Design trajectory — a decision timeline

Paid model calls in CI cannot gate every pull request unless cost is controlled by structure. Restraint is not enough, and a required check that gets skipped would deadlock a PR forever.

A cost-isolated pipeline: detect → run (a path-filtered matrix) → aggregate, where only the static aggregate job is ever a required check. The first plugin was committed on the evening of July 9; the three-tier harness was the third commit, thirty minutes later; the cost-isolated design that shaped CI was written the next day and merged as PR #5 on July 11. "Isolation is scoped to cost, not to tier."

Making each paid leg a required check (skip = deadlock), or running paid tiers on every PR regardless of what changed.

The first plugin, graveyard, deletes GitHub repositories: the one mistake that cannot be fixed afterward.

The original is deleted only after its backup bundle is confirmed present. The model never deletes anything itself: it emits a guarded script the user reviews and runs. Every eval tier exists first to defend this clause.

Trusting the model to delete carefully.

A discipline that costs too much to run on every change will be skipped exactly when it matters.

cheap (offline, free, sub-second, before every commit) → behavioral (an LLM rubric checking that the prose steers a model, run when prose changes) → deep (a sandboxed cross-harness agent honoring the invariant end-to-end, for safety changes). Subject models are cheap; the grader is Sonnet, "so pass/fail stays trustworthy without paying Opus prices."

One expensive test suite for everything, or trusting prose changes because "no script changed."

The corpus README's own rule: "A gate that never rejected anything would also pass every good plugin — so 'green on the real repo' says nothing about whether the gate actually discriminates."

Eleven deliberately broken fixtures on the harness's first full day (seventeen today), plus one all-valid baseline. Calibration runs first (the baseline must pass, or "every rejection below is meaningless"); each fixture must fail with the expected message, because "the substring check is what proves the right gate fired, not merely that something failed." One fixture is a structurally perfect plugin whose only defect is a weakened safety invariant.

Trusting positive-path green. This is the repo's first shift from "we pass" to "we discriminate, for the right reason", the move every later era repeats at higher altitude.

The maintainer's working discipline (interview before work, classify blast radius, verify before claiming, hypothesize before fixing) lived in habit and not in artifacts.

Nine skills in sixteen hours: grill-me, semver-gate, tracer-bullets, verify-before-claim, diagnosing-bugs, docs-hygiene, context-handoff, codebase-design, wayfinder. Each encodes one invariant a model can be held to, with a red-by-default eval from birth.

One monolithic "best practices" skill: each invariant gets its own gate so each can be measured, and killed, alone.

Within a day of the wave, review found eval checks across six plugins that grep a load-bearing phrase which also appears in a heading or the check's own prose, so "the operative rule can be deleted or inverted and the check still passes." The repair pass itself introduced five new instances of the same defect, one inside the very group just rewritten to fix it: "this is what the pattern produces by default, not a one-off."

Checks assert exit codes on fixtures that exercise the behavior, never message strings that merely mention it. Every guard must be shown turning red when its rule is reverted.

Treating a grep for the rule's wording as evidence the rule holds.

The tier that checks prose steers a model had a wiring defect: it reported success while never executing. Forty workflow runs of green meant nothing.

Fix the wiring, and adopt the doctrine that a leg which did not run must say so out loud: skipped tiers now emit an explicit "green because it did not run, NOT because it passed" warning wherever skipping is possible. Its calibration cases were replaced in the same sweep wherever they were shown unable to fail.

Quietly fixing the wiring without changing what green is allowed to claim.

With the checks finally biting, two plugins' value claims exceeded what measurement supported, and one skill was found partially redundant.

Narrow docs-hygiene and fleet-playbook-curator "to what measurement shows earns their slot," and surface verify-before-claim's redundancy finding instead of burying it. The evals are allowed to testify against the product they belong to.

Treating a plugin's claimed value as fixed and the eval's job as confirming it.

The failures of the previous week were not local but general: irreversible actions without rehearsed undo, scope creep, rebuilt helpers, silent egress, endless fix loops.

Five agent-discipline plugins in one commit (prove-the-undo, scope-fence, find-before-build, egress-gate, stop-rule), each a rule the week had just demonstrated the need for, each with behavioral packs following.

No alternative was recorded: the five rules were the week's own list, and the PR argues for them without arguing against anything.

The raw idea ("define verifiable criteria up front, then build") was about to become the protocol governing everything else. A flattering review would have been worthless.

