Retain Spot database qualification refusal as separate operation

doc/plans/2026-10-26-chat-catalog-eval-progress.md

@@ -4,6 +4,7 @@ Updated: 2026-10-27. This is the single progress record for [the saved goal](202
 
 ## Current state
 
+- **Second remote qualification operation:**[run40524193545](https://github.com/paperclipai/paperclip/actions/runs/40524193545), target6175603, proved actual Spot/x86_64 then failed host database-image qualification (`owned-linux-amd64-postgres-image-unqualified`) before evaluation. Authenticated artifact12743322992 and exact extracted bytes are verified; the underlying Docker/image cause is not yet established. Operation1 remains separate. Both have0canonical/native/provider work and consume0case ordinals; all244 remote initials remain unrun. Receipt:`results/chat-catalog-remote-opencode/operation-40524193545.json`. Separate reporter PR17888 head822f171177 remains open/unmerged with CI pending at the manager checkpoint; no reporter outcome is inferred from this host receipt.
 - **First remote operation:**[Actions run40519322850](https://github.com/paperclipai/paperclip/actions/runs/40519322850), exact target6175603, was refused by the actual-host gate because AWS supplied On-Demand instead of Spot. Authenticated artifact12740329812 and its SHA256-bound host receipt prove evaluation was not admitted:0canonical/model/native work and0case ordinals consumed. All244 remote initials remain unrun. Separately, trusted reporter dependency installation failed with `ERR_PNPM_LOCKFILE_CONFIG_MISMATCH`; this is not a case/model outcome. No redispatch or retry is authorized by this record. Remote operation evidence is under `results/chat-catalog-remote-opencode/operation-40519322850.json`; the historical local ledger is unchanged.
 - **User steering supersedes the local queue:**all new local admissions are stopped. All admitted children have finished and exact owned absence is verified; no remaining76/22 local initials, local B or new health launches. Future execution is GitHub Actions on existing AWS spot runners, using the new Paperclip runner OpenCode provider via OpenRouter model `deepseek/deepseek-v4.1-flash-1017`. Local histories remain preserved; their passes cannot qualify the separately named remote lane. The manager approved a new remote initial for every scenario plus at most one coherent correction measurement, with distinct history and no erased local ordinals.
 - **Readable results:**`tests/runner-e2e/results/chat-catalog-campaign/interim-results.html` now shows all244 searchable outcomes plus frozen public canonical query/context/intended outcome, conservative stage proofs, edited diagnoses, correction commits, evidence references, elapsed gaps and six open/unmerged core PRs. The local checkpoint is closed. Proofs establish105 saved canonical queries,102 exact canonical-native admissions,14 returned feature grades and110 observation-grade snapshots; unproven stages stay unknown. Eighteen measurements have confirmed zero native IDs, two lack bound run-count proof; zero native alone is not a setup classification. Recorded reservation span is15.539h; union of completed attempt wall intervals4.719h (not model time), sum5.879h (overlaps counted). Two large no-measurement gaps total8h26m and are being source-attributed separately.

tests/runner-e2e/chat-remote-campaign.test.ts

@@ -42,8 +42,17 @@ describe("remote Actions cell import", () => {
     delete f.host.postgres; delete f.host.dockerEngineSha256;
     const operation = validateRemoteHostRefusal(f.input());
     expect(operation.caseMeasurements).toBe(0); expect(operation.caseOrdinalsConsumed).toBe(0); expect(operation.initialIntentConsumed).toBe(false);
-    f.host.evaluationAdmitted = true; expect(() => validateRemoteHostRefusal(f.input())).toThrow("On-Demand refusal");
-    f.host.evaluationAdmitted = false; f.host.lifecycle = "spot"; expect(() => validateRemoteHostRefusal(f.input())).toThrow("On-Demand refusal");
+    f.host.evaluationAdmitted = true; expect(() => validateRemoteHostRefusal(f.input())).toThrow("host refusal");
+    f.host.evaluationAdmitted = false; f.host.lifecycle = "spot"; expect(() => validateRemoteHostRefusal(f.input())).toThrow("host refusal");
+  });
+  it("retains Spot image-qualification refusal separately and rejects invented admission", () => {
+    const f = fixture(); Object.assign(f.host, { status: "blocked", lifecycle: "spot", reason: "owned-linux-amd64-postgres-image-unqualified", instanceId: "i-12345678", imageId: "ami-12345678" });
+    delete f.host.postgres; delete f.host.dockerEngineSha256;
+    const operation = validateRemoteHostRefusal(f.input());
+    expect(operation.actualHost.lifecycle).toBe("spot"); expect(operation.caseOrdinalsConsumed).toBe(0);
+    f.host.reason = "unknown-failure"; expect(() => validateRemoteHostRefusal(f.input())).toThrow("host refusal");
+    f.host.reason = "owned-linux-amd64-postgres-image-unqualified"; f.host.postgres = {};
+    expect(() => validateRemoteHostRefusal(f.input())).toThrow("host refusal");
   });
   it("keeps unknown billing unknown and reported OpenRouter billing separate", () => {
     const f = fixture(); expect(remoteCellUsage(f.result)).toEqual({ costUsd: null, tokens: null, coverage: "unavailable" });

