nexus-agents 8.58.2 → 8.58.3

package/dist/{chunk-YF3YIHPZ.js → chunk-XKP6IEHD.js}

@@ -25,10 +25,10 @@ import {
   toolSuccessStructured,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-JE2TRDX7.js";
+} from "./chunk-TDBR47OD.js";
 import {
   VERSION
-} from "./chunk-CZN5JK7D.js";
+} from "./chunk-7DD6X5D7.js";
 import {
   UNRESOLVED_MODEL_ID,
   assessPanelIndependence,
@@ -280,6 +280,463 @@ function reportPanelModelIndependence(modelIds, roleCount, phase, logger11) {
   );
 }
 
+// src/audit/vote-record.ts
+import * as crypto from "node:crypto";
+import { z as z2 } from "zod";
+var VoteRecordDecisionSchema = z2.enum(["approved", "rejected", "no_quorum"]);
+var VoteRecordOptionCoverageSchema = z2.object({
+  /** Every approving voter, selecting or not — the tally's denominator. */
+  approverCount: z2.number().int().nonnegative(),
+  /** Approvers whose selection matched a declared option. */
+  selectedCount: z2.number().int().nonnegative(),
+  /** Approvers with no usable selection; their choice is unmeasured. */
+  unattributedApprovals: z2.number().int().nonnegative()
+}).strict();
+var VoteRecordPanelCoverageSchema = z2.object({
+  /** Voters the panel asked for. */
+  requested: z2.number().int().nonnegative(),
+  /** Voters that returned a usable vote — the denominator of `voteCounts`. */
+  responded: z2.number().int().nonnegative(),
+  /** Voters that errored or timed out. */
+  errored: z2.number().int().nonnegative(),
+  /** The roles behind `errored`, in panel order. */
+  erroredRoles: z2.array(z2.string().min(1).max(100))
+}).strict();
+var MAX_VOTER_REASONING_CHARS = 2e4;
+function clipForRecord(text) {
+  if (text.length <= MAX_VOTER_REASONING_CHARS) return { text };
+  return { text: text.slice(0, MAX_VOTER_REASONING_CHARS), truncated: true };
+}
+var RetriedFromRecordSchema = z2.object({
+  /** The first pass's `source`: errored, or answered without reading. */
+  source: z2.enum(["error", "unverifiable"]),
+  /** The first pass's `error` string, when it had one; already clipped. */
+  error: z2.string().max(MAX_VOTER_REASONING_CHARS).optional(),
+  /** True when `error` was clipped to {@link MAX_VOTER_REASONING_CHARS}. */
+  errorTruncated: z2.literal(true).optional()
+}).strict();
+var SeatFallbackRecordSchema = z2.object({
+  /** The CLI the seat was assigned to, bare (`claude`, not `cli-claude`). */
+  fromCli: z2.string().min(1).max(100),
+  /** The model the assigned adapter had detected, when it had one. */
+  fromModel: z2.string().min(1).max(200).optional(),
+  /** The adapter-layer class of the error that moved the seat. */
+  reason: z2.enum(["rate-limit", "capacity", "auth", "timeout", "sandbox", "unknown"])
+}).strict();
+var VoterSummarySchema = z2.object({
+  role: z2.string().min(1).max(100),
+  decision: z2.enum(["approve", "reject", "abstain"]),
+  confidence: z2.number().min(0).max(1),
+  /**
+   * The voter's stated grounds (#5373, schema 1.6).
+   *
+   * `generateVoteHash` already hashed `{role, decision, reasoning}` and then
+   * discarded the text, so the chain attested to a value it did not store and
+   * nobody could re-verify the hash without re-obtaining the reasoning. On
+   * #5228 a contrarian rejection was clipped mid-sentence in the terminal, the
+   * grounds were unrecoverable, and the same defect resurfaced a round later —
+   * one round of a 7-voter panel is 7-13 minutes of model time, and the
+   * objection was right both times.
+   *
+   * Stored whole rather than sampled. Warn-mode near-misses are emitted per
+   * TOOL CALL, thousands a day; votes are emitted per PANEL, dozens a day at
+   * most, so ~17 KB per vote is not the same growth problem.
+   *
+   * Absence is not an empty argument: an errored voter has no entry in
+   * `voters` at all (see `panelCoverage`), so `reasoning: ''` means a live
+   * voter returned nothing, which is itself a signal.
+   */
+  reasoning: z2.string().max(MAX_VOTER_REASONING_CHARS).optional(),
+  /** True when `reasoning` was clipped to {@link MAX_VOTER_REASONING_CHARS}. */
+  reasoningTruncated: z2.literal(true).optional(),
+  /**
+   * True when this seat was recovered by the per-role retry (#6050, schema 1.7).
+   *
+   * `voter-retry.ts` has set `retried: true` on recovered results since it was
+   * written, and `vote-types.ts` states the reason: the flag is "what makes the
+   * recovery visible instead of indistinguishable from a clean first attempt".
+   * It had one producer and ZERO consumers — both summarizers and the record
+   * dropped it — so the field existed, was documented, and never reached
+   * anything that could act on it.
+   *
+   * A retried seat is weaker evidence than a first-pass one: the model was
+   * unavailable or timed out, and the recovery ran under different conditions.
+   * For a ratification vote on a governor-path change, "7 of 7 answered" and
+   * "6 answered, 1 recovered on retry" are different facts about the scrutiny
+   * the change received, and the record stated the first for both.
+   *
+   * `literal(true)` and optional, on the `reasoningTruncated` rule: a clean
+   * seat carries no key, so its entry re-hashes byte-identical and every
+   * historical record still verifies.
+   */
+  retried: z2.literal(true).optional(),
+  /**
+   * Registry model id the seat ran on (#6091, schema 1.8).
+   *
+   * The seat→model mapping is round-robin over the available CLIs plus
+   * `NEXUS_VOTER_MODEL_<ROLE>` pins, so it is not recoverable from the
+   * ledger after the fact: 1844 voter entries across 278 records carried no
+   * model. "When an agent's output becomes evidence, its provenance travels
+   * with it" — a tally that says `scope_steward: approve` without saying
+   * which model answered cannot be audited for the #6068 failure class.
+   * Present-only, on the `retried` rule; absent when the result carried no
+   * model or only the pending-detection placeholder.
+   */
+  model: z2.string().min(1).max(200).optional(),
+  /**
+   * True when the seat could not read the artifact (#6094, schema 1.8).
+   *
+   * `decision` is `abstain` for such a seat, so without this flag the record
+   * could not tell "read it and abstained" from "never saw it" — and one
+   * ledger entry (`vote-1789058788915-6lfrbuq`) shows a seat that APPROVED
+   * on the proposal text after failing to read. `literal(true)` and
+   * present-only, so every pre-1.8 entry re-hashes byte-identical.
+   */
+  unverifiable: z2.literal(true).optional(),
+  /**
+   * The CLI the round-robin or `NEXUS_VOTER_MODEL_<ROLE>` pin chose for the
+   * seat, as a bare name (#6115, schema 1.9). `model` says where a seat
+   * answered; this says where it was MEANT to. Three consecutive 7-seat
+   * ratification panels on 2026-09-13 answered every seat on one gemini
+   * model while the assignment was three claude, two codex, two gemini,
+   * and the 1.8 record showed seven identical `model` values with nothing
+   * that said five of them were substitutes. Present-only, on the `model`
+   * rule; absent on a result built outside the panel launcher.
+   */
+  assignedCli: z2.string().min(1).max(100).optional(),
+  /**
+   * Present only when the seat answered on a different CLI or model than
+   * assigned (#6115, schema 1.9): the exact `SeatFallback` shape the live
+   * result carries, rebuilt field-by-field. `fromCli` is the assigned CLI,
+   * `fromModel` the model it had detected (absent when it never did — the
+   * pending-detection placeholder is not a model), `reason` the adapter
+   * layer's error class. The vocabulary is compile-checked against the live
+   * `FallbackReason` in vote-record.test.ts; a class one side learns alone
+   * would either refuse every record that carries it (#6054) or accept one
+   * no producer can write.
+   */
+  fallback: SeatFallbackRecordSchema.optional(),
+  /**
+   * Present only when the per-role retry REPLACED this seat (#6246, schema
+   * 1.12): the first pass's source and, when it had one, its clipped error
+   * string. `retried` (1.7) says a recovery happened; this says what it
+   * recovered from. On the #6241 panel a seat recorded `retried: true,
+   * unverifiable: true` after a first pass that errored on two response-parse
+   * failures, and nothing in the record joined the two — a reader of the
+   * ledger and the log together concluded the parse errors had been
+   * misclassified (#6244). Rebuilt field-by-field on the `fallback` rule; the
+   * `source` vocabulary is compile-checked against the live `RetriedFrom`.
+   */
+  retriedFrom: RetriedFromRecordSchema.optional()
+}).strict();
+function defineVoterKeys(keys) {
+  return keys;
+}
+var VOTER_SUMMARY_KEYS = defineVoterKeys([
+  "role",
+  "decision",
+  "confidence",
+  "reasoning",
+  "reasoningTruncated",
+  "retried",
+  // 1.8 (#6091, #6094): appended after `retried`, present-only, so a 1.7
+  // entry projects byte-identically.
