task-pipeline-skill 1.72.0 → 1.74.0

package/plugins/task-pipeline/skills/task-pipeline/graph.schema.json

@@ -117,7 +117,7 @@
           "not": {
             "pattern": "[\\n\\r]"
           },
-          "description": "**How this node will be closed** \u2014 the command a verifier runs, or the named judgement that stands in where no command can (`references/gates.md`'s third gate type: name the judge, record the verdict AS judgement). Its output becomes the node's `evidence` row.\n\nRequired on every node except a `parked` one, and that is the whole point of the field: `agents/verifier.md` tells the verifier to run *the check this node names*, so a node with none leaves it the two options that same paragraph forbids \u2014 invent a check, or run everything. Shipped doctrine read a field the schema did not have (B-080); the field the doctrine reads now exists.\n\nOne string, never a list, because the requirement it serves is singular throughout \u2014 one input, one job, one output, one owner, **one** completion test. A node needing two unrelated checks is a node doing two jobs, and the answer is to split it rather than to widen this field. One gate made of two commands is `a && b`, which is still one gate.\n\nA `parked` node is exempt because it is the one node nobody will close, and a placeholder there \u2014 *n/a, parked* \u2014 is the confidence-without-correctness this schema refuses everywhere else. The field survives a park: `park` sets the status and never removes what the node said it would run."
+          "description": "**How this node will be closed** — the command a verifier runs, or the named judgement that stands in where no command can (`references/gates.md`'s third gate type: name the judge, record the verdict AS judgement). Its output becomes the node's `evidence` row.\n\nRequired on every node except a `parked` one, and that is the whole point of the field: `agents/verifier.md` tells the verifier to run *the check this node names*, so a node with none leaves it the two options that same paragraph forbids — invent a check, or run everything. Shipped doctrine read a field the schema did not have (B-080); the field the doctrine reads now exists.\n\nOne string, never a list, because the requirement it serves is singular throughout — one input, one job, one output, one owner, **one** completion test. A node needing two unrelated checks is a node doing two jobs, and the answer is to split it rather than to widen this field. One gate made of two commands is `a && b`, which is still one gate.\n\nA `parked` node is exempt because it is the one node nobody will close, and a placeholder there — *n/a, parked* — is the confidence-without-correctness this schema refuses everywhere else. The field survives a park: `park` sets the status and never removes what the node said it would run."
         },
         "evidence": {
           "type": [
@@ -145,87 +145,100 @@
             "pattern": "\\S"
           },
           "description": "What this node MUTATES — paths, register names, remote resource ids. `references/planning.md` states the rule the frontier needs: *distinct is not the same as independent, and the check is what they touch, never what they are called.* That rule lived in the markdown plan, and the graph replaced the plan as the thing deciding what runs next — so `next` could hand two agents two runnable nodes that write the same file, with nothing able to report it.\\n\\nOptional, and its absence is DISCLOSED rather than treated as «touches nothing»: `next` prints how many frontier nodes declared no targets, because a quiet run and a checked one must not look alike."
-        }
-      },
-      "allOf": [
-        {
-          "if": {
-            "properties": {
-              "status": {
-                "not": {
-                  "const": "parked"
+        },
+        "certification": {
+          "type": "object",
+          "description": "What the three-tier certification recorded for this node. Written by `graph.py certify` on every round, pass or fail: a failing round that wrote nothing would erase the only evidence that a node is churning, which is the number the loop-guard ceiling reads.",
+          "additionalProperties": false,
+          "required": [
+            "round",
+            "tiers",
+            "at",
+            "history"
+          ],
+          "properties": {
+            "round": {
+              "type": "integer",
+              "minimum": 1
+            },
+            "tiers": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": [
+                "unit",
+                "seam",
+                "product"
+              ],
+              "properties": {
+                "unit": {
+                  "enum": [
+                    "pass",
+                    "fail"
+                  ]
+                },
+                "seam": {
+                  "enum": [
+                    "pass",
+                    "fail"
+                  ]
+                },
+                "product": {
+                  "enum": [
+                    "pass",
+                    "fail"
+                  ]
                 }
               }
             },
-            "required": [
-              "status"
-            ]
-          },
-          "then": {
-            "required": [
-              "check"
-            ],
-            "properties": {
-              "check": {
-                "type": "string",
-                "minLength": 1,
-                "pattern": "\\S"
-              }
-            }
-          }
-        },
-        {
-          "if": {
-            "properties": {
