@tiphys/kernel 0.1.0 → 0.2.0

package/dist/src/checks.js

@@ -24,6 +24,8 @@
  * D-M3-22: a check that belongs in section 2.3's table and is not in it is a
  * PLAN DEFECT to escalate, not a script to add quietly.
  */
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import { readdirSync } from "node:fs";
 import { createRequire } from "node:module";
 import { join } from "node:path";
@@ -2648,16 +2650,507 @@ export const DECORRELATION_DIMENSIONS = [
 /** The merge-authority value that makes decorrelation a precondition of merge. */
 export const DELEGATED_MERGE_AUTHORITY = "delegated-under-conditions";
 /**
- * Every verdict document committed under `<context>/delivery/review/`.
+ * SAY WHAT `produced-by` ACTUALLY COMPARED, ON THE GREEN LINE (CR-VS-003).
+ *
+ * The comparison is `canonicalScalar`: NFKC, whitespace collapse, lowercase,
+ * then `!==`. Reproduced at the swept head with one variable changed: two
+ * `produced-by` strings naming two different MODELS of one vendor, in the
+ * vendor-plus-model-plus-organisation form this project's own reviews use, are
+ * certified "distinct on produced-by", green, exit 0. Two models of ONE family
+ * pass as decorrelated, which is T-001's own property failing inside the
+ * kernel's decorrelation check. The two strings are quoted verbatim in the
+ * sweep evidence rather than here, because no vendor model name may appear in
+ * the kernel's shipped surface (test/schemas.test.ts:800).
+ *
+ * WHY THIS IS A SENTENCE AND NOT A FAMILY VOCABULARY, and the reason is a
+ * settled one rather than an omission. M4-P10 deferred the family comparison to
+ * M4-P11 (delivery/work-history/m4-p10.md:654); M4-P11 DECLINED the mechanism in
+ * its own words, "a closed enum of family names was rejected: no such vocabulary
+ * can be kept current" (delivery/work-history/m4-p11.md:142). That reason holds
+ * and shipping the enum that phase rejected would be reopening it by the back
+ * door. What was never done is the OTHER half of the reviewer's own proposal:
+ * stop the green line reading as a cross-family assertion. A bundle-level green
+ * saying "distinct on produced-by" is read as "two families reviewed this", and
+ * nothing here establishes that. So the line now says what it measured.
+ *
+ * WHAT WOULD CLOSE IT, named rather than left open: a `produced-by-family`
+ * field in `schemas/verdict.schema.json`, required, compared instead of the free
+ * string, with the vocabulary OPEN (any two distinct values decorrelate) so no
+ * list has to be kept current. That is a schema change and a decision record,
+ * both outside this fix round's declared files.
+ */
+export function producedByCaveat(compared) {
+    return compared.includes("produced-by")
+        ? "; produced-by was compared as a canonicalised STRING and not as a model FAMILY, so two models of one " +
+            "family are distinct here and this line is not a cross-family assertion"
+        : "";
+}
+export function readVerdictKind(value) {
+    const record = asRecord(value);
+    if (record === undefined) {
+        return { kind: "other" };
+    }
+    const reading = establishField(record, "kind");
+    if (reading.kind === "absent") {
+        return { kind: "other" };
+    }
+    if (reading.kind === "unusable" || reading.kind === "uncanonical") {
+        /* The vocabulary is the DOCUMENT's, as it is at `establishField`: a reader
+           looking at their own YAML is helped by "a list" and by the codepoint and
+           position of the character they cannot see, and not by "unestablished". */
+        return { kind: "unreadable", found: reading.found };
+    }
+    if (reading.value !== "verdict") {
+        return { kind: "other" };
+    }
+    return { kind: "verdict", record };
+}
+/** A verdict document is committed under one of these extensions. */
+const VERDICT_FILE_PATTERN = /\.(ya?ml|json)$/i;
+/**
+ * The project's own paperwork root, and the widest set the FALSIFIERS look at.
+ *
+ * WHY THIS IS THE BOUNDARY AND NOT THE WHOLE TREE (CR-M4P11-002, and the
+ * measurement that decided it). Falsifier 1 asks a question about A PROJECT'S
+ * OWN RECORD, so scoping it to `delivery/review/` was defeated by FILE
+ * PLACEMENT ALONE: the reviewer committed two `family-b` verdicts under
+ * `delivery/evidence/`, which is where this repository actually keeps its only
+ * two real verdicts, and the exception was granted anyway.
+ *
+ * The obvious repair, the whole tree, was tried and MEASURED WRONG. At
+ * `122472b` a whole-subtree enumeration finds SEVEN verdict documents here and
+ * FIVE of them are `witness/fixtures/dual-review/*.yaml`, deliberately
+ * carrying `family-a` and `family-b` because they are the inputs to this very
+ * check's own tests. A corpus that counts a test fixture as a project's record
+ * would make the exception permanently unusable for any project that vendors
+ * fixtures, and would say something false while doing it.
+ *
+ * `delivery/` is the kernel's OWN declared paperwork root, not a boundary
+ * invented here: `REVIEW_DIRECTORY` is under it, `loadDeclaration`
+ * (src/gates/release.ts:817) reads phase declarations from under it, and
+ * src/gates/scope.ts:565 already treats `delivery/review/` and
+ * `delivery/verification/` as the phase-evidence directories. Using it keeps
+ * the rule mechanical and placement-based rather than a judgment about which
+ * documents look real.
+ *
+ * WHAT IT STILL DOES NOT REACH, named rather than left to be found: a verdict
+ * committed OUTSIDE `delivery/` is invisible to the falsifiers. That residue
+ * is smaller than the one it replaces and it is stated here, in the file, so
+ * the next reader does not have to re-derive it.
+ */
+const PAPERWORK_ROOT = "delivery";
+/**
+ * How to name the set a check just looked at, in the check's own output.
+ *
+ * SC-011 one scope out: "every verdict this project has committed" and "every
+ * file that happens to be sitting in one directory right now" are different
+ * claims and must not print the same sentence. This renders a TRAILING
+ * parenthetical rather than a clause in the middle of one, so a sentence that
+ * already names its subject keeps its shape and gains a provenance tail.
+ */
+export function describeVerdictCorpusSource(source) {
+    return source.kind === "commit"
+        ? `(corpus: ${source.scope} read from commit ${source.refSha}, resolved from ${source.ref})`
+        : `(corpus: ${source.scope} read from the WORKING TREE because this context has no resolvable git ref: ${source.reason})`;
+}
+/**
+ * How to name the source ONE context document was looked for in.
+ *
+ * FIX ROUND 2, DV-001. The regime report line used to say "no charter.yaml"
+ * about a directory with a `charter.yaml` sitting in it, because the probe had
+ * moved to the commit and the sentence had not. A record that names a document
+ * and not the SOURCE it was looked for in is unfalsifiable by the person
+ * reading it, which is the same SC-011 property `describeVerdictCorpusSource`
+ * exists for one scope out.
+ */
+export function describeContextDocumentSource(source) {
+    return source.kind === "commit"
+        ? `in commit ${source.refSha}, resolved from ${source.ref}`
+        : `in the WORKING TREE, because this context has no resolvable git ref: ${source.reason}`;
+}
+/**
+ * The verdict documents a PAIR decision is made over: `delivery/review/`.
+ *
+ * TWO ARMS, AND WHICH ONE RAN IS REPORTED RATHER THAN INFERRED.
+ *
+ * THE COMMIT ARM is taken whenever `<context>` resolves `ref`, and it reads
+ * the directory's entries out of the git object database. The filesystem is
+ * not consulted at all, so an uncommitted addition, deletion or edit cannot
+ * change what this returns. That is the anti-widening rule
+ * `readReviewFamilies` and `loadDeclaration` (src/gates/release.ts:817)
+ * already apply to a DECLARATION, now applied to the evidence beside it. It
+ * closes both directions of the same hole: an uncommitted DELETION can no
+ * longer remove a verdict that contradicts a declaration, and an uncommitted
+ * ADDITION can no longer manufacture the pair DR-0012 condition 2 requires.
+ *
+ * THE WORKTREE ARM is taken only when there is no resolvable ref, which is the
+ * pre-existing behaviour for a context that is not a git repository at all,
+ * and it SAYS SO in every sentence it produces. No exception can be granted on
+ * this arm, because `readReviewFamilies` resolves the same ref and returns
+ * absent or error when it cannot: with no git there is one source of truth and
+ * nothing to disagree.
+ *
+ * THE SCOPE STAYS `delivery/review/` HERE, and widening it was measured wrong.
+ * `headGroupFor` turns this set into the reviews of one `(phase, head)`, and
+ * five of the seven verdict documents in this repository's tree are fixtures
+ * for this check's own tests. See `PAPERWORK_ROOT` above; the widest set is
+ * what the FALSIFIERS use, and it is a different question.
+ *
+ * A file that does not carry `kind: verdict` is SKIPPED rather than reported,
+ * because that directory also holds this project's prose reviews and a check
+ * that reddened on a markdown file would be unusable. What is NOT skipped is
+ * the directory being unreadable, which the caller turns into a violation:
+ * "nothing to compare" and "could not look" are different facts.
+ *
+ * AND A CANDIDATE THAT COULD NOT BE LOOKED AT IS THE SECOND HALF OF THAT SAME
+ * SENTENCE, WHICH THE FIRST ROUND WROTE AND APPLIED AT ONE SITE ONLY. A
+ * `.yaml`, `.yml` or `.json` file here has passed the only filter that
+ * separates a candidate verdict from a prose review, so bytes that cannot be
+ * READ and bytes that do not DECODE are not "this is not a verdict", they are
+ * "nobody knows whether this is a verdict". Dropping such a file SHRINKS the
+ * set the merge predicates reason over, which is the fail-open direction for a
+ * predicate that approves when the set is clean: measured at the reviewed head,
+ * a third review reading FIX-ROUND-NEEDED with one malformed line left
+ * `verdict-pair-approves` printing that the pair approves. So they are returned
+ * as diagnostics and every caller seeds its violation list with them, exactly
+ * as `headGroupFor` already does for a sibling with no usable head.
+ */
+export function loadCommittedVerdicts(contextDirectory, source = resolveCorpusSource(contextDirectory)) {
+    if (source.kind !== "commit") {
+        return loadVerdictsFromWorktree(contextDirectory, source.reason);
+    }
+    const refSha = source.refSha;
+    /* RECURSIVE SINCE THE DR-0047 SWEEP (CR-VS-002), AND THE ARGUMENT THAT USED
+       TO SIT AT `loadPaperworkVerdicts` FOR WHY THIS ONE WAS FLAT IS WITHDRAWN.
+       One function had two callers at two depths, so a committed document could
+       be INSIDE the corpus that can contradict a single-family declaration and
+       OUTSIDE the corpus that can refuse a merge. Measured before the change: two
+       APPROVE verdicts at this directory's top level plus a committed THIRD
+       verdict for the same phase and head reading FIX-ROUND-NEEDED one directory
+       down gave `check-dual-review: green`, exit 0, with the refusal neither
+       counted nor mentioned; and with BOTH verdicts one directory down the gate
+       reported `0 verdict document(s)` and not-applicable while `git ls-files`
+       listed them. `ls-tree` without `-r` yields the SUBTREE'S NAME, which
+       `VERDICT_FILE_PATTERN` discards, so the drop was silent by construction,
+       which is the fail-open direction for a predicate that approves when the set
+       is clean. Depth is now a property of the LISTING FUNCTION's one contract
+       rather than of which caller reached it. */
+    const listed = listCommittedTree(contextDirectory, refSha, REVIEW_DIRECTORY, true);
+    if (!listed.ok) {
+        return { ok: false, reason: listed.reason };
+    }
+    return readCommittedVerdicts(contextDirectory, refSha, listed.paths, source);
+}
+/**
+ * Every verdict document committed anywhere under `delivery/` at one commit.
+ *
+ * THE FALSIFIERS' CORPUS, AND A DIFFERENT QUESTION FROM THE PAIR'S. See
+ * `PAPERWORK_ROOT` for why the boundary is the paperwork root rather than one
+ * directory or the whole tree.
+ *
+ * COMMIT ONLY, WITH NO WORKTREE FALLBACK, and that is not an omission. This is
+ * reached only from `singleFamilyException`, which is reached only when a
+ * declaration was successfully read out of a commit. There is no arm where a
+ * declaration exists and a commit does not, so a worktree fallback here would
+ * be code that cannot run, which is the dead-arm shape this file already
+ * refused once at `classifyEntry`.
+ */
+function loadPaperworkVerdicts(contextDirectory, ref, refSha) {
+    const source = {
+        kind: "commit",
+        ref,
+        refSha,
+        scope: `every verdict document under ${PAPERWORK_ROOT}/`,
+    };
+    /* `recursive` HERE AND, SINCE THE DR-0047 SWEEP, ON THE PAIR CORPUS TOO. The
+       paragraph that stood here said the pair's directory is flat by convention
+       and that recursing it would be a silent behaviour change on the arm that
+       already worked. CR-VS-002 measured what the asymmetry cost instead: a
+       verdict one directory down was inside THIS corpus and outside that one, so
+       a committed review refusing the head under audit could contradict a
+       declaration and could not refuse a merge. Both corpora now read the same
+       depth; the boundaries still differ, and that difference is the real one.
+       THE LISTING
+       ITSELF IS THE SAME FUNCTION the pair corpus uses (FIX ROUND 2, DV-002):
+       two listing idioms maintained side by side is what let one of them be
+       wrong in a nested context while the other was right. */
+    const listed = listCommittedTree(contextDirectory, refSha, PAPERWORK_ROOT, true);
+    if (!listed.ok) {
+        return {
+            ok: false,
+            reason: `the verdict documents under ${PAPERWORK_ROOT}/ in ${refSha} could not be enumerated, so the ` +
+                `record that would refute a single-family declaration could not be established: ${listed.reason}`,
+        };
+    }
+    return readCommittedVerdicts(contextDirectory, refSha, listed.paths, source);
+}
+/**
+ * List one committed directory, as paths relative to the CONTEXT DIRECTORY.
