nexus-agents 8.58.2 → 8.58.4

package/dist/{chunk-YF3YIHPZ.js → chunk-3A5BXLPV.js}

@@ -1,7 +1,7 @@
 import {
   computeCostDetail,
   priceBasisOf
-} from "./chunk-QSSP62D3.js";
+} from "./chunk-5RSH7N6W.js";
 import {
   allOf
 } from "./chunk-OQB3XC5O.js";
@@ -25,20 +25,20 @@ import {
   toolSuccessStructured,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-JE2TRDX7.js";
+} from "./chunk-IK5FLVX4.js";
 import {
   VERSION
-} from "./chunk-CZN5JK7D.js";
+} from "./chunk-XFUWBS6A.js";
 import {
   UNRESOLVED_MODEL_ID,
   assessPanelIndependence,
   countDistinctModels,
   createEvent,
   getGlobalRegistry
-} from "./chunk-BXP5K5TU.js";
+} from "./chunk-YLBVRBVK.js";
 import {
   getToolMemory
-} from "./chunk-3YICA7KW.js";
+} from "./chunk-HGLRQ4N5.js";
 import {
   authRemediation,
   classifyExtractedError,
@@ -47,7 +47,7 @@ import {
   isTimeoutText,
   sleep,
   withTimeout
-} from "./chunk-3JOMLFC7.js";
+} from "./chunk-4FFTWLHX.js";
 import {
   AgentError,
   CLI_NAMES,
@@ -77,7 +77,7 @@ import {
   registerPersistentOutcomeStoreFactory,
   resolveClassGuardMs,
   resolveVoteTimeout
-} from "./chunk-JF77LAYJ.js";
+} from "./chunk-6DYJTPER.js";
 import {
   ensureLearningDir,
   getOutcomesFile
@@ -280,6 +280,463 @@ function reportPanelModelIndependence(modelIds, roleCount, phase, logger11) {
   );
 }
 
+// src/audit/vote-record.ts
+import * as crypto from "node:crypto";
+import { z as z2 } from "zod";
+var VoteRecordDecisionSchema = z2.enum(["approved", "rejected", "no_quorum"]);
+var VoteRecordOptionCoverageSchema = z2.object({
+  /** Every approving voter, selecting or not — the tally's denominator. */
+  approverCount: z2.number().int().nonnegative(),
+  /** Approvers whose selection matched a declared option. */
+  selectedCount: z2.number().int().nonnegative(),
+  /** Approvers with no usable selection; their choice is unmeasured. */
+  unattributedApprovals: z2.number().int().nonnegative()
+}).strict();
+var VoteRecordPanelCoverageSchema = z2.object({
+  /** Voters the panel asked for. */
+  requested: z2.number().int().nonnegative(),
+  /** Voters that returned a usable vote — the denominator of `voteCounts`. */
+  responded: z2.number().int().nonnegative(),
+  /** Voters that errored or timed out. */
+  errored: z2.number().int().nonnegative(),
+  /** The roles behind `errored`, in panel order. */
+  erroredRoles: z2.array(z2.string().min(1).max(100))
+}).strict();
+var MAX_VOTER_REASONING_CHARS = 2e4;
+function clipForRecord(text) {
+  if (text.length <= MAX_VOTER_REASONING_CHARS) return { text };
+  return { text: text.slice(0, MAX_VOTER_REASONING_CHARS), truncated: true };
+}
+var RetriedFromRecordSchema = z2.object({
+  /** The first pass's `source`: errored, or answered without reading. */
+  source: z2.enum(["error", "unverifiable"]),
+  /** The first pass's `error` string, when it had one; already clipped. */
+  error: z2.string().max(MAX_VOTER_REASONING_CHARS).optional(),
+  /** True when `error` was clipped to {@link MAX_VOTER_REASONING_CHARS}. */
+  errorTruncated: z2.literal(true).optional()
+}).strict();
+var SeatFallbackRecordSchema = z2.object({
+  /** The CLI the seat was assigned to, bare (`claude`, not `cli-claude`). */
+  fromCli: z2.string().min(1).max(100),
+  /** The model the assigned adapter had detected, when it had one. */
+  fromModel: z2.string().min(1).max(200).optional(),
+  /** The adapter-layer class of the error that moved the seat. */
+  reason: z2.enum(["rate-limit", "capacity", "auth", "timeout", "sandbox", "unknown"])
+}).strict();
+var VoterSummarySchema = z2.object({
+  role: z2.string().min(1).max(100),
+  decision: z2.enum(["approve", "reject", "abstain"]),
+  confidence: z2.number().min(0).max(1),
+  /**
+   * The voter's stated grounds (#5373, schema 1.6).
+   *
+   * `generateVoteHash` already hashed `{role, decision, reasoning}` and then
+   * discarded the text, so the chain attested to a value it did not store and
+   * nobody could re-verify the hash without re-obtaining the reasoning. On
+   * #5228 a contrarian rejection was clipped mid-sentence in the terminal, the
+   * grounds were unrecoverable, and the same defect resurfaced a round later —
+   * one round of a 7-voter panel is 7-13 minutes of model time, and the
+   * objection was right both times.
+   *
+   * Stored whole rather than sampled. Warn-mode near-misses are emitted per
+   * TOOL CALL, thousands a day; votes are emitted per PANEL, dozens a day at
+   * most, so ~17 KB per vote is not the same growth problem.
+   *
+   * Absence is not an empty argument: an errored voter has no entry in
+   * `voters` at all (see `panelCoverage`), so `reasoning: ''` means a live
+   * voter returned nothing, which is itself a signal.
+   */
+  reasoning: z2.string().max(MAX_VOTER_REASONING_CHARS).optional(),
+  /** True when `reasoning` was clipped to {@link MAX_VOTER_REASONING_CHARS}. */
+  reasoningTruncated: z2.literal(true).optional(),
+  /**
+   * True when this seat was recovered by the per-role retry (#6050, schema 1.7).
+   *
+   * `voter-retry.ts` has set `retried: true` on recovered results since it was
+   * written, and `vote-types.ts` states the reason: the flag is "what makes the
+   * recovery visible instead of indistinguishable from a clean first attempt".
+   * It had one producer and ZERO consumers — both summarizers and the record
+   * dropped it — so the field existed, was documented, and never reached
+   * anything that could act on it.
+   *
+   * A retried seat is weaker evidence than a first-pass one: the model was
+   * unavailable or timed out, and the recovery ran under different conditions.
+   * For a ratification vote on a governor-path change, "7 of 7 answered" and
+   * "6 answered, 1 recovered on retry" are different facts about the scrutiny
+   * the change received, and the record stated the first for both.
+   *
+   * `literal(true)` and optional, on the `reasoningTruncated` rule: a clean
+   * seat carries no key, so its entry re-hashes byte-identical and every
+   * historical record still verifies.
+   */
+  retried: z2.literal(true).optional(),
+  /**
+   * Registry model id the seat ran on (#6091, schema 1.8).
+   *
+   * The seat→model mapping is round-robin over the available CLIs plus
+   * `NEXUS_VOTER_MODEL_<ROLE>` pins, so it is not recoverable from the
+   * ledger after the fact: 1844 voter entries across 278 records carried no
+   * model. "When an agent's output becomes evidence, its provenance travels
+   * with it" — a tally that says `scope_steward: approve` without saying
+   * which model answered cannot be audited for the #6068 failure class.
+   * Present-only, on the `retried` rule; absent when the result carried no
+   * model or only the pending-detection placeholder.
+   */
+  model: z2.string().min(1).max(200).optional(),
+  /**
+   * True when the seat could not read the artifact (#6094, schema 1.8).
+   *
+   * `decision` is `abstain` for such a seat, so without this flag the record
+   * could not tell "read it and abstained" from "never saw it" — and one
+   * ledger entry (`vote-1789058788915-6lfrbuq`) shows a seat that APPROVED
+   * on the proposal text after failing to read. `literal(true)` and
+   * present-only, so every pre-1.8 entry re-hashes byte-identical.
+   */
+  unverifiable: z2.literal(true).optional(),
+  /**
+   * The CLI the round-robin or `NEXUS_VOTER_MODEL_<ROLE>` pin chose for the
+   * seat, as a bare name (#6115, schema 1.9). `model` says where a seat
+   * answered; this says where it was MEANT to. Three consecutive 7-seat
+   * ratification panels on 2026-09-13 answered every seat on one gemini
+   * model while the assignment was three claude, two codex, two gemini,
+   * and the 1.8 record showed seven identical `model` values with nothing
+   * that said five of them were substitutes. Present-only, on the `model`
+   * rule; absent on a result built outside the panel launcher.
+   */
+  assignedCli: z2.string().min(1).max(100).optional(),
+  /**
+   * Present only when the seat answered on a different CLI or model than
+   * assigned (#6115, schema 1.9): the exact `SeatFallback` shape the live
+   * result carries, rebuilt field-by-field. `fromCli` is the assigned CLI,
+   * `fromModel` the model it had detected (absent when it never did — the
+   * pending-detection placeholder is not a model), `reason` the adapter
+   * layer's error class. The vocabulary is compile-checked against the live
+   * `FallbackReason` in vote-record.test.ts; a class one side learns alone
+   * would either refuse every record that carries it (#6054) or accept one
+   * no producer can write.
+   */
+  fallback: SeatFallbackRecordSchema.optional(),
+  /**
+   * Present only when the per-role retry REPLACED this seat (#6246, schema
+   * 1.12): the first pass's source and, when it had one, its clipped error
+   * string. `retried` (1.7) says a recovery happened; this says what it
+   * recovered from. On the #6241 panel a seat recorded `retried: true,
+   * unverifiable: true` after a first pass that errored on two response-parse
+   * failures, and nothing in the record joined the two — a reader of the
+   * ledger and the log together concluded the parse errors had been
+   * misclassified (#6244). Rebuilt field-by-field on the `fallback` rule; the
+   * `source` vocabulary is compile-checked against the live `RetriedFrom`.
+   */
+  retriedFrom: RetriedFromRecordSchema.optional()
+}).strict();
+function defineVoterKeys(keys) {
+  return keys;
+}
+var VOTER_SUMMARY_KEYS = defineVoterKeys([
+  "role",
+  "decision",
+  "confidence",
+  "reasoning",
+  "reasoningTruncated",
+  "retried",
+  // 1.8 (#6091, #6094): appended after `retried`, present-only, so a 1.7
+  // entry projects byte-identically.
