agent-bios 0.12.0 → 0.13.0

package/launch/agent-launch.py

@@ -937,6 +937,19 @@ SEVERITY_NAME_RULE = (
 # forbidding the labels that trigger it, which is why `<`, `-` and `=` stay registrable.
 SEVERITY_ARROW = " => "
 SEVERITY_CLAUSE_MARKER = "; severities "
+# The criterion discipline clause. A CONSTANT, not a slot: the criterion's content is
+# per-review and lives in the packet (which packet_sha256 binds), while the contract is
+# per-launch and golden-pinned — so what renders here is only the discipline, identical
+# for every method and every criterion. Placed BEFORE the severity clause in the row,
+# because the severity clause is parsed as everything after its marker.
+CRITERION_CLAUSE_MARKER = "; criterion "
+CRITERION_CLAUSE = (
+    f"{CRITERION_CLAUSE_MARKER}declared in the packet: compile it with "
+    f"--compile-criterion, prefer a dispatch whose host schema flag probed present "
+    f"(--check-schema-flag), emit receipts under REVIEW_CRITERION_SCHEMA so emission "
+    f"refuses unclassified findings, and fold returned rows against the declared enum "
+    f"without guessing a class"
+)
 # The panel that carries corpus/registration text, and the scrolling body that holds it.
 # Named once so the screen, its CSS, its key bindings and the check that drives them cannot
 # drift apart.
@@ -1127,6 +1140,17 @@ class ReviewMechanism:
 def parse_review_method(method_id: str, raw: Any, context: str) -> ReviewMethod:
     if not isinstance(raw, dict):
         raise LaunchError(f"{context} must be a table")
+    # The method ID is the one authored value core PREFIXES to the rendered row, so the
+    # formatted-body marker checks never see it — a registry key carrying a clause
+    # marker forged a second decodable clause beside core's (criterion round, #1; the
+    # same door round 20 #5 opened for the plan marker, closed there on the whole row).
+    for marker in (SEVERITY_CLAUSE_MARKER, CONTROLS_CLAUSE_MARKER, CRITERION_CLAUSE_MARKER):
+        if marker in method_id:
+            raise LaunchError(
+                f"{context}: the method id contains {marker!r}, which core owns for a "
+                f"rendered clause; an id carrying it would forge a second clause in "
+                f"every row it prefixes"
+            )
     unknown = sorted(set(raw) - METHOD_KEYS)
     if unknown:
         raise LaunchError(f"{context}: unknown method key(s): {', '.join(unknown)}")
@@ -1307,6 +1331,12 @@ def validate_instruction_slots(template: str, context: str) -> set:
             f"{context}: contains {CONTROLS_CLAUSE_MARKER!r}, which core appends from the "
             f"method's declared controls; a second clause would contradict it"
         )
+    if CRITERION_CLAUSE_MARKER in template:
+        raise LaunchError(
+            f"{context}: contains {CRITERION_CLAUSE_MARKER!r}, which core appends when the "
+            f"plan declares a criterion-disciplined review; a second clause would "
+            f"contradict the plan's toggle"
+        )
     refuse_plan_marker(template, context)
     return used
 
@@ -1513,9 +1543,16 @@ def derive_review_mechanism(
     )
 
 
-def render_review_method(method: ReviewMethod, mechanism: ReviewMechanism) -> str:
+def render_review_method(
+    method: ReviewMethod, mechanism: ReviewMechanism, criterion: bool = False
+) -> str:
     """The generic renderer. Every method — shipped or third-party — reaches the
-    contract through this one function, with the exact seat already resolved."""
+    contract through this one function, with the exact seat already resolved.
+
+    `criterion` is the plan's toggle, threaded rather than read from anywhere global:
+    when the preset declares a criterion-disciplined review, core appends the one
+    discipline clause to every row, method-blind, the way the severity translation is
+    appended — an author never writes it and a slot never carries it."""
     binding = mechanism.binding
     slots = {
         "command": mechanism.command or "",
@@ -1561,7 +1598,8 @@ def render_review_method(method: ReviewMethod, mechanism: ReviewMechanism) -> st
     # them as literals, and a perspective label carrying `; controls trials=1` rendered a
     # second controls clause beside core's (round 19, #9). Every substitution passes here.
     for marker, owner in ((CONTROLS_CLAUSE_MARKER, "the method's declared controls"),
-                          (REVIEW_PLAN_MARKER, "the contract's canonical review record")):
+                          (REVIEW_PLAN_MARKER, "the contract's canonical review record"),
+                          (CRITERION_CLAUSE_MARKER, "the plan's criterion discipline")):
         if marker in body:
             raise LaunchError(
                 f"review method {method.method_id!r} renders {marker!r} in its body, which "
@@ -1570,7 +1608,7 @@ def render_review_method(method: ReviewMethod, mechanism: ReviewMechanism) -> st
     rendered = (
         f"{method.method_id}: {body} "
         f"[{mechanism.shape}; {binding.model}/{binding.effort}"
-        f"{controls_clause(method)}{severity_translation(method)}]"
+        f"{controls_clause(method)}{criterion_clause(criterion)}{severity_translation(method)}]"
     )
     # The assembled ROW, after the body. The body check above catches a SLOT value and says
     # so; what it cannot see is the part core itself prefixes — the METHOD ID, a user-chosen
@@ -1623,6 +1661,16 @@ def severity_vocabulary(method: ReviewMethod) -> str:
     return ", ".join(method.severity_emits)
 
 
+def criterion_clause(active: bool) -> str:
+    """The discipline clause, or "" when the plan declares no criterion.
+
+    Core-owned and constant for the reason severity_translation is core-appended: a
+    third-party method carries it without its author remembering to, and the gate can
+    subtract the exact substring. Inside the seat bracket, BEFORE the severity clause,
+    which is parsed as everything after its own marker."""
+    return CRITERION_CLAUSE if active else ""
+
+
 def severity_translation(method: ReviewMethod) -> str:
     """The clause telling the reader how to move this reviewer's severities onto the
     canonical ladder, or "" when it reports on the ladder already.
@@ -1743,7 +1791,8 @@ def independence_grade(reviewer: ReviewBinding, main: ReviewBinding) -> str:
 
 
 def _resolve_one(
-    method: ReviewMethod, binding: ReviewBinding, main: ReviewBinding, config: dict[str, Any]
+    method: ReviewMethod, binding: ReviewBinding, main: ReviewBinding,
+    config: dict[str, Any], criterion: bool = False,
 ) -> ReviewMethodReport:
     """One method against the main seat. An optional method is NEVER silently rebound
     to a different seat: if its mechanism cannot be derived it is dropped, and the
@@ -1823,7 +1872,7 @@ def _resolve_one(
     return ReviewMethodReport(
         method.method_id, status, grade, "; ".join(notes),
         binding.model, binding.effort, binding.provider, mechanism.adapter,
-        render_review_method(method, mechanism), method_controls(method),
+        render_review_method(method, mechanism, criterion), method_controls(method),
         tuple(mechanism.evidence),
     )
 
@@ -1844,7 +1893,7 @@ def best_review_grade(rows) -> str:
 
 def resolve_composable_review(
     review: ReviewPlan, main: ReviewBinding, config: dict[str, Any],
-    methods: dict[str, ReviewMethod],
+    methods: dict[str, ReviewMethod], criterion: bool = False,
 ) -> ReviewReport:
     """Base panel plus the method map, each graded against the main seat.
 
@@ -1858,7 +1907,7 @@ def resolve_composable_review(
     if panel is None:
         raise LaunchError(f"the {PANEL_METHOD} method is required and is not registered")
     base_binding = review.base_binding or main
-    base = _resolve_one(panel, base_binding, main, config)
+    base = _resolve_one(panel, base_binding, main, config, criterion)
     # Authored-but-unsatisfiable is a fallback too, not just an undeliverable mechanism.
     # Without this the §1 rule below was unreachable for the commonest case — a preset
     # naming a provider the profile has no host for never got here at all, because the
@@ -1866,7 +1915,7 @@ def resolve_composable_review(
     fell_back = review.base_unseated is not None
     if base.status == STATUS_DROPPED and review.base_binding is not None:
         # Try the same floor on the main's own seat before giving up on review.
-        base = _resolve_one(panel, main, main, config)
+        base = _resolve_one(panel, main, main, config, criterion)
         fell_back = True
     if fell_back and base.status != STATUS_DROPPED:
         detail = (
@@ -1905,7 +1954,7 @@ def resolve_composable_review(
                 if unseated
                 else "no binding: the method names no verifier seat"))
             continue
-        rows.append(_resolve_one(method, binding, main, config))
+        rows.append(_resolve_one(method, binding, main, config, criterion))
     return ReviewReport(base, tuple(rows), best_review_grade((base, *rows)))
 
 
@@ -2375,6 +2424,12 @@ RECEIPT_KEYS = frozenset({
     "provider", "model", "effort", "exit_status", "passes", "ordering_seed", "swap_group",
     # What the tool reported back, keyed by the field names its offer declared.
     "evidence",
+    # The digest of the compiled criterion schema the emission validated this result
+    # against — present ONLY on a schema-route dispatch (REVIEW_CRITERION_SCHEMA was
+    # set), read by --verify-receipts, which recompiles the packet's criterion and
+    # refuses a mismatch. Absent on a prose-route dispatch, which is disclosed, never
+    # refused: host schema capability is per-machine and not retroactively provable.
+    "criterion_schema_sha256",
 })
 # The BUNDLE's grammar, closed for the reason the receipt's is. The reader took its four
 # anchors and ignored everything else, so a key it does not know rode along unjudged and
@@ -2460,6 +2515,16 @@ def _receipt_structure_reason(receipt: Any) -> str:
             f"records exit_status as {type(status).__name__}, not an integer — a boolean is "
             f"not an exit status, and JSON false is not exit 0"
         )
+    # Form here, in the door the adjudicator AND the fold share, so a folded pair of
+    # matching non-hashes cannot agree its way past the per-receipt check.
+    if "criterion_schema_sha256" in receipt and not is_sha256_hex(
+        receipt["criterion_schema_sha256"]
+    ):
+        return (
+            f"records criterion_schema_sha256={receipt['criterion_schema_sha256']!r}, "
+            f"which is not a SHA-256 hash — nothing was hashed, so no schema validated "
+            f"this result"
+        )
     return ""
 
 
@@ -2496,7 +2561,7 @@ def _raw_receipt_reason(receipt: Any) -> str:
 
 def _receipt_reason(
     receipt: Any, row: "ReviewMethodReport | None", bundle: dict, seen: set,
-    controls: dict, required_evidence: tuple = (),
+    controls: dict, required_evidence: tuple = (), criterion_digest: "str | None" = None,
 ) -> str:
     """Why this receipt cannot be credited, or "" when it can.
 
