task-pipeline-skill 1.97.1 → 1.98.0

package/plugins/task-pipeline/skills/task-pipeline/references/spec.md

@@ -18,7 +18,7 @@ Writing the approved design down so a zero-context implementer — human or suba
 - Module dossier — when the run is one brick of a platform
 - Self-review — before showing it
 - Locked contracts are decisions — the register, not only the spec
-- GATE (manual)
+- GATE (auto)
 
 ## Order of operations
 
@@ -280,13 +280,14 @@ spec section instead of restating the reasoning there.
 and the next one supersedes it; an id survives. If this stage settled something and
 no entry names it, the run has agreed to decide it again later.
 
-## GATE (manual)
+## GATE (auto)
 
 > "Spec written and committed to `<path>`. Review it and tell me if anything should
 > change before I write the implementation plan."
 
-Wait for the operator. Changes requested → apply, re-run the self-review, ask
-again.
+Where the brief records a standing authorization (the default gate is `auto` since
+1.98.0), an independent reader reviews the spec and the run continues; otherwise wait
+for the operator. Changes requested → apply, re-run the self-review, and review again.
 
 The gate is not only the operator's word: **every section carries `covers: REQ-…`
 and every REQ in the brief appears in at least one section.** For UI tasks it

package/plugins/task-pipeline/skills/task-pipeline/references/stage-00-intake.md

@@ -7,13 +7,13 @@ The full gate and freedom level remain in [stages.md](stages.md).
 - 0 — Intake grill — MANDATORY
 
 ## 0 — Intake grill — MANDATORY
-- **Stage 0 is not optional and not skippable.** There is no "small enough task"
-  exemption, no "the request was already clear" exemption, no starting stage 1
-  "while the operator thinks". The only sanctioned bypass is the
-  entry-from-super-ux short-circuit below, and even that still requires a scope
-  confirmation and a record of what was adopted vs skipped. A run that reaches
-  stage 1 without a committed, operator-confirmed brief is a **failed run** —
-  stop and go back.
+- **Stage 0 always runs, and its depth is proportional.** The gap check, the
+  harvest and the brief are never skipped; the interview, the committed brief file
+  and stages 1-4 are what a small change does without (Phase 1d below, the
+  *proportional run*). A run that starts building without a brief and its REQ rows
+  (in the brief file, or on the short path in the run ledger) is a **failed run**:
+  stop and go back. The entry-from-super-ux short-circuit below is the other
+  sanctioned shortening.
 - **Entry-from-super-ux short-circuit (check FIRST).** task-pipeline is often
   launched *from* super-ux — its `/ux` action menu offers "execute autonomously
   via the task-pipeline plugin" once the UX chain (and often a
@@ -40,8 +40,9 @@ The full gate and freedom level remain in [stages.md](stages.md).
   `affected` / `god-nodes` answer *reach*, which is what grep cannot), `CLAUDE.md`,
   `CONTEXT.md`/ADRs, `docs/` + `docs/ux/`, past pipeline briefs and carry-over
   ledgers, **the retro's standing instructions and run stamps** (`<artifacts>/retro.md`,
-  read **in full** — ten standing rows and ten stamps, both bounded **by a cap**, and they bind this
-  run; stamp each instruction as it fires. Its *Recent log* is **queried** by the
+  read **in full**: ten standing rows and ten stamps, bounded by a cap and by a byte
+  budget; print `scripts/retro_budget.py check` first, which states the floor's bytes and
+  bytes/4 tokens. They bind this run; stamp each instruction as it fires. Its *Recent log* is **queried** by the
   task's nouns, not read: uncapped narrative inside a binding source is what makes the
   capped part get skimmed, [`retrospective.md`](retrospective.md)), **lessons from other
   projects** (source 7b, [`knowledge-sources.md`](knowledge-sources.md): `scripts/lessons.py
@@ -81,30 +82,43 @@ The full gate and freedom level remain in [stages.md](stages.md).
   or they genuinely disagree and that is a decision. There is no fourth option, and
   starting on an unresolved divergence means building against a system that does
   not exist.
-- **Phase 1d — the short-path triage: printed, proposed, never taken silently.** This
-  pipeline's own boundary exempts a typo, a one-line fix and a mechanical rename — and
-  nothing measured that until 2026-08-10, so the exemption depended on an agent
-  remembering it while eleven stages and four manual gates stood in front of a
-  one-paragraph edit. Three questions, each with something behind it:
+- **Phase 1d — the short-path triage, and the proportional run: a small change
+  takes the short path by default.** This pipeline's boundary exempts a typo and a one-line edit; until 1.98.0
+  the next size up still met eleven stages and five manual gates, because the short
+  path was only *proposed* and silence took the full flow. Under a standing "decide and
+  act" instruction silence is the normal answer, so a proposal was the full flow every
+  time. The triage now **decides**, from five answers with something behind each:
 