+ *
+ * ONE LISTING IDIOM FOR BOTH CORPORA (FIX ROUND 2, DV-002), AND THE PATHSPEC
+ * FORM IS THE LOAD-BEARING HALF. Fix round 1 replaced one `readdirSync` with
+ * TWO different git idioms: the falsifiers' corpus listed
+ * `<sha> -- ./<dir>/` and the pair corpus listed the tree-ish `<sha>:./<dir>`.
+ * Those are not two spellings of one question. `git ls-tree` applies the
+ * CURRENT DIRECTORY as an implicit pathspec, so a tree-ish listing run from a
+ * context directory that is a SUBDIRECTORY of its repository is filtered
+ * against a prefix the named tree's own entries do not carry, and it returns
+ * NOTHING with exit 0. Measured, one commit, cwd = a context directory nested
+ * one level inside its repository, `delivery/review/` holding two committed
+ * verdicts:
+ *
+ *   git cat-file -t $S:./delivery/review              -> tree, exit 0
+ *   git ls-tree -z --name-only $S:./delivery/review   -> EMPTY, exit 0
+ *   git ls-tree -z --name-only $S -- ./delivery/review/
+ *                                                     -> both names, exit 0
+ *
+ * An empty listing is then indistinguishable from an absent directory, so
+ * "could not enumerate" became "there are none", the pair corpus came back
+ * empty, and a committed pair sharing one `produced-by` reported
+ * NOT-APPLICABLE on a conditional gate instead of red. The kernel's own
+ * repository could not see it, because the registry command runs the script
+ * with `.` at the repository root; every consumer whose tiphys context is not
+ * its repository root does see it.
+ *
+ * The pathspec form's output is relative to the current directory, which is
+ * the context directory, which is what `readCommittedVerdicts` then hands to
+ * `git show ${refSha}:./${path}`. The listing and the read therefore resolve
+ * against the SAME base, which is the property that broke.
+ *
+ * ABSENT, REGULAR AND UNLISTABLE ARE THREE ANSWERS, exactly as `classifyEntry`
+ * gives three on the worktree arm. `git cat-file -t` is what separates them:
+ * a missing path is an empty corpus, a `blob` where a directory was expected
+ * is the same fact the worktree arm reports as "is a regular file, not a
+ * directory", and a listing that fails for any other reason has not reached a
+ * verdict and must not report one (M2-C-3).
+ */
+function listCommittedTree(contextDirectory, refSha, directory, recursive) {
+    const typed = gitIn(["cat-file", "-t", `${refSha}:./${directory}`], contextDirectory);
+    if (!typed.ok) {
+        /* ABSENT, OR COULD NOT LOOK, AND THEY ARE NOT THE SAME ANSWER. Until this
+           round a `cat-file -t` that failed for ANY reason returned an empty
+           corpus, so an object database that could not be read reported the same
+           thing as a project that keeps no `delivery/` at all, which is the
+           "could not look" reported as "looked and found nothing" shape the
+           sibling loader's comment already named. Absence is established by a
+           SECOND probe that does not mention the path: if the commit object
+           itself is readable, the only thing the first probe can have been
+           reporting is that the path is not in it. This is the same fail-closed
+           rule `readCommittedVerdicts` twenty lines down already applies to a
+           blob it was told about and cannot read. */
+        const commitReadable = gitIn(["cat-file", "-t", refSha], contextDirectory);
+        if (!commitReadable.ok) {
+            return {
+                ok: false,
+                reason: `${refSha} could not be read in ${contextDirectory}, so whether ${directory}/ is committed there ` +
+                    `was not established and an empty corpus must not be reported: ${commitReadable.reason}`,
+            };
+        }
+        return { ok: true, paths: [] };
+    }
+    const type = typed.stdout.trim();
+    if (type !== "tree") {
+        return {
+            ok: false,
+            reason: `${refSha}:./${directory} is a ${type}, not a directory, so the committed verdicts cannot be enumerated`,
+        };
+    }
+    const listed = gitIn([
+        "ls-tree",
+        ...(recursive ? ["-r"] : []),
+        "-z",
+        "--name-only",
+        refSha,
+        "--",
+        `./${directory}/`,
+    ], contextDirectory);
+    if (!listed.ok) {
+        return {
+            ok: false,
+            reason: `${refSha}:./${directory} could not be listed: ${listed.reason}`,
+        };
+    }
+    return { ok: true, paths: listed.stdout.split("\0").filter((name) => name !== "") };
+}
+/**
+ * Read a list of committed paths and keep the ones that are verdicts.
+ *
+ * `-z` ON EVERY LISTING THAT FEEDS THIS IS LOAD-BEARING. Without it git QUOTES
+ * a path carrying a quote, a backslash or a non-ASCII byte, and the quoted
+ * spelling is not the path `git show` wants, so exactly the documents whose
+ * names are unusual would drop out of the corpus. Dropping a document from the
+ * corpus is the fail-open direction.
+ *
+ * `${refSha}:./${path}` AND NOT `${refSha}:${path}`, for the reason
+ * `readReviewFamilies` already gives further down: without the leading `./`
+ * git resolves the path against the REPOSITORY ROOT, so a context directory
+ * nested inside a larger repository would silently read the outer
+ * repository's documents. With `./` the listing and the read are both relative
+ * to the directory the caller named, so they cannot disagree about which tree
+ * they are describing.
+ */
+function readCommittedVerdicts(contextDirectory, refSha, paths, source) {
+    const documents = [];
+    for (const path of [...paths].sort()) {
+        if (!VERDICT_FILE_PATTERN.test(path)) {
+            continue;
+        }
+        const shown = gitIn(["show", `${refSha}:./${path}`], contextDirectory);
+        if (!shown.ok) {
+            /* A path the same commit's own listing named and the same commit cannot
+               produce is not a document to skip, it is a corpus that could not be
+               read. M2-C-3: this has not reached a verdict, so it must not report
+               one. */
+            return {
+                ok: false,
+                reason: `${refSha}:./${path} is listed in ${refSha} and could not be read, so the committed verdict corpus is ` +
+                    `incomplete and no merge precondition can be decided over it: ${shown.reason}`,
+            };
+        }
+        documents.push({ path: join(contextDirectory, path), body: shown.stdout });
+    }
+    const selected = selectVerdicts(documents);
+    return { ok: true, verdicts: selected.verdicts, unexaminable: selected.unexaminable, source };
+}
+/**
+ * Read a context document AT THE SOURCE THE DECISION IS BEING MADE FROM.
+ *
+ * FIX ROUND 1, AND IT IS THE FOURTH SITE OF THE MECHANISM the reviewers found
+ * at the first. Their finding was that the CORPUS was read from disk while the
+ * declaration was read from a commit. The derivation for it (D2 and D3 in the
+ * work history) turned up the same split one document further out and WORSE:
+ * `establishDelegatedRegime` decides whether a delegated merge grant is in
+ * force at all, and it read `charter.yaml` and `assurance-modes.yaml` off
+ * DISK, while `readReviewFamilies` read THE SAME `charter.yaml` out of the
+ * object database.
+ *
+ * Measured, one commit, one working-tree edit of one word:
+ *
+ *   committed `delivery-mode: full` (merge-authority delegated-under-conditions)
+ *   with a pair sharing produced-by         -> red, exit 1
+ *   the SAME commit, `delivery-mode: direct-pr` written into the working tree
+ *   and never committed                     -> GREEN, exit 0, and the record
+ *                                              prints "mode direct-pr declares
+ *                                              merge-authority owner, which is
+ *                                              not a delegated grant"
+ *
+ * That is not the exception being bought, it is the ENTIRE decorrelation
+ * requirement being switched off, by an edit no commit records and no diff
+ * shows. It is the same mechanism as CR-M4P11-001 and it is why this round
+ * fixes the mechanism rather than the corpus.
+ *
+ * The worktree arm is the pre-existing behaviour and is unchanged: with no
+ * resolvable ref there is one source of truth and nothing to disagree.
+ */
+function readContextDocumentAt(contextDirectory, relativePath, source) {
+    if (source.kind !== "commit") {
+        return readContextDocument(contextDirectory, relativePath);
+    }
+    const path = join(contextDirectory, relativePath);
+    const shown = gitIn(["show", `${source.refSha}:./${relativePath}`], contextDirectory);
+    if (!shown.ok) {
+        return {
+            ok: false,
+            reason: `${source.refSha}:./${relativePath} could not be read: ${shown.reason}`,
+        };
+    }
+    const decoded = decodeDocument(shown.stdout, path);
+    if (!decoded.ok) {
+        return { ok: false, reason: decoded.reason };
+    }
+    return { ok: true, value: decoded.value, path };
+}
+/**
+ * Is a context document present AT THE SOURCE the decision is read from?
+ *
+ * SEPARATE FROM READING IT, because "absent" and "present and unreadable" are
+ * different facts with different verdicts one screen down, exactly as
+ * `classifyEntry` keeps them apart on the worktree arm.
+ */
+function contextDocumentPresentAt(contextDirectory, relativePath, source) {
+    if (source.kind !== "commit") {
+        return classifyEntry(join(contextDirectory, relativePath)).kind !== "absent";
+    }
+    const typed = gitIn(["cat-file", "-t", `${source.refSha}:./${relativePath}`], contextDirectory);
+    return typed.ok && typed.stdout.trim() === "blob";
+}
+/**
+ * Resolve, ONCE, the source every document of one decision is read from.
+ *
+ * EXPORTED because the two merge-precondition checks each resolve it at the
+ * top of their own run and hand the SAME value to the regime reader, the
+ * declaration reader and both corpus loaders. One resolution is what makes
+ * "the halves disagree" unrepresentable rather than merely unlikely.
+ */
+export function resolveCorpusSource(contextDirectory, ref = "HEAD") {
+    const resolved = gitIn(["rev-parse", `${ref}^{commit}`], contextDirectory);
+    return resolved.ok
+        ? { kind: "commit", ref, refSha: resolved.stdout.trim(), scope: REVIEW_DIRECTORY }
+        : { kind: "worktree", reason: resolved.reason, scope: REVIEW_DIRECTORY };
+}
+/**
+ * The one selection rule, applied to every document an arm produced.
  *
- * A file that is not a regular file, does not decode, or does not carry
- * `kind: verdict` is SKIPPED rather than reported, because that directory also
- * holds this project's prose reviews and a check that reddened on a markdown
- * file would be unusable. What is NOT skipped is the directory being
- * unreadable, which the caller turns into a violation: "nothing to compare" and
- * "could not look" are different facts.
+ * MATERIALISED RATHER THAN STREAMED, and the bound is stated rather than left
+ * to be discovered: the widest corpus is the candidate `.yaml`, `.yml` and
+ * `.json` blobs under `delivery/`, measured at 103 files and 8953667 bytes in
+ * this repository at `79ce63b`, and it is read only when a single-family
+ * declaration has already been established.
  */
-function loadCommittedVerdicts(contextDirectory) {
+function selectVerdicts(documents) {
+    const verdicts = [];
+    const unexaminable = [];
+    for (const { path, body } of documents) {
+        const decoded = decodeDocument(body, path);
+        if (!decoded.ok) {
+            unexaminable.push({
+                pointer: "#/kind",
+                message: `${path} sits under ${REVIEW_DIRECTORY} and did not decode, so whether it is a verdict refusing this head could not be established, and a merge check that could not look at one document must not report the rest of them clean: ${decoded.reason}`,
+            });
+            continue;
+        }
+        /* CANONICAL HERE TOO, AND THE REASON IS THE SAME ONE ONE LAYER OUT. This
+           `===` decides MEMBERSHIP OF THE GROUP the decorrelation decision is made
+           over, so a lookalike character in `kind` does not produce a wrong
+           comparison, it silently removes a document from the comparison. With
+           three verdicts, two of them sharing a model family, dropping one of the
+           correlated pair leaves two distinct ones and a green run. That is the
+           same fail-open outcome as the reported finding, reached by making the
+           check look at less rather than by making it compare wrongly.
