shapeup-sdlc 3.15.1 → 3.16.1

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shapeup-sdlc-plugin",
   "displayName": "ShapeUp SDLC Plugin",
-  "version": "3.15.1",
+  "version": "3.16.1",
   "description": "Shape Up SDLC harness for Claude Code: shaping, intake, orient, scope-mapping, building (T0-verified, sandboxed, scope-contracted), evaluation and QA skills orchestrated by a tech-lead.",
   "author": {
     "name": "Liberty Nguyen",

package/AGENTS.md

@@ -36,7 +36,7 @@ Betting Table: PO decides; rejected pitches loop back to raw idea.
 | Wire | ⏸ **L1a.5** — Wiring Review ✚ | `/solution-architect` (`wire`): sole writer of committed `wiring-map.md` — per-UC engine → seam → entry-point call site → affordance, per `project-profile.md` |
 | Map Scopes | ⏸ **L1b** — Board Review (+ substrate disjointness lint) | `/scope-architect` (scope contracts ✦ — sole writer); traceability oracle advisory ✚. A registered requirement that no acceptance criterion grades and no scope claims is **red** here, and L1b prints the `REQ → AC` table: the two ways out are an AC carrying `(covers: REQ-…)` or the PO marking the clause `CUT (PO-approved)`. Red only where the plan is still cheap to change — after L1b nobody re-reads the pitch |
 | Build Vertically | ⏸ **L2** — Board 100% ✅ + T0-green ✦ | per dispatch: compile order → `/task-executor` (--order) → ingest result; T0-verified per attempt (fixtures + DB probe ✦), substrate-sandboxed ✦. Scopes build **concurrently** ✦ — `--parallel-scopes N` caps it (default 4), a scope is released the moment its own dependencies are green, and a scope green in this round is skipped rather than rebuilt. Then the **round build gate** ⚙: the ledger's run command, then the profile's `build_probe` and `launch_probe`, run once per round before EVAL — a red gate ends the round with no verdict and its failing step is compiled into the next round's orders as bugs; a `mobile` profile with no `launch_probe` is warned about every round, so the install/launch risk has an owner |
-| EVAL (once per round) | ⏸ **L3** — Verdict | `/spec-evaluator` (--order), only over a round whose build gate ⚙ is not red: spec- + test-surface-conformance ★, T0 citation ✦; refuted boxes/verdict applied by ingest. The order names the round's build gate artifact and the profile's `launch_probe`, so a `[ui]` row is graded on the app the gate launched rather than recorded as no evidence — a project with no `launch_probe` still gets no on-device grade |
+| EVAL (once per round) | ⏸ **L3** — Verdict | `/spec-evaluator` (--order), only over a round whose build gate ⚙ is not red: spec- + test-surface-conformance ★, T0 citation ✦; refuted boxes/verdict applied by ingest. The order names the round's build gate artifact and the profile's `launch_probe`, so a `[ui]` row is graded on the app the gate launched rather than recorded as no evidence — a project with no `launch_probe` still gets no on-device grade. A PASS names every Test Surface row as its own criterion: one that grades the surface as a group is refused, and the judge is sent back once with the reason |
 | FAIL → round r+1 | — | regression rule ★: bugs + full Test Surface of touched UC. Every criterion the verdict graded FAIL reaches the round, whether or not the judge filed a bug for it, addressed to the scope that owns its use case — a round with a FAIL verdict and nothing to fix is how a run stalls. A row whose check the scope rewrote between a failing trial and a passing one is listed for the judge, who reads it against the row before the pass counts |
 
 ✦ = requires scope contracts (`shapeup/<slug>/scopes/*.md`); ✚ = requires the spine artifacts (`requirements.md`, `wiring-map.md`, `project-profile.md`). Traceability stays advisory until `covers:` is populated. Absent artifact ⇒ arm skipped (non-regression).

package/commands/ship.md

@@ -99,6 +99,8 @@ Additional flags, pass through to `tech-lead` only when the user names them:
 - `--rounds N` → override the outer circuit breaker (build+eval cycles, default 3).
 - `--attempts N` → override the inner circuit breaker (per-scope T0 attempts, default 5;
   no-op on specs without scope contracts).
-- `--orch-model / --exec-model / --eval-model / --qa-model <name>` → override GATE L0.8's
+- `--exec-model / --eval-model / --qa-model <name>` → override GATE L0.8's
   resolved model matrix for this run only (highest precedence over `.claude/settings.local.json`
-  / `.claude/settings.json` / skill defaults).
+  / `.claude/settings.json` / skill defaults). `--orch-model` is shown in the L0 block and changes
+  nothing: the orchestrator is the session already running this command, so its model is the one
+  that session was started with.