   ```
-  1. files the request names, resolved        git ls-files -- <paths>       -> N
+  1. files the change touches, resolved      git ls-files -- <paths>       -> N
   2. any of them a public contract            the surfaces the host's release
                                               syncs, its schema or config
                                               contracts, a shipped command,
                                               its README                    -> yes/no
-  3. behaviour a user or a caller observes changes                          -> yes/no
+  3. behaviour a user observes changes        a UI, a message, an output    -> yes/no
+  4. a deploy target in the brief             stage 7's target exists       -> yes/no
+  5. risk class                               work-graph.md R1-R3           -> R1/R2/R3
   ```
 
-  Few files, no contract, no observable change ⇒ **propose** the short path: stages 1,
-  2, 3 and 4 marked `⊘` with the triage answer as the reason, and 5→10 running
-  unchanged. **Propose, never take.** The answer goes in the brief's autonomy sweep and
-  silence takes the full flow — the same floor deploy authorization uses. The glyph is
-  what makes it safe: a skipped stage is printed on the rail **with its reason**
-  ([`progress.md`](progress.md)), and a skip nobody can see is indistinguishable from a
-  stage that was never entered.
-- **How it runs: [`grill.md`](grill.md)** — the full doctrine, built into this
-  skill (nothing to install). In short: close what the sources can, then ONE batch
+  **Small** means all of: the gap check left zero material unknowns, N ≤ 5, no public
+  contract, no user-observable change, no deploy, and risk **R1**. Small ⇒ the run takes
+  the short path and prints one line:
+  `short path: R1 · N files · no contract · no user-facing change · no deploy`.
+  `scripts/short_path.py` computes the decision from the five answers (exit 0 short,
+  3 full) and prints that line.
+  The short path is: the brief and its REQ rows written into the run ledger (no grill,
+  no committed brief file) → stage 5, build with tests → stage 6, the suite plus **one**
+  verification (one blind tier, [`certification.md`](certification.md)) → stage 9, the
+  docs the change makes false and the handoff → stage 10, the hand-back and a run stamp;
+  a retro entry only when the run taught a new lesson. Stages 1-4, 7 and 8 print `⊘`
+  with the triage line as their reason ([`progress.md`](progress.md)).
+  **Triggers that bring a skipped stage back:** a deploy target appears (7, 8); a wiki or
+  code graph exists and the change touched what it indexes (9 in full); a check reveals a
+  contract or a user-facing effect (leave the short path, resume at stage 2); the
+  operator asks for the full cycle. Any answer outside *small* takes the full flow,
+  printed the same way with the failing answer as its reason.
+- **How it runs: [`grill.md`](grill.md)**, read only when the gap check leaves a
+  material unknown (a complete brief asks nothing). In short: close what the sources can, then ONE batch
   of the material unknowns, ordered by dependency, a recommended answer with each —
   one at a time only where answers depend on each other or the operator asks;
   contradictions reconciled on the spot; **every answer that touches

package/plugins/task-pipeline/skills/task-pipeline/references/stage-05-dev.md

@@ -7,7 +7,7 @@ The full gate and freedom level remain in [stages.md](stages.md).
   workspace (native worktree tool first, git fallback, baseline tests), keep a
   ledger under `.task-pipeline/build/<plan>/` so a compacted context can resume,
   then one fresh implementer subagent per task with a file-based brief and report,
-  a review after every task ([`review.md`](review.md)), and a five-round fix loop
+  a review after every task ([`review.md`](review.md)), and a three-round fix loop
   with an explicit breaker. TDD per task ([`tdd.md`](tdd.md)): failing test →
   watch it fail → minimal impl → watch it pass → commit. Pin subagents to the
   run's confirmed model (`model-tiering.md`). The plan's parallel groups fan out