+  "model",
+  "unverifiable",
+  // 1.9 (#6115): appended after `unverifiable`, present-only, so a 1.8 entry
+  // projects byte-identically. `fallback` is the first nested voter field;
+  // `projectSeatFallback` rebuilds it in its own canonical order.
+  "assignedCli",
+  "fallback",
+  // 1.12 (#6246): appended after `fallback`, present-only, so a 1.11 entry
+  // projects byte-identically. Nested; `projectRetriedFrom` rebuilds it in
+  // its own canonical order.
+  "retriedFrom"
+]);
+function noUnprojectedKeys(rest) {
+  return rest;
+}
+function projectSeatFallback(f) {
+  const { fromCli, fromModel, reason, ...rest } = f;
+  noUnprojectedKeys(rest);
+  return {
+    fromCli,
+    ...fromModel !== void 0 ? { fromModel } : {},
+    reason
+  };
+}
+function projectRetriedFrom(r) {
+  const { source, error, errorTruncated, ...rest } = r;
+  noUnprojectedKeys(rest);
+  return {
+    source,
+    ...error !== void 0 ? { error } : {},
+    ...errorTruncated !== void 0 ? { errorTruncated } : {}
+  };
+}
+function projectVoterField(v, key) {
+  if (key === "fallback") {
+    return v.fallback === void 0 ? void 0 : projectSeatFallback(v.fallback);
+  }
+  if (key === "retriedFrom") {
+    return v.retriedFrom === void 0 ? void 0 : projectRetriedFrom(v.retriedFrom);
+  }
+  return v[key];
+}
+function projectVoterSummary(v) {
+  const out = {};
+  for (const key of VOTER_SUMMARY_KEYS) {
+    const value = projectVoterField(v, key);
+    if (value !== void 0) out[key] = value;
+  }
+  return out;
+}
+var VoteRecordCountsSchema = z2.object({
+  approve: z2.number().int().nonnegative(),
+  reject: z2.number().int().nonnegative(),
+  abstain: z2.number().int().nonnegative(),
+  total: z2.number().int().nonnegative()
+}).strict();
+var VoteRecordOptionCountSchema = z2.object({
+  /** The option label as declared in the proposal (e.g. 'A'). */
+  option: z2.string().min(1),
+  /** How many voters selected it. */
+  count: z2.number().int().nonnegative()
+}).strict();
+var GIT_SHA_PATTERN = /^[0-9a-f]{40}$/;
+var VoteRecordPrBindingSchema = z2.object({
+  pr: z2.number().int().positive(),
+  headSha: z2.string().regex(GIT_SHA_PATTERN, "expected a full 40-hex lowercase commit sha")
+}).strict();
+function projectPrBinding(b) {
+  return { pr: b.pr, headSha: b.headSha };
+}
+var VoteRecordErrorPolicySchema = z2.enum([
+  "reduce_denominator",
+  "count_as_abstain",
+  "fail_closed",
+  "absolute_quorum"
+]);
+var VoteRecordSchema = z2.object({
+  /**
+   * Schema version. '1.1' marked the chain→record-set+sequence model (#3927);
+   * '1.2' adds the optional `ratifies` subject-binding field (#3927 item 1);
+   * '1.10' adds the optional `ratifiesPr` PR-binding (#5130); '1.11' the
+   * optional `errorPolicy` (#6211); '1.12' the per-voter `retriedFrom`
+   * (#6246). Every tier is accepted — a 1.1 record
+   * (no `ratifies`) verifies unchanged because each optional is folded into
+   * the self-hash ONLY when present (see {@link computeVoteRecordHash}).
+   * Tiers are labels, not ordered numbers: '1.10' follows '1.9' by
+   * convention only and nothing compares them.
+   */
+  version: z2.enum([
+    "1.1",
+    "1.2",
+    "1.3",
+    "1.4",
+    "1.5",
+    "1.6",
+    "1.7",
+    "1.8",
+    "1.9",
+    "1.10",
+    "1.11",
+    "1.12"
+  ]),
+  /** Unique record id (also usable as a `ratificationVoteRef`). */
+  id: z2.string().min(1),
+  /**
+   * Monotonic sequence number (integer ≥ 0). Assigned as (max existing
+   * sequence)+1 at write time. Sorted, the set of sequences must cover
+   * 0..maxSeq with no gap (omission detection); DUPLICATE sequences are a
+   * benign concurrent-fork signal, not tampering.
+   */
+  sequence: z2.number().int().nonnegative(),
+  /** ISO-8601 timestamp the vote was recorded. */
+  recordedAt: z2.string().min(1),
+  /**
+   * SHA-256 of the FULL proposal text. The proposal itself is truncated for
+   * the human record (`proposal`), but the hash binds the record to the exact
+   * proposal voted on — a later edit of `proposal` that changes meaning is
+   * detectable by recomputing this hash from the original.
+   */
+  proposalHash: z2.string().length(64),
+  /** Truncated proposal text for the human/reviewer record. */
+  proposal: z2.string(),
+  /** The voting strategy used. */
+  strategy: z2.enum([
+    "simple_majority",
+    "supermajority",
+    "unanimous",
+    "higher_order",
+    "opinion_wise",
+    "proof_of_learning"
+  ]),
+  /** The resolved decision. */
+  decision: VoteRecordDecisionSchema,
+  /** Approval fraction as a percentage (0-100). */
+  approvalPercentage: z2.number().min(0).max(100),
+  /** Vote-count breakdown. */
+  voteCounts: VoteRecordCountsSchema,
+  /** Per-voter {role, decision, confidence} summary. */
+  voters: z2.array(VoterSummarySchema),
+  /** Optional correlation/decision id linking to the cost rollup / trace. */
+  correlationId: z2.string().min(1).optional(),
+  /**
+   * Per-option distribution for a multi-option proposal (#4452, schema 1.3).
+   *
+   * Present only when the vote declared `options`. Absent on an ordinary
+   * yes/no vote, and absent on every 1.1/1.2 record — which is why it is
+   * folded into the self-hash ONLY when present (see
+   * {@link computeVoteRecordHash}), exactly as `ratifies` was.
+   *
+   * Without this, a 6-1 or 5-2 option split is recorded as `approve: 7` and
+   * reads as unanimous. Threshold semantics invert too: `unanimous` becomes
+   * the EASIEST bar to clear, because every engaged voter approves while
+   * choosing different things.
+   */
+  // No `.min(1)` (#6049). The rule this field's own docstring states is
+  // "present only when the vote declared `options`" -- keyed on DECLARATION,
+  // not on whether anyone picked one. `.min(1)` encoded the older, narrower
+  // rule, so once the builder started emitting `[]` for "declared, nothing
+  // attributable" the record appended fine and then failed to parse on read:
+  // `too_small, minimum 1`. The write path does not validate, so the line
+  // landed in the ledger and `parseVoteRecordsText` silently dropped it --
+  // the case most worth auditing became the one no reader could see.
+  //
+  // Relaxing is a pure widening: no previously-valid record changes meaning
+  // or hash, and no persisted record can currently hold an empty tally.
+  optionTally: z2.array(VoteRecordOptionCountSchema).optional(),
+  /**
+   * Selection coverage for a multi-option vote (#4472, schema 1.4).
+   *
+   * `optionTally` alone cannot distinguish dissent from absence: `4 pick X
+   * + 3 unreadable` and a genuine 4/3 split both leave a leading share of
+   * 57%. Recording how many approvers produced no usable selection is what
+   * makes a partial measurement legible AS partial — the condition every
+   * voter attached to adopting the "credit no option" rule.
+   */
+  optionCoverage: VoteRecordOptionCoverageSchema.optional(),
+  /**
+   * Panel coverage (#5738, schema 1.5). Present only when at least one
+   * requested voter failed to return a vote; absent keeps a clean panel on
+   * the pre-1.5 projection, so every historical record still verifies.
+   */
+  panelCoverage: VoteRecordPanelCoverageSchema.optional(),
+  /**
+   * The loop/strategy subject this vote RATIFIES (#3927 item 1). Present only on
+   * a ratification vote; set at vote time and bound into the self-hash (so it is
+   * tamper-evident). The authority-tier promotion gate
+   * (`scripts/check-authority-tier-drift.ts`) resolves a transition's
+   * `ratificationVoteRef` to a record and requires `ratifies === transition.subject`
+   * (with `decision === 'approved'` and `strategy === 'higher_order'`). Absent on
+   * an ordinary (non-ratification) vote; a 1.1 record never carries it.
+   */
+  ratifies: z2.string().min(1).optional(),
+  /**
+   * The PR this vote RATIFIES, bound to the head the panel saw (#5130 step 1,
+   * schema 1.10; panel decision Q1 option A, 5 of 6). Present only on a
+   * governor-path ratification vote; hash-covered like `ratifies`, so a
+   * record cannot be repointed at a different PR or a later push without
+   * breaking its hash. The governor gate (step 2, #5779/#5131) resolves the
+   * record from the committed ledger and requires `pr` to be the PR under
+   * review and `headSha` to be its head (or `head^` when `head` touches only
+   * the ledger — the caller-commits tip). Absent on every pre-1.10 record.
