audit-tools 0.50.20 → 0.51.0

package/dist/audit/reporting/synthesis.js

@@ -1,8 +1,12 @@
-import { AUDIT_FINDINGS_CONTRACT_VERSION as SHARED_AUDIT_FINDINGS_CONTRACT_VERSION, AUDITOR_REPORT_MARKER, renderProcessFeedbackSection, renderFindingBlockLines, compareCodeUnits, countBy, } from "audit-tools/shared";
+import { degradedAnalyzerEntries, } from "../types/analyzerCapability.js";
+import { AUDIT_FINDINGS_CONTRACT_VERSION as SHARED_AUDIT_FINDINGS_CONTRACT_VERSION, AUDITOR_REPORT_MARKER, renderProcessFeedbackSection, renderFindingBlockLines, compareCodeUnits, countBy, deriveLensCoverage, isIngestEvent, reprojectLensCoverage, } from "audit-tools/shared";
+import { resolveIntentLensSelection } from "../orchestrator/lensSelection.js";
 import { buildWorkBlockPartition } from "./workBlocks.js";
 import { mergeFindings } from "./mergeFindings.js";
 import { selectCurrentResults } from "../orchestrator/ledger.js";
 import { assignStableFindingIds } from "./findingIdentity.js";
+const CONCEPTUAL_ATTRIBUTION_IDS = Symbol("conceptual-attribution-ids");
+const CONCEPTUAL_ID_MARKER_PREFIX = "\u0000audit-tools:conceptual-final-id:";
 /**
  * Contract version stamped onto the canonical `audit-findings.json`.
  * Single-sourced from `audit-tools/shared` so the auditor's output and the
@@ -10,6 +14,47 @@ import { assignStableFindingIds } from "./findingIdentity.js";
  * `seam-artifact-ipc-envelope` test).
  */
 export const AUDIT_FINDINGS_CONTRACT_VERSION = SHARED_AUDIT_FINDINGS_CONTRACT_VERSION;
+function markConceptualFindingIds(designAssessment) {
+    const conceptualFindings = designAssessment?.conceptual_findings ?? [];
+    if (conceptualFindings.length === 0) {
+        return { designAssessment, findingIdByMarker: new Map() };
+    }
+    const findingIdByMarker = new Map();
+    const markedFindings = conceptualFindings.map((finding, index) => {
+        const marker = `${CONCEPTUAL_ID_MARKER_PREFIX}${index}:${finding.id}\u0000`;
+        findingIdByMarker.set(marker, finding.id);
+        return {
+            ...finding,
+            evidence: [...(finding.evidence ?? []), marker],
+        };
+    });
+    return {
+        designAssessment: { ...designAssessment, conceptual_findings: markedFindings },
+        findingIdByMarker,
+    };
+}
+function extractConceptualAttributionIds(mergedFindings, findingIdByMarker) {
+    if (findingIdByMarker.size === 0)
+        return mergedFindings.map(() => []);
+    let recoveredMarkerCount = 0;
+    const localIdsByFinding = mergedFindings.map((finding) => {
+        const localIds = [];
+        const evidence = (finding.evidence ?? []).filter((entry) => {
+            const localId = findingIdByMarker.get(entry);
+            if (localId === undefined)
+                return true;
+            localIds.push(localId);
+            recoveredMarkerCount += 1;
+            return false;
+        });
+        finding.evidence = evidence;
+        return localIds;
+    });
+    if (recoveredMarkerCount !== findingIdByMarker.size) {
+        throw new Error("Conceptual attribution identity markers were not conserved through finding merge.");
+    }
+    return localIdsByFinding;
+}
 function severityBreakdown(findings) {
     return countBy(findings, (finding) => finding.severity);
 }
@@ -24,6 +69,15 @@ function lensBreakdown(findings) {
 function groundingStatusBreakdown(findings) {
     return countBy(findings, (finding) => finding.grounding?.status);
 }
+/**
+ * Per-status counts of the judge's defect-presence claim. Findings with no
+ * status (every deterministic finding — the conceptual pass is the only
+ * producer) are skipped by `countBy`, so an empty result means "no finding
+ * carried a claim" and the caller omits the field, exactly as for grounding.
