // ONE explicit time key per row: a report's `when` can come from any of three stamps, and they all sort on

package/driver/suite-census.json

@@ -621,6 +621,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-model-of-the-current-generation-is-named-in-every-spelling.test.mjs": {
+          "tests": 4,
+          "asserts": 13,
+          "skips": 0,
+          "todos": 0
+        },
         "a-name-documented-in-any-example-file-is-documented.test.mjs": {
           "tests": 7,
           "asserts": 16,
@@ -711,6 +717,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-plan-run-that-was-not-answered-is-not-a-drift.test.mjs": {
+          "tests": 5,
+          "asserts": 16,
+          "skips": 0,
+          "todos": 0
+        },
         "a-pool-copy-is-not-a-refusal.test.mjs": {
           "tests": 8,
           "asserts": 28,
@@ -723,12 +735,24 @@
           "skips": 0,
           "todos": 0
         },
+        "a-press-that-starts-late-is-not-a-page-that-did-not-move.test.mjs": {
+          "tests": 5,
+          "asserts": 13,
+          "skips": 0,
+          "todos": 0
+        },
         "a-printed-command-runs-from-where-the-reader-stands.test.mjs": {
           "tests": 15,
           "asserts": 62,
           "skips": 0,
           "todos": 0
         },
+        "a-program-already-here-is-checked-against-the-floor.test.mjs": {
+          "tests": 9,
+          "asserts": 38,
+          "skips": 1,
+          "todos": 0
+        },
         "a-project-cannot-break-the-tree-it-joins.test.mjs": {
           "tests": 13,
           "asserts": 37,
@@ -933,6 +957,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-run-records-the-tier-it-asked-for.test.mjs": {
+          "tests": 5,
+          "asserts": 18,
+          "skips": 0,
+          "todos": 0
+        },
         "a-run-records-the-tool-that-served-it.test.mjs": {
           "tests": 13,
           "asserts": 33,
@@ -1253,7 +1283,7 @@
         },
         "an-absent-portal-bundle-is-not-a-stale-one.test.mjs": {
           "tests": 4,
-          "asserts": 7,
+          "asserts": 13,
           "skips": 0,
           "todos": 0
         },
@@ -1271,7 +1301,7 @@
         },
         "an-archived-run-says-whether-it-was-delivered.test.mjs": {
           "tests": 8,
-          "asserts": 42,
+          "asserts": 44,
           "skips": 0,
           "todos": 0
         },
@@ -2452,8 +2482,8 @@
           "todos": 0
         },
         "engine-probe.test.mjs": {
-          "tests": 34,
-          "asserts": 166,
+          "tests": 35,
+          "asserts": 172,
           "skips": 0,
           "todos": 0
         },
@@ -2465,7 +2495,7 @@
         },
         "engine.anthropic.test.mjs": {
           "tests": 65,
-          "asserts": 239,
+          "asserts": 245,
           "skips": 0,
           "todos": 0
         },
@@ -3412,8 +3442,8 @@
           "todos": 0
         },
         "pipeline.mock.test.mjs": {
-          "tests": 98,
-          "asserts": 820,
+          "tests": 99,
+          "asserts": 827,
           "skips": 0,
           "todos": 0
         },
@@ -3665,7 +3695,7 @@
         },
         "progress.test.mjs": {
           "tests": 26,
-          "asserts": 96,
+          "asserts": 97,
           "skips": 0,
           "todos": 0
         },
@@ -3880,8 +3910,8 @@
           "todos": 0
         },
         "reference-score.test.mjs": {
-          "tests": 63,
-          "asserts": 213,
+          "tests": 65,
+          "asserts": 221,
           "skips": 0,
           "todos": 0
         },
@@ -4048,8 +4078,8 @@
           "todos": 0
         },
         "release-pipeline.test.mjs": {
-          "tests": 120,
-          "asserts": 452,
+          "tests": 121,
+          "asserts": 456,
           "skips": 0,
           "todos": 0
         },
@@ -4133,7 +4163,7 @@
         },
         "report-data.test.mjs": {
           "tests": 5,
-          "asserts": 55,
+          "asserts": 56,
           "skips": 0,
           "todos": 0
         },
@@ -4715,7 +4745,7 @@
         },
         "status-snapshot.test.mjs": {
           "tests": 6,
-          "asserts": 39,
+          "asserts": 40,
           "skips": 0,
           "todos": 0
         },
@@ -5121,6 +5151,12 @@
           "skips": 0,
           "todos": 0
         },
+        "the-engine-floor-can-run-the-current-top-tier.test.mjs": {
+          "tests": 2,
+          "asserts": 5,
+          "skips": 0,
+          "todos": 0
+        },
         "the-engine-step-cannot-loop-on-a-menu-nothing-changed.test.mjs": {
           "tests": 17,
           "asserts": 45,
@@ -5225,7 +5261,7 @@
         },
         "the-install-pages-describe-the-install-this-build-performs.test.mjs": {
           "tests": 11,
-          "asserts": 89,
+          "asserts": 90,
           "skips": 0,
           "todos": 0
         },
@@ -5374,8 +5410,8 @@
           "todos": 0
         },
         "the-portal-shows-only-approved-strings.test.mjs": {
-          "tests": 15,
-          "asserts": 32,
+          "tests": 20,
+          "asserts": 46,
           "skips": 0,
           "todos": 0
         },
@@ -5517,6 +5553,12 @@
           "skips": 0,
           "todos": 0
         },
+        "the-reviewers-sign-off-is-not-the-clearances-answer.test.mjs": {
+          "tests": 3,
+          "asserts": 19,
+          "skips": 0,
+          "todos": 0
+        },
         "the-reviewing-pass-reads-the-lines-a-client-sees-first.test.mjs": {
           "tests": 10,
           "asserts": 27,
@@ -5591,7 +5633,7 @@
         },
         "the-short-surfaces-quote-the-report.test.mjs": {
           "tests": 3,
-          "asserts": 7,
+          "asserts": 9,
           "skips": 0,
           "todos": 0
         },
@@ -5717,7 +5759,7 @@
         },
         "tokens.test.mjs": {
           "tests": 10,
-          "asserts": 51,
+          "asserts": 54,
           "skips": 0,
           "todos": 0
         },