great-cto 2.96.0 → 2.97.0

package/board/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "great_cto",
   "id": "great_cto",
   "description": "Engineering process for solo founders and teams up to 50 engineers. Agents do architecture, code review, QA, and security. You make two decisions per feature.",
-  "version": "2.96.0",
+  "version": "2.97.0",
   "author": {
     "name": "Great CTO",
     "url": "https://github.com/avelikiy/great_cto"
@@ -195,6 +195,10 @@
             "command": "PLUGIN_DIR=$(ls -d ~/.claude/plugins/cache/local/great_cto/*/ 2>/dev/null | sort -V | tail -1 | sed 's|/$||'); node \"${PLUGIN_DIR}/scripts/hooks/reviewer-nudge.mjs\" 2>/dev/null || true",
             "timeout": 5,
             "statusMessage": "Checking reviewer rules for this file..."
+          },
+          {
+            "type": "command",
+            "command": "PLUGIN_DIR=$(ls -d ~/.claude/plugins/cache/local/great_cto/*/ 2>/dev/null | sort -V | tail -1 | sed 's|/$||'); node \"${PLUGIN_DIR}/scripts/hooks/lesson-rules-check.mjs\" 2>/dev/null; true"
           }
         ]
       },

package/board/packages/board/lib/data-readers.mjs

@@ -322,17 +322,62 @@ function getInbox(cwd = process.cwd()) {
     return ageH > 48;
   });
   const sec = readSecStats(cwd);
+
+  // One object, one section.
+  //
+  // These four filters overlap — a P0 that is also blocked matched two of them,
+  // so it rendered as two rows and the nav badge (gates + p0 + blocked) counted
+  // it twice. "Two things need you" when one thing does is a small lie that
+  // costs real attention, and it is the same defect as any other count that
+  // measures the query rather than the world.
+  //
+  // Each task lands in its strongest section only, strongest first: a gate is
+  // waiting on a signature, a P0 is an emergency, blocked is a state, stale is
+  // an observation. The other states it is in are kept on the row as `also`, so
+  // deduplicating loses nothing — the row can still say "and it is blocked".
+  const ORDER = [
+    ['gate', pendingGates],
+    ['p0', p0],
+    ['blocked', blocked],
+    ['stale', stale],
+  ];
+  const homeOf = new Map();      // task id → the section that owns it
+  const alsoOf = new Map();      // task id → the other sections it matched
+  for (const [name, list] of ORDER) {
+    for (const t of list) {
+      const id = t?.id ?? t?.title;
+      if (id === undefined) continue;
+      if (homeOf.has(id)) { alsoOf.set(id, [...(alsoOf.get(id) || []), name]); continue; }
+      homeOf.set(id, name);
+    }
+  }
+  const own = (name, list, limit) => list
+    .filter((t) => homeOf.get(t?.id ?? t?.title) === name)
+    .map((t) => ({ ...t, also: alsoOf.get(t?.id ?? t?.title) || [] }))
+    .slice(0, limit);
+
+  const ownedGates = own('gate', pendingGates, 20);
+  const ownedP0 = own('p0', p0, 10);
+  const ownedBlocked = own('blocked', blocked, 10);
+  const ownedStale = own('stale', stale, 10);
+
   return {
-    pending_gates: pendingGates.slice(0, 20),
-    blocked: blocked.slice(0, 10),
-    p0_open: p0.slice(0, 10),
-    stale_in_progress: stale.slice(0, 10),
+    pending_gates: ownedGates,
+    blocked: ownedBlocked,
+    p0_open: ownedP0,
+    stale_in_progress: ownedStale,
     security: { blocked: sec.blocked, approved: sec.approved },
     summary: {
-      gates: pendingGates.length,
-      blocked: blocked.length,
-      p0: p0.length,
-      stale: stale.length,
+      // Counts of distinct objects, so gates + p0 + blocked is a real total
+      // rather than a sum over overlapping sets.
+      gates: [...homeOf.values()].filter((s) => s === 'gate').length,
+      blocked: [...homeOf.values()].filter((s) => s === 'blocked').length,
+      p0: [...homeOf.values()].filter((s) => s === 'p0').length,
+      stale: [...homeOf.values()].filter((s) => s === 'stale').length,
+      // How many distinct things want attention at all — the number the nav
+      // badge means, stated once here rather than re-derived by every caller
+      // that might re-derive it wrongly.
+      needs_you: [...homeOf.values()].filter((s) => s !== 'stale').length,
     },
   };
 }

package/board/packages/board/lib/docs.mjs

@@ -13,6 +13,7 @@
 // Zero dependencies, like the rest of the board.
 