+ */
+function verificationStatusBreakdown(findings) {
+    return countBy(findings, (finding) => finding.verification_status);
+}
 function runtimeStatusBreakdown(report, taskManifest) {
     const breakdown = countBy(report?.results ?? [], (result) => result.status);
     const resultTaskIds = new Set((report?.results ?? []).map((result) => result.task_id));
@@ -56,6 +110,7 @@ function formatCountList(summary) {
     return parts.length > 0 ? parts.join(", ") : "none";
 }
 export function buildAuditReportModel(params) {
+    const markedConceptual = markConceptualFindingIds(params.designAssessment);
     // Re-key the finalized findings with globally-unique, content-addressed ids
     // before anything addresses them by id. mergeFindings emits exactly one
     // finding per file-independent identity (exact normalized lens|category|
@@ -69,7 +124,20 @@ export function buildAuditReportModel(params) {
     // before merging, so a re-dispatched result's fresh findings replace the stale
     // base record they superseded — including findings the re-audit dropped, which
     // a finding-id upsert alone would leave behind.
-    const allFindings = assignStableFindingIds(mergeFindings(selectCurrentResults(params.results), params.runtimeValidationReport, params.externalAnalyzerResults, params.designAssessment, params.structureDecomposition, params.charterRegister, params.systemicChallenge));
+    const mergedFindings = mergeFindings(selectCurrentResults(params.results), params.runtimeValidationReport, params.externalAnalyzerResults, markedConceptual.designAssessment, params.structureDecomposition, params.charterRegister, params.systemicChallenge);
+    const conceptualIdsByFinding = extractConceptualAttributionIds(mergedFindings, markedConceptual.findingIdByMarker);
+    const allFindings = assignStableFindingIds(mergedFindings);
+    const conceptualAttributionIds = new Map();
+    for (const [index, localIds] of conceptualIdsByFinding.entries()) {
+        const canonicalId = allFindings[index].id;
+        for (const localId of localIds) {
+            const existing = conceptualAttributionIds.get(localId);
+            if (existing !== undefined && existing !== canonicalId) {
+                throw new Error(`Conceptual finding id "${localId}" resolved to multiple canonical findings.`);
+            }
+            conceptualAttributionIds.set(localId, canonicalId);
+        }
+    }
     // B4: a tool-executable anchor that REFUTED a claim (status `refuted`, distinct
     // from `ungrounded`) is quarantined-EXCLUDED — kept out of the admitted findings
     // AND the work blocks so a disproven claim never merges as actionable fact. The
@@ -87,20 +155,48 @@ export function buildAuditReportModel(params) {
         sizeIndex: params.sizeIndex,
     });
     const coverage = coverageSummary(params.coverageMatrix);
+    // A lens is only `clean` — "asked, and there was nothing there" — when at
+    // least one LENS-OPEN channel came back. Per-file audit results are lens-gated
+    // by planning (`required_lenses`), and the two design-review passes carry the
+    // selection into their prompts and record their own completion. With none of
+    // them ingested, a selected lens with no findings was never exercised, and
+    // saying `clean` would be exactly the "absence of a finding reads as absence
+    // of a defect" claim this field exists to refuse.
+    const lensOpenChannelIngested = params.results.length > 0 ||
+        params.designAssessment?.contract_reviewed === true ||
+        params.designAssessment?.conceptual_reviewed === true;
+    const selectedLenses = resolveIntentLensSelection(params.intentCheckpoint?.lens_selection);
     // Count grounding over ALL findings (incl. quarantined-refuted) so the `refuted`
     // tally reflects findings dropped from the admitted set.
     const groundingBreakdown = groundingStatusBreakdown(allFindings);
+    const verificationBreakdown = verificationStatusBreakdown(allFindings);
     const model = {
         summary: {
             finding_count: findings.length,
             work_block_count: workBlocks.blocks.length,
             severity_breakdown: severityBreakdown(findings),
             lens_breakdown: lensBreakdown(findings),
+            // Presence is guaranteed HERE, at the one boundary that holds both the
+            // operator's selection and the produced findings. Absent — deliberately —
+            // when no selection resolved: "no limit" and "every lens" are different
+            // answers, and inventing a map would be a claim nobody made.
