@@ -57,4 +57,4 @@
 - 产出裁决的每轮都须读到契约复审档位,见回退证据 ⇒ 裁决整体作废。
 - 父会话只可逐字采纳或整体作废(核验失败、越范围、格式不完整),⛔ 永不改写润色。
 - PASS、FAIL 与作废都落 PR 或卡;同 head 再起子代理须引前次作废因,⛔ 不重起求 PASS。
-- 契约复核 ⛔ 不适用额度耗尽豁免降档:豁免对象是派发,复核 ⛔ 不随派发档位免除。
+- 额度耗尽豁免只及派发 ⛔ 不及复核;档位退役 ≠ 耗尽,恒维护者裁决 ⛔ 非席位读数。
@@ -12119,9 +12119,27 @@ export function residueLines(
  * gate's accept set is the maintainer's decision, not a refresh-time
  * convenience. The review label deliberately names WHAT is reviewed, never a
  * model (maintainer, 2026-08-16: 「needs:fable-review 这个标签不好,下次模型升级怎么办」).
+ *
+ * ## A tier that is GONE is not a tier that is EXHAUSTED (#19544)
+ *
+ * The exits below carry a QUOTA exemption: a tier that is exhausted comes
+ * back, so the card waits out of the queue and the review is never downgraded
+ * and never self-reviewed. A tier that has been RETIRED never comes back, and
+ * the two cases differ on WHO MAY ACT: a seat reading 「⛔ 不许降档」 onto a
+ * vanished tier holds its whole lane forever, and a seat picking the
+ * replacement itself is the silent downgrade the fuse exists to stop. So a
+ * retirement is a maintainer ruling and ⛔ never a seat's reading — and when
+ * the ruling lands, this VALUE is the one line that moves. The ceiling of the
+ * ladder `tierLines` prints is DERIVED from it ({@link TIER_CEILING}) so the
+ * two cannot drift apart. This value moved off the retired ceiling on the
+ * maintainer's 2026-09-21 ruling — verbatim: 「fable 没有了」, answered with
+ * 「改成 opus」 — which is why the docblocks below still name the retired tier
+ * where they record what was ruled AT THE TIME; a record of what was served
+ * then stays true. Rule text: `references/contract-review.md` 「降档保险丝」.
+ *
  * Rulebook: `.claude/skills/pm-dispatch/SKILL.md` 「入队与落地」 — the clause-② gate and the `needs:contract-review` review-chain bullets.
  */
-export const CONTRACT_REVIEW_TIER = 'claude-fable-5-1';
+export const CONTRACT_REVIEW_TIER = 'claude-opus-5';
 
 /**
  * The globs that MANDATE a model tier for any card whose file surface touches
@@ -12201,9 +12219,10 @@ export const CONTRACT_REVIEW_TIER = 'claude-fable-5-1';
  *
  * The sanctioned exits from a mandate — the one-line-class mechanical-edit
  * downgrade (a card CONTENT judgment, like clause ②), the measured quota
- * exemption (fable unavailable ⇒ opus, never lower) and the proactive
- * low-headroom downgrade — are claim-time judgments, not properties of the
- * file surface. This tool states the mandate; the seat records any exit and
+ * exemption (the mandated tier EXHAUSTED ⇒ the default tier, never lower — a
+ * tier that is RETIRED is not exhausted and is a maintainer ruling instead,
+ * ⛔ never a seat's reading) and the proactive low-headroom downgrade — are
+ * claim-time judgments, not properties of the file surface. This tool states the mandate; the seat records any exit and
  * its reason in the claim comment. ONE exit is path-shaped, and so it IS
  * encoded: the one-line-class downgrade does not exist for a surface under
  * `skills/**` — the 2026-09-10 ruling's 必须, because a closed enumeration
@@ -12331,6 +12350,49 @@ export const TIER_FLOOR = 'sonnet';
 /** The default judgment tier for a card with no mandate — the ruling's 默认判断档. */
 export const TIER_DEFAULT = 'opus';
 
+/**
+ * The FAMILY word inside a model id — `claude-<family>-<version>` ⇒ `family`.
+ *
+ * The ladder the claim comment quotes is written in family words (`sonnet`,
+ * `opus`), while {@link CONTRACT_REVIEW_TIER} is a full model id, so the
+ * ceiling has to cross between the two vocabularies somewhere. It crosses
+ * HERE, by derivation, because the alternative — writing the ceiling's word
+ * down beside the constant — is the second value site the constant's own
+ * docblock refuses, and it is exactly how the ladder came to read 「ceiling
+ * fable」 for a tier the harness had stopped serving.
+ *
+ * An id this cannot read returns VERBATIM rather than throwing or guessing: a
+ * ladder printing the whole model id is louder than one printing a family word
+ * nobody ruled, and `--tier` runs on every dispatch, so a model id in an
+ * unfamiliar shape must not take the tool down. Both directions are pinned.