+    
+           Canonicalising ADMITS more documents, which is the fail-closed direction
+           here: more verdicts in the group means more chances to find a shared
+           value, never fewer. A file that is not a verdict at all still fails this
+           test, because no canonical form turns a prose review into `verdict`. */
+        /* THE ONE READER, AND FIX ROUND 2 IS THAT IT IS ONE READER WITH THREE
+           OUTCOMES RATHER THAN A BOOLEAN. `readVerdictKind` is documented at its
+           own definition; what matters here is that `unreadable` is a DIAGNOSTIC
+           and `other` is a skip, because a document whose `kind` key is present and
+           whose reading FAILED has not said it is not a verdict, it has said
+           nothing that could be read. The skip below is now reached only by a
+           document that answered. */
+        const kindReading = readVerdictKind(decoded.value);
+        if (kindReading.kind === "unreadable") {
+            unexaminable.push({
+                pointer: "#/kind",
+                message: `${path} sits under ${REVIEW_DIRECTORY} and declares a kind field that could not be read as a word (it is ${kindReading.found}), so whether it is a verdict refusing this head could not be established, and a merge check that could not read one document's own type must not report the rest of them clean`,
+            });
+            continue;
+        }
+        if (kindReading.kind !== "verdict") {
+            continue;
+        }
+        verdicts.push({ path, record: kindReading.record });
+    }
+    return { verdicts, unexaminable };
+}
+/** The pre-existing arm, for a context that is not a git repository. */
+function loadVerdictsFromWorktree(contextDirectory, why) {
+    const source = {
+        kind: "worktree",
+        reason: why,
+        scope: REVIEW_DIRECTORY,
+    };
     const directory = join(contextDirectory, REVIEW_DIRECTORY);
     /* `classifyEntry` HAS NO `directory` KIND: a directory lands in `irregular`,
        which is the kind that means "present and not safe to OPEN AS A FILE". So
@@ -2667,14 +3160,21 @@ function loadCommittedVerdicts(contextDirectory) {
        exist would have been dead code that always took the error arm. */
     const entry = classifyEntry(directory);
     if (entry.kind === "absent" || entry.kind === "dangling") {
-        return { ok: true, verdicts: [] };
+        return { ok: true, verdicts: [], unexaminable: [], source };
     }
     if (entry.kind === "unexaminable") {
         return { ok: false, reason: entry.reason };
     }
     let names;
     try {
-        names = readdirSync(directory);
+        /* `recursive` SO THE TWO ARMS READ THE SAME DEPTH (CR-VS-002). The commit
+           arm lists the whole subtree, and an arm that read one level would make
+           WHICH ARM RAN decide whether a refusing verdict one directory down is
+           part of the corpus. That is the same one-rule-two-readings shape this
+           section already removed for the selection rule. `recursive` yields paths
+           relative to `directory`, which is what `join` below already expects, and
+           a nested name still has to pass `VERDICT_FILE_PATTERN`. */
+        names = readdirSync(directory, { recursive: true }).map((name) => String(name));
     }
     catch (error) {
         if (entry.kind === "regular") {
@@ -2685,44 +3185,37 @@ function loadCommittedVerdicts(contextDirectory) {
         }
         return { ok: false, reason: `${directory} could not be listed: ${String(error)}` };
     }
-    const verdicts = [];
+    const documents = [];
+    const unreadable = [];
     for (const name of names.sort()) {
-        if (!/\.(ya?ml|json)$/i.test(name)) {
+        if (!VERDICT_FILE_PATTERN.test(name)) {
             continue;
         }
         const path = join(directory, name);
         const read = readOperatorPath(path);
         if (!read.ok) {
+            /* M4-P10 FIX ROUND 2, REAPPLIED ON THIS ARM. The commit arm one screen up
+               refuses the whole corpus when a path its own listing named cannot be
+               produced, which is stricter than a diagnostic and is right there: the
+               same commit named it. Here the directory was listed from a working tree
+               that can change under the read, so the fail-closed form is the one
+               M4-P10 wrote, a named candidate carried out to every caller's violation
+               list rather than a silent `continue`. */
+            unreadable.push({
+                pointer: "#/kind",
+                message: `${path} sits under ${REVIEW_DIRECTORY} and could not be read, so whether it is a verdict refusing this head could not be established, and a merge check that could not look at one document must not report the rest of them clean: ${read.reason}`,
+            });
             continue;
         }
-        const decoded = decodeDocument(read.body, path);
-        if (!decoded.ok) {
-            continue;
-        }
-        const record = asRecord(decoded.value);
-        /* CANONICAL HERE TOO, AND THE REASON IS THE SAME ONE ONE LAYER OUT. This
-           `===` decides MEMBERSHIP OF THE GROUP the decorrelation decision is made
-           over, so a lookalike character in `kind` does not produce a wrong
-           comparison, it silently removes a document from the comparison. With
-           three verdicts, two of them sharing a model family, dropping one of the
-           correlated pair leaves two distinct ones and a green run. That is the
-           same fail-open outcome as the reported finding, reached by making the
-           check look at less rather than by making it compare wrongly.
-    
-           Canonicalising ADMITS more documents, which is the fail-closed direction
-           here: more verdicts in the group means more chances to find a shared
-           value, never fewer. A file that is not a verdict at all still fails this
-           test, because no canonical form turns a prose review into `verdict`. */
-        if (record === undefined) {
-            continue;
-        }
-        const kindReading = establishField(record, "kind");
-        if (kindReading.kind !== "established" || kindReading.value !== "verdict") {
-            continue;
-        }
-        verdicts.push({ path, record });
+        documents.push({ path, body: read.body });
     }
-    return { ok: true, verdicts };
+    const selected = selectVerdicts(documents);
+    return {
+        ok: true,
+        verdicts: selected.verdicts,
+        unexaminable: [...unreadable, ...selected.unexaminable],
+        source,
+    };
 }
 /**
  * THE CANONICAL FORM OF A GOVERNANCE SCALAR, DECLARED HERE BECAUSE A
@@ -2899,6 +3392,881 @@ function decorrelationTriple(record) {
         return reading.kind === "established" ? `=${reading.value}` : `<${reading.kind}>`;
     }).join(" | ");
 }
+/* ------------------------------------------------------------------ */
+/* The head, and what it is allowed to be (M4-P10)                      */
+/* ------------------------------------------------------------------ */
+/**
+ * A commit sha as `schemas/verdict.schema.json` spells it.
+ *
+ * RESTATED HERE RATHER THAN BORROWED FROM THE SCHEMA, and that is not
+ * duplication by accident. Nothing on the shipped path validates the SIBLING
+ * documents this check loads, which is recorded at `dualReviewDecorrelation`
+ * below, so a sibling carrying an abbreviated `head` reaches the grouping code
+ * whatever the schema says. A check that trusted the schema for this would put
+ * a short sha in its own group of one and never compare it to anything, which
+ * is the fail-open direction.
+ */
+const FULL_SHA = /^[0-9a-f]{40}$/;
+/**
+ * Establish the head a verdict claims to review.
+ *
+ * TWO REFUSALS, AND THEY ARE DIFFERENT FACTS. An UNESTABLISHED `head` is the
+ * ordinary absent-or-unusable-or-uncanonical reading every other dimension in
+ * this file gets, with its own sentence from `unestablishedReason`. A head that
+ * IS established and is not forty hex digits is a SECOND SPELLING of a fact
+ * some other document may state in full, and it is refused on its own terms,
+ * because no canonical form reconciles an abbreviation with the forty-character
+ * sha it abbreviates without resolving both against a repository this check is
+ * never given.
+ *
+ * Case never reaches the pattern as a problem: `establishField` folds it, so an
+ * upper-case sha and a lower-case one are already ONE key by the time the test
+ * runs. That is the direction the hazard row asks for, two spellings of one
+ * head becoming one group rather than two.
+ */
+function headKeyOf(record, where) {
+    const reading = establishField(record, "head");
+    if (reading.kind !== "established") {
+        return {
+            ok: false,
+            message: `${where} ${unestablishedReason(reading, "head")}, so the reviews cannot be grouped by the head they reviewed, and a delegated grant is not satisfied by a review that does not say what it reviewed`,
+        };
+    }
+    if (!FULL_SHA.test(reading.value)) {
+        return {
+            ok: false,
+            message: `${where} declares head ${reading.value}, which is not forty lowercase hexadecimal digits; an abbreviated sha is a second spelling of one head and would form its own group of one, which is never compared to anything`,
+        };
+    }
+    return { ok: true, value: reading.value };
+}
+/**
+ * Select the verdicts for one `(phase, head)` out of a directory's committed set.
+ *
+ * WHY A SIBLING WITH NO USABLE HEAD BECOMES A VIOLATION RATHER THAN BEING
+ * SKIPPED, which is the whole reason this is a function and not a `filter`.
+ * Dropping such a sibling silently SHRINKS the group, and a shrinking group is
+ * exactly the fail-open shape this file has already been bitten by twice, at
+ * `loadCommittedVerdicts` and at the `phase` canonicalisation. With three
+ * verdicts, two of them sharing a model family, giving the third an unreadable
+ * head would leave a compared pair of two and a green run. So every same-phase
+ * sibling that cannot be keyed is REPORTED as a violation and the remaining
+ * members are still compared: a reader is owed both facts.
+ */
+function headGroupFor(verdicts, phaseKey, headKey) {
+    const members = [];
+    const unkeyed = [];
+    for (const candidate of verdicts) {
+        /* BOTH SIDES CANONICAL. `phaseKey` is already canonical; the sibling's is
+           read through the same function so the two are compared in one form
+           rather than one canonical value against one raw one.
+    
+           AND THE TWO ARMS ARE SPLIT, WHICH THE FIRST ROUND LEFT JOINED. `phase` is
+           half of the join key, so a sibling whose phase cannot be ESTABLISHED is
+           unkeyable for exactly the reason a sibling with no usable head is, and
+           the paragraph above says what that costs. It was folded into one `||`
+           with the determinate case, so a verdict declaring no phase fell out
+           silently while one declaring a DIFFERENT phase fell out correctly.
+           Measured at the reviewed head through the shipped CLI: a refusing third
+           review with its `phase:` line deleted left both merge checks printing
+           their affirmative REPORT lines over the remaining two. */
+        const phaseReading = establishField(candidate.record, "phase");
+        if (phaseReading.kind !== "established") {
+            unkeyed.push({
+                pointer: "#/phase",
+                message: `${candidate.path} ${unestablishedReason(phaseReading, "phase")}, so it cannot be placed in or out of the group for phase ${phaseKey}, and a sibling that cannot be keyed must not shrink the set the delegated grant is read off`,
+            });
+            continue;
+        }
+        if (phaseReading.value !== phaseKey) {
+            continue;
+        }
+        const key = headKeyOf(candidate.record, candidate.path);
+        if (!key.ok) {
+            unkeyed.push({ pointer: "#/head", message: key.message });
+            continue;
+        }
+        if (key.value === headKey) {
+            members.push(candidate);
+        }
+    }
+    return { members, unkeyed };
+}
+/* ------------------------------------------------------------------ */
+/* ANCHORING THE CORPUS TO THE COMMIT UNDER AUDIT (CR-VS-001)           */
+/* ------------------------------------------------------------------ */
+/**
+ * THE MECHANISM THIS SECTION CLOSES, STATED ONE LEVEL UP FROM THE FINDING:
+ * a gate whose verdict is about EVIDENCE THE CALLER SUPPLIED, with no check
+ * that the evidence is about the thing being audited.
+ *
+ * `headGroupFor` above groups by the head THE VERDICT DOCUMENTS THEMSELVES
+ * DECLARE. Before this section nothing compared that value to the commit the
+ * gate was running against, and nothing established that it named a commit at
+ * all. Both arms were reproduced end to end through the shipped script:
+ *
+ *   ARM A  two decorrelated APPROVE verdicts naming
+ *          deadbeefdeadbeefdeadbeefdeadbeefdeadbeef, which
+ *          `git cat-file -t` reports as not an object, in a repository whose
+ *          HEAD is a real commit          -> GREEN, 2 units, exit 0
+ *   ARM B  the same verdicts plus a further commit of work no verdict
+ *          mentions                       -> GREEN, exit 0
+ *
+ * So ONE committed approving pair turned this gate green for that phase at
+ * every later head, indefinitely, on evidence about one old commit. That is
+ * T-009's own rule ("a gate result is evidence only for the configuration it
+ * ran under") failing inside the gate that carries DR-0012's merge grant.
+ *
+ * THE ASYMMETRY THAT MAKES THE FIX SOUND, and it is the whole of the design.
+ * The AUDITED head comes from the CALLER: the gate runner passes `--head` from
+ * the pull-request event (the registry entry now declares `parameters: [head]`,
+ * the same mechanism `scope` has always used), and with no `--head` it is the
+ * commit the context's own `HEAD` resolves to, which is what the checkout put
+ * there. The DECLARED head comes from a document an agent under review wrote.
+ * One of those two is a fact about the run and the other is a claim in the
+ * evidence, and the claim must be measured against the fact rather than
+ * replacing it.
+ */
+/** Resolve one ref to a full commit sha inside a context directory. */
+export function resolveCommitIn(contextDirectory, ref) {
+    /* `^{commit}` AND NOT A BARE `rev-parse`. A bare `rev-parse` of a forty-hex
+       string that is in no object database ECHOES IT BACK and exits 0, so it
+       cannot tell a commit from a sha somebody typed. The peel is what makes
+       this a question about the object database rather than about the syntax of
+       the argument, and it also refuses a tag or a tree that is not a commit.
+       `--end-of-options` keeps a ref that begins with `-` from being read as a
+       flag. */
+    const resolved = gitIn(["rev-parse", "--verify", "--quiet", "--end-of-options", `${ref}^{commit}`], contextDirectory);
+    if (!resolved.ok) {
+        return { ok: false, reason: resolved.reason };
+    }
+    const sha = resolved.stdout.trim();
+    if (!FULL_SHA.test(sha)) {
+        return {
+            ok: false,
+            reason: `git rev-parse ${ref}^{commit} in ${contextDirectory} produced ${sha}, which is not a full commit sha`,
+        };
+    }
+    return { ok: true, sha };
+}
+export function resolveAuditedHead(contextDirectory, requested, source) {
+    if (requested !== undefined) {
+        const resolved = resolveCommitIn(contextDirectory, requested);
+        if (!resolved.ok) {
+            /* M2-C-3. A caller that named a head this repository cannot produce has
+               not told the gate which commit to judge, and a gate that carried on
+               would be judging whatever the documents felt like naming, which is the
+               state this whole section exists to end. `error`, never green and never
+               not-applicable: nothing has been evaluated. */
+            return {
+                kind: "error",
+                reason: `--head ${requested} does not resolve to a commit in ${contextDirectory}, so the commit under audit ` +
+                    `was not established and no merge verdict can be reached over evidence that names its own subject: ${resolved.reason}`,
+            };
+        }
+        return { kind: "anchored", head: resolved.sha, how: `--head ${requested}` };
+    }
+    if (source.kind === "commit") {
+        return { kind: "anchored", head: source.refSha, how: `${source.ref}, resolved in ${contextDirectory}` };
+    }
+    return { kind: "unanchored", reason: source.reason };
+}
+/**
+ * Ask git whether `candidate` is an ancestor of `descendant`.
+ *
+ * `merge-base --is-ancestor` ANSWERS WITH AN EXIT CODE, and 1 is an ANSWER
+ * while anything else is a FAILURE. `gitIn` folds every nonzero status into
+ * `ok: false`, which would make "no" indistinguishable from "git could not
+ * run", and that collapse is the fail-open direction here: an unanswerable
+ * question read as "not an ancestor" is merely noisy, but read as "ancestor"
+ * it would admit anything. Three outcomes, never two.