+            ...(selectedLenses === undefined
+                ? {}
+                : {
+                    lens_coverage: deriveLensCoverage({
+                        selectedLenses,
+                        findings,
+                        lensOpenChannelIngested,
+                    }),
+                }),
             audited_file_count: coverage.audited_file_count,
             excluded_file_count: coverage.excluded_file_count,
             ...(Object.keys(groundingBreakdown).length > 0
                 ? { grounding_status_breakdown: groundingBreakdown }
                 : {}),
+            ...(Object.keys(verificationBreakdown).length > 0
+                ? { verification_status_breakdown: verificationBreakdown }
+                : {}),
             runtime_validation_status_breakdown: runtimeStatusBreakdown(params.runtimeValidationReport, params.runtimeValidationTaskManifest),
         },
         findings,
@@ -109,6 +205,9 @@ export function buildAuditReportModel(params) {
         work_block_seams: workBlocks.seams,
         ...(quarantinedRefuted.length > 0 ? { quarantined_findings: quarantinedRefuted } : {}),
     };
+    if (conceptualAttributionIds.size > 0) {
+        model[CONCEPTUAL_ATTRIBUTION_IDS] = conceptualAttributionIds;
+    }
     return model;
 }
 /**
@@ -128,6 +227,10 @@ export function buildAuditFindingsReport(model) {
             ? { quarantined_findings: model.quarantined_findings }
             : {}),
     };
+    const conceptualAttributionIds = model[CONCEPTUAL_ATTRIBUTION_IDS];
+    if (conceptualAttributionIds) {
+        report[CONCEPTUAL_ATTRIBUTION_IDS] = conceptualAttributionIds;
+    }
     return report;
 }
 /**
@@ -182,6 +285,96 @@ export function applyNarrative(report, narrative) {
         top_risks: narrative.top_risks,
     };
 }
+/**
+ * Name the selected lenses this run did not exercise.
+ *
+ * Rendered whenever a selected lens produced no findings, with its outcome, so
+ * `clean` ("asked, nothing found") and `not_run` ("never asked") stay legible as
+ * the different statements they are. Nothing to say — every selected lens
+ * produced findings, or no selection was made — renders nothing.
+ */
+function renderUnexercisedLensLine(coverage) {
+    const unexercised = (coverage ?? []).filter((entry) => entry.selected && entry.outcome !== "findings");
+    if (unexercised.length === 0)
+        return [];
+    const byOutcome = new Map();
+    for (const entry of unexercised) {
+        const bucket = byOutcome.get(entry.outcome);
+        if (bucket)
+            bucket.push(entry.lens);
+        else
+            byOutcome.set(entry.outcome, [entry.lens]);
+    }
+    const parts = [...byOutcome.entries()]
+        .sort(([left], [right]) => compareCodeUnits(left, right))
+        .map(([outcome, lenses]) => `${outcome === "not_run" ? "never exercised" : "exercised, no findings"}: ${lenses.join(", ")}`);
+    return [`- Lenses not exercised: ${parts.join("; ")}`];
+}
+/**
+ * The *Audit Limitations* body for a degraded graph-enrichment channel.
+ *
+ * Names each analyzer that was ASKED FOR and could not run, with its own note —
+ * the honest per-analyzer row that `analyzer_capability.json` has always carried
+ * and that, until now, nothing in the tree ever opened. The scalar roll-up is
+ * deliberately not the sentence: it cannot say "1932 edges added AND two
+ * analyzers degraded", so the entries are listed rather than summarized.
+ */
+function renderAnalyzerDegradationLines(record) {
+    const degraded = degradedAnalyzerEntries(record);
+    if (degraded.length === 0)
+        return [];
+    return [
+        `${degraded.length} language analyzer(s) were requested and could not run, so parser-grade extraction was OFF for them and the weaker deterministic regex floor was used instead. Findings that depend on the dependency graph are correspondingly weaker for these languages:`,
+        "",
+        ...degraded.map((entry) => `- \`${entry.id}\` (requested \`${entry.setting}\`, resolution \`${entry.resolution}\`)` +
+            (entry.note ? ` — ${entry.note}` : "")),
+        "",
+    ];
+}
+/**
+ * What the charter lanes were actually GIVEN, per evidence class.
+ *
+ * This renders UNCONDITIONALLY, deliberately diverging from the drift section
+ * above where clean is the expected case and presence is the statement. Here the
+ * measured case was 0 of 72 source-comment blocks delivered while the register
+ * and the report said nothing at all — so a silent section would leave
+ * "complete" indistinguishable from "not measured", which is the exact
+ * false-green this block exists to close. A run with no charter layer says so.
