diff --git a/task-templates/workflow/bug-verify-sonnet@1.yaml b/task-templates/workflow/bug-verify-sonnet@1.yaml
index 4b1d2ee..e73bba8 100644
--- a/task-templates/workflow/bug-verify-sonnet@1.yaml
+++ b/task-templates/workflow/bug-verify-sonnet@1.yaml
@@ -52,6 +52,10 @@ nodes:
       5. Write the bare verdict token — exactly `verified` or exactly
          `rejected`, nothing else, no trailing whitespace or punctuation —
          to /workspace/verdict. This file is NOT committed to the repo.
+         (NOTE 2026-09-06: this SHOULD move to scratchpad/verdict,
+         committed+pushed, once verdict-tx can clone the branch to read it
+         back — see the runtime_env note on the verdict-tx node below.
+         Left as the working /workspace/verdict contract for now.)
       6. Call task_complete.
   - id: verdict-tx
     kind: script
@@ -59,3 +63,10 @@ nodes:
     depends_on: [agent]
     runtime_env:
       STATE_TX_ALLOWED_STATES: "verified,rejected"
+      # NOTE (2026-09-06): scratchpad/verdict cross-node wiring is NOT yet
+      # live — script tasks (dispatcher/task_manager.py::_run_script_task)
+      # have no credentialed way to clone the agent's branch (the per-task
+      # SSH key is provisioned through the full ESO/account harness
+      # resolution pipeline, which script tasks deliberately bypass). Left
+      # at the /workspace/verdict default pending that follow-up; see
+      # spec/bugs or the M-something item tracking it.