diff --git a/src/pipeline.rs b/src/pipeline.rs
index 1f9b51e..17c516b 100644
--- a/src/pipeline.rs
+++ b/src/pipeline.rs
@@ -336,14 +336,16 @@ impl Identity {
     /// was a genuine defect that had shipped in a release (`CBaseEntity::DispatchTraceAttack`, in fact
     /// `CLogicRelay::Trigger`). n=1, so this rejects one entry rather than aborting a release.
     fn contradiction(&self, lib: &str, img: &CodeImage, addr: u64, name: &str) -> Option<String> {
-        // `Identity::of` gives every loaded image an entry, so a miss here does NOT mean "a library with
-        // no evidence" — it means the caller holds the wrong FORM of the key, and the `?` below then
-        // disables this entire check without a word. That is precisely how it sat dead on the fold path.
-        debug_assert!(
-            self.0.contains_key(lib),
-            "Identity is keyed by SHORT library name (`server`), got `{lib}`"
-        );
-        let lib = self.0.get(lib)?;
+        // `Identity::of` gives every loaded image an entry, and both call sites key from a file in that
+        // same map, so a miss here does NOT mean "a library with no evidence" — it means the caller holds
+        // the wrong FORM of the key, and the `?` this used to be then disabled the entire check without a
+        // word. That is precisely how it sat dead on the fold path.
+        //
+        // NOT a `debug_assert!`: that compiles out in release, and the shipped binary is a release build,
+        // so the guard would have gone on silently passing in the one configuration that matters.
+        let Some(lib) = self.0.get(lib) else {
+            panic!("Identity is keyed by SHORT library name (`server`), got `{lib}`");
+        };
         let (class, method) = name.split_once("::")?;
         let registered = lib.vscript_at.get(&addr)?;
         if names_correspond(registered, method) {