+ */
+function renderCharterCoverageSection(coverage, archive) {
+    // Its OWN top-level section, not a sub-head of "Process Feedback": coverage is
+    // a delivery measurement about the tool's inputs, not feedback about the host —
+    // and nesting it there would force that heading to render on every report,
+    // silently inverting the drift section's "presence is the statement" contract.
+    const lines = ["## Evidence Coverage", "", "### Charter evidence coverage", ""];
+    if (coverage.length === 0) {
+        lines.push("No charter evidence packets were measured in this run (the charter layer " +
+            "is opt-in at a `deep` ceiling). This is a stated absence, not a clean bill.", "");
+    }
+    for (const packet of coverage) {
+        lines.push(`- \`${packet.kind}\` channel:`);
+        for (const entry of packet.classes) {
+            const truncated = entry.truncated > 0 ? `, ${entry.truncated} truncated` : "";
+            lines.push(`  - ${entry.evidence_class}: ${entry.delivered} of ${entry.named} delivered${truncated}` +
+                (entry.omitted.length > 0
+                    ? ` — omitted: ${entry.omitted
+                        .map((row) => `${row.path} (${row.reason})`)
+                        .join(", ")}`
+                    : ""));
+        }
+    }
+    const unarchived = archive.filter((row) => !row.archived);
+    if (unarchived.length > 0) {
+        lines.push("", "⚠ Packet retention FAILED for " +
+            unarchived
+                .map((row) => `\`${row.kind}\` (${row.reason ?? "unstated reason"})`)
+                .join(", ") +
+            ". The lane-asset copy was left in place rather than deleted, so the " +
+            "evidence still exists — but it is not in the run's archive.");
+    }
+    lines.push("");
+    return lines;
+}
 /**
  * What happened to this run's submissions, when something went wrong.
  *
@@ -199,6 +392,71 @@ export function applyNarrative(report, narrative) {
  * ambiguity. Totals are sorted by content, never arrival: a derived summary may
  * sort; the ledger file it derives from may not.
  */
+/**
+ * What this run actually DISPATCHED, and how much of it came back.
+ *
+ * The drift section below renders only when something was refused, so a run in
+ * which five lanes silently under-delivered — exit 0, nothing written, then
+ * re-dispatched until they succeeded — produced zero `rejected` events and read
+ * as clean. This is the other half: dispatched versus delivered, per round, so
+ * a lane that reported success and wrote nothing is a printed fact rather than
+ * something recoverable only from the host's transcript.
+ *
+ * A dispatch is DELIVERED when its submission has any terminal record other
+ * than a `lane_outcome` of `not_run`: an ingest event (the tool consumed it) or
+ * an observed outcome. No terminal row at all is `not_run` too — the absence IS
+ * the record, never an inference that something arrived.
+ */
+function renderLaneDeliverySection(events) {
+    const dispatched = events.filter((event) => event.kind === "dispatched");
+    if (dispatched.length === 0)
+        return [];
+    const outcomeById = new Map();
+    for (const event of events) {
+        if (event.kind === "lane_outcome" && event.outcome !== undefined) {
+            outcomeById.set(event.submission_id, event.outcome);
+        }
+        else if (isIngestEvent(event.kind) && !outcomeById.has(event.submission_id)) {
+            // The tool ingested it, so it was delivered; the ledger does not record
+            // how much was in it, and this must not invent a count.
+            outcomeById.set(event.submission_id, "findings");
+        }
+    }
+    const byRound = new Map();
+    for (const event of dispatched) {
+        const round = event.round_id ?? "";
+        const bucket = byRound.get(round);
+        if (bucket)
+            bucket.push(event);
+        else
+            byRound.set(round, [event]);
+    }
+    const lines = [
+        "### Lane dispatch and delivery",
+        "",
+        `${dispatched.length} lane(s) were dispatched this run. A dispatched lane that wrote nothing at the bound path the tool declared is recorded \`not_run\` — the absence is the record, not an inference.`,
+        "",
+    ];
+    // Sorted by content, never arrival: a derived summary may sort; the ledger
+    // file it derives from may not.
