arkaos 4.42.0 → 4.44.0

package/THE-ARKAOS-GUIDE.md

@@ -1,6 +1,6 @@
 # The ArkaOS Guide
 
-> v4.42.0 — 89 agents, 17 departments, 332 skills, 297 commands, 18 ADRs.
+> v4.44.0 — 89 agents, 17 departments, 332 skills, 297 commands, 18 ADRs.
 > One file, everything you need to start. Generated by `scripts/guide_gen.py` — never hand-edited.
 
 ## What it is

package/VERSION

@@ -1 +1 @@
-4.42.0
+4.44.0

package/arka/skills/checkpoint/SKILL.md

@@ -53,7 +53,12 @@ Any work item whose execution would block the user for **> 30 seconds**
 Per the brainstorm (Marta + Tomas):
 
 - **Technical conflicts** between reviewers (e.g. Eduardo + Francisca
-  disagree on a code-style call) → Marta resolves silently.
+  disagree on a code-style call) → Marta resolves ON THE RECORD:
+  evidence decides (reproduce the claim, cite the reproduction), and
+  the resolution lands in her verdict notes. A blocker backed by
+  evidence is fixed or REFUTED with a substantive reason — never
+  dropped silently (constitution `inter-agent-checkpoints` enforcement
+  + `evidence-flow`; the aggregate guard enforces the bar).
 - **Strategic / taste / business-knowledge conflicts** → Marta surfaces
   the disagreement at the next checkpoint: *"Eduardo + Francisca
   discordam em X, eu inclino para A — qual o teu input?"*. The user
@@ -74,8 +79,10 @@ Tens contexto a acrescentar antes de eu arrancar? (Silêncio = procedo.)
   follows by emitting checkpoint markers between agent calls.
 - Does not block the user. The user is free to stay silent (proceed)
   or to send any message (parsed by `parse_user_injection`).
-- Does not bypass the mandatory 13-phase flow. Checkpoints are
-  emitted **inside** the per-todo loop of Phase 11.
+- Does not bypass the mandatory 4-gate evidence flow (the 13-phase
+  flow it referenced was replaced in v4.1.0 — constitution
+  `evidence-flow`). Checkpoints are emitted **inside** Gate 3
+  execution, between sub-dispatches; Gate 4 still runs.
 
 ## Cross-references
 

package/arka/skills/flow/SKILL.md

@@ -142,6 +142,10 @@ resumes at the right gate.
   Time and token cost are not acceptable answers to any of the three.
 - Quality Gate REJECTED loops back at most twice; a third REJECTED
   escalates to the operator with the full verdict.
+- The gate-closing report reproduces each reviewer verdict VERBATIM
+  under `### <Reviewer> — verbatim`, with the ledger artifact path
+  (`~/.arkaos/quality-gate/<session>/`) beside it. Summarising a
+  reviewer in your own words is relay, not report.
 - Close with an honest summary: what changed, where, how it was
   verified (real commands + results), what remains open.
 

package/config/claude-agents/eduardo-copy.md

@@ -55,10 +55,21 @@ DOCUMENTATION-scope prose it is advisory.
 Return a `QGVerdict` JSON object (schema: `QG_VERDICT_JSON_SCHEMA` in
 `core.governance.qg_verdict`): `verdict`, `evidence_report` summary,
 `blockers` [{check, detail, file, verdict}] with exact location and
-correction — `verdict` is claim-level: CONFIRMED (you verified the
+correction — `check` names the evidence check or rubric area (the
+aggregate's coverage matching keys on it; never leave it empty),
+`verdict` is claim-level: CONFIRMED (you verified the
 error on the page/line), PLAUSIBLE (credible, unverified), REFUTED
 (disproven; recorded, never counts toward rejection) —,
-`reviewer: "copy-director-eduardo"`, `model_used`, `notes`.
+`reviewer: "copy-director-eduardo"`, `model_used`, `evidence_digest`
+(the `report_digest` of the report you interpreted — mandatory since
+PR-B4; an artifact without it cannot support an APPROVED aggregate),
+`notes`.
+
+Emit the JSON inside a ```arka-qgverdict fence in your FINAL message —
+the fence is what the hook-boundary ledger captures verbatim. Never
+write triple backticks inside a JSON string — one inside notes cut the
+extractor mid-string (francisca-tech-17); the balanced-JSON cut now
+recovers most such cases, and none of them is worth relying on.
 
