diff --git a/HARNESS.md b/HARNESS.md
index dcd6c02..ce48c2c 100644
--- a/HARNESS.md
+++ b/HARNESS.md
@@ -82,7 +82,9 @@ load-bearing mechanism here, and the one with least machine enforcement, which i
 fails any `.go` change that does not touch `state.md`. That does not prove the counters are *right*;
 it makes forgetting them impossible, which is the real failure mode.
 
-**The dependency allowlist** names modules that are permitted, not required. `#` starts a comment anywhere on a line, including after an entry — the gate strips those, so an entry may carry the reason it exists. Being listed is permission;
+**The dependency allowlist** names modules that are permitted, not required. The gate also fails an
+untidy `go.mod`, because `go get` marks a module indirect until something imports it — and an indirect
+entry is not checked against the allowlist, so an unapproved dependency could sit there unnoticed. `#` starts a comment anywhere on a line, including after an entry — the gate strips those, so an entry may carry the reason it exists. Being listed is permission;
 `DEPS_MAX` counts what `go.mod` actually pulls in. `scripts/allowed-deps.txt` is the list.
 
 **Budgets in `scripts/budgets.env`.** Two hard LOC ceilings, core and extensions, plus a dependency
diff --git a/scripts/verify.sh b/scripts/verify.sh
index 0ff885c..b8a56dc 100755
--- a/scripts/verify.sh
+++ b/scripts/verify.sh
@@ -236,6 +236,14 @@ if [ -f scripts/allowed-deps.txt ]; then
   fi
 fi
 
+# An untidy go.mod misreports what is direct, so the allowlist check above would silently skip a
+# dependency added by `go get` before anything imported it.
+if go mod tidy -diff >/tmp/tidy.log 2>&1; then
+  pass "go.mod is tidy"
+else
+  bad "go.mod is untidy — run go mod tidy; until then a direct dependency can hide as indirect"
+fi
+
 if [ "$total" -gt "$DEPS_MAX" ]; then
   bad "module count $total exceeds DEPS_MAX=$DEPS_MAX"
 else