+    for (const round of [...byRound.keys()].sort(compareCodeUnits)) {
+        const rows = byRound.get(round);
+        const outcomes = rows.map((event) => outcomeById.get(event.submission_id) ?? "not_run");
+        const delivered = outcomes.filter((outcome) => outcome !== "not_run").length;
+        const tally = new Map();
+        for (const outcome of outcomes) {
+            tally.set(outcome, (tally.get(outcome) ?? 0) + 1);
+        }
+        const breakdown = [...tally.entries()]
+            .sort(([left], [right]) => compareCodeUnits(left, right))
+            .map(([outcome, count]) => `${outcome} ${count}`)
+            .join(", ");
+        lines.push(`- ${round === "" ? "this run's gate lanes" : `round \`${round}\``}: ` +
+            `${delivered} of ${rows.length} delivered (${breakdown})`);
+    }
+    lines.push("");
+    return lines;
+}
 function renderSubmissionDriftSection(events) {
     const refusedIds = new Set(events
         .filter((event) => event.kind === "rejected")
@@ -208,11 +466,15 @@ function renderSubmissionDriftSection(events) {
         .map((event) => event.submission_id));
     if (refusedIds.size === 0 && handRepairedIds.size === 0)
         return [];
-    // Trailing state per submission: a refusal followed by an acceptance or a
-    // hand recovery is RESOLVED; one that is still the last word is not.
+    // Trailing state per submission, over the INGEST events only: a refusal
+    // followed by an acceptance or a hand recovery is RESOLVED; one that is still
+    // the last word is not. It used to be "everything except `expected`", so a
+    // `dispatched` row appended when the still-pending lane was re-materialized
+    // would have become the trailing event and made this claim the refusal "was
+    // later accepted or re-landed by hand" when nothing had accepted it.
     const trailing = new Map();
     for (const event of events) {
-        if (event.kind === "expected")
+        if (!isIngestEvent(event.kind))
             continue;
         trailing.set(event.submission_id, event.kind);
     }
@@ -255,9 +517,125 @@ function renderSubmissionDriftSection(events) {
 function pushFindingBlock(finding, lines) {
     lines.push(...renderFindingBlockLines(finding));
 }
-function renderConceptualAttributionSection(adjudication) {
+export function canonicalizeConceptualAttributionIds(report, adjudication, idSource = report) {
+    const canonicalIds = new Set([
+        ...report.findings.map((finding) => finding.id),
+        ...(report.quarantined_findings ?? []).map((finding) => finding.id),
+    ]);
+    const idMap = idSource[CONCEPTUAL_ATTRIBUTION_IDS];
+    const resolve = (id) => {
+        if (canonicalIds.has(id))
+            return id;
+        const canonicalId = idMap?.get(id);
+        if (canonicalId !== undefined && canonicalIds.has(canonicalId)) {
+            return canonicalId;
+        }
+        throw new Error(`Conceptual attribution refused: final finding id "${id}" does not resolve ` +
+            "to a canonical finding in audit-findings.json.");
+    };
+    // Canonicalize the carried adjudication itself, not only the markdown text.
+    // The fold persists every carried core artifact, so subsequent narrative and
+    // resynthesis renders reload canonical targets rather than reviving the
+    // judge-local ids that existed before the synthesis boundary.
+    const sharesByCanonicalId = new Map();
+    for (const share of adjudication.final_finding_shares) {
+        const sourceFinalFindingId = share.final_finding_id;
+        const canonicalId = resolve(sourceFinalFindingId);
+        const entries = sharesByCanonicalId.get(canonicalId) ?? [];
+        entries.push({ sourceFinalFindingId, share });
+        sharesByCanonicalId.set(canonicalId, entries);
+    }
+    const resolvedFinalFindingShares = [...sharesByCanonicalId.entries()]
+        .sort(([left], [right]) => compareCodeUnits(left, right))
+        .map(([canonicalId, entries]) => {
+        if (entries.length === 1) {
+            return { ...entries[0].share, final_finding_id: canonicalId };
+        }
+        const orderedEntries = [...entries].sort((left, right) => compareCodeUnits(left.sourceFinalFindingId, right.sourceFinalFindingId));
+        const contributions = new Map();
+        for (const entry of orderedEntries) {
+            for (const contribution of entry.share.contributors) {
+                const contributorEntries = contributions.get(contribution.contributor_id) ?? [];
+                contributorEntries.push({
+                    sourceFinalFindingId: entry.sourceFinalFindingId,
+                    contribution,
+                });
+                contributions.set(contribution.contributor_id, contributorEntries);
+            }
+        }
+        const orderedContributions = [...contributions.entries()].sort(([left], [right]) => compareCodeUnits(left, right));
+        // Each judge-local final has its own 100% allocation. Once several local
+        // finals collapse to one canonical finding, the canonical allocation is
+        // their equal-weight mean (a missing contributor contributes 0%). Allocate
+        // power-of-two micro-percent units by largest remainder: division back to
+        // numbers is exact in binary, every result stays bounded, and the common
+        // denominator makes the sum exactly 100 rather than approximately 100.
