Story 2559: attention that cannot quietly misdirect counsel

Mental model: the Deep Read envelope is a marked reading copy. Each section gets one suggested reading allocation, but an uncertain suggestion is erased rather than left behind as a dangerous “skip”. The run also keeps the opaque provider/cache ticket that lets Glance and Deep Read continue the same model session.

The failure this prevents

A model can be unsure and still output skip. If the wire stores only that grade, the reading surface can make a material section look safely ignorable. The envelope now represents uncertainty explicitly: a suppressed row has grade: null, and a graded row cannot claim it is suppressed.

section-1
  attention: {
    grade: null,
    reason: "below the panel confidence floor",
    confidence: 0.59,
    order: 1,
    estimated_seconds: 20,
    suppressed: true
  }

UI result: no allocation; counsel reads normally

The existing evidence wall stays intact

Attention is a fourth proposed-row type. It reaches the permanent envelope through the same candidate → judge ruling → assembler trace path as every other row. Section references are checked after assembly, while quoted findings and assertions still pass the unchanged byte-exact V-CITE wall.

Invariant	Mechanical result
One allocation per admitted section	Unknown, missing, or duplicate section attention rejects the envelope.
I-12 fail-safe	`suppressed` is true exactly when `grade` is absent.
Trace authority	`rows[].trace` remains candidate IDs + judge ruling ID + `vcite_verified`.
V-CITE	Evidence span verification is unchanged.

Why session continuity lives on the run

The panel uses several models, so two scalar columns would lose sessions. Each run instead stores a typed JSON array with one entry per model: agent_key, model_id, cached_prefix_id, and provider_session_id. The run’s parent job supplies document_id and extraction_version, making the effective key (document_id, extraction_version, model). Repeated pass receipts merge idempotently; conflicting continuity for the same model fails closed.

Proof

Contract tests round-trip attention and panel sessions, including the planted false-skip contradiction. Assembler tests preserve the trace/V-CITE chain and reject broken section links. The real-Postgres orchestration test settles repeated proposer/judge passes, then reads back one suppressed attention row and a deduplicated per-model session list. The Alembic roundtrip proves upgrade → base → upgrade with one head.