diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fd34a388..ae65899e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -161,10 +161,10 @@ jobs:
         run: bash scripts/roadmap/check-roadmap-fresh.sh
 
       # The kit's own reader, not a home-made one: owner decision 23/09. The
-      # home-made scripts/ci/check-product-map.mjs (0d9f5ac, 31/08) describes a
-      # different state model and cannot be green at the same time as the kit's
-      # map. It stays on disk only because signed evidence (cong-tu-canh-minh)
-      # names it as a verifier; it no longer runs in CI.
+      # home-made scripts/ci/check-product-map.mjs (0d9f5ac, 31/08) described a
+      # different state model and could not be green at the same time as the
+      # kit's map. It was deleted on 23/09 once cong-tu-canh-minh, the signed
+      # dossier naming it as a verifier, was retired (owner: manh).
       - name: Product map freshness
         run: node "$CLAUDE_PLUGIN_ROOT/scripts/product-map.mjs" --root . --check
 
diff --git a/PRODUCT-MAP.md b/PRODUCT-MAP.md
index 757e7a8f..bb560408 100644
--- a/PRODUCT-MAP.md
+++ b/PRODUCT-MAP.md
@@ -40,11 +40,11 @@ flowchart TD
 - CI-a — vitest vào CI + gỡ ghim SDK cứng của guard overlay (khử mìn hạ tầng verify) (`ci-vitest-sdk-pin`)
 - slot dán chữ/khung giá/logo/safe-zone lên ảnh & video (Phase 1.2) (`compose-overlay`)
 - Conformance L0 — pluginRev, node_cached contract, TS↔Python conformance suite (`conformance-l0`)
-- Cổng tự canh mình — hai guard vào CI, và suite verify thôi tự đốt vòng (`cong-tu-canh-minh`)
+- Cổng tự canh mình — hai guard vào CI, và suite verify thôi tự đốt vòng (`cong-tu-canh-minh`) — đã giao — đã nghỉ, giữ sử liệu
 - Đăng ký fork oneflow-api-openai vào manifest chính thức (`dang-ky-fork-openai`)
 - Dependency refresh — five pending dependabot updates (`dependency-refresh-2026-07`)
-- Gate 0.6 — cùng-không-gian cho scope paths + neo lịch sử cho eval per-PR (`gate-scope-anchors`)
-- Gate tooling × t1_skip_globs — đường hợp lệ để sửa guard, và trả ba nợ 0.8 (`gate-tooling-t1`)
+- Gate 0.6 — cùng-không-gian cho scope paths + neo lịch sử cho eval per-PR (`gate-scope-anchors`) — đã giao — đã nghỉ, giữ sử liệu
+- Gate tooling × t1_skip_globs — đường hợp lệ để sửa guard, và trả ba nợ 0.8 (`gate-tooling-t1`) — đã giao — đã nghỉ, giữ sử liệu
 - Hai đường chạy, một venv — engine Python dùng venv per-plugin như bên TypeScript, thôi nuốt lỗi cấp phát (`hai-duong-chay-mot-venv`)
 - Hàng rào thôi đọc nhầm "không đo được" thành "không có gì sai" (`hang-rao-doc-nham-loi-thanh-khong-co-gi`)
 - Kho khoá toàn vẹn — đọc không cắt bớt âm thầm, ghi không để lại file cụt (`kho-khoa-toan-ven`)
@@ -64,7 +64,7 @@ flowchart TD
 - Plugin scanner reads imports by scope boundary, and says why a slot was skipped (`scan-with-block-imports`)
 - Publish the SDK as oneflow-sdk while keeping the tongflow import package (`sdk-distribution-rename`)
 - Skill system v1 — manifest tham số, template, orchestrator v1, ngăn skill và xem/sửa kế hoạch; skill thứ hai không đụng engine (`skill-system-v1`)
-- Scope evidence staleness by declared eval paths (`stale-scope-by-paths`)
+- Scope evidence staleness by declared eval paths (`stale-scope-by-paths`) — đã giao — đã nghỉ, giữ sử liệu
 - Per-task metering columns and measured plugin duration (`task-metering`)
 
 ## Đã nghiệm thu giá trị
diff --git a/_acceptance/config.yaml b/_acceptance/config.yaml
index c2ddaf5c..06d2abed 100644
--- a/_acceptance/config.yaml
+++ b/_acceptance/config.yaml
@@ -387,20 +387,11 @@ executors:
     # ---- hai-duong-chay-mot-venv (B4) ----
     hdc_layout_constant_pinned: "bash scripts/plugins/check-venv-layout-pinned.sh"
     hdc_layout_constant_teeth: "bash scripts/plugins/check-venv-layout-teeth.sh"
-    # --- cong-tu-canh-minh (31/08) ---
-    # Bo kiem ban do + rang cua no. Dat o scripts/ci/ chu khong scripts/roadmap/
-    # hay scripts/acceptance/ vi gia re-pin: 0 vs 1 vs 2 ho so (do tren paths da
-    # khai cua 29 ho so).
+    # --- cong-tu-canh-minh (31/08) --- khoa pmap_* (thuoc ban do rieng
+    # scripts/ci/check-product-map*.{mjs,sh}) da go 23/09: ho so nghi (thuoc =
+    # kit, #128/#129), ban do nay do scripts/product-map.mjs cua kit canh.
     kkt_seam_signature: "bash scripts/settings/check-env-store-teeth.sh --case seam-signature"
     kkt_teeth_all: "bash scripts/settings/check-env-store-teeth.sh"
-    pmap_check: "node scripts/ci/check-product-map.mjs"
-    pmap_teeth_all: "bash scripts/ci/check-product-map-teeth.sh"
-    pmap_teeth_missing_slug: "bash scripts/ci/check-product-map-teeth.sh --case missing-slug"
-    pmap_teeth_count: "bash scripts/ci/check-product-map-teeth.sh --case count-mismatch"
-    pmap_teeth_opportunity: "bash scripts/ci/check-product-map-teeth.sh --case opportunity-mismatch"
-    pmap_teeth_unreadable: "bash scripts/ci/check-product-map-teeth.sh --case artifact-missing --case artifact-unreadable"
-    pmap_teeth_extra_slug: "bash scripts/ci/check-product-map-teeth.sh --case extra-slug --case status-downgraded"
-    pmap_teeth_source_buckets: "bash scripts/ci/check-product-map-teeth.sh --case contract-unparsable --case status-unknown --case dir-empty"
     # Lo mu cua guard lo trinh: no so TAP slug trong khoi marker nen dong trung
     # vo hinh. Do 31/08: so cai CO dong trung normalize-text-vi ma guard van xanh.
     roadmap_fresh: "bash scripts/roadmap/check-roadmap-fresh.sh"
@@ -430,7 +421,11 @@ executors:
     # ho so nay (do tren cay eb175ed). Ve «la mot suite key» cua AC-9 do bang
     # phep khang dinh truc tiep ben duoi. Phat hien ngoai hop dong -> Cong 2.
     lcm_wiring: "bash scripts/ci/check-gate-guards-job.sh shape && bash scripts/ci/check-gate-guards-job.sh reachable && bash scripts/ci/check-gate-guards-job.sh teeth && bash scripts/roadmap/check-plan-suite-key.sh"
-    lcm_pmap: "node scripts/ci/check-product-map.mjs && bash scripts/ci/check-product-map-teeth.sh --case parked-opportunity"
+    # 23/09: tro sang bo doc ban do cua kit ghim KIT_SHA (cung lenh buoc CI
+    # «Product map freshness»); thuoc rieng check-product-map.mjs va case rang
+    # parked-opportunity cua no da xoa — rang do kit tu canh. Ban do kit van in
+    # «Xep lai sau 3 viec» dung ba co hoi park cua AC-11.
+    lcm_pmap: "node \"$CLAUDE_PLUGIN_ROOT/scripts/product-map.mjs\" --root . --check"
     # --- mo-hoa-b01 (05/09) --- guard dinh danh fork + rang, MOT khoa moi ca (khuon lcm_*).
     fork_identity: "bash scripts/fork/check-fork-identity.sh"
     mhb_teeth_all: "bash scripts/fork/check-fork-identity-teeth.sh"
@@ -443,7 +438,7 @@ executors:
     mhb_teeth_notice: "bash scripts/fork/check-fork-identity-teeth.sh --case notice-dist-gone && bash scripts/fork/check-fork-identity-teeth.sh --case notice-unchanged-back && bash scripts/fork/check-fork-identity-teeth.sh --case notice-attribution-gone"
     mhb_prototype_lane: "bash scripts/fork/check-prototype-lane.sh mo-hoa-b01 && bash scripts/fork/check-fork-identity-teeth.sh --case debt-table-missing && bash scripts/fork/check-fork-identity-teeth.sh --case debt-table-duplicate"
     mhb_wiring: "bash scripts/ci/check-gate-guards-job.sh shape && bash scripts/ci/check-gate-guards-job.sh reachable && bash scripts/ci/check-gate-guards-job.sh teeth && bash scripts/fork/check-suite-key.sh fork_identity check-fork-identity.sh && bash scripts/fork/check-fork-identity-teeth.sh --case suite-key-dangling"
-    mhb_existing_guards: "bash scripts/plugins/check-live-docs-manifest-synced.sh readme && bash scripts/plugins/check-live-docs-manifest-synced.sh claude && bash scripts/plugins/check-live-docs-manifest-synced.sh orphans origin/main && bash scripts/plugins/check-manifest-doc-synced.sh && bash scripts/plugins/check-prefix-docs.sh && bash scripts/ci/check-action-pins.sh && bash scripts/ci/check-docker-dryrun.sh && node scripts/roadmap/check-plan-freeze.mjs && bash scripts/roadmap/check-plan-docs.sh && bash scripts/roadmap/check-roadmap-fresh.sh && node scripts/ci/check-product-map.mjs"
+    mhb_existing_guards: "bash scripts/plugins/check-live-docs-manifest-synced.sh readme && bash scripts/plugins/check-live-docs-manifest-synced.sh claude && bash scripts/plugins/check-live-docs-manifest-synced.sh orphans origin/main && bash scripts/plugins/check-manifest-doc-synced.sh && bash scripts/plugins/check-prefix-docs.sh && bash scripts/ci/check-action-pins.sh && bash scripts/ci/check-docker-dryrun.sh && node scripts/roadmap/check-plan-freeze.mjs && bash scripts/roadmap/check-plan-docs.sh && bash scripts/roadmap/check-roadmap-fresh.sh && node \"$CLAUDE_PLUGIN_ROOT/scripts/product-map.mjs\" --root . --check"
     # Job CI: rut lenh RA TU ci.yml roi CHAY no, theo khuon check-vitest-job.sh.
     # Doc YAML la do chi dan; chay lenh rut ra moi la do hanh vi.
     # o-do-chay-0-ca-van-xanh: mot o do loc theo ten ca ma khong ca nao khop
@@ -528,39 +523,11 @@ executors:
     # conformance-l0 Gate 1 (2026-07-28).
     conformance_discriminating: bash scripts/conformance/check-suite-discriminating.sh
     plugin_rev_joined_path: pnpm tsx scripts/plugins/check-rev-joined-path.ts
-    # stale-scope-by-paths Gate 1 (2026-07-28): every file below lands during
-    # implementation. These live under scripts/acceptance/ on purpose — the
-    # t1_skip_globs exemption for the gate tooling lists EXACT paths, so a guard
-    # in a new subdirectory is gated and the gate applies to itself.
-    # One key per eval, same guard with a different --case: nine evals behind one
-    # command collapse nine criteria into one exit code, and a case that was
-    # never implemented then looks identical to a case that passed.
-    stale_scope_in_scope: bash scripts/acceptance/check-stale-scoping.sh --case in-scope
-    stale_scope_out_of_scope: bash scripts/acceptance/check-stale-scoping.sh --case out-of-scope
-    stale_scope_partial: bash scripts/acceptance/check-stale-scoping.sh --case partial
-    stale_scope_under_declared: bash scripts/acceptance/check-stale-scoping.sh --case under-declared
-    stale_scope_malformed: bash scripts/acceptance/check-stale-scoping.sh --case malformed
-    stale_scope_indent_drift: bash scripts/acceptance/check-stale-scoping.sh --case indent-drift
-    stale_scope_merged_halves: bash scripts/acceptance/check-stale-scoping.sh --case merged-halves
-    stale_scope_suppression: bash scripts/acceptance/check-stale-scoping.sh --case suppression
-    stale_scope_two_bases: bash scripts/acceptance/check-stale-scoping.sh --case two-bases
-    stale_scope_announce: bash scripts/acceptance/check-stale-scoping.sh --case announce
-    stale_scope_mutation: bash scripts/acceptance/check-stale-scoping.sh --case mutation
-    stale_scope_case_completeness: bash scripts/acceptance/check-stale-scoping.sh --case case-completeness
-    stale_scope_guard_not_exempt: bash scripts/acceptance/check-stale-scoping.sh --case guard-not-exempt
-    stale_scope_no_kill_switch: bash scripts/acceptance/check-stale-scoping.sh --case no-kill-switch
-    stale_scope_real_repo: bash scripts/acceptance/check-stale-real-repo.sh
-    # gate-tooling-t1 (item 0.8). Ba case MỚI của check-stale-scoping.sh giữ
-    # tiền tố stale_scope_* vì chúng là case của guard đó; các guard mới đứng
-    # riêng mang tiền tố gt1_. Một key cho một eval — xem đầu evals.yaml.