 import fs from 'node:fs';
+import { judgeFreshness } from '../../../scripts/lib/freshness.mjs';
 import path from 'node:path';
 
 /**
@@ -100,6 +101,38 @@ export function groupFor(rel) {
  * differently — the same reason the pipeline view labels a stale verdict rather
  * than hiding it.
  */
+/**
+ * One document's freshness, as three states rather than a date.
+ *
+ * `unknown` covers two different absences and says which: a file we could not
+ * read at all, and a file that simply declares no date. Neither may render as
+ * fresh — the whole reason `stale_after` exists is that a document nobody can
+ * judge must not look like one that passed.
+ */
+function freshnessOf(abs, nowMs = Date.now(), staleDays = 180) {
+  let text;
+  try { text = fs.readFileSync(abs, 'utf8'); }
+  catch (e) {
+    return { freshness: 'unknown', freshnessBasis: 'unreadable', staleAfter: null,
+      freshnessWhy: `could not read this file: ${String(e?.message || e)}` };
+  }
+  try {
+    const j = judgeFreshness({ text, dateType: 'any', nowMs, staleDays });
+    return {
+      freshness: j.verdict,
+      freshnessBasis: j.basis,
+      staleAfter: j.staleAfter,
+      freshnessWhy: j.basis === 'declared'
+        ? `the author declared it good until ${j.staleAfter}`
+        : (j.date ? `judged by its own date ${j.date} (${j.ageDays}d, threshold ${staleDays}d)`
+                  : 'no stale_after and no date — nothing to judge it by'),
+    };
+  } catch (e) {
+    return { freshness: 'unknown', freshnessBasis: 'unreadable', staleAfter: null,
+      freshnessWhy: String(e?.message || e) };
+  }
+}
+
 export function listDocs(root, { max = MAX_DOCS } = {}) {
   const found = [];
   for (const g of DOC_GROUPS) {
@@ -125,6 +158,12 @@ export function listDocs(root, { max = MAX_DOCS } = {}) {
       group: groupFor(d.rel),
       size: d.size,
       modified: d.modified,
+      // A modification time answers "when was this file last touched", which is
+      // a different question from "is this still true". A typo fix rejuvenates a
+      // document that stopped being true months earlier, and the list showed
+      // only the former. `judgeFreshness` gives three verdicts and names which
+      // rule produced each — see scripts/lib/freshness.mjs.
+      ...freshnessOf(d.abs),
     });
   }
 

package/board/packages/board/lib/routes.mjs

@@ -551,6 +551,113 @@ async function dispatch(req, res, url, cwd) {
     return true;
   }
 