+  "model",
+  "unverifiable",
+  // 1.9 (#6115): appended after `unverifiable`, present-only, so a 1.8 entry
+  // projects byte-identically. `fallback` is the first nested voter field;
+  // `projectSeatFallback` rebuilds it in its own canonical order.
+  "assignedCli",
+  "fallback",
+  // 1.12 (#6246): appended after `fallback`, present-only, so a 1.11 entry
+  // projects byte-identically. Nested; `projectRetriedFrom` rebuilds it in
+  // its own canonical order.
+  "retriedFrom"
+]);
+function noUnprojectedKeys(rest) {
+  return rest;
+}
+function projectSeatFallback(f) {
+  const { fromCli, fromModel, reason, ...rest } = f;
+  noUnprojectedKeys(rest);
+  return {
+    fromCli,
+    ...fromModel !== void 0 ? { fromModel } : {},
+    reason
+  };
+}
+function projectRetriedFrom(r) {
+  const { source, error, errorTruncated, ...rest } = r;
+  noUnprojectedKeys(rest);
+  return {
+    source,
+    ...error !== void 0 ? { error } : {},
+    ...errorTruncated !== void 0 ? { errorTruncated } : {}
+  };
+}
+function projectVoterField(v, key) {
+  if (key === "fallback") {
+    return v.fallback === void 0 ? void 0 : projectSeatFallback(v.fallback);
+  }
+  if (key === "retriedFrom") {
+    return v.retriedFrom === void 0 ? void 0 : projectRetriedFrom(v.retriedFrom);
+  }
+  return v[key];
+}
+function projectVoterSummary(v) {
+  const out = {};
+  for (const key of VOTER_SUMMARY_KEYS) {
+    const value = projectVoterField(v, key);
+    if (value !== void 0) out[key] = value;
+  }
+  return out;
+}
+var VoteRecordCountsSchema = z2.object({
+  approve: z2.number().int().nonnegative(),
+  reject: z2.number().int().nonnegative(),
+  abstain: z2.number().int().nonnegative(),
+  total: z2.number().int().nonnegative()
+}).strict();
+var VoteRecordOptionCountSchema = z2.object({
+  /** The option label as declared in the proposal (e.g. 'A'). */
+  option: z2.string().min(1),
+  /** How many voters selected it. */
+  count: z2.number().int().nonnegative()
+}).strict();
+var GIT_SHA_PATTERN = /^[0-9a-f]{40}$/;
+var VoteRecordPrBindingSchema = z2.object({
+  pr: z2.number().int().positive(),
+  headSha: z2.string().regex(GIT_SHA_PATTERN, "expected a full 40-hex lowercase commit sha")
+}).strict();
+function projectPrBinding(b) {
+  return { pr: b.pr, headSha: b.headSha };
+}
+var VoteRecordErrorPolicySchema = z2.enum([
+  "reduce_denominator",
+  "count_as_abstain",
+  "fail_closed",
+  "absolute_quorum"
+]);
+var VoteRecordSchema = z2.object({
+  /**
+   * Schema version. '1.1' marked the chain→record-set+sequence model (#3927);
+   * '1.2' adds the optional `ratifies` subject-binding field (#3927 item 1);
+   * '1.10' adds the optional `ratifiesPr` PR-binding (#5130); '1.11' the
+   * optional `errorPolicy` (#6211); '1.12' the per-voter `retriedFrom`
+   * (#6246). Every tier is accepted — a 1.1 record
+   * (no `ratifies`) verifies unchanged because each optional is folded into
+   * the self-hash ONLY when present (see {@link computeVoteRecordHash}).
+   * Tiers are labels, not ordered numbers: '1.10' follows '1.9' by
+   * convention only and nothing compares them.
+   */
+  version: z2.enum([
+    "1.1",
+    "1.2",
+    "1.3",
+    "1.4",
+    "1.5",
+    "1.6",
+    "1.7",
+    "1.8",
+    "1.9",
+    "1.10",
+    "1.11",
+    "1.12"
+  ]),
+  /** Unique record id (also usable as a `ratificationVoteRef`). */
+  id: z2.string().min(1),
+  /**
+   * Monotonic sequence number (integer ≥ 0). Assigned as (max existing
+   * sequence)+1 at write time. Sorted, the set of sequences must cover
+   * 0..maxSeq with no gap (omission detection); DUPLICATE sequences are a
+   * benign concurrent-fork signal, not tampering.
+   */
+  sequence: z2.number().int().nonnegative(),
+  /** ISO-8601 timestamp the vote was recorded. */
+  recordedAt: z2.string().min(1),
+  /**
+   * SHA-256 of the FULL proposal text. The proposal itself is truncated for
+   * the human record (`proposal`), but the hash binds the record to the exact
+   * proposal voted on — a later edit of `proposal` that changes meaning is
+   * detectable by recomputing this hash from the original.
+   */
+  proposalHash: z2.string().length(64),
+  /** Truncated proposal text for the human/reviewer record. */
+  proposal: z2.string(),
+  /** The voting strategy used. */
+  strategy: z2.enum([
+    "simple_majority",
+    "supermajority",
+    "unanimous",
+    "higher_order",
+    "opinion_wise",
+    "proof_of_learning"
+  ]),
+  /** The resolved decision. */
+  decision: VoteRecordDecisionSchema,
+  /** Approval fraction as a percentage (0-100). */
+  approvalPercentage: z2.number().min(0).max(100),
+  /** Vote-count breakdown. */
+  voteCounts: VoteRecordCountsSchema,
+  /** Per-voter {role, decision, confidence} summary. */
+  voters: z2.array(VoterSummarySchema),
+  /** Optional correlation/decision id linking to the cost rollup / trace. */
+  correlationId: z2.string().min(1).optional(),
+  /**
+   * Per-option distribution for a multi-option proposal (#4452, schema 1.3).
+   *
+   * Present only when the vote declared `options`. Absent on an ordinary
+   * yes/no vote, and absent on every 1.1/1.2 record — which is why it is
+   * folded into the self-hash ONLY when present (see
+   * {@link computeVoteRecordHash}), exactly as `ratifies` was.
+   *
+   * Without this, a 6-1 or 5-2 option split is recorded as `approve: 7` and
+   * reads as unanimous. Threshold semantics invert too: `unanimous` becomes
+   * the EASIEST bar to clear, because every engaged voter approves while
+   * choosing different things.
+   */
+  // No `.min(1)` (#6049). The rule this field's own docstring states is
+  // "present only when the vote declared `options`" -- keyed on DECLARATION,
+  // not on whether anyone picked one. `.min(1)` encoded the older, narrower
+  // rule, so once the builder started emitting `[]` for "declared, nothing
+  // attributable" the record appended fine and then failed to parse on read:
+  // `too_small, minimum 1`. The write path does not validate, so the line
+  // landed in the ledger and `parseVoteRecordsText` silently dropped it --
+  // the case most worth auditing became the one no reader could see.
+  //
+  // Relaxing is a pure widening: no previously-valid record changes meaning
+  // or hash, and no persisted record can currently hold an empty tally.
+  optionTally: z2.array(VoteRecordOptionCountSchema).optional(),
+  /**
+   * Selection coverage for a multi-option vote (#4472, schema 1.4).
+   *
+   * `optionTally` alone cannot distinguish dissent from absence: `4 pick X
+   * + 3 unreadable` and a genuine 4/3 split both leave a leading share of
+   * 57%. Recording how many approvers produced no usable selection is what
+   * makes a partial measurement legible AS partial — the condition every
+   * voter attached to adopting the "credit no option" rule.
+   */
+  optionCoverage: VoteRecordOptionCoverageSchema.optional(),
+  /**
+   * Panel coverage (#5738, schema 1.5). Present only when at least one
+   * requested voter failed to return a vote; absent keeps a clean panel on
+   * the pre-1.5 projection, so every historical record still verifies.
+   */
+  panelCoverage: VoteRecordPanelCoverageSchema.optional(),
+  /**
+   * The loop/strategy subject this vote RATIFIES (#3927 item 1). Present only on
+   * a ratification vote; set at vote time and bound into the self-hash (so it is
+   * tamper-evident). The authority-tier promotion gate
+   * (`scripts/check-authority-tier-drift.ts`) resolves a transition's
+   * `ratificationVoteRef` to a record and requires `ratifies === transition.subject`
+   * (with `decision === 'approved'` and `strategy === 'higher_order'`). Absent on
+   * an ordinary (non-ratification) vote; a 1.1 record never carries it.
+   */
+  ratifies: z2.string().min(1).optional(),
+  /**
+   * The PR this vote RATIFIES, bound to the head the panel saw (#5130 step 1,
+   * schema 1.10; panel decision Q1 option A, 5 of 6). Present only on a
+   * governor-path ratification vote; hash-covered like `ratifies`, so a
+   * record cannot be repointed at a different PR or a later push without
+   * breaking its hash. The governor gate (step 2, #5779/#5131) resolves the
+   * record from the committed ledger and requires `pr` to be the PR under
+   * review and `headSha` to be its head (or `head^` when `head` touches only
+   * the ledger — the caller-commits tip). Absent on every pre-1.10 record.
+   *
+   * A SEPARATE key rather than a structured encoding of `ratifies`: that
+   * field is the authority-ladder SUBJECT, compared by string equality to
+   * `transition.subject` and grouped by `conflictingRatifiedSubjects`; no
+   * resolver parses it. Overloading it would give one field two consumers
+   * with two equality rules. The two may coexist on one record.
+   */
+  ratifiesPr: VoteRecordPrBindingSchema.optional(),
+  /**
+   * The error policy the panel actually ran under (#6211, schema 1.11): the
+   * EFFECTIVE policy after `consensus_vote` applied the per-strategy default
+   * (`input.errorPolicy ?? getDefaultErrorPolicy(strategy)`), not the raw
+   * input the caller may have omitted. Hash-covered, present-only.
+   *
+   * Before this tier the policy reached the RESPONSE only, so the governor
+   * ledger gate (`scripts/governor-ledger-evidence.ts`) could not say which
+   * policy a whole-panel ratification was configured with: under
+   * `absolute_quorum` an errored seat voids the vote, so the one
+   * ledger-observable trace of a different policy was an approved record
+   * with `panelCoverage.errored > 0` — and a whole panel under
+   * `reduce_denominator` looked exactly like one under `absolute_quorum`.