@@ -2545,6 +2610,22 @@ def _receipt_reason(
         )
     if packet != bundle.get("packet_sha256"):
         return "hashes a different packet than the one the plan declared"
+    # Only when the packet's criterion is in hand: the digest is recompiled from the
+    # packet's own record, so a mismatch means the schema the host was handed was
+    # compiled from some OTHER criterion — a stricter or looser enum than the one this
+    # packet declares. With no packet supplied there is nothing to recompile, and the
+    # rendering says the claim is unbound rather than treating it as proven.
+    if (
+        criterion_digest is not None
+        and "criterion_schema_sha256" in receipt
+        and receipt["criterion_schema_sha256"] != criterion_digest
+    ):
+        return (
+            f"was validated against a schema hashing "
+            f"{receipt['criterion_schema_sha256']}, and recompiling this packet's "
+            f"declared criterion yields {criterion_digest} — the schema enforced was "
+            f"not compiled from the criterion this packet declares"
+        )
     for field in ("provider", "model", "effort"):
         if receipt.get(field) != getattr(row, field):
             return (
@@ -2639,7 +2720,7 @@ def _receipt_reason(
 
 def verify_review_receipts(
     report: ReviewReport, bundle: Any, required_controls: dict[str, dict],
-    required_evidence: dict[str, tuple],
+    required_evidence: dict[str, tuple], criterion_digest: "str | None" = None,
 ) -> tuple[ReviewReport, tuple[ReceiptVerdict, ...]]:
     """Adjudicate a review against its receipts.
 
@@ -2860,6 +2941,7 @@ def verify_review_receipts(
             # The row's own snapshot, never the caller's recomputation — see the drift
             # refusal above.
             row.evidence if row else (),
+            criterion_digest,
         )
         if not reason and isinstance(receipt.get("dispatch_id"), str):
             seen.add(receipt["dispatch_id"])
@@ -2908,7 +2990,8 @@ def verify_review_receipts(
 
 
 def render_receipt_verdicts(
-    report: ReviewReport, verdicts: tuple[ReceiptVerdict, ...], packet_bound: bool = False
+    report: ReviewReport, verdicts: tuple[ReceiptVerdict, ...],
+    packet_bound: bool = False, criterion_note: str = "",
 ) -> str:
     # Coverage is printed as a count, not only as a word: `partial` tells a reader the set
     # was incomplete and `1/3` tells them how incomplete, which is the difference between
@@ -2952,6 +3035,10 @@ def render_receipt_verdicts(
         "  grade_derivation=claimed — the plan does not serialize the main seat, so a row's "
         "independence grade is the launch's own claim and is not recomputed here"
     )
+    if criterion_note:
+        # Empty on every non-criterion adjudication, so the rendering is byte-identical
+        # to today's whenever the plan declared no discipline.
+        lines.append(criterion_note)
     for verdict in verdicts:
         state = "ACHIEVED" if verdict.accepted else "PROPOSED"
         lines.append(
@@ -2962,6 +3049,426 @@ def render_receipt_verdicts(
     return "\n".join(lines)
 