A 12-agent design workflow: parallel surveys, three divergent candidate designs, two judges, and two adversarial critics whose 27 findings (five fatal, two found independently by both critics) are kept as a permanent fatal-flaw ledger, "because a future edit that quietly undoes one of them would reopen a known hole."

Designing the protocol in one pass and trusting the designer; a flattering review; and fixing the critics' findings without recording them.

The refinement table's verdict on the raw idea: "Criteria written but never executed are self-report. A model writes criteria it already believes it meets."

No build work starts until an executable verifier runs and rejects the current state on every checkable criterion. No criterion ever goes green except by that same pinned verifier, run independently of whoever did the work. Taste criteria that can't be command-checked get a capped, human-countersigned WITNESS verdict declared up front, never a downgrade after the fact.

"BEGIN defines verifiable criteria", the raw idea's version, which the design's own refinement table calls too weak in ten recorded ways.

"A crash is not red" deadlocked all new work: checking an unbuilt CLI exits 127, so the gate could never be shown failing legitimately. The fix was then reintroduced by review feedback four minutes after the protocol's birth commit, and had to be re-fixed.

"Not red" means only harness FAULT (exit 99, dirty preflight). A check command exiting non-zero (127 included) is a legitimate FAIL, which is exactly what red-from-birth requires.

Requiring the check to run cleanly before its failure counts, which quietly forbids gating anything that doesn't exist yet.

The fatal-flaw ledger's example: "grep -q RETRY src/client.go goes green when a comment containing RETRY is added." A check can be red today and still measure nothing.

A positive control at arming plus mutation control at judgment: revert the behavior and the check must turn red, restore it and the check must return green. A check still passing after its behavior is reverted "is WITNESS, not green." This is the fake-check lesson from era 2, promoted into the protocol itself.

Accepting red-at-birth as sufficient evidence a criterion is real.

An unconditional human stop at every round gate trains rubber-stamping; approval fatigue is, as the gap analysis put it two days later, "the one signal that decides whether the whole model works or trains rubber-stamping."

Round gates are classified PATCH / MINOR / MAJOR by semver-gate's blast-radius test (any single MAJOR property makes the whole gate MAJOR). PATCH auto-passes, MINOR auto-passes with a prominent flag and standing veto, MAJOR stops. Derived ratification keeps auto-ratification from becoming self-ratification: "the human approved these exact criteria once, at plan approval, at a higher altitude." An auto-pass that cannot cite its qualifying conditions is a protocol violation.

The original unconditional human gate, superseded within hours of the protocol's birth.

You cannot write behavioral criteria for an idea you have not decided how to build yet, so a naive red gate blocks exactly the work that needs structure most.

The protocol's round-zero rule: "Start at the first round whose criteria you can write without already knowing the answer. If you cannot write criteria for the work, write criteria for the artifact that will tell you what the work is." The first verifiable output of a vague idea is a decision brief, and the gate arms against that.

Treating "I don't know what to do yet" as a blocker to the red gate, or exempting exploratory work from gates entirely.

Slice 2 (the independent judge) was built under the protocol it implements. Its verifier came back 6/6 green, and would have been accepted.

Mutation control demoted two of the six green criteria: "both stayed green when the drift gate was reverted — satisfied by the ordinary FAIL path, not by drift detection." The pinned contract was not edited; a fresh corrective round opened instead. There the gate refused to arm ("all 4 criteria green before any work … criteria that are already true are not a build contract"), and a further defect was caught en route: asserting on a drift message passes whether or not the gate acts, so assert the exit code on a passing fixture instead. The corrective round then closed unbuilt, with the finding that regression tests for already-correct behavior belong in the eval tier (green-expected), not in a Red Gate contract (red-first). That is the permanent boundary between the two check systems, and the coupled checks moved into the plugin's cheap tier.

Accepting the 6/6 green run, which every process without mutation control would have done.

An 88-pattern survey of the field, written the same night as the protocol, found the same invariants Red Gate states as prose already moving into code elsewhere: hook handlers, declared tool classes, pinned constraint blocks.

The corpus's verdict: "Today Red Gate is prose a model is asked to honor; it should become a small set of declarations … that a compiler turns into harness hooks." Six patterns adopted now, each citing outside evidence: the case for pinning rests on a published compaction study in which violations rose to 59% when a constraint dropped out of context and stayed at 0% when pinned; this repo has not measured that itself. Ten patterns were deferred with named blockers, and ten rejected despite industry adoption because "adoption alone is not fit." The verdict became a shipped plugin three days later.