-              "status": {
-                "const": "done"
-              }
+            "at": {
+              "type": "string",
+              "minLength": 1
             },
-            "required": [
-              "status"
-            ]
-          },
-          "then": {
-            "required": [
-              "evidence"
-            ],
-            "properties": {
-              "evidence": {
-                "type": "array",
-                "minItems": 1,
-                "items": {
-                  "type": "string",
-                  "minLength": 1,
-                  "pattern": "\\S",
-                  "description": "At least one non-whitespace character. `minLength: 1` alone accepts a single space, which is the one shape where this schema and `graph.py`'s verdict gate disagreed — the gate strips, the schema counted. A cross-check fixture comparing the two found it."
+            "history": {
+              "type": "array",
+              "minItems": 1,
+              "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": [
+                  "unit",
+                  "seam",
+                  "product"
+                ],
+                "properties": {
+                  "unit": {
+                    "enum": [
+                      "pass",
+                      "fail"
+                    ]
+                  },
+                  "seam": {
+                    "enum": [
+                      "pass",
+                      "fail"
+                    ]
+                  },
+                  "product": {
+                    "enum": [
+                      "pass",
+                      "fail"
+                    ]
+                  }
                 }
               }
             }
           }
+        }
+      },
+      "allOf": [
+        {
+          "$ref": "#/definitions/rule_check_unless_parked"
         },
         {
-          "if": {
-            "properties": {
-              "status": {
-                "const": "parked"
-              }
-            },
-            "required": [
-              "status"
-            ]
-          },
-          "then": {
-            "required": [
-              "parked_reason"
-            ],
-            "properties": {
-              "parked_reason": {
-                "type": "string",
-                "minLength": 1,
-                "pattern": "\\S"
-              }
-            }
-          }
+          "$ref": "#/definitions/rule_done_needs_evidence"
+        },
+        {
+          "$ref": "#/definitions/rule_parked_needs_reason"
         }
       ]
     },
@@ -283,6 +296,88 @@
           "description": "The reason, written for a person reading it later. The non-whitespace pattern is required for the same reason `parked_reason` needs one: `minLength: 1` counts a space."
         }
       }
+    },
+    "rule_check_unless_parked": {
+      "description": "B-080's rule, factored out of `node.allOf` so it is stated once and referenced. Factoring it exposed B-079: `test/validate.py`'s `_conditionals()` recursed into `allOf` and never followed a `$ref`, so a schema that shares a rule this way read as a schema with NO conditionals and both REQ-006 and REQ-012 were reported missing from a schema that states them. The shipped schema now uses the `$ref` form, so the deref branch is exercised by every run of the gate rather than by one fixture.",
+      "if": {
+        "properties": {
+          "status": {
+            "not": {
+              "const": "parked"
+            }
+          }
+        },
+        "required": [
+          "status"
+        ]
+      },
+      "then": {
+        "required": [
+          "check"
+        ],
+        "properties": {
+          "check": {
+            "type": "string",
+            "minLength": 1,
+            "pattern": "\\S"
+          }
+        }
+      }
+    },
+    "rule_done_needs_evidence": {
+      "description": "REQ-006 as draft-07 states it: `done` implies at least one non-whitespace evidence string. Referenced from `node.allOf`, never inlined, so the rule has one home.",
+      "if": {
+        "properties": {
+          "status": {
+            "const": "done"
+          }
+        },
+        "required": [
+          "status"
+        ]
+      },
+      "then": {
+        "required": [
+          "evidence"
+        ],
+        "properties": {
+          "evidence": {
+            "type": "array",
+            "minItems": 1,
+            "items": {
+              "type": "string",
+              "minLength": 1,
+              "pattern": "\\S",
+              "description": "At least one non-whitespace character. `minLength: 1` alone accepts a single space, which is the one shape where this schema and `graph.py`'s verdict gate disagreed — the gate strips, the schema counted. A cross-check fixture comparing the two found it."
+            }
+          }
+        }
+      }
+    },
+    "rule_parked_needs_reason": {
+      "description": "REQ-012: a parked node names why it is parked. Referenced from `node.allOf`.",
+      "if": {
+        "properties": {
+          "status": {
+            "const": "parked"
+          }
+        },
+        "required": [
+          "status"
+        ]
+      },
+      "then": {
+        "required": [
+          "parked_reason"
+        ],
+        "properties": {
+          "parked_reason": {
+            "type": "string",
+            "minLength": 1,
+            "pattern": "\\S"
+          }
+        }
+      }
     }
   }
 }

package/plugins/task-pipeline/skills/task-pipeline/references/acceptance.md

@@ -319,6 +319,29 @@ spends its length refusing.
 