 Model tier: single source is constitution `quality_gate.model_policy` —
 Quality Gate reviewers run on the best model available (frontier tier,

package/config/claude-agents/francisca-tech.md

@@ -54,8 +54,18 @@ you did not attempt to reproduce is PLAUSIBLE at best, never CONFIRMED.
 Return a `QGVerdict` JSON object (schema: `QG_VERDICT_JSON_SCHEMA` in
 `core.governance.qg_verdict`): `verdict`, `evidence_report` summary,
 `blockers` [{check, detail, file, verdict}] numbered B1./B2. with line
-references and fix suggestions,
-`reviewer: "tech-director-francisca"`, `model_used`, `notes`.
+references and fix suggestions — `check` names the evidence check or
+rubric area (the aggregate's coverage matching keys on it; never
+leave it empty) —, `reviewer: "tech-director-francisca"`,
+`model_used`, `evidence_digest` (the `report_digest` of the report
+you interpreted — mandatory since PR-B4; an artifact without it
+cannot support an APPROVED aggregate), `notes`.
+
+Emit the JSON inside a ```arka-qgverdict fence in your FINAL message —
+the fence is what the hook-boundary ledger captures verbatim. Never
+write triple backticks inside a JSON string — one inside notes cut the
+extractor mid-string (francisca-tech-17); the balanced-JSON cut now
+recovers most such cases, and none of them is worth relying on.
 
 Model tier: single source is constitution `quality_gate.model_policy` —
 Quality Gate reviewers run on the best model available (frontier tier,

package/config/claude-agents/marta-cqo.md

@@ -26,9 +26,20 @@ evidence report, never from model size.
 1. Run the engine first — no verdict without a report:
    `~/.arkaos/bin/arka-py -m core.governance.evidence_checks <project_dir> [--changed-files ...] [--test-command '...'] --json`
 2. Dispatch Eduardo (spellcheck + changed copy) and Francisca
-   (lint/typecheck/tests/coverage/security-grep) with the report and the
-   structured output schema `QG_VERDICT_JSON_SCHEMA` from
-   `core.governance.qg_verdict`.
+   (lint/typecheck/tests/coverage/security-grep) with the report and,
+   in the prompt, the QGVerdict field names (`QG_VERDICT_JSON_SCHEMA`
+   in `core.governance.qg_verdict` is that contract — the Agent tool
+   has no structured-output parameter). Dispatch shape (PR-B4): the
+   prompt names the FULL field set the reviewer returns — `verdict`,
+   `evidence_report` {overall, checks_ran, checks_failed,
+   checks_skipped}, `blockers` [{`check` (the evidence check name;
+   coverage matching keys on it), `detail`, `file`, `verdict`
+   CONFIRMED/PLAUSIBLE/REFUTED}], `reviewer`, `model_used`,
+   `evidence_digest` (= the report's `report_digest`), `notes`. A
+   dispatch that invents its own field names fail-softs the artifact
+   (16 schema errors on one B2 round); a reviewer artifact without
+   `evidence_digest` cannot support an APPROVED aggregate — the guard
+   refuses it and the reviewer must be re-dispatched.
 3. Aggregate at CLAIM level (Constitution 2.0): every reviewer blocker
    carries `verdict` CONFIRMED / PLAUSIBLE / REFUTED. Only CONFIRMED and
    PLAUSIBLE blockers count toward rejection; REFUTED are recorded for
@@ -39,9 +50,7 @@ evidence report, never from model size.
    - overall == "pass" → APPROVED only if zero CONFIRMED/PLAUSIBLE blockers.
    - overall == "insufficient-evidence" → APPROVED only with explicit
      justification in notes; otherwise REJECTED.
-4. Record the outcome via `core.governance.review_workflow` passing
-   `evidence_overall` — it raises on APPROVED-over-fail by design.
-5. Record the eval label (evals ADR 2026-07-09) as your FINAL act — the
+4. Record the eval label (evals ADR 2026-07-09) as your FINAL act — the
    corpus only grows if the verdict-issuer writes it, and dispatch
    through this agent bypasses the department SKILL's step 6: write your
    final QGVerdict JSON to a temp file and run
@@ -51,11 +60,15 @@ evidence report, never from model size.
    remedy: invalid JSON (fix the JSON and re-run), a missing
    --session-id (pass the session id — the anti-self-approval guard
    reads that session's reviewer ledger), or a guard refusal (the
-   ledger cannot support your aggregate: quorum, digest, blocker
-   coverage, or an APPROVED verdict standing over a rejecting
-   reviewer — read the stderr reasons and fix the REVIEW, not the
-   JSON; if the reason names AGGREGATE.json or the session id, fix
-   that instead). Never skip.
+   ledger cannot support your aggregate: quorum, a missing or
+   mismatched `evidence_digest` without a justified `digest_carries`
+   entry, a session already stamped as ended (digest and session
+   reasons refuse only an APPROVED aggregate — a REJECTED one records
+   with warnings), blocker coverage, or an
+   APPROVED verdict standing over a rejecting reviewer — read the
+   stderr reasons and fix the REVIEW, not the JSON; if the reason
+   names AGGREGATE.json or the session id, fix that instead). Never
+   skip.
    Every review feeds `~/.arkaos/telemetry/qg-verdicts.jsonl`, redo
    verdicts included (a REJECTED→APPROVED pair is two labels).
 
