okstra 0.179.1 → 0.179.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "okstra",
-  "version": "0.179.1",
+  "version": "0.179.2",
   "description": "Host-aware multi-provider cross-verification orchestrator runtime and agent skills.",
   "license": "MIT",
   "author": "devonshin",

package/runtime/BUILD.json

@@ -1,5 +1,5 @@
 {
-  "package": "0.179.1",
-  "builtAt": "2026-08-20T08:40:17.534Z",
+  "package": "0.179.2",
+  "builtAt": "2026-08-20T11:20:27.145Z",
   "repoRoot": "/home/runner/work/okstra/okstra"
 }

package/runtime/prompts/lead/plan-body-verification.md

@@ -230,6 +230,9 @@ round before any host or provider process starts.
    **Verdict provenance (BLOCKING).** Every verdict recorded in `planItems[].verdicts[]` MUST trace back to a dispatch that actually returned a result file at the path above. The whole gate — classification, self-fix eligibility, promotion, `gateBlockedBy` — is computed from these votes, so an unbacked vote lets the round be skipped while the gate still reads `passed`. **Enforced:** `validators/validate-run.py` `_validate_plan_body_verdict_provenance` fails any `verdicts[].worker` with no matching `<worker>-plan-verify-r<N>-<task-type>-<seq>.md` result file. Recording a `verification-error` for a dispatch that produced no result is the correct way to represent a failed worker — inventing an `AGREE` is a contract violation.
 
 4. After all dispatches return, lead aggregates verdicts per `P-*` item across workers and classifies each:
+
+   **Every item carries at least one verdict row (BLOCKING).** Aggregation covers the whole queue, not the subset that came back cleanly. An item left with an empty `verdicts[]` is not a weak signal the gate can discount — it classifies `all-non-result`, states as `needs-reverify`, and folds into `passed-with-dissent` next to items two verifiers actually agreed on, so a plan item nobody judged reads as a passing one. This is the shape a self-fix round produces when the planner adds an item and the targeted round-N queue never picks it up. A worker that returned nothing is a `verification-error` row (step 3), not a missing row; if an item was never dispatched, dispatch it before scoring the round. **Enforced:** `validators/validate-run.py` `_validate_round_recorded_verdicts` fails any run whose `roundCount` ≥ 1 leaves an extracted item with no verdict row.
+
    - `full-consensus` — all participating analysers `AGREE` (SUPPLEMENT counts as agree on the item itself).
    - `partial-consensus` — majority `AGREE`, dissenting `DISAGREE` recorded.
    - `dissent-isolated` — only one worker `DISAGREE`s, others `AGREE` — treat as `partial-consensus` for gate purposes; record dissent. (Distinct from finding-convergence `worker-unique`, which means the *opposite*: only one worker AGREEs. Plan-body classifications use this dedicated label to avoid the collision.)
@@ -290,7 +293,7 @@ round before any host or provider process starts.
    - `Blocks=approval`
    - the item's `planItems[].clarificationId` set to that `C-<N>` (1:1 link). `validators/validate-run.py` `_validate_plan_body_clarification_matching` recomputes each item's class and fails when a majority-disagree item's `clarificationId` is missing, dangling, or points at a non-`approval` row.
    - set `approvalContext.classification` to `user-decision` for a majority `needs-user-input` item, `correctness-critical` for `DISAGREE(a)`, `DISAGREE(f)` on `P-Req-*`, or an independent Requirement Coverage blocker, and `noncritical-dissent` for another surviving majority disagreement.
-   - populate `approvalContext.planItemIds`, `activityIds`, `unblockCondition`, and `recommendedDisposition`. Every option carries a `disposition`: `select` only for `user-decision`, `accept-risk` only for `noncritical-dissent`, and `request-revision` / `reject` for any classification. `correctness-critical` never offers or records `accept-risk`. **Enforced:** `validators/validate-run.py` `_validate_approval_context`.
+   - populate `approvalContext.planItemIds`, `activityIds`, `unblockCondition`, and `recommendedDisposition`. `planItemIds` carries the **extracted item ids verbatim** — the ordinal form the extractor issues (`P-Opt-1`, `P-Step-1.1`), never the human label the plan prose uses for the same thing ("Option C", "Completion B"). The letter label is what that item's `subject` records (§"subject" above: `P-Opt-1` → "Option A: …"), so cite the id and let the subject carry the name; a label written into `planItemIds` reads as an unknown plan item and fails the run. Every option carries a `disposition`: `select` only for `user-decision`, `accept-risk` only for `noncritical-dissent`, and `request-revision` / `reject` for any classification. `correctness-critical` never offers or records `accept-risk`. **Enforced:** `validators/validate-run.py` `_validate_approval_context`.
    - **Self-fix exhaustion is not risk acceptance.** A `noncritical-dissent` item remains blocking until the user explicitly selects `accept-risk`. Record the user's non-empty original text and the `user-decision-required` / `user-decision-evaluated` activity references in `approvalContext.resolution`; only then does `validators/validate-run.py` `_resolved_noncritical_dissent_ids` let `_is_dissent_downgraded` fold it into `passed-with-dissent`.
    - **Correctness-critical defects cannot be waived.** After the user-directed correction, targeted re-verification of every linked item MUST record only `AGREE` or an acceptable `SUPPLEMENT`, and any independent Requirement Coverage blocker MUST be removed before the row becomes `resolved`. A `DISAGREE` or `verification-error` returns it to `open`. **Enforced:** `validators/validate-run.py` `_validate_correctness_resolution`.
    - When a correctness-critical `planner-fixable` item is promoted, its `Statement` MUST state "planner self-fix attempted but unresolved" and name the stop reason. `validators/validate-run.py` `_validate_self_fix_before_clarification` fails when a planner-fixable majority item is promoted while the budget is not exhausted — it requires `selfFixRoundsApplied >= 1` **and** `selfFixStopReason` in `{no-progress, max-rounds-reached}`, so neither `all-resolved` nor `not-attempted` can excuse a promotion.
@@ -553,7 +556,7 @@ Changes from the round-1 template:
 