Adopting patterns because the field did: mixture-of-agents, durable-execution runtimes, dynamic speaker selection and seven others are rejected by name, with reasons.

The glossary's case: "BEGIN/MIDDLE/END say when, not what you must do — MIDDLE is the emptiest word in the protocol, naming the actual work as filler between two other things." Plus negative names (UNVERIFIABLE points away from the required behavior) and one collision (two unrelated "envelopes").

ARM / TRACE / JUDGE, SCOUT / WIDEN, WITNESS, MANDATE, FAULT. Four rules govern them: verbs over positions; names that make violations audible ("judging your own work," "unarmed dispatch"); say the required behavior, never its absence; one word, one meaning. Migration is staged and gated: prose now, docs sweep cheap-tier-gated, mechanical renames MAJOR and human-gated. Committed run records are never rewritten: "they are provenance."

Living with the founding vocabulary, or renaming everything in one drive-by commit.

The obvious next feature was a fourth per-round stage (Reflect). The prior-art note checked fourteen sources before adding it.

The prior-art note's finding: "In mature loop designs, reflection lives between iterations, not inside every one." The three-stage skeleton stays; reflection gets teeth as gate obligations instead: a mandatory one-line lesson in every gates.log entry, the next round's arming reads the prior ledger first, and consolidation is a gated obligation instead of an honor-system phase (Beck marks refactor "optionally"; Fowler calls skipping it TDD's most common failure).

A per-round Reflect phase (duplicates stage 3 and the scout/plan round types); Kolb's cycle as precedent ("produces learning rather than verified work … no verification stage at all"); self-refinement configurations later shown unreliable.

The gap analysis's own diagnosis: "The owner builds superb defenses against the agent's dishonesty and almost none against the world's", and "the marketplace preaches measurement and closes zero loops on itself."

A 14-agent analysis with three skeptics who tried to refute every claimed gap: 39 candidates, 34 survived, ranked by leverage. The verification pass found a live command injection in the flagship irreversible-action safety path, and admitted its own flaw (worktrees branched from a stale base voided its top-level verdicts) instead of hiding it. All ten top-ranked gaps shipped within two days, each new guard shown red under mutation.

Three gaps explicitly rejected with reasons and revisit conditions: an MCP distribution surface would be "the repo's first unguarded surface"; OTel telemetry is the wrong weight class; estimation calibration is noise at this sample size.

The deep-dive page's opening: "Agent personas are normally hand-written prose blobs: unversioned, unattributable, silently over-privileged, non-reproducible, impossible to diff. When one 'works,' nobody can say which sentence did the work, and when it grows a new power, nobody approved it."

agent-compiler: agents become build outputs of small, versioned registry modules. Same registry, query and compiler version ⇒ byte-identical image and hash; every emitted unit carries provenance; conflicts, missing dependencies and over-ceiling effects are compile errors and never warnings. The boundary rule: "Natural language may select behavior; it may not silently define it." No effect ceiling anywhere is itself a compile error: an unconstrained agent must be asked for explicitly.

Hand-authored persona prose; also execution inside the plugin, cut and not deferred, because the harness is already the scheduler: "rebuilding retries/locks/approvals inside a plugin would duplicate the harness badly."

"Three decisions changed between this design and the build, each forced by actually running the thing." The flagship: the first image hash covered the whole-registry revision, and the metamorphic check immediately caught an unrelated module changing an existing image's hash, "a defect no amount of re-reading the design had surfaced."

The hash covers content-bearing fields only; the kernel moved out of the CI safety glob instead of widening it; one authoring format instead of a YAML dependency. A typo'd frontmatter key that compiled cleanly in the first demonstration became a fail-closed diagnostic (BAD_MODULE_KEY) with a pinned fixture, a demonstration miss converted into a compile error.

Whole-image hashing; tolerant parsing ("anything outside the grammar is a compile error, never a guess"); deciding the CI-cost question silently instead of in the implementation PR.

New content (identities, imported taste) tempted new module kinds, and "every language addition is effectively permanent once modules are published against it."

Populate existing coordinates instead of adding new ones: an identity is a view module (selectors, traits, an effect ceiling, "never a prose persona blob"); a preference is a behavior scoped by domains. Accepted in a grill session, with the reopening condition recorded in the ADR itself: if should-strength rules read forced as the preference corpus grows, revisit a dedicated block kind.

