@event4u/agent-config 9.33.0 → 9.35.0

package/src/scripts/_lib/session_register.ts

@@ -50,7 +50,16 @@
  *    longer than the TTL means another session may claim your branch.
  * 2. **This is advisory, not a mutex.** Two sessions can claim in the same
  *    millisecond. Nothing here provides exclusion, and no later feature may be
- *    built on it as if it did.
+ *    built on it as if it did. `sessions:claim` refusing to WRITE a claim a peer
+ *    holds is a consistency check on its own write, not exclusion: it protects
+ *    the record from being false, never the peer from being duplicated.
+ * 3. **The claim is per SESSION, and the bridge file has to be too.** The
+ *    paragraph above rules `agents/runtime/state/` out for the register and the
+ *    same argument applies to the claim that feeds it: one shared file per
+ *    checkout means a second session in the same directory reads the first one's
+ *    claim as its own. Measured — four live records carrying one identical,
+ *    already-archived slug. The file is keyed on the host session id where one
+ *    exists, and degrades to the shared path where none does.
  *
  * ## Failure is always open
  *
@@ -359,3 +368,60 @@ export function foreign_live_records(
     const own = safe_stem(session_id);
     return read_live_records(dir, options).filter((r) => safe_stem(r.session_id) !== own);
 }
+
+// ---------------------------------------------------------------------------
+// Collisions — and why `branch` alone was the wrong axis
+// ---------------------------------------------------------------------------
+
+/**
+ * What two live sessions are colliding over.
+ *
+ * `branch` was the only axis this register checked, and it is the CHEAP one: two
+ * sessions on one branch see each other immediately, and coordinating is a
+ * `git worktree add`. `roadmap` is the expensive one and went unchecked —
+ * measured twice (PR #1277/#1280, PR #1280/#1281), both times two sessions built
+ * the SAME roadmap phase under DIFFERENT branch names
+ * (`feat/dispatch-safety-confirmation` vs `feat/dispatch-safety-confirmed-execution`),
+ * so the branch comparison was silent by construction while a whole
+ * implementation was duplicated. One of the two PRs is thrown away either way.
+ */
+export type CollisionKind = 'roadmap' | 'branch';
+
+export interface Collision {
+    kind: CollisionKind;
+    record: SessionRecord;
+}
+
+/**
+ * Classify what this session collides with, roadmap-first.
+ *
+ * Ordering is the finding, not a preference: a roadmap collision means the work
+ * is being done twice and one branch is already wasted, while a branch collision
+ * means two sessions can see each other's commits. Reporting the cheap one first
+ * is what let the expensive one pass unremarked.
+ *
+ * A `null` slug never collides — "no roadmap claimed" is the state of every
+ * session before it picks one, and treating absence as a match would make the
+ * warning fire on every pair of fresh sessions and be switched off.
+ */
+export function classify_collisions(
+    others: readonly SessionRecord[],
+    here: { branch: string | null; roadmap_slug: string | null },
+): Collision[] {
+    const out: Collision[] = [];
+    for (const r of others) {
+        if (
+            here.roadmap_slug !== null &&
+            r.roadmap_slug !== null &&
+            r.roadmap_slug === here.roadmap_slug
+        ) {
+            out.push({ kind: 'roadmap', record: r });
+        }
+    }
+    for (const r of others) {
+        if (here.branch !== null && r.branch === here.branch) {
+            out.push({ kind: 'branch', record: r });
+        }
+    }
+    return out;
+}

