fix(flaky): repair the five paid gate detectors and the judged review/plan-review prose (GSTA-128)

Daily flaky pass over the 2026-10-27 Open ledger entries, paid cases first.

- ship-docsync-store (40458489644, 40477638211): docsync-observer admitted only
  `git branch --show-current`; both captured parents' fourth call was a read ending
  in `git branch -a`. Operand-free branch listings are now part of the read grammar.
- ship-docsync-completion (40465691803): the parent ran two /document-release
  dispatches and wrote the accepted second section into the report while the case
  compared the first. The contract now follows the last foreground dispatch.
- ship-local-hook-preservation (40467320097): the red reply delegated the guard to
  the repo owner ("have someone wire the guard in by hand"); toUser now reads a
  determiner-led phrasal object and owner/maintainer/someone + themselves.
- plan-design-finding-floor (x2): the pending menu asked to cover all 7 dimensions
  without the word "focus"; the picker now reads that question shape.
- Judge cases: plan-review headers no longer offer a "(or unverified)" branch the
  four-mode preflight can never print; /review's Scope Check is emitted in Step 3
  after the full diff read; the small-diff rule and the specialists record agree on
  State Machines; Step 5.8.2 names which post-fix rerun rule governs. Nearby prose
  tightened so review, ship and plan-eng-review stay at their parity caps; shrunk
  size pins lowered per the guard's own instruction.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

scripts/resolvers/outside-voice-steps.ts

@@ -346,7 +346,7 @@ approval and artifact-write requirements still apply.`}
 |---|---|
 | Disabled | Record disabled coverage below, then continue to planning decisions. No prompt, outside process or native replacement. |
 | Ready | Construct the prompt and run the foreground outside invocation. |
-| Other preflight mode, including harness mismatch | Report the probe's diagnosis, construct the same prompt and use Native fallback. |
+| Any other mode (\`not_installed\`, \`under_current_harness\`) | Report the probe's diagnosis, construct the same prompt and use Native fallback. |
 | Outside execution or output validation fails | Retain its output and diagnosis, finish termination, then use Native fallback. Auth: name the login repair; timeout: report the five-minute limit; empty response: say no response. |
 | Reviewer completes | Present its full output and ${ceo ? 'go to Integrate reviewer findings' : 'resolve findings through Decision procedure'}. |
 | Native fallback unavailable or fails | Record unavailable coverage and continue to planning decisions. No clean-review credit. |
@@ -408,9 +408,11 @@ THE PLAN:
 }
 
 function codexPlanReviewRun(ctx: TemplateContext, ceo: boolean, needsApprovalReadiness: boolean): string {
-  return `**If \`CODEX_MODE: ready\` (or \`unverified\`) — run ${outsideVoiceFor(ctx).label}:**
+  // The plan-review preflight prints disabled, ready, not_installed or under_current_harness and never `unverified`
+  // (gates 40477638211 and 40454750574: every judge sample read "(or unverified)" as a branch nothing can enter).
+  return `**If \`CODEX_MODE: ready\` — run ${outsideVoiceFor(ctx).label}:**
 
-${['plan-ceo-review', 'plan-eng-review'].includes(ctx.skillName) ? `Run this block for \`ready\` or \`unverified\`, in the one foreground Bash call described below.
+${['plan-ceo-review', 'plan-eng-review'].includes(ctx.skillName) ? `Run this block for \`ready\`, in the one foreground Bash call described below.
 Its opening harness guard rechecks the fresh shell: exit 78 uses the same Native
 fallback below, never a replacement provider. Finish termination before fallback and consume only
 completed output. Use private temporary paths, with no background jobs.` : `Run the selected backend in the one foreground Bash invocation described below.
@@ -716,7 +718,7 @@ numbers, and CHANGELOG entries that over- or under-sell what shipped. Be terse.
 
 THE DOCS AND DIFF: <include current contents of each touched document, with its path, plus affected source context; the parent appends the release diff below>"
 
-**If \`CODEX_MODE: ready\` (or \`unverified\`) — run ${outsideVoiceFor(ctx).label}:**
+**If \`CODEX_MODE: ready\`${outsideVoiceFor(ctx).id === 'codex' ? ' (or \`unverified\`)' : ''} — run ${outsideVoiceFor(ctx).label}:**
 
 ${outsideVoiceInvocation(ctx, { timeoutMs: 300000, diffCommand: 'DOC_DIFF_BASE=$(git merge-base origin/<base> HEAD 2>/dev/null || git merge-base <base> HEAD) && git diff "$DOC_DIFF_BASE" HEAD' })}
 

scripts/resolvers/plan-gates.ts

@@ -538,7 +538,7 @@ The plan completion results augment the existing Scope Drift Detection. If a pla
 - **HIGH-impact plan-file discrepancies** trigger AskUserQuestion showing the investigation findings:
   - Options: A) Stop this review for implementation, B) Continue this review with P1 TODOs, C) Record the items as intentionally dropped
   - A ends this invocation before code review or implementation. List the missing work; after implementation, start a fresh /review.
-  - B queues the approved TODO changes for Step 5, not this read-only audit. B/C continue to the final Scope Check and Step 2. None of these choices authorizes shipping or waives required verification.
+  - B queues the approved TODO changes for Step 5, not this read-only audit. B/C continue to Step 2. None of these choices authorizes shipping or waives required verification.
   - Spawned or non-interactive: report REQUIREMENTS MISSING, continue; record nothing.
 
 Otherwise the audit is **INFORMATIONAL**.
@@ -546,7 +546,8 @@ Discrepancies derived only from fallback sources (commit messages, TODOS.md, PR
 this question, whatever their IMPACT: report them in the Scope Check as lower-confidence missing requirements.
 