+   *
+   * A SEPARATE key rather than a structured encoding of `ratifies`: that
+   * field is the authority-ladder SUBJECT, compared by string equality to
+   * `transition.subject` and grouped by `conflictingRatifiedSubjects`; no
+   * resolver parses it. Overloading it would give one field two consumers
+   * with two equality rules. The two may coexist on one record.
+   */
+  ratifiesPr: VoteRecordPrBindingSchema.optional(),
+  /**
+   * The error policy the panel actually ran under (#6211, schema 1.11): the
+   * EFFECTIVE policy after `consensus_vote` applied the per-strategy default
+   * (`input.errorPolicy ?? getDefaultErrorPolicy(strategy)`), not the raw
+   * input the caller may have omitted. Hash-covered, present-only.
+   *
+   * Before this tier the policy reached the RESPONSE only, so the governor
+   * ledger gate (`scripts/governor-ledger-evidence.ts`) could not say which
+   * policy a whole-panel ratification was configured with: under
+   * `absolute_quorum` an errored seat voids the vote, so the one
+   * ledger-observable trace of a different policy was an approved record
+   * with `panelCoverage.errored > 0` — and a whole panel under
+   * `reduce_denominator` looked exactly like one under `absolute_quorum`.
+   * The gate's `wrong-error-policy` verdict reads this field; a record
+   * without it (every pre-1.11 record) keeps the panel-coverage inference
+   * and is reported as `errorPolicy: unrecorded`.
+   */
+  errorPolicy: VoteRecordErrorPolicySchema.optional(),
+  /**
+   * ADVISORY hash of the tip record at write time (absent for the first).
+   * Retained for audit texture but NOT covered by `hash` and NOT verified —
+   * the record-set model is position-independent (#3927).
+   */
+  previousHash: z2.string().length(64).optional(),
+  /** SHA-256 over every field above EXCEPT `previousHash` (and except `hash`). */
+  hash: z2.string().length(64)
+}).strict();
+function foldOptionalFields(base, payload) {
+  const withTally = payload.optionTally !== void 0 ? {
+    ...base,
+    optionTally: payload.optionTally.map((o) => ({ option: o.option, count: o.count }))
+  } : base;
+  const withCoverage = payload.optionCoverage !== void 0 ? {
+    ...withTally,
+    optionCoverage: {
+      approverCount: payload.optionCoverage.approverCount,
+      selectedCount: payload.optionCoverage.selectedCount,
+      unattributedApprovals: payload.optionCoverage.unattributedApprovals
+    }
+  } : withTally;
+  const withPanel = payload.panelCoverage !== void 0 ? {
+    ...withCoverage,
+    panelCoverage: {
+      requested: payload.panelCoverage.requested,
+      responded: payload.panelCoverage.responded,
+      errored: payload.panelCoverage.errored,
+      erroredRoles: [...payload.panelCoverage.erroredRoles]
+    }
+  } : withCoverage;
+  const withRatifies = payload.ratifies !== void 0 ? { ...withPanel, ratifies: payload.ratifies } : withPanel;
+  const withPrBinding = payload.ratifiesPr !== void 0 ? { ...withRatifies, ratifiesPr: projectPrBinding(payload.ratifiesPr) } : withRatifies;
+  return payload.errorPolicy !== void 0 ? { ...withPrBinding, errorPolicy: payload.errorPolicy } : withPrBinding;
+}
+function computeVoteRecordHash(payload) {
+  const base = {
+    version: payload.version,
+    id: payload.id,
+    sequence: payload.sequence,
+    recordedAt: payload.recordedAt,
+    proposalHash: payload.proposalHash,
+    proposal: payload.proposal,
+    strategy: payload.strategy,
+    decision: payload.decision,
+    approvalPercentage: payload.approvalPercentage,
+    // Rebuild voteCounts in schema order (approve, reject, abstain, total) so the
+    // hash does not depend on how the nested object's keys were ordered (#3962).
+    voteCounts: {
+      approve: payload.voteCounts.approve,
+      reject: payload.voteCounts.reject,
+      abstain: payload.voteCounts.abstain,
+      total: payload.voteCounts.total
+    },
+    // `reasoning` / `reasoningTruncated` (#5373, schema 1.6) are appended per
+    // entry ONLY when present, on the same rule as the record-level optional
+    // fields: a pre-1.6 voter entry re-hashes byte-identical, so every
+    // historical record still verifies, while editing or removing a stored
+    // reasoning flips the hash.
+    voters: payload.voters.map(projectVoterSummary),
+    correlationId: payload.correlationId ?? null
+  };
+  const canonical = JSON.stringify(foldOptionalFields(base, payload));
+  return crypto.createHash("sha256").update(canonical).digest("hex");
+}
+function hashProposal(proposal) {
+  return crypto.createHash("sha256").update(proposal).digest("hex");
+}
+
 // src/cli/voter-unverifiable.ts
 var UNVERIFIABLE_STDERR_RE = /\bbwrap: |RTM_NEWADDR|\bsandbox\b[^\n]*\b(?:denied|failed|not permitted)\b/i;
 var UNVERIFIABLE_REASONING_RE = /\bbwrap: |RTM_NEWADDR|\b(?:repository|source|shell) (?:reads?|access|execution|inspection) failed\b|\bcould not (?:read|inspect) the artifact\b/i;
@@ -317,6 +774,13 @@ function isAbsentSeat(v) {
 }
 
 // src/cli/voter-retry.ts
+var CONTROL_CHARS_RE = /[\x00-\x1f\x7f-\x9f]/g;
+function retriedFromOf(first) {
+  const source = first.source === "unverifiable" ? "unverifiable" : "error";
+  if (first.error === void 0) return { source };
+  const { text, truncated } = clipForRecord(first.error.replace(CONTROL_CHARS_RE, " "));
+  return { source, error: text, ...truncated === true ? { errorTruncated: true } : {} };
+}
 var DEFAULT_ERRORED_ROLE_BACKOFF_MS = 3e3;
 async function retryErroredRoles(first, relaunch, logger11, backoffMs) {
   const erroredRoles = first.filter(isAbsentSeat).map((v) => v.role);
@@ -328,10 +792,17 @@ async function retryErroredRoles(first, relaunch, logger11, backoffMs) {
   });
   if (backoffMs > 0) await sleep(backoffMs);
   const retriedResults = await relaunch(erroredRoles);
+  const firstByRole = new Map(first.map((v) => [v.role, v]));
   const recovered = /* @__PURE__ */ new Map();
   for (const r of retriedResults) {
     if (r.source === "error") continue;
-    recovered.set(r.role, { ...r, retried: true });
+    const prior = firstByRole.get(r.role);
+    const from = prior !== void 0 && isAbsentSeat(prior) ? retriedFromOf(prior) : void 0;
+    recovered.set(r.role, {
+      ...r,
+      retried: true,
+      ...from !== void 0 ? { retriedFrom: from } : {}
+    });
   }
   if (recovered.size === 0) {
     logger11.warn("Per-role retry recovered no voter \u2014 the panel stays degraded", { erroredRoles });
@@ -666,7 +1137,7 @@ var SIMULATED_VOTE_REASONING = {
 };
 
 // src/cli/voter-response.ts
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 
 // src/consensus/option-tally.ts
 var SUPERMAJORITY_SHARE = 2 / 3;
@@ -726,26 +1197,26 @@ var SyntheticVoteError = class extends Error {
   }
   rawOutput;
 };
-var RawFindingSchema = z2.object({
-  summary: z2.string().min(1).max(500).describe("One-line summary of the issue"),
-  location: z2.string().min(1).max(200).describe("path/file.ext:line"),
-  severity: z2.enum(["critical", "high", "medium", "low"]).default("medium"),
-  gate: z2.object({
-    reread_cited_line: z2.enum(["passed", "failed", "skipped"]).default("skipped"),
-    traced_call_path: z2.enum(["passed", "failed", "skipped"]).default("skipped"),
-    named_assertion: z2.string().default("").describe("Concrete failing assertion \u2014 substantive, not a rubber-stamp word"),
-    ruled_out_language_non_issue: z2.enum(["passed", "failed", "skipped"]).default("skipped")
+var RawFindingSchema = z3.object({
+  summary: z3.string().min(1).max(500).describe("One-line summary of the issue"),
+  location: z3.string().min(1).max(200).describe("path/file.ext:line"),
+  severity: z3.enum(["critical", "high", "medium", "low"]).default("medium"),
+  gate: z3.object({
+    reread_cited_line: z3.enum(["passed", "failed", "skipped"]).default("skipped"),
+    traced_call_path: z3.enum(["passed", "failed", "skipped"]).default("skipped"),
+    named_assertion: z3.string().default("").describe("Concrete failing assertion \u2014 substantive, not a rubber-stamp word"),
+    ruled_out_language_non_issue: z3.enum(["passed", "failed", "skipped"]).default("skipped")
   }),
-  claim: z2.string().min(1).max(2e3).describe("What is wrong and why it justifies blocking")
+  claim: z3.string().min(1).max(2e3).describe("What is wrong and why it justifies blocking")
 });
-var VoteResponseSchema = z2.object({
-  decision: z2.enum(["approve", "reject", "abstain"]).describe("Your vote decision"),
-  reasoning: z2.string().min(10).max(4e3).describe("Explanation for your vote (10-4000 chars)"),
-  confidence: z2.number().min(0).max(1).describe("Confidence level 0-1"),
-  conditions: z2.array(z2.string()).optional().describe("Optional conditions for approval"),
+var VoteResponseSchema = z3.object({
+  decision: z3.enum(["approve", "reject", "abstain"]).describe("Your vote decision"),
+  reasoning: z3.string().min(10).max(4e3).describe("Explanation for your vote (10-4000 chars)"),
+  confidence: z3.number().min(0).max(1).describe("Confidence level 0-1"),
+  conditions: z3.array(z3.string()).optional().describe("Optional conditions for approval"),
   /** Structured rejection categories for reject→refine→re-vote loops (Issue #1213). */
-  rejectionCategories: z2.array(
-    z2.enum([
+  rejectionCategories: z3.array(
+    z3.enum([
       "YAGNI",
       "DRY_VIOLATION",
       "OVER_ENGINEERING",
@@ -757,11 +1228,11 @@ var VoteResponseSchema = z2.object({
   ).optional().describe("Rejection reason categories when decision is reject"),
   /** Top-level structured findings for PR-review mode (#2245 v4 follow-up).