package/kernel/gate.mjs

@@ -54,7 +54,7 @@ import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync } fr
 import { parseBoard } from "./reduce/board.mjs";
 import { join, dirname } from "node:path";
 import { runArgs } from "./lib/argv.mjs";
-import { gateAnswerCandidates, gates as gatesPath, LOCAL, resultsDir, tasksDir, hammerCensus, readRunId } from "./lib/paths.mjs";
+import { gateAnswerCandidates, gates as gatesPath, LOCAL, resultsDir, tasksDir, hammerCensus, readRunId, harnessRun } from "./lib/paths.mjs";
 
 export const GATE_IDS = ["L0", "L1a", "L1a.5", "L1b", "L2", "L3", "QA", "H", "L4", "COACH-1"];
 
@@ -327,6 +327,34 @@ export function appendGateLedger(cwd, slug, row) {
   } catch { return false; }
 }
 
+/**
+ * This run's earlier ship sign-off, if it already has one.
+ *
+ * A launched run crosses L4 itself and then closes, and the orchestrator's own closing step resolved
+ * it again afterwards — a second `ship` row, after the close, for a decision already taken. Once the
+ * run is closed, its decided L4 row is returned instead of resolving again. An open run still
+ * re-resolves (the census it reads may have changed), a reopened run has no close, and a paused or
+ * aborted row is not a sign-off.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @param {string|null} runId - The run the resolve belongs to.
+ * @returns {(object|null)} The earlier L4 row, or null.
+ */
+export function priorSignOff(cwd, slug, runId) {
+  if (!runId) return null;
+  let ledger = "";
+  try { ledger = readFileSync(harnessRun(cwd, slug), "utf8"); } catch { return null; }
+  if (!/^closed_status:[ \t]*[^\s~]/m.test(ledger)) return null;
+  let text = "";
+  try { text = readFileSync(gatesPath(cwd, slug), "utf8"); } catch { return null; }
+  for (const line of text.split("\n")) {
+    let row; try { row = JSON.parse(line); } catch { continue; }
+    if (row?.gate === "L4" && row.run_id === runId && row.status === "ok") return row;
+  }
+  return null;
+}
+
 /** Gates this lane will actually hit — used by --verify to catch a set that stalls halfway. */
 export function requiredGates({ autoLevel = "unattended", tiny = false, qa = true } = {}) {
   if (tiny) return ["L0", "L4"];
@@ -483,6 +511,10 @@ export function cli(rawArgv) {
   const gate = args.resolve ?? null;
   if (!gate) die("nothing to do — pass --init, --list, --verify, or --resolve <gate-id>");
 
+  if (gate === "L4" && args.slug) {
+    const prior = priorSignOff(cwd, args.slug, readRunId(cwd, args.slug));
+    if (prior) out({ ok: true, gate: "L4", status: prior.status, decision: prior.decision, source: prior.source, already_resolved_at: prior.at }, 0);
+  }
   const r = narrowToEvidence(resolve(found.set, gate, found.source), cwd, args.slug ?? null);
   if (r.status === "error") die(r.reason);
   // A gate with no `--slug` (e.g. `--file` used ad hoc, outside any run) has nowhere to file a

package/kernel/probe/eval.mjs

@@ -35,7 +35,7 @@ import { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs";
 import { join, resolve, resolve as resolvePath, sep } from "node:path";
 import { createHash } from "node:crypto";
 import { runArgs } from "../lib/argv.mjs";
-import { resultsDir, scopesDir, readRunId, verdictsDir } from "../lib/paths.mjs";
+import { resultsDir, scopesDir, readRunId, verdictsDir, specDir } from "../lib/paths.mjs";
 
 /** Longest `reason` reported. A deviation is prose written by a worker and can run to paragraphs. */
 const REASON_MAX = 400;
@@ -203,6 +203,56 @@ export function verdictProblem(verdict) {
   return null;
 }
 