+ */
+function isAncestorIn(contextDirectory, candidate, descendant) {
+    const run = spawnSync("git", ["merge-base", "--is-ancestor", "--end-of-options", candidate, descendant], { cwd: contextDirectory, encoding: "utf8" });
+    if (run.error !== undefined) {
+        return {
+            kind: "undetermined",
+            reason: `git merge-base --is-ancestor ${candidate} ${descendant} could not be run: ${String(run.error)}`,
+        };
+    }
+    if (run.status === 0) {
+        return { kind: "yes" };
+    }
+    if (run.status === 1) {
+        return { kind: "no" };
+    }
+    return {
+        kind: "undetermined",
+        reason: `git merge-base --is-ancestor ${candidate} ${descendant} exited ${String(run.status)}: ` +
+            `${(run.stderr ?? "").replace(/\s+/g, " ").trim()}`,
+    };
+}
+/**
+ * The paperwork prefix a changed path must carry to count as evidence, spelled
+ * for THIS context directory rather than for the repository root.
+ *
+ * `git diff --name-only` prints paths relative to the REPOSITORY ROOT, and the
+ * context directory need not be that root. Reading `delivery/` out of a nested
+ * context would then classify the repository root's `delivery/` as this
+ * project's paperwork and a nested `sub/delivery/` as shipped content, which is
+ * backwards. `rev-parse --show-prefix` gives the offset, so the comparison is
+ * made in the repository's own spelling. The diff is deliberately NOT narrowed
+ * to the context directory: a change outside it is still unreviewed content in
+ * the audited commit, and narrowing would hide it.
+ */
+function evidencePrefixIn(contextDirectory) {
+    const shown = gitIn(["rev-parse", "--show-prefix"], contextDirectory);
+    if (!shown.ok) {
+        return { ok: false, reason: shown.reason };
+    }
+    return { ok: true, prefix: `${shown.stdout.trim()}${PAPERWORK_ROOT}/` };
+}
+/**
+ * Place one declared head against the commit under audit.
+ *
+ * EQUAL PASSES, unchanged, and it is checked first so a context git cannot be
+ * questioned about still answers the one relation that needs no git at all.
+ *
+ * A DESCENDANT IS REFUSED, and it has its own sentence rather than being folded
+ * into "not an ancestor". A verdict naming a commit BELOW the audited one is a
+ * review of work the audited commit does not contain, which is the fail-open
+ * direction stated backwards: the reviewers saw more than is being merged, and
+ * nothing here establishes that what they approved about the extra work says
+ * anything about the tree without it.
+ */
+export function relateDeclaredHead(contextDirectory, declared, auditedHead) {
+    if (declared === auditedHead) {
+        return { kind: "same" };
+    }
+    const resolved = resolveCommitIn(contextDirectory, declared);
+    if (!resolved.ok) {
+        return { kind: "unresolvable", reason: resolved.reason };
+    }
+    const ancestor = isAncestorIn(contextDirectory, declared, auditedHead);
+    if (ancestor.kind === "undetermined") {
+        return { kind: "undetermined", reason: ancestor.reason };
+    }
+    if (ancestor.kind === "no") {
+        const other = isAncestorIn(contextDirectory, auditedHead, declared);
+        if (other.kind === "undetermined") {
+            return { kind: "undetermined", reason: other.reason };
+        }
+        return other.kind === "yes" ? { kind: "descendant" } : { kind: "unrelated" };
+    }
+    const prefix = evidencePrefixIn(contextDirectory);
+    if (!prefix.ok) {
+        return { kind: "undetermined", reason: prefix.reason };
+    }
+    /* `-z` IS LOAD-BEARING FOR THE SAME REASON `--no-renames` IS, and it was
+       measured rather than reasoned. Without it git QUOTES any path outside the
+       printable ASCII set, so a paperwork file whose name carries one non-ASCII
+       character arrives wrapped in double quotes with octal escapes, which does
+       not start with `delivery/` and is classified as shipped content. Measured
+       on git 2.43.0, one repository, one commit, one flag changed: the default
+       form printed the quoted spelling and the `-z` form printed the real path.
+  
+       The failure that would cause is fail-CLOSED, so it admits nothing it should
+       not; it is fixed anyway because refusing a green a project is entitled to is
+       the cannot-go-green shape this whole section exists to end, one filename
+       narrower. `-z` also makes the separator NUL rather than newline, which is
+       why the split changed with it: a newline split over `-z` output would read
+       the whole list as one path. */
+    const diff = gitIn(["diff", "-z", "--no-renames", "--name-only", `${declared}..${auditedHead}`, "--"], contextDirectory);
+    if (!diff.ok) {
+        return { kind: "undetermined", reason: diff.reason };
+    }
+    const changed = diff.stdout.split("\0").map((line) => line.trim()).filter((line) => line !== "");
+    const shipped = changed.filter((path) => !path.startsWith(prefix.prefix));
+    return shipped.length === 0
+        ? { kind: "evidence-only-ancestor", changed }
+        : { kind: "shipped-change", shipped };
+}
+/**
+ * Split a loaded corpus into the verdicts that are about the audited commit
+ * and the ones that are not.
+ *
+ * FIVE REFUSAL ROUTES, AND THEY ARE STRUCTURALLY DIFFERENT RATHER THAN ONE
+ * SHAPE FIVE TIMES, which is what makes them members of a class instead of
+ * instances of a finding:
+ *
+ *   RESOLUTION   the declared head is not a commit in this repository. The
+ *                document is evidence about an object nobody can produce.
+ *   SHIPPED GAP  the declared head IS an ancestor, and shipped content changed
+ *                between it and the audited commit. Unreviewed work is riding
+ *                in on a review of something else.
+ *   DESCENDANT   the declared head is BELOW the audited commit. The reviewers
+ *                read a tree the audited commit does not contain.
+ *   UNRELATED    a real commit on neither side. A review of another line.
+ *   UNDETERMINED git could not place it. Never admitted, because a relation
+ *                nobody established must not read as the one that passes.
+ *
+ * ADMISSION IS TWO ROUTES AND THEY ARE ALSO PRINTED: the declared head IS the
+ * audited commit, or it is an ancestor whose whole gap is paperwork. See
+ * `relateDeclaredHead` for why the second is safe and for what it deliberately
+ * does not refuse.
+ *
+ * Every refusal leaves the verdict out of the audited group and IS PRINTED with
+ * the route it took, because a document silently dropped from a merge
+ * corpus is the fail-open direction this file has already been bitten by at
+ * `loadCommittedVerdicts`, at the `phase` canonicalisation and at
+ * `headGroupFor`. A reader is owed the fact that the corpus holds two
+ * approving reviews of something else.
+ */
+export function partitionByAuditedHead(contextDirectory, verdicts, auditedHead) {
+    const onHead = [];
+    const admitted = [];
+    const offHead = [];
+    const unkeyed = [];
+    const unkeyedVerdicts = [];
+    for (const candidate of verdicts) {
+        const key = headKeyOf(candidate.record, candidate.path);
+        if (!key.ok) {
+            unkeyed.push({ pointer: "#/head", message: key.message });
+            unkeyedVerdicts.push(candidate);
+            continue;
+        }
+        const relation = relateDeclaredHead(contextDirectory, key.value, auditedHead);
+        if (relation.kind === "same" || relation.kind === "evidence-only-ancestor") {
+            onHead.push(candidate);
+            admitted.push({ path: candidate.path, declared: key.value, relation });
+            continue;
+        }
+        offHead.push({ path: candidate.path, declared: key.value, relation });
+    }
+    return { onHead, admitted, offHead, unkeyed, unkeyedVerdicts };
+}
+/** How many shipped paths to name before the sentence stops being readable. */
+const NAMED_SHIPPED_PATHS = 5;
+/** One operator-facing line per verdict the audit excluded, naming its route. */
+export function describeOffHeadVerdicts(offHead, auditedHead) {
+    return [...offHead]
+        .sort((left, right) => (left.path < right.path ? -1 : left.path > right.path ? 1 : 0))
+        .map((entry) => {
+        const head = `${entry.path} declares head ${entry.declared}, which`;
+        const tail = `it is not evidence about the commit under audit ${auditedHead}`;
+        if (entry.relation.kind === "unresolvable") {
+            return `${head} does not resolve to a commit in this repository at all, so it is evidence about an object nobody can produce and ${tail}`;
+        }
+        if (entry.relation.kind === "shipped-change") {
+            const shipped = entry.relation.shipped;
+            const named = shipped.slice(0, NAMED_SHIPPED_PATHS).join(", ");
+            const more = shipped.length > NAMED_SHIPPED_PATHS
+                ? ` and ${String(shipped.length - NAMED_SHIPPED_PATHS)} more`
+                : "";
+            return (`${head} is an ancestor of the commit under audit ${auditedHead}, but ${String(shipped.length)} path(s) ` +
+                `outside ${PAPERWORK_ROOT}/ differ between them (${named}${more}), so shipped work no verdict reviewed ` +
+                `is riding in on a review of something else and ${tail}`);
+        }
+        if (entry.relation.kind === "descendant") {
+            return `${head} is a DESCENDANT of the commit under audit ${auditedHead}, so the reviewers read a tree this commit does not contain and ${tail}`;
+        }
+        if (entry.relation.kind === "undetermined") {
+            return `${head} could not be placed relative to the commit under audit ${auditedHead}, so whether it reviews this work is unknown and ${tail}: ${entry.relation.reason}`;
+        }
+        return `${head} is a commit in this repository and is neither the commit under audit ${auditedHead} nor an ancestor of it, so it is a review of other work and ${tail}`;
+    });
+}
+/** One operator-facing line per verdict the audit ADMITTED, naming its route. */
+export function describeAdmittedVerdicts(admitted, auditedHead) {
+    return [...admitted]
+        .sort((left, right) => (left.path < right.path ? -1 : left.path > right.path ? 1 : 0))
+        .map((entry) => entry.relation.kind === "evidence-only-ancestor"
+        ? `${entry.path} declares head ${entry.declared}, an ancestor of the commit under audit ${auditedHead} whose ` +
+            `${String(entry.relation.changed.length)} differing path(s) are all under ${PAPERWORK_ROOT}/, so the shipped ` +
+            `content it reviewed is the shipped content of this commit`
+        : `${entry.path} declares head ${entry.declared}, which IS the commit under audit`);
+}
+/**
+ * Read the declared delivery mode's merge authority out of a context directory.
+ *
+ * LIFTED OUT OF `dual-review-decorrelation` BY M4-P10, AND THE LIFT IS THE
+ * POINT RATHER THAN A TIDY-UP. M4-P10 adds a SECOND check that applies exactly
+ * where DR-0012's delegated grant applies (`verdict-pair-approves`, condition
+ * 2). Copying the regime reading into it would have produced two readers of one
+ * fact, which is the shape this repository's fix-round contract calls fixing the
+ * INSTANCE rather than the MECHANISM: a later correction to one reader would
+ * leave the other fail-open, and the three sites already repaired inside this
+ * block (recorded in the comments below) are the evidence that such corrections
+ * happen.
+ *
+ * Every message below is the one `dual-review-decorrelation` shipped, byte for
+ * byte, except that the two REPORT lines now name the CALLING check. That is
+ * deliberate: a reader who sees `REPORT verdict-pair-approves ... declares no
+ * delivery mode` must be able to tell which guard declined to run.