 ## GATE (manual)
 
+> **Acceptance policy `AP-1` · owner: the operator of the project running this pipeline ·
+> in force since 2026-08-20 · supersedes: the unversioned ladder that stood before it.**
+>
+> This block is the policy, and naming it that closes a contradiction that stood in the
+> shipped doctrine. [`gates.md`](gates.md) → *Axis A — the stage gate type* says which stages are
+> manual is the operator's decision and that **the framework fixes no stage count and no
+> gate assignment** — while the ladder below fixes twelve criteria and the statuses they
+> may take. Both were true and neither was scoped, so a reader could take either as the
+> rule.
+>
+> **The scope, stated once:** `gates.md`'s sentence governs the **pipeline's shape** — how
+> many stages a project runs and which of them are `auto`, `judgment` or `manual`, all of
+> it in the project's own `pipeline.json`. `AP-1` governs **what stage 10's manual gate
+> asks when a project runs one.** A project may drop stage 10, or make it `auto` for a
+> class of work, and `AP-1` then does not apply to it; a project that keeps it manual gets
+> these criteria and this vocabulary, not a per-run selection from them.
+>
+> **Changing it is a decision, not an edit.** An amended criterion moves the version to
+> `AP-2` and lands with a row in the project's decision register, because a policy that can
+> be edited silently is the *«recorded in the slot reserved for what a machine
+> established»* failure one level up: an acceptance standard nobody can cite by version is
+> one every run re-negotiates.
+
 All of:
 
 1. **Every shipped REQ has a verification row, and every row names a REQ its own run

package/plugins/task-pipeline/skills/task-pipeline/references/audit.md

@@ -47,12 +47,21 @@ The method most audits use is **horizontal**: compare the documents against each
 other, then do it again. It works, and then it fails in a way that is invisible
 from inside it. Measured over seven passes on a production repository:
 
-| Pass | Findings | …of which the previous pass's own fixes caused |
-|---|---|---|
-| 4 | 12 | 5 |
-| 5 | 17 | 9 |
-| 6 | 13 | 10 |
-| 7 | 19 | 4 |
+| Pass | Findings | …of which the previous pass's own fixes caused | Self-inflicted share |
+|---|---|---|---|
+| 4 | 12 | 5 | 42% |
+| 5 | 17 | 9 | 53% |
+| 6 | 13 | 10 | 77% |
+| 7 | 19 | 4 | 21% — see the note below |
+
+**The trend above is measured over passes four to six, and pass seven is not part of
+it.** 42% → 53% → 77% is the decay this section teaches; the seventh pass fell back to
+4 of 19 and **the record does not say what that pass did differently.** The row stays,
+with the gap named, for two reasons. Deleting a measured row to protect a claim is the
+opposite of what this file asks of every gate it describes — and the vertical pass
+described below cannot be credited for the drop, because it is a separate pass over the
+same repository, not the seventh. Whatever pass seven did, it is unrecorded, and an
+unrecorded cause is what this table has to say about it.
 
 By pass six the audit was **mostly repairing itself**. Not fatigue — arithmetic.
 Each pass edits the corpus the next pass reads, so the newest edits are always the