package/plugins/task-pipeline/skills/task-pipeline/references/stages.md

@@ -1,9 +1,10 @@
 # Stages — detail & gates
 
-For the selected **default profile**, read this spine at entry, then the one detail
-linked in the current stage before work on every entry or resume, including wave
-iterations and approved short paths. Do not preload all stage details. Missing or
-unreadable detail means stop that stage and repair its route, never guess. A custom
+For the selected **default profile**, read **one stage section of this file when that
+stage starts** (the stage table in `SKILL.md` is the index), then the one detail it
+links, on every entry or resume, including wave iterations and approved short paths
+(the triage approves the short path itself since 1.98.0). Never read this file end to
+end. Do not preload all stage details. Missing or unreadable detail means stop that stage and repair its route, never guess. A custom
 profile uses its own declared doctrine and stages; numeric ids do not select these
 default details, and the kernel still applies.
 
@@ -14,7 +15,10 @@ orchestrator verifies the check itself, pass/fail), `judgment` (a named judge
 rules where no complete deterministic check exists — [`gates.md`](gates.md) →
 *The judgment gate*) or `manual` (requires the operator's explicit go, including a
 specific standing authorization naming the act, cited with its source and scope;
-otherwise wait). These stages (0 intake + 1→10) are the plugin's
+otherwise wait). **This example ships every gate `auto`** (since 1.98.0): where it
+names an approval, the operator's answer or the standing authorization recorded in the
+brief satisfies it without a pause. A project makes a gate `manual` in its own
+`pipeline.json`. These stages (0 intake + 1→10) are the plugin's
 **example** flow, encoded in `pipeline.example.json` against the universal contract
 `pipeline.schema.json`; a host project replaces it with its own
 stages/agents/types (see SKILL.md → *Bring your own skills*).
@@ -84,7 +88,11 @@ never that the work was skipped quietly.
 
 **On entry or resume:** read [stage-00-intake.md](stage-00-intake.md) before stage work.
 
-- **GATE (manual):** shared understanding reached — **the source ledger is written
+- **On the short path** (`stage-00-intake.md` → Phase 1d) this gate
+  is: the triage line printed, the brief and its REQ rows in the run ledger, the retro
+  floor read with its byte count, and the source ledger. Everything else below applies
+  to the full flow.
+- **GATE (auto):** shared understanding reached — **the source ledger is written
   (every source consulted, or an explicit "none found")** and **its `Contradictions:`
   line is written under it** — the harvest is a fan-out that converges on one brief, and
   nothing else compares the sources *with each other*; `Contradictions: none` is the
@@ -107,8 +115,8 @@ never that the work was skipped quietly.
   is filled — objective, exit checks on the artefact the operator uses, scope, budget and
   base** ([`finish-line.md`](finish-line.md)), the carry-over ledger is
   seeded, **`.task-pipeline/run.md` exists and the header block has been printed**
-  ([`progress.md`](progress.md)), the model decision is recorded, and the operator
-  confirms the brief. Stop when a
+  ([`progress.md`](progress.md)), the model decision is recorded, and the brief is
+  confirmed: the operator's answer, or the standing authorization recorded in it. Stop when a
   re-scan surfaces no new branches (don't grill past diminishing returns;
   reversible calls can be deferred with a note). Only then start stage 1.
 - **The verification ledger is read.** `<artifacts>/verification.md` — the harvest
@@ -140,7 +148,8 @@ never that the work was skipped quietly.
 
 **On entry or resume:** read [stage-02-brainstorm.md](stage-02-brainstorm.md) before stage work.
 
-- **GATE (manual):** the user approves the design, the UI verdict is recorded, **the
+- **GATE (auto):** the design is approved (the operator's go, or the brief's standing
+  authorization), the UI verdict is recorded, **the
   queue is an artifact rather than a recollection** — where it is a work graph,
   `graph.py validate` exits 0 and `graph.py coverage` names any requirement no node serves,
   **every REQ is answered by the design** — a requirement the design doesn't
@@ -156,10 +165,11 @@ never that the work was skipped quietly.
 