+ */
+export function tierWordOf(modelId) {
+  const m = /^claude-([a-z]+)-/.exec(String(modelId ?? ''));
+  return m === null ? String(modelId ?? '') : m[1];
+}
+
+/**
+ * The ladder's CEILING — the contract-review tier, in the ladder's vocabulary.
+ *
+ * ⛔ Not a constant of its own: derived from {@link CONTRACT_REVIEW_TIER} so a
+ * retirement ruling moves ONE line and the ladder follows. The day the ceiling
+ * and the default read the same word is not a bug — it is what a retired
+ * ceiling falling to the default LOOKS like, and the ladder says so rather
+ * than keeping a tier nobody can be dispatched at.
+ */
+export const TIER_CEILING = tierWordOf(CONTRACT_REVIEW_TIER);
+
+/**
+ * Tier family words this ladder once printed and must never print again.
+ *
+ * ⛔ Not a tier table and ⛔ not an ordering — a RETIRED-SPELLING guard, the
+ * same shape as the retired clause-② keys pinned further down. The self-test
+ * asserts no rendering contains one, so the day a ceiling is written down by
+ * hand again it reds instead of quietly outliving the harness that served it.
+ * A word leaves this list only when a maintainer ruling brings the tier back.
+ */
+export const RETIRED_TIER_WORDS = Object.freeze(['fable']);
+
 /**
  * Place a card's file surface against the mandatory globs. Pure over its
  * inputs, so the self-test can drive every branch offline.
@@ -12394,7 +12456,7 @@ export function tierLines(result) {
   if (!mandatory) {
     return [
       `Model tier — no path-derived mandate: the surface hits none of the ${declared} declared glob(s), derived here, not recalled.`,
-      `  The tier stays the PM's per-card judgment call (floor ${TIER_FLOOR} · default ${TIER_DEFAULT} · ceiling fable).`,
+      `  The tier stays the PM's per-card judgment call (floor ${TIER_FLOOR} · default ${TIER_DEFAULT} · ceiling ${TIER_CEILING}).`,
       clause2,
       ...suspicion,
     ];
@@ -12415,7 +12477,8 @@ export function tierLines(result) {
     `Model tier — MANDATORY: ${tier} (derived from the file surface, not recalled).`,
     ...hits.map((h) => `  - ${h.path} ⇢ '${h.glob}' — ${h.why}`),
     `  Exits, each recorded with its reason in the claim comment's \`Container & model\` line: ${oneLineExit};` +
-      ' the measured quota exemption (fable unavailable ⇒ opus, never lower); the proactive low-headroom downgrade.',
+      ` the measured quota exemption (the mandated tier EXHAUSTED ⇒ ${TIER_DEFAULT}, never lower — a tier that is` +
+      " RETIRED is a maintainer ruling instead, ⛔ never a seat's reading); the proactive low-headroom downgrade.",
     clause2,
     ...suspicion,
   ];
@@ -25232,6 +25295,60 @@ function selfTest() {
   t(`every frame-sync-enforced copy is fable-mandated (unmandated: ${frameFiles.filter((f) => !deriveTier([f]).mandatory).join(', ') || 'none'})`, frameFiles.length > 0 && frameFiles.every((f) => deriveTier([f]).tier === CONTRACT_REVIEW_TIER));
   t('the SKILL.md main file and the dev-agent definition are declared in their own right, not only via the frame table', MANDATORY_TIER_GLOBS.some((g) => g.glob === '.claude/skills/pm-dispatch/SKILL.md') && MANDATORY_TIER_GLOBS.some((g) => g.glob === '.claude/agents/os-dev.md'));
 
+  // ── The ladder's CEILING and the constant, pinned TOGETHER (#19544) ───────
+  //
+  // The ceiling used to be a WORD written beside the constant, and the pair
+  // drifted in the one direction nothing could see: the harness stopped
+  // serving the tier, the constant kept naming it, and the ladder went on
+  // printing its family word as a LIVE rule for a tier no dispatch could
+  // reach. The ceiling is derived now, so these cases hold the RENDERING
+  // against the constant rather than against a remembered word — write the
+  // ceiling by hand again and they red, whichever half was edited.
+  // The provenance ROWS (`  - <path> ⇢ '<glob>' — <why>`) are excluded from the
+  // retired-word guard below, and deliberately: several of them quote a
+  // maintainer ruling verbatim, and a record of what was ruled AT THE TIME
+  // stays true however the tier moves afterwards. What the guard covers is the
+  // rules — the ladder, the exits, the clause-② note, the suspicion line.