    * Replaces the YAML-in-reasoning encoding that proved lossy. */
-  findings: z2.array(RawFindingSchema).optional().describe("Structured findings (PR review only)"),
+  findings: z3.array(RawFindingSchema).optional().describe("Structured findings (PR review only)"),
   /** Chosen option when the proposal declared `options` (#4472). Validated
    * against the declared list by the caller; an unmatched value is dropped
    * rather than recorded, so a parse miss surfaces as absent. */
-  selectedOption: z2.string().optional().describe("Which declared option you choose")
+  selectedOption: z3.string().optional().describe("Which declared option you choose")
 });
 var VOTE_JSON_SCHEMA = {
   type: "object",
@@ -1653,9 +2124,9 @@ async function collectRealVotes(options) {
 // src/cli/voter-project.ts
 import { readFileSync, statSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 var VOTER_PROJECT_PATTERN = /^[A-Za-z0-9._/@-]{1,200}$/;
-var VoterProjectInputSchema = z3.string().regex(VOTER_PROJECT_PATTERN).optional().describe(
+var VoterProjectInputSchema = z4.string().regex(VOTER_PROJECT_PATTERN).optional().describe(
   "The project the panel is judging (#6110), e.g. `acme/widgets` \u2014 it replaces `nexus-agents` in every voter's system prompt, so a consuming repository is not judged against this one's mission and governance files. When omitted the name is DERIVED from the server's working directory (the `origin` remote as `owner/repo`, else the nearest `package.json` name) and falls back to `nexus-agents`; the response discloses which on `project.source`. Letters, digits and `._/@-` only, at most 200 characters."
 );
 var MAX_ANCESTOR_DEPTH = 64;
@@ -1821,40 +2292,40 @@ function describeVeto(verdict) {
 }
 
 // src/consensus/types-voting-protocol.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 var VOTING_ROUND_DEFAULT_TIMEOUT_MS = OPERATION_CLASSES["multi-llm-panel"].guardMs;
-var VotingRoundPhaseSchema = z4.enum(["analysis", "deliberation", "consensus"]);
-var VotingRoundStatusSchema = z4.enum([
+var VotingRoundPhaseSchema = z5.enum(["analysis", "deliberation", "consensus"]);
+var VotingRoundStatusSchema = z5.enum([
   "pending",
   "in_progress",
   "awaiting_votes",
   "completed",
   "aborted"
 ]);
-var AgentFindingSchema = z4.object({
-  agentId: z4.string(),
-  category: z4.enum(["bug", "security", "performance", "style", "design", "documentation", "other"]),
-  severity: z4.enum(["critical", "major", "minor", "suggestion"]),
-  description: z4.string().min(1),
-  location: z4.string().optional().describe("File path and line range if applicable"),
-  suggestion: z4.string().optional().describe("Recommended fix"),
-  confidence: z4.number().min(0).max(1),
-  timestamp: z4.iso.datetime().optional()
+var AgentFindingSchema = z5.object({
+  agentId: z5.string(),
+  category: z5.enum(["bug", "security", "performance", "style", "design", "documentation", "other"]),
+  severity: z5.enum(["critical", "major", "minor", "suggestion"]),
+  description: z5.string().min(1),
+  location: z5.string().optional().describe("File path and line range if applicable"),
+  suggestion: z5.string().optional().describe("Recommended fix"),
+  confidence: z5.number().min(0).max(1),
+  timestamp: z5.iso.datetime().optional()
 });
-var FindingVoteSchema = z4.object({
-  agentId: z4.string(),
-  findingId: z4.string(),
-  agree: z4.boolean(),
-  reasoning: z4.string().optional(),
-  amendedSeverity: z4.enum(["critical", "major", "minor", "suggestion"]).optional()
+var FindingVoteSchema = z5.object({
+  agentId: z5.string(),
+  findingId: z5.string(),
+  agree: z5.boolean(),
+  reasoning: z5.string().optional(),
+  amendedSeverity: z5.enum(["critical", "major", "minor", "suggestion"]).optional()
 });
-var VotingProtocolConfigSchema = z4.object({
-  committeeSize: z4.number().int().min(2).max(7).default(3),
-  maxRounds: z4.number().int().min(1).max(5).default(3),
-  roundTimeoutMs: z4.number().int().positive().default(VOTING_ROUND_DEFAULT_TIMEOUT_MS),
-  agreementThreshold: z4.number().min(0.5).max(1).default(SUPERMAJORITY_THRESHOLD),
-  enableAntiSycophancy: z4.boolean().default(true),
-  sycophancyThreshold: z4.number().min(0).max(1).default(0.8)
+var VotingProtocolConfigSchema = z5.object({
+  committeeSize: z5.number().int().min(2).max(7).default(3),
+  maxRounds: z5.number().int().min(1).max(5).default(3),
+  roundTimeoutMs: z5.number().int().positive().default(VOTING_ROUND_DEFAULT_TIMEOUT_MS),
+  agreementThreshold: z5.number().min(0.5).max(1).default(SUPERMAJORITY_THRESHOLD),
+  enableAntiSycophancy: z5.boolean().default(true),
+  sycophancyThreshold: z5.number().min(0).max(1).default(0.8)
 });
 var DEFAULT_VOTING_PROTOCOL_CONFIG = {
   committeeSize: 3,
@@ -1867,30 +2338,30 @@ var DEFAULT_VOTING_PROTOCOL_CONFIG = {
 };
 
 // src/consensus/types-weighted-voting.ts
-import { z as z5 } from "zod";
-var TaskOutcomeStatusSchema = z5.enum(["success", "failure", "partial", "unknown"]);
-var WeightedAgentRecordSchema = z5.object({
-  agentId: z5.string().min(1),
-  totalTasks: z5.number().int().nonnegative(),
-  successfulTasks: z5.number().int().nonnegative(),
-  failedTasks: z5.number().int().nonnegative(),
-  partialTasks: z5.number().int().nonnegative(),
-  successRate: z5.number().min(0).max(1),
-  weight: z5.number().min(0).max(1),
-  trustScore: z5.number().min(0).max(1),
-  byzantineFlags: z5.number().int().nonnegative(),
-  lastActive: z5.date(),
-  createdAt: z5.date()
+import { z as z6 } from "zod";
+var TaskOutcomeStatusSchema = z6.enum(["success", "failure", "partial", "unknown"]);
+var WeightedAgentRecordSchema = z6.object({
+  agentId: z6.string().min(1),
+  totalTasks: z6.number().int().nonnegative(),
+  successfulTasks: z6.number().int().nonnegative(),
+  failedTasks: z6.number().int().nonnegative(),
+  partialTasks: z6.number().int().nonnegative(),
+  successRate: z6.number().min(0).max(1),
+  weight: z6.number().min(0).max(1),
+  trustScore: z6.number().min(0).max(1),
+  byzantineFlags: z6.number().int().nonnegative(),
+  lastActive: z6.date(),
+  createdAt: z6.date()
 });
-var WeightedVotingConfigSchema = z5.object({
-  minWeight: z5.number().min(0).max(1).default(0.1),
-  maxByzantineFraction: z5.number().min(0).max(0.5).default(0.33),
-  weightDecayFactor: z5.number().min(0.5).max(1).default(0.9),
-  weightRecoveryFactor: z5.number().min(1).max(2).default(1.05),
-  minTrustScore: z5.number().min(0).max(1).default(0.3),
-  byzantineFlagThreshold: z5.number().int().positive().default(3),
-  initialWeight: z5.number().min(0).max(1).default(0.5),
-  quorumThreshold: z5.number().min(0.5).max(1).default(SUPERMAJORITY_THRESHOLD)
+var WeightedVotingConfigSchema = z6.object({
+  minWeight: z6.number().min(0).max(1).default(0.1),
+  maxByzantineFraction: z6.number().min(0).max(0.5).default(0.33),
+  weightDecayFactor: z6.number().min(0.5).max(1).default(0.9),
+  weightRecoveryFactor: z6.number().min(1).max(2).default(1.05),
+  minTrustScore: z6.number().min(0).max(1).default(0.3),
+  byzantineFlagThreshold: z6.number().int().positive().default(3),
+  initialWeight: z6.number().min(0).max(1).default(0.5),
+  quorumThreshold: z6.number().min(0.5).max(1).default(SUPERMAJORITY_THRESHOLD)
 });
 var DEFAULT_WEIGHTED_VOTING_CONFIG = {
   minWeight: 0.1,
@@ -1905,7 +2376,7 @@ var DEFAULT_WEIGHTED_VOTING_CONFIG = {
 };
 
 // src/consensus/higher-order-types.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 function createAgentPairKey(agentA, agentB) {
   return agentA < agentB ? `${agentA}:${agentB}` : `${agentB}:${agentA}`;
 }
@@ -1916,52 +2387,52 @@ function parseAgentPairKey(key) {
   }
   return [parts[0], parts[1]];
 }
-var CorrelationCoefficientSchema = z6.number().min(-1).max(1);
-var IndependentSubsetSchema = z6.object({
-  id: z6.string(),
-  agentIds: z6.array(z6.string()),
-  independenceScore: z6.number().min(0).max(1),
-  pairCoverage: z6.object({