 When continuing after the audit (no HIGH-impact gate, or option B/C), emit the
-single final Scope Check using Step 1.5's provisional notes and this plan context:
+single final Scope Check in Step 3, after its full diff read, from Step 1.5's
+provisional notes and this plan context:
 
 \`\`\`
 Scope Check: [CLEAN / DRIFT DETECTED / REQUIREMENTS MISSING]

scripts/resolvers/review-army.ts

@@ -59,13 +59,13 @@ ${ctx.paths.binDir}/gstack-specialist-stats 2>/dev/null || true
 
 Select specialists from the scope signals above.
 
-**Always-on (dispatch on every review with 50+ changed lines):**
+**Always-on (every review with 50+ changed lines):**
 1. **Testing** — read \`${ctx.paths.skillRoot}/review/specialists/testing.md\`
 2. **Maintainability** — read \`${ctx.paths.skillRoot}/review/specialists/maintainability.md\`
 
-**If DIFF_LINES < 50:** Skip all specialists except State Machines. Print: "Small diff ($DIFF_LINES lines) — specialists skipped." Continue to Step ${stepMerge} with the ${isShip ? 'core/design-lite' : 'core'} findings and an empty specialist list, then the parent's Exploratory QA step and ${nextStep}. Small diffs skip fan-out, never the parent-owned smoke probes. Core shared-code checks also remain required.
+**If DIFF_LINES < 50:** Skip all specialists except State Machines (item 9 decides it). Print: "Small diff ($DIFF_LINES lines) — specialists skipped." Continue to Step ${stepMerge} with the ${isShip ? 'core/design-lite' : 'core'} findings and an empty or State Machines-only specialist list, then the parent's Exploratory QA step and ${nextStep}. Small diffs skip fan-out, never the parent-owned smoke probes or core shared-code checks.
 
-**Conditional (dispatch if the matching scope signal is true):**
+**Conditional (dispatch when its scope signal is true):**
 3. **Security** — if SCOPE_AUTH=true, OR if SCOPE_BACKEND=true AND DIFF_LINES > 100. Read \`${ctx.paths.skillRoot}/review/specialists/security.md\`
 4. **Performance** — if SCOPE_BACKEND=true OR SCOPE_FRONTEND=true. Read \`${ctx.paths.skillRoot}/review/specialists/performance.md\`
 5. **Data Migration** — if SCOPE_MIGRATIONS=true. Read \`${ctx.paths.skillRoot}/review/specialists/data-migration.md\`
@@ -280,7 +280,7 @@ Core shared-code savings never enter this footer; explain any overlap once in th
 #### 7. Save specialist activity
 
 Compile a \`specialists\` object for ${persistRef}.
-${isShip ? 'For each specialist' : 'For DIFF_LINES < 50, keep `specialists: {}`; do not manufacture per-specialist scope records. Otherwise record each considered specialist'} (testing, maintainability, security, performance, data-migration, api-contract, design, simplification, state-machines, red-team):
+${isShip ? 'For each specialist' : 'For DIFF_LINES < 50, keep `specialists: {}` (or `state-machines` alone when it dispatched); do not manufacture per-specialist scope records. Otherwise record each considered specialist'} (testing, maintainability, security, performance, data-migration, api-contract, design, simplification, state-machines, red-team):
 - If dispatched: \`{"dispatched": true, "findings": N, "critical": N, "informational": N}\`
 - If skipped by scope: \`{"dispatched": false, "reason": "scope"}\`
 - If skipped by gating: \`{"dispatched": false, "reason": "gated"}\`

scripts/resolvers/review-scope.ts

@@ -36,8 +36,8 @@ ${isShip ? `4. Output before Step 9:
 5. The Scope Check is **INFORMATIONAL**, not a separate blocker; retain it for the PR body and continue to Step 9. It never waives the plan audit's discrepancy gate.
 
 ---` : `4. Keep these notes provisional. Next, execute the plan-completion section;
-   it resolves the HIGH-impact decision and emits the single final Scope Check
-   before Step 2. The Scope Check itself is informational, not another gate.`}`;
+   it resolves the HIGH-impact decision before Step 2; Step 3 emits the single
+   final Scope Check after its full diff read. It is informational, not another gate.`}`;
 }
 
 // ─── Cross-Review Finding Dedup ──────────────────────────────────────

scripts/resolvers/sideways.ts

@@ -50,6 +50,6 @@ export function undeclaredBehaviorLines(): { fields: string; rule: string } {
   return {
     fields: `Diff read: full (<n> files, <m> hunks) | partial (<unread paths>)
 Undeclared behavior changes: <behavior the diff changes that the PR body, commit messages and plan do not state> | none`,
-    rule: `\`Diff read\` records the full-diff read Step 3 required; \`Scope Check: CLEAN\`, and options B and C above, count as approved only with \`Diff read: full\` recorded. A partial read is \`DRIFT DETECTED\` naming the unread paths. \`Undeclared behavior changes\` lists every behavior the diff changes (a default, an exit code, a stored value, a route, a side effect) that the author's own summary omits; each is a Scope Check item for the reviewer, never silently CLEAN.`,
+    rule: `\`Diff read\` records Step 3's full-diff read; \`Scope Check: CLEAN\`, and options B and C above, count as approved only with \`Diff read: full\` recorded. A partial read is \`DRIFT DETECTED\` naming the unread paths. \`Undeclared behavior changes\` lists every behavior the diff changes (a default, an exit code, a stored value, a route, a side effect) that the author's own summary omits; each is a Scope Check item for the reviewer, never silently CLEAN.`,
   };
 }