The two served-surface decisions deferred by the off-serving lanes, scoped against
shipped code — the VERIFIED and ASK halves of the same 'where off-serving stops' line.
ASK (ask_serving_enabled): pass_manager integration point (the _classify_all_refused
emit site), two-layer split, the Q1B_ASK_CARVE_OUT retirement gate coupled to the
switch (not to Q1-D), and the no-question/no-proposal dead-zone proof as a flip
precondition.
VERIFIED (verified_serving_enabled): the gold-free independent-reader eligibility bar
(independence in the READING not the solving), _canonically_verified as the inert seam,
validate-first holdout gates, and the explicit import-level ban on eval-gold-backed
serving (P1-B stays off-serving forever).
Both gated by a config kill-switch sibling of estimation_enabled; both keep the GSM8K
seal byte-identical. No served-surface code until reviewed.