package/src/scripts/_lib/subagent_capsule.ts

@@ -232,10 +232,35 @@ export interface MainSessionRecycleEnvelope {
      * of silent. Required; an empty list is a claim, not a default.
      */
     not_carried_forward: string[];
-    /** Choices already made, each with its one-line rationale in the same line. */
+    /**
+     * Choices already made, each with its one-line rationale in the same line.
+     *
+     * A line MAY close with a reversibility tag — `[reversible]` or
+     * `[irreversible]` — so the successor can tell "we picked A over B, easy to
+     * revisit" from "we already migrated the data". The tag is OPTIONAL, so no
+     * committed envelope is retroactively invalid; when present its spelling is
+     * validated, which is what keeps it a checkable field rather than a doctrine
+     * nobody can verify. No claim is made that it improves resumption — that
+     * stays the registered, unmeasured `envelope_resume_success` metric.
+     */
     decisions?: string[];
     /** Binding constraints the successor must not silently re-open. */
     constraints?: string[];
+    /**
+     * Paths the successor must NOT modify — a parallel worktree, a file another
+     * session holds, a generated projection whose source lives elsewhere.
+     *
+     * Distinct from `constraints`, which carries decisions in prose: this is a
+     * list of path refs, so "was this path off limits?" is answerable by
+     * comparison instead of by reading. That checkability is the whole reason it
+     * is a field rather than a sentence — the same bar the handoff-envelope
+     * adjudication set (a field whose presence is checkable survives where a
+     * doctrine whose effect is unmeasured did not).
+     *
+     * Optional: an envelope with nothing off limits states nothing here, and an
+     * empty list is not a claim that everything is writable.
+     */
+    do_not_touch?: string[];
     /** Open worker CHECKPOINT envelopes by path — never inlined bodies. */
     open_worker_envelopes?: string[];
     /** Artifact paths (deliverables, notes, evidence) — refs, never bodies. */
@@ -444,6 +469,54 @@ export function hasBoundaryMarker(block: string): boolean {
     );
 }
 
+/** The two accepted reversibility tags, exact spellings. */
+export const DECISION_REVERSIBILITY_TAGS: readonly string[] = ['reversible', 'irreversible'];
+
+/**
+ * Validate the OPTIONAL trailing reversibility tag on a decision line.
+ *
+ * Fires only on a line that closes with a bracket whose content is trying to be
+ * one of the two tags — `[reversble]`, `[Irreversible!]`, `[reversible?]`. A
+ * bracket used for anything else (`[ADR-109]`, `[see #1273]`) is left alone, and
+ * a line with no bracket at all is the untagged default. So the check catches a
+ * typo in a tag someone MEANT to write, which is the only failure a
+ * presence-checkable optional field can actually have: a silently misspelled tag
+ * reads as "untagged" and loses the distinction the tag exists to carry.
+ */
+export function decisionTagErrors(decisions: unknown): string[] {
+    if (!Array.isArray(decisions)) {
+        return [];
+    }
+    const errors: string[] = [];
+    for (const line of decisions) {
+        if (typeof line !== 'string') {
+            continue;
+        }
+        const m = /\[([^\]]*)\]\s*$/.exec(line.trimEnd());
+        if (m === null) {
+            continue;
+        }
+        const inner = (m[1] ?? '').trim();
+        const lowered = inner.toLowerCase();
+        if (DECISION_REVERSIBILITY_TAGS.includes(lowered)) {
+            if (inner !== lowered) {
+                errors.push(
+                    `decisions: reversibility tag must be lower-case — got \`[${inner}]\`, expected \`[${lowered}]\``,
+                );
+            }
+            continue;
+        }
+        if (/^i?rr?ever[a-z]*[^a-z]*$/i.test(lowered)) {
+            errors.push(
+                `decisions: \`[${inner}]\` is not a reversibility tag — use exactly ` +
+                    DECISION_REVERSIBILITY_TAGS.map((t) => `\`[${t}]\``).join(' or ') +
+                    ', or drop the bracket',
+            );
+        }
+    }
+    return errors;
+}
+
 /** Every key `validateRecycleEnvelope` accepts — anything else is schema-invalid. */
 const RECYCLE_ENVELOPE_KEYS: ReadonlySet<string> = new Set([
     'capsule_version',
@@ -457,6 +530,7 @@ const RECYCLE_ENVELOPE_KEYS: ReadonlySet<string> = new Set([
     'not_carried_forward',
     'decisions',
     'constraints',
+    'do_not_touch',
     'open_worker_envelopes',
     'artifact_paths',
     'assumptions',
@@ -519,7 +593,10 @@ export function validateRecycleEnvelope(input: unknown): string[] {
     checkList(errors, 'remaining', e['remaining'], MAX_LINE_CHARS, true);
     checkList(errors, 'not_carried_forward', e['not_carried_forward'], MAX_LINE_CHARS, true);
     checkList(errors, 'decisions', e['decisions'], MAX_LINE_CHARS, false);
+    errors.push(...decisionTagErrors(e['decisions']));
     checkList(errors, 'constraints', e['constraints'], MAX_LINE_CHARS, false);
+    // Path refs, so the REF budget applies — not the prose one `constraints` uses.
+    checkList(errors, 'do_not_touch', e['do_not_touch'], MAX_REF_CHARS, false);
     checkList(errors, 'open_worker_envelopes', e['open_worker_envelopes'], MAX_REF_CHARS, false);
     checkList(errors, 'artifact_paths', e['artifact_paths'], MAX_REF_CHARS, false);
     checkList(errors, 'suggested_skills', e['suggested_skills'], MAX_REF_CHARS, false);

