Contract ids: sequential OPS-/PV- ids collided 3 times on 2026-10-19 (#5621, #5591, #5765); pick a scheme #5770

Filed on the cop's explicit order (FLOW-008).

Problem

Sequential contract ids (FALSIFY-OPS-nnn, FALSIFY-BIN-PV-nnn) are taken by "next free number" at authoring time. Two PRs authored against the same main take the same number, and the second to land conflicts by hand. Three collisions on 2026-10-19:

Each resolution is manual, repeats the contract regen/seat round, and the pass_criteria: All N falsification tests pass count is a second number that must move with the id (it is a hidden second collision point). Related: #5768 (derived contract files DIRTY every open PR).

Candidate schemes

A. Content-derived ids. Id = prefix + short hash of the test path (e.g. FALSIFY-OPS-<first 6 of sha256(test)>). No shared counter, so no collision; stable across renumbering. Cost: ids stop being human-ordered; every consumer that parses -nnn and any doc citing an id must be migrated; needs a one-off rewrite of existing ids.
B. Keep sequential, allocate at merge. Authors write a placeholder (FALSIFY-OPS-NEW-<slug>); the merge batcher (see #5768, scripts/contracts_resolve.sh) assigns the next number and fixes pass_criteria in the same step. Cost: ids not known until merge, so a PR body cannot cite them; the batcher gains a rewrite step.
(Option C, for completeness: derive pass_criteria count from the list so only the id remains manual. Cheaper, solves the second point only.)

Acceptance (falsifier first)

• A test that builds two branches each adding one falsification entry to the same contract, merges both, and asserts pv validate passes with no hand edit and pass_criteria equals the entry count.
• The check that today catches a duplicate id still fails on a hand-made duplicate (mutation).

Quorum note

Changing the id scheme changes what a contract gate accepts, so it is gate content: it needs a planted quorum round before the change (never the author's model id; Sonnet-authored work gets Opus lanes) and a separate non-author sign-off bound to the final commit. Option C alone changes no accepted input and needs no quorum.