+ */
+function establishDelegatedRegime(checkId, contextDirectory, phase, source) {
+    const charterPresent = contextDocumentPresentAt(contextDirectory, CHARTER_DOCUMENT, source);
+    if (!charterPresent) {
+        /* THE SENTENCE NAMES THE SOURCE, AND THE CLAIM ABOUT THE MERGE GATE NAMES
+           THE READER BOTH SIDES SHARE (FIX ROUND 2, DV-001). Fix round 1 moved
+           this PRESENCE probe to the commit and left the merge gate's refusal on
+           disk, so a `charter.yaml` written into a working tree and committed
+           nowhere passed the gate's refusal, reached this arm, and was reported as
+           "no charter.yaml" while the file sat in the directory the same line
+           names. The gate now refuses through `missingRegimeDocument` below,
+           which is this same probe, so the second half of this sentence is a
+           property of one shared function rather than a claim about another
+           program that has to be maintained by hand. */
+        return {
+            kind: "report",
+            lines: [
+                `REPORT ${checkId} ${contextDirectory} declares no delivery mode ` +
+                    `(no ${CHARTER_DOCUMENT} ${describeContextDocumentSource(source)}), so the verdicts for phase ` +
+                    `${phase} were NOT evaluated against a merge-authority regime; the merge gate ` +
+                    `scripts/check-dual-review.mjs refuses such a directory outright, through the same presence ` +
+                    `reader and therefore against the same source`,
+            ],
+        };
+    }
+    const charter = readContextDocumentAt(contextDirectory, CHARTER_DOCUMENT, source);
+    if (!charter.ok) {
+        return {
+            kind: "violation",
+            pointer: "#/produced-by",
+            message: `the charter is present and could not be read, so the declared mode's merge-authority is unknown and decorrelation could not be evaluated: ${charter.reason}`,
+        };
+    }
+    /* SITE TWO OF THE SAME MECHANISM. `asRecord(charter.value)?.["delivery-mode"]`
+       used to flow into `String(modeId)` and into an `===` against every mode's
+       id, so a charter declaring NO delivery mode reddened with the sentence
+       "declares delivery mode undefined, which ... does not define". The verdict
+       was right by luck and the sentence was false: the charter declares no mode
+       rather than one called "undefined". Establishing it first gives absence its
+       own sentence, and gives the `===` below a non-empty string, which is also
+       what stops an id-less mode row (`eachMode` defaults a missing id to "")
+       from matching a charter whose delivery-mode is the empty string. */
+    const modeReading = establishField(asRecord(charter.value), "delivery-mode");
+    if (modeReading.kind !== "established") {
+        return {
+            kind: "violation",
+            pointer: "#/produced-by",
+            message: `${charter.path} ${unestablishedReason(modeReading, "delivery-mode")}, so no mode's merge-authority can be looked up and whether the delegated grant applies to phase ${phase} could not be established`,
+        };
+    }
+    const modeId = modeReading.value;
+    const modesDocument = readContextDocumentAt(contextDirectory, MODES_DOCUMENT, source);
+    if (!modesDocument.ok) {
+        return {
+            kind: "violation",
+            pointer: "#/produced-by",
+            message: `${charter.path} declares delivery mode ${String(modeId)} and ${MODES_DOCUMENT} could not be read, so that mode's merge-authority is unknown and decorrelation could not be evaluated: ${modesDocument.reason}`,
+        };
+    }
+    /* BOTH SIDES CANONICAL, and the direction here is worth stating because it
+       is the one place in this function where collapsing makes a lookup SUCCEED
+       more often rather than fail. `eachMode` builds `row.id` with its own
+       `String(... ?? "")` and is shared with six other consumers, so it is left
+       alone and its output is canonicalised at THIS use site. Finding the mode
+       a charter actually names is the correct reading; the security-relevant
+       comparison is the `merge-authority` one below, and THAT one is fail-closed
+       under collapsing, because more values matching the delegated constant
+       means the decorrelation requirement applies more often, never less. */
+    const mode = eachMode(modesDocument.value).find((row) => {
+        const reading = canonicalScalar(row.id);
+        return reading.ok && reading.value === modeId;
+    });
+    if (mode === undefined) {
+        return {
+            kind: "violation",
+            pointer: "#/produced-by",
+            message: `${charter.path} declares delivery mode ${String(modeId)}, which ${modesDocument.path} does not define, so its merge-authority is unknown`,
+        };
+    }
+    /* SITE THREE, AND IT IS THE WORST OF THE FOUR BECAUSE IT DISABLES THE WHOLE
+       CHECK RATHER THAN ONE DIMENSION. `String(mode.mode["merge-authority"] ?? "")`
+       made a mode that declares NO merge-authority indistinguishable from one
+       declaring some other authority, and the not-a-delegated-grant arm below is
+       a REPORT rather than a violation. Measured on the shipped script before
+       this repair (probe P1 in delivery/work-history/m3-p9.md): a pair sharing
+       one model family, under a mode with its `merge-authority` line deleted,
+       exited 0 GREEN printing "mode full declares merge-authority , which is not
+       a delegated grant". That sentence is false and the exit code authorises
+       the merge the check exists to refuse. The reviewer did not find this one;
+       the derivation did. */
+    const authorityReading = establishField(mode.mode, "merge-authority");
+    if (authorityReading.kind !== "established") {
+        return {
+            kind: "violation",
+            pointer: "#/produced-by",
+            message: `${modesDocument.path} ${unestablishedReason(authorityReading, "merge-authority")} for mode ${modeId}, so whether the delegated grant applies to phase ${phase} could not be established, and a merge check that cannot determine the regime must not report that no decorrelation is required`,
+        };
+    }
+    const authority = authorityReading.value;
+    if (authority !== DELEGATED_MERGE_AUTHORITY) {
+        return {
+            kind: "report",
+            lines: [
+                `REPORT ${checkId} mode ${String(modeId)} declares merge-authority ${authority}, ` +
+                    `which is not a delegated grant, so no decorrelation is required of the reviews of phase ${phase}`,
+            ],
+        };
+    }
+    return { kind: "delegated" };
+}
+/* ------------------------------------------------------------------ */
+/* review-families: DR-0038's declared single-family exception (M4-P11) */
+/* ------------------------------------------------------------------ */
+/** The charter field DR-0038's declaration lives in (M4-D-28). */
+export const REVIEW_FAMILIES_FIELD = "review-families";
+/** The document that carries it. */
+export const CHARTER_DOCUMENT = "charter.yaml";
+/**
+ * The documents that say WHICH merge-authority regime is in force.
+ *
+ * MOVED HERE FROM `scripts/check-dual-review.mjs` (FIX ROUND 2, DV-001). The
+ * script held its own copy of this list AND its own presence probe, and the
+ * probe read the WORKING TREE while `establishDelegatedRegime` read the
+ * COMMIT. Two probes of one fact against two sources is the mechanism this
+ * phase has now paid for twice: each answered correctly about its own source,
+ * so nothing ever reported a disagreement, and an uncommitted `charter.yaml`
+ * took the gate from error to GREEN on a correlated committed pair.
+ */
+export const REGIME_DOCUMENTS = [CHARTER_DOCUMENT, MODES_DOCUMENT];
+/**
+ * The first regime document that is NOT present at the source a decision over
+ * this context would be made from, or `undefined` when both are.
+ *
+ * WHY THE REFUSAL LIVES AT THE MERGE GATE AND THE REPORT LIVES IN THE CHECK,
+ * unchanged from M3-P9 and restated because this round moved the probe: the
+ * derived check runs on ANY verdict with ANY context, and M3-P7's verdict
+ * contexts carry a plan and a work history and no charter, so a check that
+ * reddened on an absent charter reddened eight of that phase's tests. The
+ * check therefore REPORTS, and `scripts/check-dual-review.mjs`, which is the
+ * command DR-0012's grant runs through, refuses. What changed is that the
+ * refusal and the report are now ONE probe with two callers, so they cannot
+ * answer about different sources.
+ *
+ * THE SOURCE IS A PARAMETER, not resolved here, so a caller that has already
+ * resolved one (the gate script resolves it when it loads the corpus) refuses
+ * against the SAME commit it read the verdicts from rather than a second
+ * `rev-parse` that could land elsewhere.
+ */
+export function missingRegimeDocument(contextDirectory, source = resolveCorpusSource(contextDirectory)) {
+    for (const document of REGIME_DOCUMENTS) {
+        if (!contextDocumentPresentAt(contextDirectory, document, source)) {
+            return {
+                document,
+                source,
+                reason: `${join(contextDirectory, document)} does not exist ${describeContextDocumentSource(source)}, so ` +
+                    `the declared mode's merge-authority is unknown and no decorrelation verdict can be reached; a ` +
+                    `merge check that cannot determine the regime reports error, never green`,
+            };
+        }
+    }
+    return undefined;
+}
+function gitIn(args, cwd) {
+    /* The buffer is raised because a charter is an operator document with no
+       declared size bound, and a truncated read would decode as a DIFFERENT
+       document rather than as a failure. */
+    const run = spawnSync("git", args, { cwd, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
+    if (run.error !== undefined) {
+        return { ok: false, reason: `git ${args.join(" ")} could not be run: ${String(run.error)}` };
+    }
+    if (run.status !== 0) {
+        return {
+            ok: false,
+            reason: `git ${args.join(" ")} exited ${String(run.status)}: ${(run.stderr ?? "").replace(/\s+/g, " ").trim()}`,
+        };
+    }
+    return { ok: true, stdout: run.stdout ?? "" };
+}
+/**
+ * Is a `review-families` key present in the WORKING TREE's charter?
+ *
+ * Asked for exactly one purpose: to tell "this project makes no declaration"
+ * apart from "this project makes a declaration that is not committed". The
+ * first is absence and changes nothing. The second is an ERROR, because the
+ * whole value of the exception over a silent one is that a reader can check
+ * it, and an uncommitted claim is one nothing can be checked against.
+ */
+function treeDeclaresReviewFamilies(contextDirectory) {
+    const tree = readContextDocument(contextDirectory, CHARTER_DOCUMENT);
+    if (!tree.ok) {
+        return false;
+    }
+    const record = asRecord(tree.value);
+    return record !== undefined && REVIEW_FAMILIES_FIELD in record;
+}
+/**
+ * Read DR-0038's declaration OUT OF THE GIT OBJECT DATABASE, never out of the
+ * working tree.
+ *
+ * WHY THE COMMITTED BLOB IS THE ONLY ONE THAT COUNTS. This is the anti-widening
+ * rule the scope auditor and `loadDeclaration` (src/gates/release.ts:817) both
+ * already apply, one condition along: a phase must not be able to switch off,
+ * inside its own working tree, the condition that would otherwise have refused
+ * its merge. A declaration read from disk is one an implementer can add,
+ * merge under, and delete, leaving a merged head whose record says the
+ * cross-family requirement was met.
+ *
+ * `HEAD:./charter.yaml` AND NOT `HEAD:charter.yaml`, and the difference is not
+ * cosmetic. A path without the leading `./` is resolved against the repository
+ * ROOT, so a context directory that happens to sit inside a larger repository
+ * (which every fixture staged under a checkout does) would silently read that
+ * repository's charter instead of its own. With `./` git resolves relative to
+ * the directory it was run in, which is the one the caller named.
+ */
+export function readReviewFamilies(contextDirectory, ref = "HEAD") {
+    const resolved = gitIn(["rev-parse", `${ref}^{commit}`], contextDirectory);
+    const relativePath = `./${CHARTER_DOCUMENT}`;
+    if (!resolved.ok) {
+        if (treeDeclaresReviewFamilies(contextDirectory)) {
+            return {
+                kind: "error",
+                reason: `${join(contextDirectory, CHARTER_DOCUMENT)} declares ${REVIEW_FAMILIES_FIELD} in the working tree and ` +
+                    `${contextDirectory} has no resolvable git ref ${ref}, so the declaration cannot be attributed to a ` +
+                    `commit; an exception read from an uncommitted file is error, never permission (${resolved.reason})`,
+            };
+        }
+        return { kind: "absent" };
+    }
+    const refSha = resolved.stdout.trim();
+    const shown = gitIn(["show", `${refSha}:${relativePath}`], contextDirectory);
+    if (!shown.ok) {
+        if (treeDeclaresReviewFamilies(contextDirectory)) {
+            return {
+                kind: "error",
+                reason: `${join(contextDirectory, CHARTER_DOCUMENT)} declares ${REVIEW_FAMILIES_FIELD} in the working tree and ` +
+                    `${refSha}:${relativePath} could not be read, so the declaration is not committed and cannot be ` +
+                    `attributed; an exception read from an uncommitted file is error, never permission (${shown.reason})`,
+            };
+        }
+        return { kind: "absent" };
+    }
+    const body = shown.stdout;
+    const sha256 = createHash("sha256").update(body).digest("hex");
+    const provenance = {
+        path: CHARTER_DOCUMENT,
+        ref,
+        refSha,
+        sha256,
+    };
+    const decoded = decodeDocument(body, join(contextDirectory, CHARTER_DOCUMENT));
+    if (!decoded.ok) {
+        return {
+            kind: "error",
+            reason: `${refSha}:${relativePath} does not decode, so whether it declares ${REVIEW_FAMILIES_FIELD} could not be established: ${decoded.reason}`,
+        };
+    }
+    const charter = asRecord(decoded.value);
+    if (charter === undefined || !(REVIEW_FAMILIES_FIELD in charter)) {
+        return { kind: "absent" };
+    }
+    const declaration = asRecord(charter[REVIEW_FAMILIES_FIELD]);
+    if (declaration === undefined) {
+        return {
+            kind: "error",
+            reason: `${refSha}:${relativePath} carries ${REVIEW_FAMILIES_FIELD} and it is not a map, so no declared family set can be read from it`,
+        };
+    }
+    const reasonReading = establishField(declaration, "reason");
+    if (reasonReading.kind !== "established") {
+        return {
+            kind: "error",
+            reason: `${refSha}:${relativePath} ${unestablishedReason(reasonReading, `${REVIEW_FAMILIES_FIELD}.reason`)}; ` +
+                `narrowing an owner-reserved merge condition costs a stated reason, so a declaration without one is error`,
+        };
+    }
+    const available = declaration["available"];
+    if (!Array.isArray(available) || available.length === 0) {
+        return {
+            kind: "error",
+            reason: `${refSha}:${relativePath} declares ${REVIEW_FAMILIES_FIELD}.available as ${Array.isArray(available) ? "an empty list" : "not a list"}, so no family set can be read from it`,
+        };
+    }
+    const families = [];
+    const declaredAs = [];
+    for (let index = 0; index < available.length; index += 1) {
+        const entry = available[index];
+        /* Each entry goes through the SAME canonical form a verdict's
+           `produced-by` goes through, because the two are compared to each other
+           below. A declaration canonicalised one way and an observation
+           canonicalised another is the fix-round-2 mechanism with two documents
+           instead of one. */
+        const reading = establishField({ entry }, "entry");
+        if (reading.kind !== "established") {
+            return {
+                kind: "error",
+                reason: `${refSha}:${relativePath} ${unestablishedReason(reading, `${REVIEW_FAMILIES_FIELD}.available[${String(index)}]`)}, so the declared family set cannot be compared with what the verdicts carry`,
+            };
+        }
+        if (families.includes(reading.value)) {
+            /* REFUSED RATHER THAN DEDUPLICATED, and the direction is why. The
+               exception applies when exactly ONE family is declared, so collapsing
+               `[Anthropic, anthropic]` to one entry would turn a document that reads
+               as two families into a single-family declaration. That is the only
+               canonicalisation in this file that would be fail-OPEN, so it is a
+               refusal instead. */
+            return {
+                kind: "error",
+                reason: `${refSha}:${relativePath} lists ${String(entry)} in ${REVIEW_FAMILIES_FIELD}.available more than once once canonicalised, so how many families it declares cannot be established`,
+            };
+        }
+        families.push(reading.value);
+        declaredAs.push(String(entry));
+    }
+    return {
+        kind: "declared",
+        families: [...families].sort(),
+        declaredAs,
+        reason: declaration["reason"],
+        provenance,
+    };
+}
+/** One line naming where a declaration came from, for a detail or a report. */
+export function reviewFamiliesProvenanceLine(provenance) {
+    return (`declaration ${provenance.path} read from ${provenance.ref} ` +
+        `(${provenance.refSha}), blob sha256 ${provenance.sha256}`);
+}
+/**
+ * DR-0038's exception, and its two falsifiers, over one committed corpus.
+ *
+ * THE EXCEPTION NARROWS EXACTLY ONE DIMENSION. `produced-by` stops being
+ * required to differ. `framing` and `review-contract` are untouched, because
+ * T-007's whole finding is that model decorrelation and CONTRACT decorrelation
+ * are different properties: a single-family environment still has two framings
+ * and two contracts available to it, so relaxing those would be relaxing
+ * something the environment does not force.
