Port G1 "Review before decision" as staged (Ouroboros task 81ff7bb71a3e446e)

Source: the paused Ouroboros contribution G1, contributor tree
projects/issues-20261012-g1, branch contrib/review-before-decision-20261013 at
9ccdedbad (no G1 commit; all work was in the index). Applied from the exact
snapshot handoff-g1-03/g1/staged.patch, sha256 ffa2a76aa40443fe... (120 files,
+6515/-829), on d63d458bd. Authorship of the design and the code is Ouroboros
(task 81ff7bb71a3e446e, with its a5db final delta). It closes #1741 (handback
before Git in Advisory and Cyber Pro, frozen readers, exact-attempt rejoin),
#1737 (pending_review=wait honoured in Cyber Pro), #1731 (Auto = typed
nomination, Required = nomination or observed production, Off buys no root
panel; acceptance_material), #1736, #1735, #1723, #1742, #1667 and the owner's
O9 Settings save under Wrap up, #1738 (late_review_marks: one host mark in the
owning room, released only by the integrating mind), and the receptive wait
(an addressed message ends only the author's wait).

Dropped, and why:
- ouroboros/tools/plan_review_collect.py (owe_plan_wave, settle_ended_plan_wave,
  publish_ended_plan_feedback, _late_plan_lines, attach_historical_results(errors))
  and ouroboros/tools/plan_review_artifacts.py (the record_plan_review_supplement
  latch, author_ended, owe-before-publication in record_exact_wave): the v2 plan
  engine they extend is retired on this candidate (the collector is deleted;
  late v2 results are history only). Late plan delivery is re-made on the
  planning organ in a later commit.
- the two tools/review.py hunks that drop the ToolResult re-imports at :186 and
  :260: upstream already hoisted that import to the function's first statement.
- the nine plan-wave cases of tests/test_late_review_marks.py (they drive the
  deleted collector); rewritten as organ scenarios in a later commit.

Re-merged, restored, re-homed:
- owner_wait._sleep_wake: G1's left-review settlement wake merged with upstream
  #1864 (the sleep path keeps acquisition_budget(0)).
- web/modules/chat.js: the model-wait controller gets notify: showToast again.
- web/modules/settings.js would reach 1601 lines (cap 1600): the Settings
  policy-state lines (policyValueLabel, G1's cyberReviewNote, syncPolicyState)
  move to web/modules/settings_policy.js, one responsibility with no import
  back; the one-line if bodies a5db squeezed into cyberReviewNote are blocks again.
- tests whose files this candidate rewrote get G1's new cases appended at their
  natural place: test_awaited_review_not_degraded (wait keeps the same panel),
  test_review_cyber_authority (skill_review texts), test_review_view_integration
  (#1723 first gate wave), test_workflow_review_outcomes (clean PASS handback).
- fixture drift from G1's own #1731 rule: the _finality_pass traces of
  test_acceptance_author_stop and test_review_author_finality record the write's
  observed outcome (a bare argument is an intention, not production).
- ouroboros/domains.toml registers ouroboros/tools/plan_delivery.py (D06),
  missing on d63d458bd, so the domain map regenerates; DOMAIN_MAP.md and the
  inventories are regenerated.

Kept as staged here and adapted in the following commits: the acceptance rule
after a rewrite, the plan_wave branch of late_review_marks._settle_owed, the
second (settled=true) left-review receipt write, the gateway's import of the
private _operation_stop_state, and the doc and prompt texts that rejected
(docs/CHECKLISTS.md:70, 01-high-level-architecture, 06-rules-by-change-class).

docs/DESIGN.md

@@ -206,7 +206,10 @@ A segmented choice row gives every choice the same width. Up to four fill their
 row; a longer scale wraps into equal columns of four and leaves its last row partly
 empty rather than stretching a lone choice; a narrow card stacks two; one-glyph
 values such as review cycles stay one row. An empty inherit choice is as real as
-any other, and the focused choice wears the one focus ring.
+any other, and the focused choice wears the one focus ring. A choice the running
+Access suspends — Blocking under Cyber Pro — stays selected; the note beside it
+names its effect for the current process and for the selected next start, from
+the draft before Save.
 
 Short fixed choices keep native selects, including the platform's own popup.
 A control never widens its column: a select shows its chosen label on one
@@ -1438,6 +1441,8 @@ asks to return, and only the primary's own accepted reply counts as a return.
 
 A submitted action is shown as pending until the task reports its application.
 A saved Settings change and a still-pending task change are disclosed separately.
+When a requested Settings save failed or is unconfirmed, resolving the wait shows one
+toast with those facts; closing its card without resolution announces nothing.
 Retries preserve the original request identity and payload. Revisioned rows reject
 older observations and resolved episodes never reopen. Terminal authors retain
 exact live paid-review controls without reviving author status; other waits end. A mailbox delivery failure keeps Retry request available for