fix(verifier): report headings the ship gate reads

gates/selftest.sh

@@ -50,7 +50,7 @@ budget='623 SKILL.md
 1816 skills/6-maintain/SKILL.md
 818 roles/adversary.md
 440 roles/researcher.md
-2422 roles/verifier.md'
+2420 roles/verifier.md'
 for p in "$kit"/SKILL.md "$kit"/AGENTS.md "$kit"/skills/*/SKILL.md "$kit"/roles/*.md; do
   rel=${p#"$kit"/}
   max=$(printf '%s\n' "$budget" | awk -v f="$rel" '$2 == f { print $1 }')
@@ -90,6 +90,15 @@ d=.sdlc/work/feat-c; mkdir -p "$d"; echo goal > "$d/intent.md"; lens "$d/evidenc
 sed '$d' "$d/evidence.md" > "$t/ev"; printf 'VERDICT: <PASS>\n' >> "$t/ev"; cp "$t/ev" "$d/evidence.md"
 out=$("$kit/gates/approve.sh" ship "$d/evidence.md" 2>&1) && fail "ship approved with the Intent match VERDICT missing"
 has "$out" "no VERDICT: line under ### Intent match." "the missing lens not named alone"
+#    a reviewer report written to roles/verifier.md's template, sub-headings
+#    included, is what ship reads — pasted unchanged, it passes
+grep -q '^### <E2E | Side effects | Intent match>' "$kit/roles/verifier.md" \
+  || fail "roles/verifier.md report heading no longer matches the ship gate's lens headings"
+r=.sdlc/work/feat-r; mkdir -p "$r"; echo goal > "$r/intent.md"; : > "$r/evidence.md"
+for l in 'E2E' 'Side effects' 'Intent match'; do
+  printf '### %s\n#### Executed checks\n- ran\nVERDICT: PASS\n' "$l" >> "$r/evidence.md"
+done
+"$kit/gates/approve.sh" ship "$r/evidence.md" >/dev/null 2>&1 || fail "ship refused a report in roles/verifier.md's own layout"
 printf 'no independent verification available: no subagent in this harness\n' > "$d/evidence.md"
 "$kit/gates/approve.sh" ship "$d/evidence.md" >/dev/null || fail "ship refused over the rule-5 gap line"
 lens "$d/evidence.md"

roles/verifier.md

@@ -171,20 +171,21 @@ snapshotted`; live source unreachable → say so, the snapshot stands.
 
 Record every check as **command or tool · environment · scenario · observed
 result** (deciding lines verbatim; bulk into `.sdlc/work/<slug>/scratch/`).
-Include report provenance: actual reviewer session/agent and tool-call IDs
-when exposed, author/reviewer relationship, source revision plus working-tree
-identity, recipe and upstream input identities, exact input paths, commands,
-exit codes, log paths and deciding lines. An unavailable identifier is
-`unknown — <why>`; never fabricate an ID or claim a signature proves review.
+Include report provenance — every item of the template's Provenance,
+Inputs/source and Evidence lines, with actual IDs when exposed. An
+unavailable identifier is `unknown — <why>`; never fabricate an ID or claim a
+signature proves review.
 Preserve the report unchanged in evidence.md, shared provenance once for a
-combined reviewer and separate per-lens observations and VERDICT lines.
-**No environment = NOT VERIFIED**: name what is missing (no runnable app, no
-browser tool, no reachable API, no permitted credentials). Never a pass, and
-never unit tests standing in for the real run; delivering over the gap is the
-human's explicit call, recorded in evidence.md.
+combined reviewer and separate per-lens observations and VERDICT lines. Head
+each lens exactly as below (`####` for sub-headings): the ship gate reads each
+VERDICT under its `###` lens heading.
+**No environment = NOT VERIFIED**: name what is missing (runnable app, browser
+tool, reachable API, permitted credentials) — never a pass, never unit tests
+in place of the real run; delivering over the gap is the human's explicit
+call, recorded in evidence.md.
 
 ```
-## Verifier report — <E2E | Side effects | Intent match>   (fill your lens's lines)
+### <E2E | Side effects | Intent match>   (fill your lens's lines)
 - Provenance: reviewer ID <actual ID | unknown — reason>; context ID <actual ID | unknown — reason>; tool calls <actual IDs | unknown — reason>; independent of implementer <observed relationship | unknown>
 - Inputs/source: <revision + current tree identity>; recipe <identity>; upstream <identities>; input paths <exact paths>
 - Evidence: executed <commands, exit codes, log paths, deciding lines>; independently inspected <current logs/receipts, or none>