+ *
+ * FALSIFIER 1, CONTRADICTION BY THE CORPUS. If the project's own committed
+ * verdicts carry two or more distinct canonicalised `produced-by` values, the
+ * declaration is contradicted by the project's own record and this is RED. A
+ * project that has demonstrably used two cannot claim one.
+ *
+ * FALSIFIER 2, THE NAME MUST MATCH. A verdict whose `produced-by` canonicalises
+ * to anything other than the declared family is RED. Without this, a
+ * declaration could name a family nothing in the record uses and still buy the
+ * relaxation.
+ *
+ * THE SCOPE IS THE WHOLE COMMITTED CORPUS, NOT THE ONE (phase, head) GROUP,
+ * and that is deliberate. "This project has one family available" is a claim
+ * about the project, so the widest set of its own verdicts is what can refute
+ * it. Scoping the falsifiers to the group under review would let a project
+ * whose history carries three families declare one, provided the two reviews
+ * in front of the check happened to agree.
+ *
+ * WHAT IT DOES NOT CATCH, said here and not only in the plan: a project with a
+ * second family AVAILABLE that has simply never used it. Nothing in a record of
+ * what WAS used reaches what COULD have been used. `readReviewFamilies` answers
+ * that with provenance rather than detection: the claim is attributable to a
+ * commit and a blob, so it is dated and signed even where it is not refutable.
+ */
+export function singleFamilyException(contextDirectory, loaded) {
+    /* ONE RESOLUTION, THREADED THROUGH, AND THAT IS THE STRUCTURAL HALF OF THE
+       FIX (M4-P11 fix round 1). The declaration is no longer read at whatever
+       `HEAD` happens to mean when `readReviewFamilies` is called: it is read at
+       the EXACT commit sha the pair corpus was enumerated from, and the
+       falsifiers' own corpus is then read from that same sha. A declaration and
+       the evidence that refutes it come out of ONE TREE by construction, so
+       "they disagree about what exists" is not a state this function can be put
+       into rather than a state it checks for and hopes to catch.
+  
+       On the worktree arm there is no commit to pin to, so `HEAD` is passed and
+       `readReviewFamilies` performs the same `rev-parse` that just failed: it
+       returns `absent`, or `error` if the working tree declares anyway. Either
+       way no exception is granted, which is why one source of truth with no git
+       is safe and two sources with git was not. */
+    const declarationRef = loaded.source.kind === "commit" ? loaded.source.refSha : "HEAD";
+    const reading = readReviewFamilies(contextDirectory, declarationRef);
+    if (reading.kind === "error") {
+        return { kind: "error", reason: reading.reason };
+    }
+    if (reading.kind === "absent") {
+        /* AN ABSENT DECLARATION IS NOT PERMISSION. src/gates/release.ts:1037 states
+           the rule for the sibling case; here it means the cross-family requirement
+           applies unchanged, so a same-family pair stays red. */
+        return { kind: "not-declared" };
+    }
+    if (reading.families.length !== 1) {
+        /* A declaration of TWO OR MORE families is a valid declaration and it is
+           not this exception. The environment says it has more than one, so
+           DR-0012 condition 1 is satisfiable honestly and nothing is narrowed. */
+        return { kind: "not-declared" };
+    }
+    /* THE FALSIFIERS' CORPUS IS READ HERE AND NOT BY THE CALLER, for two
+       reasons that both matter. It is a WIDER set than the pair corpus, because
+       the claim being falsified is about the project rather than about the two
+       reviews in front of the check (CR-M4P11-002). And reading it only after a
+       single-family declaration has been established means the wider read is
+       paid for only by the runs that claim the exception, instead of by every
+       verdict validated anywhere. */
+    const paperwork = loaded.source.kind === "commit"
+        ? loadPaperworkVerdicts(contextDirectory, loaded.source.ref, loaded.source.refSha)
+        : /* UNREACHABLE BY CONSTRUCTION AND NOT LEFT TO CHANCE: `reading` is
+             `declared` only when `readReviewFamilies` resolved a commit, and it
+             resolves the same ref this corpus failed to resolve. It is written
+             as a refusal rather than an assertion because M2-C-3 says a check
+             that cannot establish its subject reports error, never a verdict. */
+            {
+                ok: false,
+                reason: `${CHARTER_DOCUMENT} declares ${REVIEW_FAMILIES_FIELD} at ${declarationRef} and ${contextDirectory} ` +
+                    `has no resolvable commit to read the refuting record from, so the exception could not be evaluated`,
+            };
+    if (!paperwork.ok) {
+        return { kind: "error", reason: paperwork.reason };
+    }
+    const corpus = paperwork.verdicts;
+    const corpusScope = describeVerdictCorpusSource(paperwork.source);
+    const declared = reading.families[0];
+    const provenance = reviewFamiliesProvenanceLine(reading.provenance);
+    const violations = [];
+    const observed = new Map();
+    for (const candidate of corpus) {
+        const value = establishField(candidate.record, "produced-by");
+        if (value.kind !== "established") {
+            violations.push({
+                pointer: "#/produced-by",
+                message: `${candidate.path} ${unestablishedReason(value, "produced-by")}, so it cannot be compared with the single family ${REVIEW_FAMILIES_FIELD} declares, and an exception cannot rest on a verdict that does not say what produced it; ${provenance}`,
+            });
+            continue;
+        }
+        observed.set(value.value, [...(observed.get(value.value) ?? []), candidate.path]);
+    }
+    const distinct = [...observed.keys()].sort();
+    if (distinct.length > 1) {
+        violations.push({
+            pointer: "#/produced-by",
+            message: `${CHARTER_DOCUMENT} declares the single review family ${reading.declaredAs.join(", ")} and the ` +
+                `${String(corpus.length)} verdict document(s) committed under ${PAPERWORK_ROOT}/ carry ` +
+                `${String(distinct.length)} distinct produced-by value(s) (${distinct.join(", ")}), so the declaration ` +
+                `is contradicted by this project's own record and the exception does not apply; ${provenance} ` +
+                corpusScope,
+        });
+    }
+    for (const value of distinct) {
+        if (value === declared) {
+            continue;
+        }
+        violations.push({
+            pointer: "#/produced-by",
+            /* BOTH SPELLINGS OF THE DECLARED NAME, for the reason the `phase` label
+               one screen down already gives: the canonical form is what was
+               COMPARED and the operator's form is what is in the file they are
+               holding. Printing only the canonical form tells someone whose charter
+               says `Family-A` about a family called `family-a`. */
+            message: `${CHARTER_DOCUMENT} declares the single review family ${reading.declaredAs.join(", ")} ` +
+                `(canonically ${declared}) and ` +
+                `${observed.get(value).sort().join(", ")} carr${observed.get(value).length === 1 ? "ies" : "y"} ` +
+                `produced-by ${value}, which is not the declared family, so the exception does not apply to it; ${provenance}`,
+        });
+    }
+    if (violations.length > 0) {
+        return { kind: "refused", violations };
+    }
+    return {
+        kind: "exempt",
+        family: declared,
+        reading,
+        reports: [
+            `REPORT single-family-declared ${CHARTER_DOCUMENT} declares exactly one review family ` +
+                `(${reading.declaredAs.join(", ")}) and all ${String(corpus.length)} verdict document(s) committed ` +
+                `under ${PAPERWORK_ROOT}/ carry it, so produced-by is NOT required to differ; framing and ` +
+                `review-contract still are; reason: ${reading.reason}; ${provenance} ` +
+                corpusScope,
+        ],
+    };
+}
 /**
  * DR-0012's merge precondition, made into a comparison a command can make
  * against the verdict FILES rather than against a session's memory (M3R-004).
@@ -2934,15 +4302,30 @@ function decorrelationTriple(record) {
  * criteria contract. So `review-contract` is compared separately and is
  * witnessed separately (criterion 7b).
  *
- * WHAT IT DOES NOT REACH, named rather than left to be found. Condition (d) of
- * step 3b, that neither verdict carries an unresolved high or medium finding,
- * is NOT checked here: the verdict schema's own root `if`/`then` already
- * forbids APPROVE beside a high or critical finding, and "unresolved" is a
- * state of the review thread rather than of the document. Nothing here decides
- * whether the two verdicts describe the same HEAD either: the verdict schema
- * carries no head field, so `phase` is the join key and the DIRECTORY is what
- * scopes a set of verdicts to one head. Both are stated in
- * delivery/work-history/m3-p9.md as declared readings rather than absorbed.
+ * WHAT IT DOES NOT REACH, named rather than left to be found, AND BOTH ITEMS
+ * THIS PARAGRAPH USED TO NAME HAVE BEEN CLOSED BY M4-P10. The first was
+ * condition (d) of step 3b, that neither verdict carries an unresolved high or
+ * medium finding; that is now the sibling check `verdict-pair-approves`, and
+ * the schema's own root `if`/`then` was widened from [high, critical] to
+ * [medium, high, critical] at the same time, because it had been one severity
+ * narrower than DR-0012 condition 2 ever since it shipped. The second was that
+ * nothing decided whether two verdicts describe the same HEAD; the schema now
+ * requires `head` and this check groups by `(phase, head)`.
+ *
+ * WHAT IS STILL NOT REACHED, so the paragraph does not read as complete. This
+ * check compares `produced-by` as a canonicalised STRING, never as a model
+ * FAMILY, so two values naming one vendor pass as decorrelated; that was
+ * measured twice against this repository's own reviews and recorded at
+ * delivery/verification/m4-prototype-probes.md:1. THE DEFERRAL CHAIN FOR IT
+ * TERMINATED WITH NO OWNER, which is what CR-VS-003 found and what this
+ * paragraph used to hide: it said "closing it is M4-P11's declared scope", and
+ * M4-P11 declined the mechanism (delivery/work-history/m4-p11.md:142) and
+ * shipped the single-family EXCEPTION instead, which is a different question.
+ * No later phase picked it up. The string comparison therefore STANDS, and what
+ * the DR-0047 sweep changed is that the green line now says so: see
+ * `producedByCaveat`, which also names what would close it. And a
+ * `produced-by` line is written BY the reviewing agent, so it is forgeable; an
+ * observed alternative exists and is M4-D-06's business, not this check's.
  */
 export const dualReviewDecorrelation = {
     id: "dual-review-decorrelation",
@@ -3013,135 +4396,80 @@ export const dualReviewDecorrelation = {
            `error`. That is the path DR-0012's grant runs through, and it must never
            report green without knowing the regime. Imposing the same refusal here
            imposed it on a path the grant has nothing to do with. */
-        const charterPresent = classifyEntry(join(contextDirectory, "charter.yaml")).kind !== "absent";
-        if (!charterPresent) {
-            return {
-                violations: [],
-                reports: [
-                    `REPORT dual-review-decorrelation ${contextDirectory} declares no delivery mode ` +
-                        `(no charter.yaml), so the verdicts for phase ${phase} were NOT evaluated against a ` +
-                        `merge-authority regime; scripts/check-dual-review.mjs refuses such a directory outright`,
-                ],
-            };
+        /* ONE RESOLUTION FOR THE WHOLE DECISION (M4-P11 fix round 1). The regime,
+           the declaration and both corpora are read from THIS value, so no two of
+           them can describe different trees. Resolved before the regime rather
+           than after it because the regime is the first thing that can end the
+           run, and a regime read from an uncommitted charter was measured turning
+           a red correlated pair green at exit 0. */
+        const source = resolveCorpusSource(contextDirectory);
+        const regime = establishDelegatedRegime("dual-review-decorrelation", contextDirectory, phase, source);
+        if (regime.kind === "report") {
+            return { violations: [], reports: regime.lines };
         }
-        const charter = readContextDocument(contextDirectory, "charter.yaml");
-        if (!charter.ok) {
+        if (regime.kind === "violation") {
             return {
-                violations: [
-                    {
-                        pointer: "#/produced-by",
-                        message: `the charter is present and could not be read, so the declared mode's merge-authority is unknown and decorrelation could not be evaluated: ${charter.reason}`,
-                    },
-                ],
+                violations: [{ pointer: regime.pointer, message: regime.message }],
                 reports: [],
             };
         }
-        /* SITE TWO OF THE SAME MECHANISM. `asRecord(charter.value)?.["delivery-mode"]`
-           used to flow into `String(modeId)` and into an `===` against every mode's
-           id, so a charter declaring NO delivery mode reddened with the sentence
-           "declares delivery mode undefined, which ... does not define". The verdict
-           was right by luck and the sentence was false: the charter declares no mode
-           rather than one called "undefined". Establishing it first gives absence its
-           own sentence, and gives the `===` below a non-empty string, which is also
-           what stops an id-less mode row (`eachMode` defaults a missing id to "")
-           from matching a charter whose delivery-mode is the empty string. */
-        const modeReading = establishField(asRecord(charter.value), "delivery-mode");
-        if (modeReading.kind !== "established") {
-            return {
-                violations: [
-                    {
-                        pointer: "#/produced-by",
-                        message: `${charter.path} ${unestablishedReason(modeReading, "delivery-mode")}, so no mode's merge-authority can be looked up and whether the delegated grant applies to phase ${phase} could not be established`,
-                    },
-                ],
-                reports: [],
-            };
-        }
-        const modeId = modeReading.value;
-        const modesDocument = readContextDocument(contextDirectory, MODES_DOCUMENT);
-        if (!modesDocument.ok) {
-            return {
-                violations: [
-                    {
-                        pointer: "#/produced-by",
-                        message: `${charter.path} declares delivery mode ${String(modeId)} and ${MODES_DOCUMENT} could not be read, so that mode's merge-authority is unknown and decorrelation could not be evaluated: ${modesDocument.reason}`,
-                    },
-                ],
-                reports: [],
-            };
-        }
-        /* BOTH SIDES CANONICAL, and the direction here is worth stating because it
-           is the one place in this function where collapsing makes a lookup SUCCEED
-           more often rather than fail. `eachMode` builds `row.id` with its own
-           `String(... ?? "")` and is shared with six other consumers, so it is left
-           alone and its output is canonicalised at THIS use site. Finding the mode
-           a charter actually names is the correct reading; the security-relevant
-           comparison is the `merge-authority` one below, and THAT one is fail-closed
-           under collapsing, because more values matching the delegated constant
-           means the decorrelation requirement applies more often, never less. */
-        const mode = eachMode(modesDocument.value).find((row) => {
-            const reading = canonicalScalar(row.id);
-            return reading.ok && reading.value === modeId;
-        });
-        if (mode === undefined) {
+        const committed = loadCommittedVerdicts(contextDirectory, source);
+        if (!committed.ok) {
             return {
-                violations: [
-                    {
-                        pointer: "#/produced-by",
-                        message: `${charter.path} declares delivery mode ${String(modeId)}, which ${modesDocument.path} does not define, so its merge-authority is unknown`,
-                    },
-                ],
+                violations: [{ pointer: "#/produced-by", message: committed.reason }],
                 reports: [],
             };
         }
-        /* SITE THREE, AND IT IS THE WORST OF THE FOUR BECAUSE IT DISABLES THE WHOLE
-           CHECK RATHER THAN ONE DIMENSION. `String(mode.mode["merge-authority"] ?? "")`
-           made a mode that declares NO merge-authority indistinguishable from one
-           declaring some other authority, and the not-a-delegated-grant arm below is
-           a REPORT rather than a violation. Measured on the shipped script before
-           this repair (probe P1 in delivery/work-history/m3-p9.md): a pair sharing
-           one model family, under a mode with its `merge-authority` line deleted,
-           exited 0 GREEN printing "mode full declares merge-authority , which is not
-           a delegated grant". That sentence is false and the exit code authorises
-           the merge the check exists to refuse. The reviewer did not find this one;
-           the derivation did. */
-        const authorityReading = establishField(mode.mode, "merge-authority");
-        if (authorityReading.kind !== "established") {
+        /* DR-0038's EXCEPTION IS DECIDED HERE, BEFORE THE GROUP IS ASSEMBLED, AND
+           THE POSITION IS LOAD-BEARING (M4-P11). Both falsifiers are claims about
+           the project's WHOLE committed corpus, not about the pair in front of the
+           check, so they are answerable without a head and they are answered first.