package/plugins/task-pipeline/skills/task-pipeline/references/certification.md

@@ -0,0 +1,146 @@
+# Certification — three readings at three distances, and all three must pass
+
+A node is not closed by one agent's opinion. It is closed by **three independent
+readings at escalating visibility**, and the run may not advance until all three
+pass.
+
+## Contents
+
+- Why one verifier is not enough, stated as the failure it produces
+- The three tiers
+- Blind, and it is the whole design
+- A pass has to mean something, so two rules have teeth
+- The report, and where each field lands
+- The commands
+- The fix cycle, and its ceiling
+- What this costs, said out loud
+- Rationalizations
+
+## Why one verifier is not enough, stated as the failure it produces
+
+A verifier reads the diff it was handed. That is not a shortcoming of the agent; it
+is the definition of its context. And it means a whole class of defect is invisible
+to it by construction:
+
+- the change is correct where it was made, and a **caller's contract moved** under it
+- a **second implementation of the same rule** did not get the fix
+- a **documented behaviour** is now false, and the document still reads as true
+- **another feature** reaches the same path and nobody considered the interaction
+
+None of these is a bug in the changed lines. All of them ship. Each is found by
+looking one level further out than the change — which is a different reading, not a
+longer one, because the context that finds it is the context that excludes the diff.
+
+## The three tiers
+
+| Tier | Subject | Characteristic finding |
+|---|---|---|
+| `unit` | the changed functions, classes and branches, plus the node's own `check` | a branch nothing exercises; a boundary that moved |
+| `seam` | everything that can reach the change — callers, callees, implementors, shared state, the neighbours' tests | a contract that moved under a dependent; the duplicate that did not get the fix |
+| `product` | documentation, scenarios, user-visible strings, and the neighbouring features that share this path | a documented behaviour that is now false; an interaction nobody listed |
+
+Agents: [`../../../agents/verifier-unit.md`](../../../agents/verifier-unit.md),
+[`verifier-seam.md`](../../../agents/verifier-seam.md),
+[`verifier-product.md`](../../../agents/verifier-product.md).
+
+## Blind, and it is the whole design
+
+**The three run in parallel and no tier reads another's report.** Three readings
+that inform each other are one opinion with three signatures — and the failure mode
+is specific: an agent that has just read a convincing account of the implementation
+will paraphrase it back as product truth. The disagreement between blind readings is
+the instrument, so `graph.py certify` refuses a report whose prose cites another
+tier's verdict.
+
+Dispatch all three in one message so they run concurrently. Give each the node id,
+its `serves`, and the diff — nothing else, and never another tier's output.
+
+## A pass has to mean something, so two rules have teeth
+
+**A tier cannot pass on an empty `scope`.** `scope` is what the tier actually
+opened, with `file:line`. A report that names nothing it read is a rubber stamp, and
+three rubber stamps cost three times one verifier while reading as three times the
+assurance — strictly worse than the single verdict it replaced. `certify` refuses it
+by name.
+
+**A tier cannot pass while carrying a `breaks` finding.** There are two severities
+and no third, because a certification that admits a maybe admits everything:
+
+- **`breaks`** — the node is not done. Carries a `check`: the command or judgement
+  that will prove the fix, for the same reason `replan.add` does. The finding
+  becomes a node the next round has to close, and handing that node the absence is
+  how the defect returns one round later.
+- **`risk`** — found, judged survivable, and named. It ships, and it reaches the
+  closing verdict as a blocker with `can_continue_around: true`, which is exactly
+  what a named survivable finding is.
+
+## The report, and where each field lands
+
+Eight keys, all required, `[]` a valid answer and silence not one. On a pass
+`certify` assembles the canonical seven-key verdict that
+[`work-graph.md`](work-graph.md) already specifies, and no field is used for
+something it does not mean:
+
+| Tier field | Becomes | Because |
+|---|---|---|
+| `confirms` | `done` | asked for, and now true |
+| `not_examined` | `not_verified` | present, and no check touched it |
+| `findings` at `risk` | `blockers`, `can_continue_around: true` | found, judged survivable, named |
+| `evidence` | `evidence`, prefixed with the tier | the command and what it printed |
+
+`certify` runs the assembled verdict through the same `verdict_violations` gate
+`close` will apply, so a certification cannot hand the run a verdict its own
+consumer refuses.
+
+## The commands
+
+```bash
+# three reports in, one verdict out — exits 1 if any tier failed
+graph.py certify --node N-007 \
+    --tier unit.json --tier seam.json --tier product.json
+
+# unchanged, and still the only thing that moves the graph
+graph.py close --verdict .task-pipeline/verdict-N-007.json
+```
+
+## The fix cycle, and its ceiling
+
+A failing round **records itself and leaves the node open.** `certification` on the
+node carries the round number, this round's three verdicts and the history of every
+round — written on failure too, because a failing round that wrote nothing would
+erase the only evidence that a node is churning.
+
+The cycle is: `certify` → fail → the `breaks` findings become nodes (each already
+carrying its `check`) → fix → `certify` again, round `N+1`. Same three tiers, same
+blind dispatch. A tier that passed in an earlier round is **re-run**, because the
+fix is a new change and the level it passed on is not the level it now faces.
+
+**At the ceiling the gate measures rather than stops** —
+[`loop-guard.md`](loop-guard.md). `--ceiling` defaults to 3. At or over it, `certify`
+still runs and still reports the tiers; what it adds is the name of the tier that
+has failed **every** round. A run spinning on one level needs the operator to see
+*which* level:
+
+- the same tier every round → the level is being misread, or the node is the wrong
+  shape. Not one fix away. Re-plan the node, do not attempt round four.
+- different tiers each round → churn across levels. Usually one requirement that
+  was never decided, surfacing at whichever distance looks at it.
+
+## What this costs, said out loud
+
+Three agents per node instead of one. That is the price of the visibility, and it is
+paid per node rather than per run. The three are dispatched in parallel, so the
+wall-clock cost is roughly one reading; the token cost is three. A node whose
+`check` is mechanical and whose blast radius is genuinely nil still pays it — and a
+tier with nothing to find says so in `scope` and `not_examined` rather than being
+skipped, because **a skipped level and a clean level are indistinguishable
+afterwards**, and only one of them is evidence.
+
+## Rationalizations
+
+| Temptation | Why it is wrong |
+|---|---|
+| «All three would say the same thing» | Then all three say it, at a cost you already know, and the run has three signatures instead of one guess about what the other two would have found |
+| «The seam tier can read the unit report first — it saves tokens» | It saves tokens by removing the second opinion. The reports are cheap; the independence is the product |
+| «Tier 3 passed last round, skip it» | The fix is a new change. A tier's pass is about the tree it read, and that tree moved |
+| «Round 4 will get it» | Read the ceiling's output. The same tier failing three times is a planning defect wearing a verification failure's clothes |