   `**Prior dissent**: resolved | unresolved | none — <which prior objection, and what the current text does about it>`
 
-**Enforced:** `validators/validate-run.py` `_validate_reverify_prompt_carries_dissent` fails a run whose `plan-verify-r<N>` (N ≥ 2) prompt file lacks the `**Prior round dissent**` block.
+**Enforced — on the answer, not on the question.** `validators/validate-run.py` `_validate_reverify_result_addresses_prior_dissent` fails a run whose round 2+ plan-verify **worker results** lack the `**Prior dissent**` line described directly above. Nothing reads the prompt file, so the `**Prior round dissent**` block is a guideline: it is how you make that line answerable, and a worker cannot write it without one. Note the two spellings are different anchors for different artifacts — `**Prior round dissent**` is the block you put in the prompt, `**Prior dissent**` is the line the worker puts in its result, and only the latter is checked (`scripts/okstra_ctl/verdict_blocks.py` parses it as a response field). A prompt that carries the block while the response format omits the line fails this check with the block present.
 
 ## Worker non-result handling in plan-body round (BLOCKING)
 

package/runtime/python/okstra_ctl/dispatch_core.py

@@ -91,7 +91,11 @@ from .initial_prompt_materialization import (
 )
 from .agent_invocation import AgentInvocationError, materialize_retry_invocation
 from .path_hints import hydrate_active_run_context
-from .schema_excerpt import bundle_excerpt_path, excerpt_version_skew
+from .schema_excerpt import (
+    bundle_excerpt_path,
+    describe_changed,
+    excerpt_contract_skew,
+)
 from .seeding import installed_version
 from .report_finalize import (
     STEP_VALIDATE_RUN,
@@ -2977,11 +2981,17 @@ def _reject_stale_schema_excerpt(
     schema. A run long enough to straddle a runtime upgrade therefore has the
     author writing to one contract and the validator reading another — and the
     only thing that noticed was the renderer, in Phase 6, after the worker had
-    authored the whole report. The two versions are comparable the moment the
+    authored the whole report. The same inputs are already on hand the moment the
     dispatch is built, and the remedy is the same either way, so it belongs here.
 
