fix: make the verifiers able to refuse, and the citations able to be wrong

[arst]

Fourth review pass. Six findings, all about what a sample is entitled to claim rather than whether it runs.

1. Least-to-Most accepted an answer its verifier had already failed (medium-high)

The real bug. A final answer that failed the deterministic billing check twice was still added to solved and printed as === Final answer === — directly under the log line proving it wrong.

Steps now carry Accepted / Unverified / Contested. A contested step ends the chain rather than becoming an established fact for the steps that would cite it, and the run prints the candidate beside the host's figure with status: CONTESTED instead of a total.

A verifier that cannot block acceptance is only telemetry.

Both paths were run live — the passing one, and the failing one by temporarily perturbing the host's schedule so the check could not agree.

2. GraphRAG traded fabricated provenance for inflated provenance (medium)

The previous fix dropped invented ids, then attached every document in the community to the summary — so documents the summary never rested on appeared to support it.

The citation is now claimed ∩ actual. Unclaimed community members print as "in this community but were not claimed as used — not cited as support", and a summary with no surviving id is not carried to the global answer at all.

Kept single-summary provenance rather than moving to claim-level SummaryClaim — that is the right next step, but it is a redesign of the synthesis stage, not a fix.

3. CoVe promoted a self-report into factual authority (medium)

check CONFIDENT and disagrees -> correct the draft let the same deployment's own confidence label decide which factual value wins. No evidence enters the system between the draft and the check, so preferring the check is only preferring the model's later guess.

Disagreement now resolves to contested either way, stating both values and what would settle them. The CONFIDENT:/UNCERTAIN: prefix is reported, not obeyed. Live run:

Founding year: AD 15 [CONTESTED: the blind check said around 15 BC (self-reported confident)]

4. Dual-LLM stale comment (minor)

A comment said the injected 48000.00 "would file", two lines above the gate that holds it. Now: it passes the type gate untouched, and the separate unattended-value policy holds it for a person.

5. Clarification screening rediscovered the slot it had already resolved (minor)

ScreenedQuestion carries TargetSlot, so the lexical match happens once in Screen and the merge stops repeating it. No behaviour change today; it removes the drift.

6. Refusal.NoSubscriber was dead taxonomy (minor)

"Nobody subscribes" was ambiguous between the workflow finishing and a topic name nothing will ever match — so DecisionMdae became a successful terminal event. Terminal topics are now declared (bus.RegisterTerminal("DecisionMade")); anything else unsubscribed is a NoSubscriber dead letter. The run publishes one misspelled event at the end to show a typo failing loudly.

One unasked extra there: the terminal event's payload — the approver's actual decision — was never printed, so the workflow's own output was invisible. One line.

---

Six pattern docs updated to match. 441 tests pass (+1), solution builds clean, all six changed samples re-run against the live deployment.

🤖 Generated with Claude Code

https://claude.ai/code/session_0161UFxvL3zPhufoYaQh27Ss