 
+# ── criterion discipline (defect-criterion stage 6) ─────────────────────────
+# The criterion is PER-REVIEW: its content rides the packet, never the contract or the
+# config. What core owns is the deterministic subset — the document grammar, the
+# compiled findings schema, the packet record line, and the findings check that receipt
+# emission runs. Whether a golden is persuasive or a stop condition genuinely reachable
+# stays semantic and is never adjudicated here.
+CRITERION_RECORD_SCHEMA = "ReviewCriterion/v1"
+CRITERION_RECORD_MARKER = f"{CRITERION_RECORD_SCHEMA}: "
+# The guide's eight fields plus the two the machine subset needs named apart: the enum
+# and its one stop-relevant member. Closed, and every key required — the guide's own
+# rule is that an empty cell makes a hunch, not a criterion.
+CRITERION_KEYS = frozenset({
+    "name", "observer", "defect", "classes", "stop_class", "evidence",
+    "non_defects", "stop_condition", "misclassification_cost", "goldens",
+})
+CRITERION_GOLDEN_KEYS = frozenset({"kind", "case", "why", "date", "provenance"})
+CRITERION_GOLDEN_KINDS = ("positive", "negative", "boundary")
+# The guide's admission bar: ≥2 positive, ≥2 negative, ≥1 boundary.
+CRITERION_GOLDEN_MINIMUMS = {"positive": 2, "negative": 2, "boundary": 1}
+CRITERION_PROVENANCE = frozenset({"measured", "constructed"})
+
+
+def _utf8_encodable(value: str) -> bool:
+    """False for a string no UTF-8 artifact can carry — a JSON escape can smuggle a
+    lone surrogate through json.loads, and every encode after it crashes."""
+    try:
+        value.encode("utf-8")
+    except UnicodeEncodeError:
+        return False
+    return True
+
+
+def validate_criterion(document: Any, context: str) -> None:
+    """Refuse a criterion document that fails the DECIDABLE subset of the guide schema,
+    by field name. Nothing downstream receives a half-criterion: there is no fallback
+    to "no criterion" and no default for any cell."""
+    if not isinstance(document, dict):
+        raise LaunchError(f"{context} must be a JSON object")
+    # The whole document must be UTF-8-encodable BEFORE any field check: JSON escapes
+    # admit lone surrogates that json.loads accepts and every later encode —
+    # the canonical record line, the compiled schema bytes — crashes on with a
+    # traceback instead of a named refusal (criterion round 2, #0).
+    try:
+        json.dumps(document, ensure_ascii=False).encode("utf-8")
+    except UnicodeEncodeError as exc:
+        raise LaunchError(
+            f"{context} is not UTF-8-encodable ({exc}); a lone surrogate cannot ride "
+            f"the record line or the compiled schema"
+        ) from exc
+    missing = sorted(CRITERION_KEYS - set(document))
+    if missing:
+        raise LaunchError(
+            f"{context} is missing {', '.join(missing)}; an empty cell makes a hunch, "
+            f"not a criterion"
+        )
+    unknown = sorted(set(document) - CRITERION_KEYS)
+    if unknown:
+        raise LaunchError(f"{context} carries unknown key(s): {', '.join(unknown)}")
+    for field in ("name", "observer", "defect", "evidence", "stop_condition",
+                  "misclassification_cost"):
+        value = document[field]
+        if not isinstance(value, str) or not value.strip():
+            raise LaunchError(f"{context}.{field} must be a non-empty string")
+    classes = document["classes"]
+    if (
+        not isinstance(classes, list) or len(classes) < 2
+        or not all(isinstance(value, str) and value for value in classes)
+    ):
+        raise LaunchError(
+            f"{context}.classes must list at least two non-empty class names — the "
+            f"stop-relevant class and the relief valves that keep it honest"
+        )
+    if len(set(classes)) != len(classes):
+        raise LaunchError(f"{context}.classes repeats a value")
+    for value in classes:
+        if value != value.strip():
+            raise LaunchError(
+                f"{context}.classes[{value!r}] may not carry leading or trailing "
+                f"whitespace, which no reader can see"
+            )
+    stop = document["stop_class"]
+    if not isinstance(stop, str) or stop not in classes:
+        raise LaunchError(
+            f"{context}.stop_class must name exactly one member of classes; "
+            f"got {stop!r}"
+        )
+    non_defects = document["non_defects"]
+    if (
+        not isinstance(non_defects, list) or not non_defects
+        or not all(isinstance(value, str) and value.strip() for value in non_defects)
+    ):
+        raise LaunchError(
+            f"{context}.non_defects must be a non-empty list of the defect-lookalikes "
+            f"this criterion excludes"
+        )
+    goldens = document["goldens"]
+    if not isinstance(goldens, list):
+        raise LaunchError(f"{context}.goldens must be a list")
+    counts = {kind: 0 for kind in CRITERION_GOLDEN_KINDS}
+    for index, golden in enumerate(goldens):
+        slot = f"{context}.goldens[{index}]"
+        if not isinstance(golden, dict):
+            raise LaunchError(f"{slot} must be an object")
+        missing = sorted(CRITERION_GOLDEN_KEYS - set(golden))
+        if missing:
+            raise LaunchError(f"{slot} is missing {', '.join(missing)}")
+        unknown = sorted(set(golden) - CRITERION_GOLDEN_KEYS)
+        if unknown:
+            raise LaunchError(f"{slot} carries unknown key(s): {', '.join(unknown)}")
+        kind = golden["kind"]
+        if kind not in CRITERION_GOLDEN_KINDS:
+            raise LaunchError(
+                f"{slot}.kind must be one of {', '.join(CRITERION_GOLDEN_KINDS)}; "
+                f"got {kind!r}"
+            )
+        for field in ("case", "why"):
+            if not isinstance(golden[field], str) or not golden[field].strip():
+                raise LaunchError(f"{slot}.{field} must be a non-empty string")
+        date = golden["date"]
+        if not isinstance(date, str):
+            raise LaunchError(f"{slot}.date must be a string")
+        try:
+            datetime.date.fromisoformat(date)
+        except ValueError as exc:
+            raise LaunchError(f"{slot}.date must be an ISO date: {exc}") from exc
+        if golden["provenance"] not in CRITERION_PROVENANCE:
+            raise LaunchError(
+                f"{slot}.provenance must be measured or constructed; "
+                f"got {golden['provenance']!r}"
+            )
+        counts[kind] += 1
+    short = [
+        f"{kind} {counts[kind]}/{minimum}"
+        for kind, minimum in CRITERION_GOLDEN_MINIMUMS.items()
+        if counts[kind] < minimum
+    ]
+    if short:
+        raise LaunchError(
+            f"{context}.goldens falls short of the admission bar ({', '.join(short)}); "
+            f"the bar is never weakened to admit an entry"
+        )
+
+
+def criterion_schema(classes: list) -> dict:
+    """The compiled findings schema — a pure function of the enum, which is what makes
+    `--verify-receipts` able to recompile it from the packet's record and compare
+    digests. Both object levels reject unknown fields; `findings` may be empty."""
+    return {
+        "type": "object",
+        "additionalProperties": False,
+        "required": ["findings"],
+        "properties": {
+            "findings": {
+                "type": "array",
+                "items": {
+                    "type": "object",
+                    "additionalProperties": False,
+                    "required": ["class", "finding"],
+                    "properties": {
+                        "class": {"enum": list(classes)},
+                        "finding": {"type": "string", "minLength": 1},
+                    },
+                },
+            },
+        },
+    }
+
+
+def criterion_schema_bytes(document: dict) -> bytes:
+    """Canonical bytes for the compiled schema: sorted keys, no whitespace, one
+    trailing newline. Byte-identical on every compile of the same document — proven by
+    the double-compile control — because the receipt digest is compared against a
+    recompilation."""
+    schema = criterion_schema(document["classes"])
+    return (
+        json.dumps(schema, ensure_ascii=False, sort_keys=True, separators=(",", ":"))
+        + "\n"
+    ).encode("utf-8")
+
+
+def criterion_record_line(document: dict) -> str:
+    """The one line the packet carries: the canonical serialization of the document
+    behind the record marker, the same shape the ReviewPlan/v1 record rides in."""
+    return CRITERION_RECORD_MARKER + json.dumps(
+        document, ensure_ascii=False, sort_keys=True, separators=(",", ":")
+    )
+
+
+def extract_criterion(text: str, context: str) -> dict:
+    """The criterion the packet declares, from its record line — exactly one.
+
+    Zero records is a refusal rather than None on purpose: this is only called when
+    the plan's rows carry the discipline clause, and a launch that declared the
+    discipline cannot verify without the criterion."""
+    # LINE-anchored, because the packet is free text: an unanchored find took a prose
+    # mention — "for example, ReviewCriterion/v1: {...}" mid-sentence — as the declared
+    # record (criterion round, #5). The record is a line the compiler printed: marker at
+    # line start, one JSON value, nothing else before the newline.
+    starts = []
+    index = text.find(CRITERION_RECORD_MARKER)
+    while index >= 0:
+        if index == 0 or text[index - 1] == "\n":
+            starts.append(index)
+        index = text.find(CRITERION_RECORD_MARKER, index + 1)
+    if not starts:
+        raise LaunchError(
+            f"{context} carries no {CRITERION_RECORD_SCHEMA} record line, so the "
+            f"criterion the plan's discipline clause declares is nowhere in the bytes "
+            f"the reviewers consumed"
+        )
+    if len(starts) > 1:
+        raise LaunchError(
+            f"{context} carries more than one {CRITERION_RECORD_SCHEMA} record; a mixed "
+            f"packet is split into one packet per criterion, so exactly one is the claim "
+            f"this can adjudicate"
+        )
+    start = starts[0] + len(CRITERION_RECORD_MARKER)
+    try:
+        document, consumed = json.JSONDecoder().raw_decode(text[start:])
+    except json.JSONDecodeError as exc:
+        raise LaunchError(
+            f"{context} carries a {CRITERION_RECORD_SCHEMA} record that does not parse: "
+            f"{exc}"
+        ) from exc
+    trailing = text[start + consumed:].split("\n", 1)[0]
+    if trailing.strip():
+        raise LaunchError(
+            f"{context} carries a {CRITERION_RECORD_SCHEMA} record line with trailing "
+            f"content ({trailing.strip()[:40]!r}); the record is the whole line, so "
+            f"extra text on it is a different claim than the compiler printed"
+        )
+    validate_criterion(document, f"{context}'s {CRITERION_RECORD_SCHEMA} record")
+    return document
+
+
+def criterion_classes_of_schema(schema: Any, context: str) -> list:
+    """The enum a compiled schema file carries — accepted only when the whole schema
+    equals what compiling that enum produces, so a hand-edited or foreign schema is
+    refused rather than partially read."""
+    try:
+        classes = schema["properties"]["findings"]["items"]["properties"]["class"]["enum"]
+    except (TypeError, KeyError):
+        raise LaunchError(
+            f"{context} is not a compiled criterion schema; compile one with "
+            f"--compile-criterion"
+        ) from None
+    # Self-consistency alone lets the schema supply its own authority: an exact
+    # criterion_schema(['anything']) equals recompiling its own enum although the
+    # compiler can never produce it — validate_criterion refuses every one-class
+    # document (criterion round, #2). The enum must also be one the compiler admits.
+    if (
+        not isinstance(classes, list) or len(classes) < 2
+        or len(set(classes)) != len(classes)
+        or not all(
+            isinstance(value, str) and value and value == value.strip()
+            and _utf8_encodable(value)
+            for value in classes
+        )
+    ):
+        raise LaunchError(
+            f"{context} carries an enum --compile-criterion can never produce (fewer "
+            f"than two classes, or a duplicate, empty, whitespace-padded, or "
+            f"non-UTF-8-encodable name); it was not written by the compiler — "
+            f"recompile rather than editing the artifact"
+        )
+    if schema != criterion_schema(classes):
+        raise LaunchError(
+            f"{context} differs from what compiling its own enum produces, so it was "
+            f"not written by --compile-criterion; recompile rather than editing the "
+            f"artifact"
+        )
+    return list(classes)
+
+
+def findings_violations(result: Any, classes: list) -> list:
+    """Why this result is not a findings record under the declared enum — every
+    violation named, empty when it conforms. Deterministic and total: no salvage, no
+    guessed class, no partial admission."""
+    violations = []
+    if not isinstance(result, dict):
+        return [f"the result is {type(result).__name__}, not an object"]
+    unknown = sorted(set(result) - {"findings"})
+    if unknown:
+        violations.append(f"unknown result key(s): {', '.join(unknown)}")
+    findings = result.get("findings")
+    if not isinstance(findings, list):
+        violations.append("the result carries no findings array")
+        return violations
+    for index, finding in enumerate(findings):
+        slot = f"findings[{index}]"
+        if not isinstance(finding, dict):
+            violations.append(f"{slot} is {type(finding).__name__}, not an object")
+            continue
+        unknown = sorted(set(finding) - {"class", "finding"})
+        if unknown:
+            violations.append(f"{slot} carries unknown key(s): {', '.join(unknown)}")
+        if "class" not in finding:
+            violations.append(f"{slot} carries no class; a row is never admitted unclassified")
+        elif finding["class"] not in classes:
+            violations.append(
+                f"{slot} carries class {finding['class']!r}, which is not in the "
+                f"declared enum ({', '.join(classes)})"
+            )
+        prose = finding.get("finding")
+        if not isinstance(prose, str) or not prose.strip():
+            violations.append(f"{slot}.finding must be a non-empty string")
+    return violations
+
+
+def compile_criterion_command(criterion_file: str, schema_out: str) -> int:
+    """Validate a criterion document and publish its compiled findings schema.
+
+    Prints the packet record line the dispatching agent pastes verbatim, and the
+    digest receipt emission will stamp — so the three artifacts (packet record,
+    schema file, receipt digest) cannot drift from one authoring."""
+    path = pathlib.Path(criterion_file).expanduser()
+    try:
+        document = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, UnicodeDecodeError, json.JSONDecodeError) as exc:
+        raise LaunchError(f"cannot read criterion document {path}: {exc}") from exc
+    validate_criterion(document, str(path))
+    payload = criterion_schema_bytes(document)
+    target = pathlib.Path(schema_out).expanduser()
+    try:
+        target.parent.mkdir(parents=True, exist_ok=True)
+        publish_atomically(target, payload)
+    except OSError as exc:
+        raise LaunchError(f"cannot write compiled schema into {target}: {exc}") from exc
+    print(criterion_record_line(document))
+    print(f"criterion_schema_sha256={hashlib.sha256(payload).hexdigest()} {target}")
+    return 0
+
+
+def check_findings_command(result_file: str, schema_file: str) -> int:
+    """The structural accepting channel, standalone: refuse a findings result that
+    fails the compiled schema, each violation by name. The same check runs inside
+    --emit-receipt when REVIEW_CRITERION_SCHEMA is set, so bypassing this one only
+    forfeits the receipt."""
+    schema_path = pathlib.Path(schema_file).expanduser()
+    try:
+        schema = json.loads(schema_path.read_text(encoding="utf-8"))
+    except (OSError, UnicodeDecodeError, json.JSONDecodeError) as exc:
+        raise LaunchError(f"cannot read compiled schema {schema_path}: {exc}") from exc
+    classes = criterion_classes_of_schema(schema, str(schema_path))
+    result_path = pathlib.Path(result_file).expanduser()
+    try:
+        result = json.loads(result_path.read_text(encoding="utf-8"))
+    except (OSError, UnicodeDecodeError) as exc:
+        raise LaunchError(f"cannot read result {result_path}: {exc}") from exc
+    except json.JSONDecodeError as exc:
+        print(f"REFUSED: {result_path} is not JSON, so no finding in it carries a class: {exc}")
+        return 1
+    violations = findings_violations(result, classes)
+    if violations:
+        for violation in violations:
+            print(f"REFUSED: {violation}")
+        return 1
+    count = len(result["findings"])
+    print(f"OK: {count} finding{'s' if count != 1 else ''} conform to the declared enum")
+    return 0
+
+
+# The host CLIs' structured-output flags, and how each registers them. A TABLE plus a
+# PROBE rather than an offer key: a declared capability is documentation, and the rule
+# is probe-over-docs — the flag either appears in the installed binary's registered
+# options or the route renders prose discipline.
+HOST_SCHEMA_FLAGS = {
+    "codex": (("exec", "--help"), "--output-schema"),
+    "claude": (("--help",), "--json-schema"),
+}
+SCHEMA_FLAG_ABSENT_EXIT = 4
+
+
+def check_schema_flag_command(host: str, config_path: pathlib.Path) -> int:
+    """Probe the resolved backend binary for its structured-output flag.
+
+    Exit 0 when the flag is registered, SCHEMA_FLAG_ABSENT_EXIT when the binary runs
+    and does not register it — absence is a finding, not an error — and a LaunchError
+    when nothing could be probed at all."""
+    if host not in HOST_SCHEMA_FLAGS:
+        raise LaunchError(
+            f"no schema flag is known for host {host!r}; known hosts: "
+            f"{', '.join(sorted(HOST_SCHEMA_FLAGS))}"
+        )
+    config = load_config(config_path)
+    command = config.get("backends", {}).get(host, {}).get("command")
+    if not isinstance(command, str) or not command:
+        raise LaunchError(f"config names no backend command for host {host!r}")
+    help_args, flag = HOST_SCHEMA_FLAGS[host]
+    try:
+        probe = subprocess.run(
+            [command, *help_args], capture_output=True, text=True, timeout=60,
+        )
+    except (OSError, subprocess.TimeoutExpired) as exc:
+        raise LaunchError(f"cannot probe {command!r} for {flag}: {exc}") from exc
+    # A failed help run proves nothing about the flag — and its ERROR text can carry
+    # the very token being searched for ("error: unknown option --output-schema"), so
+    # scanning it reported present on the known-opposite input (criterion round, #7).
+    if probe.returncode != 0:
+        detail = (probe.stderr or probe.stdout).strip()[:160]
+        raise LaunchError(
+            f"cannot probe {command!r} for {flag}: help exited {probe.returncode}"
+            + (f" ({detail})" if detail else "")
+            + " — presence cannot be read from a failed probe"
+        )
+    text = (probe.stdout + probe.stderr).replace(",", " ")
+    registered = any(
+        token == flag or token.startswith(f"{flag}=")
+        for token in text.split()
+    )
+    if registered:
+        print(f"schema flag {flag} for host {host}: present ({command})")
+        return 0
+    print(
+        f"schema flag {flag} for host {host}: absent ({command} registers no such "
+        f"option; dispatch this route as prose discipline)"
+    )
+    return SCHEMA_FLAG_ABSENT_EXIT
+
+
 # ── receipt production (the adapter side of the same contract) ──────────────
 # Everything above adjudicates receipts; nothing produced one. That gap is the whole
 # defect: the only party able to write a receipt was whoever ran the review, so the
@@ -2983,6 +3490,12 @@ RECEIPT_METHOD_ENV = "REVIEW_METHOD_ID"
 # multi-pass method, and a third-party one gets them right by not participating.
 RECEIPT_SEED_ENV = "REVIEW_ORDERING_SEED"
 RECEIPT_SWAP_ENV = "REVIEW_SWAP_GROUP"
+# The compiled criterion schema for THIS dispatch, set by the dispatch wrapper only
+# when it passed the schema to the host. Set, emission validates the result against it
+# and refuses to write a receipt for a class-less or out-of-enum finding — so the only
+# path to a receipt IS the structural accepting channel, and a bypassed check is an
+# unproven dispatch. Unset — every prose route — emission behaves exactly as today.
+RECEIPT_CRITERION_ENV = "REVIEW_CRITERION_SCHEMA"
 # The probe adjudicates a one-row plan, and every plan's one required row is the base
 # panel wearing its reserved id (`_review_identity_reason`). It had a name of its own —
 # `adapter-conformance-probe` — which made the probe the only plan in the system whose
@@ -3021,9 +3534,10 @@ def _sha256_file(path: str) -> str:
     return digest.hexdigest()
 