+           Putting them after the head resolution would have made a contradicted
+           declaration invisible on exactly the corpus that contradicts it: this
+           repository's own two real review verdicts predate M4-P10's required
+           `head` field, so the head arm returns before any of this would run.
+    
+           A CONTRADICTED DECLARATION RETURNS IMMEDIATELY. It is red either way, so
+           nothing is authorised by the early return, and what a reader needs first
+           is that the project's declaration is false rather than a list of
+           downstream consequences of believing it. */
+        const exception = singleFamilyException(contextDirectory, committed);
+        if (exception.kind === "error") {
+            /* M2-C-3. A check that cannot establish whether an exception applies must
+               not decide that it does not and carry on: that would silently impose
+               the strict rule on a project that may have declared honestly, and,
+               worse, would report a normal red that hides an unreadable declaration. */
             return {
-                violations: [
-                    {
-                        pointer: "#/produced-by",
-                        message: `${modesDocument.path} ${unestablishedReason(authorityReading, "merge-authority")} for mode ${modeId}, so whether the delegated grant applies to phase ${phase} could not be established, and a merge check that cannot determine the regime must not report that no decorrelation is required`,
-                    },
-                ],
+                violations: [{ pointer: "#/produced-by", message: exception.reason }],
                 reports: [],
             };
         }
-        const authority = authorityReading.value;
-        if (authority !== DELEGATED_MERGE_AUTHORITY) {
-            return {
-                violations: [],
-                reports: [
-                    `REPORT dual-review-decorrelation mode ${String(modeId)} declares merge-authority ${authority}, ` +
-                        `which is not a delegated grant, so no decorrelation is required of the reviews of phase ${phase}`,
-                ],
-            };
+        if (exception.kind === "refused") {
+            return { violations: exception.violations, reports: [] };
         }
-        const committed = loadCommittedVerdicts(contextDirectory);
-        if (!committed.ok) {
+        const exemptDimensions = exception.kind === "exempt" ? new Set(["produced-by"]) : new Set();
+        const exceptionReports = exception.kind === "exempt" ? exception.reports : [];
+        /* THE JOIN KEY IS NOW (phase, head), WHICH IS M4-P10's FIRST CHANGE. Until
+           this line the key was `phase` alone and the DIRECTORY was what scoped a
+           set of verdicts to one head, a convention declared in
+           delivery/work-history/m3-p9.md and enforced by nothing. Under that
+           convention two reviews of two DIFFERENT heads sitting in one directory
+           were compared as a pair and the grant read as satisfied, which is
+           DR-0012 condition 1's head clause
+           (delivery/decisions/DR-0012-delegated-merge-authority.md:22) asserted by
+           an operator rather than checked. The instance's OWN head is established
+           first, so a verdict that does not say what it reviewed cannot select a
+           group at all. */
+        const ownHead = headKeyOf(verdict, "this verdict");
+        if (!ownHead.ok) {
             return {
-                violations: [{ pointer: "#/produced-by", message: committed.reason }],
+                violations: [{ pointer: "#/head", message: ownHead.message }],
                 reports: [],
             };
         }
-        const group = committed.verdicts.filter(
-        /* BOTH SIDES CANONICAL. `phase` above is already canonical; the sibling's
-           is read through the same function so the two are compared in one form
-           rather than one canonical value against one raw one. */
-        (candidate) => {
-            const reading = establishField(candidate.record, "phase");
-            return reading.kind === "established" && reading.value === phaseKey;
-        });
+        const headKey = ownHead.value;
+        const grouped = headGroupFor(committed.verdicts, phaseKey, headKey);
+        const group = grouped.members;
         /* MEMBERSHIP FIRST. DR-0012 condition 1 says the two reviews are WRITTEN TO
            `delivery/review/` AND COMMITTED, so a verdict that is not among them is
            not a review this rule can be satisfied by, however well decorrelated the
@@ -3153,20 +4481,35 @@ export const dualReviewDecorrelation = {
                 violations: [
                     {
                         pointer: "#/phase",
-                        message: `this verdict is not among the ${String(group.length)} verdict document(s) committed under ${REVIEW_DIRECTORY} for phase ${phase}, so it is not a review the delegated grant can be satisfied by`,
+                        message: `this verdict is not among the ${String(group.length)} verdict document(s) committed under ${REVIEW_DIRECTORY} for phase ${phase} at head ${headKey}, so it is not a review the delegated grant can be satisfied by ${describeVerdictCorpusSource(committed.source)}`,
                     },
                 ],
                 reports: [],
             };
         }
-        const violations = [];
+        /* THE SIBLINGS THAT COULD NOT BE LOOKED AT OR COULD NOT BE KEYED ARE
+           CARRIED IN, NOT DROPPED. See `loadCommittedVerdicts` and `headGroupFor`:
+           a candidate whose bytes do not read or decode, and a same-phase verdict
+           with an unusable phase or head, each shrink the group silently
+           otherwise, and a shrinking group is the fail-open shape. */
+        const violations = [...committed.unexaminable, ...grouped.unkeyed];
         if (group.length < 2) {
             violations.push({
                 pointer: "#/phase",
-                message: `only ${String(group.length)} verdict document(s) exist under ${REVIEW_DIRECTORY} for phase ${phase}, and a delegated grant requires two independent clean-room reviews of the exact head`,
+                message: `only ${String(group.length)} verdict document(s) exist under ${REVIEW_DIRECTORY} for phase ${phase} at head ${headKey}, and a delegated grant requires two independent clean-room reviews of the exact head ${describeVerdictCorpusSource(committed.source)}`,
             });
         }
         for (const dimension of DECORRELATION_DIMENSIONS) {
+            if (exemptDimensions.has(dimension)) {
+                /* THE ONE NARROWED DIMENSION (DR-0038, M4-P11). `continue` skips the
+                   DISTINCTNESS requirement only, and it is reached only after both
+                   falsifiers passed, which means every committed verdict has already
+                   been read and found to carry the one declared family. So this is not
+                   a dimension that stopped being looked at: it is one that was looked
+                   at against a different rule. The two dimensions below are untouched,
+                   which is what stops the exception relaxing the whole check. */
+                continue;
+            }
             /* SITE ONE, THE ONE CR-001 REPORTS. ABSENCE IS ITS OWN VERDICT AND IT IS A
                FAIL, and the choice was deliberate rather than inherited.
       
@@ -3207,16 +4550,376 @@ export const dualReviewDecorrelation = {
                 });
             }
         }
+        /* THE REPORT NAMES THE DIMENSIONS ACTUALLY COMPARED, never the constant.
+           Printing the full triple while one of its members was exempt is the
+           sentence DR-0038 exists to stop being written: "distinct on produced-by"
+           about a pair that was not required to be. */
+        const compared = DECORRELATION_DIMENSIONS.filter((dimension) => !exemptDimensions.has(dimension));
+        return {
+            violations,
+            reports: violations.length > 0
+                ? /* THE EXCEPTION IS PRINTED EVEN ON A RED, because the owner's whole
+                     requirement is that nobody can hide it. A red run whose reader
+                     cannot see that produced-by was exempt is one where the exception
+                     is invisible exactly when the record is being read most closely. */
+                    [...exceptionReports]
+                : [
+                    ...exceptionReports,
+                    `REPORT dual-review-decorrelation ${String(group.length)} verdict(s) for phase ${phase} at head ${headKey} are distinct on ${compared.join(", ")}${producedByCaveat(compared)}`,
+                ],
+        };
+    },
+};
+/* ------------------------------------------------------------------ */
+/* verdict-pair-approves (M4-P10 step 5, DR-0012 condition 2)           */
+/* ------------------------------------------------------------------ */
+/**
+ * The severities DR-0012 condition 2 bars an APPROVE from sitting beside.
+ *
+ * `low` is absent DELIBERATELY and the record says why:
+ * delivery/decisions/DR-0012-delegated-merge-authority.md:23 permits merging
+ * with a low finding provided it is fixed or tracked with a reason. The same
+ * three words are the escalation enum in `schemas/verdict.schema.json`, and the
+ * two must agree; M4-P10 widened both together, because the shipped pair had
+ * the schema stopping at `high` while the decision said `medium`.
+ */
+export const BLOCKING_SEVERITIES = ["medium", "high", "critical"];
+/**
+ * The whole severity vocabulary, canonicalised, and the reason it exists BESIDE
+ * the blocking list rather than being inferred from it.
+ *
+ * WITHOUT IT, AN UNRECOGNISED SEVERITY IS SILENTLY NON-BLOCKING. `includes` over
+ * the blocking three answers "is this one of the three", and a review ranking a
+ * defect `blocker`, `sev1` or `showstopper` gets `false` from that question and
+ * sails through. The verdict schema forbids those words, and nothing on this
+ * gate's path validates the committed siblings, so the schema is not the guard
+ * here. Under a delegated grant an unrecognised severity has not been shown
+ * non-blocking, and unshown must be refused; the four words are the ones
+ * `schemas/verdict.schema.json` and `schemas/finding.schema.json` share.
+ */
+const SEVERITY_VOCABULARY = ["low", "medium", "high", "critical"];
+/**
+ * The closed verdict vocabulary, exactly as `schemas/verdict.schema.json` spells
+ * it, and the one word in it that authorises a merge.
+ *
+ * WHY THE RAW SPELLING IS CHECKED HERE AND CANONICALISATION IS NOT ENOUGH, which
+ * is the opposite of the rule the decorrelation check follows one screen up and
+ * is opposite for a reason that is worth stating rather than looking like an
+ * inconsistency. THAT check REFUSES when two values are the same, so collapsing
+ * more spellings onto one value produces MORE refusals and is fail-CLOSED. THIS
+ * check APPROVES when a value equals one particular word, so collapsing produces
+ * more APPROVALS and is fail-OPEN: a sibling reading `Approve`, which
+ * `schemas/verdict.schema.json` forbids and which nothing on this path
+ * validates, would canonicalise to `approve` and be read as an authorisation.
+ * The direction of the comparison decides the direction of the collapse.
+ *
+ * So the canonical reading is still used to ESTABLISH that a value is there and
+ * is comparable, and the RAW string then has to be one of the two words.
+ */
+const VERDICT_VOCABULARY = ["APPROVE", "FIX-ROUND-NEEDED"];
+const APPROVING_VERDICT = "APPROVE";
+/**
+ * DR-0012 CONDITION 2, MADE INTO A PREDICATE
+ * (delivery/decisions/DR-0012-delegated-merge-authority.md:23).
+ *
+ * WHAT WAS MISSING, stated as the gap rather than as a feature. Before this
+ * check, `scripts/check-dual-review.mjs` could not see a verdict's VALUE at
+ * all: measured against the whole of that script, `grep -c` returned 0 for
+ * `APPROVE`, 0 for `severity` and 0 for `findings`. So two properly
+ * decorrelated reviews that both REFUSED the merge passed the gate green, and
+ * so did an APPROVE sitting beside a finding the review itself ranked medium.
+ * Condition 1 looked checked and condition 2 was asserted by a human, which is
+ * the worse of the two states because it reads as progress.
+ *
+ * WHY IT IS A SEPARATE CHECK RATHER THAN MORE OF `dual-review-decorrelation`.
+ * They are different predicates over the same set, and section 2.3 rule 3's
+ * Kind B falsification is per-check: DEREGISTERING this one must make a
+ * refusing pair pass, which is only a witness if there is one id to deregister.
+ * Folding condition 2 into the decorrelation check would have made that
+ * witness unavailable and would have made one red indistinguishable from the
+ * other in the gate's output.