+   * The gate's `wrong-error-policy` verdict reads this field; a record
+   * without it (every pre-1.11 record) keeps the panel-coverage inference
+   * and is reported as `errorPolicy: unrecorded`.
+   */
+  errorPolicy: VoteRecordErrorPolicySchema.optional(),
+  /**
+   * ADVISORY hash of the tip record at write time (absent for the first).
+   * Retained for audit texture but NOT covered by `hash` and NOT verified —
+   * the record-set model is position-independent (#3927).
+   */
+  previousHash: z2.string().length(64).optional(),
+  /** SHA-256 over every field above EXCEPT `previousHash` (and except `hash`). */
+  hash: z2.string().length(64)
+}).strict();
+function foldOptionalFields(base, payload) {
+  const withTally = payload.optionTally !== void 0 ? {
+    ...base,
+    optionTally: payload.optionTally.map((o) => ({ option: o.option, count: o.count }))
+  } : base;
+  const withCoverage = payload.optionCoverage !== void 0 ? {
+    ...withTally,
+    optionCoverage: {
+      approverCount: payload.optionCoverage.approverCount,
+      selectedCount: payload.optionCoverage.selectedCount,
+      unattributedApprovals: payload.optionCoverage.unattributedApprovals
+    }
+  } : withTally;
+  const withPanel = payload.panelCoverage !== void 0 ? {
+    ...withCoverage,
+    panelCoverage: {
+      requested: payload.panelCoverage.requested,
+      responded: payload.panelCoverage.responded,
+      errored: payload.panelCoverage.errored,
+      erroredRoles: [...payload.panelCoverage.erroredRoles]
+    }
+  } : withCoverage;
+  const withRatifies = payload.ratifies !== void 0 ? { ...withPanel, ratifies: payload.ratifies } : withPanel;
+  const withPrBinding = payload.ratifiesPr !== void 0 ? { ...withRatifies, ratifiesPr: projectPrBinding(payload.ratifiesPr) } : withRatifies;
+  return payload.errorPolicy !== void 0 ? { ...withPrBinding, errorPolicy: payload.errorPolicy } : withPrBinding;
+}
+function computeVoteRecordHash(payload) {
+  const base = {
+    version: payload.version,
+    id: payload.id,
+    sequence: payload.sequence,
+    recordedAt: payload.recordedAt,
+    proposalHash: payload.proposalHash,
+    proposal: payload.proposal,
+    strategy: payload.strategy,
+    decision: payload.decision,
+    approvalPercentage: payload.approvalPercentage,
+    // Rebuild voteCounts in schema order (approve, reject, abstain, total) so the
+    // hash does not depend on how the nested object's keys were ordered (#3962).
+    voteCounts: {
+      approve: payload.voteCounts.approve,
+      reject: payload.voteCounts.reject,
+      abstain: payload.voteCounts.abstain,
+      total: payload.voteCounts.total
+    },
+    // `reasoning` / `reasoningTruncated` (#5373, schema 1.6) are appended per
+    // entry ONLY when present, on the same rule as the record-level optional
+    // fields: a pre-1.6 voter entry re-hashes byte-identical, so every
+    // historical record still verifies, while editing or removing a stored
+    // reasoning flips the hash.
+    voters: payload.voters.map(projectVoterSummary),
+    correlationId: payload.correlationId ?? null
+  };
+  const canonical = JSON.stringify(foldOptionalFields(base, payload));
+  return crypto.createHash("sha256").update(canonical).digest("hex");
+}
+function hashProposal(proposal) {
+  return crypto.createHash("sha256").update(proposal).digest("hex");
+}
+
 // src/cli/voter-unverifiable.ts
 var UNVERIFIABLE_STDERR_RE = /\bbwrap: |RTM_NEWADDR|\bsandbox\b[^\n]*\b(?:denied|failed|not permitted)\b/i;
 var UNVERIFIABLE_REASONING_RE = /\bbwrap: |RTM_NEWADDR|\b(?:repository|source|shell) (?:reads?|access|execution|inspection) failed\b|\bcould not (?:read|inspect) the artifact\b/i;
@@ -317,6 +774,13 @@ function isAbsentSeat(v) {
 }
 
 // src/cli/voter-retry.ts
+var CONTROL_CHARS_RE = /[\x00-\x1f\x7f-\x9f]/g;
+function retriedFromOf(first) {
+  const source = first.source === "unverifiable" ? "unverifiable" : "error";
+  if (first.error === void 0) return { source };
+  const { text, truncated } = clipForRecord(first.error.replace(CONTROL_CHARS_RE, " "));
+  return { source, error: text, ...truncated === true ? { errorTruncated: true } : {} };
+}
 var DEFAULT_ERRORED_ROLE_BACKOFF_MS = 3e3;
 async function retryErroredRoles(first, relaunch, logger11, backoffMs) {
   const erroredRoles = first.filter(isAbsentSeat).map((v) => v.role);
@@ -328,10 +792,17 @@ async function retryErroredRoles(first, relaunch, logger11, backoffMs) {
   });
   if (backoffMs > 0) await sleep(backoffMs);
   const retriedResults = await relaunch(erroredRoles);
+  const firstByRole = new Map(first.map((v) => [v.role, v]));
   const recovered = /* @__PURE__ */ new Map();
   for (const r of retriedResults) {
     if (r.source === "error") continue;
-    recovered.set(r.role, { ...r, retried: true });
+    const prior = firstByRole.get(r.role);
+    const from = prior !== void 0 && isAbsentSeat(prior) ? retriedFromOf(prior) : void 0;
+    recovered.set(r.role, {
+      ...r,
+      retried: true,
+      ...from !== void 0 ? { retriedFrom: from } : {}
+    });
   }
   if (recovered.size === 0) {
     logger11.warn("Per-role retry recovered no voter \u2014 the panel stays degraded", { erroredRoles });
@@ -666,7 +1137,7 @@ var SIMULATED_VOTE_REASONING = {
 };
 
 // src/cli/voter-response.ts
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 
 // src/consensus/option-tally.ts
 var SUPERMAJORITY_SHARE = 2 / 3;
@@ -726,26 +1197,26 @@ var SyntheticVoteError = class extends Error {
   }
   rawOutput;
 };
-var RawFindingSchema = z2.object({
-  summary: z2.string().min(1).max(500).describe("One-line summary of the issue"),
-  location: z2.string().min(1).max(200).describe("path/file.ext:line"),
-  severity: z2.enum(["critical", "high", "medium", "low"]).default("medium"),
-  gate: z2.object({
-    reread_cited_line: z2.enum(["passed", "failed", "skipped"]).default("skipped"),
-    traced_call_path: z2.enum(["passed", "failed", "skipped"]).default("skipped"),
-    named_assertion: z2.string().default("").describe("Concrete failing assertion \u2014 substantive, not a rubber-stamp word"),
-    ruled_out_language_non_issue: z2.enum(["passed", "failed", "skipped"]).default("skipped")
+var RawFindingSchema = z3.object({
+  summary: z3.string().min(1).max(500).describe("One-line summary of the issue"),
+  location: z3.string().min(1).max(200).describe("path/file.ext:line"),
+  severity: z3.enum(["critical", "high", "medium", "low"]).default("medium"),
+  gate: z3.object({
+    reread_cited_line: z3.enum(["passed", "failed", "skipped"]).default("skipped"),
+    traced_call_path: z3.enum(["passed", "failed", "skipped"]).default("skipped"),
+    named_assertion: z3.string().default("").describe("Concrete failing assertion \u2014 substantive, not a rubber-stamp word"),
+    ruled_out_language_non_issue: z3.enum(["passed", "failed", "skipped"]).default("skipped")
   }),
-  claim: z2.string().min(1).max(2e3).describe("What is wrong and why it justifies blocking")
+  claim: z3.string().min(1).max(2e3).describe("What is wrong and why it justifies blocking")
 });
-var VoteResponseSchema = z2.object({
-  decision: z2.enum(["approve", "reject", "abstain"]).describe("Your vote decision"),
-  reasoning: z2.string().min(10).max(4e3).describe("Explanation for your vote (10-4000 chars)"),
-  confidence: z2.number().min(0).max(1).describe("Confidence level 0-1"),
-  conditions: z2.array(z2.string()).optional().describe("Optional conditions for approval"),
+var VoteResponseSchema = z3.object({
+  decision: z3.enum(["approve", "reject", "abstain"]).describe("Your vote decision"),
+  reasoning: z3.string().min(10).max(4e3).describe("Explanation for your vote (10-4000 chars)"),
+  confidence: z3.number().min(0).max(1).describe("Confidence level 0-1"),
+  conditions: z3.array(z3.string()).optional().describe("Optional conditions for approval"),
   /** Structured rejection categories for reject→refine→re-vote loops (Issue #1213). */
-  rejectionCategories: z2.array(
-    z2.enum([
+  rejectionCategories: z3.array(
+    z3.enum([
       "YAGNI",
       "DRY_VIOLATION",
       "OVER_ENGINEERING",
@@ -757,11 +1228,11 @@ var VoteResponseSchema = z2.object({
   ).optional().describe("Rejection reason categories when decision is reject"),
   /** Top-level structured findings for PR-review mode (#2245 v4 follow-up).
    * Replaces the YAML-in-reasoning encoding that proved lossy. */
-  findings: z2.array(RawFindingSchema).optional().describe("Structured findings (PR review only)"),
+  findings: z3.array(RawFindingSchema).optional().describe("Structured findings (PR review only)"),
   /** Chosen option when the proposal declared `options` (#4472). Validated
    * against the declared list by the caller; an unmatched value is dropped
    * rather than recorded, so a parse miss surfaces as absent. */
-  selectedOption: z2.string().optional().describe("Which declared option you choose")
+  selectedOption: z3.string().optional().describe("Which declared option you choose")
 });
 var VOTE_JSON_SCHEMA = {
   type: "object",
@@ -903,12 +1374,12 @@ Example PR-review request_changes response with structured findings:
     }
   ]
 }`;
-function buildVotePrompt(proposal, options) {
+function buildVotePrompt(proposal, options, workspace) {
   return `Evaluate the following proposal and provide your vote.