-    stale_scope_fork_undeclared: bash scripts/acceptance/check-stale-scoping.sh --case fork-undeclared
-    stale_scope_fork_declared_in_union: bash scripts/acceptance/check-stale-scoping.sh --case fork-declared-in-union
-    stale_scope_undeclared: bash scripts/acceptance/check-stale-scoping.sh --case undeclared
-    gt1_t1_escape_path: bash scripts/acceptance/check-t1-escape-path.sh
-    gt1_all_scoping_cases: bash scripts/acceptance/check-scoping-all-cases.sh
-    gt1_dead_code_absent: bash scripts/acceptance/check-golden-dead-code-absent.sh
-    gt1_fork_teeth: bash scripts/acceptance/check-fork-scope-teeth.sh
-    gt1_no_stale_on_empty_diff: bash scripts/acceptance/check-no-stale-empty-diff.sh
+    # stale-scope-by-paths / gate-tooling-t1 / gate-scope-anchors: cac khoa
+    # stale_scope_*, gt1_* (5 khoa) va scope_ns_*/gate_ns_* da go 23/09 cung
+    # guard cua chung — chung canh co che staleness theo paths cua cong fork da
+    # xoa o #129, ca ba ho so nghi (thuoc = kit). Khoa con lai ben duoi tro vao
+    # script con song.
     gt1_no_golden_claim: bash scripts/acceptance/check-no-golden-claim.sh
     gt1_landed_merge_repinned: bash scripts/acceptance/check-landed-merge-repinned.sh
     # roadmap-drift-guard Gate 1 (2026-08-27). MỘT khoá cho MỖI case: bộ răng cũ
@@ -577,12 +544,9 @@ executors:
     roadmap_teeth_supersede_source_single: bash scripts/roadmap/check-roadmap-guard-teeth.sh --case supersede-source-single
     roadmap_teeth_case_isolation: bash scripts/roadmap/check-roadmap-guard-teeth.sh --case case-isolation
     own_range_case_completeness: bash scripts/acceptance/test-own-range.sh case-completeness
-    scope_ns_case_completeness: bash scripts/acceptance/test-scope-namespace.sh case-completeness
-    # gate-scope-anchors (0.6): same-universe scope check + historical anchors.
+    # gate-scope-anchors (0.6): historical anchors (own-range); the scope
+    # namespace half died with the fork gate (#129).
     # b2_* and ghcr_anchored hit the network (gh) — local verify only, not CI.
-    gate_ns_exempt_refused: bash scripts/acceptance/test-scope-namespace.sh exempt-refused
-    gate_ns_variants_red: bash scripts/acceptance/test-scope-namespace.sh variants-discriminating
-    gate_ns_legit_granted: bash scripts/acceptance/test-scope-namespace.sh legit-granted
     own_range_anchored: bash scripts/acceptance/test-own-range.sh anchored
     own_range_unlanded: bash scripts/acceptance/test-own-range.sh unlanded
     own_range_malformed: bash scripts/acceptance/test-own-range.sh malformed
@@ -831,6 +795,30 @@ risk_tiers:
     - "_acceptance/**"
     - "public/**"
     - "src/i18n/messages/**"
+    # lịch sử — tệp đã xoá ở #129; giữ để luật stale không đếm việc xoá là code
+    # đổi sau verify (kit GUIDE §5.3 mục 3, 23/09). Luật stale đếm tệp đổi từ
+    # verified_commit ngoài t1_skip_globs, nên gỡ các dòng này biến chính việc
+    # xoá bản kit đã chép thành «code đổi sau verify» cho mọi hồ sơ ký trước #129.
+    # Giữ cả hai bộ tên `.js`/`.cjs`: cửa sổ diff từ verified_commit cũ còn thấy
+    # đường `.js` (kit 1.40.0 đổi đuôi). Gỡ chỉ khi không hồ sơ sống nào có
+    # verified_commit trước #129.
+    - "scripts/pre-merge-check.sh"
+    - "lib/eval-yaml.cjs"
+    - "scripts/recheck-evidence.cjs"
+    - "scripts/recheck-evidence.js"
+    - "lib/evidence-core.cjs"
+    - "lib/evidence-core.js"
+    - "lib/gap-probe.cjs"
+    - "lib/gap-probe.js"
+    - "lib/ac-line.cjs"
+    - "lib/ac-line.js"
+    - "lib/md-section.cjs"
+    - "lib/md-section.js"
+    - "lib/workspace-record.cjs"
+    # Bản chép lop-nhin-thay.cjs vào ở a282fed (kit 2.14.0) nhưng chưa từng được
+    # khai ở đây; #129 xoá nó nên nó cũng phải là dòng lịch sử, nếu không mọi hồ
+    # sơ có verified_commit từ a282fed tới trước #129 hết hạn vì chính việc xoá.
+    - "lib/lop-nhin-thay.cjs"
     # Lint configuration only — it constrains how source is written, never what
     # the product does at runtime, so a change here cannot invalidate evidence.
     - "biome.json"
diff --git a/_acceptance/cong-tu-canh-minh/decisions.jsonl b/_acceptance/cong-tu-canh-minh/decisions.jsonl
index 6d372ad0..bea3dd86 100644
--- a/_acceptance/cong-tu-canh-minh/decisions.jsonl
+++ b/_acceptance/cong-tu-canh-minh/decisions.jsonl
@@ -17,3 +17,4 @@
 {"id":"d-20260831T140000Z-2093","type":"approach","stage":"gate2","at":"2026-08-31T14:00:00Z","decision":"Ngoai-1 (guard nuot tham so la) — owner chon ghi Known limits, nhan ban sua vao goi nay","impact":"tiet kiem: mot dong lenh go sai trong ci.yml khong con doc ra thanh da-kiem-sach · rui ro: khong tieu chi nao do truc tiep hanh vi tu choi do, no duoc giu gian tiep boi ve guard-of-the-guard cua E8"}
 {"id":"d-20260831T140100Z-7746","type":"approach","stage":"gate2","at":"2026-08-31T14:01:00Z","decision":"Ngoai-2 (nghi van cong bo qua staleness) — owner chon mo ho so moi staleness-ho-so-thieu-paths","impact":"tiet kiem: khong sua mu mot chot chan CI · rui ro: neu dung la fail-open thi no van mo cho toi khi ho so moi chay xong"}
 {"id": "d-20260831T150000Z-3382", "type": "fix", "stage": "S5", "at": "2026-08-31T15:00:00Z", "decision": "Them dong so cai lo trinh cho chinh ho so nay, va viet no KHONG dung nhay nguoc", "impact": "tiet kiem: CI xanh · rui ro: so cai doc MOI tu trong nhay nguoc la mot slug, nen dong nao chua ten lenh trong nhay se sinh slug ma — gioi han co san cua guard, khong phai loi goi nay"}
+{"id":"d-20260923T074315Z-20","type":"nghi","stage":"gate2","at":"2026-09-23T07:43:15Z","by":"manh","decision":"thước = kit từ 23/09","impact":"hồ sơ thôi hứa: bản đồ PRODUCT-MAP.md khớp hồ sơ theo thước riêng scripts/ci/check-product-map.mjs (AC-1..4, 10..12; nay bước CI Product map freshness chạy bộ đọc của kit ở KIT_SHA, #128) và suite_keys tách build/typecheck (AC-8; owner gộp lại 02/09 ở 4d8dd32). Guard sổ cái, nối dây job và a11y-dist-dir vẫn chạy nhưng không còn hồ sơ này bảo chứng"}
diff --git a/_acceptance/gate-scope-anchors/decisions.jsonl b/_acceptance/gate-scope-anchors/decisions.jsonl
index 39f85c6b..e36b0d25 100644
--- a/_acceptance/gate-scope-anchors/decisions.jsonl
+++ b/_acceptance/gate-scope-anchors/decisions.jsonl
@@ -16,3 +16,4 @@
 {"id":"d-20260804T220000Z-11216","type":"fix","stage":"S4-r3","at":"2026-08-04T22:00:00Z","decision":"Dong finding HIGH vong 3: cua so registry cua check-ghcr-untouched khoa theo CO-SLUG thay vi CO-HA-CANH. Feature da neo nhung chua merge -> anchor_tip tra HEAD -> UNTIL = ngay commit hom nay, som hon SINCE (createdAt cua run dispatch) -> cua so RONG -> jq khong chon gi -> in ok va exit 0, nuot mat mot ban publish that. Da repro bang so lieu that truoc khi sua","impact":"tiet kiem: dong lo fail-open trong chinh nua doi chung ma Task 5 vua them; them anchor_landed (hoi DA-HA-CANH-CHUA, khac han anchor_tip hoi CAY-NAO) va assert_window_sane (cua so ket thuc truoc khi bat dau = cau hoi khong tra loi duoc = exit 2). Doi lai: mot ham nua trong gh-run-lib","serves":["AC-9"]}
 {"id":"d-20260804T220001Z-11217","type":"revisit","stage":"S4-r3","at":"2026-08-04T22:00:01Z","decision":"Ba vong nghiem thu lien tiep, moi vong tim dung MOT loi that trong code cua toi, va ca ba deu cung mot loi tu duy: gan mot cau hoi vao DIEU KIEN GAN DUNG thay vi dieu kien that (exit trong subshell; slug-co-mat thay cho neo-giai-duoc; slug-co-mat thay cho da-ha-canh)","impact":"chi phi: ~2.8M token/vong. Gia tri bien van duong nhung dang giam dan va deu roi vao MOT ho loi da co ten","revisit":"Trinh Manh o Cong 2: chay vong 4 hay dung lai. Lap luan de dung: ho loi da duoc dat ten va nay co guard thi hanh (assert_window_sane, set -e invariant, ba poison value); lap luan de chay tiep: ba vong deu khong rong"}
 {"id":"d-20260804T221500Z-11218","type":"fix","stage":"S4-r3","at":"2026-08-04T22:15:00Z","decision":"Dong finding LOW nhung TRONG hop dong: scope_has_any_match doc ls-files KHONG co core.quotePath=false, trong khi stale_files doc diff CO — git mac dinh quote path phi-ASCII, nen hai ben danh van khac nhau (\"src/lib/caf\\303\\251.ts\" vs src/lib/cafe.ts). Da xac minh bang fixture that","impact":"huong lech la fail-CLOSED (tu choi scope oan) chu khong phai lo hong; nhung chinh chu thich toi viet khang dinh hai ben hoi cung mot khong gian — khang dinh do phai dung. Sua mot co, them ca kiem vao E3, mutation-test", "serves":["AC-1","AC-3"]}
+{"id":"d-20260923T074315Z-19","type":"nghi","stage":"gate2","at":"2026-09-23T07:43:15Z","by":"manh","decision":"thước = kit từ 23/09","impact":"hồ sơ thôi hứa cả hai nửa: AC-1..3 không gian tên paths của cổng fork (đã xoá ở #129, kit không đọc paths); AC-4..12 neo own-range vẫn có script sống và test-own-range.sh vẫn xanh nhưng không còn hồ sơ đã ký bảo chứng"}
diff --git a/_acceptance/gate-tooling-t1/decisions.jsonl b/_acceptance/gate-tooling-t1/decisions.jsonl
index ba5c65cc..3b7508c2 100644
--- a/_acceptance/gate-tooling-t1/decisions.jsonl
+++ b/_acceptance/gate-tooling-t1/decisions.jsonl
@@ -1,3 +1,4 @@
 {"id":"d-20260828T031500Z-scope","type":"descope","stage":"gate2","at":"2026-08-28T03:15:00Z","decision":"Thu hẹp phạm vi gate-tooling-t1: hồ sơ đóng vế (i) của nợ 0.8 (PR sửa guard không còn nổ VIOLATION [PR] t1-escape) và KHÔNG đóng vế (ii) (PR đó vẫn làm cũ pin đã ký). Đo 28/08: PR chỉ sửa scripts/acceptance/** kèm artifact sinh 3 violation staleness — measure-harness, task-metering (đều khai scripts/**), stale-scope-by-paths (khai chính scripts/acceptance/**). Phát hiện bởi gap-probe P0-1, xác minh lại trên cây thật bởi orchestrator (critic nêu 2 slug, thực tế 3).","impact":"Câu 'nợ 0.8 đã đóng' bị thu hẹp trong Context và khai vào Out of scope. KHÔNG AC nào đổi, KHÔNG eval nào nới — 13 eval vẫn khẳng định đúng thứ chúng vẫn khẳng định. Vế (ii) thành nợ có tên, cần contract kế; đường ra đã biết (bỏ khai paths ở 3 eval thường trực của measure-harness/task-metering) nhưng chạm _acceptance/<slug>/ của hai feature khác nên phải đi kèm wave của chúng."}
 {"id":"d-20260828T032000Z-ac12","type":"approach","stage":"gate2","at":"2026-08-28T03:20:00Z","decision":"AC-12 (giữ / thu hẹp / bỏ khai paths cho measure-harness và task-metering): hướng được chọn là BỎ KHAI, theo phán quyết PASS của blind judge. Căn cứ đo được trên cửa sổ a788985..d919b5e: 81 file gated đổi, union loại ra đúng 9, 72 file còn lại rơi trong union và vẫn làm hai feature stale — lời khai paths tiết kiệm 0 vòng re-verify; quét 33 commit first-parent không commit nào có toàn bộ file gated ngoài union. Union sai cả hai chiều: scripts/** khai thừa mọi guard shell (biome Checked 0 files), sdk/** khai thiếu dù eval biome đọc sdk/**/*.json.","impact":"Ghi lại để khuyến nghị của judge có nơi hạ cánh thay vì mất trong một đoạn văn (gap-probe P1-4). CHƯA THI HÀNH trong hồ sơ này: thực thi chạm _acceptance/measure-harness/ và _acceptance/task-metering/, tức mở lại phép soi staleness của chúng, nên phải đi ké wave của hai feature đó. Việc thi hành thuộc contract kế, cùng chỗ với vế (ii) của d-20260828T031500Z-scope."}
 {"id":"d-20260828T032500Z-amend","type":"amendment","stage":"gate2","at":"2026-08-28T03:25:00Z","decision":"Amendment 1 (AC-5 bỏ con số cứng '14 case') được duyệt tại chỗ bởi Manh ngày 28/08, cùng lượt duyệt Amendment 2. Amendment 1 viết ngày 27/08 sau vòng verify 1 mà chưa có dòng người duyệt — gap-probe P1-5 bắt được.","impact":"Frontmatter thêm amended_at: 2026-08-28 để phân biệt bản trước và sau sửa. Khoảng hở còn lại, khai thẳng: AC-5 nay lấy phạm vi từ chính vật bị đo (KNOWN_CASES) và KHÔNG có sàn, nên tập case có thể CO lại mà E6 vẫn xanh (gap-probe P0-3) — nợ chuyển contract kế, không vá ở đây."}
+{"id":"d-20260923T074315Z-4","type":"nghi","stage":"gate2","at":"2026-09-23T07:43:15Z","by":"manh","decision":"thước = kit từ 23/09","impact":"hồ sơ thôi hứa về fork STALE-DIFF-SCOPE-GUARD và staleness theo paths trong scripts/pre-merge-check.sh chép vào kho; bản chép đã xoá ở #129, cổng nay là kit ghim sha và kit tính staleness trên cả cây, không đọc paths"}
diff --git a/_acceptance/lat-cat-chung-minh/evidence-report.md b/_acceptance/lat-cat-chung-minh/evidence-report.md
index 43d4d07a..8c805a1d 100644
--- a/_acceptance/lat-cat-chung-minh/evidence-report.md
+++ b/_acceptance/lat-cat-chung-minh/evidence-report.md
@@ -6,7 +6,7 @@ failed_evals: []
 verified_by: fresh-context verification subagent
 enforcement_mode: strict
 bypass_used: false
-verified_commit: e4ea5ac18424b87a25e02ee4cfc4f82d97f5803d
+verified_commit: 825e6cd533e944a4ea7118af431433efc6cd75dd
 human_signoff: Phan Le Manh 2026-09-05
 ---
 
@@ -314,4 +314,8 @@ Round 3: Toàn bộ E1-E18 (script — thêm E17/E16-liên-quan AC-2 và E18 m
 
 Round 4: Toàn bộ E1-E18 (script) và J1 (judgment) đều PASS trên cây HEAD (27e27f1fddf467ed85aa0c009ebc8d9db985a249), cùng 8 lệnh suite hồi quy (preflight-verify-env, check-plan-freeze.mjs, build/typecheck, lint:check, test 900 passed | 5 skipped, sdk pytest 292 passed, verify:plugins, gen:abi) đều xanh. Ba finding CONFIRMED trong hợp đồng của round 3 (AC-11, AC-5, AC-15) đã được sửa — mục "Trong hợp đồng" của review-findings.md nay rỗng. Review vòng này phát hiện 16 finding mới, toàn bộ đều nằm ngoài phạm vi đã duyệt ở Cổng 1; 2/16 rơi vào file không bộ đo nào phủ (package.json, _acceptance/lat-cat-chung-minh/evals.yaml). Sau round 4, owner quyết ở Cổng 2 (05/09) gỡ ô phán đoán J1 khỏi bộ ô đo vì không có đường hợp lệ để đóng chốt bằng chứng cho một ô hội-đồng-máy (không có verifier script/config:<key> và không có run_id trong sổ máy) — quyết định ghi trong `decisions.jsonl` d-20260905T080000Z-lcm18. Verdict tổng round 4 là PASS.
