feat(asvs): tell a re-score apart from a re-verification, and read the 28 flagged entries (BACKLOG #1328)

docs/BACKLOG.md

@@ -16171,7 +16171,15 @@ blind window is about a day rather than open-ended.
 
 ## 1328. no cell-to-item map exists, so an ASVS re-score cannot be handed to the seat that must flip the banner
 
-> 🚧 **RUN FOR THE FIRST TIME 2026-09-03. The date comparison this row calls "the open work" has now produced an answer, and reading the 28 flagged entries is what remains.** The screen used to exit 3 on the only clone that exists here; it does not any more. Measured against the vault record at engine `2b8bccb4`: 62 pairs over 48 items, **51 pairs decided exactly and 11 held back as undecidable**, **35 hits over 28 distinct items**. Of those 28, **11 carry an open banner** (the missing-flip direction this row was filed for) and **17 carry a closed one** (the reverting direction its own amendment names, where a closed banner may rest on a withdrawn premise). **A hit is still a prompt to read the entry, not a finding** -- the first run's two apparent hits both dissolved on reading, and #1026 is flagged again here exactly as that worked negative case predicts. **Filed 2026-08-22.** A research-verdict item closes by TWO acts in different seats: a vault scorecard re-score, then a ledger banner flip. Nothing maps a cell to the item it governs, so the first act cannot be handed to the seat that performs the second.
+> 🚧 **READ 2026-09-04. The 28 entries this row called "what remains" are read, and the answer is THREE items, not 28.** Re-run against the vault record at engine `a2eef0f37` over a full-history clone: 62 pairs over 48 items, **zero undecidable pairs and zero floored dates**, so every pair is decided against a true last-touch date -- a strictly better run than 2026-09-03's, which held 11 back. The same 35 hits over 28 distinct items. **22 of those 28 items carried NO covering grade change at all after the banner moved**, so four in five hits were a `last_verified` bump from a re-check that CONFIRMED the grade already there. **Surviving the read: `BACKLOG #1172`, `BACKLOG #1127` and `BACKLOG #1184`** -- all three in the missing-flip direction, all three carrying `closing-act: scorecard-rescore`. `BACKLOG #1172` is the cleanest instance this row has ever had: its own banner says the row stays open only because the re-score "is explicitly not run", and that re-score landed 2026-08-26, the day after. `BACKLOG #1184` is flagged in the same shape but its prose still describes the defect as live and high-value, so the direction to fix is the Tracker's call rather than an automatic flip. **ZERO re-opens.** Only two downward grade transitions exist in the entire scorecard history, and neither leaves a closed banner resting on a withdrawn premise: `BACKLOG #65`'s predates its banner's last touch, and `BACKLOG #1049`'s reverted and recovered inside a single day, ending at the grade its closure rested on. **The three flips are a ledger act this seat does not perform, so this row stays open until they land.**
+>
+> **A DATE MOVE IS NOT A RE-SCORE, AND THAT IS THE QUESTION THIS ROW'S OWN DISCRIMINATOR ASKS.** `last_verified` bumps on every re-verification, including one that changes nothing, so the date comparison fires on confirmations exactly as loudly as on real re-scores -- an instrument answering a question adjacent to the one asked (SDS-3.8). The tool now reads the scorecard's own git history and marks each hit GRADE MOVED, GRADE MOVED DOWN or GRADE UNCHANGED, which cuts the reading burden from 28 items to 6. It prints a direction and never a grade value; cell ids and grades stay vaulted.
+>
+> **TWO DISAGREEMENTS THE DATE RULE STRUCTURALLY CANNOT SEE, found by reading and not by the screen.** `BACKLOG #1148`'s covering grade moved to a pass on the SAME DAY its banner last moved, and same-day is the in-sync convention every comparison here uses, so it renders as a confirmation. `BACKLOG #1143`'s covering grade has passed since 2026-08-01, before that item's banner ever moved, while the item still says every named condition holds at HEAD. **The screen detects ORDERING, not DISAGREEMENT** -- a record that contradicted the ledger from the start is invisible to it at any depth of history. That is a different screen and it is unfiled; naming the subject rather than a number, it is the grade-versus-banner-state comparison.
