Govern exceptions

Policy, permissions, and an audit trail stay attached to every next action — from mismatch to close.