@@ -64,11 +77,25 @@ evidence report, never from model size.
 Return a `QGVerdict` JSON object: `verdict` (APPROVED|REJECTED),
 `evidence_report` {overall, checks_ran, checks_failed, checks_skipped},
 `blockers` [{check, detail, file, verdict}], `reviewer: "cqo-marta"`,
-`model_used`, `notes`. Binary — there is no "approved with caveats".
+`model_used`, `notes`, `evidence_digest` (the `report_digest` of the
+report you aggregated — mandatory since PR-B4) and, when you carry an
+earlier review over a report change, `digest_carries`
+[{reviewer, evidence_digest, reason}] naming the digest THAT reviewer
+actually reviewed and why the review still stands (>= 40 chars).
+Binary — there is no "approved with caveats".
+
+Emit the final JSON inside a ```arka-qgverdict fence in your FINAL
+message — the fence is what the hook-boundary ledger captures, and an
+aggregate that exists only as prose is a relay (the B1 gate closed
+with this fence present by ad-hoc instruction; it is contract now).
+Never write triple backticks inside a JSON string — one inside notes
+cut the extractor mid-string (francisca-tech-17); the balanced-JSON
+cut now recovers most such cases, and none of them is worth relying
+on.
 
 Filled example (the shape you return, not a schema):
 
