Certification block, shipped 2026-09-10 (entirely-api 8c0fd5a, entirely-portal 8f5e192, Supabase migration 047 projects.cert_blocked + reason/at/by). Trigger: BAL-9006 (3108 Ervin Court, Annapolis, JES Baltimore) — customer asked to be invoiced for the inspections with NO certification issued. services/cert_block.py is the one gate; every cert path refuses while the flag is set (portal draft/approve/send/resend, generate_cert_package, deliver_cert_internal → HTTP 423 cert_blocked, Friday send_cert). Confidence routing routes the invoice alone; send_invoice omits the “certification package sent separately” line; auto-validation, cert_validate, needs engine, shepherd cert rules, missing-certs and the review queue skip blocked projects; the close write-guard accepts Paid alone. Portal: header banner with reason, owner/admin Block / Lift buttons (POST /portal/projects/{id}/cert-block), CertPanel hides cert actions, cert sub-track “Blocked”, Cert Blocked flag badge on header + Workbench. Gotcha: projects_enriched enumerates its columns, so the shepherd does a separate cert_blocked id lookup rather than reading the view. BAL-9006 blocked 2026-09-10 13:21 UTC by dustin; 2 production days entered on the UND-PUSH line (owner_manual, confirmed); invoice BALT-INV-9265 drafted at $1,900, awaiting Dustin’s send.