+/**
+ * The Test Surface row ids the spec declares, in spec order.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @returns {string[]} Every `TS-…` id that opens a table row in a use-case file; [] with no spec tree.
+ */
+export function surfaceRows(cwd, slug) {
+  const dir = join(specDir(cwd, slug), "usecases");
+  let files = [];
+  try { files = readdirSync(dir).filter((f) => /^UC-.*\.md$/.test(f)).sort(); } catch { return []; }
+  const rows = [];
+  for (const f of files) {
+    let text = "";
+    try { text = readFileSync(join(dir, f), "utf8"); } catch { continue; }
+    for (const m of text.matchAll(/^\|\s*(TS-[A-Za-z0-9_-]+)\s*\|/gm)) if (!rows.includes(m[1])) rows.push(m[1]);
+  }
+  return rows;
+}
+
+/**
+ * Whether a PASS grades every Test Surface row by name.
+ *
+ * A PASS that grades the surface as a whole — "device rows", "local rows" — validated like any other
+ * and switched off everything that reads a verdict row by row: the requirements matrix read no
+ * evidence under every covered requirement, a failed row had no criterion to become a bug, and a row
+ * nobody looked at passed with the rest. A row counts as graded when its id appears in a criterion's
+ * text or its `traces_to`. Only a PASS is held to it: a FAIL sends the round back either way.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @param {object} verdict - The WorkResult's `verdict`.
+ * @returns {(string|null)} A reason naming the rows no criterion graded, or null.
+ */
+export function coverageProblem(cwd, slug, verdict) {
+  if (verdict?.overall !== "PASS") return null;
+  const rows = surfaceRows(cwd, slug);
+  if (!rows.length) return null;
+  const named = new Set();
+  for (const c of Array.isArray(verdict.criteria) ? verdict.criteria : []) {
+    const text = [c?.criterion, ...(Array.isArray(c?.traces_to) ? c.traces_to : [])].map((x) => String(x ?? "")).join(" ");
+    for (const m of text.matchAll(/\bTS-[A-Za-z0-9_]+(?:-[A-Za-z0-9_]+)*/g)) named.add(m[0]);
+  }
+  const missing = rows.filter((r) => !named.has(r));
+  if (!missing.length) return null;
+  const shown = missing.slice(0, 8).join(", ") + (missing.length > 8 ? ` and ${missing.length - 8} more` : "");
+  return `the PASS verdict grades ${rows.length - missing.length} of ${rows.length} Test Surface rows by name — ` +
+    `each row is its own criterion, its id in the criterion or its traces_to; ungraded: ${shown}`;
+}
+
 export function citationProblem(cwd, slug, verdict, { round = null } = {}) {
   if (verdict?.overall !== "PASS" && verdict?.overall !== "FAIL") return null;
   if (!isScoped(cwd, slug)) return null;
@@ -247,7 +297,7 @@ export function evalVerdict(cwd, slug, round) {
       ? `the evaluator returned ${status || "no status"}: ${first}`
       : `status ${status || "unknown"} with no PASS/FAIL verdict`), status);
   }
-  const problem = verdictProblem(v) || citationProblem(cwd, slug, v, { round });
+  const problem = verdictProblem(v) || coverageProblem(cwd, slug, v) || citationProblem(cwd, slug, v, { round });
   if (problem) return unfit(problem, status, overall);
   return {
     found: true,

package/kernel/reduce/ingest.mjs

@@ -37,7 +37,7 @@ import { fileURLToPath } from "node:url";
 import { validate } from "../verify/envelope.mjs";
 import { runArgs } from "../lib/argv.mjs";
 import { tasksDir, localRoot, dispatchReceipts, legLedger, readRunId } from "../lib/paths.mjs";
-import { citationProblem, verdictProblem } from "../probe/eval.mjs";
+import { citationProblem, coverageProblem, verdictProblem } from "../probe/eval.mjs";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const RESULT_SCHEMA = JSON.parse(readFileSync(resolve(HERE, "../schemas/work-result.schema.json"), "utf8"));
@@ -692,17 +692,20 @@ export async function cli(rawArgv) {
     process.exit(1);
   }
 