+  // Receipt — does the approval still apply to what is in the tree?
+  //
+  // The reviewing agents already record a hash-bound receipt of the bytes they
+  // read, and those verdicts are in the log this board reads. Nothing surfaced
+  // them, so the top rung of the evidence ladder — the reviewed bytes are the
+  // shipped bytes — was being written and never looked at. An approval that no
+  // longer describes the tree is the one thing a gate button cannot tell you.
+  if (pathname === '/api/receipt') {
+    const c = url.searchParams.get('project') ? resolveProjectCwd(url.searchParams.get('project')) : cwd;
+    let out;
+    try {
+      const { latestApproval, treeReceipt, compareReceipts, mergeBase } = await import('../../../scripts/lib/receipt.mjs');
+      const approval = latestApproval(c);
+      if (!approval?.receipt) {
+        out = { state: 'no-receipt', why: 'no approving verdict carries a receipt yet', agent: approval?.agent || null, ts: approval?.ts || null };
+      } else {
+        const current = treeReceipt(c, { base: approval.receipt.base || mergeBase(c) });
+        const cmp = compareReceipts(approval.receipt, current, { cwd: c });
+        out = { ...cmp, agent: approval.agent, ts: approval.ts };
+      }
+    } catch (e) {
+      // Never "matches" on an error. Not knowing whether the approval still
+      // holds is its own state, and calling it a match would put the strongest
+      // reassurance exactly where the least is known.
+      out = { state: 'unreadable', why: String(e?.message || e), agent: null, ts: null };
+    }
+    res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+    res.end(JSON.stringify(out));
+    return true;
+  }
+
+  // Gate tiers — will this gate wait for you, or announce and proceed?
+  //
+  // A gate card offered Approve/Reject regardless, which is the right control
+  // for a `gated` gate and the wrong one for a tiered gate that already went
+  // ahead. Two states rendered where the machinery has three.
+  //
+  // `enabled` is returned alongside, because a tier is only in force when the
+  // project opted in with `gate-tiering: evidence`. Showing "notify" on a
+  // project that never opted in would describe a stand-down that will not
+  // happen — the mirror image of the defect this whole feature guards.
+  if (pathname === '/api/gate-tiers') {
+    const c = url.searchParams.get('project') ? resolveProjectCwd(url.searchParams.get('project')) : cwd;
+    try {
+      const { tierAll, tieringEnabled } = await import('../../../scripts/lib/gate-tier.mjs');
+      const { fileURLToPath: f2u } = await import('node:url');
+      const libDir = path.dirname(f2u(import.meta.url));
+      const histPath = path.join(libDir, '..', '..', '..', 'tests', 'eval', 'results-history.jsonl');
+
+      let enabled = false;
+      try { enabled = tieringEnabled(fs.readFileSync(path.join(c, '.great_cto', 'PROJECT.md'), 'utf8')); }
+      catch { /* no PROJECT.md — tiering is off, which is the safe reading */ }
+
+      const rows = [];
+      let historyRead = false;
+      try {
+        for (const line of fs.readFileSync(histPath, 'utf8').split('\n')) {
+          if (!line.trim()) continue;
+          try { rows.push(JSON.parse(line)); } catch { /* a bad row is not evidence */ }
+        }
+        historyRead = true;
+      } catch { /* reported as unmeasured below, never as gated-because-fine */ }
+
+      const byAgent = {};
+      for (const t of tierAll(rows)) byAgent[t.agent] = { tier: t.tier, why: t.why, evals: t.evals };
+      res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+      res.end(JSON.stringify({ enabled, measured: historyRead, agents: byAgent }));
+    } catch (e) {
+      // The real error. An agent missing from `agents` reads as unmeasured on the
+      // client, which keeps its gate — the correct direction to be wrong in.
+      res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+      res.end(JSON.stringify({ enabled: false, measured: false, agents: {}, why: String(e?.message || e) }));
+    }
+    return true;
+  }
+
+  // Stand-downs — gates that proceeded WITHOUT being asked, and on what evidence.
+  //
+  // ADR-009: a gate is not the only valid answer, but silence is never one. An
+  // evidence-tiered gate announces instead of waiting, and until now that
+  // announcement had nowhere on this board to land — the record was being
+  // written and nothing read it.
+  if (pathname === '/api/stand-downs') {
+    const c = url.searchParams.get('project') ? resolveProjectCwd(url.searchParams.get('project')) : cwd;
+    let rows = null;
+    let why = '';
+    try {
+      const { readStandDowns } = await import('../../../scripts/lib/stand-down.mjs');
+      rows = readStandDowns(c, { limit: 50 });
+    } catch (e) {
+      // The real error. A handler that names a cause it did not observe sends
+      // the reader looking in the wrong place — this file has done that once.
+      why = String(e?.message || e);
+    }
+    res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+    // Three states, because two cannot carry them: `readStandDowns` returns null
+    // when the ledger exists and could not be read, [] when nothing has stood
+    // down, and rows when something has. "I could not look" must never render as
+    // "nothing happened".
+    res.end(JSON.stringify(
+      rows === null
+        ? { state: 'unreadable', why: why || 'the stand-down ledger exists but could not be read', rows: [] }
+        : { state: rows.length ? 'some' : 'none', why: '', rows },
+    ));
+    return true;
+  }
+
   // Resume — pick up where you left off (last verdicts + WIP + recent decisions)
   if (pathname === '/api/resume') {
     res.writeHead(200, verdictHeaders(cwd, { 'Content-Type': 'application/json' }));