+        // Source-local percentages/rationales remain verbatim in rationale below.
+        const unitsPerPercent = 2 ** 20;
+        const totalUnits = 100 * unitsPerPercent;
+        const allocationInputs = orderedContributions.map(([contributorId, contributorEntries]) => {
+            const sourcePercent = contributorEntries.reduce((sum, entry) => sum + entry.contribution.contribution_percent, 0);
+            return { contributorId, contributorEntries, sourcePercent };
+        });
+        const totalSourcePercent = allocationInputs.reduce((sum, item) => sum + item.sourcePercent, 0);
+        if (!Number.isFinite(totalSourcePercent) || totalSourcePercent <= 0) {
+            throw new Error("Conceptual attribution percentage allocation has no positive total.");
+        }
+        const allocations = allocationInputs.map(({ contributorId, contributorEntries, sourcePercent }) => {
+            const exactUnits = (sourcePercent / totalSourcePercent) * totalUnits;
+            const units = Math.floor(exactUnits);
+            return {
+                contributorId,
+                contributorEntries,
+                units,
+                remainder: exactUnits - units,
+            };
+        });
+        const remainingUnits = totalUnits - allocations.reduce((sum, item) => sum + item.units, 0);
+        if (remainingUnits < 0 || remainingUnits > allocations.length) {
+            throw new Error("Conceptual attribution percentage allocation exceeded bounded remainder.");
+        }
+        const remainderOrder = [...allocations].sort((left, right) => right.remainder - left.remainder ||
+            compareCodeUnits(left.contributorId, right.contributorId));
+        for (let index = 0; index < remainingUnits; index += 1) {
+            remainderOrder[index].units += 1;
+        }
+        const contributors = orderedContributions.map(([contributorId, contributorEntries]) => {
+            const allocation = allocations.find((item) => item.contributorId === contributorId);
+            return {
+                contributor_id: contributorId,
+                source_candidate_ids: [
+                    ...new Set(contributorEntries.flatMap((entry) => entry.contribution.source_candidate_ids)),
+                ].sort(compareCodeUnits),
+                contribution_percent: allocation.units / unitsPerPercent,
+                rationale: contributorEntries
+                    .map((entry) => `${entry.sourceFinalFindingId} ` +
+                    `(${entry.contribution.contribution_percent}%): ` +
+                    entry.contribution.rationale)
+                    .join(" | "),
+            };
+        });
+        return {
+            final_finding_id: canonicalId,
+            contributors,
+        };
+    });
+    const resolvedCandidateDispositions = adjudication.candidate_dispositions.map((disposition) => ({
+        ...disposition,
+        target_final_finding_ids: [
+            ...new Set(disposition.target_final_finding_ids.map(resolve)),
+        ],
+    }));
+    // Commit both reference-bearing arrays only after every share and target has
+    // resolved. A late unknown disposition target cannot leave half-canonical
+    // attribution in the caller's carried bundle.