     Only the report writer is stopped: it is the only worker that authors against
     the excerpt. Re-running bundle prep re-cuts it from the installed schema.
+
+    The stamp alone is not the test. Most releases change nothing this task-type
+    authors against, and re-prep is not a cheap way to rewrite one stamp line: it
+    opens a new run, so every artifact bound to the current one — convergence
+    state, critic merges, the plan-item queue and its verdicts — is left behind.
+    The guard therefore fires on the contract text and names what moved.
     """
     writer = next(
         (job for job in jobs if job.worker_id == REPORT_WRITER_WORKER_ID), None
@@ -2989,21 +2999,24 @@ def _reject_stale_schema_excerpt(
     if writer is None:
         return
     expected = _string_value(manifest.get("expectedReportRecordPath"))
-    if not expected:
+    task_type = _string_value(manifest.get("taskType"))
+    if not expected or not task_type:
         return
     excerpt_path = bundle_excerpt_path(_resolve_project_path(project_root, expected))
     if excerpt_path is None:
         return
     installed = installed_version()
-    cut_from = excerpt_version_skew(excerpt_path, installed)
-    if not cut_from:
+    skew = excerpt_contract_skew(excerpt_path, task_type, installed)
+    if skew is None:
         return
     raise DispatchError(
         f"the bundle's schema excerpt ({excerpt_path}) was cut from okstra "
-        f"{cut_from} but this runtime is {installed}. The report writer authors "
-        f"against that excerpt and validation runs against the installed schema, "
-        f"so dispatching now spends a full authoring pass on the wrong contract. "
-        f"Re-prepare the task bundle to re-cut the excerpt, then dispatch again."
+        f"{skew.cut_from} and this runtime is {installed}, which states "
+        f"{task_type}'s contract differently: {describe_changed(skew.changed)}. "
+        f"The report writer authors against that excerpt and validation runs "
+        f"against the installed schema, so dispatching now spends a full authoring "
+        f"pass on the wrong contract. Re-prepare the task bundle to re-cut the "
+        f"excerpt, then dispatch again."
     )
 
 

package/runtime/python/okstra_ctl/render_final_report.py

@@ -59,7 +59,7 @@ from okstra_ctl.report_contract import (
     markdown_template_for,
 )
 from okstra_ctl.report_markdown import ReportSections
-from okstra_ctl.schema_excerpt import excerpt_cut_from_version
+from okstra_ctl.schema_excerpt import describe_changed, excerpt_contract_skew
 from okstra_ctl.seeding import installed_version
 from okstra_ctl.usage_cells import format_duration_ms, format_int, format_usd
 
@@ -753,34 +753,37 @@ def _bundle_excerpt_path(data_path: Path) -> Path | None:
 
 
 def _with_excerpt_drift_hint(
-    exc: FinalReportRenderError, data_path: Path
+    exc: FinalReportRenderError, data_path: Path, task_type: str
 ) -> FinalReportRenderError:
-    """Name the version skew behind a schema failure, when that is the cause.
+    """Name the contract drift behind a schema failure, when that is the cause.
 
     A long run straddles its own runtime upgrade: the report-writer authors
     against the excerpt frozen into the bundle at prep time, while the renderer
     validates against the installed schema. Without this the author sees only
     `additional property ... not allowed` for a field the excerpt told it to
     write, and has no way to tell a real mistake from a stale bundle.
+
+    An older stamp is not itself the cause. When the excerpt still states this
+    task-type's contract exactly, the failure came from somewhere else, and
+    pointing at the version would send the author to re-prepare a bundle that
+    was never wrong. The hint is attached only when a contract member actually
+    moved, and it names which.
     """
     if "schema validation" not in str(exc):
         return exc
     excerpt_path = _bundle_excerpt_path(data_path)
-    if excerpt_path is None:
-        return exc
-    try:
-        cut_from = excerpt_cut_from_version(
-            json.loads(excerpt_path.read_text(encoding="utf-8"))
-        )
-    except (OSError, json.JSONDecodeError):
+    if excerpt_path is None or not task_type:
         return exc
     current = installed_version()
-    if not cut_from or not current or cut_from == current:
+    skew = excerpt_contract_skew(excerpt_path, task_type, current)
+    if skew is None:
         return exc
     return FinalReportRenderError(
         f"{exc} — the bundle's schema excerpt ({excerpt_path}) was cut from okstra "
-        f"{cut_from} but validation ran on {current}; author against the installed "
-        "schema, not the excerpt, or re-prepare the bundle."
+        f"{skew.cut_from} but validation ran on {current}, which states "
+        f"{task_type}'s contract differently: {describe_changed(skew.changed)}; "
+        "author against the installed schema, not the excerpt, or re-prepare the "
+        "bundle."
     )
 