-    observed: z6.number().int().nonnegative(),
-    total: z6.number().int().nonnegative()
+var CorrelationCoefficientSchema = z7.number().min(-1).max(1);
+var IndependentSubsetSchema = z7.object({
+  id: z7.string(),
+  agentIds: z7.array(z7.string()),
+  independenceScore: z7.number().min(0).max(1),
+  pairCoverage: z7.object({
+    observed: z7.number().int().nonnegative(),
+    total: z7.number().int().nonnegative()
   }),
-  observationCount: z6.number().int().nonnegative()
+  observationCount: z7.number().int().nonnegative()
 });
-var VotingObservationSchema = z6.object({
-  proposalId: z6.string(),
-  agentId: z6.string(),
-  decision: z6.enum(["approve", "reject", "abstain"]),
-  confidence: z6.number().min(0).max(1),
-  alignedWithOutcome: z6.boolean(),
-  timestamp: z6.date(),
-  modelKey: z6.string().optional(),
-  observedModel: z6.string().optional()
+var VotingObservationSchema = z7.object({
+  proposalId: z7.string(),
+  agentId: z7.string(),
+  decision: z7.enum(["approve", "reject", "abstain"]),
+  confidence: z7.number().min(0).max(1),
+  alignedWithOutcome: z7.boolean(),
+  timestamp: z7.date(),
+  modelKey: z7.string().optional(),
+  observedModel: z7.string().optional()
 });
-var PairwiseVotingHistorySchema = z6.object({
-  pairKey: z6.string(),
-  jointObservations: z6.number().int().nonnegative(),
-  agreements: z6.number().int().nonnegative(),
-  disagreements: z6.number().int().nonnegative(),
+var PairwiseVotingHistorySchema = z7.object({
+  pairKey: z7.string(),
+  jointObservations: z7.number().int().nonnegative(),
+  agreements: z7.number().int().nonnegative(),
+  disagreements: z7.number().int().nonnegative(),
   correlation: CorrelationCoefficientSchema,
-  lastUpdated: z6.date()
+  lastUpdated: z7.date()
 });
-var HigherOrderVotingConfigSchema = z6.object({
-  minObservationsForCorrelation: z6.number().int().positive().default(10),
-  correlationThreshold: z6.number().min(0).max(1).default(0.3),
+var HigherOrderVotingConfigSchema = z7.object({
+  minObservationsForCorrelation: z7.number().int().positive().default(10),
+  correlationThreshold: z7.number().min(0).max(1).default(0.3),
   /**
    * @deprecated Ignored since 8.x: correlation evidence is lifetime and partitioned by the role's pinned model (#5555); nothing reads this value. Removed in the next major (#5564).
    */
-  correlationMaxAgeMs: z6.number().int().positive().default(864e5),
+  correlationMaxAgeMs: z7.number().int().positive().default(864e5),
   // 24 hours
-  independenceThreshold: z6.number().min(0).max(1).default(0.2),
-  fallbackToSimpleVoting: z6.boolean().default(true),
+  independenceThreshold: z7.number().min(0).max(1).default(0.2),
+  fallbackToSimpleVoting: z7.boolean().default(true),
   /**
    * @deprecated Ignored since 8.x: correlation evidence is lifetime and partitioned by the role's pinned model (#5555); nothing reads this value. Removed in the next major (#5564).
    */
-  observationDecayFactor: z6.number().min(0).max(1).default(0.95),
-  maxObservationsPerAgent: z6.number().int().positive().default(1e3),
-  maxProposals: z6.number().int().positive().default(5e3),
-  maxTrackedPairs: z6.number().int().positive().default(100)
+  observationDecayFactor: z7.number().min(0).max(1).default(0.95),
+  maxObservationsPerAgent: z7.number().int().positive().default(1e3),
+  maxProposals: z7.number().int().positive().default(5e3),
+  maxTrackedPairs: z7.number().int().positive().default(100)
 });
 var DEFAULT_HIGHER_ORDER_CONFIG = {
   minObservationsForCorrelation: 10,
@@ -1975,25 +2446,25 @@ var DEFAULT_HIGHER_ORDER_CONFIG = {
   maxProposals: 5e3,
   maxTrackedPairs: 100
 };
-var HigherOrderVotingResultSchema = z6.object({
-  decision: z6.enum(["approve", "reject", "no_consensus"]),
-  posteriorApproval: z6.number().min(0).max(1),
-  posteriorRejection: z6.number().min(0).max(1),
-  effectiveVoteCount: z6.number().nonnegative(),
-  usedCorrelationData: z6.boolean(),
-  method: z6.enum(["ow", "isp", "simple"]),
-  improvementOverBaseline: z6.number(),
-  independentSubsets: z6.array(IndependentSubsetSchema).optional(),
-  downweightedAgents: z6.array(z6.string()),
-  reasoning: z6.string()
+var HigherOrderVotingResultSchema = z7.object({
+  decision: z7.enum(["approve", "reject", "no_consensus"]),
+  posteriorApproval: z7.number().min(0).max(1),
+  posteriorRejection: z7.number().min(0).max(1),
+  effectiveVoteCount: z7.number().nonnegative(),
+  usedCorrelationData: z7.boolean(),
+  method: z7.enum(["ow", "isp", "simple"]),
+  improvementOverBaseline: z7.number(),
+  independentSubsets: z7.array(IndependentSubsetSchema).optional(),
+  downweightedAgents: z7.array(z7.string()),
+  reasoning: z7.string()
 });
-var CorrelationTrackerStatsSchema = z6.object({
-  totalAgents: z6.number().int().nonnegative(),
-  trackedPairs: z6.number().int().nonnegative(),
-  totalObservations: z6.number().int().nonnegative(),
-  averageCorrelation: z6.number(),
-  independentSubsetCount: z6.number().int().nonnegative(),
-  pairsWithSufficientData: z6.number().int().nonnegative()
+var CorrelationTrackerStatsSchema = z7.object({
+  totalAgents: z7.number().int().nonnegative(),
+  trackedPairs: z7.number().int().nonnegative(),
+  totalObservations: z7.number().int().nonnegative(),
+  averageCorrelation: z7.number(),
+  independentSubsetCount: z7.number().int().nonnegative(),
+  pairsWithSufficientData: z7.number().int().nonnegative()
 });
 
 // src/consensus/higher-order-helpers.ts
@@ -5005,24 +5476,24 @@ function createCorrelationTracker(config) {
 import * as fs from "node:fs";
 
 // src/consensus/correlation-persistence-records.ts
-import { z as z7 } from "zod";
-var PersistedVoteSchema = z7.object({
-  agentId: z7.string(),
-  decision: z7.enum(["approve", "reject", "abstain"]),
-  confidence: z7.number().min(0).max(1),
-  modelKey: z7.string().optional(),
-  observedModel: z7.string().optional()
+import { z as z8 } from "zod";
+var PersistedVoteSchema = z8.object({
+  agentId: z8.string(),
+  decision: z8.enum(["approve", "reject", "abstain"]),
+  confidence: z8.number().min(0).max(1),
+  modelKey: z8.string().optional(),
+  observedModel: z8.string().optional()
 });
-var PersistedProposalSchema = z7.object({
-  proposalId: z7.string(),
-  votes: z7.array(PersistedVoteSchema),
-  outcome: z7.enum(["approved", "rejected"]),
-  timestamp: z7.iso.datetime()
+var PersistedProposalSchema = z8.object({
+  proposalId: z8.string(),
+  votes: z8.array(PersistedVoteSchema),
+  outcome: z8.enum(["approved", "rejected"]),
+  timestamp: z8.iso.datetime()
 });
-var PersistedCorrelationDataSchema = z7.object({
-  version: z7.number().int().positive(),
-  proposals: z7.array(PersistedProposalSchema),
-  savedAt: z7.iso.datetime()
+var PersistedCorrelationDataSchema = z8.object({
+  version: z8.number().int().positive(),
+  proposals: z8.array(PersistedProposalSchema),
+  savedAt: z8.iso.datetime()
 });
 function createPersistedProposal(proposalId, votes, outcome, context) {
   const persistedVotes = [];
@@ -5270,449 +5741,40 @@ import { z as z9 } from "zod";
 function answeringSeats(votes) {
   return votes.filter((v) => v.source === "llm");
 }
-function resolvedModel(v) {
-  return v.model === void 0 || v.model === "" || v.model === UNRESOLVED_MODEL_ID ? void 0 : v.model;
-}
-function seatFallbacks(votes) {
-  const out = [];
-  for (const v of answeringSeats(votes)) {
-    if (v.fallback === void 0) continue;
-    out.push({
-      role: v.role,
-      fallback: v.fallback,
-      toCli: v.cli === void 0 ? "?" : bareCliName(v.cli),
-      toModel: resolvedModel(v)
-    });
-  }
-  return out;
-}
-function panelDiversityOf(votes) {
-  const models = answeringSeats(votes).map(resolvedModel).filter((m) => m !== void 0);
-  return {
-    distinctModels: countDistinctModels(models),
-    fallbacks: seatFallbacks(votes).length
-  };
-}
-var MIN_PANEL_FOR_DIVERSITY_WARNING = 3;
-function singleModelPanelWarning(votes) {