 
 PROPOSAL:
 ${proposal}
-${buildOptionsBlock(options)}
+${buildOptionsBlock(options)}${buildWorkspaceBlock(workspace)}
 In addition to your role-specific criteria, assess these workflow-test dimensions:
 - Testability: Can the proposed changes be verified with automated tests?
 - Workflow integration: Does this fit into existing CI/make/test workflows?
@@ -932,6 +1403,14 @@ OPTIONS \u2014 choose exactly ONE of these and name it verbatim in \`selectedOpt
 ${list}
 `;
 }
+function buildWorkspaceBlock(workspace) {
+  if (workspace === void 0 || workspace === "") return "";
+  return `
+REPOSITORY ACCESS:
+The repository under review is the working directory of this panel: ${workspace}
+Every seat's file and shell tools run there, and reading it is expected. When the proposal refers to something in that repository \u2014 a PR head, a diff, the files it touches \u2014 read it there before you vote: the proposal text describes the artifact and is not a substitute for it. If your tools cannot read that directory, follow the UNVERIFIABLE rule in your instructions.
+`;
+}
 function buildSelectionFieldDoc(options) {
   if (options === void 0 || options.length === 0) return "";
   return "- selectedOption: REQUIRED. Exactly one option from the OPTIONS list above, copied verbatim. Do not invent an option, combine two, or leave it blank \u2014 your selection is what the threshold is measured over.";
@@ -1155,14 +1634,17 @@ function buildVoteRequest({
   timeoutMs,
   withResponseFormat,
   options,
-  project
+  project,
+  workspace
 }) {
   const base = {
     messages: [
       // #6110: the seat judges the caller's target project, not this
       // repository's. `undefined` renders the `nexus-agents` default.
       { role: "system", content: getVoterPrompts(project)[role] },
-      { role: "user", content: buildVotePrompt(proposal, options) }
+      // #6254: and the working directory the seats run in, so a seat with
+      // file tools knows where the artifact is and that reading it is expected.
+      { role: "user", content: buildVotePrompt(proposal, options, workspace) }
     ],
     // 4000 (#4131): headroom so a findings-bearing verdict (JSON envelope +
     // reasoning + structured findings) isn't cut mid-JSON by the token cap and
@@ -1219,8 +1701,8 @@ async function runVoteCompletion(args) {
   };
 }
 async function executeSingleVoteAttempt(role, proposal, adapter, timeoutMs, context = {}) {
-  const { options, project } = context;
-  const completionArgs = { role, proposal, adapter, timeoutMs, options, project };
+  const { options, project, workspace } = context;
+  const completionArgs = { role, proposal, adapter, timeoutMs, options, project, workspace };
   let completion = await runVoteCompletion({ ...completionArgs, withResponseFormat: true });
   if (!completion.ok && isStructuredOutputUnsupported(completion.error)) {
     completion = await runVoteCompletion({ ...completionArgs, withResponseFormat: false });
@@ -1251,7 +1733,7 @@ function logAbandonedRetries(logger11, role, attempt, maxRetries) {
   });
 }
 async function executeWithRetries(opts) {
-  const { role, proposal, adapter, logger: logger11, timeoutMs, maxRetries, options, project } = opts;
+  const { role, proposal, adapter, logger: logger11, timeoutMs, maxRetries, options, project, workspace } = opts;
   let lastError = "";
   for (let attempt = 0; attempt <= maxRetries; attempt++) {
     if (attempt > 0) {
@@ -1264,7 +1746,8 @@ async function executeWithRetries(opts) {
     const attemptStart = Date.now();
     const result = await executeSingleVoteAttempt(role, proposal, adapter, timeoutMs, {
       options,
-      project
+      project,
+      workspace
     });
     const attemptMs = Date.now() - attemptStart;
     if (result.ok) {
@@ -1457,14 +1940,15 @@ function resolveVoteExecution(options) {
     maxRetries: options?.maxRetries ?? VOTE_TIMEOUTS.maxRetries,
     allowSimulation: options?.allowSimulation ?? false,
     declaredOptions: options?.declaredOptions,
-    project: options?.project
+    project: options?.project,
+    workspace: options?.workspace
   };
 }
 async function executeAgentVote(role, proposal, adapter, logger11, options) {
   const start = getTimeProvider().now();
-  const { timeoutMs, maxRetries, allowSimulation, declaredOptions, project } = resolveVoteExecution(options);
+  const { allowSimulation, declaredOptions, ...settings } = resolveVoteExecution(options);
   logger11.info("Executing vote", { role, model: adapter.modelId, provider: adapter.providerId });
-  const retryOptions = { role, proposal, adapter, logger: logger11, timeoutMs, maxRetries, project };
+  const retryOptions = { role, proposal, adapter, logger: logger11, ...settings };
   const result = await executeWithRetries({ ...retryOptions, options: declaredOptions });
   const processingTimeMs = getTimeProvider().now() - start;
   if (result.ok) {
@@ -1607,8 +2091,6 @@ async function assignPanelSeats(fallbackAdapter, options, logger11) {
 async function collectRealVotes(options) {
   const logger11 = options.logger ?? defaultLogger;
   const { roles, proposal, simulate, allowSimulation } = options;
-  const timeoutMs = options.timeoutMs ?? resolveVoteTimeout();
-  const maxRetries = options.maxRetries ?? VOTE_TIMEOUTS.maxRetries;
   if (simulate === true) {
     logger11.info("Using simulation mode (explicitly requested)");
     return createSimulatedVotes(roles, proposal);
@@ -1618,16 +2100,7 @@ async function collectRealVotes(options) {
     return createSimulatedVotes(roles, proposal, "No adapter available");
   const roleAdapters = await assignPanelSeats(adapterResult.adapter, options, logger11);
   warnIfCodexConcurrencyExceeded(roleAdapters, logger11);
-  const voteOptions = {
-    timeoutMs,
-    maxRetries,
-    allowSimulation: allowSimulation ?? false,
-    // #4472: reaches executeAgentVote, which puts the declared options in the
-    // prompt and resolves each voter's selection against them.
-    declaredOptions: options.declaredOptions,
-    // #6110: likewise the target project, into every seat's system prompt.
-    project: options.project
-  };
+  const voteOptions = resolveVoteExecution({ ...options, workspace: process.cwd() });
   const interDelay = options.interAgentDelayMs ?? DEFAULT_INTER_AGENT_DELAY_MS;
   const launchInput = {
     roles,
@@ -1653,9 +2126,9 @@ async function collectRealVotes(options) {
 // src/cli/voter-project.ts
 import { readFileSync, statSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 var VOTER_PROJECT_PATTERN = /^[A-Za-z0-9._/@-]{1,200}$/;
-var VoterProjectInputSchema = z3.string().regex(VOTER_PROJECT_PATTERN).optional().describe(
+var VoterProjectInputSchema = z4.string().regex(VOTER_PROJECT_PATTERN).optional().describe(
   "The project the panel is judging (#6110), e.g. `acme/widgets` \u2014 it replaces `nexus-agents` in every voter's system prompt, so a consuming repository is not judged against this one's mission and governance files. When omitted the name is DERIVED from the server's working directory (the `origin` remote as `owner/repo`, else the nearest `package.json` name) and falls back to `nexus-agents`; the response discloses which on `project.source`. Letters, digits and `._/@-` only, at most 200 characters."