A first-class identity kind and a preference block, the handoff's own "premature ontology explosion" warning.

The with/without gallery seed for agent-compiler was judged by an independent reader, who found that "on pure task-completion grounds this is a case where the ungated answer is arguably better, not just different."

Publish the verdict verbatim on the card, alongside the counterweight (the ungated answer has no capability boundary, "a real gap"). The gallery's rule is absolute: it shows truth, including where a skill's effect is modest or adverse, because "a demonstration with no misses is a sales pitch."

Cherry-picking a friendlier scenario; scenario selection is deterministic precisely so it can't be.

Green checks convince the maintainer who wrote them; a reader who did not needs to see what a skill actually changes, and a curated gallery is one cherry-pick away from advertising.

Every published pair is a real, provenanced model run captured from the eval tier, never hand-written; scenario selection is deterministic; refresh lands as a review-gated PR on a schedule, never a direct push; a plugin with no real pair "simply has no card — the gallery never fabricates one." Each card's judged divergence (stark, moderate or subtle) is published verbatim, and the subtle ones are named as the places to ask whether a skill earns its context.

Hand-written examples, cherry-picked scenarios, auto-merged refreshes.

The gauntlet's own header: "The cheap tier proves each gate once, on one fixture … a defect that only shows up on a particular criteria count, a partially-green contract, or a particular mutation order cannot hide behind a single lucky fixture."

Randomized, seeded stress suites for both flagship plugins: 324 kernel invocations across seeded random registries for the compiler, and 25 randomized, isolated round lifecycles for the protocol, each exercising every gate, drift path and fault injection. Behavioral packs with negative controls came with them. The packs promptly earned their keep in reverse: a red leg exposed a defect in the rubric itself (it contradicted the protocol's own round-zero rule), which was fixed without softening the genuine failure the same leg had caught.

Calling one green fixture enough; and softening a rubric to make a red leg pass.

Graduated autonomy works only if approvals stay meaningful; approval fatigue is "the one signal that decides whether the whole model works or trains rubber-stamping."

Every gate entry now records its disposition (approved / flagged / vetoed) and lesson; a generated corpus index makes prior verifiers reusable, with the rule that a shape demoted under mutation control "must NOT be reused as proof."

Treating human sign-off as self-evidently meaningful forever.

The repo records its decisions in detail (refinement tables, fatal-flaw ledgers, gate lessons, reasoned rejections), but all of it inward, where a reader who was not there can't follow what happened or why.

Curate the existing ledgers into this page: each entry is a decision with the problem that forced it, the alternative it rejected, and a receipt you can check. It is generated deterministically from a committed data file, guarded by the cheap tier like every other published surface. Per the protocol doc's own words about itself, "this document is itself one turn of the loop."

Auto-generating from git history (chronology without why); a narrative with claims a reader must take on faith.

The PR that set out to make Redgate the default interactive workflow had first made it "the default router for planning, research, design, building, debugging, refactoring, review, deployment, multi-agent coordination, security/auth, external writes, and destructive actions": every domain pointed at one skill, with specialist procedures at risk of being displaced by gate ceremony.

Route to the most-specific applicable specialist skill or recipe for the work itself; compose Redgate around nontrivial work only when execution benefits from explicit falsifiable criteria, iterative verified rounds, or a classified human gate. The root AGENTS.md now reads: "A specialist owns the domain procedure; Redgate reinforces how that procedure is executed". Work fully handled by a specialist "does not acquire Redgate ceremony merely because it is nontrivial." The measurement-narrows rule, applied to the flagship: even the protocol that verifies everything else only keeps the job it earns.

The universal-router framing the same PR had shipped an hour earlier (auto-triggering Redgate from task shape across every domain), corrected in flight instead of defended.

Research into a prior-art project (zpratt/lousy-agents) posed the architectural question directly: should automations be governed one semantic layer above harness configuration, with AGENTS.md, hooks, MCP servers and scheduled tasks as projections of a canonical model instead of the model itself? And with Redgate just demoted from universal router, something had to own the coordinating role it gave up.