 **On entry or resume:** read [stage-03-spec.md](stage-03-spec.md) before stage work.
 
-- **GATE (manual):** the **`## Self-review` section written and committed with
+- **GATE (auto):** the **`## Self-review` section written and committed with
   computed values** — every check the spec names resolving or marked `review`, the
   brief's decisions and stage 2's rejected options read back with no unresolved
-  contradiction, and the cost delta printed; spec committed **and** user-reviewed; **every section carries
+  contradiction, and the cost delta printed; spec committed **and** reviewed (by the
+  operator, or under the brief's standing authorization by an independent reader); **every section carries
   `covers: REQ-…` and every REQ appears in at least one section**; for UI tasks
   additionally: the super-ux chain (foundation → flows → screens → scenarios) is
   designed, validated and approved; scenarios validated in `docs/ux/scenarios.md`;
@@ -299,10 +309,10 @@ never that the work was skipped quietly.
 
 **On entry or resume:** read [stage-07-lint-deploy.md](stage-07-lint-deploy.md) before stage work.
 
-- **GATE (manual):** lint clean (host linter **and**, for UI projects, the super-ux
+- **GATE (auto):** lint clean (host linter **and**, for UI projects, the super-ux
   linter) **and** suite green **before** deploy, **and no REQ is still `open`** — a
   `partial` ships only with the operator's explicit acceptance. A gap is cheapest to
-  close before it ships, and the operator is already present at this gate. **The
+  close before it ships. **The
   carry-over count is printed beside this verdict.** Deploy is outward → explicit
   operator go, or a specific standing authorization naming that act, cited with its source
   and scope. Authorization to release does not silently authorize a separate deploy. If
@@ -376,7 +386,7 @@ never that the work was skipped quietly.
 
 **On entry or resume:** read [stage-10-acceptance.md](stage-10-acceptance.md) before stage work.
 
-- **GATE (manual):** the ladder walk ran and its absences became REQ rows before
+- **GATE (auto):** the ladder walk ran and its absences became REQ rows before
   the table was written; **the hand-back is written** — the request quoted as it was
   GIVEN, where the run stands against it, what was solved with its evidence, what
   surfaced that nobody asked for, every decision still waiting **asked here with
@@ -422,10 +432,11 @@ never that the work was skipped quietly.
   carries evidence; every `partial` names what's missing and where it's tracked;
   every `deferred`/`dropped` has the operator's agreement and, for `deferred`, a
   tracker entry; no carry-over row left `unresolved`, and the ledger's counts are
-  printed with the verdict; the operator answers the
-  closing question and signs off. Manual by design — an automated check can prove
-  the table is well-formed, only the person who asked can confirm it is what they
-  asked for.
+  printed with the verdict; the hand-back asks the closing question and carries
+  the answer the operator can give at any time. `auto` by default since 1.98.0: a
+  check proves the table well-formed, and only the person who asked can confirm it is
+  what they asked for, so the run hands that question back rather than waiting on it.
+  A project that wants the wait sets this gate `manual`.
 
 ## The program loop — a platform, one brick at a time
 
@@ -486,8 +497,8 @@ cycle.
   a feeling, and the ledger is what survives compaction.
 - **Trips on:** revert-oscillation (A→B→A); the same file edited twice for the same
   reason; a finding already ADDRESSED or parked coming back; a stage entered a third
-  time for one artifact; two loops editing one file. Hard caps: 5 fix rounds per
-  task, 2 re-entries per stage per artifact, 3 passes per module.
+  time for one artifact; two loops editing one file. Hard caps, each a stop: 3 fix
+  rounds per task, 2 re-entries per stage per artifact, 3 passes per module.
 - **On a trip: stop editing.** Name shapes A and B with their evidence, escalate to
   the layer that owns the conflict (rubric → operator → plan → spec → module map),
   re-plan the check as an ordered one-item-per-line checklist, then go through it in

package/plugins/task-pipeline/skills/task-pipeline/references/waves.md

@@ -57,10 +57,12 @@ on real agents, tasks and users rather than on the first guess.
 | 5–8 Build → post-deploy | per wave, then the close pass. A wave's stage 7 integrates to the main branch **without tagging**; the release's tag, its approval mode and its go are stage 7's full gate, run once at the release ([`iteration.md`](iteration.md) → *The cycle*, step 10), and stage 8's trio follows on what was released (step 11) |
 | 9 Docs + wiki · 10 Acceptance | once, to close the release, over everything the waves shipped |
 