-  // --- T0 citation gate -----------------------------------------------------------------------
-  // A PASS or FAIL on a scoped spec that cites no T0 artifact is not a judgement this run may act
-  // on (see `citationProblem`). `probe eval` refuses it to the round loop; refusing it here as well
-  // keeps the verdict ledger from recording a verdict the loop will never branch on.
+  // --- Verdict gate: structure, row coverage, T0 citation ---------------------------------------
+  // A PASS or FAIL on a scoped spec that cites no T0 artifact, or a PASS that does not grade every
+  // Test Surface row by name, is not a judgement this run may act on (see `citationProblem`,
+  // `coverageProblem`). `probe eval` refuses it to the round loop; refusing it here as well keeps
+  // the verdict ledger from recording a verdict the loop will never branch on.
   if (result.verdict) {
+    const evalSlug = String(result.order_id).split("/")[0];
     const evalRound = Number((String(result.order_id).match(/-r(\d+)$/) || [])[1]) || null;
-    const problem = verdictProblem(result.verdict) || citationProblem(cwd, String(result.order_id).split("/")[0], result.verdict, { round: evalRound });
+    const problem = verdictProblem(result.verdict) || coverageProblem(cwd, evalSlug, result.verdict)
+      || citationProblem(cwd, evalSlug, result.verdict, { round: evalRound });
     if (problem) {
       console.error(`ingest-result: result refused — ${problem}.`);
       console.error(`  The round stays open: re-dispatch the evaluator against its order, which lists`);
-      console.error(`  the T0 artifacts to cite. Nothing was written.`);
+      console.error(`  the T0 artifacts to cite and the spec whose rows it grades. Nothing was written.`);
       process.exit(1);
     }
   }

package/kernel/reduce/ship.mjs

@@ -32,7 +32,7 @@ import { runArgs } from "../lib/argv.mjs";
 import {
   report as reportPath, tasksDir, verdictsDir, trials, evaluationDir, qaDir,
   roundLedger, discoveryLedger, receipt as receiptPath, harnessRun, relShared,
-  activeOrder, runArgsPath, readReceipt, runIdFromReceipt, hammerCensus,
+  activeOrder, runArgsPath, readReceipt, runIdFromReceipt, hammerCensus, LOCAL,
 } from "../lib/paths.mjs";
 import { readTrials } from "../verify/t0.mjs";
 import { ratchetReport } from "../probe/stats.mjs";
@@ -112,16 +112,27 @@ export function boardCensus(cwd, slug) {
  * An id with no resolvable use case becomes a neutral phrase rather than the id: the report loses a
  * pointer that never resolved off this machine anyway, and keeps the sentence around it.
  *
+ * A path into the run trace is the same leak by another spelling: the QA findings section quotes
+ * the hunt report, which points at the discovery ledger by its local path, and the next run's
+ * spec-lint refused the report for it. The path becomes "the run trace", and the sentence stays.
+ *
  * @param {*} text - Any value destined for the committed report.
  * @param {Record<string, string[]>} anchors - Board id → its `use_case_refs`.
- * @returns {string} The text with every `TASK-…` replaced by a stable anchor.
+ * @returns {string} The text with every `TASK-…` replaced by a stable anchor and every run-trace
+ *   path by a phrase.
  */
 export function deboard(text, anchors = {}) {
-  return String(text ?? "").replace(/\bTASK-[A-Za-z0-9][\w.-]*/g, (id) => {
-    const ucs = anchors[id];
-    if (ucs && ucs.length) return ucs.join("/");
-    return "a board task";
-  });
+  const esc = LOCAL.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return String(text ?? "")
+    .replace(/\bTASK-[A-Za-z0-9][\w.-]*/g, (id) => {
+      const ucs = anchors[id];
+      if (ucs && ucs.length) return ucs.join("/");
+      return "a board task";
+    })
+    .replace(new RegExp(`\`?${esc}/[^\\s\`]+\`?`, "g"), (m) => {
+      const tail = (m.replace(/`/g, "").match(/[)\]},.;:'"]+$/) || [""])[0];
+      return `the run trace${tail}`;
+    });
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shapeup-sdlc",
-  "version": "3.15.1",
+  "version": "3.16.1",
   "description": "Shape Up for coding agents \u2014 with gates the agent can't talk its way past. Harness for Claude Code.",
   "bin": {
     "shapeup-sdlc": "bin/init.mjs"