package/plugins/task-pipeline/skills/task-pipeline/references/gates.md

@@ -58,6 +58,15 @@ not the operator confirming it is what they asked for, and no amount of checking
 makes it one. Which stages are manual is the **operator's** decision, recorded in
 their `pipeline.json`; the framework fixes no stage count and no gate assignment.
 
+**That sentence is about the pipeline's SHAPE, and nothing else.** It says a project
+chooses how many stages it runs and which of them wait for a person. It does not say the
+criteria inside a gate are per-run negotiable: where a project keeps stage 10 manual, what
+that gate asks is [`acceptance.md`](acceptance.md)'s policy **`AP-1`**, which is versioned
+and has an owner. The two rules stood side by side unscoped until 2026-08-20 (`B-091`), and
+a reader could take either as the whole rule — *the framework fixes nothing* and *the ladder
+is fixed* are both in the shipped doctrine, which is how an acceptance standard becomes
+something every run re-argues.
+
 ## The judgment gate — a ruling is not a measurement
 
 Two types were not enough, and the gap was not cosmetic. A reviewer's ruling, a check that

package/plugins/task-pipeline/skills/task-pipeline/references/portability.md

@@ -71,6 +71,7 @@ a row pointing outside the bundle is the defect this file exists to catch.
 | What a spec must lock, the UX-track order, the module dossier | `references/spec.md` |
 | The zero-context plan format, parallel groups, set equality | `references/planning.md` |
 | The work graph: its fields, the verbs and their exit codes, and the three invariants a schema cannot state | `references/work-graph.md`, `scripts/graph.py`, `graph.schema.json` |
+| How a node is CLOSED: three blind readings at escalating visibility, all three required, and the round ledger the ceiling reads | `references/certification.md`, `agents/verifier-{unit,seam,product}.md`, `scripts/graph.py certify` |
 | Workspace isolation, the subagent loop, who may write the register | `references/build.md` |
 | The review rubric, diff packages, the three verdicts | `references/review.md` |
 | **False success** — the class, its known shapes and its two rules | `references/gates.md` |

package/plugins/task-pipeline/skills/task-pipeline/references/progress.md

@@ -369,12 +369,18 @@ deduplicated, and always exiting 0 — a hook that can fail a `Read` breaks ever
 every session. `scripts/graph.py doctrine` reports how many of the bundle's reference files
 a run opened and lists the rest.
 
-Why it is hook-written is the same reason as above: a claim about what somebody read,
-written by the party the claim is about, is not evidence. And why the verb prints
+Why a hook appends it is the same reason as above: a claim about what somebody read,
+written by the party the claim is about, is not evidence. **And that is an intent rather
+than a proof, so the verb reports `unattested`:** the ledger is the file the agent appends
+to at every stage and carries no writer field, so nothing in it separates a hook-written
+line from one an agent typed. Saying *never agent-written* was a provenance claim the
+format cannot support — B-014's class, in the mechanism built to close it.
+
+And why the verb prints
 `unmeasured` rather than `0` when there are no such lines is the same reason again — the
 hook being absent and the run reading nothing are **opposite facts** the ledger cannot
 separate, so it claims neither. A `0` there would be the reassuring answer to a question
-nobody asked, over 34 files nobody checked.
+nobody asked, over 35 files nobody checked.
 