-  if (votes.length < MIN_PANEL_FOR_DIVERSITY_WARNING) return void 0;
-  const answered = answeringSeats(votes);
-  const models = answered.map(resolvedModel);
-  const model = models[0];
-  if (model === void 0 || models.includes(void 0)) return void 0;
-  if (panelDiversityOf(votes).distinctModels !== 1) return void 0;
-  const silent = votes.length - answered.length;
-  const missing = silent > 0 ? ` (${String(silent)} did not answer)` : "";
-  return `All ${String(answered.length)} seats answered on ${model}${missing}; independence is weaker than assigned.`;
-}
-
-// src/audit/vote-record.ts
-import * as crypto from "node:crypto";
-import { z as z8 } from "zod";
-var VoteRecordDecisionSchema = z8.enum(["approved", "rejected", "no_quorum"]);
-var VoteRecordOptionCoverageSchema = z8.object({
-  /** Every approving voter, selecting or not — the tally's denominator. */
-  approverCount: z8.number().int().nonnegative(),
-  /** Approvers whose selection matched a declared option. */
-  selectedCount: z8.number().int().nonnegative(),
-  /** Approvers with no usable selection; their choice is unmeasured. */
-  unattributedApprovals: z8.number().int().nonnegative()
-}).strict();
-var VoteRecordPanelCoverageSchema = z8.object({
-  /** Voters the panel asked for. */
-  requested: z8.number().int().nonnegative(),
-  /** Voters that returned a usable vote — the denominator of `voteCounts`. */
-  responded: z8.number().int().nonnegative(),
-  /** Voters that errored or timed out. */
-  errored: z8.number().int().nonnegative(),
-  /** The roles behind `errored`, in panel order. */
-  erroredRoles: z8.array(z8.string().min(1).max(100))
-}).strict();
-var MAX_VOTER_REASONING_CHARS = 2e4;
-var SeatFallbackRecordSchema = z8.object({
-  /** The CLI the seat was assigned to, bare (`claude`, not `cli-claude`). */
-  fromCli: z8.string().min(1).max(100),
-  /** The model the assigned adapter had detected, when it had one. */
-  fromModel: z8.string().min(1).max(200).optional(),
-  /** The adapter-layer class of the error that moved the seat. */
-  reason: z8.enum(["rate-limit", "capacity", "auth", "timeout", "sandbox", "unknown"])
-}).strict();
-var VoterSummarySchema = z8.object({
-  role: z8.string().min(1).max(100),
-  decision: z8.enum(["approve", "reject", "abstain"]),
-  confidence: z8.number().min(0).max(1),
-  /**
-   * The voter's stated grounds (#5373, schema 1.6).
-   *
-   * `generateVoteHash` already hashed `{role, decision, reasoning}` and then
-   * discarded the text, so the chain attested to a value it did not store and
-   * nobody could re-verify the hash without re-obtaining the reasoning. On
-   * #5228 a contrarian rejection was clipped mid-sentence in the terminal, the
-   * grounds were unrecoverable, and the same defect resurfaced a round later —
-   * one round of a 7-voter panel is 7-13 minutes of model time, and the
-   * objection was right both times.
-   *
-   * Stored whole rather than sampled. Warn-mode near-misses are emitted per
-   * TOOL CALL, thousands a day; votes are emitted per PANEL, dozens a day at
-   * most, so ~17 KB per vote is not the same growth problem.
-   *
-   * Absence is not an empty argument: an errored voter has no entry in
-   * `voters` at all (see `panelCoverage`), so `reasoning: ''` means a live
-   * voter returned nothing, which is itself a signal.
-   */
-  reasoning: z8.string().max(MAX_VOTER_REASONING_CHARS).optional(),
-  /** True when `reasoning` was clipped to {@link MAX_VOTER_REASONING_CHARS}. */
-  reasoningTruncated: z8.literal(true).optional(),
-  /**
-   * True when this seat was recovered by the per-role retry (#6050, schema 1.7).
-   *
-   * `voter-retry.ts` has set `retried: true` on recovered results since it was
-   * written, and `vote-types.ts` states the reason: the flag is "what makes the
-   * recovery visible instead of indistinguishable from a clean first attempt".
-   * It had one producer and ZERO consumers — both summarizers and the record
-   * dropped it — so the field existed, was documented, and never reached
-   * anything that could act on it.
-   *
-   * A retried seat is weaker evidence than a first-pass one: the model was
-   * unavailable or timed out, and the recovery ran under different conditions.
-   * For a ratification vote on a governor-path change, "7 of 7 answered" and
-   * "6 answered, 1 recovered on retry" are different facts about the scrutiny
-   * the change received, and the record stated the first for both.
-   *
-   * `literal(true)` and optional, on the `reasoningTruncated` rule: a clean
-   * seat carries no key, so its entry re-hashes byte-identical and every
-   * historical record still verifies.
-   */
-  retried: z8.literal(true).optional(),
-  /**
-   * Registry model id the seat ran on (#6091, schema 1.8).
-   *
-   * The seat→model mapping is round-robin over the available CLIs plus
-   * `NEXUS_VOTER_MODEL_<ROLE>` pins, so it is not recoverable from the
-   * ledger after the fact: 1844 voter entries across 278 records carried no
-   * model. "When an agent's output becomes evidence, its provenance travels
-   * with it" — a tally that says `scope_steward: approve` without saying
-   * which model answered cannot be audited for the #6068 failure class.
-   * Present-only, on the `retried` rule; absent when the result carried no
-   * model or only the pending-detection placeholder.
-   */
-  model: z8.string().min(1).max(200).optional(),
-  /**
-   * True when the seat could not read the artifact (#6094, schema 1.8).
-   *
-   * `decision` is `abstain` for such a seat, so without this flag the record
-   * could not tell "read it and abstained" from "never saw it" — and one
-   * ledger entry (`vote-1789058788915-6lfrbuq`) shows a seat that APPROVED
-   * on the proposal text after failing to read. `literal(true)` and
-   * present-only, so every pre-1.8 entry re-hashes byte-identical.
-   */
-  unverifiable: z8.literal(true).optional(),
-  /**
-   * The CLI the round-robin or `NEXUS_VOTER_MODEL_<ROLE>` pin chose for the
-   * seat, as a bare name (#6115, schema 1.9). `model` says where a seat
-   * answered; this says where it was MEANT to. Three consecutive 7-seat
-   * ratification panels on 2026-09-13 answered every seat on one gemini
-   * model while the assignment was three claude, two codex, two gemini,
-   * and the 1.8 record showed seven identical `model` values with nothing
-   * that said five of them were substitutes. Present-only, on the `model`
-   * rule; absent on a result built outside the panel launcher.
-   */
-  assignedCli: z8.string().min(1).max(100).optional(),
-  /**
-   * Present only when the seat answered on a different CLI or model than
-   * assigned (#6115, schema 1.9): the exact `SeatFallback` shape the live
-   * result carries, rebuilt field-by-field. `fromCli` is the assigned CLI,
-   * `fromModel` the model it had detected (absent when it never did — the
-   * pending-detection placeholder is not a model), `reason` the adapter
-   * layer's error class. The vocabulary is compile-checked against the live
-   * `FallbackReason` in vote-record.test.ts; a class one side learns alone
-   * would either refuse every record that carries it (#6054) or accept one
-   * no producer can write.
-   */
-  fallback: SeatFallbackRecordSchema.optional()
-}).strict();
-function defineVoterKeys(keys) {
-  return keys;
-}
-var VOTER_SUMMARY_KEYS = defineVoterKeys([
-  "role",
-  "decision",
-  "confidence",
-  "reasoning",
-  "reasoningTruncated",
-  "retried",
-  // 1.8 (#6091, #6094): appended after `retried`, present-only, so a 1.7
-  // entry projects byte-identically.
-  "model",
-  "unverifiable",
-  // 1.9 (#6115): appended after `unverifiable`, present-only, so a 1.8 entry
-  // projects byte-identically. `fallback` is the first nested voter field;
-  // `projectSeatFallback` rebuilds it in its own canonical order.