+ *
+ * WHY IT EVALUATES THE COMMITTED GROUP AND NEVER THE INSTANCE'S OWN FIELDS,
+ * which is the one place its shape differs from its sibling's. DR-0012
+ * condition 2 is a property of the two reviews WRITTEN TO `delivery/review/`
+ * AND COMMITTED. A document handed to this check that is not among them is not
+ * a review the grant can be satisfied by, and it also cannot break the
+ * predicate: what is asserted is about the committed set, which the stray
+ * document is not a member of. So there is no membership test here, and the
+ * empty case is not a hole: a `(phase, head)` selecting fewer than two
+ * committed verdicts is refused by the pair-size rule below.
+ *
+ * WHAT IT DOES NOT REACH, named rather than left to be found. "Unresolved" is
+ * a state of the review THREAD, and this check reads documents: a finding that
+ * was raised, fixed in a later round and left in the file still reddens here.
+ * That is the fail-closed direction and it is a real cost, paid deliberately,
+ * because the alternative is a resolution field an author sets on their own
+ * finding. Nothing here decides whether a `severity` was ranked honestly
+ * either; a review that calls a critical defect `low` passes, and no keyword
+ * reaches that.
+ */
+export const verdictPairApproves = {
+    id: "verdict-pair-approves",
+    type: "verdict",
+    requiresContext: true,
+    run(instance, contextDirectory) {
+        if (contextDirectory === undefined) {
+            /* Unreachable through `runChecks`, which SKIPS first. Fail closed rather
+               than trusting a caller that reaches the check directly. */
+            return {
+                violations: [{ pointer: "#/verdict", message: "no context directory was supplied" }],
+                reports: [],
+            };
+        }
+        const verdict = asRecord(instance);
+        const phaseReading = establishField(verdict, "phase");
+        if (phaseReading.kind !== "established") {
+            return {
+                violations: [
+                    {
+                        pointer: "#/phase",
+                        message: `the verdict ${unestablishedReason(phaseReading, "phase")}, so the other reviews of the same work cannot be selected`,
+                    },
+                ],
+                reports: [],
+            };
+        }
+        const phaseKey = phaseReading.value;
+        const phase = verdict?.["phase"];
+        const source = resolveCorpusSource(contextDirectory);
+        const regime = establishDelegatedRegime("verdict-pair-approves", contextDirectory, phase, source);
+        if (regime.kind === "report") {
+            return { violations: [], reports: regime.lines };
+        }
+        if (regime.kind === "violation") {
+            return {
+                violations: [{ pointer: regime.pointer, message: regime.message }],
+                reports: [],
+            };
+        }
+        const ownHead = headKeyOf(verdict, "this verdict");
+        if (!ownHead.ok) {
+            return {
+                violations: [{ pointer: "#/head", message: ownHead.message }],
+                reports: [],
+            };
+        }
+        const headKey = ownHead.value;
+        const committed = loadCommittedVerdicts(contextDirectory, source);
+        if (!committed.ok) {
+            return {
+                violations: [{ pointer: "#/verdict", message: committed.reason }],
+                reports: [],
+            };
+        }
+        const grouped = headGroupFor(committed.verdicts, phaseKey, headKey);
+        const group = grouped.members;
+        /* SAME TWO SOURCES AS THE SIBLING CHECK, AND THE REASON IS SHARPER HERE.
+           This predicate says the pair APPROVES, so every document that could not
+           be examined is a document that could have been the refusal. */
+        const violations = [...committed.unexaminable, ...grouped.unkeyed];
+        if (group.length < 2) {
+            violations.push({
+                pointer: "#/verdict",
+                message: `only ${String(group.length)} verdict document(s) exist under ${REVIEW_DIRECTORY} for phase ${phase} at head ${headKey}, and DR-0012 condition 2 is a property of the PAIR, so it cannot be satisfied by fewer than two ${describeVerdictCorpusSource(committed.source)}`,
+            });
+        }
+        for (const candidate of group) {
+            const reading = establishField(candidate.record, "verdict");
+            if (reading.kind !== "established") {
+                violations.push({
+                    pointer: "#/verdict",
+                    message: `${candidate.path} ${unestablishedReason(reading, "verdict")}, so whether this review approves the merge could not be established, and a merge check that cannot read a verdict must not report the pair clean`,
+                });
+            }
+            else {
+                const raw = candidate.record["verdict"];
+                if (!VERDICT_VOCABULARY.includes(raw)) {
+                    violations.push({
+                        pointer: "#/verdict",
+                        message: `${candidate.path} declares verdict ${raw}, which is not one of the two words the closed vocabulary admits (${VERDICT_VOCABULARY.join(", ")}), so it cannot be read as an authorisation however it is spelled`,
+                    });
+                }
+                else if (raw !== APPROVING_VERDICT) {
+                    violations.push({
+                        pointer: "#/verdict",
+                        message: `${candidate.path} reads ${raw} for phase ${phase} at head ${headKey}, so the pair does not approve this head and the delegated grant's condition 2 is not met`,
+                    });
+                }
+            }
+            violations.push(...blockingFindings(candidate, phase, headKey));
+        }
         return {
             violations,
             reports: violations.length > 0
                 ? []
                 : [
-                    `REPORT dual-review-decorrelation ${String(group.length)} verdict(s) for phase ${phase} are distinct on ${DECORRELATION_DIMENSIONS.join(", ")}`,
+                    `REPORT verdict-pair-approves ${String(group.length)} verdict(s) for phase ${phase} at head ${headKey} read APPROVE and carry no finding at ${BLOCKING_SEVERITIES.join(", ")}`,
                 ],
         };
     },
 };
+/**
+ * Every finding in one verdict that DR-0012 condition 2 bars a merge over.
+ *
+ * SEPARATE FROM THE CHECK BODY because the shapes it has to refuse are the
+ * interesting part and they are easy to lose in a loop. `findings` that is not
+ * a list, an entry that is not a map, and a `severity` that cannot be
+ * established are all REFUSALS rather than skips, for the reason the whole of
+ * this section follows: a value that has not been established is not a value
+ * that has been shown safe, and under a grant unshown must be refused.
+ */
+function blockingFindings(candidate, phase, headKey) {
+    const raw = candidate.record["findings"];
+    if (raw === undefined) {
+        return [
+            {
+                pointer: "#/findings",
+                message: `${candidate.path} declares no findings, so whether it carries a blocking one could not be established for phase ${phase} at head ${headKey}`,
+            },
+        ];
+    }
+    if (!Array.isArray(raw)) {
+        return [
+            {
+                pointer: "#/findings",
+                message: `${candidate.path} declares findings as ${raw === null ? "null" : typeof raw === "object" ? "a map" : `a ${typeof raw}`}, which is not a list of findings, so whether it carries a blocking one could not be established`,
+            },
+        ];
+    }
+    const out = [];
+    for (let index = 0; index < raw.length; index += 1) {
+        const finding = asRecord(raw[index]);
+        if (finding === undefined) {
+            out.push({
+                pointer: `#/findings/${String(index)}`,
+                message: `${candidate.path} finding ${String(index)} is not a map, so its severity could not be established`,
+            });
+            continue;
+        }
+        const severity = establishField(finding, "severity");
+        if (severity.kind !== "established") {
+            out.push({
+                pointer: `#/findings/${String(index)}/severity`,
+                message: `${candidate.path} finding ${String(index)} ${unestablishedReason(severity, "severity")}, so whether it blocks the merge could not be established`,
+            });
+            continue;
+        }
+        const id = establishField(finding, "id");
+        const named = id.kind === "established" ? finding["id"] : `at index ${String(index)}`;
+        if (!SEVERITY_VOCABULARY.includes(severity.value)) {
+            out.push({
+                pointer: `#/findings/${String(index)}/severity`,
+                message: `${candidate.path} ranks finding ${named} ${severity.value}, which is not one of the four severities the kernel's vocabulary admits (${SEVERITY_VOCABULARY.join(", ")}), so whether it blocks the merge could not be established`,
+            });
+            continue;
+        }
+        if (BLOCKING_SEVERITIES.includes(severity.value)) {
+            out.push({
+                pointer: `#/findings/${String(index)}/severity`,
+                message: `${candidate.path} carries finding ${named} at severity ${severity.value} for phase ${phase} at head ${headKey}, and a delegated grant is not satisfied while a review carries an unresolved finding at ${BLOCKING_SEVERITIES.join(", ")}`,
+            });
+        }
+    }
+    return out;
+}
+/* ------------------------------------------------------------------ */
+/* model-resolution-subject-echo (M4-P7 criteria 1, 2 and 7)            */
+/* ------------------------------------------------------------------ */
+/**
+ * THE SUBJECT ECHO AGREES WITH THE RESOLUTION IT SITS BESIDE, THE RECORD WAS
+ * WRITTEN AFTER THE TURN ENDED, AND AN OVERRIDE WAS PERMITTED BEFORE IT WAS
+ * APPLIED.
+ *
+ * All three compare SIBLING FIELDS of one document, so all three are Kind B
+ * and none of them is reachable from a keyword (schemas/README.md's Kind A and
+ * Kind B section, DR-0013 clause 8). The schema next door can require that
+ * `subject`, `turnEnd` and `resolution` are all PRESENT, which is what makes a
+ * launch-time record unrepresentable, and it stops exactly there: it cannot
+ * say that two present values agree.
+ *
+ * WHY THE ECHO MATTERS AT ALL, since a record that echoes itself sounds
+ * circular. It is not the record checking itself against itself. `subject` is
+ * a VERBATIM copy of the launch request the adapter was handed and
+ * `resolution` is what the adapter's resolver actually consumed, and the
+ * hazard is that those two diverge silently: a resolver that read the wrong
+ * role's row produces a perfectly well-formed record whose family token is
+ * then attributed to a task it was never about. That is the misattribution
+ * guard src/gates/schemas/release-record.schema.json:26 exists for, one seam
+ * along, and the kernel-side half of it is in src/model-resolution.ts where
+ * the request is compared against a copy the kernel itself holds.
+ *
+ * THE OVERRIDE DIRECTION IS THE ONE MOST LIKELY TO BE GOT WRONG. M4-P7
+ * criterion 7 wants BOTH directions: a role whose `charter-override` is
+ * `allowed` takes the charter's tier, and a role whose permission is anything
+ * else does not. The second direction is the one a resolver written from the
+ * happy path silently drops, because nothing about it looks like a failure.
+ */
+export const modelResolutionSubjectEcho = {
+    id: "model-resolution-subject-echo",
+    type: "model-resolution",
+    requiresContext: false,
+    run(instance) {
+        const document = asRecord(instance);
+        if (document === undefined) {
+            return EMPTY;
+        }
+        const subject = asRecord(document["subject"]);
+        const resolution = asRecord(document["resolution"]);
+        if (subject === undefined || resolution === undefined) {
+            /* The schema requires both and runs first in `cmdValidate`, so this arm
+               is not reached through the command. It is kept fail-open rather than
+               inventing a second diagnostic for a missing field the schema already
+               names, which would print the same defect twice under two wordings. */
+            return EMPTY;
+        }
+        const violations = [];
+        const echoedRole = subject["role"];
+        const resolvedRole = resolution["role"];
+        if (echoedRole !== resolvedRole) {
+            violations.push({
+                pointer: "#/resolution/role",
+                message: `the resolution is for role ${String(resolvedRole)} and the subject echo says the launch request named role ${String(echoedRole)}, so this record resolves a different subject than it claims`,
+            });
+        }
+        const overrideApplied = resolution["overrideApplied"];
+        const resolvedTier = resolution["tier"];
+        if (overrideApplied === false && resolvedTier !== subject["requestedTier"]) {
+            violations.push({
+                pointer: "#/resolution/tier",
+                message: `no charter override was applied and the resolved tier ${String(resolvedTier)} is not the requested tier ${String(subject["requestedTier"])}, so the tier changed with nothing recorded as having changed it`,
+            });
+        }
+        if (overrideApplied === true) {
+            if (resolvedTier !== resolution["charterTier"]) {
+                violations.push({
+                    pointer: "#/resolution/tier",
+                    message: `a charter override was applied and the resolved tier ${String(resolvedTier)} is not the charter tier ${String(resolution["charterTier"])}, so the record cites a charter it did not follow`,
+                });
+            }
+            const permission = asRecord(resolution["observation"])?.["configPermission"];
+            if (permission !== "allowed") {
+                violations.push({
+                    pointer: "#/resolution/observation/configPermission",
+                    message: `a charter override was applied while the role's charter-override permission was observed to be ${String(permission)}, so the override was taken where the role forbids it`,
+                });
+            }
+        }
+        const writtenAt = document["writtenAt"];
+        const endedAt = asRecord(document["turnEnd"])?.["endedAt"];
+        if (typeof writtenAt === "string" && typeof endedAt === "string") {
+            const written = Date.parse(writtenAt);
+            const ended = Date.parse(endedAt);
+            if (Number.isFinite(written) && Number.isFinite(ended) && written < ended) {
+                violations.push({
+                    pointer: "#/writtenAt",
+                    message: `the record says it was written at ${writtenAt}, before the turn ended at ${endedAt}, so it cannot carry what the turn resolved and is a restatement of the request`,
+                });
+            }
+        }
+        return { violations, reports: [] };
+    },
+};
 /* ------------------------------------------------------------------ */
 /* The registry                                                         */
 /* ------------------------------------------------------------------ */
@@ -3258,6 +4961,14 @@ const registry = [
        id, and `registeredChecks` returns a copy, so this array's position carries
        no meaning any check reads. */
     dualReviewDecorrelation,
+    /* M4-P10 step 5. Appended rather than inserted, for the reason recorded on
+       the M3-P7 block above: `checksFor` filters by declared type and sorts by
+       id, so this array's position carries no meaning any check reads. */
+    verdictPairApproves,
+    /* M4-P7. Appended rather than inserted, for the reason recorded on the
+       M3-P7 block above: `checksFor` filters by declared type and sorts by id,
+       so this array's position carries no meaning any check reads. */
+    modelResolutionSubjectEcho,
 ];
 /** Register a check. Later phases append their own (section 2.3's table). */
 export function registerCheck(check) {