 It is a disclosure: no floor, no direction, never a target. The moment the number becomes
 something to raise, a run will open files to raise it.

package/plugins/task-pipeline/skills/task-pipeline/references/retrospective.md

@@ -19,7 +19,7 @@ justifies reading it protects one section while the file below it doubles.
 | Artifact | Parts | How it is read |
 |---|---|---|
 | `docs/evidence/retro.md` — **one per project** | **Standing instructions** (max **10**) · **Run stamps** (max **10**, oldest rotate out) | stage 0, **in full** — both are bounded by a **cap**, which *one line each* never was |
-| the same file's **Recent log** | entries from the last five run stamps — narrative, and capped by nothing | stage 0, **queried** by the task's nouns. It said *in full* until 2026-08-10, when it measured **74%** of the file: an uncapped section inside a binding source is what makes the capped part get skimmed |
+| the same file's **Recent log** | narrative entries, **uncapped by design** — the heading said *entries from the last five run stamps* until 2026-08-20 while the section held 25 going back nine days, a bound in a heading that nothing enforced | stage 0, **queried** by the task's nouns. It said *in full* until 2026-08-10, when it measured **74%** of the file: an uncapped section inside a binding source is what makes the capped part get skimmed |
 | `docs/evidence/retro/YYYY-QN.md` — the archive | every entry and every retirement ever written, append-only | **queried** by the task's nouns; never read end to end |
 
 Seed the archive from [`../templates/retro-archive.md`](../templates/retro-archive.md).

package/plugins/task-pipeline/skills/task-pipeline/references/stages.md

@@ -273,6 +273,12 @@ never that the work was skipped quietly.
   `next` refuses to walk one. The reason to prefer it over a prose plan is measured, not
   aesthetic: a 400-node graph and a 4-node graph produce the same 27-byte frontier, so the
   cost of knowing what is next does not grow with the programme.
+- **And the check is what THREE readings will run, not one**
+  ([`certification.md`](certification.md)). A node is closed by `unit`, `seam` and `product`
+  reports, dispatched blind and in parallel, and `certify` refuses the close until all three
+  pass. That is a planning fact, not only a verification one: a node whose blast radius nobody
+  can name is a node the seam and product tiers cannot scope, so `touches` and `serves` are
+  what make the two outer readings possible at all.
 - **The queue exists here, so the loop arms here** ([`continuity.md`](continuity.md) →
   *Part 1a*). Where `run.loop.arm` is `after-decomposition` and the map holds more than
   one module, arm the mode at the close of this stage and print one line: the mode, and

package/plugins/task-pipeline/skills/task-pipeline/references/work-graph.md

@@ -59,6 +59,7 @@ conditional on the code, never merely sequenced after it.**
 | `goal` | the release goal | `0` · `3` unstated |
 | `add` | the id it allocated | `0` · `1` refused |
 | `park` | the id and the reason | `0` · `1` refused |
+| `certify` | the round, and on a failure every `breaks` finding with its fix and its check | `0` all three tiers passed · `1` a tier failed, or a report is malformed |
 | `close` | the goal, the new frontier count, and what was not verified | `0` · `1` refused **or the verdict stops the run** |
 | `producer` | what produced this proof — actor, model, runtime, skill, config, commit, trace | `0` |
 | `doctrine` | how many of the bundle's reference files this run opened | `0` |
@@ -77,6 +78,8 @@ A **`parked`** node is the single exemption: it is the one node nobody will clos
 *n/a — parked* in that field is confidence without correctness. `park` never removes what
 the node said it would run.
 
+**A node is closed by three readings, not one.** `certify` takes one tier report from each of `unit`, `seam` and `product` — dispatched blind and in parallel — requires all three to pass, and assembles the seven-key verdict `close` consumes. `close`'s contract is unchanged; what changed is that the verdict is now built from three readings at different distances instead of written from one, because a change can be correct where it was made and wrong one level out. A failing round records itself and leaves the node open. Doctrine: [`certification.md`](certification.md).
+
 **`close` stamps the commit; the verifier never supplies it.** A verdict written after the
 tree moved is evidence about a different tree, and an agent cannot name the wrong commit if
 it is never the one naming one.