-```json
+```arka-qgverdict
 {"verdict": "REJECTED",
  "evidence_report": {"overall": "pass", "checks_ran": ["lint","tests"],
                      "checks_failed": [], "checks_skipped": ["coverage"]},
@@ -77,9 +104,32 @@ Filled example (the shape you return, not a schema):
     "detail": "AttributeError on malformed record — docstring claims 'never raises'; reproduced via check_x('bad')",
     "file": "core/governance/x.py:138", "verdict": "CONFIRMED"}],
  "reviewer": "cqo-marta", "model_used": "opus",
+ "evidence_digest": "3f2a3f2a3f2a3f2a3f2a3f2a3f2a3f2a3f2a3f2a3f2a3f2a3f2a3f2a3f2a3f2a",
  "notes": "Engine pass but 1 CONFIRMED blocker, reproduced by my own hand."}
 ```
 
+## Reporting (verbatim, never relay)
+
+The gate-closing report reproduces every reviewer verdict VERBATIM
+under `### <Reviewer> — verbatim`, each with its ledger artifact path
+beside it. Summarising a reviewer in your own words is relay, not
+report — a relay inside a gate is a single point of distortion, and
+it is how a corpus reached 80 aggregator-authored records with zero
+reviewer-signed ones.
+
+## Conflict Handling (no silent resolution)
+
+A reviewer blocker BACKED BY EVIDENCE is never resolved silently: it
+is fixed (and the fix verified by execution), or REFUTED on the
+record with a substantive reason (>= 40 chars — the guard enforces
+the bar), or it blocks. Disagreement between reviewers is settled by
+evidence, not by rank: reproduce the claim, cite the reproduction.
+Only a blocker with no evidence behind it (no repro, no citation) may
+be dropped, and even that drop is recorded in `notes`, never omitted.
+A CONFIRMED blocker is never merely noted: the guard reads
+`blockers`, not `notes` — it is fixed, or REFUTED in `blockers` with
+its reason, or it blocks.
+
 ## Signature Rules (anti-sycophancy)
 
 - Open with "Quality Gate Verdict:" and close with "Final:".

package/config/constitution.yaml

@@ -248,7 +248,7 @@ enforcement_levels:
 
       - id: inter-agent-checkpoints
         rule: "Long-running multi-agent dispatches (estimated >30s) are fragmented into sub-dispatches of 2-3min each. Between sub-dispatches, the orchestrator emits a proactive [arka:checkpoint] prompt announcing the next sub-dispatch and inviting user context injection. The user can inject (continue with addition) or stay silent (proceed)."
-        enforcement: "Orchestrator wraps multi-step work in checkpointed dispatches; reviewer conflicts escalated to user when strategic (taste/business knowledge), resolved silently when purely technical; QG deliberations are visible, not just verdict."
+        enforcement: "Orchestrator wraps multi-step work in checkpointed dispatches; reviewer conflicts escalated to user when strategic (taste/business knowledge), resolved on the record when purely technical (evidence cited in the verdict notes — never silently; the earlier self-contradiction was resolved 2026-07-30 in favour of visibility); QG deliberations are visible, not just verdict."
 
       - id: hybrid-learning
         rule: "ArkaOS learns from user corrections via hybrid mechanism: implicit auto-detection with confidence scoring for typical corrections (default), explicit Marta-led confirmation for high-leverage rules (top-level rule candidates) or rules that contradict existing memory. Marta is the owner of the learning loop. Memory rules carry a confidence field that climbs as the rule is applied without correction."
@@ -492,3 +492,6 @@ amendments:
     - version: "4.12.0"
       date: "2026-07-09"
       changes: "Interaction Reform PR2 (operator-approved plan, 2026-07-09): added gate-judges MUST rule — plan-judge at Gate 2 and output-judge at Gate 4 for MEDIUM/HIGH work, structured JudgeVerdict (core.governance.judge), frontier tier, arkaos-not-yes-man standard applied to agents, user_challenge surfacing for technically wrong requests; verdicts recorded to judge-verdicts.jsonl."
+    - version: "4.43.0"
+      date: "2026-07-30"
+      changes: "PR-B4 (operator-approved repair-campaign plan): inter-agent-checkpoints enforcement text amended — technical reviewer conflicts change from 'resolved silently' to 'resolved on the record' (evidence cited in verdict notes), resolving the self-contradiction with the same enforcement's 'QG deliberations are visible' clause in favour of visibility. Rule text, level and scope unchanged."

package/config/hooks/agent-provision.sh

@@ -2,11 +2,23 @@
 # ArkaOS PreToolUse hook for dynamic agent provisioning.
 # Intercepts Task tool calls: if subagent_type is not present in the
 # project's .claude/agents/, copies it from ArkaOS core when available,
-# or blocks with an approval-request message when the agent must be