 
-Round 5: Toàn bộ E1-E18 (script) đều PASS trên cây HEAD (e4ea5ac18424b87a25e02ee4cfc4f82d97f5803d) — chỉ còn 18 ô máy do J1 đã bị gỡ ở round 4 — cùng 8 lệnh suite hồi quy (preflight-verify-env, check-plan-freeze.mjs, build/typecheck, lint:check, test 900 passed | 5 skipped, sdk pytest 292 passed, verify:plugins, gen:abi) đều xanh. Review vòng này phát hiện 12 finding mới (4 medium từ "conventions", 4 từ "bugs" gồm 1 high + 2 medium + 1 low, 4 từ "measurement" gồm 1 high + 2 medium + 1 low), toàn bộ đều nằm ngoài phạm vi đã duyệt ở Cổng 1; mục "Trong hợp đồng" rỗng. Verdict tổng là PASS; escalate tiếp theo là quyết định của người ở Gate 2 cho 12 finding này (8 đề xuất mở hợp đồng mới, 4 đề xuất ghi Known limits).
\ No newline at end of file
+Round 5: Toàn bộ E1-E18 (script) đều PASS trên cây HEAD (e4ea5ac18424b87a25e02ee4cfc4f82d97f5803d) — chỉ còn 18 ô máy do J1 đã bị gỡ ở round 4 — cùng 8 lệnh suite hồi quy (preflight-verify-env, check-plan-freeze.mjs, build/typecheck, lint:check, test 900 passed | 5 skipped, sdk pytest 292 passed, verify:plugins, gen:abi) đều xanh. Review vòng này phát hiện 12 finding mới (4 medium từ "conventions", 4 từ "bugs" gồm 1 high + 2 medium + 1 low, 4 từ "measurement" gồm 1 high + 2 medium + 1 low), toàn bộ đều nằm ngoài phạm vi đã duyệt ở Cổng 1; mục "Trong hợp đồng" rỗng. Verdict tổng là PASS; escalate tiếp theo là quyết định của người ở Gate 2 cho 12 finding này (8 đề xuất mở hợp đồng mới, 4 đề xuất ghi Known limits).
+
+### Re-pin lần 1 — 2026-09-23, do thước = kit từ 23/09 (#128/#129): needle bản đồ trỏ bước kit, guard gọi cổng kit, lcm_pmap/mhb_existing_guards trỏ bộ đọc bản đồ kit
+run_id: repin-20260923T080040Z-11314
+sha: 825e6cd533e944a4ea7118af431433efc6cd75dd · suites: 9 lệnh exit 0 · evals: 18/18 eval máy đạt kỳ vọng
diff --git a/_acceptance/lat-cat-chung-minh/run-log.jsonl b/_acceptance/lat-cat-chung-minh/run-log.jsonl
index c4d9f6a0..03c2ec02 100644
--- a/_acceptance/lat-cat-chung-minh/run-log.jsonl
+++ b/_acceptance/lat-cat-chung-minh/run-log.jsonl
@@ -136,3 +136,4 @@
 {"ts":"2026-09-05T08:30:00Z","sha":"e4ea5ac18424b6f8c3d5e7a9f1b2c4d6e8a0f2b4","round":5,"evalId":"SUITE-gen_abi","run_id":"minted-lat-cat-chung-minh-SUITE-gen_abi-r5","exit_code":0,"cmd":"pnpm gen:abi && git diff --exit-code src/generated/abi sdk/tongflow/_data/tongflow.abi.json"}
 {"ts":"2026-09-05T08:30:00Z","sha":"e4ea5ac18424b6f8c3d5e7a9f1b2c4d6e8a0f2b4","round":5,"kind":"baseline","evals_hash":"r5-e4ea5ac-after-j1-descope","non_discriminating":[]}
 {"ts":"2026-09-05T08:30:00Z","sha":"e4ea5ac18424b6f8c3d5e7a9f1b2c4d6e8a0f2b4","round":5,"kind":"round-tally","verdict":"PASS","expected":26,"returned":26,"blocked":0}
+{"ts":"2026-09-23T08:00:40Z","kind":"repin","run_id":"repin-20260923T080040Z-11314","sha":"825e6cd533e944a4ea7118af431433efc6cd75dd","suites_exit":[0,0,0,0,0,0,0,0,0],"evals_exit":{"E1":0,"E2":0,"E3":0,"E4":0,"E5":0,"E6":0,"E7":0,"E8":0,"E9":0,"E10":0,"E11":0,"E12":0,"E13":0,"E14":0,"E15":0,"E16":0,"E17":0,"E18":0}}
diff --git a/_acceptance/mo-hoa-b01/evidence-report.md b/_acceptance/mo-hoa-b01/evidence-report.md
index a2027c7a..937d8a82 100644
--- a/_acceptance/mo-hoa-b01/evidence-report.md
+++ b/_acceptance/mo-hoa-b01/evidence-report.md
@@ -6,7 +6,7 @@ failed_evals: []
 verified_by: fresh-context verification subagent
 enforcement_mode: strict
 bypass_used: false
-verified_commit: bb2b05d89c7cbb49dd7d8589a1f09d5e50fb1609
+verified_commit: 825e6cd533e944a4ea7118af431433efc6cd75dd
 human_signoff: Phan Le Manh 2026-09-07
 ---
 
@@ -408,3 +408,7 @@ Run-log vòng 7 và 8 append nguyên văn từ kết quả workflow (bộ tổng
 **Lượt ghi này** điền `human_signoff`, Known limits (7 mục đã ký + nợ có tên từ Amendment) và
 Ngoài hợp đồng (từ review-findings) vào evidence — hai mục mà bộ tổng hợp kit luôn để rỗng khiến
 lưới trước merge đọc hồ sơ là «xanh-sạch, không mời ký».
+
+### Re-pin lần 1 — 2026-09-23, do thước = kit từ 23/09 (#128/#129): needle bản đồ trỏ bước kit, guard gọi cổng kit, lcm_pmap/mhb_existing_guards trỏ bộ đọc bản đồ kit
+run_id: repin-20260923T080040Z-11314
+sha: 825e6cd533e944a4ea7118af431433efc6cd75dd · suites: 9 lệnh exit 0 · evals: 11/11 eval máy đạt kỳ vọng
diff --git a/_acceptance/mo-hoa-b01/run-log.jsonl b/_acceptance/mo-hoa-b01/run-log.jsonl
index 597ac753..68648e76 100644
--- a/_acceptance/mo-hoa-b01/run-log.jsonl
+++ b/_acceptance/mo-hoa-b01/run-log.jsonl
@@ -169,3 +169,4 @@
 {"ts":"2026-09-07T15:08:35Z","round":8,"evalId":"E10","run_id":"minted-mo-hoa-b01-E10-r7","exit_code":0,"cmd":"bash scripts/fork/check-fork-identity-teeth.sh --case notice-dist-gone && bash scripts/fork/check-fork-identity-teeth.sh --case notice-unchanged-back && bash scripts/fork/check-fork-identity-teeth.sh --case notice-attribution-gone","carried_from_round":7}
 {"ts":"2026-09-07T15:08:35Z","round":8,"evalId":"E11","run_id":"minted-mo-hoa-b01-E11-r7","exit_code":0,"cmd":"bash scripts/fork/check-prototype-lane.sh mo-hoa-b01 && bash scripts/fork/check-fork-identity-teeth.sh --case debt-table-missing && bash scripts/fork/check-fork-identity-teeth.sh --case debt-table-duplicate","carried_from_round":7}
 {"ts":"2026-09-07T15:08:35Z","round":8,"kind":"round-tally","verdict":"PASS","expected":11,"returned":11,"blocked":0}
+{"ts":"2026-09-23T08:00:40Z","kind":"repin","run_id":"repin-20260923T080040Z-11314","sha":"825e6cd533e944a4ea7118af431433efc6cd75dd","suites_exit":[0,0,0,0,0,0,0,0,0],"evals_exit":{"E1":0,"E2":0,"E3":0,"E4":0,"E5":0,"E6":0,"E7":0,"E8":0,"E9":0,"E10":0,"E11":0}}
diff --git a/_acceptance/noi-thuoc-tai-lieu-vao-ci/evidence-report.md b/_acceptance/noi-thuoc-tai-lieu-vao-ci/evidence-report.md
index e8156132..782f34b7 100644
--- a/_acceptance/noi-thuoc-tai-lieu-vao-ci/evidence-report.md
+++ b/_acceptance/noi-thuoc-tai-lieu-vao-ci/evidence-report.md
@@ -7,7 +7,7 @@ reason:
 verified_by: phiên VERIFY tươi, chạy TUẦN TỰ (CLASSIFIER-FALLBACK sau BLOCKED vòng 2)
 enforcement_mode: strict
 bypass_used: false
-verified_commit: 36651d8d168c1945d2f3ad5f66e7799bf9f5c932
+verified_commit: 825e6cd533e944a4ea7118af431433efc6cd75dd
 human_signoff: Phan Le Manh 2026-09-02
 ---
 
@@ -236,3 +236,7 @@ lệnh-hỏng; lúc đó cây không còn lành vì một hồ sơ vừa đượ
 ### Re-pin lần 12 — 2026-09-16, do chien dich ghim lai kit 2.14.0
 run_id: repin-20260916T063028Z-36924
 sha: 36651d8d168c1945d2f3ad5f66e7799bf9f5c932 · suites: 9 lệnh exit 0 · evals: 9/9 eval máy đạt kỳ vọng
+
+### Re-pin lần 13 — 2026-09-23, do thước = kit từ 23/09 (#128/#129): needle bản đồ trỏ bước kit, guard gọi cổng kit, lcm_pmap/mhb_existing_guards trỏ bộ đọc bản đồ kit
+run_id: repin-20260923T080040Z-11314
+sha: 825e6cd533e944a4ea7118af431433efc6cd75dd · suites: 9 lệnh exit 0 · evals: 9/9 eval máy đạt kỳ vọng
diff --git a/_acceptance/noi-thuoc-tai-lieu-vao-ci/run-log.jsonl b/_acceptance/noi-thuoc-tai-lieu-vao-ci/run-log.jsonl
index 63436c6b..f1c5d82d 100644
--- a/_acceptance/noi-thuoc-tai-lieu-vao-ci/run-log.jsonl
+++ b/_acceptance/noi-thuoc-tai-lieu-vao-ci/run-log.jsonl
@@ -85,3 +85,4 @@
 {"ts":"2026-09-16T06:30:29Z","kind":"eval","run_id":"repin-20260916T063028Z-36924","eval":"E7","criterion":"AC-7","verifier":"config:executors.script.dkfo_docs_teeth","exit_code":0,"sha":"36651d8d168c1945d2f3ad5f66e7799bf9f5c932"}
 {"ts":"2026-09-16T06:30:29Z","kind":"eval","run_id":"repin-20260916T063028Z-36924","eval":"E8","criterion":"AC-8","verifier":"config:executors.script.ntlc_resign_wave","exit_code":0,"sha":"36651d8d168c1945d2f3ad5f66e7799bf9f5c932"}
 {"ts":"2026-09-16T06:30:29Z","kind":"eval","run_id":"repin-20260916T063028Z-36924","eval":"E9","criterion":"AC-9","verifier":"config:executors.script.ntlc_no_new_checkout","exit_code":0,"sha":"36651d8d168c1945d2f3ad5f66e7799bf9f5c932"}
+{"ts":"2026-09-23T08:00:40Z","kind":"repin","run_id":"repin-20260923T080040Z-11314","sha":"825e6cd533e944a4ea7118af431433efc6cd75dd","suites_exit":[0,0,0,0,0,0,0,0,0],"evals_exit":{"E1":0,"E2":0,"E3":0,"E4":0,"E5":0,"E6":0,"E7":0,"E8":0,"E9":0}}
diff --git a/_acceptance/o-do-chay-0-ca-van-xanh/evidence-report.md b/_acceptance/o-do-chay-0-ca-van-xanh/evidence-report.md
index 0fb28ca2..09b5db08 100644
--- a/_acceptance/o-do-chay-0-ca-van-xanh/evidence-report.md
+++ b/_acceptance/o-do-chay-0-ca-van-xanh/evidence-report.md
@@ -7,7 +7,7 @@ reason:
 verified_by: machine-lane (owner chốt bỏ lớp hội đồng, 31/08)
 enforcement_mode: strict
 bypass_used: false
-verified_commit: d6939560d2784fe505a01e1b65fa96c4d530ea94
+verified_commit: 825e6cd533e944a4ea7118af431433efc6cd75dd
 human_signoff: Phan Le Manh 2026-09-01
 ---
 
@@ -338,3 +338,7 @@ minh được.