package/board/packages/board/public/index.html

@@ -2284,6 +2284,9 @@ button { font-family: inherit; cursor: pointer; }
       <div class="inbox-page">
         <div class="inbox-greet" id="inbox-greet">Good morning. Here's what needs your decision.</div>
         <div class="inbox-summary" id="inbox-summary"></div>
+        <!-- Top rung of the evidence ladder: are the bytes that were reviewed
+             still the bytes in the tree? Hidden while they match. -->
+        <div id="inbox-receipt" style="display:none;margin:6px 0 2px;font-size:12px"></div>
 
         <!-- Resume — pick up where you left off -->
         <div class="resume-card" id="resume-card" style="display:none">
@@ -2332,6 +2335,17 @@ button { font-family: inherit; cursor: pointer; }
           </div>
           <div id="inbox-gates"></div>
         </div>
+        <!-- Gates that did NOT wait for you. Placed directly under the decisions
+             you still owe, because "what proceeded without me" is the question a
+             tiered gate creates and nothing on this board answered. -->
+        <div class="inbox-section" id="inbox-standdown-section" style="display:none">
+          <div class="inbox-section-head">
+            <span class="dot dot-amber"></span>
+            <h3>Proceeded without you</h3>
+            <span class="inbox-count" id="inbox-standdown-count">0</span>
+          </div>
+          <div id="inbox-standdown"></div>
+        </div>
         <div class="inbox-section" id="inbox-p0-section">
           <div class="inbox-section-head">
             <span class="dot dot-red"></span>
@@ -2754,7 +2768,12 @@ function greetByHour() {
 function renderInbox(d) {
   inboxData = d || {};
   const s = d?.summary || { gates: 0, blocked: 0, p0: 0, stale: 0 };
-  document.getElementById('nav-inbox-count').textContent = s.gates + s.p0 + s.blocked;
+  // `needs_you` counts distinct objects. Summing the three categories double-counted
+  // anything that matched two of them — a P0 that is also blocked read as two things
+  // needing attention when it was one. Older payloads have no `needs_you`, so the sum
+  // stays as the fallback rather than rendering nothing.
+  document.getElementById('nav-inbox-count').textContent =
+    Number.isFinite(s.needs_you) ? s.needs_you : s.gates + s.p0 + s.blocked;
   // Same rule as the all-clear card: "nothing urgent" is a claim about data we
   // may not have. When a read failed, say that instead of reassuring the user.
   const greetTail = anyDegraded()
@@ -2771,6 +2790,8 @@ function renderInbox(d) {
   renderInboxList('inbox-p0', d?.p0_open || [], 'inbox-p0-count', {});
   renderInboxList('inbox-blocked', d?.blocked || [], 'inbox-blocked-count', {});
   renderInboxList('inbox-stale', d?.stale_in_progress || [], 'inbox-stale-count', {});
+  refreshStandDowns();
+  refreshReceipt();
   // Idle focus: collapse the empty sections into one all-clear card when nothing needs a decision.
   const attention = (d?.pending_gates || []).length + (d?.p0_open || []).length
     + (d?.blocked || []).length + (d?.stale_in_progress || []).length;
@@ -2785,6 +2806,150 @@ function renderInbox(d) {
     'Some project data could not be read — counts below are incomplete.');
 }
 