 
-def publish_atomically(target: pathlib.Path, text: str) -> None:
-    """Write `text` at `target` so a reader sees the old file or the complete new one, and
-    a failure leaves neither a partial file nor a temporary.
+def publish_atomically(target: pathlib.Path, payload: str | bytes,
+                       mode: int | None = None) -> None:
+    """Write `payload` at `target` so a reader sees the old file or the complete new one,
+    and a failure leaves neither a partial file nor a temporary.
 
     `write_text` creates the FINAL name and then fills it, so a concurrent reader — and
     the receipt fold globs exactly its directory — could observe a truncated record, and a
@@ -3036,10 +3550,17 @@ def publish_atomically(target: pathlib.Path, text: str) -> None:
     the preset save wrote its temporary and published it with no `try`, so an `os.replace`
     that failed left a complete temporary file beside the untouched preset file, for the
     next save's glob or the next reader to find (spec round 2, #6). The removal never
-    masks the error that caused it."""
+    masks the error that caused it. The registration wizard was the third copy, with
+    neither the boundary nor the cleanup (writable-scratch round, #6) — it publishes
+    BYTES it snapshotted and re-applies the file's prior mode, hence the two optionals."""
     temporary = target.with_name(f".{target.name}.{os.getpid()}.tmp")
     try:
-        temporary.write_text(text, encoding="utf-8")
+        if isinstance(payload, bytes):
+            temporary.write_bytes(payload)
+        else:
+            temporary.write_text(payload, encoding="utf-8")
+        if mode is not None:
+            temporary.chmod(mode)
         os.replace(temporary, target)
     except BaseException:
         try:
@@ -3075,18 +3596,79 @@ def emit_receipt_command(
         if not key or not separator:
             raise LaunchError(f"--evidence takes key=value, got {item!r}")
         fields[key] = value
+    # Present-but-empty is a configuration error, never a silent prose downgrade: an
+    # exported empty value made the whole validation vacuous while the caller believed
+    # it armed (criterion round, #3 — the empty-variable class the corpus already
+    # names for shell checks).
+    criterion_env = os.environ.get(RECEIPT_CRITERION_ENV)
+    if criterion_env is not None and not criterion_env.strip():
+        raise LaunchError(
+            f"{RECEIPT_CRITERION_ENV} is set but empty; unset it for a prose-route "
+            f"dispatch or point it at a compiled schema"
+        )
+    # Only a SUCCESSFUL dispatch is validated and stamped: a failed dispatch's receipt
+    # records the failure and is already refused credit for exit != 0, and refusing to
+    # write it would erase the failure record — while stamping it would claim a
+    # validation that never ran.
+    criterion_schema_path = criterion_env if status == 0 else None
+    # ONE byte snapshot each for the schema and the result: validating one read and
+    # hashing a second let the digest bind bytes the validation never saw — the same
+    # false PASS whether the swap is a race or an adversary (criterion round, #4).
+    criterion_digest = None
+    result_bytes = None
+    if criterion_schema_path:
+        schema_file = pathlib.Path(criterion_schema_path).expanduser()
+        try:
+            schema_bytes = schema_file.read_bytes()
+        except OSError as exc:
+            raise LaunchError(
+                f"{RECEIPT_CRITERION_ENV} names {schema_file}, which is not a readable "
+                f"compiled schema: {exc}"
+            ) from exc
+        try:
+            schema = json.loads(schema_bytes)
+        except (UnicodeDecodeError, json.JSONDecodeError) as exc:
+            raise LaunchError(
+                f"{RECEIPT_CRITERION_ENV} names {schema_file}, which is not a readable "
+                f"compiled schema: {exc}"
+            ) from exc
+        classes = criterion_classes_of_schema(schema, str(schema_file))
+        try:
+            result_bytes = pathlib.Path(result_file).expanduser().read_bytes()
+        except OSError as exc:
+            raise LaunchError(f"cannot read result {result_file}: {exc}") from exc
+        try:
+            result = json.loads(result_bytes)
+        except (UnicodeDecodeError, json.JSONDecodeError) as exc:
+            raise LaunchError(
+                f"no receipt: the result is not JSON, so no finding in it carries a "
+                f"class from the declared enum ({exc})"
+            ) from exc
+        violations = findings_violations(result, classes)
+        if violations:
+            raise LaunchError(
+                "no receipt: " + "; ".join(violations) + " — a result the schema "
+                "refuses is not published, and runtime never guesses a class"
+            )
+        criterion_digest = hashlib.sha256(schema_bytes).hexdigest()
     dispatch_id = uuid.uuid4().hex
     receipt = {
         "schema": RECEIPT_SCHEMA,
         "method_id": method_id,
         "dispatch_id": dispatch_id,
         "packet_sha256": _sha256_file(packet_file),
-        "result_sha256": _sha256_file(result_file),
+        # The bytes the validation saw, when it ran; the file, when it did not.
+        "result_sha256": (
+            hashlib.sha256(result_bytes).hexdigest()
+            if result_bytes is not None else _sha256_file(result_file)
+        ),
         "provider": provider,
         "model": model,
         "effort": effort,
         "exit_status": status,
     }
+    if criterion_digest:
+        receipt["criterion_schema_sha256"] = criterion_digest
     if fields:
         receipt["evidence"] = fields
     for key, name in (("ordering_seed", RECEIPT_SEED_ENV), ("swap_group", RECEIPT_SWAP_ENV)):
@@ -3214,7 +3796,12 @@ def _merge_method_passes(method_id: str, group: list[dict], main_dispatch_id: st
     # `passes`, and for a lone receipt it is naturally the one-element set. Round 4 made
     # the multi-pass record faithful and this is the same sentence applied to the twin
     # F1 already names: asked of EACH receipt, singleton included.
-    for field_name in ("provider", "model", "effort", "packet_sha256"):
+    for field_name in (
+        "provider", "model", "effort", "packet_sha256", "criterion_schema_sha256",
+    ):
+        # criterion_schema_sha256 included with PRESENCE counted as a value: passes
+        # validated against different schemas — or one validated and one not — ran
+        # under different criteria and cannot be one method's passes.
         values = {json.dumps(receipt.get(field_name), sort_keys=True) for receipt in group}
         if len(values) > 1:
             raise LaunchError(
@@ -3578,7 +4165,8 @@ def routed_preset_names(presets: dict[str, Any]) -> set[str]:
     """
     return {
         name for name, preset in presets.items()
-        if isinstance(preset, dict) and ("mission" in preset or "trigger" in preset)
+        if isinstance(preset, dict)
+        and ("mission" in preset or "trigger" in preset or "criterion" in preset)
     }
 