-**One planning gate, not three prompts.** The manual gates of stages 0, 2 and 3 are
-presented together at the end of planning: the brief, the canvas, the wave plan and the
-question batch in one message. Each gate's criteria are still checked and printed; the
-operator is asked once, and the go names the gates it closes. Silence closes none.
+**One planning gate, not three prompts.** The gates of stages 0, 2 and 3 are presented
+together at the end of planning: the brief, the canvas, the wave plan and the question
+batch in one message. Each gate's criteria are still checked and printed. They are `auto`
+by default (since 1.98.0): the standing authorization recorded in the brief closes them
+and the run continues; where the project made them `manual`, the operator is asked once,
+the go names the gates it closes, and silence closes none.
 
 ## Wave 0 — the survey and the inventory
 

package/plugins/task-pipeline/skills/task-pipeline/scripts/graph.py

@@ -35,6 +35,7 @@ conditional on the code, never merely sequenced after it):
     4  nothing runnable: an unclassified, running or parked dependency remains
     5  external execution lease contention
     6  nothing runnable: all remaining dependency leaves are recorded watched waits
+    7  `certify` stopped at its ceiling: the node is parked with the evidence
 
 **The mutation verbs never leave a half-written queue.** `add` and `park` write to a
 temp file in the same directory and `os.replace` it into place, so a crash mid-write
@@ -654,10 +655,25 @@ ALL_TIERS = TIERS + (VISUAL_TIER,)
 SURFACE_CLASSES = ("flagship", "product", "internal", "ad")
 RISK_CLASSES = ("R1", "R2", "R3")
 # Passing certification rounds a node owes before `close` accepts it, by risk class
-# (`references/certification.md` → *Rounds owed by risk class*). R3's must include one
-# round recorded `--kind adversarial`.
-ROUNDS_OWED = {"R1": 1, "R2": 2, "R3": 3}
+# (`references/certification.md` → *Rounds owed by risk class*). A clean round ends the
+# node unless it is R3 or a flagship surface: those owe a second passing round, and it is
+# the adversarial one, a different question rather than the same reading again. R2 owed
+# two blind rounds until 1.98.0, and a clean round did not cancel the next one: the loop
+# the 2026-10-20 cost audit measured.
+ROUNDS_OWED = {"R1": 1, "R2": 1, "R3": 2}
 ROUND_KINDS = ("blind", "adversarial")
+# An R1 node certifies with ONE blind tier (any of the three; `unit` is the default
+# reading). Every other node owes all three, and a flagship or product surface the fourth.
+ONE_TIER_RISK = ("R1",)
+
+
+def owed_rounds(node):
+    """(rounds owed, adversarial owed) for a node, or (0, False) when it owes no count."""
+    owed = ROUNDS_OWED.get(node.get("risk"), 0)
+    adversarial = node.get("risk") == "R3" or node.get("surface_class") == "flagship"
+    if node.get("surface_class") == "flagship":
+        owed = max(owed, 2)
+    return owed, adversarial
 
 
 def passing_rounds(cert):
@@ -675,13 +691,13 @@ def passing_rounds(cert):
 
 def owed_shortfall(node):
     """None when the node's class is satisfied, else a sentence saying what it still owes."""
-    owed = ROUNDS_OWED.get(node.get("risk"))
+    owed, adversarial = owed_rounds(node)
     if not owed:
         return None
     passed = passing_rounds(node.get("certification"))
     if len(passed) < owed:
         return "%d of %d owed passing rounds" % (len(passed), owed)
-    if node.get("risk") == "R3" and "adversarial" not in passed:
+    if adversarial and "adversarial" not in passed:
         cert = node.get("certification") or {}
         kinds = list(cert.get("kinds") or [])
         failed_adv = any(k == "adversarial" and not all(v == "pass" for v in (h or {}).values())
@@ -1661,10 +1677,14 @@ def cmd_certify(graph, args):
     the number the ceiling below reads. The node stays `pending` on a failure; the
     round count is the trail.
 