-  "assignedCli",
-  "fallback"
-]);
-function noUnprojectedKeys(rest) {
-  return rest;
-}
-function projectSeatFallback(f) {
-  const { fromCli, fromModel, reason, ...rest } = f;
-  noUnprojectedKeys(rest);
-  return {
-    fromCli,
-    ...fromModel !== void 0 ? { fromModel } : {},
-    reason
-  };
-}
-function projectVoterSummary(v) {
-  const out = {};
-  for (const key of VOTER_SUMMARY_KEYS) {
-    const value = key === "fallback" ? v.fallback === void 0 ? void 0 : projectSeatFallback(v.fallback) : v[key];
-    if (value !== void 0) out[key] = value;
+function resolvedModel(v) {
+  return v.model === void 0 || v.model === "" || v.model === UNRESOLVED_MODEL_ID ? void 0 : v.model;
+}
+function seatFallbacks(votes) {
+  const out = [];
+  for (const v of answeringSeats(votes)) {
+    if (v.fallback === void 0) continue;
+    out.push({
+      role: v.role,
+      fallback: v.fallback,
+      toCli: v.cli === void 0 ? "?" : bareCliName(v.cli),
+      toModel: resolvedModel(v)
+    });
   }
   return out;
 }
-var VoteRecordCountsSchema = z8.object({
-  approve: z8.number().int().nonnegative(),
-  reject: z8.number().int().nonnegative(),
-  abstain: z8.number().int().nonnegative(),
-  total: z8.number().int().nonnegative()
-}).strict();
-var VoteRecordOptionCountSchema = z8.object({
-  /** The option label as declared in the proposal (e.g. 'A'). */
-  option: z8.string().min(1),
-  /** How many voters selected it. */
-  count: z8.number().int().nonnegative()
-}).strict();
-var GIT_SHA_PATTERN = /^[0-9a-f]{40}$/;
-var VoteRecordPrBindingSchema = z8.object({
-  pr: z8.number().int().positive(),
-  headSha: z8.string().regex(GIT_SHA_PATTERN, "expected a full 40-hex lowercase commit sha")
-}).strict();
-function projectPrBinding(b) {
-  return { pr: b.pr, headSha: b.headSha };
-}
-var VoteRecordErrorPolicySchema = z8.enum([
-  "reduce_denominator",
-  "count_as_abstain",
-  "fail_closed",
-  "absolute_quorum"
-]);
-var VoteRecordSchema = z8.object({
-  /**
-   * Schema version. '1.1' marked the chain→record-set+sequence model (#3927);
-   * '1.2' adds the optional `ratifies` subject-binding field (#3927 item 1);
-   * '1.10' adds the optional `ratifiesPr` PR-binding (#5130); '1.11' the
-   * optional `errorPolicy` (#6211). Every tier is accepted — a 1.1 record
-   * (no `ratifies`) verifies unchanged because each optional is folded into
-   * the self-hash ONLY when present (see {@link computeVoteRecordHash}).
-   * Tiers are labels, not ordered numbers: '1.10' follows '1.9' by
-   * convention only and nothing compares them.
-   */
-  version: z8.enum([
-    "1.1",
-    "1.2",
-    "1.3",
-    "1.4",
-    "1.5",
-    "1.6",
-    "1.7",
-    "1.8",
-    "1.9",
-    "1.10",
-    "1.11"
-  ]),
-  /** Unique record id (also usable as a `ratificationVoteRef`). */
-  id: z8.string().min(1),
-  /**
-   * Monotonic sequence number (integer ≥ 0). Assigned as (max existing
-   * sequence)+1 at write time. Sorted, the set of sequences must cover
-   * 0..maxSeq with no gap (omission detection); DUPLICATE sequences are a
-   * benign concurrent-fork signal, not tampering.
-   */
-  sequence: z8.number().int().nonnegative(),
-  /** ISO-8601 timestamp the vote was recorded. */
-  recordedAt: z8.string().min(1),
-  /**
-   * SHA-256 of the FULL proposal text. The proposal itself is truncated for
-   * the human record (`proposal`), but the hash binds the record to the exact
-   * proposal voted on — a later edit of `proposal` that changes meaning is
-   * detectable by recomputing this hash from the original.
-   */
-  proposalHash: z8.string().length(64),
-  /** Truncated proposal text for the human/reviewer record. */
-  proposal: z8.string(),
-  /** The voting strategy used. */
-  strategy: z8.enum([
-    "simple_majority",
-    "supermajority",
-    "unanimous",
-    "higher_order",
-    "opinion_wise",
-    "proof_of_learning"
-  ]),
-  /** The resolved decision. */
-  decision: VoteRecordDecisionSchema,
-  /** Approval fraction as a percentage (0-100). */
-  approvalPercentage: z8.number().min(0).max(100),
-  /** Vote-count breakdown. */
-  voteCounts: VoteRecordCountsSchema,
-  /** Per-voter {role, decision, confidence} summary. */
-  voters: z8.array(VoterSummarySchema),
-  /** Optional correlation/decision id linking to the cost rollup / trace. */
-  correlationId: z8.string().min(1).optional(),
-  /**
-   * Per-option distribution for a multi-option proposal (#4452, schema 1.3).
-   *
-   * Present only when the vote declared `options`. Absent on an ordinary
-   * yes/no vote, and absent on every 1.1/1.2 record — which is why it is
-   * folded into the self-hash ONLY when present (see
-   * {@link computeVoteRecordHash}), exactly as `ratifies` was.
-   *
-   * Without this, a 6-1 or 5-2 option split is recorded as `approve: 7` and
-   * reads as unanimous. Threshold semantics invert too: `unanimous` becomes
-   * the EASIEST bar to clear, because every engaged voter approves while
-   * choosing different things.
-   */
-  // No `.min(1)` (#6049). The rule this field's own docstring states is
-  // "present only when the vote declared `options`" -- keyed on DECLARATION,
-  // not on whether anyone picked one. `.min(1)` encoded the older, narrower
-  // rule, so once the builder started emitting `[]` for "declared, nothing
-  // attributable" the record appended fine and then failed to parse on read:
-  // `too_small, minimum 1`. The write path does not validate, so the line
-  // landed in the ledger and `parseVoteRecordsText` silently dropped it --
-  // the case most worth auditing became the one no reader could see.
-  //
-  // Relaxing is a pure widening: no previously-valid record changes meaning
-  // or hash, and no persisted record can currently hold an empty tally.
-  optionTally: z8.array(VoteRecordOptionCountSchema).optional(),
-  /**
-   * Selection coverage for a multi-option vote (#4472, schema 1.4).
-   *
-   * `optionTally` alone cannot distinguish dissent from absence: `4 pick X
-   * + 3 unreadable` and a genuine 4/3 split both leave a leading share of
-   * 57%. Recording how many approvers produced no usable selection is what
-   * makes a partial measurement legible AS partial — the condition every
-   * voter attached to adopting the "credit no option" rule.
-   */
-  optionCoverage: VoteRecordOptionCoverageSchema.optional(),
-  /**
-   * Panel coverage (#5738, schema 1.5). Present only when at least one
-   * requested voter failed to return a vote; absent keeps a clean panel on
-   * the pre-1.5 projection, so every historical record still verifies.
-   */
-  panelCoverage: VoteRecordPanelCoverageSchema.optional(),
-  /**
-   * The loop/strategy subject this vote RATIFIES (#3927 item 1). Present only on
-   * a ratification vote; set at vote time and bound into the self-hash (so it is
-   * tamper-evident). The authority-tier promotion gate
-   * (`scripts/check-authority-tier-drift.ts`) resolves a transition's
-   * `ratificationVoteRef` to a record and requires `ratifies === transition.subject`
-   * (with `decision === 'approved'` and `strategy === 'higher_order'`). Absent on
-   * an ordinary (non-ratification) vote; a 1.1 record never carries it.
-   */
-  ratifies: z8.string().min(1).optional(),
-  /**
-   * The PR this vote RATIFIES, bound to the head the panel saw (#5130 step 1,
-   * schema 1.10; panel decision Q1 option A, 5 of 6). Present only on a
-   * governor-path ratification vote; hash-covered like `ratifies`, so a
-   * record cannot be repointed at a different PR or a later push without
-   * breaking its hash. The governor gate (step 2, #5779/#5131) resolves the
-   * record from the committed ledger and requires `pr` to be the PR under
-   * review and `headSha` to be its head (or `head^` when `head` touches only
-   * the ledger — the caller-commits tip). Absent on every pre-1.10 record.
-   *
-   * A SEPARATE key rather than a structured encoding of `ratifies`: that
-   * field is the authority-ladder SUBJECT, compared by string equality to
-   * `transition.subject` and grouped by `conflictingRatifiedSubjects`; no
-   * resolver parses it. Overloading it would give one field two consumers
-   * with two equality rules. The two may coexist on one record.
-   */
-  ratifiesPr: VoteRecordPrBindingSchema.optional(),
-  /**
-   * The error policy the panel actually ran under (#6211, schema 1.11): the
-   * EFFECTIVE policy after `consensus_vote` applied the per-strategy default
-   * (`input.errorPolicy ?? getDefaultErrorPolicy(strategy)`), not the raw
-   * input the caller may have omitted. Hash-covered, present-only.
-   *
-   * Before this tier the policy reached the RESPONSE only, so the governor
-   * ledger gate (`scripts/governor-ledger-evidence.ts`) could not say which
-   * policy a whole-panel ratification was configured with: under
-   * `absolute_quorum` an errored seat voids the vote, so the one
-   * ledger-observable trace of a different policy was an approved record
-   * with `panelCoverage.errored > 0` — and a whole panel under
-   * `reduce_denominator` looked exactly like one under `absolute_quorum`.