package/src/scripts/ai_council/config.ts

@@ -52,6 +52,11 @@
  *    single absent member into a deadlocked release gate (council-verified
  *    2026-08-09). See `quorum.ts` for the resolver a caller applies to its
  *    own present/total member counts.
+ * 9b. `quorum_min_present` ∈ positive integers (default 2, ADR-224). The
+ *    floor a gate-class pass would want — SHADOW ONLY: it is recorded per
+ *    pass and enforced nowhere, so no value of this key can hold, delay or
+ *    fail a council pass today. See `quorum.ts::wouldSoloFloorHold` for why
+ *    the measurement landed without the enforcement.
  *
  * Parity notes (intentional, documented):
  *   - YAML is parsed with `yaml` (npm) at `version: '1.1'`, matching
@@ -71,6 +76,12 @@ import * as path from 'node:path';
 import { parse as parseYaml } from 'yaml';
 
 import * as user_global_paths from '../_lib/user_global_paths.js';
+// LAYERING CONSTRAINT, load-bearing: this is a VALUE import from quorum, while
+// `quorum.ts` imports `QuorumSetting` back from here. That back-edge is
+// `import type` and is erased at build, so there is no runtime cycle today.
+// Converting it to a value import — or adding any other runtime import from
+// quorum into config — creates a real ESM cycle in the loader's init path.
+import { SOLO_FLOOR_MIN_PRESENT } from './quorum.js';
 
 const _VALID_PROVIDERS: ReadonlySet<string> = new Set([
     'anthropic',
@@ -585,6 +596,25 @@ export interface CliCallBudgetConfig {
  */
 export type QuorumSetting = 'majority' | number;
 
+/**
+ * The `min_present` floor ADR-224 authorized, as an operator-visible key.
+ *
+ * A SIBLING key rather than a widened `QuorumSetting`, deliberately.
+ * `QuorumSetting` is consumed by `resolveQuorumThreshold`, `evaluateQuorum`,
+ * `_quorum_setting_from` and their tests; widening it into a union with an
+ * object would touch every one of them to express a value none of them read.
+ * The floor is not a second threshold — `quorum` answers "did enough members
+ * answer to conclude", the floor answers "was that conclusion reached on too
+ * few voices to gate on", and they resolve at different call sites.
+ *
+ * Validated at load like every other key; defaults to
+ * `quorum.ts::SOLO_FLOOR_MIN_PRESENT` so the shadow fire-rate accumulates
+ * without the operator having to opt in — an unset floor that recorded nothing
+ * would leave ADR-224's review trigger (b) with no data to trigger on. Nothing
+ * is enforced at any value: see `wouldSoloFloorHold`.
+ */
+export type QuorumMinPresent = number;
+
 export interface CouncilConfig {
     readonly enabled: boolean;
     readonly defaults: DefaultsConfig;
@@ -594,6 +624,7 @@ export interface CouncilConfig {
     readonly consensus_scoring: ConsensusScoringConfig;
     readonly cli_call_budget: CliCallBudgetConfig;
     readonly quorum: QuorumSetting;
+    readonly quorum_min_present: QuorumMinPresent;
     readonly necessity_classifier: NecessityClassifierConfig;
     readonly model_downgrade: ModelDowngradeConfig;
     readonly debate: DebateConfig;
@@ -822,6 +853,9 @@ export function _build_config(raw: Dict, source_path: PathLike): CouncilConfig {
         _asDict(_getOr(raw, 'cli_call_budget', {})),
     );
     const quorum = _build_quorum(_get(raw, 'quorum', 'majority'));
+    const quorum_min_present = _build_quorum_min_present(
+        _get(raw, 'quorum_min_present', SOLO_FLOOR_MIN_PRESENT),
+    );
     const necessity_classifier = _build_necessity_classifier(
         _asDict(_getOr(raw, 'necessity_classifier', {})),
     );
@@ -871,6 +905,7 @@ export function _build_config(raw: Dict, source_path: PathLike): CouncilConfig {
         consensus_scoring: consensus,
         cli_call_budget,
         quorum,
+        quorum_min_present,
         necessity_classifier,
         model_downgrade,
         debate,
@@ -1905,6 +1940,31 @@ function _build_quorum(raw: Json): QuorumSetting {
     );
 }
 
