fix(census): corroborate candidates before the uniqueness gate

[v4lheru]

The bug

The branch-3 resume census cannot realign a resumed session whenever another Claude session is live, because it rejects candidates on COUNT before consulting the ownership proof.

_resume_census_unique_candidate builds its candidate set, then applies if len(candidates) != 1: return None. _resume_census_candidate_corroborated is only ever reached for an already-unique candidate, so its cwd subject anchor never gets the chance to discriminate. Two live team dirs inside RESUME_CENSUS_RECENCY_SECONDS are enough to kill the whole set.

Observed live, not inferred. _resolve_aligned_team_name returned the stale default while the census held exactly two candidates:

session-7c6ea94d  tasks mtime 143s  lead cwd = ".../Yulia - KB project"
session-b95ae762  tasks mtime  96s  lead cwd = ".../CS - Churn Dashboard"

The cwd anchor separates those perfectly. The resumed session was left pointing at a team that does not exist, so every Agent dispatch was denied by a gate citing a phantom team, with nothing indicating why. The recorded team also propagates to pact-session-context.json, the CLAUDE.md - Team: line and the hook's announced value, all from this one resolved name, so all three surfaces were wrong together.

Still reproduces at 4.7.2: hooks/shared/pact_context.py gates on if len(candidates) != 1: with no corroboration pass.

The fix

Corroborate every candidate first, then require exactly one survivor. The count rule is kept rather than deleted, so it now bounds the proof rather than the accident.

Safety

For |C| <= 1 the two orders are provably identical, since the survivor set is a subset of the candidate set. Every existing zero-or-one-candidate fixture is byte-identical and the change is inert outside the >= 2 case.

For |C| >= 2 the old order always returned None, and the new one can only return a candidate passing the full ownership proof (lead entry by leadAgentId, agentId self-consistency against the dir name, cwd subject anchor, birth order). Nothing rejected on ownership grounds becomes admitted.

Qualification, stated because it is a real cost

The raw-count rule was incidentally masking part of the residual that _resume_census_candidate_corroborated already documents: a sibling born between this session's end marker and its resume, running from the same directory. Today that sibling wins only as the sole candidate; after this change it can win alongside non-corroborating candidates.

No new mis-alignment class, but a documented one becomes reachable in strictly more environments. Recorded at the residual's own site in the source.

Deliberately NOT addressed by making birth order mandatory. That skip exists so realignment still works when the journal has no end marker, and removing it would refuse legitimate realignments to buy a narrow reduction in a known residual.

Branch 2 inherits this

The #1509 preemption guard calls the same helper (pact_context.py:827), so a corroborated winner can now preempt a dead-looking own substrate in a >= 2 candidate world. That is intended. Branch 2 keeps its own stricter gates and any winner still has to corroborate. The alternative forks the census into two semantics and leaves branch 2 blind to the same defect.

Also in commit 1

The RESUME_CENSUS_RECENCY_SECONDS comment claimed "a mis-tuned window can only suppress, never mis-align". That goes false here, since widening the window can convert a zero-survivor world into a one-survivor one. Comment rewritten; the constant is unchanged at 900.

Second commit: two fixtures that never built ambiguity

Reviewed separately on purpose, since it is a different ask.

Cells ii and xi of test_resume_team_realign_1507.py both describe two live candidates resolving to the stale default, but seeded AMBIG_TEAM member-less (_seed_team_store defaults corroborate=False). That candidate carried no ownership claim, so the world contained one claim, not two. Neither cell composed the situation its own name describes.

The assertions could not have detected the difference either: AMBIG_TEAM has tasks=(), and an empty store denies under either resolution, so the deny is equally consistent with "failed safe" and "realigned onto a candidate that happens to have no work".

Cell ii now bites under a pick-first mutation of the survivor count, where on commit 1's tree it survived that same mutation.

Cell xi does not newly bite, and this is a premise correction rather than a new guard. Its assertions concern message composition and none of them discriminate which team resolved. No resolution assertion was added, since its subject is the composer rather than the resolver.

Both carry an in-cell FIXTURE REPAIRED note so a later reader does not restore the member-less seed as a simplification.

Verification

• Baseline on clean main: 143 failed / 14610 passed / 449 skipped. All 143 are tests/test_telegram_* on a missing optional dependency, none near pact_context. Compared as a set diff of failing node-ids, not a count.
• After: 143 failed / 14613 passed. Zero new, zero fixed. The +3 are the new cells.
• Sabotage: reverting only pact_context.py turns both regression cells red, each resolving to the stale default.
• Reverse mutation: len(survivors) != 1 to a pick-first turns the fail-safe cell red, proving it is not vacuous.