+/**
+ * Does the last approval still describe what is in the tree?
+ *
+ * The reviewing agents already record a hash-bound receipt of the bytes they
+ * read. Nothing on this board looked at it, so the top rung of the evidence
+ * ladder was being written and never read.
+ *
+ * Five readings, and only three of them speak:
+ *   differs     reviewed files changed after the approval — the actionable one
+ *   unreadable  we could not tell. Shown, because "cannot check" must never
+ *               render as "checked and fine"
+ *   extended    new files appeared; nothing reviewed was altered — worth a
+ *               quiet line, since the addition was never reviewed either
+ *   matches     silent. A clean state does not need a banner.
+ *   no-receipt  silent. Nothing has been approved yet; saying so would nag
+ *               about a stage that has not happened.
+ */
+async function refreshReceipt() {
+  const el = document.getElementById('inbox-receipt');
+  if (!el) return;
+  const d = await api(`/api/receipt${pqs()}`);
+  if (!d || d.state === 'matches' || d.state === 'no-receipt') { el.style.display = 'none'; return; }
+
+  const stamp = d.agent ? `${esc(d.agent)}${d.ts ? ' · ' + relTime(d.ts) : ''}` : '';
+  const body = d.state === 'differs'
+    ? `<b>${(d.changed || []).length + (d.removed || []).length} reviewed file(s) changed since ${stamp} approved</b>
+       — the approval no longer describes what is in the tree.
+       <span class="muted">${esc((d.changed || []).slice(0, 4).join(', '))}${(d.changed || []).length > 4 ? ' …' : ''}</span>`
+    : d.state === 'unreadable'
+      ? `<b>Could not check the review receipt</b> — <span class="muted">${esc(d.why || '')}</span>. This is not the same as a clean tree.`
+      : `${(d.added || []).length} file(s) added since ${stamp} approved; nothing reviewed was altered.`;
+
+  const colour = d.state === 'matches' ? 'var(--text3)' : 'var(--status-gate)';
+  el.style.display = '';
+  el.innerHTML = `<span style="color:${colour}">${body}</span>`;
+}
+
+/**
+ * Is this document still true? — which is not the question `modified` answers.
+ *
+ * Three states, and the two that are not `fresh` look different from each other:
+ *
+ *   stale    the author's own `stale_after` has passed, or its date is older
+ *            than the threshold — say so, loudly, it is the actionable one
+ *   unknown  nothing to judge it by, OR the file could not be read. Both are
+ *            shown, because a document nobody could judge must never render the
+ *            same as one that passed. That equivalence is why stale_after exists.
+ *   fresh    nothing — a clean row should stay quiet
+ *
+ * Absent freshness data (an older board payload) also renders nothing, since
+ * inventing a verdict from a missing field is the defect itself.
+ */
+function freshnessBadge(doc) {
+  const v = doc?.freshness;
+  if (!v || v === 'fresh') return '';
+  const unreadable = doc.freshnessBasis === 'unreadable';
+  const colour = v === 'stale' ? 'var(--status-gate)' : 'var(--text3)';
+  const label = v === 'stale' ? 'stale' : (unreadable ? 'could not read' : 'unknown');
+  return `<span title="${esc(doc.freshnessWhy || '')}" style="font-family:var(--mono);font-size:10px;margin-left:6px;padding:0 4px;border:1px solid var(--border);border-radius:3px;color:${colour}">${esc(label)}</span>`;
+}
+
+// Will this gate wait for you, or did the pipeline already go past it?
+//
+// `null` until fetched, and it stays null on any failure — every render path
+// treats "no tier information" as "this gate waits", which is the reading that
+// keeps a human in the loop when we do not know.
+let gateTiers = null;
+async function refreshGateTiers() {
+  const d = await api(`/api/gate-tiers${pqs()}`);
+  gateTiers = d && d.agents ? d : null;
+}
+
+/**
+ * The tier line for a gate card, or '' when it would say nothing true.
+ *
+ * Three readings, not two:
+ *   - tiering off for this project, or the agent unmeasured → nothing shown, the
+ *     gate waits, which is what the buttons already imply
+ *   - `gated` → nothing shown for the same reason
+ *   - `notify` / `notify-thin` → said out loud, because the pipeline did NOT
+ *     wait for this decision and the Approve button alone implies it did
+ */
+function gateTierNote(t) {
+  if (!gateTiers?.enabled || !gateTiers?.measured) return '';
+  const info = gateTiers.agents?.[t.agent];
+  if (!info || info.tier === 'gated') return '';
+  const thin = info.tier === 'notify-thin';
+  const colour = thin ? 'var(--status-gate)' : 'var(--text3)';
+  // `notify-thin` is sound statistics over unmeasured coverage — one eval passed
+  // conclusively, which says nothing about the rest of what this agent is for.
+  // It is the reading most worth a second look, so it reads differently.
+  const caveat = thin ? ' — one eval, coverage unmeasured' : '';
+  return `<div style="margin-top:3px;font-size:11px;color:${colour}">