package/skills/spec-evaluator/SKILL.md

@@ -175,6 +175,11 @@ round. Write it so someone without your context can answer it in one reply.
 }
 ```
 
+**Every Test Surface row is its own criterion.** Name the row's id (`TS-05-05`) in `criterion`, one
+row per entry — never a range (`TS-01-04/05`) and never a group ("device rows"). Ingest refuses a
+PASS that leaves any row of the spec unnamed, because the requirement matrix, the next round's bugs
+and the rewritten-check list all read the verdict one row at a time.
+
 **`traces_to` is copied, not invented.** Fill it from the `(covers: REQ-…)` clause of the
 acceptance criteria your criterion grades: the AC already carries the link, written when the plan
 was reviewed, and you record which requirement your criterion maps back to. An AC with no `covers:`
@@ -200,6 +205,7 @@ separation is the whole point of the architecture.
 ## Verification checklist
 
 - [ ] Every criterion traces to committed spec text (UC/domain-model/contract/Done-when/Non-Go)
+- [ ] Every Test Surface row is graded as its own criterion, by id
 - [ ] `traces_to` copied from the graded ACs' `covers:` clauses — empty where they carry none
 - [ ] Every PASS cites a confirming probe; every FAIL cites evidence or "NO EVIDENCE"
 - [ ] Every FAIL was re-probed once; confidence assigned per the ledger rule

package/skills/tech-lead/SKILL.md

@@ -110,11 +110,11 @@ failed, launch from the install path and have the operator `/add-dir` the plugin
 did not actually receive from the PO — an unattended lane with no answer for a gate is meant to
 `abort` (see `harness gate`'s `on_missing`), not silently proceed.
 
-## Step 4 — GATE L4 — Ship Sign-Off (this skill's own gate; the workflow never sees it)
+## Step 4 — GATE L4 — Ship Sign-Off
 
-FIRST freeze the evidence — run state is gitignored, so `shapeup/<slug>/REPORT.md` (already
-written by `shapeup-run.js` via `harness reduce ship`, or write it now on a `gate_h` close) is all a
-teammate sees. Then RESOLVE the gate — `references/gates.md` GATE L4 has the call — and emit:
+A `shipped`/`escalated` return already crossed L4 in the run and froze `REPORT.md`: never resolve it
+again (a row after the close is a second sign-off). A return that did not reach L4 freezes the report
+now and RESOLVES the gate (`references/gates.md` GATE L4). Either way, emit:
 
 ```
 ⏸ GATE L4 — Ship Sign-Off

package/skills/tech-lead/references/gates.md

@@ -571,7 +571,9 @@ On confirm:
 - If the PO provides substantive feedback (not just 'y' or empty) → automatically delegate via Agent (model: exec — see references/protocol.md "Invocation mechanism"): Skill(shapeup-sdlc-plugin:coach) with the provided feedback for RLHF. The coach runs its own GATE COACH-1 to have the PO categorize each rule, then files it under the responsible skill in `shapeup/knowledge-base/<skill>.md` (committed → team-shared). Coachable: `task-executor`, `ba-pitch-analyzer`, `qa-edge-hunter`, `orient`, `scope-architect`, `solution-architect` (each reads its own file at the top of its next run) and `tech-lead` (workflow guidance, read at the next GATE L0). Guidance never decides a gate: a filed rule may add a question or a check to a gate block, never an answer. The tech lead does not categorize the feedback itself — that is the coach's gate, by design (no assumptions).
 - Then output → `✅ [slug] [shipped & deployed | built & verified, deploy pending] — [r] rounds, verdict PASS.`
 
-**Resolve the gate itself before any of the above** — this is the decision that shipped the run,
+**A launched run already crossed L4 — never resolve it again after a `shipped` or `escalated`
+return; a second row after the close is a second sign-off.** In the prose lane, **resolve the gate
+itself before any of the above** — this is the decision that shipped the run,
 and without it the trace holds no record of that decision at all: `node
 "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" gate --resolve L4 --slug <slug>
 [--file <path>|--preset <name>]`. Exit 0 (`decision=ship|hold`) — render the block above and close