-    **The ceiling measures rather than stops** — `references/loop-guard.md`. At the
-    ceiling `certify` still runs and still tells the truth about the tiers; what it
-    adds is the name of the tier that keeps failing, because a run spinning on one
-    level needs the operator to see WHICH level, not to be halted.
+    **The ceiling stops** (`references/loop-guard.md`, since 1.98.0). A round that fails
+    with the node's failing rounds at the ceiling parks the node with the evidence as its
+    reason (exit 7): the run records a blocker row and moves on. It used to measure
+    only, and a measured loop is still a loop.
+
+    **No re-run on unchanged input.** A round of the same kind on the same tree as the
+    round before it is refused before anything is written: a tier's answer about a tree
+    it already read is the answer it gave.
     """
     guard(graph, args.graph)
 
@@ -1721,10 +1741,14 @@ def cmd_certify(graph, args):
         die("the tier reports are malformed — nothing was written:\n  " + "\n  ".join(bad))
 
     missing = [x for x in TIERS if x not in reports]
-    if missing:
+    if node.get("risk") in ONE_TIER_RISK:
+        if len(missing) == len(TIERS):
+            die("certification of an %s node needs one blind tier report (unit, seam or "
+                "product); none was given" % node.get("risk"))
+    elif missing:
         die("certification is missing the %s report(s) — all three are required, because "
-            "the level nobody read is the level the defect survives at"
-            % ", ".join("`%s`" % m for m in missing))
+            "the level nobody read is the level the defect survives at (an R1 node "
+            "certifies with one)" % ", ".join("`%s`" % m for m in missing))
     sclass = node.get("surface_class")
     if sclass in VISUAL_REQUIRED and VISUAL_TIER not in reports:
         die("certification is missing the `%s` report — %s is a %s surface, and on one the "
@@ -1743,6 +1767,18 @@ def cmd_certify(graph, args):
         head = ""
 
     prior = node.get("certification") or {}
+    try:
+        _t = subprocess.run(["git", "rev-parse", "HEAD^{tree}"], capture_output=True, text=True)
+        tree = _t.stdout.strip() if _t.returncode == 0 else ""
+    except OSError:
+        tree = ""
+    prior_kinds = list(prior.get("kinds") or [])
+    if (tree and prior.get("tree") == tree
+            and (prior_kinds[-1] if prior_kinds else "blind") == args.kind):
+        die("%s: round %d already read tree %s as a %s round: re-running a tier on "
+            "unchanged input repeats its answer. Change the code, run the other kind of round, "
+            "or record a blocker (references/loop-guard.md). Nothing was written."
+            % (nid, int(prior.get("round") or 0), tree[:12], args.kind))
     round_no = int(prior.get("round") or 0) + 1
     tiers_now = {x: reports[x]["verdict"] for x in tiers}
     history = list(prior.get("history") or []) + [tiers_now]
@@ -1754,6 +1790,8 @@ def cmd_certify(graph, args):
         "history": history,
         "kinds": kinds,
     }
+    if tree:
+        node["certification"]["tree"] = tree
 
     failed = [x for x in tiers if tiers_now[x] == "fail"]
 
@@ -1761,6 +1799,20 @@ def cmd_certify(graph, args):
     # operator needs named; counting it here is what makes the loop visible.
     churning = [x for x in tiers
                 if len(history) >= 2 and all(h.get(x) == "fail" for h in history)]
+    failed_rounds = sum(1 for h in history if any(v == "fail" for v in h.values()))
+    stop = bool(failed) and failed_rounds >= args.ceiling
+    if stop:
+        first = next((f for x in failed for f in reports[x]["findings"]
+                      if f.get("severity") == "breaks"), {})
+        reason = ("certification ceiling: %d failing round(s), ceiling %d; failing tier(s) %s; "
+                  "%s; first break %s: %s; check: %s. Blocker row owed on the board"
+                  % (failed_rounds, args.ceiling, ", ".join(failed),
+                     ("stuck on " + ", ".join(churning)) if churning else "churn across levels",
+                     first.get("where", "?"), first.get("what", "?"), first.get("check", "?")))
+        reason = " ".join(reason.split())
+        node["status"] = "parked"
+        node["parked_reason"] = reason
+        revise(graph, "park", nid, reason)
 
     save(args.graph, graph)
 