+    <span style="font-family:var(--mono);border:1px solid var(--border);border-radius:3px;padding:0 4px">${esc(info.tier)}</span>
+    the pipeline did not wait for this${esc(caveat)} · <span title="${esc(info.why || '')}">${esc((info.why || '').slice(0, 90))}</span>
+  </div>`;
+}
+
+// Gates that announced instead of waiting.
+//
+// Three states, not two. `none` hides the section — nothing has proceeded
+// unattended, which is a real and common answer. `unreadable` SHOWS it and says
+// so: a ledger that exists and could not be read must never render the same as
+// an empty one, because the whole reason this record exists is that a
+// stand-down nobody can see is indistinguishable from a gate nobody configured.
+async function refreshStandDowns() {
+  const section = document.getElementById('inbox-standdown-section');
+  const root = document.getElementById('inbox-standdown');
+  const cnt = document.getElementById('inbox-standdown-count');
+  if (!section || !root) return;
+
+  const d = await api(`/api/stand-downs${pqs()}`);
+  if (!d) { section.style.display = 'none'; return; }
+
+  if (d.state === 'unreadable') {
+    section.style.display = '';
+    if (cnt) cnt.textContent = '?';
+    root.innerHTML = `<div class="inbox-row"><span class="ttl">The stand-down ledger could not be read
+      <span class="meta">${esc(d.why || '')} — gates may have proceeded unattended without appearing here</span></span></div>`;
+    return;
+  }
+  if (d.state !== 'some' || !d.rows.length) { section.style.display = 'none'; root.innerHTML = ''; return; }
+
+  section.style.display = '';
+  if (cnt) cnt.textContent = d.rows.length;
+  // Newest first — the ledger appends, but a reader wants the most recent thing
+  // that happened without them.
+  root.innerHTML = d.rows.slice().reverse().map(r => {
+    // `notify-thin` means the gate stood down on ONE eval: sound statistics,
+    // unmeasured coverage. That is the row most worth a second look, so it is
+    // the row that looks different.
+    const thin = r.tier === 'notify-thin';
+    const tierTag = `<span style="font-family:var(--mono);font-size:10px;padding:1px 5px;border-radius:3px;border:1px solid var(--border);color:${thin ? 'var(--status-gate)' : 'var(--text3)'}">${esc(r.tier || 'unknown')}</span>`;
+    return `
+      <div class="inbox-row">
+        <span class="id">gate:${esc(r.gate || '?')}</span>
+        <span class="ttl">${esc(r.agent || 'unknown agent')} proceeded without asking
+          <span class="ttl-desc">${esc(r.evidence || '')}</span>
+          <span class="meta">${tierTag} · <span title="${esc(r.ts || '')}">${r.ts ? relTime(r.ts) : 'no timestamp'}</span></span>
+        </span>
+      </div>`;
+  }).join('');
+}
+
 function renderInboxList(rootId, items, countId, opts = {}) {
   const root = document.getElementById(rootId);
   const cnt = document.getElementById(countId);
@@ -2794,9 +2959,17 @@ function renderInboxList(rootId, items, countId, opts = {}) {
   if (section) section.style.display = items.length ? '' : 'none';
   if (!items.length) { root.innerHTML = ''; return; }
   root.innerHTML = items.map(t => {
+    // A task now appears in one section only, so the states it ALSO matched are
+    // shown here rather than lost. Deduplicating the rows must not deduplicate
+    // the facts: a gate that is also blocked is still blocked, and hiding that
+    // to fix a double count would trade one wrong reading for another.
+    const alsoTag = (t.also || []).length
+      ? `<span title="also matched: ${esc((t.also || []).join(', '))}" style="color:var(--text3)">also ${esc((t.also || []).join(' + '))}</span>`
+      : '';
     const meta = [
       t.agent ? `agent: ${esc(t.agent)}` : '',
       t.priority != null ? PRIORITY_LABEL[t.priority] : '',
+      alsoTag,
       // Gates (the showApprove list) get the exact date+time the decision has been
       // waiting since; other rows keep the compact relative stamp.
       t.updated_at
@@ -2812,16 +2985,21 @@ function renderInboxList(rootId, items, countId, opts = {}) {
          </div>`
       : `<div class="actions"><span style="font-family:var(--mono);font-size:11px;color:var(--text3)">${t.status || ''}</span></div>`;
     const desc = t.description ? `<span class="ttl-desc">${esc(t.description.slice(0, 140))}${t.description.length > 140 ? '…' : ''}</span>` : '';
+    // Only gate rows can stand down, so only they carry the note.
+    const tierNote = opts.showApprove ? gateTierNote(t) : '';
     return `
       <div class="inbox-row" onclick='openSide(${JSON.stringify(t).replace(/'/g, "&apos;")})'>
         <span class="id">${esc(t.id || '')}</span>
-        <span class="ttl">${esc(t.title)}${desc}<span class="meta">${meta}</span></span>
+        <span class="ttl">${esc(t.title)}${desc}<span class="meta">${meta}</span>${tierNote}</span>
         ${actions}
       </div>`;
   }).join('');
 }
 