 
@@ -815,7 +818,9 @@ def render_to_file(
             template_path=resolved_template,
         )
     except FinalReportRenderError as exc:
-        raise _with_excerpt_drift_hint(exc, data_path) from exc
+        header = data.get("header") if isinstance(data, dict) else None
+        task_type = header.get("taskType") if isinstance(header, dict) else ""
+        raise _with_excerpt_drift_hint(exc, data_path, str(task_type or "")) from exc
 
     output_path.parent.mkdir(parents=True, exist_ok=True)
     tmp = output_path.with_suffix(output_path.suffix + f".tmp.{os.getpid()}")

package/runtime/python/okstra_ctl/schema_excerpt.py

@@ -23,9 +23,12 @@ from __future__ import annotations
 
 import json
 import re
+from collections.abc import Sequence
+from dataclasses import dataclass
 from pathlib import Path
 
-from .report_contract import TASK_TYPE_DATA_PROPERTY
+from .final_report_schema import load_schema_version
+from .report_contract import CURRENT_REPORT_SCHEMA_VERSION, TASK_TYPE_DATA_PROPERTY
 
 
 _ALL_PER_TYPE_PROPERTIES = frozenset(TASK_TYPE_DATA_PROPERTY.values())
@@ -79,28 +82,100 @@ def excerpt_cut_from_version(excerpt: dict) -> str:
     return value if isinstance(value, str) else ""
 
 
-def excerpt_version_skew(excerpt_path: Path, installed: str) -> str:
-    """The version the bundle excerpt was cut from, when it is not *installed*.
+@dataclass(frozen=True)
+class ExcerptSkew:
+    """A bundle excerpt whose contract text differs from the installed one.
 
-    Empty means no actionable skew: the file is absent or unreadable, carries no
-    stamp, or matches. A non-empty return is the older version, which the caller
-    turns into its own message.
+    ``cut_from`` is the older okstra version stamped into the bundle;
+    ``changed`` names the excerpt members that differ, as ``properties.<name>``
+    / ``$defs.<name>`` / a bare top-level key.
+    """
+
+    cut_from: str
+    changed: tuple[str, ...]
+
+
+def _changed_members(section: str, old: object, fresh: object) -> list[str]:
+    old_map = old if isinstance(old, dict) else {}
+    fresh_map = fresh if isinstance(fresh, dict) else {}
+    return [
+        f"{section}.{name}"
+        for name in sorted(set(old_map) | set(fresh_map))
+        if old_map.get(name) != fresh_map.get(name)
+    ]
+
+
+def _changed_excerpt_members(old: dict, fresh: dict) -> tuple[str, ...]:
+    """Every member of *old* that *fresh* states differently.
+
+    The stamp is excluded by definition — it is the thing that differs whenever
+    the two were cut by different runtimes, and it says nothing about what the
+    author is being told to write.
+    """
+    changed = []
+    for section in ("properties", "$defs"):
+        changed.extend(_changed_members(section, old.get(section), fresh.get(section)))
+    changed.extend(
+        key
+        for key in sorted(set(old) | set(fresh))
+        if key not in ("properties", "$defs", EXCERPT_VERSION_KEY)
+        and old.get(key) != fresh.get(key)
+    )
+    return tuple(changed)
+
+
+def describe_changed(changed: Sequence[str], limit: int = 5) -> str:
+    """A one-clause rendering of :attr:`ExcerptSkew.changed` for an error message."""
+    if not changed:
+        return "no contract member differs"
+    head = ", ".join(f"`{name}`" for name in changed[:limit])
+    rest = len(changed) - limit
+    return f"{head} and {rest} more" if rest > 0 else head
+
+
+def excerpt_contract_skew(
+    excerpt_path: Path, task_type: str, installed: str
+) -> ExcerptSkew | None:
+    """What this task-type's contract states differently since the bundle was cut.
+
+    ``None`` means the bundle excerpt still states the installed contract, and a
+    caller that blocks on skew must let the run through. Four ways to get it:
+    the file is absent or unreadable, it carries no stamp, the stamp matches, or
+    — the case a version comparison gets wrong — the stamp is older but every
+    contract member is identical because the release changed nothing this
+    task-type authors against. A patch release that touches only dispatch or
+    wizard code lands in that fourth case, and blocking an in-flight run on it
+    costs a full bundle re-prep to rewrite one stamp line.
+
+    The installed schema is loaded here rather than passed in, so a caller only
+    needs the excerpt path and the manifest's task-type. An install too old to
+    carry `schemas/` cannot be compared at all: that returns ``None`` too, since
+    an unprovable drift is not grounds to stop a dispatch.
 