@@ -1774,9 +1826,10 @@ def cmd_certify(graph, args):
                 print("  [%s] %s — %s" % (tier, f["where"], f["what"]), file=sys.stderr)
                 print("      fix:   %s" % f.get("fix", "(not stated)"), file=sys.stderr)
                 print("      check: %s" % f["check"], file=sys.stderr)
-        if round_no >= args.ceiling:
-            print("\n%s has been certified %d time(s), at or over the ceiling of %d."
-                  % (nid, round_no, args.ceiling), file=sys.stderr)
+        if stop:
+            print("\n%s has failed %d round(s), at the ceiling of %d. STOPPED: the node is "
+                  "parked with this evidence as its reason; record a blocker row and move on."
+                  % (nid, failed_rounds, args.ceiling), file=sys.stderr)
             if churning:
                 print("The same tier has failed every round: %s. That is not a fix "
                       "away — the level itself is being misread, or the node is the "
@@ -1785,6 +1838,8 @@ def cmd_certify(graph, args):
             else:
                 print("No single tier is failing every round, so this is churn across "
                       "levels rather than one stuck level.", file=sys.stderr)
+        if stop:
+            return 7
         print("\nThe node stays open. Round %d is recorded on it." % round_no,
               file=sys.stderr)
         return 1
@@ -1843,7 +1898,7 @@ def cmd_certify(graph, args):
         fh.write("\n")
     os.replace(tmp, out)
     print("%s: certified at %s in round %d" % (nid, ", ".join(tiers), round_no))
-    owed = ROUNDS_OWED.get(node.get("risk"))
+    owed, _adv = owed_rounds(node)
     short = owed_shortfall(node)
     if short:
         print("round %d: %s — not closable yet. The next round reads the node's whole diff at "
@@ -1964,7 +2019,7 @@ def cmd_close(graph, args):
     if short and not exc:
         die("%s is %s: %s — not closable yet. Run the next round with `graph.py certify`, "
             "or record an authorized exception with `waive`. Nothing was written."
-            % (nid, node["risk"], short))
+            % (nid, node.get("risk") or "a %s surface" % node.get("surface_class"), short))
     if cert:
         tiers = cert.get("tiers") or {}
         failing = sorted(k for k, val in tiers.items() if val != "pass")
@@ -2073,8 +2128,8 @@ VERBS = {
     "wait": (cmd_wait, "record a watched external wait, without executing its locator"),
     "resume": (cmd_wait, "resolve the exact wait identity and return to pending"),
     "wave": (cmd_wave, "move a node to another wave, carrying the reason"),
-    "certify": (cmd_certify, "require three independent tier reports (four on a "
-                             "flagship or product surface), then emit the verdict "
+    "certify": (cmd_certify, "require three independent tier reports (one on an R1 node, "
+                             "four on a flagship or product surface), then emit the verdict "
                              "`close` consumes"),
     "close": (cmd_close, "consume a verdict, close one node and re-plan"),
 }
@@ -2128,8 +2183,9 @@ def main(argv=None):
                         help="the round's kind; R3 owes one `adversarial` round "
                              "(references/certification.md → *Rounds owed by risk class*)")
     p_cert.add_argument("--ceiling", type=int, default=3,
-                        help="rounds after which the output names the churning tier; it "
-                             "measures rather than stops (references/loop-guard.md)")
+                        help="failing rounds after which certify STOPS: the node is parked "
+                             "with the evidence and the run records a blocker row and moves "
+                             "on, exit 7 (references/loop-guard.md)")
 
     for verb in ("claim", "release", "recover", "complete"):
         made[verb].add_argument("--authority", required=True,