+/**
+ * Validate `quorum_min_present` — the shadow floor's configured value.
+ *
+ * Rejects the same shapes `_build_quorum` rejects, and for the same reason: a
+ * silently coerced floor produces a fire-rate that is an artefact of the
+ * coercion rather than of the council. `_isInt` already requires
+ * `typeof value === 'number'`, so booleans are excluded by it — the sibling's
+ * extra `!_isBool` conjunct is a Python-ism (there `bool` really is an `int`
+ * subclass) and is not repeated here.
+ *
+ * There is no upper bound — a floor above the roster is clamped per-pass by
+ * `wouldSoloFloorHold`, where the roster is actually known, and rejecting it
+ * at load would refuse a config that is legitimate the moment a member is
+ * added.
+ */
+function _build_quorum_min_present(raw: Json): QuorumMinPresent {
+    if (_isInt(raw) && (raw as number) >= 1) {
+        return raw as number;
+    }
+    throw new CouncilConfigError(
+        `\`quorum_min_present\`=${_pyRepr(raw)} must be an integer >= 1 ` +
+            `(got ${_pyTypeName(raw)}).`,
+    );
+}
+
 function _build_advisor(name: string, cfg: Dict): AdvisorConfig {
     if (!_isDict(cfg)) {
         throw new CouncilConfigError(`advisors.${name}: must be a mapping.`);

package/src/scripts/ai_council/events_log.ts

@@ -6,8 +6,9 @@
  * `<project_root>/agents/runtime/council/events.log`. The schema carries the
  * minimum needed to answer "why did the council skip / block this?" and,
  * since v2, "who actually attended?" — at retro time, without leaking prompt
- * content. v2 added the `quorum_result` action and nothing else; see
- * `appendQuorumEvent`.
+ * content. v2 added the `quorum_result` action and nothing else; v3 added two
+ * booleans to that line (`gate_class`, `floor_would_hold`) and nothing else.
+ * See `appendQuorumEvent`.
  *
  * Privacy floor:
  *     `original_ask` is never written verbatim — the caller passes the raw
@@ -27,7 +28,13 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
-import { isSoloConcluded, type QuorumResult } from './quorum.js';
+import { isEnvKillSwitchActive } from '../_lib/env_kill_switch.js';
+import {
+    isSoloConcluded,
+    SOLO_FLOOR_MIN_PRESENT,
+    wouldSoloFloorHold,
+    type QuorumResult,
+} from './quorum.js';
 import type { AbsentReason } from './transport_resolver.js';
 
 /**
@@ -35,8 +42,29 @@ import type { AbsentReason } from './transport_resolver.js';
  * `appendQuorumEvent`. Every schema-v1 field keeps its name, type and
  * position, so a v1 reader parses a v2 necessity line unchanged; only the
  * action vocabulary widened.
+ *
+ * v3 adds two booleans to the `quorum_result` line — `gate_class` (declared
+ * by the caller) and `floor_would_hold` (the ADR-224 counterfactual). Purely
+ * additive, in the same sense v2 was: no field is renamed, retyped or moved,
+ * no action is added, and a v2 reader parses a v3 line unchanged because it
+ * reads fields by name and never saw these two. The version moves anyway, so
+ * a consumer computing the shadow fire-rate can tell a line that recorded
+ * `false` from a line written before the field existed — a distinction it
+ * cannot make from the absent field alone.
+ *
+ * v4 adds `min_present` to the same line: the floor value `floor_would_hold`
+ * was actually computed against. Additive in the v2/v3 sense — no field is
+ * renamed, retyped or moved — and it closes a provenance hole rather than
+ * adding a capability. `quorum_min_present` is an operator-facing key in the
+ * **user-global** `.ai-council.yml` (ADR-104), so before v4 two machines
+ * emitted byte-identical lines while measuring different counterfactuals, and
+ * a configured `quorum_min_present: 1` — valid, and provably unable to hold
+ * anything — zeroed `shadow_floor_fire_rate` with no trace on the data. A
+ * boolean whose meaning depends on an unrecorded per-machine value is not a
+ * measurement; recording the value is what makes the series comparable and a
+ * zero reading attributable.
  */
-export const SCHEMA_VERSION = 2;
+export const SCHEMA_VERSION = 4;
 
 export type EventAction = 'proceed' | 'skip_necessity' | 'block_quota' | 'quorum_result';
 