     The comparison used to live only in the renderer's error decorator, so it ran
     in Phase 6 — after a worker had already authored a whole report against a
-    stale excerpt. The same two values are available much earlier, and the fix
+    stale excerpt. The same inputs are available much earlier, and the fix
     (re-prepare the bundle) is the same either way.
     """
     if not installed:
-        return ""
+        return None
     try:
         excerpt = json.loads(excerpt_path.read_text(encoding="utf-8"))
     except (OSError, json.JSONDecodeError):
-        return ""
+        return None
     if not isinstance(excerpt, dict):
-        return ""
+        return None
     cut_from = excerpt_cut_from_version(excerpt)
-    return cut_from if cut_from and cut_from != installed else ""
+    if not cut_from or cut_from == installed:
+        return None
+    try:
+        fresh = build_schema_excerpt(
+            load_schema_version(CURRENT_REPORT_SCHEMA_VERSION), task_type, installed
+        )
+    except Exception:  # noqa: BLE001 — an unloadable schema proves no drift
+        return None
+    changed = _changed_excerpt_members(excerpt, fresh)
+    return ExcerptSkew(cut_from, changed) if changed else None
 
 
 def bundle_excerpt_path(start: Path) -> Path | None:

package/runtime/validators/validate-run.py

@@ -4001,7 +4001,14 @@ def _recompute_plan_body_gate(
         return "aborted-non-result"
     if any(c == "majority-disagree" for c in classes):
         return "blocked-by-disagreement"
-    if any(c in ("has-dissent", "needs-reverify") for c in classes):
+    if any(c in ("has-dissent", "needs-reverify", "all-non-result") for c in classes):
+        # `all-non-result` belongs here for the same reason `needs-reverify`
+        # does — it IS that shape with zero participating votes instead of one
+        # (`_state_classification` maps it there, and the contract's step 5
+        # lists `needs-reverify` under `passed-with-dissent`). Left out, an
+        # item no verifier could judge scored `passed`: the all-error case
+        # already reads `needs-reverify` in the state file while the gate it
+        # feeds says every item reached consensus.
         return "passed-with-dissent"
     return "passed"
 
@@ -4448,10 +4455,18 @@ def _validate_approval_activity_refs(
     }
     unknown_activity_ids = sorted(activity_ids - set(activities))
     if not activity_ids or unknown_activity_ids:
+        # `recorded` names what the ACTIVITY LEDGER holds, not what this row
+        # cited. Printing the row's own ids put the same value on both sides —
+        # `unknown=['A-501'], recorded=['A-501']` — and hid the actual cause,
+        # which is an empty `agentActivity[]` (the run never called
+        # `okstra agent-activity append`). A reader cannot reach that from a
+        # message that contradicts itself.
+        recorded = sorted(activities)
         failures.append(
             f"final-report data.json: approval clarification `{row_id}` activityIds "
             f"must reference agentActivity[].activityId values; unknown="
-            f"{unknown_activity_ids or 'none'}, recorded={sorted(activity_ids)}."
+            f"{unknown_activity_ids or 'none'}, recorded in agentActivity[]="
+            f"{recorded or 'none — the activity ledger is empty'}."
         )
     elif not all(
         _is_decision_required_activity(activities.get(ref)) for ref in activity_ids
@@ -4913,9 +4928,17 @@ def _validate_approval_context(
             historical_coverage_ids,
             activities,
         ):
+            # 사람이 읽는 옵션 라벨(`P-Opt-C`)을 ID 로 착각하는 경우가 여기로
+            # 온다. ID 는 추출기가 발행한 서수(`P-Opt-1`)이고, 문자 라벨은 그
+            # 항목의 `subject` 가 나른다. 무엇을 써야 하는지 알려 주지 않으면
+            # 작성자가 두 체계 사이에서 되돌아갈 곳이 없다.
             failures.append(
                 f"final-report data.json: approval clarification `{row_id}` planItemIds "
-                f"reference unknown plan items {sorted(unknown_ids)}."
+                f"reference unknown plan items {sorted(unknown_ids)}. Use the "
+                "extracted item id verbatim (ordinal, e.g. `P-Opt-1`) — the human "
+                "label it carries (\"Option C\") lives in that item's `subject`, "
+                f"not in its id. Extracted ids in this report: "
+                f"{sorted(plan_items_by_id)[:12] or 'none'}."
             )
         linked_items = [
             plan_items_by_id[item_id]
@@ -6606,7 +6629,7 @@ def _validate_stage_carry_sidecar_exists(
 
 
 def _validate_round_recorded_verdicts(data: dict, failures: list[str]) -> None:
-    """A round that ran must leave the votes it ran on.
+    """A round that ran must leave the votes it ran on — item by item.
 