 ### Re-pin lần 2 — 2026-09-08, do hang so di kem 33->38 trong rang bo kiem o do, va dong B3 neu so hieu ADR-0013
 run_id: repin-20260908T071345Z-62406
 sha: d6939560d2784fe505a01e1b65fa96c4d530ea94 · suites: 9 lệnh exit 0 · evals: 17 eval máy exit 0
+
+### Re-pin lần 3 — 2026-09-23, do thước = kit từ 23/09 (#128/#129): needle bản đồ trỏ bước kit, guard gọi cổng kit, lcm_pmap/mhb_existing_guards trỏ bộ đọc bản đồ kit
+run_id: repin-20260923T080040Z-11314
+sha: 825e6cd533e944a4ea7118af431433efc6cd75dd · suites: 9 lệnh exit 0 · evals: 17/17 eval máy đạt kỳ vọng
diff --git a/_acceptance/o-do-chay-0-ca-van-xanh/run-log.jsonl b/_acceptance/o-do-chay-0-ca-van-xanh/run-log.jsonl
index e03c59e7..b7f33457 100644
--- a/_acceptance/o-do-chay-0-ca-van-xanh/run-log.jsonl
+++ b/_acceptance/o-do-chay-0-ca-van-xanh/run-log.jsonl
@@ -27,3 +27,4 @@
 {"ts":"2026-09-05T10:15:00Z","kind":"eval","run_id":"repin-merge-20260905T101500Z","eval":"E12","criterion":"AC-11","verifier":"config:executors.script.gate_guards_job_no_new_job","exit_code":0,"sha":"96ee9b89c428b5ce0d64c8f49ba29eb7bd65727e"}
 {"ts":"2026-09-05T10:15:00Z","kind":"eval","run_id":"repin-merge-20260905T101500Z","eval":"E13","criterion":"AC-11","verifier":"config:executors.script.action_pins","exit_code":0,"sha":"96ee9b89c428b5ce0d64c8f49ba29eb7bd65727e"}
 {"ts":"2026-09-08T07:13:45Z","kind":"repin","run_id":"repin-20260908T071345Z-62406","sha":"d6939560d2784fe505a01e1b65fa96c4d530ea94","suites_exit":[0,0,0,0,0,0,0,0,0],"evals_exit":{"E1":0,"E2":0,"E3":0,"E4":0,"E5":0,"E6":0,"E7":0,"E8":0,"E9":0,"E10":0,"E11":0,"E12":0,"E13":0,"E15":0,"E16":0,"E17":0,"E14":0}}
+{"ts":"2026-09-23T08:00:40Z","kind":"repin","run_id":"repin-20260923T080040Z-11314","sha":"825e6cd533e944a4ea7118af431433efc6cd75dd","suites_exit":[0,0,0,0,0,0,0,0,0],"evals_exit":{"E1":0,"E2":0,"E3":0,"E4":0,"E5":0,"E6":0,"E7":0,"E8":0,"E9":0,"E10":0,"E11":0,"E12":0,"E13":0,"E15":0,"E16":0,"E17":0,"E14":0}}
diff --git a/_acceptance/roadmap-drift-guard/evidence-report.md b/_acceptance/roadmap-drift-guard/evidence-report.md
index 944badbe..250726ad 100644
--- a/_acceptance/roadmap-drift-guard/evidence-report.md
+++ b/_acceptance/roadmap-drift-guard/evidence-report.md
@@ -7,7 +7,7 @@ reason:
 verified_by: fresh-context verification subagent
 enforcement_mode: strict
 bypass_used: false
-verified_commit: 8aeab256ea83c8f653f04e362da194f5f2a63d29
+verified_commit: b2cd6684f6b8a051515aae821bd8638d14a004ee
 human_signoff: Manh 2026-08-27
 ---
 
@@ -425,3 +425,7 @@ sha: 36651d8d168c1945d2f3ad5f66e7799bf9f5c932 · suites: 9 lệnh exit 0 · eval
 ### Re-pin lần 8 — 2026-09-23, do fixture tick-noi-doi của răng plan-freeze thôi ghim skill-system-v1 (PR #128)
 run_id: repin-20260923T035636Z-96358
 sha: 8aeab256ea83c8f653f04e362da194f5f2a63d29 · suites: 9 lệnh exit 0 · evals: 10/10 eval máy đạt kỳ vọng
+
+### Re-pin lần 9 — 2026-09-23, do PR này đổi scripts/acceptance/** và scripts/ci/** (thước = kit từ 23/09), hồ sơ ghim ở 8aeab25 hoá stale
+run_id: repin-20260923T080348Z-99028
+sha: b2cd6684f6b8a051515aae821bd8638d14a004ee · suites: 9 lệnh exit 0 · evals: 10/10 eval máy đạt kỳ vọng
diff --git a/_acceptance/roadmap-drift-guard/run-log.jsonl b/_acceptance/roadmap-drift-guard/run-log.jsonl
index ec33f99f..a7d7bc48 100644
--- a/_acceptance/roadmap-drift-guard/run-log.jsonl
+++ b/_acceptance/roadmap-drift-guard/run-log.jsonl
@@ -119,3 +119,4 @@
 {"ts":"2026-09-16T06:30:30Z","kind":"eval","run_id":"repin-20260916T063028Z-36924","eval":"E9","criterion":"AC-9","verifier":"config:executors.script.roadmap_teeth_supersede_source_single","exit_code":0,"sha":"36651d8d168c1945d2f3ad5f66e7799bf9f5c932"}
 {"ts":"2026-09-16T06:30:30Z","kind":"eval","run_id":"repin-20260916T063028Z-36924","eval":"E11","criterion":"AC-4","verifier":"config:executors.script.roadmap_teeth_ledger_paired","exit_code":0,"sha":"36651d8d168c1945d2f3ad5f66e7799bf9f5c932"}
 {"ts":"2026-09-23T03:56:36Z","kind":"repin","run_id":"repin-20260923T035636Z-96358","sha":"8aeab256ea83c8f653f04e362da194f5f2a63d29","suites_exit":[0,0,0,0,0,0,0,0,0],"evals_exit":{"E1":0,"E2":0,"E3":0,"E4":0,"E5":0,"E6":0,"E7":0,"E8":0,"E9":0,"E11":0}}
+{"ts":"2026-09-23T08:03:48Z","kind":"repin","run_id":"repin-20260923T080348Z-99028","sha":"b2cd6684f6b8a051515aae821bd8638d14a004ee","suites_exit":[0,0,0,0,0,0,0,0,0],"evals_exit":{"E1":0,"E2":0,"E3":0,"E4":0,"E5":0,"E6":0,"E7":0,"E8":0,"E9":0,"E11":0}}
diff --git a/_acceptance/stale-scope-by-paths/decisions.jsonl b/_acceptance/stale-scope-by-paths/decisions.jsonl
index f0170064..8c25c475 100644
--- a/_acceptance/stale-scope-by-paths/decisions.jsonl
+++ b/_acceptance/stale-scope-by-paths/decisions.jsonl
@@ -17,3 +17,4 @@
 {"id":"d-20260729T095807Z-19845","type":"descope","stage":"gate2","at":"2026-07-29T09:58:07Z","decision":"KHÔNG vá lỗi 'scope toàn glob t1-exempt thì vĩnh viễn rỗng' trong feature này — mở contract riêng, gộp cùng chiều 'ngữ nghĩa không gian tên + coverage-set' mà hợp đồng hiện thiếu","impact":"human quyết ở Cổng 2. Vá lẻ 4 lần trước đều lòi biến thể kế tiếp, nên trục đúng là mở AC cho chính chiều đó chứ không thêm AC lẻ thứ 5. Đổi lại: ship bản này với một fail-open HIGH đã biết — một feature docs-only khai paths trung thực vẫn tự miễn nhiễm cảnh báo cũ","revisit":"Contract riêng ngay sau khi feature này merge"}
 {"id":"d-20260729T095807Z-29062","type":"descope","stage":"gate2","at":"2026-07-29T09:58:07Z","decision":"KHÔNG dịch ~265 dòng tiếng Việt + ≥14 thông điệp CI trong feature này — mở contract riêng","impact":"human quyết ở Cổng 2. Chúng thuộc file vendor của kit nên sửa tay sẽ bị ghi đè ở lần bump sau; việc thật là quyết định chính sách (xin upstream dịch, hay ghi ngoại lệ vendor vào CLAUDE.md/CONTRIBUTING.md). Đổi lại repo AGPL hướng contributor ngoài vẫn in thông điệp CI hai thứ tiếng cho tới lúc đó","revisit":"Contract riêng"}
 {"id": "d-20260805T190000Z-31447", "type": "descope", "stage": "gate2", "at": "2026-08-05T19:00:00Z", "decision": "Gỡ E3 (stale_scoping_golden) khỏi bộ eval. Golden của nó đóng băng PHÁN QUYẾT staleness của 7 feature khai 0 paths, không phải HÀNH VI scoping — nên nó không có trạng thái ổn định nào: để nguyên thì đỏ sau mọi wave re-pin thành công (đo được: exit 0 trước khi ghim, exit 1 sau khi ghim, cùng một cây); regen về 7 dòng OK thì đỏ ở nhánh sau khi 7 feature đó stale trở lại. Phát hiện trong wave của ci-vitest-sdk-pin, 05/08.", "impact": "AC-3 mất eval máy trực tiếp cho MỆNH ĐỀ (a) (khai 0 paths + thay đổi gated → vẫn báo stale). Hai mệnh đề còn lại (b) không thêm dòng output, (c) không được cấp narrow scope — vẫn được E15 (announce) khẳng định thẳng trên fixture mode `none` (zero paths). Bản đầu của entry này nói quá khoảng hở; sửa lại sau vòng verify context sạch 05/08. Vá = một dòng grep vào $d2 sẵn có trong case_announce, không cần case mới. check-stale-golden.sh, fixture của nó, và key executor stale_scoping_golden trong config.yaml được GIỮ LẠI ở lượt này (xoá là chạm scripts/** và kích lại treadmill staleness) — code chết, và guard đó chạy tay sẽ ĐỎ, đừng nhầm là gate hỏng. SỬA 27/08: cả ba mảnh đã được xoá ở PR #76 dưới hồ sơ gate-tooling-t1 (item 0.8b); lý do hoãn nói trên hết hiệu lực từ 97b5b12 (17/08) — đo được là commit chỉ chạm scripts/** sinh 0 stale violation."}
+{"id":"d-20260923T074315Z-20","type":"nghi","stage":"gate2","at":"2026-09-23T07:43:15Z","by":"manh","decision":"thước = kit từ 23/09","impact":"hồ sơ thôi hứa staleness theo paths đã khai: cổng fork mang cơ chế này đã xoá ở #129; kit ghim sha tính staleness trên cả cây ngoài t1_skip_globs, nên lời hứa này không còn ai thực thi, không phải do kit canh thay"}
diff --git a/scripts/acceptance/check-fork-scope-teeth.sh b/scripts/acceptance/check-fork-scope-teeth.sh
deleted file mode 100755
index 4b790924..00000000
--- a/scripts/acceptance/check-fork-scope-teeth.sh
+++ /dev/null
@@ -1,132 +0,0 @@
-#!/usr/bin/env bash
-# E9 / AC-8 of gate-tooling-t1 — teeth for the STALE-DIFF-SCOPE-GUARD fork.