 );
 var MAX_ANCESTOR_DEPTH = 64;
@@ -1821,40 +2294,40 @@ function describeVeto(verdict) {
 }
 
 // src/consensus/types-voting-protocol.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 var VOTING_ROUND_DEFAULT_TIMEOUT_MS = OPERATION_CLASSES["multi-llm-panel"].guardMs;
-var VotingRoundPhaseSchema = z4.enum(["analysis", "deliberation", "consensus"]);
-var VotingRoundStatusSchema = z4.enum([
+var VotingRoundPhaseSchema = z5.enum(["analysis", "deliberation", "consensus"]);
+var VotingRoundStatusSchema = z5.enum([
   "pending",
   "in_progress",
   "awaiting_votes",
   "completed",
   "aborted"
 ]);
-var AgentFindingSchema = z4.object({
-  agentId: z4.string(),
-  category: z4.enum(["bug", "security", "performance", "style", "design", "documentation", "other"]),
-  severity: z4.enum(["critical", "major", "minor", "suggestion"]),
-  description: z4.string().min(1),
-  location: z4.string().optional().describe("File path and line range if applicable"),
-  suggestion: z4.string().optional().describe("Recommended fix"),
-  confidence: z4.number().min(0).max(1),
-  timestamp: z4.iso.datetime().optional()
+var AgentFindingSchema = z5.object({
+  agentId: z5.string(),
+  category: z5.enum(["bug", "security", "performance", "style", "design", "documentation", "other"]),
+  severity: z5.enum(["critical", "major", "minor", "suggestion"]),
+  description: z5.string().min(1),
+  location: z5.string().optional().describe("File path and line range if applicable"),
+  suggestion: z5.string().optional().describe("Recommended fix"),
+  confidence: z5.number().min(0).max(1),
+  timestamp: z5.iso.datetime().optional()
 });
-var FindingVoteSchema = z4.object({
-  agentId: z4.string(),
-  findingId: z4.string(),
-  agree: z4.boolean(),
-  reasoning: z4.string().optional(),
-  amendedSeverity: z4.enum(["critical", "major", "minor", "suggestion"]).optional()
+var FindingVoteSchema = z5.object({
+  agentId: z5.string(),
+  findingId: z5.string(),
+  agree: z5.boolean(),
+  reasoning: z5.string().optional(),
+  amendedSeverity: z5.enum(["critical", "major", "minor", "suggestion"]).optional()
 });
-var VotingProtocolConfigSchema = z4.object({
-  committeeSize: z4.number().int().min(2).max(7).default(3),
-  maxRounds: z4.number().int().min(1).max(5).default(3),
-  roundTimeoutMs: z4.number().int().positive().default(VOTING_ROUND_DEFAULT_TIMEOUT_MS),
-  agreementThreshold: z4.number().min(0.5).max(1).default(SUPERMAJORITY_THRESHOLD),
-  enableAntiSycophancy: z4.boolean().default(true),
-  sycophancyThreshold: z4.number().min(0).max(1).default(0.8)
+var VotingProtocolConfigSchema = z5.object({
+  committeeSize: z5.number().int().min(2).max(7).default(3),
+  maxRounds: z5.number().int().min(1).max(5).default(3),
+  roundTimeoutMs: z5.number().int().positive().default(VOTING_ROUND_DEFAULT_TIMEOUT_MS),
+  agreementThreshold: z5.number().min(0.5).max(1).default(SUPERMAJORITY_THRESHOLD),
+  enableAntiSycophancy: z5.boolean().default(true),
+  sycophancyThreshold: z5.number().min(0).max(1).default(0.8)
 });
 var DEFAULT_VOTING_PROTOCOL_CONFIG = {
   committeeSize: 3,
@@ -1867,30 +2340,30 @@ var DEFAULT_VOTING_PROTOCOL_CONFIG = {
 };
 
 // src/consensus/types-weighted-voting.ts
-import { z as z5 } from "zod";
-var TaskOutcomeStatusSchema = z5.enum(["success", "failure", "partial", "unknown"]);
-var WeightedAgentRecordSchema = z5.object({
-  agentId: z5.string().min(1),
-  totalTasks: z5.number().int().nonnegative(),
-  successfulTasks: z5.number().int().nonnegative(),
-  failedTasks: z5.number().int().nonnegative(),
-  partialTasks: z5.number().int().nonnegative(),
-  successRate: z5.number().min(0).max(1),
-  weight: z5.number().min(0).max(1),
-  trustScore: z5.number().min(0).max(1),
-  byzantineFlags: z5.number().int().nonnegative(),
-  lastActive: z5.date(),
-  createdAt: z5.date()
+import { z as z6 } from "zod";
+var TaskOutcomeStatusSchema = z6.enum(["success", "failure", "partial", "unknown"]);
+var WeightedAgentRecordSchema = z6.object({
+  agentId: z6.string().min(1),
+  totalTasks: z6.number().int().nonnegative(),
+  successfulTasks: z6.number().int().nonnegative(),
+  failedTasks: z6.number().int().nonnegative(),
+  partialTasks: z6.number().int().nonnegative(),
+  successRate: z6.number().min(0).max(1),
+  weight: z6.number().min(0).max(1),
+  trustScore: z6.number().min(0).max(1),
+  byzantineFlags: z6.number().int().nonnegative(),
+  lastActive: z6.date(),
+  createdAt: z6.date()
 });
-var WeightedVotingConfigSchema = z5.object({
-  minWeight: z5.number().min(0).max(1).default(0.1),
-  maxByzantineFraction: z5.number().min(0).max(0.5).default(0.33),
-  weightDecayFactor: z5.number().min(0.5).max(1).default(0.9),
-  weightRecoveryFactor: z5.number().min(1).max(2).default(1.05),
-  minTrustScore: z5.number().min(0).max(1).default(0.3),
-  byzantineFlagThreshold: z5.number().int().positive().default(3),
-  initialWeight: z5.number().min(0).max(1).default(0.5),
-  quorumThreshold: z5.number().min(0.5).max(1).default(SUPERMAJORITY_THRESHOLD)
+var WeightedVotingConfigSchema = z6.object({
+  minWeight: z6.number().min(0).max(1).default(0.1),
+  maxByzantineFraction: z6.number().min(0).max(0.5).default(0.33),
+  weightDecayFactor: z6.number().min(0.5).max(1).default(0.9),
+  weightRecoveryFactor: z6.number().min(1).max(2).default(1.05),
+  minTrustScore: z6.number().min(0).max(1).default(0.3),
+  byzantineFlagThreshold: z6.number().int().positive().default(3),
+  initialWeight: z6.number().min(0).max(1).default(0.5),
+  quorumThreshold: z6.number().min(0.5).max(1).default(SUPERMAJORITY_THRESHOLD)
 });
 var DEFAULT_WEIGHTED_VOTING_CONFIG = {
   minWeight: 0.1,
@@ -1905,7 +2378,7 @@ var DEFAULT_WEIGHTED_VOTING_CONFIG = {
 };
 
 // src/consensus/higher-order-types.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 function createAgentPairKey(agentA, agentB) {
   return agentA < agentB ? `${agentA}:${agentB}` : `${agentB}:${agentA}`;
 }
@@ -1916,52 +2389,52 @@ function parseAgentPairKey(key) {
   }
   return [parts[0], parts[1]];
 }
-var CorrelationCoefficientSchema = z6.number().min(-1).max(1);
-var IndependentSubsetSchema = z6.object({
-  id: z6.string(),
-  agentIds: z6.array(z6.string()),
-  independenceScore: z6.number().min(0).max(1),
-  pairCoverage: z6.object({
-    observed: z6.number().int().nonnegative(),
-    total: z6.number().int().nonnegative()
+var CorrelationCoefficientSchema = z7.number().min(-1).max(1);
+var IndependentSubsetSchema = z7.object({
+  id: z7.string(),
+  agentIds: z7.array(z7.string()),
+  independenceScore: z7.number().min(0).max(1),
+  pairCoverage: z7.object({
+    observed: z7.number().int().nonnegative(),
+    total: z7.number().int().nonnegative()
   }),
-  observationCount: z6.number().int().nonnegative()
+  observationCount: z7.number().int().nonnegative()
 });
-var VotingObservationSchema = z6.object({
-  proposalId: z6.string(),
-  agentId: z6.string(),
-  decision: z6.enum(["approve", "reject", "abstain"]),
-  confidence: z6.number().min(0).max(1),
-  alignedWithOutcome: z6.boolean(),
-  timestamp: z6.date(),
-  modelKey: z6.string().optional(),
-  observedModel: z6.string().optional()
+var VotingObservationSchema = z7.object({
+  proposalId: z7.string(),
+  agentId: z7.string(),
+  decision: z7.enum(["approve", "reject", "abstain"]),
+  confidence: z7.number().min(0).max(1),
+  alignedWithOutcome: z7.boolean(),
+  timestamp: z7.date(),
+  modelKey: z7.string().optional(),
+  observedModel: z7.string().optional()
 });
-var PairwiseVotingHistorySchema = z6.object({
-  pairKey: z6.string(),
-  jointObservations: z6.number().int().nonnegative(),
-  agreements: z6.number().int().nonnegative(),
-  disagreements: z6.number().int().nonnegative(),
+var PairwiseVotingHistorySchema = z7.object({
+  pairKey: z7.string(),
+  jointObservations: z7.number().int().nonnegative(),
+  agreements: z7.number().int().nonnegative(),
+  disagreements: z7.number().int().nonnegative(),
   correlation: CorrelationCoefficientSchema,
-  lastUpdated: z6.date()
+  lastUpdated: z7.date()
 });
-var HigherOrderVotingConfigSchema = z6.object({
-  minObservationsForCorrelation: z6.number().int().positive().default(10),
-  correlationThreshold: z6.number().min(0).max(1).default(0.3),
+var HigherOrderVotingConfigSchema = z7.object({
+  minObservationsForCorrelation: z7.number().int().positive().default(10),
+  correlationThreshold: z7.number().min(0).max(1).default(0.3),
   /**
    * @deprecated Ignored since 8.x: correlation evidence is lifetime and partitioned by the role's pinned model (#5555); nothing reads this value. Removed in the next major (#5564).
    */
-  correlationMaxAgeMs: z6.number().int().positive().default(864e5),
+  correlationMaxAgeMs: z7.number().int().positive().default(864e5),
   // 24 hours
-  independenceThreshold: z6.number().min(0).max(1).default(0.2),
-  fallbackToSimpleVoting: z6.boolean().default(true),
+  independenceThreshold: z7.number().min(0).max(1).default(0.2),
+  fallbackToSimpleVoting: z7.boolean().default(true),
   /**
    * @deprecated Ignored since 8.x: correlation evidence is lifetime and partitioned by the role's pinned model (#5555); nothing reads this value. Removed in the next major (#5564).