-# created via `/platform-arka agent provision <name>`.
+# or surfaces an approval-request message WITHOUT blocking when the
+# agent is unknown. The set of valid subagent_types is not enumerable
+# here — runtime built-ins (general-purpose, statusline-setup, …)
+# change with Claude Code versions and plugins add their own — so any
+# blocking arm on "unknown" breaks legitimate dispatches (QG PR-B5 r1
+# reproduced exit 2 on general-purpose). Provision when we know the
+# name; stand aside when we don't.
 
 set -euo pipefail
 
+# No jq, no payload parse. .claude/rules/bash-hooks.md:11-12 prescribes
+# a python3 fallback for jq; this gate is OPTIONAL by design, so it
+# stands aside instead of paying a python spawn on every Task call —
+# and per the same rules file ("exit code 2 = block action", last
+# bullet), exiting 0 here can never break a dispatch.
+command -v jq >/dev/null 2>&1 || exit 0
+
 # ─── Shared Python resolver (exports ARKA_PY) ──────────────────────────
 # The resolver guards its own ARKA_PY assignment with `|| true`, so sourcing
 # is set -e-safe even on the last-resort fallback. The trailing `|| true`
@@ -49,7 +61,6 @@ if [ -z "$core_root" ]; then
 fi
 
 if [ -d "$core_root/departments" ]; then
-    mkdir -p "$project_agents_dir"
     set +e
     "$ARKA_PY" - "$core_root" "$subagent_type" "$target" <<'PY'
 import os, re, sys
@@ -105,7 +116,10 @@ if md_path is not None:
 
 content = "\n".join(parts) + "\n"
 
-# Atomic write: temp file in same dir, then os.replace.
+# Create the parent only on the arm that actually writes (a dispatch
+# of an unknown name must not scatter empty .claude/agents/ dirs), then
+# atomic write: temp file in same dir, then os.replace.
+target.parent.mkdir(parents=True, exist_ok=True)
 tmp = target.with_suffix(".md.tmp")
 tmp.write_text(content)
 os.replace(tmp, target)
@@ -128,15 +142,22 @@ PY
     esac
 fi
 
-# Agent not in project and not in core — surface an approval-request.
+# Agent not in project, and the core lookup either found nothing or
+# never ran. Say exactly which, and NEVER block: this name may be a
+# runtime built-in or a plugin agent this script cannot know about —
+# if it truly doesn't exist, the Task dispatch itself fails with the
+# runtime's own error.
+if [ -d "$core_root/departments" ]; then
+    core_note="no ArkaOS core agent of that name was found (core searched at: $core_root)"
+else
+    core_note="the ArkaOS core lookup did not run (no departments/ under: ${core_root:-<unset>})"
+fi
 cat >&2 <<MSG
-[arka:provision-needed] Agent '$subagent_type' is not installed in this
-project and does not exist in ArkaOS core. To create it, run:
-
-    /platform-arka agent provision $subagent_type
-
-This opens the Skill Architect flow which drafts the agent YAML with
-4-framework DNA, goes through Quality Gate, and commits to core before
-propagating to the project. Blocking dispatch until the agent exists.
+[arka:provision-needed] Agent '$subagent_type' is not in this project's
+.claude/agents/, and $core_note.
+If ArkaOS should provide this agent, create it at
+.claude/agents/$subagent_type.md, or run 'npx arkaos update' so ArkaOS
+core ships a definition this gate can copy.
+Runtime built-ins and plugin agents are unaffected — dispatch proceeds.
 MSG
-exit 2
+exit 0

package/core/evals/record_cli.py

@@ -8,14 +8,19 @@ flow skill instructions), closing the "labels gratuitos" loop from the
 evals ADR.
 
 ``--kind qg`` is the AGGREGATE path and runs the anti-self-approval
-guard (PR-B3): ``--session-id`` is mandatory and validated, the
-session's reviewer ledger must hold at least two hook-captured
-reviewer verdicts, no evidence_digest present on both sides may
-disagree (an absent digest warns — PR-B4 makes dispatch populate it),
-no CONFIRMED reviewer blocker may disappear silently, and an APPROVED
-aggregate may not stand over a rejecting reviewer. The label records
-ONLY once AGGREGATE.json is verifiably on disk — an
-accepted-but-unwritten aggregate is a refusal, not a success.
+guard (PR-B3, hardened in PR-B4): ``--session-id`` is mandatory and
+validated, the session's reviewer ledger must hold at least two
+hook-captured reviewer verdicts, the digest chain must hold (the
+aggregate and every counted reviewer artifact carry evidence_digest;
+a reviewer's digest that predates the final report needs an explicit
+``digest_carries`` justification), the session must not be stamped
+ended, no CONFIRMED reviewer blocker may disappear silently, and an