+    adjudication.final_finding_shares = resolvedFinalFindingShares;
+    adjudication.candidate_dispositions = resolvedCandidateDispositions;
+}
+function renderConceptualAttributionSection(report, adjudication) {
     if (!adjudication)
         return [];
+    canonicalizeConceptualAttributionIds(report, adjudication);
     const contributors = new Map(adjudication.contributors.map((contributor) => [
         contributor.contributor_id,
         contributor,
@@ -265,7 +643,15 @@ function renderConceptualAttributionSection(adjudication) {
     const lines = [
         "## Conceptual Review Attribution",
         "",
-        `Round: \`${adjudication.round_id}\`. Contribution and modification percentages are judge-authored semantic estimates; tooling verified references, bounds, complete candidate coverage, and 100% contribution totals.`,
+        `Round: \`${adjudication.round_id}\`. Contribution and modification percentages are judge-authored semantic estimates; tooling verified references, bounds, complete candidate coverage, and 100% contribution totals. \`verification_status\` is likewise judge-authored — the tool enforces that a claim is present, consistent and published, never that it is true. Note that a conceptual finding's \`grounded\` verdict certifies component-path existence ONLY; the defect-presence claim is carried by \`verification_status\`, not by grounding.`,
+        "",
+        // The aggregate the live run had to be obtained by counting the artifact by
+        // hand. Both populations are CANDIDATE-scoped here and are not reconciled
+        // with the finding-scoped Summary counts: the post-adjudication grounding
+        // quarantine can drop a merged candidate's final finding, so they
+        // legitimately differ and each is labelled by its population.
+        `- Candidate dispositions: ${formatCountList(adjudication.candidate_disposition_breakdown)}`,
+        `- Candidate verification: ${formatCountList(adjudication.candidate_verification_status_breakdown)}`,
         "",
     ];
     for (const finalShare of adjudication.final_finding_shares) {
@@ -284,7 +670,7 @@ function renderConceptualAttributionSection(adjudication) {
     }
     lines.push("### Candidate dispositions", "");
     for (const disposition of adjudication.candidate_dispositions) {
-        lines.push(`- \`${disposition.candidate_id}\` — **${disposition.disposition}**; modified ${disposition.modification_percent}%; targets ${disposition.target_final_finding_ids.join(", ") || "none"}. ${disposition.rationale}`);
+        lines.push(`- \`${disposition.candidate_id}\` — **${disposition.disposition}**; \`${disposition.verification_status}\`; modified ${disposition.modification_percent}%; targets ${disposition.target_final_finding_ids.join(", ") || "none"}. ${disposition.rationale}${disposition.verification_note ? ` _Verified:_ ${disposition.verification_note}` : ""}`);
     }
     lines.push("");
     return lines;
@@ -300,7 +686,12 @@ export function renderAuditReportMarkdown(report, options = {}) {
     }
     lines.push("## Summary", "", `- Findings: ${report.summary.finding_count}`, `- Work blocks: ${report.summary.work_block_count}`, `- Severity breakdown: ${formatSeverityList(report.summary.severity_breakdown)}`, ...(report.summary.lens_breakdown && Object.keys(report.summary.lens_breakdown).length > 0
         ? [`- Lens breakdown: ${formatCountList(report.summary.lens_breakdown)}`]
-        : []), ...(report.summary.grounding_status_breakdown &&
+        : []), 
+    // The line the breakdown structurally cannot carry: a selected lens with no
+    // findings has no key in a `countBy`, so it used to be invisible. Named
+    // here rather than in *Audit Limitations* (owner working assumption) — terse
+    // and always in front of the reader, beside the counts it qualifies.
+    ...renderUnexercisedLensLine(report.summary.lens_coverage), ...(report.summary.grounding_status_breakdown &&
         Object.keys(report.summary.grounding_status_breakdown).length > 0
         ? [
             `- Grounding (S7): ${formatCountList(report.summary.grounding_status_breakdown)}` +
@@ -315,6 +706,12 @@ export function renderAuditReportMarkdown(report, options = {}) {
                     .filter(Boolean)
                     .reduce((acc, note, i) => acc + (i === 0 ? " — " : "; ") + note, ""),
         ]
+        : []), ...(report.summary.verification_status_breakdown &&
+        Object.keys(report.summary.verification_status_breakdown).length > 0
+        ? [
+            `- Verification: ${formatCountList(report.summary.verification_status_breakdown)}` +
+                " — judge-authored claims about whether each defect is present at HEAD, not tool runs",
+        ]
         : []), `- Fully audited files: ${report.summary.audited_file_count}`, `- Excluded non-auditable files: ${report.summary.excluded_file_count}`, "");