    */
-  observationDecayFactor: z6.number().min(0).max(1).default(0.95),
-  maxObservationsPerAgent: z6.number().int().positive().default(1e3),
-  maxProposals: z6.number().int().positive().default(5e3),
-  maxTrackedPairs: z6.number().int().positive().default(100)
+  observationDecayFactor: z7.number().min(0).max(1).default(0.95),
+  maxObservationsPerAgent: z7.number().int().positive().default(1e3),
+  maxProposals: z7.number().int().positive().default(5e3),
+  maxTrackedPairs: z7.number().int().positive().default(100)
 });
 var DEFAULT_HIGHER_ORDER_CONFIG = {
   minObservationsForCorrelation: 10,
@@ -1975,25 +2448,25 @@ var DEFAULT_HIGHER_ORDER_CONFIG = {
   maxProposals: 5e3,
   maxTrackedPairs: 100
 };
-var HigherOrderVotingResultSchema = z6.object({
-  decision: z6.enum(["approve", "reject", "no_consensus"]),
-  posteriorApproval: z6.number().min(0).max(1),
-  posteriorRejection: z6.number().min(0).max(1),
-  effectiveVoteCount: z6.number().nonnegative(),
-  usedCorrelationData: z6.boolean(),
-  method: z6.enum(["ow", "isp", "simple"]),
-  improvementOverBaseline: z6.number(),
-  independentSubsets: z6.array(IndependentSubsetSchema).optional(),
-  downweightedAgents: z6.array(z6.string()),
-  reasoning: z6.string()
+var HigherOrderVotingResultSchema = z7.object({
+  decision: z7.enum(["approve", "reject", "no_consensus"]),
+  posteriorApproval: z7.number().min(0).max(1),
+  posteriorRejection: z7.number().min(0).max(1),
+  effectiveVoteCount: z7.number().nonnegative(),
+  usedCorrelationData: z7.boolean(),
+  method: z7.enum(["ow", "isp", "simple"]),
+  improvementOverBaseline: z7.number(),
+  independentSubsets: z7.array(IndependentSubsetSchema).optional(),
+  downweightedAgents: z7.array(z7.string()),
+  reasoning: z7.string()
 });
-var CorrelationTrackerStatsSchema = z6.object({
-  totalAgents: z6.number().int().nonnegative(),
-  trackedPairs: z6.number().int().nonnegative(),
-  totalObservations: z6.number().int().nonnegative(),
-  averageCorrelation: z6.number(),
-  independentSubsetCount: z6.number().int().nonnegative(),
-  pairsWithSufficientData: z6.number().int().nonnegative()
+var CorrelationTrackerStatsSchema = z7.object({
+  totalAgents: z7.number().int().nonnegative(),
+  trackedPairs: z7.number().int().nonnegative(),
+  totalObservations: z7.number().int().nonnegative(),
+  averageCorrelation: z7.number(),
+  independentSubsetCount: z7.number().int().nonnegative(),
+  pairsWithSufficientData: z7.number().int().nonnegative()
 });
 
 // src/consensus/higher-order-helpers.ts
@@ -5005,24 +5478,24 @@ function createCorrelationTracker(config) {
 import * as fs from "node:fs";
 
 // src/consensus/correlation-persistence-records.ts
-import { z as z7 } from "zod";
-var PersistedVoteSchema = z7.object({
-  agentId: z7.string(),
-  decision: z7.enum(["approve", "reject", "abstain"]),
-  confidence: z7.number().min(0).max(1),
-  modelKey: z7.string().optional(),
-  observedModel: z7.string().optional()
+import { z as z8 } from "zod";
+var PersistedVoteSchema = z8.object({
+  agentId: z8.string(),
+  decision: z8.enum(["approve", "reject", "abstain"]),
+  confidence: z8.number().min(0).max(1),
+  modelKey: z8.string().optional(),
+  observedModel: z8.string().optional()
 });
-var PersistedProposalSchema = z7.object({
-  proposalId: z7.string(),
-  votes: z7.array(PersistedVoteSchema),
-  outcome: z7.enum(["approved", "rejected"]),
-  timestamp: z7.iso.datetime()
+var PersistedProposalSchema = z8.object({
+  proposalId: z8.string(),
+  votes: z8.array(PersistedVoteSchema),
+  outcome: z8.enum(["approved", "rejected"]),
+  timestamp: z8.iso.datetime()
 });
-var PersistedCorrelationDataSchema = z7.object({
-  version: z7.number().int().positive(),
-  proposals: z7.array(PersistedProposalSchema),
-  savedAt: z7.iso.datetime()
+var PersistedCorrelationDataSchema = z8.object({
+  version: z8.number().int().positive(),
+  proposals: z8.array(PersistedProposalSchema),
+  savedAt: z8.iso.datetime()
 });
 function createPersistedProposal(proposalId, votes, outcome, context) {
   const persistedVotes = [];
@@ -5270,449 +5743,40 @@ import { z as z9 } from "zod";
 function answeringSeats(votes) {
   return votes.filter((v) => v.source === "llm");
 }
-function resolvedModel(v) {
-  return v.model === void 0 || v.model === "" || v.model === UNRESOLVED_MODEL_ID ? void 0 : v.model;
-}
-function seatFallbacks(votes) {
-  const out = [];
-  for (const v of answeringSeats(votes)) {
-    if (v.fallback === void 0) continue;
-    out.push({
-      role: v.role,
-      fallback: v.fallback,
-      toCli: v.cli === void 0 ? "?" : bareCliName(v.cli),
-      toModel: resolvedModel(v)
-    });
-  }
-  return out;
-}
-function panelDiversityOf(votes) {
-  const models = answeringSeats(votes).map(resolvedModel).filter((m) => m !== void 0);
-  return {
-    distinctModels: countDistinctModels(models),
-    fallbacks: seatFallbacks(votes).length
-  };
-}
-var MIN_PANEL_FOR_DIVERSITY_WARNING = 3;
-function singleModelPanelWarning(votes) {
-  if (votes.length < MIN_PANEL_FOR_DIVERSITY_WARNING) return void 0;
-  const answered = answeringSeats(votes);
-  const models = answered.map(resolvedModel);
-  const model = models[0];
-  if (model === void 0 || models.includes(void 0)) return void 0;
-  if (panelDiversityOf(votes).distinctModels !== 1) return void 0;
-  const silent = votes.length - answered.length;
-  const missing = silent > 0 ? ` (${String(silent)} did not answer)` : "";
-  return `All ${String(answered.length)} seats answered on ${model}${missing}; independence is weaker than assigned.`;
-}
-
-// src/audit/vote-record.ts
-import * as crypto from "node:crypto";
-import { z as z8 } from "zod";
-var VoteRecordDecisionSchema = z8.enum(["approved", "rejected", "no_quorum"]);
-var VoteRecordOptionCoverageSchema = z8.object({
-  /** Every approving voter, selecting or not — the tally's denominator. */
-  approverCount: z8.number().int().nonnegative(),
-  /** Approvers whose selection matched a declared option. */
-  selectedCount: z8.number().int().nonnegative(),
-  /** Approvers with no usable selection; their choice is unmeasured. */
-  unattributedApprovals: z8.number().int().nonnegative()
-}).strict();
-var VoteRecordPanelCoverageSchema = z8.object({
-  /** Voters the panel asked for. */
-  requested: z8.number().int().nonnegative(),
-  /** Voters that returned a usable vote — the denominator of `voteCounts`. */
-  responded: z8.number().int().nonnegative(),
-  /** Voters that errored or timed out. */
-  errored: z8.number().int().nonnegative(),
-  /** The roles behind `errored`, in panel order. */
-  erroredRoles: z8.array(z8.string().min(1).max(100))
-}).strict();
-var MAX_VOTER_REASONING_CHARS = 2e4;
-var SeatFallbackRecordSchema = z8.object({
-  /** The CLI the seat was assigned to, bare (`claude`, not `cli-claude`). */
-  fromCli: z8.string().min(1).max(100),
-  /** The model the assigned adapter had detected, when it had one. */
-  fromModel: z8.string().min(1).max(200).optional(),
-  /** The adapter-layer class of the error that moved the seat. */
-  reason: z8.enum(["rate-limit", "capacity", "auth", "timeout", "sandbox", "unknown"])
-}).strict();
-var VoterSummarySchema = z8.object({
-  role: z8.string().min(1).max(100),
-  decision: z8.enum(["approve", "reject", "abstain"]),
-  confidence: z8.number().min(0).max(1),
-  /**
-   * The voter's stated grounds (#5373, schema 1.6).
-   *
-   * `generateVoteHash` already hashed `{role, decision, reasoning}` and then
-   * discarded the text, so the chain attested to a value it did not store and
-   * nobody could re-verify the hash without re-obtaining the reasoning. On
-   * #5228 a contrarian rejection was clipped mid-sentence in the terminal, the
-   * grounds were unrecoverable, and the same defect resurfaced a round later —
-   * one round of a 7-voter panel is 7-13 minutes of model time, and the
-   * objection was right both times.
-   *
-   * Stored whole rather than sampled. Warn-mode near-misses are emitted per
-   * TOOL CALL, thousands a day; votes are emitted per PANEL, dozens a day at
-   * most, so ~17 KB per vote is not the same growth problem.
-   *
-   * Absence is not an empty argument: an errored voter has no entry in
-   * `voters` at all (see `panelCoverage`), so `reasoning: ''` means a live
-   * voter returned nothing, which is itself a signal.
-   */
-  reasoning: z8.string().max(MAX_VOTER_REASONING_CHARS).optional(),
-  /** True when `reasoning` was clipped to {@link MAX_VOTER_REASONING_CHARS}. */
-  reasoningTruncated: z8.literal(true).optional(),
-  /**
-   * True when this seat was recovered by the per-role retry (#6050, schema 1.7).
-   *
-   * `voter-retry.ts` has set `retried: true` on recovered results since it was
-   * written, and `vote-types.ts` states the reason: the flag is "what makes the
-   * recovery visible instead of indistinguishable from a clean first attempt".
-   * It had one producer and ZERO consumers — both summarizers and the record
-   * dropped it — so the field existed, was documented, and never reached
-   * anything that could act on it.
-   *
-   * A retried seat is weaker evidence than a first-pass one: the model was
-   * unavailable or timed out, and the recovery ran under different conditions.
-   * For a ratification vote on a governor-path change, "7 of 7 answered" and
-   * "6 answered, 1 recovered on retry" are different facts about the scrutiny
-   * the change received, and the record stated the first for both.
-   *
-   * `literal(true)` and optional, on the `reasoningTruncated` rule: a clean
-   * seat carries no key, so its entry re-hashes byte-identical and every
-   * historical record still verifies.
-   */
-  retried: z8.literal(true).optional(),
-  /**
-   * Registry model id the seat ran on (#6091, schema 1.8).
-   *
-   * The seat→model mapping is round-robin over the available CLIs plus
-   * `NEXUS_VOTER_MODEL_<ROLE>` pins, so it is not recoverable from the
-   * ledger after the fact: 1844 voter entries across 278 records carried no
-   * model. "When an agent's output becomes evidence, its provenance travels
-   * with it" — a tally that says `scope_steward: approve` without saying
-   * which model answered cannot be audited for the #6068 failure class.
-   * Present-only, on the `retried` rule; absent when the result carried no
-   * model or only the pending-detection placeholder.
-   */
-  model: z8.string().min(1).max(200).optional(),
-  /**
-   * True when the seat could not read the artifact (#6094, schema 1.8).
-   *
-   * `decision` is `abstain` for such a seat, so without this flag the record
-   * could not tell "read it and abstained" from "never saw it" — and one
-   * ledger entry (`vote-1789058788915-6lfrbuq`) shows a seat that APPROVED
-   * on the proposal text after failing to read. `literal(true)` and
-   * present-only, so every pre-1.8 entry re-hashes byte-identical.
-   */
-  unverifiable: z8.literal(true).optional(),
-  /**
-   * The CLI the round-robin or `NEXUS_VOTER_MODEL_<ROLE>` pin chose for the
-   * seat, as a bare name (#6115, schema 1.9). `model` says where a seat
-   * answered; this says where it was MEANT to. Three consecutive 7-seat
-   * ratification panels on 2026-09-13 answered every seat on one gemini
-   * model while the assignment was three claude, two codex, two gemini,
-   * and the 1.8 record showed seven identical `model` values with nothing
-   * that said five of them were substitutes. Present-only, on the `model`
-   * rule; absent on a result built outside the panel launcher.
