row 159: kind-isolation admits no one-letter alias as a free-text needle (gate false positive)

[MattJackson]

What

xtask/src/gates/kind_isolation/matrix/instances.rs: a learned instance name (census id or plugins.yaml alias) shorter than MIN_NEEDLE_LEN = 3 is no longer a needle. It still attributes a module-name constant that spells it. Module-name constants count at any length. --report prints each dropped name as a short line.

Why

The instance vocabulary reads plugins.yaml aliases, and the secret alias c (busbar-secret-c) became a whole-literal needle. Literals are lower-cased, so every extern "C" ABI string and every one-letter "c" key in a neutral crate counted as an instance:secret hit. That was 262 of the axis's 444 Law 0 hits on predev 5c99bef. It cost #833 a red and threatens #840.

Every other alias and census id of the five neutral kinds is at least 3 characters (the shortest is env). The floor therefore drops c and nothing else.

RED plants (matrix battery, instances::selftest)

• GREEN case: the fixture crate writes extern "C", c == "c" and every live short axis alias, and its × secret cell stays at 0. On predev the c alias makes this an unlisted-instance, so without the fix the case goes red.
• RED case: the same plant plus module == "vault" (the first 3+ character secret alias, read off plugins.yaml) is still the fixture's × secret unlisted-instance. Long aliases keep counting.
• Unit test: an_alias_under_three_characters_is_no_needle_and_a_longer_one_still_is.

Rows moved ([[law0]], exact both ways)

Reason on each row: alias needle min length (false positive), ARCHITECT 2026-10-13.

crate × axis	before	after
busbar × instance:secret	35	19
busbar-contract × instance:secret	133	45
busbar-core-admin × instance:secret	50	38
busbar-kernel × instance:secret	114	67
busbar-plugin-loader × instance:secret	107	12
busbar-core-connector × instance:secret	3	0 (row dropped)
busbar-kernel-egress × instance:secret	1	0 (row dropped)

Precedent for the dropped rows is ad19498: a neutral cell at 0 with no row is still held at 0. busbar-core-oauth2 × instance:secret stays at 1 (an env hit). The [[instance]] presence rows for secret all stay live.

Figures were re-measured by reading only (no local cargo). A line-for-line port of file_literals reproduces every current instance:secret ceiling exactly; the "after" column is the same port without c.