 
@@ -4519,7 +5107,7 @@ def host_models(config: dict[str, Any], host: str, tiers: dict[str, Any]) -> lis
 
 def resolve_review_for_plan(
     review: ReviewPlan, config: dict[str, Any], host: str, main_model: str,
-    main_effort: str, context: str,
+    main_effort: str, context: str, criterion: bool = False,
 ) -> tuple[dict, "ReviewReport | None"]:
     """(method registry, resolved report) for a review against the main seat.
 
@@ -4527,6 +5115,16 @@ def resolve_review_for_plan(
     what a fresh launch would; two copies of this would let the Custom hub show a report
     the next launch disagrees with."""
     if review.source != "composable":
+        if criterion:
+            # The clause renders only through composable review rows, so on a legacy
+            # plan the toggle is accepted and then does nothing — a false success the
+            # operator reads as discipline in force (criterion round, #0).
+            raise LaunchError(
+                f"{context} declares criterion = true, but its review uses the legacy "
+                f"schema; the discipline clause renders only through composable review "
+                f"rows, so the toggle would be silently inert — author a composable "
+                f"[review] block or drop the toggle"
+            )
         return {}, None
     provider = config["hosts"][host].get("provider")
     if not isinstance(provider, str) or not provider:
@@ -4536,7 +5134,7 @@ def resolve_review_for_plan(
         )
     methods = load_review_methods(config)
     main_seat = ReviewBinding(provider, host, main_model, main_effort)
-    return methods, resolve_composable_review(review, main_seat, config, methods)
+    return methods, resolve_composable_review(review, main_seat, config, methods, criterion)
 
 
 def effective_review_family(
@@ -4578,6 +5176,7 @@ def apply_review_plan(plan: dict[str, Any], config: dict[str, Any], review: Revi
     methods, report = resolve_review_for_plan(
         review, config, plan["host"], plan["tiers"][plan["main_tier"]]["model"],
         tier_effort(plan, plan["main_tier"]), f"custom.{plan['preset']}",
+        plan.get("criterion", False),
     )
     plan["review_plan"] = review
     # Editing on one host replaces that host's arm and leaves the others exactly as
@@ -4792,8 +5391,18 @@ def build_plan(config: dict[str, Any], host: str, preset_name: str) -> dict[str,
     # isolated mechanism is an invalid launch, and that has to fail while the plan is
     # being built rather than halfway through printing a contract.
     main_effort = frontier_effort if main_tier == "frontier" else tiers[main_tier]["effort"]
+    # The criterion-discipline toggle. A BOOLEAN, deliberately: the criterion itself is
+    # per-review and rides the packet, which packet_sha256 binds — a preset carrying its
+    # content would put per-review text into the per-launch contract the golden pins.
+    criterion = preset.get("criterion", False)
+    if not isinstance(criterion, bool):
+        raise LaunchError(
+            f"presets.{preset_name}.criterion must be a boolean toggle; the criterion "
+            f"itself is declared in the review packet, never in the preset"
+        )
     review_methods, review_report = resolve_review_for_plan(
-        review, config, host, tiers[main_tier]["model"], main_effort, f"presets.{preset_name}"
+        review, config, host, tiers[main_tier]["model"], main_effort,
+        f"presets.{preset_name}", criterion,
     )
     codex_policy = preset.get("codex_execution_policy")
     claude_policy = preset.get("claude_permission_mode")
@@ -4886,6 +5495,7 @@ def build_plan(config: dict[str, Any], host: str, preset_name: str) -> dict[str,
         },
         "mission": mission,
         "trigger": trigger,
+        "criterion": criterion,
     }
 
 
@@ -5303,32 +5913,39 @@ def _trial_registration(
     through the genuine load_config — same merge order, same validation, same
     collision refusal. Returns None on acceptance, the reader's message on refusal."""
     trial = pathlib.Path(tempfile.mkdtemp(prefix="agent-launch-register-"))
-    shutil.copy(config_path, trial / config_path.name)
-    for sibling in (USER_PRESETS_NAME, USER_LAUNCHER_NAME):
-        source = config_path.with_name(sibling)
-        if source.is_file():
-            shutil.copy(source, trial / sibling)
-    methods_source = user_methods_path(config_path)
-    existing = methods_source.read_text(encoding="utf-8") if methods_source.is_file() else USER_METHODS_HEADER
-    candidate = trial / USER_METHODS_NAME
-    try:
-        candidate.write_text(existing + block, encoding="utf-8")
-    except OSError as exc:
-        # A read-only config dir or a full disk lost every answer the
-        # user had just typed. Reported like any other refusal instead.
-        raise LaunchError(f"cannot write {candidate}: {exc}") from exc
-    candidate.chmod(0o600)
+    # One finally over EVERYTHING after the mkdtemp — the copies, the candidate
+    # write, both readers: the trial is a scratch workspace, and every exit used
+    # to leave it behind, one directory per attempt, for the life of the temp
+    # area (writable-scratch round, #7).
     try:
-        trial_config = load_config(trial / config_path.name)
-        # The REAL pipeline is both readers, not the first one. load_config accepts a
-        # method whose instructions name a slot core does not provide; load_review_methods
-        # — the reader every launch actually goes through — refuses it. Trialling only the
-        # first wrote the block, told the user it was live, and left the refusal for the
-        # next launch. A trial that does not run the reader that decides is not a trial.
-        load_review_methods(trial_config)
-    except LaunchError as exc:
-        return str(exc)
-    return None
+        shutil.copy(config_path, trial / config_path.name)
+        for sibling in (USER_PRESETS_NAME, USER_LAUNCHER_NAME):
+            source = config_path.with_name(sibling)
+            if source.is_file():
+                shutil.copy(source, trial / sibling)
+        methods_source = user_methods_path(config_path)
+        existing = methods_source.read_text(encoding="utf-8") if methods_source.is_file() else USER_METHODS_HEADER
+        candidate = trial / USER_METHODS_NAME
+        try:
+            candidate.write_text(existing + block, encoding="utf-8")
+        except OSError as exc:
+            # A read-only config dir or a full disk lost every answer the
+            # user had just typed. Reported like any other refusal instead.
+            raise LaunchError(f"cannot write {candidate}: {exc}") from exc
+        candidate.chmod(0o600)
+        try:
+            trial_config = load_config(trial / config_path.name)
+            # The REAL pipeline is both readers, not the first one. load_config accepts a
+            # method whose instructions name a slot core does not provide; load_review_methods
+            # — the reader every launch actually goes through — refuses it. Trialling only the
+            # first wrote the block, told the user it was live, and left the refusal for the
+            # next launch. A trial that does not run the reader that decides is not a trial.
+            load_review_methods(trial_config)
+        except LaunchError as exc:
+            return str(exc)
+        return None
+    finally:
+        shutil.rmtree(trial, ignore_errors=True)
 