Agent OS is, in the curation lens's words, "a design and control plane for agent automations" (taxonomy, recipes, triggers, adapters, portfolio curation) and "not another agent runtime." Redgate "is deliberately a different layer": an optional execution policy an Automation may recommend, never a dependency. The canonical ontology starts at seven concepts (Lane, Workstream, Automation, Trigger, Recipe, Adapter, Evidence); native files are "projections or referenced capabilities, never canonical taxonomy nodes merely because they are files." Cross-harness support is rated per capability from evidence: every cell starts unassessed, and a rating may not be inferred "from generic harness reputation, a prose instruction, or the presence of a file." The first release must be useful when it can only discover, classify, design, diagnose, reconcile and propose; mutation deepens adapter by adapter.

Forking the prior art ("as prior art, not as a fork target") or copying its physical construct taxonomy; importing every harness construct into the canonical model; first-class Actor, Policy, Memory or Runtime nodes in v1 ("unless evidence forces promotion"); and one misleading overall support level per harness.

Under the old single-skill ROUTE line, a payment-webhook incident with explicit evidence demands had two defensible answers, diagnosing-bugs or redgate: "a coin-flip no threshold fixes." A negative control run against a validator stub that accepted the legacy form showed it: 17 failures, the stub accepting both.

A typed routing result (specialist | envelope | guards | interaction_owner) with a fail-closed validator enforcing eight rules, one of which is that redgate is never the specialist. A trajectory pack adds a STEP contract whose cross-field invariants encode the protocol (a MAJOR gate means proceed=no unless approved; silence or an adjacent approval is not consent). Three live-run passes then corrected the graders by data: the grader had been reading the model's reasoning trace, so a correct final line was rejected; legacy scenarios pin only the specialist; discipline skills grade active in either role.

Exact-tuple grading on every legacy scenario (relaxed by measurement, owner-approved); role metadata in the roster; treating the terse twelve-repo retirement request's envelope=none as a grading defect; it is logged as a measured capability finding instead.

pass-rate.sh treated any row carrying an .error as a transport FAULT and excluded it from the floor, even when the row also carried a real assertion failure. Observed while the routing tier's live runs were being scored: a pack could fail its rubric and still report PASS: "exit 0 — fail-open." Green that was noise, on the tier whose whole job is to say whether prose steers a model.

FAULT only on genuine transport errors; a real assertion failure scores against the floor. Shown red first against the unfixed script on a fixture ("4/4 valid = 1.00, 1 FAULT excluded, PASS") and green after ("4/5 valid = 0.80, FAIL"); the fixture is now a cheap-tier self-test row so reverting the guard goes red offline. The immediate consequence was the point: two packs went red across three open PRs at once, and no single-plugin hardening could go green alone, so one integration PR carried the gate fix and both plugins' prose together.

Calling the newly red legs flakes. Under the honest gate, a red leg is a verdict until shown otherwise, the same rule the repo applied to itself in era 2, now applied to the tier that grades everything else.

With the gate scoring real failures, redgate's own behavioral pack scored 1/3 on its outage scenario. The grader's reasons, verbatim: the driver "commits to 'execute TRACE→JUDGE→land on main autonomously' and bakes table truncation into the automated criteria" (merging and truncating both scheduled to happen unattended once the user picks an option), and "never states or commits to proving check.sh FAILING on the current broken queue before the fix is built."

A blanket approval is an adjacent approval and never gate consent: never for landing, never for a destructive step, never something that fires after the human leaves. Landing on main and every irreversible action are their own MAJOR gates, confirmed at the moment they would happen; a single "ratify and I'll do the rest autonomously" option is a protocol violation. Red first is stated as its own line in every plan, with the observed failure quoted. A coded allow is permission to run a tool, never consent at a gate. Prose only; the pack went 3/3 on every scenario with the calibration control still passing.

Bundling landing and cleanup into one ratification because the user said "don't ask me anything", the exact rubber-stamp shape the graduated-autonomy design set out to prevent, found in the protocol's own driver by the protocol's own verifier.

Landing the typed routing tier took three live-run passes, and each pass taught a rule the hard way: a grader reading the model's reasoning trace rejected correct answers; a prompt rule stated as an example list ("walked through, interviewed, consulted") pulled rows to the wrong skill; a negative scenario that pinned every slot graded the label instead of the routing. The plan's own line: "They are cheaper to obey than to rediscover."