@@ -139,8 +167,7 @@ function _utf8Bytes(cp: number): string {
 }
 
 function _kill_switch_active(): boolean {
-    const value = process.env[_KILL_SWITCH_ENV] ?? '';
-    return !(value === '' || value === '0' || value === 'false' || value === 'False');
+    return isEnvKillSwitchActive(_KILL_SWITCH_ENV);
 }
 
 export interface AppendEventOptions {
@@ -286,6 +313,42 @@ export interface QuorumEventInput {
     readonly configuredTotal: number;
     readonly result: QuorumResult;
     readonly absent: readonly QuorumAbsence[];
+    /**
+     * Did the CALLER declare this pass gate-class? Declared, never inferred,
+     * and it defaults to `false` — the fail-safe direction, because an
+     * un-declared pass is the one nobody classified and the cost of reading it
+     * as advisory is a missing measurement rather than a held gate.
+     *
+     * Inference from the invocation context was the rejected alternative: it
+     * silently reclassifies passes whenever the context shape changes, which
+     * is the one failure a rate computed over this field could not detect.
+     * `command` + `phase` remain on the line, so a consumer that wants the
+     * inferred reading can still compute it and see it disagree.
+     *
+     * **No producer exists today, by design, and that is not a wiring bug.**
+     * Nothing in the tree branches on `QuorumStatus` to hold a gate, so there
+     * is no gate-class caller to mark; `council_cli.ts::_emitQuorumEvent`
+     * therefore omits it from its context object deliberately rather than by
+     * oversight, and `gate_class` is `false` on every line the tree can emit.
+     * The parameter is kept because the first consumer that holds something on
+     * quorum status IS by construction the first gate-class caller: it sets
+     * this, and `shadow_floor_fire_rate` filtered on it becomes the
+     * enforcement-relevant rate. A field introduced only at that point would
+     * leave every earlier line ambiguous between "not gate-class" and "written
+     * before anyone asked".
+     */
+    readonly gateClass?: boolean;
+    /**
+     * The floor to evaluate the counterfactual against — the operator's
+     * `quorum_min_present`, defaulting to `SOLO_FLOOR_MIN_PRESENT`.
+     *
+     * Written to the line as `min_present` since schema v4, not only consumed:
+     * it comes from the user-global config (ADR-104), so without it on the line
+     * a reader cannot tell which counterfactual a `floor_would_hold` refers to,
+     * and cannot distinguish "the floor never would have fired" from "this
+     * operator configured a floor that cannot fire".
+     */
+    readonly minPresent?: number;
 }
 
 /**
@@ -310,6 +373,10 @@ export function appendQuorumEvent(
     opts: AppendEventOptions = {},
 ): boolean {
     try {
+        // The same default `wouldSoloFloorHold` would have applied, hoisted so
+        // the recorded value and the evaluated value are one expression rather
+        // than two that happen to agree.
+        const minPresent = input.minPresent ?? SOLO_FLOOR_MIN_PRESENT;
         return appendEvent(
             {
                 lens: input.lens,
@@ -328,6 +395,38 @@ export function appendQuorumEvent(
                 // in `quorum.ts`, so a change to it cannot leave a consumer's
                 // copy silently stale.
                 solo: isSoloConcluded(input.result),
+                // Declared class, never inferred — see `QuorumEventInput`.
+                gate_class: input.gateClass ?? false,
+                // The counterfactual, written on every line: would a
+                // `min_present` floor have held this pass? Recorded as a FIELD
+                // on `quorum_result` rather than as a new action, deliberately:
+                // a new action is invisible to every consumer filtering
+                // `action === 'quorum_result'`, which would split the
+                // attendance population in two and silently move the
+                // denominator of all four registered metrics. An additive
+                // boolean moves no existing bucket.
+                //
+                // Mutually exclusive with `verdict: 'inconclusive'` by
+                // construction (`wouldSoloFloorHold` returns false unless the
+                // pass concluded), which is what makes "held by the floor" and
+                // "threshold not met" readable apart from this line alone.
+                // `configuredTotal` is passed, not omitted: post_run `total`
+                // is the roster that CONSTRUCTED, so without it a pass that
+                // lost a member at construction time reads total=1/present=1
+                // and the floor cannot fire on it — the construction-degraded
+                // solo case ADR-224 was actually decided on.
+                //
+                // `min_present` records the floor the counterfactual was
+                // computed against, resolved ONCE below and used for both the
+                // record and the predicate so the line can never disagree with
+                // the boolean it explains — the one-definition discipline
+                // `solo` follows by deferring to `isSoloConcluded`.
+                min_present: minPresent,
+                floor_would_hold: wouldSoloFloorHold(
+                    input.result,
+                    minPresent,
+                    input.configuredTotal,
+                ),
                 absent: input.absent.map((a) => ({ member: a.member, reason: a.reason })),
             },
             opts,