-#
-# WHY THIS EXISTS. The fork lives inside scripts/pre-merge-check.sh, which
-# risk_tiers.t1_skip_globs exempts BY NAME. The exemption is there so upgrading
-# the measuring stick does not stale signed evidence — but it also means a
-# change to this fork's semantics touches no gated file, stales nothing, and
-# trips no t1-escape. It is the one place in the gate where behaviour can change
-# without any acceptance artifact being required. Measured cost of that hole:
-# the fork landed on 2026-08-17 and silently disabled five of check-stale-
-# scoping.sh's fourteen cases for ten days, including the one the E3 descope
-# decision was relying on.
-#
-# WHAT IT PINS. Two perturbations, each on a COPY of the tree (the working tree
-# is never edited, and the shipped gate carries no knob — AC-13):
-#   (1) revert the narrowing → the fork wraps the WHOLE staleness block again
-#       for every slug outside the diff. `fork-declared-in-union` must go RED:
-#       that is AC-2 of stale-scope-by-paths losing its only observable form.
-#   (2) remove the fork entirely (`if false`) → every merged feature is examined
-#       again. `fork-undeclared` must go RED: that is the treadmill re-opening
-#       for the 19 features that never declared `paths`.
-# Each perturbation must be shown to have actually changed the file, and each
-# must go green again when reverted — a patch whose target moved would otherwise
-# make this guard quietly stop testing anything, which is the exact failure mode
-# it is built to rule out.
-set -euo pipefail
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"; cd "$ROOT"
-GATE_REL=scripts/pre-merge-check.sh
-MARKER='# STALE-DIFF-SCOPE-GUARD'
-WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT
-fails=0
-
-echo "check-fork-scope-teeth:"
-
-# ── Anti-vacuous layer ──────────────────────────────────────────────────────
-# The perturbations below rewrite the two lines around a single marker. If the
-# marker moved, vanished, or multiplied, every patch becomes a no-op and this
-# guard reports OK having proved nothing.
-# The OPENING condition is the only line that ENDS with the marker; the closing
-# `fi` carries it mid-line ("# đóng STALE-...") and is deliberately not counted.
-# Measured, not assumed: `grep -c 'STALE-DIFF-SCOPE-GUARD'` is 2, `grep -c
-# '# STALE-DIFF-SCOPE-GUARD$'` is 1.
-open_n="$(grep -c "$MARKER\$" "$GATE_REL" || true)"
-any_n="$(grep -c 'STALE-DIFF-SCOPE-GUARD' "$GATE_REL" || true)"
-if [ "$open_n" -ne 1 ] || [ "$any_n" -lt 2 ]; then
-  echo "FAIL anti-vacuous: expected exactly ONE line ending in '$MARKER' (the opening condition) and at least two mentions overall in $GATE_REL; found open=$open_n any=$any_n — the perturbation targets have moved, so nothing below would test anything"
-  exit 1
-fi
-gate_sha_before="$(git hash-object "$GATE_REL")"
-echo "  ok   anti-vacuous: opening marker unique, fork block still present"
-
-# ── Build a pristine mini-root the scoping guard can run inside ─────────────
-# scripts/ + lib/ + _acceptance/config.yaml is everything check-stale-scoping.sh
-# reads from ROOT; its fixtures build their own git repos under TMPDIR.
-PRISTINE="$WORK/pristine"
-mkdir -p "$PRISTINE/_acceptance"
-cp -R scripts "$PRISTINE/scripts"
-cp -R lib "$PRISTINE/lib"
-cp _acceptance/config.yaml "$PRISTINE/_acceptance/config.yaml"
-
-# Replace the two-line fork condition with a single given line. Pure awk, using
-# a one-line lookbehind: the marker sits on the CONTINUATION line, so the line
-# before it (ending in a backslash) is part of the same condition and must go
-# with it.
-patch_condition() { # <src-gate> <dst-gate> <replacement-line>
-  awk -v repl="$3" '
-    $0 ~ /# STALE-DIFF-SCOPE-GUARD$/ && prev ~ /\\$/ && !done {
-      print repl; done = 1; prev = ""; next
-    }
-    prev != "" { print prev }
-    { prev = $0 }
-    END { if (prev != "") print prev }
-  ' "$1" > "$2"
-}
-
-run_case() { # <root> <case> -> exit code
-  bash "$1/scripts/acceptance/check-stale-scoping.sh" --case "$2" >/dev/null 2>&1 && echo 0 || echo 1
-}
-
-probe() { # <label> <replacement-line> <case-that-must-go-red> <case-that-must-stay-green>
-  local label="$1" repl="$2" red="$3" green="$4"
-  local root="$WORK/$label"
-  rm -rf "$root"; cp -R "$PRISTINE" "$root"
-
-  # Baseline on this copy — if it is not green, the RED below proves nothing.
-  if [ "$(run_case "$root" "$red")" != "0" ]; then
-    echo "  FAIL [$label] baseline: --case $red is already red on an unpatched copy; the perturbation result would be meaningless"
-    fails=$((fails+1)); return
-  fi
-
-  patch_condition "$PRISTINE/$GATE_REL" "$root/$GATE_REL.patched" "$repl"
-  if cmp -s "$PRISTINE/$GATE_REL" "$root/$GATE_REL.patched"; then
-    echo "  FAIL [$label] perturbation patched NOTHING — the fork condition's shape moved, so this probe has silently stopped testing"
-    fails=$((fails+1)); return
-  fi
-  mv "$root/$GATE_REL.patched" "$root/$GATE_REL"
-
-  if [ "$(run_case "$root" "$red")" != "1" ]; then
-    echo "  FAIL [$label] --case $red stayed GREEN under the perturbation — it does not actually pin this half of the fork"
-    fails=$((fails+1)); return
-  fi
-  if [ "$(run_case "$root" "$green")" != "0" ]; then
-    echo "  FAIL [$label] --case $green also went red — the two halves are not independent, so neither says which half broke"
-    fails=$((fails+1)); return
-  fi
-
-  # Revert on the same copy: green again, or the redness above was not caused
-  # by the patch.
-  cp "$PRISTINE/$GATE_REL" "$root/$GATE_REL"
-  if [ "$(run_case "$root" "$red")" != "0" ]; then
-    echo "  FAIL [$label] --case $red stayed red after reverting the perturbation — its redness was not caused by the patch"
-    fails=$((fails+1)); return
-  fi
-  echo "  ok   [$label] --case $red red under the perturbation, green when reverted; --case $green unaffected"
-}
-
-probe revert-narrowing \
-  '  if [ "$DIFF_READY" -eq 1 ] && ! slug_in_diff "$slug"; then # STALE-DIFF-SCOPE-GUARD' \
-  fork-declared-in-union fork-undeclared
-
-probe remove-fork \
-  '  if false; then # STALE-DIFF-SCOPE-GUARD' \
-  fork-undeclared fork-declared-in-union
-
-# ── The working tree must be untouched ──────────────────────────────────────
-if [ "$(git hash-object "$GATE_REL")" != "$gate_sha_before" ]; then
-  echo "  FAIL this guard modified the shipped gate — every perturbation must stay inside the temp copy"
-  fails=$((fails+1))
-fi
-
-[ "$fails" -eq 0 ] || { echo "FAIL: $fails fork-teeth probe(s) failed"; exit 1; }
-echo "OK: both halves of the STALE-DIFF-SCOPE-GUARD fork are pinned by a case that goes red when it changes"
diff --git a/scripts/acceptance/check-gate-residual.sh b/scripts/acceptance/check-gate-residual.sh
index aaa86eaa..f90afd70 100755
--- a/scripts/acceptance/check-gate-residual.sh
+++ b/scripts/acceptance/check-gate-residual.sh
@@ -39,7 +39,12 @@ fail() { echo "FAIL: $*" >&2; exit 1; }
 if [ -n "${GATE_RESIDUAL_INPUT:-}" ]; then
     out=$(cat "$GATE_RESIDUAL_INPUT")
 else
-    out=$(bash scripts/pre-merge-check.sh . --base "$BASE" 2>&1) || true
+    # The gate runs from the kit pinned at KIT_SHA since #129 (23/09), not from a
+    # vendored copy (kit GUIDE §5.3 step 5). Unset CLAUDE_PLUGIN_ROOT is a loud
+    # error, never a silent empty verdict.
+    gate="${CLAUDE_PLUGIN_ROOT:?CLAUDE_PLUGIN_ROOT unset: the gate lives in the kit (GUIDE §5.3)}/scripts/pre-merge-check.sh"
+    [ -f "$gate" ] || fail "kit gate not found at $gate"
+    out=$(bash "$gate" . --base "$BASE" 2>&1) || true
 fi
 
 # A run that never reached its own summary line crashed; refuse to read silence
diff --git a/scripts/acceptance/check-golden-dead-code-absent.sh b/scripts/acceptance/check-golden-dead-code-absent.sh
deleted file mode 100755
index 2747f993..00000000
--- a/scripts/acceptance/check-golden-dead-code-absent.sh
+++ /dev/null
@@ -1,54 +0,0 @@
-#!/usr/bin/env bash
-# E8 / AC-7 of gate-tooling-t1. The three dead pieces of the descoped E3
-# stale-golden eval must stay gone: the guard script, its golden fixture, and
-# the `stale_scoping_golden` executor key. Removed in PR #76; this is the
-# regression guard, because a later `vendor the kit` sweep can carry all three
-# back in without anyone noticing — they look like ordinary gate tooling.
-#
-# An absence check is the easiest kind to make vacuous: a typo in a path is
-# indistinguishable from the file being gone. So every absence assertion is
-# paired with a PRESENCE probe proving this script is scanning the right tree
-# in the first place.
-set -euo pipefail
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"; cd "$ROOT"
-fails=0
-
-ok()   { echo "  ok   $1"; }
-bad()  { echo "  FAIL $1"; fails=$((fails+1)); }
-
-echo "check-golden-dead-code-absent:"
-
-# ── Anti-vacuous layer: prove we are looking at a real acceptance tree ───────
-# Without these, a wrong ROOT (or a renamed directory) makes every absence
-# assertion below trivially true and this guard reports OK having checked
-# nothing at all.
-[ -d scripts/acceptance ] \
-  || bad "anti-vacuous: scripts/acceptance/ does not exist — this guard is scanning the wrong tree, so every absence below would be meaningless"
-[ -f scripts/acceptance/check-stale-scoping.sh ] \
-  || bad "anti-vacuous: the sibling guard check-stale-scoping.sh is missing — same doubt as above"
-[ -f _acceptance/config.yaml ] \
-  || bad "anti-vacuous: _acceptance/config.yaml is missing — the key check below could not mean anything"
-[ "$fails" -eq 0 ] || { echo "FAIL: anti-vacuous probes failed; absence assertions were NOT run"; exit 1; }
-ok "anti-vacuous probes: acceptance tree present"
-
-# ── The three pieces ────────────────────────────────────────────────────────
-if [ -e scripts/acceptance/check-stale-golden.sh ]; then
-  bad "scripts/acceptance/check-stale-golden.sh is back — E3 was descoped at Gate 2 on 2026-08-05 (decisions.jsonl d-20260805T190000Z-31447); running it by hand goes RED because its golden froze a staleness VERDICT, not the scoping BEHAVIOUR"
-else
-  ok "check-stale-golden.sh absent"
-fi
-
-if [ -e scripts/acceptance/fixtures/baseline-gate-output.txt ]; then
-  bad "scripts/acceptance/fixtures/baseline-gate-output.txt is back — the golden fixture has no stable state: red after every successful re-pin wave, and red on the next branch if regenerated"
-else
-  ok "baseline-gate-output.txt absent"
-fi
-
-if grep -q 'stale_scoping_golden' _acceptance/config.yaml; then
-  bad "the stale_scoping_golden executor key is back in _acceptance/config.yaml — a key wired to a descoped eval is how dead code gets run again"
-else
-  ok "stale_scoping_golden key absent from config.yaml"
-fi
-
-[ "$fails" -eq 0 ] || { echo "FAIL: $fails dead piece(s) present"; exit 1; }
-echo "OK: all three descoped stale-golden pieces stay absent"
diff --git a/scripts/acceptance/check-no-stale-empty-diff.sh b/scripts/acceptance/check-no-stale-empty-diff.sh
deleted file mode 100755
index ed302fc8..00000000
--- a/scripts/acceptance/check-no-stale-empty-diff.sh
+++ /dev/null
@@ -1,59 +0,0 @@
-#!/usr/bin/env bash
-# E10 / AC-9 of gate-tooling-t1 — no feature carries stale evidence, measured
-# with an EMPTY diff.
-#
-# WHY EMPTY. `--base HEAD` makes the PR diff empty, which separates the two
-# things that look identical in a normal gate run: evidence that was ALREADY
-# stale before anyone touched the branch, versus evidence the branch under work
-# just staled. Only the first kind is this contract's debt. Measured on
-# 2026-08-27: narrowing the STALE-DIFF-SCOPE-GUARD fork surfaced exactly four
-# already-stale records (conformance-l0, measure-harness, stale-scope-by-paths,
-# task-metering) that the wider fork had been hiding — the same four appear with
-# an empty diff and with the branch's real diff, which is how they were shown to
-# pre-date the branch.
-#
-# WHY IT IS NOT A TAUTOLOGY. Under the narrowed fork a feature outside the PR
-# diff is examined only if it declares complete `paths`; everything else is
-# skipped. With an empty diff EVERY feature is outside the diff, so "zero stale"
-# would also be the answer if the fork skipped all of them — a green that means
-# "nobody looked". The anti-vacuous layer below therefore requires the gate to
-# show it actually examined someone.