     The gate is re-derived from `planItems[].verdicts[]`, so an empty table
     removes the very evidence the recompute judges. A *healthier* declared gate
@@ -6615,6 +6638,22 @@ def _validate_round_recorded_verdicts(data: dict, failures: list[str]) -> None:
     declaration: a lead writing `aborted-non-result` over an empty table
     produces a gate nothing can audit, indistinguishable from a round that was
     dispatched and whose results were never transcribed.
+
+    The per-item form is what survives a self-fix loop. Round 2+ queues are
+    targeted, so an item the planner adds mid-loop and never puts in one keeps
+    an empty `verdicts[]` while every neighbour carries votes — and nothing
+    downstream reads that as a gap. An empty table classifies `all-non-result`
+    (`_classify_plan_item_gate`), which states as `needs-reverify`, which
+    `_recompute_plan_body_gate` folds into `passed-with-dissent`: a plan item
+    no verifier ever judged leaves the gate in a passing value. The whole-table
+    check could not see it, since it stands down the moment any one item has a
+    vote.
+
+    An unjudged item is distinguishable from a legitimately unresolved one, and
+    the difference is what is recorded rather than what is missing. A peer that
+    returned nothing is a `verification-error` VOTE (§"Round protocol" step 3),
+    so an all-error item still carries rows and still folds to `needs-reverify`
+    on purpose. An empty table means no dispatch was accounted for at all.
     """
     ip = data.get("implementationPlanning")
     if not isinstance(ip, dict):
@@ -6628,16 +6667,33 @@ def _validate_round_recorded_verdicts(data: dict, failures: list[str]) -> None:
     items = [it for it in (pbv.get("planItems") or []) if isinstance(it, dict)]
     if not items:
         return
-    if any(it.get("verdicts") for it in items):
+    empty = [str(it.get("id") or "<unnamed>") for it in items if not it.get("verdicts")]
+    if not empty:
+        return
+    if len(empty) == len(items):
+        failures.append(
+            "final-report data.json: planBodyVerification declares "
+            f"`roundCount`={round_count} but every one of the {len(items)} "
+            "`planItems[]` carries an empty `verdicts[]`. A round that ran MUST "
+            "record the votes it produced — the gate is re-derived from this "
+            "table, so an empty one leaves the declared `gateResult` unauditable. "
+            "A dispatch that returned nothing is recorded as `verification-error`, "
+            'not omitted (plan-body-verification.md §"Round protocol" step 4).'
+        )
         return
+    shown = ", ".join(f"`{item_id}`" for item_id in empty[:5])
+    more = f" and {len(empty) - 5} more" if len(empty) > 5 else ""
     failures.append(
         "final-report data.json: planBodyVerification declares "
-        f"`roundCount`={round_count} but every one of the {len(items)} "
-        "`planItems[]` carries an empty `verdicts[]`. A round that ran MUST "
-        "record the votes it produced — the gate is re-derived from this "
-        "table, so an empty one leaves the declared `gateResult` unauditable. "
-        "A dispatch that returned nothing is recorded as `verification-error`, "
-        'not omitted (plan-body-verification.md §"Round protocol" step 4).'
+        f"`roundCount`={round_count} but {len(empty)} of {len(items)} "
+        f"`planItems[]` carry an empty `verdicts[]`: {shown}{more}. Every "
+        "extracted plan item MUST be judged by the round — an item with no "
+        "vote at all is not a dissent the gate can weigh, it is a plan item "
+        "nobody verified, and it currently folds into `passed-with-dissent` "
+        "alongside items that were properly cross-checked. Either dispatch it "
+        "in this round's queue, or record the non-result as a "
+        "`verification-error` verdict per plan-body-verification.md "
+        '§"Round protocol" step 3 — an item is never left with no row.'
     )