+APPROVED aggregate may not stand over a rejecting reviewer.
+Dispatch-shape refusals are verdict-aware: they refuse an APPROVED
+aggregate and demote to warnings on a REJECTED one, so a rejection
+label survives a bad delta. The label records ONLY once
+AGGREGATE.json is verifiably on disk — an accepted-but-unwritten
+aggregate is a refusal, not a success.
 
 ``--kind reviewer`` records an individual reviewer's verdict as a
 label and cross-references the ledger by ``verdict_digest`` — it never

package/core/governance/aggregate_guard.py

@@ -5,12 +5,19 @@ reviewer artifacts behind it — the orchestrator's own words, recorded
 as a completed gate. This guard makes that shape unrecordable AS AN
 AGGREGATE: an aggregate verdict is only recorded when the session's
 reviewer ledger holds at least two HOOK-CAPTURED reviewer verdicts,
-no evidence_digest present on both sides disagrees (dispatch does not
-yet REQUIRE the digest — PR-B4 makes it mandatory; an absent digest
-warns instead of refusing, and when reviewers do populate it, as this
-PR's own r1 artifacts did, the comparison decides), no CONFIRMED
-reviewer blocker disappears silently, and an APPROVED aggregate
-stands over no rejecting reviewer.
+the digest chain holds (PR-B4 dispatch shape: the aggregate and every
+counted reviewer artifact must carry evidence_digest, and each
+reviewer's digest must match the aggregate's — or be excused by an
+explicit, justified ``digest_carries`` entry naming the report that
+reviewer actually reviewed), no CONFIRMED reviewer blocker disappears
+silently, and an APPROVED aggregate stands over no rejecting reviewer.
+
+Severity is verdict-aware (PR-B4): fabrication vectors — quorum, an
+APPROVED over a rejecting reviewer, a vanishing CONFIRMED blocker —
+refuse regardless of verdict; dispatch-shape issues (digest chain,
+session binding) refuse only an APPROVED aggregate and demote to
+warnings on a REJECTED one, so a rejection label survives exactly the
+case where the CQO catches a bad delta.
 
 Only records whose ``source`` is in ``CAPTURE_SOURCES`` count: a
 record the orchestrator could write itself (any other source) would
@@ -27,16 +34,21 @@ home directory and this guard runs in the same trust domain as the
 orchestrator it polices — a determined orchestrator could forge
 records with a file write, either to FABRICATE a quorum or to
 SUPPRESS an existing verdict (a forged newer record supersedes it —
-same capability ceiling, different mechanics). Session ids are
-validated against the ledger's safety rule, but nothing yet binds an
-aggregate to the runtime session that produced the reviews — a past
-session holding two reviewer records is a reusable quorum token
-until PR-B4 binds the dispatch side. And ``--kind reviewer``
-(record_cli) remains an unguarded label path for reviewer
-identities: its ledger cross-reference is provenance, not
-admission. The guard turns ACCIDENTAL self-approval into
-deliberate, transcript-visible forgery; it does not and cannot make
-forgery impossible from inside the same account.
+same capability ceiling, different mechanics). Session binding
+(PR-B4) closes the COMMON reuse path, not every path: the SessionEnd
+hook stamps a session's ledger directory (``.ended``), and an
+APPROVED aggregate citing a stamped session is refused. A session
+that crashes never fires SessionEnd and stays unstamped — and in
+observed practice SessionEnd fires for a minority of sessions, so an
+unstamped ledger proves nothing about liveness. A session still open
+elsewhere is citable from this one, and the stamp itself is a file
+the same account could delete: the binding is evidence from the
+hook boundary, not a cryptographic seal. ``--kind
+reviewer`` (record_cli) likewise remains an unguarded label path for
+reviewer identities: its ledger cross-reference is provenance, not
+admission. The guard turns ACCIDENTAL self-approval into deliberate,
+transcript-visible forgery; it does not and cannot make forgery
+impossible from inside the same account.
 """
 
 from __future__ import annotations
@@ -286,35 +298,157 @@ def _covered(key: frozenset[str], aggregate: dict, approved: bool) -> str:
     return "absent"
 
 
-def _digest_reasons(
+def _carries(aggregate: dict) -> dict[str, dict]:
+    """Declared digest carries, keyed by canonical reviewer identity."""
+    carries: dict[str, dict] = {}
+    for entry in aggregate.get("digest_carries") or []:
+        if isinstance(entry, dict):
+            carries[_identity(str(entry.get("reviewer") or ""))] = entry
+    return carries