+  const liveRuleText = (rendered) => rendered.split('\n').filter((l) => !/^\s+- /.test(l)).join('\n');
+  const ladderRenderings = [plainLines, mandLines, catalogLines, tierLines(fableOf(['packages/spec/src/api/error-code-ledger.zod.ts'])).join('\n')].map(liveRuleText);
+  const ladderLine = plainLines.split('\n').find((l) => l.includes('The tier stays')) ?? '';
+  t('the ladder prints a ceiling DERIVED from the contract-review constant, so the two cannot drift apart', ladderLine.includes(`ceiling ${tierWordOf(CONTRACT_REVIEW_TIER)})`), ladderLine || 'no ladder line was rendered at all');
+  t("…in the ladder's own vocabulary — the constant's FAMILY word, so a parseable id NEVER reaches the ladder verbatim", /^claude-[a-z]+-/.test(CONTRACT_REVIEW_TIER) && TIER_CEILING === tierWordOf(CONTRACT_REVIEW_TIER) && !ladderLine.includes(CONTRACT_REVIEW_TIER), ladderLine);
+  t('tierWordOf reads the family out of an id, and hands an unreadable one back VERBATIM rather than guessing a word', tierWordOf('claude-example-9-9') === 'example' && tierWordOf('an-unfamiliar-shape') === 'an-unfamiliar-shape' && tierWordOf(null) === '');
+  t(`⛔ no RETIRED tier word survives in any live RULE — ladder, exits, clause-② note and suspicion line all read the constant (dirty: ${ladderRenderings.map((l, i) => RETIRED_TIER_WORDS.filter((w) => l.toLowerCase().includes(w)).map((w) => `${i}/${w}`).join(' ')).filter(Boolean).join(' ') || 'none'})`, ladderRenderings.every((l) => RETIRED_TIER_WORDS.every((w) => !l.toLowerCase().includes(w))));
+  t('…and the guard is not reading an empty string — every rendering it clears still carries its own rule text', ladderRenderings.every((l) => l.includes('Model tier')) && ladderRenderings.some((l) => l.includes('Exits,')));
+  t('the retired-spelling guard is not vacuous — it names at least one word, and none of them is a tier still in the ladder', RETIRED_TIER_WORDS.length > 0 && !RETIRED_TIER_WORDS.includes(TIER_FLOOR) && !RETIRED_TIER_WORDS.includes(TIER_DEFAULT) && !RETIRED_TIER_WORDS.includes(TIER_CEILING));
+  // A sibling case further down pins the constant's CURRENT value to exactly
+  // one site under these roots. What that case cannot see is a RETIRED id left
+  // behind — it is not the current value, so nothing compares it to anything,
+  // and it reads to a grepping seat as a live tier rule. So this one asks the
+  // rulebook root a different question: does it spell a model id AT ALL? The
+  // skill's own rule is 「本文不写模型名」, and a retirement is the moment that
+  // promise pays for itself — the tree needs no edit, so it cannot go stale.
+  const walkFilesUnder = (dir, out = []) => {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const abs = nodePath.join(dir, entry.name);
+      if (entry.isDirectory()) walkFilesUnder(abs, out);
+      else if (entry.isFile()) out.push(abs);
+    }
+    return out;
+  };
+  const SKILL_RULEBOOK_ROOT = '.claude/skills/pm-dispatch';
+  const skillRulebookFiles = walkFilesUnder(nodePath.join(ROOT, SKILL_RULEBOOK_ROOT));
+  const skillIdSpellings = [];
+  for (const abs of skillRulebookFiles) {
+    readFileSync(abs, 'utf8').split('\n').forEach((line, i) => {
+      if (/\bclaude-[a-z]+-\d[\w.-]*/.test(line)) skillIdSpellings.push(`${nodePath.relative(ROOT, abs)}:${i + 1}`);
+    });
+  }
+  t(`${SKILL_RULEBOOK_ROOT} spells NO model id at all — ${skillRulebookFiles.length} file(s) read, and a RETIRED id left there is caught HERE, where a current-value pin cannot see it (found: ${skillIdSpellings.join(', ') || 'none'})`, skillRulebookFiles.length > 0 && skillIdSpellings.length === 0);
+  // The rulebook half of the same coupling: the skill names the constant, and
+  // its downgrade fuse carries the case the quota exemption never had.
+  const fuseRules = readFileSync(nodePath.join(ROOT, '.claude/skills/pm-dispatch/references/contract-review.md'), 'utf8');
+  t('the rulebook names the contract-review tier by its CONSTANT, so a retirement moves the value and the prose follows', fuseRules.includes('`CONTRACT_REVIEW_TIER`'));
+  t('…and its fuse keeps the quota exemption pointed at DISPATCH, never at the review', /额度耗尽豁免[^\n]*⛔[^\n]*不及复核/.test(fuseRules));
+  t('…and carries the case it never had: a RETIRED tier is not an exhausted one, and it is a maintainer ruling, ⛔ never a seat\'s reading', /档位退役[^\n]*≠[^\n]*耗尽[^\n]*维护者裁决[^\n]*⛔[^\n]*非席位读数/.test(fuseRules));
+
   // ── Clause-② suspicion (the enqueue-gate card): hit / no hit / wording ────
   //
   // The wording cases are not decoration — the suspicion line is quoted into