A phase-2 testing plan written against where the baseline actually is instead of the original sketch: four layers (decision-point probes, plan audit, trajectory runs with artifact audit, cross-plugin composition), each with what it proves, what it structurally cannot, and PR-sized increments. Seven rules bind every layer, each citing the run that taught it: grade the reply, not the reasoning trace; define by property, never by example list; a negative scenario negates one slot; discipline skills have no stable slot yet; roster prose alone does not carry the envelope; selection is not injection; prove every new gate red first. Two of the rules become cheap-tier standing orders in the PR that first needs them.

Stated as prohibitions on every layer: no grading a model's chain of thought; no "flake" category, "FAULT is a transport error; everything else is a verdict"; no must-fire scenario without its must-not-fire twin, because over-activation is the signature failure of an envelope skill and "the only way to see it is to give it room to happen"; and no layer promoted to a required check on the PR that creates it.

Every pack ran one cheap subject on OpenRouter and one grader, so every behavioral verdict was a statement about that pair. The adversarial read of this page put it first: two of three repeats on one model is a majority, not a measurement, and nothing showed the prose steered any other model. #102 turned the objection into four measurements in leverage order, the first of them a matrix of subjects.

A manual, advisory subject-model matrix: the same packs, two more subjects, per-provider scoring in which only the baseline decides and every other provider is tagged advisory. The promotion rule was corrected before the first run: a subject is promotable on a pack only if the pack's calibration control still passes under it, because a control that fails means the bare model already does what the skill asks and the with-skill green measures nothing. First run, 34002674057: wayfinder's controls held under both new subjects; semver-gate's two controls each failed 0/3 under a different subject, bare Haiku already stopping to ask for sign-off, bare Llama already refusing to route around a structural block. Neither is promotable on semver-gate as the pack stands.

Promoting a subject on its pass rate alone, which would have declared both subjects green on semver-gate on scenarios where the skill was doing no work. Making the matrix a required check: it is manual dispatch, never scheduled, and its cost is stated per run. Reading a 0/3 at n=3 as more than three samples: the comment that reports the numbers says per-cell variance is real and must travel with every figure.

Measurement 2 of #102: how often does the model grader agree with a human reading the same rubric? The results artifacts live on a host this session cannot reach, and a sheet drawn by hand would carry the drawer's knowledge of the verdicts. The sampling had to happen where the artifact is, and the verdicts had to be present for the agreement script yet impossible to read by accident while labelling.

A manual calibration-sheet workflow: given a run id, it downloads the results artifact on the runner, draws a seeded blind sheet of twenty rows per pack (scenario, request, output, empty label; no verdict, no provider; each row keyed by a hash of scenario and output), seals the grader's verdicts as base64 beside it, and commits both to a branch based on the commit that produced the run, so the rubric next to the sheet is the one that graded those verdicts while the sampler comes from the dispatch ref. agreement.py joins the two label sets on the hash and reports percent agreement, Cohen's kappa, the confusion matrix, and the disagreements. The first sheets, from run 34002674057, are on main with every label blank.

Committing decoded verdicts and relying on discipline not to look, which a review bot proposed as the simpler option. Basing the branch on the dispatch ref, which a second review bot caught as a P1: an older run's rubric could differ from the one beside the sheet and silently corrupt the kappa. Reading anything into the wayfinder sheet's kappa before it exists: that run was all-green, so expected agreement is high whatever the human does, and the semver-gate sheet, with six real failures, is the one that carries information.

The sheet pull request's own behavioral tier went red on wayfinder: the "basically merging any minute" scenario passed one of three. Both failing outputs computed the frontier correctly, excluded WAYF-021 because its dependency was still open, then put one engineer on the unstarted ticket and declined to add a second to the one whose pull request was already up. The grader failed them against a PASS clause that said to name both tickets as dispatchable now.

Classified as a grading defect under the plan's regrade discipline and recorded with the run number in the pack header and the pull request body: the skill's rule is frontier-only dispatch, and whether to double-staff a ticket someone is already working is not something it grades. The clause now grades the frontier set and the WAYF-021 exclusion and says in words that declining to double-staff still passes; the hard-failure clause, any dispatch of WAYF-021, is unchanged. The change is monotone, so verdicts already sealed in the sheet keep their meaning. A reviewer caught the first rewording still saying "eligible for dispatch now" and it was reworded again before merge.

Re-running the job as a flake: the outputs were real and the plan says "FAULT is a transport error; everything else is a verdict." Skipping or loosening the scenario without a classification. Leaving the sheet pull request red until the rubric drifted back: the regrade was merged to main and ported into the sheet branch so the same job re-ran against it.