 async function refreshInbox() {
+  // Tiers first: the gate rows are rendered from this same call, and a row drawn
+  // before the tiers arrive would silently claim every gate is waiting.
+  await refreshGateTiers();
   const d = await api(`/api/inbox${pqs()}`);
   if (d) renderInbox(d);
   refreshPipeline();
@@ -3458,7 +3636,7 @@ async function loadDocs() {
 
   const pipeline = d.pipeline
     ? `<div class="card"><b>Pipeline</b> <span class="muted">— how a feature moves, drawn from shared/pipeline.toml</span>
-         ${renderPipeline(d.pipeline)}
+         ${renderDeclaredPipeline(d.pipeline)}
          <details style="margin-top:8px"><summary class="muted">Mermaid source</summary>
            <pre style="white-space:pre-wrap;font-size:11px">${esc(d.pipeline)}</pre></details></div>`
     : '';
@@ -3481,6 +3659,7 @@ async function loadDocs() {
         <div style="padding:4px 0;border-bottom:1px solid var(--border,#eee)">
           <a href="#" onclick="openDoc('${esc(doc.path)}');return false">${esc(doc.title)}</a>
           <span class="muted" style="font-size:11px"> · ${esc(doc.path)} · ${ago(doc.modified)}</span>
+          ${freshnessBadge(doc)}
         </div>`).join('')}</div>
       </div>`).join('');
 
@@ -3541,7 +3720,18 @@ function projectRootHint() {
 }
 
 /** The pipeline as boxes and gates — no diagram library, so it always renders. */
-function renderPipeline(mermaid) {
+// Named `renderDeclaredPipeline`, not `renderPipeline`, because there is already
+// a `renderPipeline(stages)` above that draws the LIVE rail. Both were declared
+// at the top level of this one <script>, so the later declaration won and every
+// call carrying an array of stages — refreshPipeline() and the SSE handler —
+// reached this mermaid parser instead. It returned a string nobody used and
+// never touched `#pipeline-track`, so the rail stayed the empty div in the
+// markup and the status stayed the hardcoded `idle` beside it.
+//
+// The first section of the first screen therefore read "idle" whatever the
+// pipeline was doing: not an empty state, but a confident wrong answer, which is
+// the failure this project spends its time removing.
+function renderDeclaredPipeline(mermaid) {
   const edges = [];
   for (const line of String(mermaid).split('\n')) {
     const m = line.match(/^\s*(\w+)\s*-->(?:\|([^|]*)\|)?\s*(\w+)/);