-   * The gate's `wrong-error-policy` verdict reads this field; a record
-   * without it (every pre-1.11 record) keeps the panel-coverage inference
-   * and is reported as `errorPolicy: unrecorded`.
-   */
-  errorPolicy: VoteRecordErrorPolicySchema.optional(),
-  /**
-   * ADVISORY hash of the tip record at write time (absent for the first).
-   * Retained for audit texture but NOT covered by `hash` and NOT verified —
-   * the record-set model is position-independent (#3927).
-   */
-  previousHash: z8.string().length(64).optional(),
-  /** SHA-256 over every field above EXCEPT `previousHash` (and except `hash`). */
-  hash: z8.string().length(64)
-}).strict();
-function foldOptionalFields(base, payload) {
-  const withTally = payload.optionTally !== void 0 ? {
-    ...base,
-    optionTally: payload.optionTally.map((o) => ({ option: o.option, count: o.count }))
-  } : base;
-  const withCoverage = payload.optionCoverage !== void 0 ? {
-    ...withTally,
-    optionCoverage: {
-      approverCount: payload.optionCoverage.approverCount,
-      selectedCount: payload.optionCoverage.selectedCount,
-      unattributedApprovals: payload.optionCoverage.unattributedApprovals
-    }
-  } : withTally;
-  const withPanel = payload.panelCoverage !== void 0 ? {
-    ...withCoverage,
-    panelCoverage: {
-      requested: payload.panelCoverage.requested,
-      responded: payload.panelCoverage.responded,
-      errored: payload.panelCoverage.errored,
-      erroredRoles: [...payload.panelCoverage.erroredRoles]
-    }
-  } : withCoverage;
-  const withRatifies = payload.ratifies !== void 0 ? { ...withPanel, ratifies: payload.ratifies } : withPanel;
-  const withPrBinding = payload.ratifiesPr !== void 0 ? { ...withRatifies, ratifiesPr: projectPrBinding(payload.ratifiesPr) } : withRatifies;
-  return payload.errorPolicy !== void 0 ? { ...withPrBinding, errorPolicy: payload.errorPolicy } : withPrBinding;
-}
-function computeVoteRecordHash(payload) {
-  const base = {
-    version: payload.version,
-    id: payload.id,
-    sequence: payload.sequence,
-    recordedAt: payload.recordedAt,
-    proposalHash: payload.proposalHash,
-    proposal: payload.proposal,
-    strategy: payload.strategy,
-    decision: payload.decision,
-    approvalPercentage: payload.approvalPercentage,
-    // Rebuild voteCounts in schema order (approve, reject, abstain, total) so the
-    // hash does not depend on how the nested object's keys were ordered (#3962).
-    voteCounts: {
-      approve: payload.voteCounts.approve,
-      reject: payload.voteCounts.reject,
-      abstain: payload.voteCounts.abstain,
-      total: payload.voteCounts.total
-    },
-    // `reasoning` / `reasoningTruncated` (#5373, schema 1.6) are appended per
-    // entry ONLY when present, on the same rule as the record-level optional
-    // fields: a pre-1.6 voter entry re-hashes byte-identical, so every
-    // historical record still verifies, while editing or removing a stored
-    // reasoning flips the hash.
-    voters: payload.voters.map(projectVoterSummary),
-    correlationId: payload.correlationId ?? null
+function panelDiversityOf(votes) {
+  const models = answeringSeats(votes).map(resolvedModel).filter((m) => m !== void 0);
+  return {
+    distinctModels: countDistinctModels(models),
+    fallbacks: seatFallbacks(votes).length
   };
-  const canonical = JSON.stringify(foldOptionalFields(base, payload));
-  return crypto.createHash("sha256").update(canonical).digest("hex");
 }
-function hashProposal(proposal) {
-  return crypto.createHash("sha256").update(proposal).digest("hex");
+var MIN_PANEL_FOR_DIVERSITY_WARNING = 3;
+function singleModelPanelWarning(votes) {
+  if (votes.length < MIN_PANEL_FOR_DIVERSITY_WARNING) return void 0;
+  const answered = answeringSeats(votes);
+  const models = answered.map(resolvedModel);
+  const model = models[0];
+  if (model === void 0 || models.includes(void 0)) return void 0;
+  if (panelDiversityOf(votes).distinctModels !== 1) return void 0;
+  const silent = votes.length - answered.length;
+  const missing = silent > 0 ? ` (${String(silent)} did not answer)` : "";
+  return `All ${String(answered.length)} seats answered on ${model}${missing}; independence is weaker than assigned.`;
 }
 
 // src/mcp/tools/consensus-vote-option-detection.ts
@@ -5876,7 +5938,9 @@ function toAgentVoteSummary(result) {
     // #6094: same rule for a seat that could not read the artifact.
     ...result.source === "unverifiable" ? { unverifiable: true } : {},
     // #6115: and for a seat that answered elsewhere.
-    ...result.fallback !== void 0 ? { fallback: result.fallback } : {}
+    ...result.fallback !== void 0 ? { fallback: result.fallback } : {},
+    // #6246: and for what a recovered seat was retried from.
+    ...result.retriedFrom !== void 0 ? { retriedFrom: result.retriedFrom } : {}
   };
 }
 function panelDegradationWarning(errorCount, total) {
@@ -6236,17 +6300,18 @@ function toVoterSummaries(votes) {
       // the fallback the live result stated. `model` alone showed seven
       // identical values on a panel assigned three ways and could not say so.
       ...v.assignedCli !== void 0 ? { assignedCli: v.assignedCli } : {},
-      ...v.fallback !== void 0 ? { fallback: projectSeatFallback(v.fallback) } : {}
+      ...v.fallback !== void 0 ? { fallback: projectSeatFallback(v.fallback) } : {},
+      // #6246: what the per-role retry replaced, so the record names both the
+      // seat's final state and the state it recovered from. The live retry
+      // already clipped and de-controlled the cause; this is projection only.
+      ...v.retriedFrom !== void 0 ? { retriedFrom: projectRetriedFrom(v.retriedFrom) } : {}
     });
   }
   return summaries;
 }
 function reasoningFields(reasoning) {
-  if (reasoning.length <= MAX_VOTER_REASONING_CHARS) return { reasoning };
-  return {
-    reasoning: reasoning.slice(0, MAX_VOTER_REASONING_CHARS),
-    reasoningTruncated: true
-  };
+  const { text, truncated } = clipForRecord(reasoning);
+  return { reasoning: text, ...truncated === true ? { reasoningTruncated: true } : {} };
 }
 function recordDecisionFor(input) {
   return input.resolvedDecision ?? outcomeToDecision(input.result, input.votes, input.errorVoided ?? false);
@@ -6260,15 +6325,22 @@ function deriveOptionFields(votes, declaredOptions) {
   return { optionTally: tallied ?? [], optionCoverage: coverageOf(votes) };
 }
 function recordVersion(optionTally, optionCoverage, panelCoverage, voters, recordLevel) {
+  const voterTier = voterTierOf(voters);
+  if (voterTier === "1.12") return "1.12";
   if (recordLevel.errorPolicy !== void 0) return "1.11";
   if (recordLevel.ratifiesPr !== void 0) return "1.10";
+  if (voterTier !== void 0) return voterTier;
+  if (panelCoverage !== void 0) return "1.5";
+  if (optionCoverage !== void 0) return "1.4";
+  return optionTally !== void 0 ? "1.3" : "1.2";
+}
+function voterTierOf(voters) {
+  if (voters.some((v) => v.retriedFrom !== void 0)) return "1.12";
   if (voters.some((v) => v.assignedCli !== void 0 || v.fallback !== void 0)) return "1.9";
   if (voters.some((v) => v.model !== void 0 || v.unverifiable === true)) return "1.8";
   if (voters.some((v) => v.retried === true)) return "1.7";
   if (voters.some((v) => v.reasoning !== void 0)) return "1.6";
-  if (panelCoverage !== void 0) return "1.5";
-  if (optionCoverage !== void 0) return "1.4";
-  return optionTally !== void 0 ? "1.3" : "1.2";
+  return void 0;
 }
 function panelCoverageOf(votes, always) {
   const erroredRoles = votes.filter((v) => v.source === "error").map((v) => v.role);
@@ -8753,6 +8825,7 @@ export {
   DEFAULT_VOTE_TIMEOUT_MS,
   isRateLimitError,
   PersistentOutcomeStore,
+  VoteRecordPrBindingSchema,
   isAbsentSeat,
   NoAdapterError,
   resolveAdapter,
@@ -8805,7 +8878,6 @@ export {
   createCorrelationTracker,
   seatFallbacks,
   panelDiversityOf,
-  VoteRecordPrBindingSchema,
   VotingStrategySchema,
   ErrorPolicySchema,
   VoteThresholdSchema,
@@ -8827,4 +8899,4 @@ export {
   CONSENSUS_VOTE_TOOL_SCHEMA,
   registerConsensusVoteTool
 };
-//# sourceMappingURL=chunk-YF3YIHPZ.js.map
+//# sourceMappingURL=chunk-XKP6IEHD.js.map