package/skills/tech-lead/references/protocol.md

@@ -507,8 +507,9 @@ Effect: one feature-level pass over the running app against all AC + Done-when;
         verdicts, refuted boxes, T0 citations). It touches NO task file and NO board.
 ingest-result <results/evaluate-r<r>.json>: appends the .verdicts JSONL ledger, un-ticks the
         refuted AC boxes, sets eval_verdict frontmatter — the judge returns data, ingest writes.
-        A verdict on a scoped spec that cites no T0 artifact is refused and the round stays
-        open: re-dispatch the evaluator, do not advance the round.
+        A verdict on a scoped spec that cites no T0 artifact, or a PASS that does not name
+        every Test Surface row as its own criterion, is refused and the round stays open:
+        re-dispatch the evaluator once with the refusal's reason, do not advance the round.
 Read back: EVAL-FEATURE-<slug>.md → verdict (pass|fail) + the bug list (each bug has
         task ref, severity, file:line, expected vs actual).
 ```

package/skills/tech-lead/workflows/shapeup-run.js

@@ -112,6 +112,10 @@ const argProblems = validateArgs(args);
 if (argProblems.length) return { status: "aborted", aborted_at: "args", reason: argProblems.join("; ") };
 
 const slug          = args.slug;
+// The report's path, never the ship command's one-line `detail`: that is a sub-agent's sentence, and
+// it reached the RunReturn's `report` field in place of the path the orchestrator opens. The
+// committed root is a fixed name, so the path is known without reading anything.
+const REPORT_PATH = `shapeup/${slug}/REPORT.md`;
 const KERNEL        = `${args.pluginRoot}/kernel/harness.mjs`;
 const execModel     = args.models.exec;
 const evalModel     = args.models.eval;
@@ -697,7 +701,7 @@ async function settleAtGateH(ret) {
     status: "shipped", verdict, rounds_used: round, after: "gate_h", breaker: ret.breaker ?? null,
     census: h.verdict, cut_list: h.cut_list, green_scopes: ret.green_scopes,
     unapplied_results: ret.unapplied_results || [], qa_findings: 0,
-    report: ship.detail || `shapeup/${slug}/REPORT.md`,
+    report: REPORT_PATH,
   });
 }
 
@@ -1868,8 +1872,8 @@ while (verdict !== "pass" && round <= maxRounds) {
     // freezes at GATE L4 has to say that as plainly as the gate block already does.
     verdict = "not-evaluated";
   } else {
-    const e = await worker({
-      skill: "spec-evaluator", operation: "evaluate", schema: EVAL, phase: "Eval", label: `eval:r${round}`,
+    const evalOnce = (label, extraNote = "") => worker({
+      skill: "spec-evaluator", operation: "evaluate", schema: EVAL, phase: "Eval", label,
       model: evalModel, round,
       // No `t0_artifacts` here, deliberately: `harness compile` derives them from the round's green
       // T0 verdicts on disk, for every lane — this script could only name paths it was told about.
@@ -1877,12 +1881,22 @@ while (verdict !== "pass" && round <= maxRounds) {
       // artifact and the project profile, so the judge gets the launch evidence without this script
       // having to carry it.
       payload: { dimensions: evalDims, run_cmd: rs.run_cmd, round },
-      extra: "Evaluate the running feature against every acceptance criterion and Done-when. One feature-level pass; cite every artifact the order lists under t0_artifacts, re-hashing each yourself.",
+      extra: "Evaluate the running feature against every acceptance criterion and Done-when. One feature-level pass; cite every artifact the order lists under t0_artifacts, re-hashing each yourself." + extraNote,
     });
+    let e = await evalOnce(`eval:r${round}`);
     if (e.__failed) return await withWarnings(diedAt("L3", e));
     // The pass/fail branch is decided from the WorkResult on disk, not from the dispatching
     // agent's own summary of it (`e.overall`) — see EVAL_VERDICT's comment for why.
-    const ev = await query(`probe eval --slug ${slug} --round ${round}`, EVAL_VERDICT, "Eval", `verdict:r${round}`);
+    let ev = await query(`probe eval --slug ${slug} --round ${round}`, EVAL_VERDICT, "Eval", `verdict:r${round}`);
+    // A verdict the kernel refused — a PASS that grades the surface as a group, a missing citation —
+    // is a correctable answer, not a dead judge: the judge is sent back once with the refusal's own
+    // words, and only a second refusal ends the round.
+    if (ev && !ev.ok && ev.overall && ev.reason) {
+      log(`EVAL r${round} — verdict refused (${ev.reason}); the judge is sent back once`);
+      e = await evalOnce(`eval:r${round}:again`, ` Your previous verdict for this round was refused: ${ev.reason}. Grade again and correct that.`);
+      if (e.__failed) return await withWarnings(diedAt("L3", e));
+      ev = await query(`probe eval --slug ${slug} --round ${round}`, EVAL_VERDICT, "Eval", `verdict:r${round}:again`);
+    }
     if (!ev) return await withWarnings(diedAt("L3", nullFail(`verdict:r${round}`)));
     // A round with no verdict to act on is NOT a dead worker. An evaluator that refused the round
     // wrote a result saying why, and `probe eval` carries it as `reason`; reported as "died after
@@ -2002,7 +2016,7 @@ return await withWarnings({
   rounds_used: round,
   dims_not_evaluated: ALL_DIMS.filter((d) => !evalDims.includes(d)),
   qa_findings: qaFindings,
-  report: ship.detail || `shapeup/${slug}/REPORT.md`,
+  report: REPORT_PATH,
 });
 
 // =============================================================================================