-   */
-  assignedCli: z8.string().min(1).max(100).optional(),
-  /**
-   * Present only when the seat answered on a different CLI or model than
-   * assigned (#6115, schema 1.9): the exact `SeatFallback` shape the live
-   * result carries, rebuilt field-by-field. `fromCli` is the assigned CLI,
-   * `fromModel` the model it had detected (absent when it never did — the
-   * pending-detection placeholder is not a model), `reason` the adapter
-   * layer's error class. The vocabulary is compile-checked against the live
-   * `FallbackReason` in vote-record.test.ts; a class one side learns alone
-   * would either refuse every record that carries it (#6054) or accept one
-   * no producer can write.
-   */
-  fallback: SeatFallbackRecordSchema.optional()
-}).strict();
-function defineVoterKeys(keys) {
-  return keys;
-}
-var VOTER_SUMMARY_KEYS = defineVoterKeys([
-  "role",
-  "decision",
-  "confidence",
-  "reasoning",
-  "reasoningTruncated",
-  "retried",
-  // 1.8 (#6091, #6094): appended after `retried`, present-only, so a 1.7
-  // entry projects byte-identically.
-  "model",
-  "unverifiable",
-  // 1.9 (#6115): appended after `unverifiable`, present-only, so a 1.8 entry
-  // projects byte-identically. `fallback` is the first nested voter field;
-  // `projectSeatFallback` rebuilds it in its own canonical order.
-  "assignedCli",
-  "fallback"
-]);
-function noUnprojectedKeys(rest) {
-  return rest;
-}
-function projectSeatFallback(f) {
-  const { fromCli, fromModel, reason, ...rest } = f;
-  noUnprojectedKeys(rest);
-  return {
-    fromCli,
-    ...fromModel !== void 0 ? { fromModel } : {},
-    reason
-  };
-}
-function projectVoterSummary(v) {
-  const out = {};
-  for (const key of VOTER_SUMMARY_KEYS) {
-    const value = key === "fallback" ? v.fallback === void 0 ? void 0 : projectSeatFallback(v.fallback) : v[key];
-    if (value !== void 0) out[key] = value;
+function resolvedModel(v) {
+  return v.model === void 0 || v.model === "" || v.model === UNRESOLVED_MODEL_ID ? void 0 : v.model;
+}
+function seatFallbacks(votes) {
+  const out = [];
+  for (const v of answeringSeats(votes)) {
+    if (v.fallback === void 0) continue;
+    out.push({
+      role: v.role,
+      fallback: v.fallback,
+      toCli: v.cli === void 0 ? "?" : bareCliName(v.cli),
+      toModel: resolvedModel(v)
+    });
   }
   return out;
 }
-var VoteRecordCountsSchema = z8.object({
-  approve: z8.number().int().nonnegative(),
-  reject: z8.number().int().nonnegative(),
-  abstain: z8.number().int().nonnegative(),
-  total: z8.number().int().nonnegative()
-}).strict();
-var VoteRecordOptionCountSchema = z8.object({
-  /** The option label as declared in the proposal (e.g. 'A'). */
-  option: z8.string().min(1),
-  /** How many voters selected it. */
-  count: z8.number().int().nonnegative()
-}).strict();
-var GIT_SHA_PATTERN = /^[0-9a-f]{40}$/;
-var VoteRecordPrBindingSchema = z8.object({
-  pr: z8.number().int().positive(),
-  headSha: z8.string().regex(GIT_SHA_PATTERN, "expected a full 40-hex lowercase commit sha")
-}).strict();
-function projectPrBinding(b) {
-  return { pr: b.pr, headSha: b.headSha };
-}
-var VoteRecordErrorPolicySchema = z8.enum([
-  "reduce_denominator",
-  "count_as_abstain",
-  "fail_closed",
-  "absolute_quorum"
-]);
-var VoteRecordSchema = z8.object({
-  /**
-   * Schema version. '1.1' marked the chain→record-set+sequence model (#3927);
-   * '1.2' adds the optional `ratifies` subject-binding field (#3927 item 1);
-   * '1.10' adds the optional `ratifiesPr` PR-binding (#5130); '1.11' the
-   * optional `errorPolicy` (#6211). Every tier is accepted — a 1.1 record
-   * (no `ratifies`) verifies unchanged because each optional is folded into
-   * the self-hash ONLY when present (see {@link computeVoteRecordHash}).
-   * Tiers are labels, not ordered numbers: '1.10' follows '1.9' by
-   * convention only and nothing compares them.
-   */
-  version: z8.enum([
-    "1.1",
-    "1.2",
-    "1.3",
-    "1.4",
-    "1.5",
-    "1.6",
-    "1.7",
-    "1.8",
-    "1.9",
-    "1.10",
-    "1.11"
-  ]),
-  /** Unique record id (also usable as a `ratificationVoteRef`). */
-  id: z8.string().min(1),
-  /**
-   * Monotonic sequence number (integer ≥ 0). Assigned as (max existing
-   * sequence)+1 at write time. Sorted, the set of sequences must cover
-   * 0..maxSeq with no gap (omission detection); DUPLICATE sequences are a
-   * benign concurrent-fork signal, not tampering.
-   */
-  sequence: z8.number().int().nonnegative(),
-  /** ISO-8601 timestamp the vote was recorded. */
-  recordedAt: z8.string().min(1),
-  /**
-   * SHA-256 of the FULL proposal text. The proposal itself is truncated for
-   * the human record (`proposal`), but the hash binds the record to the exact
-   * proposal voted on — a later edit of `proposal` that changes meaning is
-   * detectable by recomputing this hash from the original.
-   */
-  proposalHash: z8.string().length(64),
-  /** Truncated proposal text for the human/reviewer record. */
-  proposal: z8.string(),
-  /** The voting strategy used. */
-  strategy: z8.enum([
-    "simple_majority",
-    "supermajority",
-    "unanimous",
-    "higher_order",
-    "opinion_wise",
-    "proof_of_learning"
-  ]),
-  /** The resolved decision. */
-  decision: VoteRecordDecisionSchema,
-  /** Approval fraction as a percentage (0-100). */
-  approvalPercentage: z8.number().min(0).max(100),
-  /** Vote-count breakdown. */
-  voteCounts: VoteRecordCountsSchema,
-  /** Per-voter {role, decision, confidence} summary. */
-  voters: z8.array(VoterSummarySchema),
-  /** Optional correlation/decision id linking to the cost rollup / trace. */
-  correlationId: z8.string().min(1).optional(),
-  /**
-   * Per-option distribution for a multi-option proposal (#4452, schema 1.3).
-   *
-   * Present only when the vote declared `options`. Absent on an ordinary
-   * yes/no vote, and absent on every 1.1/1.2 record — which is why it is
-   * folded into the self-hash ONLY when present (see
-   * {@link computeVoteRecordHash}), exactly as `ratifies` was.
-   *
-   * Without this, a 6-1 or 5-2 option split is recorded as `approve: 7` and
-   * reads as unanimous. Threshold semantics invert too: `unanimous` becomes
-   * the EASIEST bar to clear, because every engaged voter approves while
-   * choosing different things.
-   */
-  // No `.min(1)` (#6049). The rule this field's own docstring states is
-  // "present only when the vote declared `options`" -- keyed on DECLARATION,
-  // not on whether anyone picked one. `.min(1)` encoded the older, narrower
-  // rule, so once the builder started emitting `[]` for "declared, nothing
-  // attributable" the record appended fine and then failed to parse on read:
-  // `too_small, minimum 1`. The write path does not validate, so the line
-  // landed in the ledger and `parseVoteRecordsText` silently dropped it --
-  // the case most worth auditing became the one no reader could see.
-  //
-  // Relaxing is a pure widening: no previously-valid record changes meaning
-  // or hash, and no persisted record can currently hold an empty tally.
-  optionTally: z8.array(VoteRecordOptionCountSchema).optional(),
-  /**
-   * Selection coverage for a multi-option vote (#4472, schema 1.4).
-   *
-   * `optionTally` alone cannot distinguish dissent from absence: `4 pick X
-   * + 3 unreadable` and a genuine 4/3 split both leave a leading share of
-   * 57%. Recording how many approvers produced no usable selection is what
-   * makes a partial measurement legible AS partial — the condition every
-   * voter attached to adopting the "credit no option" rule.
-   */
-  optionCoverage: VoteRecordOptionCoverageSchema.optional(),
-  /**
-   * Panel coverage (#5738, schema 1.5). Present only when at least one
-   * requested voter failed to return a vote; absent keeps a clean panel on
-   * the pre-1.5 projection, so every historical record still verifies.
-   */
-  panelCoverage: VoteRecordPanelCoverageSchema.optional(),
-  /**
-   * The loop/strategy subject this vote RATIFIES (#3927 item 1). Present only on
-   * a ratification vote; set at vote time and bound into the self-hash (so it is
-   * tamper-evident). The authority-tier promotion gate
-   * (`scripts/check-authority-tier-drift.ts`) resolves a transition's
-   * `ratificationVoteRef` to a record and requires `ratifies === transition.subject`
-   * (with `decision === 'approved'` and `strategy === 'higher_order'`). Absent on
-   * an ordinary (non-ratification) vote; a 1.1 record never carries it.
-   */
-  ratifies: z8.string().min(1).optional(),
-  /**
-   * The PR this vote RATIFIES, bound to the head the panel saw (#5130 step 1,
-   * schema 1.10; panel decision Q1 option A, 5 of 6). Present only on a
-   * governor-path ratification vote; hash-covered like `ratifies`, so a
-   * record cannot be repointed at a different PR or a later push without
-   * breaking its hash. The governor gate (step 2, #5779/#5131) resolves the
-   * record from the committed ledger and requires `pr` to be the PR under
-   * review and `headSha` to be its head (or `head^` when `head` touches only
-   * the ledger — the caller-commits tip). Absent on every pre-1.10 record.
-   *
-   * A SEPARATE key rather than a structured encoding of `ratifies`: that
-   * field is the authority-ladder SUBJECT, compared by string equality to
-   * `transition.subject` and grouped by `conflictingRatifiedSubjects`; no
-   * resolver parses it. Overloading it would give one field two consumers
-   * with two equality rules. The two may coexist on one record.
-   */
-  ratifiesPr: VoteRecordPrBindingSchema.optional(),
-  /**
-   * The error policy the panel actually ran under (#6211, schema 1.11): the
-   * EFFECTIVE policy after `consensus_vote` applied the per-strategy default
-   * (`input.errorPolicy ?? getDefaultErrorPolicy(strategy)`), not the raw
-   * input the caller may have omitted. Hash-covered, present-only.