-set -euo pipefail
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"; cd "$ROOT"
-GATE=scripts/pre-merge-check.sh
-WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT
-out="$WORK/gate.txt"
-
-echo "check-no-stale-empty-diff:"
-
-bash "$GATE" . --base HEAD > "$out" 2>&1 || true
-
-# ── Anti-vacuous layer ──────────────────────────────────────────────────────
-if ! grep -q '^pre-merge-check:' "$out"; then
-  echo "FAIL anti-vacuous: the gate printed no summary line — it did not run to completion, so 'no stale evidence' would be an artefact of the crash"
-  exit 1
-fi
-if ! grep -qE '^OK \[' "$out"; then
-  echo "FAIL anti-vacuous: the gate judged no feature at all — zero stale records would mean zero records"
-  exit 1
-fi
-# The decisive one: at least one feature must have reached the staleness block.
-# A granted narrow scope is the only line that proves it — an examined feature
-# either announces its scope or is reported stale, and a skipped one is silent.
-examined="$(grep -c 'narrow staleness scope applied' "$out" || true)"
-if [ "$examined" -eq 0 ]; then
-  echo "FAIL anti-vacuous: no feature reached the staleness block (no 'narrow staleness scope applied' line) — with an empty diff that means the fork skipped every feature, so 'zero stale' proves nothing about the evidence"
-  exit 1
-fi
-echo "  ok   anti-vacuous: gate ran, judged $(grep -cE '^OK \[' "$out") feature(s), and examined $examined declaring feature(s)"
-
-# ── The assertion ───────────────────────────────────────────────────────────
-n_stale="$(grep -cE '^VIOLATION \[[^]]+\]: evidence is stale' "$out" || true)"
-if [ "$n_stale" -ne 0 ]; then
-  echo "  FAIL $n_stale feature(s) carry stale evidence with an empty diff — this debt pre-dates any branch and needs a re-verify wave, not a rebase:"
-  grep -E '^VIOLATION \[[^]]+\]: evidence is stale' "$out" | sed 's/:.*//' | sed 's/^/      /'
-  echo "FAIL: stale evidence survives on a clean tree"
-  exit 1
-fi
-
-echo "OK: no feature carries stale evidence when the diff is empty"
diff --git a/scripts/acceptance/check-resign-wave.sh b/scripts/acceptance/check-resign-wave.sh
index 7628224f..ed54bbae 100755
--- a/scripts/acceptance/check-resign-wave.sh
+++ b/scripts/acceptance/check-resign-wave.sh
@@ -35,7 +35,12 @@ fail() { echo "FAIL: $*" >&2; exit 1; }
 if [ -n "${GATE_RESIDUAL_INPUT:-}" ]; then
     out=$(cat "$GATE_RESIDUAL_INPUT")
 else
-    out=$(bash scripts/pre-merge-check.sh . --base "$BASE" 2>&1) || true
+    # The gate runs from the kit pinned at KIT_SHA since #129 (23/09), not from a
+    # vendored copy (kit GUIDE §5.3 step 5). Unset CLAUDE_PLUGIN_ROOT is a loud
+    # error, never a silent empty verdict.
+    gate="${CLAUDE_PLUGIN_ROOT:?CLAUDE_PLUGIN_ROOT unset: the gate lives in the kit (GUIDE §5.3)}/scripts/pre-merge-check.sh"
+    [ -f "$gate" ] || fail "kit gate not found at $gate"
+    out=$(bash "$gate" . --base "$BASE" 2>&1) || true
 fi
 
 # A run that never reached its own summary line crashed; refuse to read silence
diff --git a/scripts/acceptance/check-scoping-all-cases.sh b/scripts/acceptance/check-scoping-all-cases.sh
deleted file mode 100755
index 887e382c..00000000
--- a/scripts/acceptance/check-scoping-all-cases.sh
+++ /dev/null
@@ -1,62 +0,0 @@
-#!/usr/bin/env bash
-# E6 / AC-5 of gate-tooling-t1 — every case of check-stale-scoping.sh must be
-# green, and every case must actually be RUN.
-#
-# WHY IT READS THE LIST INSTEAD OF CARRYING ONE. A hardcoded case list here
-# would mean a case added later is never run by this eval — and that is not a
-# hypothetical: `indent-drift` shipped a working function that nothing ever
-# invoked, because no _acceptance/config.yaml key pointed `--case indent-drift`
-# at it. A list copied into a second place rots the same way. So the names come
-# from the guard's own KNOWN_CASES.
-#
-# WHY IT IS NOT REDUNDANT WITH case-completeness. That case proves each name
-# DISPATCHES (a function exists, and a config key points at it). It never runs
-# them. This one proves they PASS. Five of fourteen cases were red on a clean
-# main for ten days while case-completeness stayed green throughout — the two
-# questions are genuinely different.
-set -euo pipefail
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"; cd "$ROOT"
-GUARD=scripts/acceptance/check-stale-scoping.sh
-fails=0
-
-echo "check-scoping-all-cases:"
-
-# ── Anti-vacuous layer ──────────────────────────────────────────────────────
-# A broken parse yields an empty (or one-item) list, and a loop over it passes
-# having run nothing. Two independent sources have to agree before anything runs.
-cases="$(sed -n 's/^KNOWN_CASES="\(.*\)"$/\1/p' "$GUARD" | head -1)"
-n_cases="$(printf '%s\n' $cases | grep -c . || true)"
-if [ "$n_cases" -eq 0 ]; then
-  echo "FAIL anti-vacuous: could not parse KNOWN_CASES out of $GUARD — a loop over an empty list would report OK having run nothing"
-  exit 1
-fi
-# Independent source: every case is wired into config.yaml as `--case <name>`
-# (case-completeness enforces that direction). If the two counts disagree, one
-# of the two readings is wrong and this guard must not pretend otherwise.
-n_cfg="$(grep -o 'check-stale-scoping\.sh --case [a-z0-9-]*' _acceptance/config.yaml | sort -u | grep -c . || true)"
-if [ "$n_cases" -ne "$n_cfg" ]; then
-  echo "FAIL anti-vacuous: KNOWN_CASES lists $n_cases case(s) but _acceptance/config.yaml wires $n_cfg — the two readings disagree, so neither can be trusted as the list to run"
-  exit 1
-fi
-echo "  ok   anti-vacuous: $n_cases cases, and config.yaml wires the same number"
-
-# ── Run them all ────────────────────────────────────────────────────────────
-red=""
-for c in $cases; do
-  out="$(bash "$GUARD" --case "$c" 2>&1 || true)"
-  # A case that never printed its own CASE line did not run — an unknown name
-  # exits 2 before dispatching, and that must not be mistaken for a pass.
-  if ! printf '%s\n' "$out" | grep -q "^CASE $c: "; then
-    echo "  FAIL $c: the guard printed no 'CASE $c:' line — it never dispatched (unknown name, or the guard died before reaching it)"
-    red="$red $c"; fails=$((fails+1)); continue
-  fi
-  if printf '%s\n' "$out" | grep -q "^CASE $c: PASS"; then
-    echo "  ok   $c"
-  else
-    echo "  FAIL $c: $(printf '%s\n' "$out" | grep "^CASE $c:" | head -1 | cut -c1-160)"
-    red="$red $c"; fails=$((fails+1))
-  fi
-done
-
-[ "$fails" -eq 0 ] || { echo "FAIL: $fails of $n_cases scoping case(s) red —$red"; exit 1; }
-echo "OK: all $n_cases cases of check-stale-scoping.sh pass"
diff --git a/scripts/acceptance/check-stale-real-repo.sh b/scripts/acceptance/check-stale-real-repo.sh
deleted file mode 100755
index a69f9f16..00000000
--- a/scripts/acceptance/check-stale-real-repo.sh
+++ /dev/null
@@ -1,98 +0,0 @@
-#!/usr/bin/env bash
-# E14 / AC-10: run the finished gate against THIS repo at two pinned SHAs and
-# assert conformance-l0 — the only feature that declares paths, written before
-# this rule existed — is refused narrow scope for exactly six files.
-#
-# Refs are literal SHAs, not branch names: merging PR #25 or adding one src/**
-# file to the branch would otherwise move the answer and redden a correct
-# implementation.
-#
-# The split that matters: the EXECUTABLE LOGIC (pre-merge-check.sh,
-# recheck-evidence.js, lib/evidence-core.js) is read from HERE — the current
-# working tree at HEAD of this branch — because that is the finished
-# mechanism under test. The _acceptance/ tree, the git history, and the files
-# the gate globs against all come from a worktree checked out at HEAD_SHA, a
-# commit that predates this branch and still carries conformance-l0's
-# declaration untouched. Running the OLD script that lived at HEAD_SHA (it
-# predates the entire scoping mechanism) would prove nothing; running the
-# current script against the CURRENT repo's _acceptance/ tree would not see
-# conformance-l0 at all, since that directory does not exist on this branch.
-# So: current script, worktree's content — never the other way round, and
-# never both from the same place.
-set -u
-HERE="$(cd "$(dirname "$0")" && pwd)"
-ROOT="$(cd "$HERE/../.." && pwd)"
-#
-# Both SHAs must be PUSHED commits, reachable from some remote-tracking ref.
-# A commit that exists only in the author's clone makes this eval pass on one
-# machine and fail everywhere else — and this is the one criterion in the
-# feature that asserts against real repo data rather than a fixture, so it is
-# exactly the one that must survive a clean checkout. HEAD_SHA was originally
-# pinned to an unpushed commit on the sibling branch; the reachability
-# preflight below exists so that mistake fails loudly at authoring time
-# instead of silently passing local review.
-BASE_SHA=336944d68a7bc7fe6da281a8c6eaf24d105703a2
-HEAD_SHA=7352ca57b932924dfabb18a80f4e71ed4b6810fd
-
-EXPECTED="src/components/workspace/execution-status-line.tsx
-src/constants/task-status.ts
-src/hooks/use-workflow-execution.ts
-src/hooks/use-workflow-recovery.ts
-src/lib/abi/conformance.ts
-src/lib/task/engine-events.ts"
-
-for sha in "$BASE_SHA" "$HEAD_SHA"; do
-  git -C "$ROOT" rev-parse --quiet --verify "$sha^{commit}" >/dev/null 2>&1 \
-    || { echo "FAIL: pinned commit $sha not in this clone (shallow fetch or rewritten history)"; exit 1; }
-  # Present locally is NOT enough: an unpushed commit is present in exactly one
-  # clone. Require reachability from a remote-tracking ref, which is what any
-  # other clone (CI included) can actually obtain. Stale remote refs can make
-  # this red for a genuinely-pushed commit — the remedy is a fetch, and a
-  # spurious red that a fetch clears is the cheap side of this trade.
-  reachable=0
-  for ref in $(git -C "$ROOT" for-each-ref --format='%(refname)' refs/remotes/ 2>/dev/null); do
-    if git -C "$ROOT" merge-base --is-ancestor "$sha" "$ref" 2>/dev/null; then reachable=1; break; fi
-  done
-  [ "$reachable" -eq 1 ] || {
-    echo "FAIL: pinned commit $sha is in this clone but reachable from NO remote-tracking ref"
-    echo "      — it is unpushed local work, so this eval would pass here and fail on CI."
-    echo "      Run 'git fetch --all' first; if it is still unreachable, push the commit or re-pin to one that is."
-    exit 1
-  }
-done
-
-work="$(mktemp -d)"
-cleanup() {
-  git -C "$ROOT" worktree remove --force "$work" >/dev/null 2>&1 || true
-  git -C "$ROOT" worktree prune >/dev/null 2>&1 || true
-  rm -rf "$work"
-}
-trap cleanup EXIT
-
-git -C "$ROOT" worktree add -q --detach "$work" "$HEAD_SHA" \
-  || { echo "FAIL: could not create worktree at $HEAD_SHA"; exit 1; }
-
-# Run the CURRENT gate ($ROOT/scripts/pre-merge-check.sh, at HEAD of this
-# branch) but point it AT the worktree ($work) as the root to inspect.
-# pre-merge-check.sh takes the root to inspect as its first positional
-# argument — that is what makes "current logic, pinned-SHA content" possible
-# without executing the worktree's own (pre-mechanism) copy of the script.
-out="$(bash "$ROOT/scripts/pre-merge-check.sh" "$work" --base "$BASE_SHA" 2>&1)"
-
-# The cross-check must have FIRED — a pass with no cross-check is vacuous.
-printf '%s\n' "$out" | grep -q 'NOTE \[conformance-l0\]: declared eval paths do not cover' \
-  || { echo "FAIL: cross-check did not fire for conformance-l0"; printf '%s\n' "$out"; exit 1; }
-
-actual="$(printf '%s\n' "$out" \
-  | sed -n '/NOTE \[conformance-l0\]: declared eval paths do not cover/,/^[A-Z]/p' \
-  | sed -n 's/^    //p' | sort)"
-
-[ -n "$actual" ] || { echo "FAIL: uncovered list is empty"; exit 1; }
-
-if [ "$actual" = "$(printf '%s\n' "$EXPECTED" | sort)" ]; then
-  echo "OK: conformance-l0 refused narrow scope for exactly the six declared-but-missing files"
-  exit 0
-fi
-echo "FAIL: uncovered list is not the expected exact set"
-diff <(printf '%s\n' "$EXPECTED" | sort) <(printf '%s\n' "$actual") || true
-exit 1
diff --git a/scripts/acceptance/check-stale-scoping.sh b/scripts/acceptance/check-stale-scoping.sh
deleted file mode 100755
index 9d61f423..00000000
--- a/scripts/acceptance/check-stale-scoping.sh
+++ /dev/null
@@ -1,759 +0,0 @@
-#!/usr/bin/env bash
-# Guard for the paths-scoped staleness mechanism in pre-merge-check.sh.