     if (report.top_risks && report.top_risks.length > 0) {
         lines.push("## Top Risks", "");
@@ -401,8 +798,12 @@ export function renderAuditReportMarkdown(report, options = {}) {
             pushFindingBlock(finding, lines);
         }
     }
-    const driftLines = renderSubmissionDriftSection(options.submission_ledger ?? []);
-    lines.push(...renderConceptualAttributionSection(options.conceptual_adjudication));
+    const ledgerEvents = options.submission_ledger ?? [];
+    const driftLines = [
+        ...renderLaneDeliverySection(ledgerEvents),
+        ...renderSubmissionDriftSection(ledgerEvents),
+    ];
+    lines.push(...renderConceptualAttributionSection(report, options.conceptual_adjudication));
     const reflections = options.reflections ?? [];
     // Structural capability limitations are report limitations, not process
     // feedback. Keep the machine contract untouched: this only partitions the
@@ -410,15 +811,32 @@ export function renderAuditReportMarkdown(report, options = {}) {
     const capabilityLimitations = reflections.filter((reflection) => reflection.task_id === "audit-capability-preflight" &&
         (reflection.severity === "high" || reflection.severity === "critical"));
     const processFeedback = reflections.filter((reflection) => !capabilityLimitations.includes(reflection));
-    const limitationLines = renderProcessFeedbackSection(capabilityLimitations);
-    if (limitationLines.length > 0)
-        limitationLines[0] = "## Audit Limitations";
+    // *Audit Limitations* states what this run could NOT do. It has two sources
+    // now, and the section is CREATED by either — it used to be the process-
+    // feedback heading renamed, so it existed only when a capability-preflight
+    // reflection happened to be present.
+    const analyzerLimitationLines = renderAnalyzerDegradationLines(options.analyzer_capability);
+    const reflectionLimitationLines = renderProcessFeedbackSection(capabilityLimitations);
+    if (reflectionLimitationLines.length > 0) {
+        reflectionLimitationLines[0] = "## Audit Limitations";
+    }
+    const limitationLines = analyzerLimitationLines.length > 0
+        ? [
+            "## Audit Limitations",
+            "",
+            ...analyzerLimitationLines,
+            // A reflection-sourced block that follows keeps its own body but must
+            // not re-open the heading it is now inside.
+            ...reflectionLimitationLines.slice(reflectionLimitationLines.length > 0 ? 2 : 0),
+        ]
+        : reflectionLimitationLines;
     const feedbackLines = renderProcessFeedbackSection(processFeedback);
+    const coverageLines = renderCharterCoverageSection(options.charter_evidence_coverage ?? [], options.charter_packet_archive ?? []);
     lines.push(...limitationLines, ...feedbackLines);
     if (driftLines.length > 0 && feedbackLines.length === 0) {
         lines.push("## Process Feedback", "");
     }
-    lines.push(...driftLines);
+    lines.push(...driftLines, ...coverageLines);
     const excludedScope = options.intent_checkpoint?.excluded_scope ?? [];
     if (excludedScope.length > 0) {
         lines.push("## Excluded / Out-of-Scope", "");
@@ -453,6 +871,7 @@ export function renderAuditReportMarkdown(report, options = {}) {
  */
 export function normalizeExistingFindingsReport(report) {
     const groundingBreakdown = groundingStatusBreakdown(report.findings);
+    const verificationBreakdown = verificationStatusBreakdown(report.findings);
     return {
         ...report,
         contract_version: AUDIT_FINDINGS_CONTRACT_VERSION,
@@ -463,9 +882,23 @@ export function normalizeExistingFindingsReport(report) {
             work_block_count: report.work_blocks.length,
             severity_breakdown: severityBreakdown(report.findings),
             lens_breakdown: lensBreakdown(report.findings),
+            // The SELECTION is carried through — this function has no checkpoint and
+            // must not invent one — while the counts and outcomes are re-derived over
+            // the same findings `lens_breakdown` is re-counted from. Copying the map
+            // untouched beside a re-derived breakdown is how the two come to
+            // contradict each other, and the contradiction is refused downstream by
+            // `projectApprovedFindings`, which throws.
+            ...(report.summary.lens_coverage === undefined
+                ? {}
+                : {
+                    lens_coverage: reprojectLensCoverage(report.summary.lens_coverage, report.findings),
+                }),
             ...(Object.keys(groundingBreakdown).length > 0
                 ? { grounding_status_breakdown: groundingBreakdown }
                 : {}),
+            ...(Object.keys(verificationBreakdown).length > 0
+                ? { verification_status_breakdown: verificationBreakdown }
+                : {}),
         },
     };
 }