 
 def register_reviewer_wizard(
@@ -5550,60 +6167,67 @@ def register_reviewer_wizard(
                                  back_hint=t("corpus.back.hint"))
                     return False
                 mode = (write_target.stat().st_mode & 0o777) if existed else 0o600
-                temporary = write_target.with_name(
-                    f".{write_target.name}.{os.getpid()}.tmp"
-                )
-                temporary.write_bytes(before + block.encode())
-                temporary.chmod(mode)
-                os.replace(temporary, write_target)
-                # Unreachable while the trial is the real pipeline — and
-                # load-bearing exactly when it is not: a post-write failure must
-                # restore the pre-write state (bytes, mode, or ABSENCE) and say
-                # so, never leave a corrupt registry behind a green screen.
                 try:
-                    fresh = load_config(config_path)
-                except LaunchError:
-                    fresh = None
-                if fresh is None or answers["id"] not in load_review_methods(fresh):
-                    # Restore ONLY when the file still holds exactly our write:
-                    # unconditional rollback would destroy an edit that landed in
-                    # the meantime; if the bytes moved, the human owns the merge.
-                    current = (
-                        write_target.read_bytes() if write_target.is_file() else b""
-                    )
-                    if current != before + block.encode():
-                        # Its own sentence, because this branch deliberately does NOT
-                        # roll back — someone else's edit landed and the human owns the
-                        # merge. Sharing the restore branch's message told the user the
-                        # file had been restored in the one case where it was left
-                        # exactly as the other writer wrote it.
-                        _corpus_info(
-                            ui, t("wizard.title"), [t("wizard.postwrite.raced.line")],
-                            back_hint=t("corpus.back.hint"),
-                        )
-                        return False
-                    if existed:
-                        restore = write_target.with_name(
-                            f".{write_target.name}.{os.getpid()}.restore"
+                    # The shared primitive owns the temporary's lifecycle: on any
+                    # failure it removes its own temp and re-raises. A directory at
+                    # the target, a permission flip, a full disk — each used to
+                    # escape here as a raw OSError, PAST the retained-answer loop,
+                    # with the completed temporary left beside the untouched file.
+                    # Publication failure is a refusal like any other: the reader's
+                    # loop keeps the answers, and the screen shows the OS's words.
+                    publish_atomically(write_target, before + block.encode(), mode)
+                except OSError as exc:
+                    verdict = f"cannot write {write_target}: {exc}"
+                if verdict is None:
+                    # Unreachable while the trial is the real pipeline — and
+                    # load-bearing exactly when it is not: a post-write failure must
+                    # restore the pre-write state (bytes, mode, or ABSENCE) and say
+                    # so, never leave a corrupt registry behind a green screen.
+                    try:
+                        fresh = load_config(config_path)
+                    except LaunchError:
+                        fresh = None
+                    if fresh is None or answers["id"] not in load_review_methods(fresh):
+                        # Restore ONLY when the file still holds exactly our write:
+                        # unconditional rollback would destroy an edit that landed in
+                        # the meantime; if the bytes moved, the human owns the merge.
+                        current = (
+                            write_target.read_bytes() if write_target.is_file() else b""
                         )
-                        restore.write_bytes(before)
-                        restore.chmod(mode)
-                        os.replace(restore, write_target)
-                    else:
-                        write_target.unlink(missing_ok=True)
-                    _corpus_info(ui, t("wizard.title"), [t("wizard.postwrite.line")],
-                                 back_hint=t("corpus.back.hint"))
-                    return False  # pre-write state restored above
-            config.clear()
-            config.update(fresh)
-            registry.clear()
-            registry.update(load_review_methods(config))
-            _corpus_info(
-                ui, t("wizard.title"),
-                [t("wizard.done.line").format(method_id=answers["id"])],
-                back_hint=t("corpus.back.hint"),
-            )
-            return True
+                        if current != before + block.encode():
+                            # Its own sentence, because this branch deliberately does NOT
+                            # roll back — someone else's edit landed and the human owns the
+                            # merge. Sharing the restore branch's message told the user the
+                            # file had been restored in the one case where it was left
+                            # exactly as the other writer wrote it.
+                            _corpus_info(
+                                ui, t("wizard.title"), [t("wizard.postwrite.raced.line")],
+                                back_hint=t("corpus.back.hint"),
+                            )
+                            return False
+                        if existed:
+                            restore = write_target.with_name(
+                                f".{write_target.name}.{os.getpid()}.restore"
+                            )
+                            restore.write_bytes(before)
+                            restore.chmod(mode)
+                            os.replace(restore, write_target)
+                        else:
+                            write_target.unlink(missing_ok=True)
+                        _corpus_info(ui, t("wizard.title"), [t("wizard.postwrite.line")],
+                                     back_hint=t("corpus.back.hint"))
+                        return False  # pre-write state restored above
+            if verdict is None:
+                config.clear()
+                config.update(fresh)
+                registry.clear()
+                registry.update(load_review_methods(config))
+                _corpus_info(
+                    ui, t("wizard.title"),
+                    [t("wizard.done.line").format(method_id=answers["id"])],
+                    back_hint=t("corpus.back.hint"),
+                )
+                return True
         action = choose(
             t("wizard.refused.title"),
             [
@@ -6039,6 +6663,13 @@ def preset_from_plan(
         "codex_execution_policy": plan["codex_execution_policy"],
         "claude_permission_mode": plan["claude_permission_mode"],
     }
+    if plan.get("criterion"):
+        # Save As from a criterion-toggled plan silently dropped the discipline: the
+        # routed-name guard covers same-name shadowing, not a fresh name, and the
+        # reload defaulted the absent field to false while Save reported success
+        # (criterion round, #8). Written only when true, so every existing saved
+        # preset stays byte-identical.
+        fields["criterion"] = True
     if review_block is None:
         # Carrying both schemas on one preset is a validation error, so the legacy
         # names appear only when there is no authored block to write.
@@ -6140,21 +6771,25 @@ def preset_from_plan(
                     f"is not an effort — saving would drop it and {other} would reload at "
                     f"its host default. Fix that entry in the launch profile and save again."
                 )
+            # A non-table where the normalized home would go — `tier_overrides.<host>` or
+            # its `frontier` entry authored as a value. The serializer now carries such a
+            # value VERBATIM (spec round 7, #3), so this normalizer cannot write into it
+            # (`setdefault("frontier", {})` on a string was round 24, #8's raw TypeError)
+            # and cannot skip past it either: skipping used to be safe only because the
+            # renderer refused the block, and with that refusal gone a skip would drop
+            # the authored `frontier_effort` in silence. When the authored effort is that
+            # host's default there is nothing to write and the carry is faithful; when it
+            # is not, the home is genuinely occupied and the save refuses naming both —
+            # the one case D-20260817-105da4 keeps a named refusal for.
             block = scoped.get(other)
+            occupied = None
+            existing = None
             if block is not None and not isinstance(block, dict):
-                # Left exactly as authored; the serializer names it rather than this
-                # silently repairing a shape it is not the owner of.
-                continue
-            existing = (block or {}).get("frontier")
-            if existing is not None and not isinstance(existing, dict):
-                # Left exactly as authored, for the reason the host-block branch above says
-                # in the same words: the serializer owns unwritable shapes and names them.
-                # This normalizer wrote into the block regardless, so `setdefault("frontier",
-                # {})` handed back the STRING and `["effort"] =` left Save as a raw
-                # TypeError — past the named boundary its workhorse twin arrives through
-                # (round 24, #8). Nothing is dropped by skipping: the renderer's `_table`
-                # door refuses this very entry by name a moment later.
-                continue
+                occupied = f"tier_overrides.{other}"
+            else:
+                existing = (block or {}).get("frontier")
+                if existing is not None and not isinstance(existing, dict):
+                    occupied = f"tier_overrides.{other}.frontier"
             if isinstance(existing, dict) and existing.get("effort") not in (None, effort):
                 # The contradiction build_plan already refuses, reached from the host that
                 # does not launch it. Named here rather than resolved: picking one of two
@@ -6179,6 +6814,19 @@ def preset_from_plan(
                 .get("frontier", {}).get("effort")
             ):
                 continue
+            if occupied is not None:
+                # AFTER the default elision on purpose, unlike the contradiction above: a
+                # non-table home states no effort to contradict, so a default-valued
+                # authoring writes no line and reloads faithfully. A non-default one has
+                # exactly one home and that home is occupied by a value the save carries
+                # verbatim — writing both is impossible, and dropping either is the
+                # silence S4 forbids.
+                raise LaunchError(
+                    f"preset {name!r}: {other} authors frontier_effort={effort!r}, whose "
+                    f"saved home is tier_overrides.{other}.frontier.effort, and {occupied} "
+                    f"holds a non-table value the save carries verbatim — it cannot write "
+                    f"both. Remove one of them in the launch profile and save again."
+                )
             scoped.setdefault(other, {}).setdefault("frontier", {})["effort"] = effort
     return fields, scoped, review_block
 