-#
-# Lives under scripts/acceptance/ on purpose: risk_tiers.t1_skip_globs exempts
-# the gate tooling by EXACT path, so this file is gated and the gate applies to
-# the change that alters the gate (AC-11).
-#
-# One case per criterion, each with its own exit code. Nine criteria behind one
-# command would mean a case that was never implemented looks identical to a case
-# that passed.
-set -u
-HERE="$(cd "$(dirname "$0")" && pwd)"
-ROOT="$(cd "$HERE/../.." && pwd)"
-GATE="$ROOT/scripts/pre-merge-check.sh"
-
-# Fixture-construction helpers (mk_fixture, write_report, mk_pair_fixture,
-# etc.) live in a sibling file purely to keep this one under the repo's
-# 800-line convention. Sourced via the same cd-based HERE this file already
-# resolves above, so it works regardless of the caller's working directory.
-. "$HERE/fixtures.sh"
-
-# Cases use new_case_tmpdir() (fixtures.sh) for temp dirs; this one EXIT trap
-# cleans them all up on pass, on fail()'s exit, and on interrupt alike.
-trap cleanup_case_tmpdirs EXIT
-
-KNOWN_CASES="in-scope out-of-scope partial under-declared malformed indent-drift merged-halves two-bases suppression announce fork-undeclared fork-declared-in-union undeclared mutation case-completeness guard-not-exempt no-kill-switch"
-
-# Perturbation knob names. Referenced here and asserted ABSENT from the shipped
-# gate by the no-kill-switch case: an env var in the gate itself would be a
-# production kill switch (set it, every declared feature gets a match-nothing
-# scope, the gate exits clean).
-KNOB_NO_MATCH="STALE_SCOPE_FORCE_NO_MATCH"
-KNOB_ALWAYS_COMPLETE="STALE_SCOPE_FORCE_COMPLETE"
-
-pass() { echo "CASE $1: PASS"; }
-fail() { echo "CASE $1: FAIL $2"; exit 1; }
-
-case_case_completeness() {
-  # E10: a case that was never implemented must be loud, not absent. Every name
-  # in KNOWN_CASES must dispatch to a function that exists.
-  missing=""
-  for c in $KNOWN_CASES; do
-    fn="case_$(printf '%s' "$c" | tr '-' '_')"
-    command -v "$fn" >/dev/null 2>&1 || missing="$missing $c"
-  done
-  [ -z "$missing" ] || fail case-completeness "unimplemented cases:$missing"
-  # And an unknown case name must be rejected rather than silently succeeding.
-  if bash "$0" --case definitely-not-a-case >/dev/null 2>&1; then
-    fail case-completeness "unknown case name exited 0"
-  fi
-  # A case can exist here and still never RUN anywhere: exactly what happened
-  # to indent-drift, which shipped a working function with no
-  # _acceptance/config.yaml executors.script key pointing `--case
-  # indent-drift` at it, so nothing at verify time or in CI ever invoked it.
-  # Every name in KNOWN_CASES must appear as a literal `--case <name>` inside
-  # _acceptance/config.yaml (moved to fixtures.sh's
-  # assert_cases_wired_in_config() purely for this file's 800-line cap).
-  missing_cfg="$(assert_cases_wired_in_config "$ROOT/_acceptance/config.yaml")"
-  [ -z "$missing_cfg" ] \
-    || fail case-completeness "cases with no --case <name> wired into _acceptance/config.yaml executors.script:$missing_cfg"
-  pass case-completeness
-}
-
-case_guard_not_exempt() {
-  # E11 / AC-11: this guard's own path must match NO glob in t1_skip_globs, or
-  # the gate would exempt the change that alters the gate.
-  #
-  # Reuse match_globs() from the gate instead of hand-rolling a second glob
-  # matcher: `case` pattern semantics differ between shells, and a private
-  # copy would silently drift from what the gate actually does. Extracting
-  # only the function body (not sourcing/executing the whole gate script,
-  # which has side effects and calls exit) keeps this guard tested against
-  # the exact matcher the gate ships.
-  match_globs_src="$(sed -n '/^match_globs()/,/^}/p' "$GATE")"
-  [ -n "$match_globs_src" ] || fail guard-not-exempt "could not extract match_globs() from $GATE"
-  eval "$match_globs_src"
-
-  globs="$(sed -n '/^  t1_skip_globs:/,/^  [a-zA-Z0-9_-]*:/p' "$ROOT/_acceptance/config.yaml" \
-    | sed -n 's/^[[:space:]]*-[[:space:]]*//p' \
-    | sed -e 's/[[:space:]]*#.*$//' -e 's/^"//' -e 's/"$//' -e "s/^'//" -e "s/'\$//")"
-  [ -n "$globs" ] || fail guard-not-exempt "could not read t1_skip_globs"
-
-  self="scripts/acceptance/check-stale-scoping.sh"
-  if match_globs "$self" "$globs"; then
-    fail guard-not-exempt "$self is exempt via a t1_skip_globs entry"
-  fi
-  # Same check for the fixture-construction helpers this guard sources
-  # (scripts/acceptance/fixtures.sh): a helper the gate exempts would be a
-  # hole in the same way $self being exempt would be.
-  helper="scripts/acceptance/fixtures.sh"
-  if match_globs "$helper" "$globs"; then
-    fail guard-not-exempt "$helper is exempt via a t1_skip_globs entry"
-  fi
-  # Sanity: the matcher must actually match something, or the check above
-  # proves nothing. A path that IS exempt has to be seen as exempt.
-  known_exempt="scripts/pre-merge-check.sh"
-  if ! match_globs "$known_exempt" "$globs"; then
-    fail guard-not-exempt "matcher matched nothing — check is vacuous"
-  fi
-  pass guard-not-exempt
-}
-
-case_no_kill_switch() {
-  # E13 / AC-13: the perturbation knobs must exist only in this guard's temp
-  # copy, never in the shipped gate.
-  for k in "$KNOB_NO_MATCH" "$KNOB_ALWAYS_COMPLETE"; do
-    if grep -q "$k" "$GATE"; then
-      fail no-kill-switch "shipped gate references perturbation knob $k"
-    fi
-  done
-  pass no-kill-switch
-}
-
-case_partial() {
-  # E4 / AC-4: paths on some evals but not all is the state a half-finished
-  # backfill leaves behind. Scoping by a partial list is worse than not scoping.
-  d="$(new_case_tmpdir)"
-  mk_fixture "$d" fx partial
-  vc="$(git -C "$d" rev-parse HEAD)"
-  write_report "$d" fx "$vc"
-  ( cd "$d" && echo drift > src/uncovered/new.txt && git add -A && git commit -q -m drift )
-  out="$(bash "$GATE" "$d" --base "$vc" 2>&1)"
-  printf '%s\n' "$out" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail partial "partial declaration did not fall back to whole-tree: $out"
-  printf '%s\n' "$out" | grep -q 'narrow scope' \
-    && fail partial "partial declaration was granted narrow scope"
-
-  # Same partial declaration, hidden behind balanced TOTALS: two `paths:`
-  # lines on one eval and none on the other. A completeness test that counts
-  # eval lines against paths lines sees 2 == 2 and calls it complete, then
-  # builds the union from the one eval that declared twice while the other
-  # eval's implicit whole-tree scope vanishes. A copy-paste duplicate is
-  # enough to reach it, so it is not an exotic shape.
-  # ISOLATION, rebuilt for the STALE-DIFF-SCOPE-GUARD fork. The old shape kept
-  # `_acceptance/fx/` out of the PR diff so the cross-check could not refuse
-  # the scope on its own and mask the completeness test. Since the fork that
-  # same shape also skips the staleness block entirely, so it now masks
-  # everything. Isolation is achieved from the other side instead: the slug IS
-  # in the diff, and the drift is placed INSIDE the union the duplicate
-  # declares so the cross-check PASSES — leaving the completeness test as the
-  # only thing that can still refuse the scope.
-  #
-  # Which assertion carries the signal changed with it. A granted scope would
-  # cover src/covered/** too, so the file stales either way and the
-  # `evidence is stale` assertion no longer discriminates; the discriminating
-  # one is the `narrow staleness scope applied` assertion, which appears only
-  # if the completeness test wrongly reads this partial declaration as
-  # complete. Kept both: the second is still a regression guard on the
-  # fallback itself.
-  d2="$(new_case_tmpdir)"
-  base2="$(mk_committed_report_fixture "$d2" fx dup)"
-  ( cd "$d2" && echo drift > src/covered/new.txt && pr_touches_artifacts "$d2" fx && git add -A && git commit -q -m drift )
-  out2="$(bash "$GATE" "$d2" --base "$base2" 2>&1)"
-  printf '%s\n' "$out2" | grep -q 'narrow staleness scope applied' \
-    && fail partial "duplicate-key partial declaration was granted narrow scope: $out2"
-  printf '%s\n' "$out2" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail partial "duplicate-key partial declaration did not fall back to whole-tree: $out2"
-
-  # Third shape of the same lie: E2 declares nothing, and a `paths:` key at the
-  # eval-key column sits in an unrelated mapping BELOW the evals list. Totals
-  # balance, and attributing a paths line to the "nearest `- id:` above"
-  # without checking it is still INSIDE that eval hands the stray key to E2 —
-  # the union then gains a glob no eval declared. Same rebuilt isolation as
-  # above: slug in the diff, drift inside the union so the cross-check passes.
-  d3="$(new_case_tmpdir)"
-  base3="$(mk_committed_report_fixture "$d3" fx stray)"
-  ( cd "$d3" && echo drift > src/covered/new.txt && pr_touches_artifacts "$d3" fx && git add -A && git commit -q -m drift )
-  out3="$(bash "$GATE" "$d3" --base "$base3" 2>&1)"
-  printf '%s\n' "$out3" | grep -q 'narrow staleness scope applied' \
-    && fail partial "stray out-of-block paths key was folded into a granted scope: $out3"
-  printf '%s\n' "$out3" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail partial "stray out-of-block paths key did not fall back to whole-tree: $out3"
-  pass partial
-}
-
-case_malformed() {
-  # E6 / AC-6: `paths: []` must read as not-declared. Read as "declared with an
-  # empty scope" it matches nothing, i.e. never stale — the worst misreading.
-  d="$(new_case_tmpdir)"
-  mk_fixture "$d" fx empty
-  vc="$(git -C "$d" rev-parse HEAD)"
-  write_report "$d" fx "$vc"
-  ( cd "$d" && echo drift > src/uncovered/new.txt && git add -A && git commit -q -m drift )
-  out="$(bash "$GATE" "$d" --base "$vc" 2>&1)"
-  printf '%s\n' "$out" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail malformed "empty paths array did not fall back to whole-tree: $out"
-  pass malformed
-}
-
-case_indent_drift() { run_indent_drift_case; } # E-indent-drift/AC-6 — real body (27 assertions on feature_scope()'s YAML-shape handling) is run_indent_drift_case() in fixtures.sh, moved there only for this file's 800-line cap
-
-case_in_scope() {
-  # E1 / AC-1: THE load-bearing case. Narrow scope must still catch a change
-  # inside the declared union — a mechanism degraded into "never stale" passes
-  # every other criterion in this guard.
-  d="$(new_case_tmpdir)"
-  mk_fixture "$d" fx all
-  vc="$(git -C "$d" rev-parse HEAD)"
-  write_report "$d" fx "$vc"
-  ( cd "$d" && echo drift > src/covered/new.txt && git add -A && git commit -q -m drift )
-  out="$(bash "$GATE" "$d" --base "$vc" 2>&1)"
-  printf '%s\n' "$out" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail in-scope "in-union change did NOT stale the feature: $out"
-
-  # Non-ASCII path inside the declared union: `git diff --name-only` quotes
-  # and octal-escapes a non-ASCII path by default (core.quotePath), so it
-  # arrives as a literal string like "caf\303\251.txt" that can never match a
-  # plain-ASCII glob.
-  #
-  # The PR carries the feature's artifacts (pr_touches_artifacts) because the
-  # STALE-DIFF-SCOPE-GUARD fork examines staleness only for a feature inside
-  # the PR diff; without them the gate prints `OK [fx]` having looked at
-  # nothing and this assertion measures silence. The old shape here committed
-  # the report separately to dodge the cross-check, which the fork has welded
-  # to the same switch. Dodging is no longer possible, so instead the
-  # cross-check is made to PASS rather than be skipped: mode `all` declares
-  # src/covered/**, and the PR's only gated file is inside it.
-  d2="$(new_case_tmpdir)"
-  base2="$(mk_committed_report_fixture "$d2" fx all)"
-  ( cd "$d2" && printf 'x' > "src/covered/café.txt" && pr_touches_artifacts "$d2" fx && git add -A && git commit -q -m "non-ascii file in scope" )
-  out2="$(bash "$GATE" "$d2" --base "$base2" 2>&1)"
-  printf '%s\n' "$out2" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail in-scope "non-ASCII in-union path did NOT stale the feature (quoted-path dropped from narrow scope): $out2"
-  printf '%s\n' "$out2" | grep -qF 'café.txt' \
-    || fail in-scope "non-ASCII in-union path was staled but not named cleanly (still quoted/escaped): $out2"
-
-  # Monorepo layout ($ROOT below the git top-level), both spellings. Every
-  # other fixture here puts $ROOT at the git root, where ls-files and
-  # `diff --name-only` agree and a namespace mismatch cannot show. Half 3a: a
-  # top-level-spelled declaration must behave exactly like the flat case —
-  # an in-union change still stales. Half 3b is the regression proper: a
-  # $ROOT-relative spelling matches no tracked file in the namespace the
-  # staleness filter uses, so it must be REFUSED out loud and fall back to
-  # whole-tree — never granted and then silently filtering everything out,
-  # which is "never stale" wearing a narrow-scope hat.