+
+
+def _carry_issue(
+    reviewer_id: str, their: str, agg_digest: str, carry: dict | None
+) -> str | None:
+    """Why a digest mismatch is NOT excused by a declared carry.
+
+    None means the carry stands: it names the digest the reviewer's own
+    artifact carries, with a substantive reason. Anything else is the
+    plain mismatch — an undeclared carry, a carry pointing at a digest
+    the reviewer never reviewed, or a bare justification.
+    """
+    if carry is None:
+        return (
+            f"evidence_digest mismatch: {reviewer_id} reviewed "
+            f"{their[:12]}…, aggregate cites {agg_digest[:12]}… — not "
+            "the same evidence report; re-dispatch the reviewer or "
+            "declare a justified digest_carries entry (PR-B4)"
+        )
+    if _norm(carry.get("evidence_digest")) != their:
+        return (
+            f"digest carry for {reviewer_id} names "
+            f"{_norm(carry.get('evidence_digest'))[:12]}… but the "
+            f"reviewer's artifact carries {their[:12]}… — a carry must "
+            "cite the report that reviewer actually reviewed"
+        )
+    if len(_norm(carry.get("reason"))) < _MIN_REFUTE_DETAIL:
+        return (
+            f"digest carry for {reviewer_id} lacks a substantive reason "
+            f"(>= {_MIN_REFUTE_DETAIL} chars — the same bar as a REFUTED "
+            "drop): why does the earlier review still stand?"
+        )
+    return None
+
+
+_MISSING_AGGREGATE_DIGEST = (
+    "aggregate carries no evidence_digest — the dispatch shape (PR-B4) "
+    "requires the aggregator to cite the report it aggregated "
+    "(report_digest from the evidence --json output)"
+)
+_MISSING_REVIEWER_DIGEST = (
+    "{rid} artifact carries no evidence_digest — the dispatch must "
+    "populate it (PR-B4 dispatch shape); re-dispatch that reviewer "
+    "with the report_digest"
+)
+_CARRY_ACCEPTED = (
+    "digest carry accepted: {rid} reviewed {their}… while the "
+    "aggregate cites {agg}… — justification on the record"
+)
+
+
+def _digest_issues(
     aggregate: dict, verdicts: list[tuple[str, dict]]
 ) -> tuple[list[str], list[str]]:
-    """Compare evidence_digest across aggregate and reviewer verdicts."""
-    reasons: list[str] = []
-    warnings: list[str] = []
+    """Dispatch-shape and integrity issues on the digest chain (PR-B4).
+
+    Returns (issues, notes). Issues are verdict-aware at the caller:
+    they refuse an APPROVED aggregate and are demoted to warnings on a
+    REJECTED one. Notes (accepted carries) are always warnings — a
+    carry is legitimate, and legitimate is not invisible.
+    """
+    issues: list[str] = []
+    notes: list[str] = []
     agg_digest = _norm(aggregate.get("evidence_digest"))
     if not agg_digest:
-        warnings.append("aggregate carries no evidence_digest")
-        return reasons, warnings
-    seen_any = False
+        issues.append(_MISSING_AGGREGATE_DIGEST)
+    carries = _carries(aggregate)
     for reviewer_id, verdict in verdicts:
         their = _norm(verdict.get("evidence_digest"))
         if not their:
+            issues.append(_MISSING_REVIEWER_DIGEST.format(rid=reviewer_id))
             continue
-        seen_any = True
-        if their != agg_digest:
-            reasons.append(
-                f"evidence_digest mismatch: {reviewer_id} reviewed "
-                f"{their[:12]}…, aggregate cites {agg_digest[:12]}… — "
-                "not the same evidence report"
-            )
-    if not seen_any:
-        warnings.append(
-            "no reviewer artifact carries evidence_digest (dispatch "
-            "shape — PR-B4 enforces it); digest comparison had nothing "
-            "to bite on"
+        if not agg_digest or their == agg_digest:
+            continue
+        issue = _carry_issue(
+            reviewer_id, their, agg_digest, carries.get(_identity(reviewer_id))
         )
-    return reasons, warnings
+        if issue is not None:
+            issues.append(issue)
+        else:
+            notes.append(_CARRY_ACCEPTED.format(
+                rid=reviewer_id, their=their[:12], agg=agg_digest[:12]
+            ))
+    return issues, notes
+
+
+def _ended_issues(session_id: str, artifact_names: list[str]) -> list[str]:
+    """A stamped session is not a live quorum (PR-B4 session binding).
+
+    M4 hardening (PR-B5): the stamp only outlaws records that PREDATE
+    it. A counted record captured strictly after the stamp's mtime
+    proves the hook boundary came back to life under this session id —
+    never observed on the dev machine, where the stamp shipped one