-   *
-   * Before this tier the policy reached the RESPONSE only, so the governor
-   * ledger gate (`scripts/governor-ledger-evidence.ts`) could not say which
-   * policy a whole-panel ratification was configured with: under
-   * `absolute_quorum` an errored seat voids the vote, so the one
-   * ledger-observable trace of a different policy was an approved record
-   * with `panelCoverage.errored > 0` — and a whole panel under
-   * `reduce_denominator` looked exactly like one under `absolute_quorum`.
-   * The gate's `wrong-error-policy` verdict reads this field; a record
-   * without it (every pre-1.11 record) keeps the panel-coverage inference
-   * and is reported as `errorPolicy: unrecorded`.
-   */
-  errorPolicy: VoteRecordErrorPolicySchema.optional(),
-  /**
-   * ADVISORY hash of the tip record at write time (absent for the first).
-   * Retained for audit texture but NOT covered by `hash` and NOT verified —
-   * the record-set model is position-independent (#3927).
-   */
-  previousHash: z8.string().length(64).optional(),
-  /** SHA-256 over every field above EXCEPT `previousHash` (and except `hash`). */
-  hash: z8.string().length(64)
-}).strict();
-function foldOptionalFields(base, payload) {
-  const withTally = payload.optionTally !== void 0 ? {
-    ...base,
-    optionTally: payload.optionTally.map((o) => ({ option: o.option, count: o.count }))
-  } : base;
-  const withCoverage = payload.optionCoverage !== void 0 ? {
-    ...withTally,
-    optionCoverage: {
-      approverCount: payload.optionCoverage.approverCount,
-      selectedCount: payload.optionCoverage.selectedCount,
-      unattributedApprovals: payload.optionCoverage.unattributedApprovals
-    }
-  } : withTally;
-  const withPanel = payload.panelCoverage !== void 0 ? {
-    ...withCoverage,
-    panelCoverage: {
-      requested: payload.panelCoverage.requested,
-      responded: payload.panelCoverage.responded,
-      errored: payload.panelCoverage.errored,
-      erroredRoles: [...payload.panelCoverage.erroredRoles]
-    }
-  } : withCoverage;
-  const withRatifies = payload.ratifies !== void 0 ? { ...withPanel, ratifies: payload.ratifies } : withPanel;
-  const withPrBinding = payload.ratifiesPr !== void 0 ? { ...withRatifies, ratifiesPr: projectPrBinding(payload.ratifiesPr) } : withRatifies;
-  return payload.errorPolicy !== void 0 ? { ...withPrBinding, errorPolicy: payload.errorPolicy } : withPrBinding;
-}
-function computeVoteRecordHash(payload) {
-  const base = {
-    version: payload.version,
-    id: payload.id,
-    sequence: payload.sequence,
-    recordedAt: payload.recordedAt,
-    proposalHash: payload.proposalHash,
-    proposal: payload.proposal,
-    strategy: payload.strategy,
-    decision: payload.decision,
-    approvalPercentage: payload.approvalPercentage,
-    // Rebuild voteCounts in schema order (approve, reject, abstain, total) so the
-    // hash does not depend on how the nested object's keys were ordered (#3962).
-    voteCounts: {
-      approve: payload.voteCounts.approve,
-      reject: payload.voteCounts.reject,
-      abstain: payload.voteCounts.abstain,
-      total: payload.voteCounts.total
-    },
-    // `reasoning` / `reasoningTruncated` (#5373, schema 1.6) are appended per
-    // entry ONLY when present, on the same rule as the record-level optional
-    // fields: a pre-1.6 voter entry re-hashes byte-identical, so every
-    // historical record still verifies, while editing or removing a stored
-    // reasoning flips the hash.
-    voters: payload.voters.map(projectVoterSummary),
-    correlationId: payload.correlationId ?? null
+function panelDiversityOf(votes) {
+  const models = answeringSeats(votes).map(resolvedModel).filter((m) => m !== void 0);
+  return {
+    distinctModels: countDistinctModels(models),
+    fallbacks: seatFallbacks(votes).length
   };
-  const canonical = JSON.stringify(foldOptionalFields(base, payload));
-  return crypto.createHash("sha256").update(canonical).digest("hex");
 }
-function hashProposal(proposal) {
-  return crypto.createHash("sha256").update(proposal).digest("hex");
+var MIN_PANEL_FOR_DIVERSITY_WARNING = 3;
+function singleModelPanelWarning(votes) {
+  if (votes.length < MIN_PANEL_FOR_DIVERSITY_WARNING) return void 0;
+  const answered = answeringSeats(votes);
+  const models = answered.map(resolvedModel);
+  const model = models[0];
+  if (model === void 0 || models.includes(void 0)) return void 0;
+  if (panelDiversityOf(votes).distinctModels !== 1) return void 0;
+  const silent = votes.length - answered.length;
+  const missing = silent > 0 ? ` (${String(silent)} did not answer)` : "";
+  return `All ${String(answered.length)} seats answered on ${model}${missing}; independence is weaker than assigned.`;
 }
 
 // src/mcp/tools/consensus-vote-option-detection.ts
@@ -5876,7 +5940,9 @@ function toAgentVoteSummary(result) {
     // #6094: same rule for a seat that could not read the artifact.
     ...result.source === "unverifiable" ? { unverifiable: true } : {},
     // #6115: and for a seat that answered elsewhere.
-    ...result.fallback !== void 0 ? { fallback: result.fallback } : {}
+    ...result.fallback !== void 0 ? { fallback: result.fallback } : {},
+    // #6246: and for what a recovered seat was retried from.
+    ...result.retriedFrom !== void 0 ? { retriedFrom: result.retriedFrom } : {}
   };
 }
 function panelDegradationWarning(errorCount, total) {
@@ -6090,7 +6156,7 @@ function logPartialProposal(bounded, log) {
 }
 async function runContrarianCheck(proposal, log) {
   try {
-    const { executeExpert } = await import("./expert-bridge-CH5WJXKF.js");
+    const { executeExpert } = await import("./expert-bridge-QX2UR2BM.js");
     const bounded = boundArtifactForReview(proposal, CONTRARIAN_PROPOSAL_BUDGET, "proposal");
     logPartialProposal(bounded, log);
     const result = await executeExpert("architecture", buildContrarianPrompt(bounded));
@@ -6236,17 +6302,18 @@ function toVoterSummaries(votes) {
       // the fallback the live result stated. `model` alone showed seven
       // identical values on a panel assigned three ways and could not say so.
       ...v.assignedCli !== void 0 ? { assignedCli: v.assignedCli } : {},
-      ...v.fallback !== void 0 ? { fallback: projectSeatFallback(v.fallback) } : {}
+      ...v.fallback !== void 0 ? { fallback: projectSeatFallback(v.fallback) } : {},
+      // #6246: what the per-role retry replaced, so the record names both the
+      // seat's final state and the state it recovered from. The live retry
+      // already clipped and de-controlled the cause; this is projection only.
+      ...v.retriedFrom !== void 0 ? { retriedFrom: projectRetriedFrom(v.retriedFrom) } : {}
     });
   }
   return summaries;
 }
 function reasoningFields(reasoning) {
-  if (reasoning.length <= MAX_VOTER_REASONING_CHARS) return { reasoning };
-  return {
-    reasoning: reasoning.slice(0, MAX_VOTER_REASONING_CHARS),
-    reasoningTruncated: true
-  };
+  const { text, truncated } = clipForRecord(reasoning);
+  return { reasoning: text, ...truncated === true ? { reasoningTruncated: true } : {} };
 }
 function recordDecisionFor(input) {
   return input.resolvedDecision ?? outcomeToDecision(input.result, input.votes, input.errorVoided ?? false);
@@ -6260,15 +6327,22 @@ function deriveOptionFields(votes, declaredOptions) {
   return { optionTally: tallied ?? [], optionCoverage: coverageOf(votes) };
 }
 function recordVersion(optionTally, optionCoverage, panelCoverage, voters, recordLevel) {
+  const voterTier = voterTierOf(voters);
+  if (voterTier === "1.12") return "1.12";
   if (recordLevel.errorPolicy !== void 0) return "1.11";
   if (recordLevel.ratifiesPr !== void 0) return "1.10";
+  if (voterTier !== void 0) return voterTier;
+  if (panelCoverage !== void 0) return "1.5";
+  if (optionCoverage !== void 0) return "1.4";
+  return optionTally !== void 0 ? "1.3" : "1.2";
+}
+function voterTierOf(voters) {
+  if (voters.some((v) => v.retriedFrom !== void 0)) return "1.12";
   if (voters.some((v) => v.assignedCli !== void 0 || v.fallback !== void 0)) return "1.9";
   if (voters.some((v) => v.model !== void 0 || v.unverifiable === true)) return "1.8";
   if (voters.some((v) => v.retried === true)) return "1.7";
   if (voters.some((v) => v.reasoning !== void 0)) return "1.6";
-  if (panelCoverage !== void 0) return "1.5";
-  if (optionCoverage !== void 0) return "1.4";
-  return optionTally !== void 0 ? "1.3" : "1.2";
+  return void 0;
 }
 function panelCoverageOf(votes, always) {
   const erroredRoles = votes.filter((v) => v.source === "error").map((v) => v.role);
@@ -8753,6 +8827,7 @@ export {
   DEFAULT_VOTE_TIMEOUT_MS,
   isRateLimitError,
   PersistentOutcomeStore,
+  VoteRecordPrBindingSchema,
   isAbsentSeat,
   NoAdapterError,
   resolveAdapter,
@@ -8805,7 +8880,6 @@ export {
   createCorrelationTracker,
   seatFallbacks,
   panelDiversityOf,
-  VoteRecordPrBindingSchema,
   VotingStrategySchema,
   ErrorPolicySchema,
   VoteThresholdSchema,
@@ -8827,4 +8901,4 @@ export {
   CONSENSUS_VOTE_TOOL_SCHEMA,
   registerConsensusVoteTool
 };
-//# sourceMappingURL=chunk-YF3YIHPZ.js.map
+//# sourceMappingURL=chunk-3A5BXLPV.js.map