package/src/scripts/ai_council/orchestrator.ts

@@ -58,6 +58,7 @@ import type { AdvisorPlan } from './advisors.js';
 import {
     advisor_system_prompt,
     ANTI_CONFORMITY_DIRECTIVE,
+    describe_verdict_mismatch,
     STANCE_LINE_CONTRACT,
     build_extraction_user_prompt,
     build_peer_review_user_prompt,
@@ -65,6 +66,7 @@ import {
     peer_review_synthesis_addendum,
     synthesis_template,
     system_prompt_for,
+    VERDICT_LINE_CONTRACT,
 } from './prompts.js';
 import { count_dissenters, dissent_quota_met, is_near_duplicate } from './debate_gates.js';
 import { parse_stance_line, render_vote_tally, tally_stances } from './stance_tally.js';
@@ -1927,6 +1929,23 @@ export function render(responses: CouncilResponse[], opts: RenderOptions = {}):
         // addendum so both extensions stack predictably.
         template = template ? `${template}\n\n${CHAIRMAN_FIELDS_ADDENDUM}` : CHAIRMAN_FIELDS_ADDENDUM;
     }
+    if (opts.stance_tally === true && template !== '') {
+        // Phase 2.1: the synthesis owes the same machine-readable closing line
+        // the members owe. Appended only when a tally will be rendered — there
+        // is nothing to check a verdict against otherwise. Composed last so it
+        // is the final instruction, matching the contract's "and nothing after
+        // it". The template's own `VERDICT: <option-label>` placeholder is
+        // parsed as absent (see `parse_verdict_line`), so the un-summarised
+        // render stays green.
+        //
+        // The `template !== ''` guard is load-bearing: an empty template is
+        // `prose_synthesis: true`, documented at `:1859-1862` as a BARE slot.
+        // Appending here would replace `*to be summarised by the host agent*`
+        // with raw contract instructions and silently override an option the
+        // caller set on purpose — a creative-lens pass would start reading like
+        // a filled-in form.
+        template = `${template}\n\n${VERDICT_LINE_CONTRACT}`;
+    }
     let body: string;
     if (template) {
         body = template;
@@ -1951,6 +1970,25 @@ export function render(responses: CouncilResponse[], opts: RenderOptions = {}):
                 .map((r) => ({ member: `${r.provider}:${r.model}`, text: r.text })),
         );
         blocks.push(render_vote_tally(tally));
+        // Phase 2.1: the verdict half of the same projection. A synthesis that
+        // states a `VERDICT:` line the tally did not clear is contradicting its
+        // own count, and the reader of the rendered pass is exactly who needs to
+        // see that.
+        //
+        // Surfaced, never thrown, and the ordering above is part of the fix: a
+        // throw here would discard the whole artifact — every member response,
+        // the peer review, the quorum bookkeeping — AFTER every provider call
+        // was paid for, which is the hazard this roadmap already recorded for
+        // the sibling shape check. `describe_verdict_mismatch` returns the
+        // string; `assert_synthesis_matches_tally` still throws for a caller
+        // holding a finished synthesis it can refuse.
+        //
+        // Conditional by construction: an absent verdict line yields null, so
+        // every synthesis written before the contract shipped stays byte-identical.
+        const mismatch = describe_verdict_mismatch(body, tally);
+        if (mismatch !== null) {
+            blocks.push(`> **Verdict/tally mismatch:** ${mismatch}`);
+        }
     }
     blocks.push(`## Convergence / Divergence\n\n${body}`);
     // Phase 4.1: closest to the synthesis it was extracted from — ahead of