+    release earlier and the ledger held a single stamped session when
+    this was written; the refusal must not outlive its own evidence.
+    Ties and unreadable mtimes keep the refusal: equality cannot
+    distinguish before from after, and fail-closed is the guard's
+    resting state.
+    """
+    from core.governance.reviewer_ledger import ENDED_NAME
+
+    session_dir = ledger_root() / session_id
+    stamp = session_dir / ENDED_NAME
+    if not stamp.is_file():
+        return []
+    try:
+        newest = max(
+            (session_dir / name).stat().st_mtime for name in artifact_names
+        )
+        if newest > stamp.stat().st_mtime:
+            return []
+    except (OSError, ValueError):
+        pass  # no readable counted record newer than the stamp
+    return [
+        f"session {session_id} is marked ended (SessionEnd stamped its "
+        "ledger) — a past session's reviewer records are not a reusable "
+        "quorum token; run the reviews in the live session"
+    ]
+
+
+def _check_key_warnings(
+    verdicts: list[tuple[str, dict]]
+) -> list[str]:
+    """CONFIRMED blockers filed without a check key — warning only.
+
+    Coverage still matches on detail/file tokens (_blocker_key keeps
+    liveness), but the dispatch shape asks reviewers to name the
+    evidence check so coverage means shared vocabulary, not prose luck.
+    """
+    warnings: list[str] = []
+    for reviewer_id, verdict in verdicts:
+        for blocker in verdict.get("blockers") or []:
+            if not isinstance(blocker, dict):
+                continue
+            if _norm(blocker.get("verdict")) != "confirmed":
+                continue
+            if not _tokens(blocker.get("check")) and _blocker_key(blocker):
+                warnings.append(
+                    f"CONFIRMED blocker ({reviewer_id}) filed without a "
+                    "check key — matched on detail/file tokens; the "
+                    "dispatch shape (PR-B4) asks for the evidence check "
+                    "name in 'check'"
+                )
+    return warnings
 
 
 _COVERAGE_REASONS = {
@@ -455,7 +589,9 @@ def check_aggregate(aggregate: dict, session_id: str) -> GuardResult:
             reviewers, [name for name, _ in counted]
         )
     verdicts = [(str(r.get("reviewer_id")), r["verdict"]) for _, r in counted]
-    reasons, warnings = _reasons(aggregate, verdicts)
+    reasons, warnings = _reasons(
+        aggregate, verdicts, session_id, [name for name, _ in counted]
+    )
     return GuardResult(
         ok=not reasons,
         reasons=reasons,
@@ -466,17 +602,42 @@ def check_aggregate(aggregate: dict, session_id: str) -> GuardResult:
 
 
 def _reasons(
-    aggregate: dict, verdicts: list[tuple[str, dict]]
+    aggregate: dict,
+    verdicts: list[tuple[str, dict]],
+    session_id: str,
+    artifact_names: list[str],
 ) -> tuple[list[str], list[str]]:
-    """Every refusal reason and warning for one aggregate."""
+    """Every refusal reason and warning for one aggregate.
+
+    Two severities, split on the aggregate's own verdict (PR-B4 item 7).
+    Fabrication vectors — an APPROVED standing over a rejecting
+    reviewer, a CONFIRMED blocker vanishing — refuse regardless of
+    verdict. Dispatch-shape issues (digest chain, session binding)
+    refuse only an APPROVED aggregate: refusing a REJECTED one over
+    shape would throw away the rejection label in exactly the case
+    where the CQO catches a bad delta, and a recorded rejection
+    launders nothing — the redo loop continues either way.
+    """
     approved = _norm(aggregate.get("verdict")) == "approved"
-    digest_reasons, warnings = _digest_reasons(aggregate, verdicts)
+    issues, notes = _digest_issues(aggregate, verdicts)
+    issues += _ended_issues(session_id, artifact_names)
     reasons = (
-        digest_reasons
-        + _verdict_reasons(aggregate, verdicts)
+        _verdict_reasons(aggregate, verdicts)
         + _blocker_reasons(aggregate, verdicts, approved)
     )
-    return reasons, warnings + _own_finding_warnings(aggregate, verdicts)
+    warnings = (
+        notes
+        + _check_key_warnings(verdicts)
+        + _own_finding_warnings(aggregate, verdicts)
+    )
+    if approved:
+        return issues + reasons, warnings
+    demoted = [
+        f"{issue} [recorded anyway: the refusal is verdict-aware "
+        "(PR-B4) — a REJECTED label is never lost to dispatch shape]"
+        for issue in issues
+    ]
+    return reasons, demoted + warnings
 
 
 def write_aggregate(