@@ -6270,11 +6918,11 @@ def render_preset_block(
     tier_overrides: dict[str, Any],
     review_block: dict[str, Any] | None = None,
 ) -> str:
-    # One door for every table this writes back, hoisted here from inside the review-arm
-    # loop so the tier overrides get the same named boundary. Save failures are contracted
-    # to arrive as LaunchError at the settings hub, and the inactive-host overrides had no
-    # boundary at all: a scalar host block was silently FILTERED OUT before it arrived, and
-    # a scalar tier block reached `.items()` as a raw AttributeError (round 22, #9).
+    # One door for every place only a table can stand — an arm's `methods`, its `base`,
+    # each binding. Save failures are contracted to arrive as LaunchError at the settings
+    # hub, never a raw escape or a silent filter (round 22, #9). The tier overrides and
+    # whole review arms no longer pass through it: a non-table node there is not
+    # malformed, it is a VALUE its parent table spells (spec round 7, #2/#3).
     def _table(value, where):
         if not isinstance(value, dict):
             raise LaunchError(
@@ -6287,51 +6935,58 @@ def render_preset_block(
     lines = [f"[presets.{_toml_key(name)}]"]
     for key, value in fields.items():
         lines.append(f"{key} = {_toml_scalar(value)}")
-    for host, tiers in tier_overrides.items():
-        for tier, override in _table(tiers, f"tier_overrides.{host}").items():
-            # Through the SAME recursive emitter the review arms use. This was a flat loop
-            # over one level, so an inactive override holding a sub-table reached
-            # `_toml_scalar`, which gives a bare table no spelling — a profile the launcher
-            # accepts died at Save with `cannot serialize preset value: {'nested': 1}`,
-            # naming neither the host, the tier, nor the key (spec round 3, #6). Verbatim
-            # carry has no depth limit here for the reason it has none in an arm (round 24,
-            # #7), and the emitter puts every leaf through `_toml_key` — round 24 #10's half
-            # — and every leaf VALUE through `_arm_scalar`, so a genuinely unwritable entry
-            # is refused naming `tier_overrides.<host>.<tier>.<key>` rather than its repr.
-            _emit_arm_table(
-                lines,
-                f"presets.{_toml_key(name)}.tier_overrides"
-                f".{_toml_key(host)}.{_toml_key(tier)}",
-                _table(override, f"tier_overrides.{host}.{tier}"),
-                name, f"tier_overrides.{host}.{tier}",
-            )
+    if tier_overrides:
+        # The whole tree through the SAME recursive emitter the review arms use, from the
+        # `tier_overrides` root down. Verbatim carry has no depth limit (spec round 3, #6;
+        # round 24, #7) and no FLOOR either: a non-table node at any depth —
+        # `tier_overrides.claude = "x"`, or `…codex.workhorse = [1, 2]` — is TOML the
+        # launcher accepts, since only the active host's blocks are validated at load,
+        # and TOML spells it perfectly well as a value in its parent table; refusing it
+        # at Save made an accepted profile unsaveable, which is S4's complement (spec
+        # round 7, #3 — the per-tier loop this replaces held a table door at exactly the
+        # two depths the emitter now writes as values). The active host's blocks arrive
+        # normalized from `preset_from_plan`, so for them this emits the same
+        # `[…tier_overrides.<host>.<tier>]` tables it always did; every leaf key goes
+        # through `_toml_key` and every leaf value through `_arm_scalar`, so a genuinely
+        # unwritable entry is refused naming its full `tier_overrides.…` path.
+        _emit_arm_table(
+            lines, f"presets.{_toml_key(name)}.tier_overrides",
+            tier_overrides, name, "tier_overrides",
+        )
     if review_block is not None:
         # One sub-table per binding, and the method id is quoted: it is a user-chosen
         # name, so a bare key would break on anything a TOML bare key cannot hold.
         # Adding method N therefore appends exactly one table and touches nothing else.
         arms = review_block.get(REVIEW_ARMS_KEY)
+        # A whole arm authored as a VALUE — `hosts.codex = [1, 2]` — is TOML the launcher
+        # accepts, because only the launching arm is parsed, and TOML writes it back as a
+        # value in the parent hosts table; so that is what this does, rather than the
+        # refusal that made an accepted profile unsaveable (spec round 7, #2). Emitted
+        # before the table arms for the reason every emitter here puts scalars first; a
+        # value with no TOML form at all is refused through `_arm_scalar`, naming
+        # `review.hosts.<host>`.
+        value_arms = (
+            {host: arm for host, arm in arms.items() if not isinstance(arm, dict)}
+            if arms else {}
+        )
+        if value_arms:
+            lines.append("")
+            lines.append(f"[presets.{_toml_key(name)}.review.{REVIEW_ARMS_KEY}]")
+            for host in sorted(value_arms, key=_toml_key):
+                lines.append(
+                    f"{_toml_key(host)} = "
+                    f"{_arm_scalar(value_arms[host], name, f'review.{REVIEW_ARMS_KEY}.{host}')}"
+                )
         for prefix, block in (
             sorted((f"review.{REVIEW_ARMS_KEY}.{_toml_key(host)}", arm)
-                   for host, arm in arms.items())
+                   for host, arm in arms.items() if isinstance(arm, dict))
             if arms else [("review", review_block)]
         ):
-            # An untouched arm is written back exactly as authored, and "as authored"
-            # includes shapes this cannot serialize: a scalar where a table belongs made
-            # `"base" in block` a raw TypeError out of Save, after the launch had already
-            # happened. Save failures are contracted to arrive as LaunchError at the
-            # settings hub, so this one does too, naming the arm to look at.
-            if not isinstance(block, dict):
-                raise LaunchError(
-                    f"preset {name!r}: the review arm at {prefix!r} is "
-                    f"{type(block).__name__}, not a table — it cannot be written back. "
-                    f"Fix that entry in the launch profile and save again."
-                )
             # `.get`, because an untouched arm is written back exactly as authored and
             # a raw block need not carry both keys — only the edited arm is re-derived.
-            # The nested shapes get the same door as the arm itself: `base`, `methods` and
-            # each binding are tables or the save names the entry (round 19, #11) — the
-            # outer check above caught a scalar arm and let `.items()` on a scalar
-            # `methods` escape as AttributeError past the same boundary.
+            # The nested shapes each get a door: `base`, `methods` and each binding are
+            # tables or the save names the entry (round 19, #11), which once escaped as
+            # a raw AttributeError from `.items()` on a scalar `methods`.
             methods = _table(block.get("methods", {}), f"{prefix}.methods")
             # Everything else the arm carries. An untouched arm is promised back VERBATIM
             # and this serializer knew exactly two keys, so any other top-level field the
@@ -7799,14 +8454,17 @@ def child_agent_registrations(
     """THE Codex child-registration projection — `(tier, description, config path, config
     content)` per spawnable tier, in the order the backend receives them.
 
-    Pure: it reads the authored templates and derives, it writes nothing. One value, three
-    consumers — `run_contract` states it, `codex_agent_configs` materialises the content at
-    the path, and `project_args` writes the description and that path into argv — for the
-    same reason `review_mcp_servers` is one value: the template a tier resolves to decides
-    BOTH halves of what the backend is handed, and neither reached the contract. Repointing
-    one tier at another tier's template therefore changed the child's description and its
-    config path under a byte-identical contract, which is the one thing the contract's own
-    tail may not be false about (spec round 6, L7).
+    Pure in what it writes — nothing — but not in what it reads: the authored template
+    files and `XDG_CACHE_HOME`. One value, three consumers — `run_contract` states it,
+    `codex_agent_configs` materialises the content at the path, and `project_args` writes
+    the description and that path into argv — for the same reason `review_mcp_servers` is
+    one value: the template a tier resolves to decides BOTH halves of what the backend is
+    handed, and neither reached the contract. Repointing one tier at another tier's
+    template therefore changed the child's description and its config path under a
+    byte-identical contract, which is the one thing the contract's own tail may not be
+    false about (spec round 6, L7). And one CALL: `project_args` computes this once and
+    hands the same list to all three, because a projection that rereads its sources gives
+    each extra call a chance to answer differently (spec round 7, L7).
 
     The path is the config's IDENTITY, not an incidental location: its directory is a
     digest of the whole rendered set, so any edit to any template moves every path — and
@@ -7883,11 +8541,16 @@ def child_agent_registrations(
 
 
 def codex_agent_configs(
-    plan: dict[str, Any], materialize: bool
+    plan: dict[str, Any], materialize: bool,
+    registrations: list[tuple[str, str, pathlib.Path, str]] | None = None,
 ) -> dict[str, tuple[pathlib.Path, str]]:
     """The registration projection, written to disk. Everything decided is decided above;
-    this adds only the bytes and the failure modes writing them has."""
-    registrations = child_agent_registrations(plan)
+    this adds only the bytes and the failure modes writing them has. A caller that also
+    renders the contract passes the projection it rendered, so what is materialised is
+    the value the contract states rather than a second computation of it (spec round 7,
+    L7)."""
+    if registrations is None:
+        registrations = child_agent_registrations(plan)
     cache_root = registrations[0][2].parent
     # Every filesystem error here becomes a LaunchError, because `materialize` is exactly
     # the difference between --dry-run and a real launch: the projection skips these writes
@@ -8063,7 +8726,18 @@ def _cross_review_route(
     return " ".join(parts)
 
 
-def run_contract(plan: dict[str, Any]) -> str:
+def run_contract(
+    plan: dict[str, Any],
+    mcp_registrations: list[tuple[str, str, list[str]]] | None = None,
+    child_registrations: list[tuple[str, str, pathlib.Path, str]] | None = None,
+) -> str:
+    """The launch contract. A caller that also builds argv — `project_args` — passes the
+    MCP and child registration projections it computed, so this text and that argv are
+    generated from ONE call of each producer: the producers reread template files, the
+    environment and PATH, so calling them once per consumer let a mid-launch change put
+    one value here and another in argv under a byte-identical contract (spec round 7,
+    L7). A caller that renders only the contract omits them and the projections are
+    computed here — there is no argv beside the text to diverge from."""
     main_tier = plan["main_tier"]
     inactive = inactive_tiers(plan)
     if plan["delegation"]:
@@ -8152,7 +8826,9 @@ def run_contract(plan: dict[str, Any]) -> str:
     # Rendered from the whole triple, quoted as JSON, because reconciling this against argv
     # is the point: a command or an argument carrying a space would otherwise read as two.
     # Empty on every route that registers nothing, which includes every legacy one.
-    registrations = review_mcp_servers(plan)
+    registrations = (
+        review_mcp_servers(plan) if mcp_registrations is None else mcp_registrations
+    )
     mcp_clause = ""
     if registrations:
         rendered = "; ".join(
@@ -8181,7 +8857,11 @@ def run_contract(plan: dict[str, Any]) -> str:
     if plan["delegation"] and plan["host"] == "codex":
         rendered_children = "; ".join(
             f"{tier} = {json.dumps(description)} at {json.dumps(str(path))}"
-            for tier, description, path, _ in child_agent_registrations(plan)
+            for tier, description, path, _ in (
+                child_agent_registrations(plan)
+                if child_registrations is None
+                else child_registrations
+            )
         )
         child_clause = (
             f"Codex child agent registrations, in the order the backend receives them "
@@ -8340,9 +9020,12 @@ def review_mcp_servers(plan: dict[str, Any]) -> list[tuple[str, str, list[str]]]
 
     THE registration projection, and the only one: `run_contract` states this value and
     both argv builders write it, so the contract and the args cannot describe different
-    servers. It carries the args as well as the name and command because a triple is what
-    each backend receives — leaving them to a constant read at the argv site put a third
-    of the registration outside the value the contract is generated from.
+    servers — and `project_args` computes it ONCE, handing the same list to the contract
+    and to argv, because command resolution rereads PATH and a second call is a second
+    answer (spec round 7, L7). It carries the args as well as the name and command
+    because a triple is what each backend receives — leaving them to a constant read at
+    the argv site put a third of the registration outside the value the contract is
+    generated from.
 