+>
+> ***AND THE ENVIRONMENT MOVED UNDER THE 2026-09-03 RUN, WHICH IS WHY THE REFUSAL CAME BACK ONE DAY LATER.*** The shared clone re-shallowed: the graft boundary went 2026-08-04 to **2026-08-31**, visible history fell to 110 commits and the two ledger walks to 76 and 2 revisions, and the newest re-score in the record is 2026-08-29. Every pair therefore sits at or before the boundary and the tool refused, correctly, deciding nothing. **The remedy is not the owner-gated one this row assumed.** `git fetch --unshallow` is the owner's call because it writes to an object store shared by every worktree, 3.7 GB here. A THROWAWAY clone shares no object store, so that objection does not reach it, and `--root` already takes a separate history source: measured 2026-09-04 at **35 MB in 17 seconds**. Do NOT pass `--filter=blob:none` -- a blobless clone fetches one ledger revision per network round trip and did not finish in ten minutes. The refusal now prints this route instead of only naming the shared-store one. **Also measured: five items are referenced by the record but absent from every ledger revision walked (246, 274, 296, 301, 314), up from the two this row recorded, because a full history sees more of them.**
+>
+> **RUN FOR THE FIRST TIME 2026-09-03. The date comparison this row calls "the open work" has now produced an answer, and reading the 28 flagged entries is what remains.** The screen used to exit 3 on the only clone that exists here; it does not any more. Measured against the vault record at engine `2b8bccb4`: 62 pairs over 48 items, **51 pairs decided exactly and 11 held back as undecidable**, **35 hits over 28 distinct items**. Of those 28, **11 carry an open banner** (the missing-flip direction this row was filed for) and **17 carry a closed one** (the reverting direction its own amendment names, where a closed banner may rest on a withdrawn premise). **A hit is still a prompt to read the entry, not a finding** -- the first run's two apparent hits both dissolved on reading, and #1026 is flagged again here exactly as that worked negative case predicts. **Filed 2026-08-22.** A research-verdict item closes by TWO acts in different seats: a vault scorecard re-score, then a ledger banner flip. Nothing maps a cell to the item it governs, so the first act cannot be handed to the seat that performs the second.
 >
 > **Scored 2026-09-03 -> P1.** Value **6/10** · Difficulty **2/10** · _quick win_. The check itself shipped -- scripts/asvs/rescore_handoff_check.py implements the date comparison at :260-275, and tests/test_asvs_rescore_handoff.py passes 21 of 21 under the project venv -- so that limb is met, but the item's own stated remainder is not. Driving the tool against the vault scorecard from both this worktree and the primary checkout exited 3 with "REFUSING: the ledger history is TRUNCATED at a shallow graft boundary", because the guard at rescore_handoff_check.py:214 fired when a ledger walk began at a graft and ca8a7488, the oldest visible revision of docs/BACKLOG.md, is listed in .git/shallow; no non-shallow engine checkout exists beside this one. **CLEARED 2026-09-03 without deepening any clone, and the fix was NOT the one this paragraph proposed.** The graft-predates-the-ledger case it names was already handled by construction: `git log` over a path lists only revisions where that path CHANGED, so a graft older than the ledger's creation is never the oldest line, and the oldest line is a graft exactly when the path already existed at the boundary -- which is the real state here, so that distinction alone would have gone on refusing. **The truncation test was necessary but not sufficient, and the missing half is a date.** A floored last-touch is always later than or equal to the truth, so the floor can only suppress a hit dated AT OR BEFORE the graft boundary; a re-score strictly after it is decided identically on the floored date and on the true one. The verdict is therefore per PAIR, and the whole run is refused only when NOTHING is decidable. Value 6 because a ledger-integrity screen that refuses in the only environment it ships into leaves the step-one-done step-two-missing disagreement undetected exactly as filed; difficulty 2 for a small additive change on an existing tested seam plus the record edit.
 > Verdict: build