tests/runner-e2e/chat-remote-campaign.ts

@@ -72,7 +72,7 @@ export function validateRemoteCell(input: {
     result, definitionDigest: definition.definitionDigest, graderDigest: definition.graderDigest, databaseLane };
 }
 /** A pre-attempt qualification refusal is an operation, never a case reservation.
- * Only the source-qualified On-Demand branch proves this exact zero-admission stage. */
+ * Only these two source-qualified host-gate branches prove this zero-admission stage. */
 export function validateRemoteHostRefusal(input: {
   intent: RemoteCellIntent; provenance: RemoteArtifactProvenance; host: RemoteArtifactDocument;
 }) {
@@ -82,11 +82,12 @@ export function validateRemoteHostRefusal(input: {
   requireProof(/^[a-f0-9]{40}$/.test(intent.sourceRevision) && p.targetSourceRevision === intent.sourceRevision
     && host.sourceRevision === intent.sourceRevision && host.workflowRunId === p.runId && host.workflowAttempt === p.runAttempt
     && host.workflowRef === "paperclipai/paperclip/.github/workflows/runner-full-stack-e2e.yml@refs/heads/master", "qualification source/run mismatch");
+  const knownRefusal = host.lifecycle === "on-demand" && host.reason === "on-demand-or-unknown-host-refused-before-evaluation"
+    || host.lifecycle === "spot" && host.reason === "owned-linux-amd64-postgres-image-unqualified";
   requireProof(host.schema === "paperclip.chat-remote-host/v1" && host.status === "blocked" && host.scope === "before-evaluation"
-    && host.evaluationAdmitted === false && host.automaticRetries === 0 && host.lifecycle === "on-demand"
-    && host.reason === "on-demand-or-unknown-host-refused-before-evaluation" && !host.postgres && !host.dockerEngineSha256
+    && host.evaluationAdmitted === false && host.automaticRetries === 0 && knownRefusal && !host.postgres && !host.dockerEngineSha256
     && host.region === "us-east-1" && host.architecture === "x86_64" && /^i-[a-f0-9]{8,17}$/.test(host.instanceId)
-    && /^ami-[a-f0-9]{8,17}$/.test(host.imageId), "not the proven pre-evaluation On-Demand refusal");
+    && /^ami-[a-f0-9]{8,17}$/.test(host.imageId), "not a proven pre-evaluation host refusal");
   requireProof(Array.isArray(host.executionIds) && host.executionIds.length === intent.selected.length
     && new Set(host.executionIds).size === host.executionIds.length
     && intent.selected.every(row => host.executionIds.includes(row.executionId)), "qualification selection mismatch");
@@ -96,7 +97,7 @@ export function validateRemoteHostRefusal(input: {
     outcome: "infrastructure-blocked-before-evaluation", reason: host.reason,
     evaluationAdmitted: false, canonicalQueries: 0, nativeRuns: 0, providerCalls: 0,
     caseMeasurements: 0, caseOrdinalsConsumed: 0, initialIntentConsumed: false,
-    caseExecutionIds: host.executionIds as string[], actualHost: { lifecycle: "on-demand", region: host.region, architecture: host.architecture },
+    caseExecutionIds: host.executionIds as string[], actualHost: { lifecycle: host.lifecycle as "on-demand" | "spot", region: host.region, architecture: host.architecture },
     reporterConclusionIsIndependent: true } as const;
 }
 export function remoteCellUsage(result: RunnerE2EResult): CampaignAttempt["usage"] {