     A rename here is a real change to what runs: the name below becomes the backend's
     `mcp_servers.<name>` namespace, which is how a tool call addresses the server."""
@@ -8565,7 +9248,21 @@ def project_args(plan: dict[str, Any], materialize_agents: bool = True) -> list[
         return []
     main = plan["tiers"][plan["main_tier"]]
     main_effort = tier_effort(plan, plan["main_tier"])
-    contract = run_contract(plan)
+    # Each registration projection is computed ONCE and every consumer below receives the
+    # same value. One producer was not enough: the contract render and the argv builders
+    # each CALLED it, and the producers reread template files, `XDG_CACHE_HOME` and PATH —
+    # so a change landing between the two calls put one value in the contract and another
+    # in argv, under a tail that promises what is described is what runs (spec round 7,
+    # L7). The child projection is computed exactly where both of its consumers live:
+    # codex argv with delegation on, and the contract's child clause, which renders under
+    # the same condition.
+    mcp_registrations = review_mcp_servers(plan)
+    child_registrations = (
+        child_agent_registrations(plan)
+        if plan["delegation"] and host == "codex"
+        else None
+    )
+    contract = run_contract(plan, mcp_registrations, child_registrations)
     if host == "codex":
         args = [
             "--model", main["model"],
@@ -8582,12 +9279,14 @@ def project_args(plan: dict[str, Any], materialize_agents: bool = True) -> list[
             policy_args = ["--sandbox", policy]
         args += policy_args
         if plan["delegation"]:
-            for tier, (path, description) in codex_agent_configs(plan, materialize_agents).items():
+            for tier, (path, description) in codex_agent_configs(
+                plan, materialize_agents, child_registrations
+            ).items():
                 args += [
                     "-c", f"agents.{tier}.description={json.dumps(description)}",
                     "-c", f"agents.{tier}.config_file={json.dumps(str(path))}",
                 ]
-        for name, command, server_args in review_mcp_servers(plan):
+        for name, command, server_args in mcp_registrations:
             args += [
                 "-c", f"mcp_servers.{name}.enabled=true",
                 "-c", f"mcp_servers.{name}.command={json.dumps(command)}",
@@ -8609,7 +9308,7 @@ def project_args(plan: dict[str, Any], materialize_agents: bool = True) -> list[
     else:
         policy_args = ["--permission-mode", policy]
     args += policy_args
-    servers = review_mcp_servers(plan)
+    servers = mcp_registrations
     if servers:
         mcp_config = {
             "mcpServers": {
@@ -8851,6 +9550,28 @@ def parse_args(argv: list[str]) -> argparse.Namespace:
         "--fold-receipts", nargs=3, metavar=("DIR", "PACKET_FILE", "MAIN_DISPATCH_ID"),
         help=f"fold a directory of receipts into one {RECEIPT_BUNDLE_SCHEMA} bundle on stdout",
     )
+    # The criterion side of the same per-review file surface. Compile turns a criterion
+    # document into the canonical findings schema and prints the packet record line;
+    # check-findings is the structural accepting channel standalone; check-schema-flag
+    # probes the installed backend for its structured-output flag, because a declared
+    # capability is docs and the rule is probe-over-docs.
+    parser.add_argument(
+        "--compile-criterion", nargs=2, metavar=("CRITERION_FILE", "SCHEMA_OUT"),
+        help=f"validate a criterion document, write its compiled findings schema, and "
+             f"print the {CRITERION_RECORD_SCHEMA} record line the packet carries",
+    )
+    parser.add_argument(
+        "--check-findings", nargs=2, metavar=("RESULT_FILE", "SCHEMA_FILE"),
+        help="refuse a findings result that fails the compiled criterion schema, each "
+             "violation by name; the same check runs inside --emit-receipt when "
+             f"${RECEIPT_CRITERION_ENV} is set",
+    )
+    parser.add_argument(
+        "--check-schema-flag", metavar="PROBE_HOST",
+        help="probe the resolved backend binary for its structured-output flag; exit 0 "
+             f"when registered, {SCHEMA_FLAG_ABSENT_EXIT} when the binary runs and does "
+             f"not register it",
+    )
     # REMAINDER and not "+": the adapter's own command line carries flags, and "+" stops
     # at the first token starting with a dash — which handed `--model` to the host
     # positional and rejected the run before the adapter was ever dispatched.
@@ -8866,7 +9587,8 @@ def parse_args(argv: list[str]) -> argparse.Namespace:
     args = parser.parse_args(argv)
     hostless = (
         args.verify_receipts or args.emit_receipt or args.fold_receipts
-        or args.check_adapter
+        or args.check_adapter or args.compile_criterion or args.check_findings
+        or args.check_schema_flag
     )
     if args.host is None and not hostless:
         parser.error("the following arguments are required: host")
@@ -8941,9 +9663,25 @@ def verify_receipts_command(
     # under audit. Both halves, because either alone is satisfiable by the wrong thing —
     # a digest agreeing with the anchor says these bytes were hashed, and the plan the
     # bytes carry says WHICH review they were hashed for.
+    # Whether the plan declared the criterion discipline: read from the rows' rendered
+    # instructions, where the launch snapshotted it — a ReviewPlan/v1 field would be a
+    # schema change restating what the instruction already carries.
+    criterion_active = any(
+        CRITERION_CLAUSE_MARKER in row.instruction
+        for row in (report.base, *report.methods)
+        if row.status != STATUS_DROPPED
+    )
+    criterion_digest: "str | None" = None
     if packet_path is not None:
         packet_file = pathlib.Path(packet_path).expanduser()
-        digest = _sha256_file(str(packet_file))
+        # ONE byte snapshot: hashing the path and then reopening it as text let the
+        # equality speak for one file state and the plan/criterion extraction for
+        # another (criterion round, #6 — the emit-side twin is #4).
+        try:
+            packet_bytes = packet_file.read_bytes()
+        except OSError as exc:
+            raise LaunchError(f"cannot read the packet {packet_file}: {exc}") from exc
+        digest = hashlib.sha256(packet_bytes).hexdigest()
         anchor = bundle.get("packet_sha256") if isinstance(bundle, dict) else None
         if digest != anchor:
             raise LaunchError(
@@ -8952,8 +9690,8 @@ def verify_receipts_command(
                 f"these bytes"
             )
         try:
-            packet_text = packet_file.read_text(encoding="utf-8")
-        except (OSError, UnicodeDecodeError) as exc:
+            packet_text = packet_bytes.decode("utf-8")
+        except UnicodeDecodeError as exc:
             raise LaunchError(f"cannot read the packet {packet_file}: {exc}") from exc
         carried = extract_review_plan_v1(packet_text)
         if carried is None:
@@ -8966,6 +9704,16 @@ def verify_receipts_command(
                 f"the supplied packet carries a different {REVIEW_PLAN_SCHEMA} record than "
                 f"{plan_path}; these receipts evidence a review of another plan"
             )
+        if criterion_active:
+            # A plan whose rows carry the discipline clause declared a criterion, and a
+            # packet that omits the record cannot verify: extract_criterion refuses the
+            # absence, the malformed record and the second record each by name. The
+            # digest is a RECOMPILATION from the packet's own bytes — never read off
+            # the receipts, which are the artifacts under audit.
+            document = extract_criterion(packet_text, "the supplied packet")
+            criterion_digest = hashlib.sha256(
+                criterion_schema_bytes(document)
+            ).hexdigest()
     # The offer that SERVES THE ROW'S HOST, selected by `select_capability_offer` — the
     # same function `derive_review_mechanism` seats a method with, rather than a second
     # loop written to the same description. The first offer for the operation was taken
@@ -9020,9 +9768,26 @@ def verify_receipts_command(
             method, capability, row_host
         )["evidence"]
     verified, verdicts = verify_review_receipts(
-        report, bundle, required_controls, required_evidence
+        report, bundle, required_controls, required_evidence, criterion_digest
     )
-    print(render_receipt_verdicts(verified, verdicts, packet_bound=packet_path is not None))
+    if not criterion_active:
+        criterion_note = ""
+    elif criterion_digest is not None:
+        criterion_note = (
+            "  criterion=declared and bound: receipts carrying criterion_schema_sha256 "
+            "were held to the schema recompiled from the packet's record; a receipt "
+            "without it ran prose discipline — steering, not structural enforcement"
+        )
+    else:
+        criterion_note = (
+            "  criterion=declared but UNBOUND: no packet was supplied, so the declared "
+            "criterion was recompiled against nothing and no schema digest above was "
+            "adjudicated"
+        )
+    print(render_receipt_verdicts(
+        verified, verdicts, packet_bound=packet_path is not None,
+        criterion_note=criterion_note,
+    ))
     return 0 if verified.achievement == ACHIEVEMENT_COMPLETE else 1
 
 
@@ -9072,6 +9837,14 @@ def main(argv: list[str]) -> int:
         return emit_receipt_command(*args.emit_receipt, evidence=args.evidence)
     if args.fold_receipts:
         return fold_receipts_command(*args.fold_receipts)
+    if args.compile_criterion:
+        return compile_criterion_command(*args.compile_criterion)
+    if args.check_findings:
+        return check_findings_command(*args.check_findings)
+    if args.check_schema_flag:
+        return check_schema_flag_command(
+            args.check_schema_flag, args.config.expanduser()
+        )
     if args.check_adapter:
         if len(args.check_adapter) < 2:
             raise LaunchError("--check-adapter takes a seat and then the adapter command")