-  d3="$(new_case_tmpdir)"
-  base3="$(mk_subdir_fixture "$d3" fx 'pkg/src/covered/**')"
-  ( cd "$d3" && echo drift > pkg/src/covered/new.txt && pr_touches_artifacts "$d3/pkg" fx && git add -A && git commit -q -m drift )
-  out3="$(bash "$GATE" "$d3/pkg" --base "$base3" 2>&1)"
-  printf '%s\n' "$out3" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail in-scope "subdir root, top-level-spelled paths: in-union change did NOT stale the feature: $out3"
-
-  d4="$(new_case_tmpdir)"
-  base4="$(mk_subdir_fixture "$d4" fx 'src/covered/**')"
-  ( cd "$d4" && echo drift > pkg/src/covered/new.txt && pr_touches_artifacts "$d4/pkg" fx && git add -A && git commit -q -m drift )
-  out4="$(bash "$GATE" "$d4/pkg" --base "$base4" 2>&1)"
-  # The protective property is unchanged — a $ROOT-relative spelling must never
-  # be granted a scope that silently filters everything out — but since the
-  # STALE-DIFF-SCOPE-GUARD fork it is a DIFFERENT guard that catches it, so the
-  # assertion is on the outcome rather than on one message.
-  #
-  # Reachability, measured: for the staleness block to run at all the slug must
-  # be in the PR diff, which also switches the cross-check on; for the
-  # cross-check to pass, the declared union must cover a non-empty gated
-  # coverage set, i.e. it must match at least one tracked file — which is
-  # exactly what the `match no gated file` refusal requires to be false. The
-  # two conditions cannot hold at once, so that specific refusal is no longer
-  # reachable from any fixture. Here the namespace mismatch surfaces as the
-  # cross-check's `do not cover` refusal instead. Both refuse the scope and
-  # fall back to whole-tree, which is the behaviour this case exists to pin.
-  printf '%s\n' "$out4" | grep -qE 'NOTE \[fx\]: declared eval paths (match no gated file|do not cover)' \
-    || fail in-scope "subdir root, \$ROOT-relative paths: match-nothing declaration was NOT refused: $out4"
-  printf '%s\n' "$out4" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail in-scope "subdir root, \$ROOT-relative paths: refused scope did NOT fall back to whole-tree staleness: $out4"
-  pass in-scope
-}
-
-case_out_of_scope() {
-  # E2 / AC-2: the behaviour the feature exists to produce.
-  #
-  # The report is committed on its own, and --base is taken AFTER that commit
-  # (not at the same commit the report's own verified_commit points to), so
-  # this feature's _acceptance/fx/ is NOT part of the PR diff the Task-6
-  # cross-check inspects (case_merged_halves' "half A" shape). That isolates
-  # what this case exists to prove — an out-of-declared-scope change alone
-  # does not stale the feature — from the cross-check, which is a separate
-  # concern exercised by case_under_declared / case_merged_halves / case_two_bases.
-  d="$(new_case_tmpdir)"
-  mk_fixture "$d" fx narrow
-  vc="$(git -C "$d" rev-parse HEAD)"
-  write_report "$d" fx "$vc"
-  ( cd "$d" && git add -A && git commit -q -m report )
-  base="$(git -C "$d" rev-parse HEAD)"
-  ( cd "$d" && echo drift > src/uncovered/new.txt && git add -A && git commit -q -m drift )
-  out="$(bash "$GATE" "$d" --base "$base" 2>&1)"
-  printf '%s\n' "$out" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    && fail out-of-scope "out-of-union change still staled the feature: $out"
-  printf '%s\n' "$out" | grep -q 'OK \[fx\]' \
-    || fail out-of-scope "feature not reported OK: $out"
-  # No over-refusal (Task 6): "narrow" mode's paths ("src/covered/**") DO
-  # match a tracked file (src/covered/seed.txt, seeded by mk_fixture) — the
-  # match-nothing guard must not misfire on a legitimately-matching
-  # declaration and fall back to whole-tree scope.
-  printf '%s\n' "$out" | grep -q 'match no gated file' \
-    && fail out-of-scope "match-nothing guard wrongly refused a declaration whose globs DO match a tracked file: $out"
-  pass out-of-scope
-}
-
-case_suppression() {
-  # E8 / AC-8: the pre-existing exclusions must survive refactoring the
-  # function that applies them — for declared and undeclared features alike.
-  for mode in all none; do
-    d="$(new_case_tmpdir)"
-    mk_fixture "$d" fx "$mode"
-    vc="$(git -C "$d" rev-parse HEAD)"
-    write_report "$d" fx "$vc"
-    ( cd "$d" && echo x > docs/note.md && echo y >> _acceptance/fx/run-log.jsonl && git add -A && git commit -q -m docs )
-    out="$(bash "$GATE" "$d" --base "$vc" 2>&1)"
-    if printf '%s\n' "$out" | grep -q 'VIOLATION \[fx\]: evidence is stale'; then
-      fail suppression "docs/_acceptance-only change staled a $mode-paths feature: $out"
-    fi
-  done
-  pass suppression
-}
-
-case_announce() {
-  # E15 / AC-14: a granted narrow scope is the only path that WEAKENS the gate,
-  # and it used to have no output at all. Undeclared (below) must still stay
-  # silent, or AC-3 breaks.
-  #
-  # Rebuilt for the STALE-DIFF-SCOPE-GUARD fork. The old shape kept
-  # `_acceptance/fx/` out of the PR diff to dodge Task 6's cross-check; the
-  # fork made that same shape skip the staleness block outright, so the gate
-  # printed `OK [fx]: PASS` and this case asserted against silence. A granted
-  # scope now requires BOTH halves at once: the slug in the diff (or nothing is
-  # examined) and the cross-check passing (or the scope is refused). That is
-  # exactly case_two_bases' shape, so it is reused here — the out-of-scope
-  # change lands BEFORE the base, where it is inside the feature's staleness
-  # range but outside the PR's coverage set, which is what leaves the
-  # announcement something to report as suppressed.
-  d="$(new_case_tmpdir)"; d2="$(new_case_tmpdir)"
-  mk_fixture "$d" fx narrow
-  vc="$(git -C "$d" rev-parse HEAD)"
-  write_report "$d" fx "$vc"
-  ( cd "$d" && git add -A && git commit -q -m report )
-  ( cd "$d" && echo old > src/uncovered/unrelated.txt && git add -A && git commit -q -m "unrelated merge" )
-  base="$(git -C "$d" rev-parse HEAD)"
-  ( cd "$d" && echo new > src/covered/pr.txt && pr_touches_artifacts "$d" fx && git add -A && git commit -q -m pr )
-  out="$(bash "$GATE" "$d" --base "$base" 2>&1)"
-  printf '%s\n' "$out" | grep -q 'narrow staleness scope applied' || fail announce "no announcement for a granted narrow scope: $out"
-  printf '%s\n' "$out" | grep -q 'suppressed' || fail announce "announcement does not say the narrowing suppressed a whole-tree change: $out"
-  # Undeclared half: the slug is in the diff here too, so the staleness block
-  # genuinely runs and the silence below is a measured silence rather than the
-  # fork's. Without it this assertion passes on every input, AC-3 included.
-  base2="$(mk_committed_report_fixture "$d2" fx none)"
-  ( cd "$d2" && echo drift > src/uncovered/new.txt && pr_touches_artifacts "$d2" fx && git add -A && git commit -q -m drift )
-  out2="$(bash "$GATE" "$d2" --base "$base2" 2>&1)"
-  printf '%s\n' "$out2" | grep -q 'narrow staleness scope applied' && fail announce "undeclared feature produced an announcement: $out2"
-  printf '%s\n' "$out2" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail announce "undeclared feature was not staled by a gated change — the staleness block did not run, so the silence above proves nothing: $out2"
-  pass announce
-}
-
-case_fork_undeclared() {
-  # E4 / AC-3 — nửa SUPPRESSION của hồ sơ gate-tooling-t1. Feature KHÔNG khai
-  # `paths` và `_acceptance/fx/` NGOÀI diff PR: fork STALE-DIFF-SCOPE-GUARD bỏ
-  # qua trọn khối, nên nó không bị báo stale dù có thay đổi gated sau
-  # verified_commit. Đây là lý do fork tồn tại (chống chặn-mọi-PR-vì-lịch-sử),
-  # nên một bản "thu hẹp fork" tay trượt thành gỡ hẳn fork phải làm case này đỏ.
-  d="$(new_case_tmpdir)"
-  base="$(mk_committed_report_fixture "$d" fx none)"
-  ( cd "$d" && echo drift > src/covered/new.txt && git add -A && git commit -q -m drift )
-  out="$(bash "$GATE" "$d" --base "$base" 2>&1)"
-  printf '%s\n' "$out" | grep -q 'OK \[fx\]' \
-    || fail fork-undeclared "feature không xuất hiện trong output — case này khẳng định một sự VẮNG MẶT, nên phải chứng minh feature được cổng nhìn thấy trước đã: $out"
-  printf '%s\n' "$out" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    && fail fork-undeclared "feature không khai paths, ngoài diff PR, vẫn bị báo stale — fork đã mất tác dụng bảo vệ và treadmill mở lại cho mọi feature whole-tree: $out"
-  printf '%s\n' "$out" | grep -q 'narrow staleness scope applied' \
-    && fail fork-undeclared "feature không khai paths lại được cấp narrow scope (AC-3 mệnh đề (c) của stale-scope-by-paths): $out"
-
-  # ĐỐI CHỨNG, trong cùng fixture: đưa artifact vào diff thì CHÍNH thay đổi
-  # gated đó PHẢI làm feature stale. Thiếu vế này, case trên vẫn xanh khi
-  # `src/covered/new.txt` không phải file gated chút nào — tức nó sẽ chứng minh
-  # sự im lặng bằng một thay đổi vô hại, không phải bằng fork.
-  ( cd "$d" && pr_touches_artifacts "$d" fx && git add -A && git commit -q -m "artifact touch" )
-  ctl="$(bash "$GATE" "$d" --base "$base" 2>&1)"
-  printf '%s\n' "$ctl" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail fork-undeclared "đối chứng thất bại: cùng thay đổi đó KHÔNG làm feature stale kể cả khi artifact nằm trong diff, nên sự im lặng ở trên không chứng minh được gì về fork: $ctl"
-  pass fork-undeclared
-}
-
-case_fork_declared_in_union() {
-  # E5 / AC-4 — nửa should-fire, đối xứng với case_out_of_scope. Feature khai
-  # ĐỦ `paths`, `_acceptance/fx/` NGOÀI diff PR (nên fork thu hẹp vẫn cho nó vào
-  # khối, và cross-check không chạy — AC-7 vế 1), và file đổi nằm TRONG union.
-  # Thiếu case này thì "thu hẹp fork" có thể thoái hoá thành "không bao giờ
-  # stale" mà out-of-scope, announce và fork-undeclared vẫn xanh hết.
-  d="$(new_case_tmpdir)"
-  base="$(mk_committed_report_fixture "$d" fx narrow)"
-  ( cd "$d" && echo drift > src/covered/new.txt && git add -A && git commit -q -m drift )
-  out="$(bash "$GATE" "$d" --base "$base" 2>&1)"
-  printf '%s\n' "$out" | grep -q 'narrow staleness scope applied' \
-    || fail fork-declared-in-union "feature khai đủ paths ngoài diff KHÔNG được vào khối staleness — fork chưa thu hẹp, và AC-2 lại mất chỗ quan sát: $out"
-  printf '%s\n' "$out" | grep -qi 'do not cover' \
-    && fail fork-declared-in-union "cross-check chạy dù artifact nằm NGOÀI diff PR (AC-7 vế 1): $out"
-  printf '%s\n' "$out" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail fork-declared-in-union "file NẰM TRONG union đã khai mà không làm feature stale — narrow scope đã thoái hoá thành 'không bao giờ stale': $out"
-  printf '%s\n' "$out" | grep -q 'src/covered/new.txt' \
-    || fail fork-declared-in-union "feature bị báo stale nhưng không nêu tên file — báo stale mà không chỉ được file là không sửa được: $out"
-  pass fork-declared-in-union
-}
-
-case_undeclared() {
-  # E7 / AC-6 — item 0.8(a). AC-3 mệnh đề (a) của stale-scope-by-paths: khai
-  # ZERO `paths` + thay đổi gated thì VẪN phải báo stale. Mệnh đề này mất eval
-  # máy từ 05/08 khi E3 bị descope. Khác case_fork_undeclared ở ĐÚNG MỘT biến:
-  # ở đây `_acceptance/fx/` NẰM TRONG diff, nên khối staleness thật sự chạy.
-  d="$(new_case_tmpdir)"
-  base="$(mk_committed_report_fixture "$d" fx none)"
-  ( cd "$d" && echo drift > src/covered/new.txt && pr_touches_artifacts "$d" fx && git add -A && git commit -q -m drift )
-  out="$(bash "$GATE" "$d" --base "$base" 2>&1)"
-  printf '%s\n' "$out" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail undeclared "khai 0 paths + thay đổi gated mà KHÔNG bị báo stale — cơ chế đã thoái hoá thành 'không bao giờ stale' cho đúng nhóm chưa hề chọn tham gia: $out"
-  printf '%s\n' "$out" | grep -q 'narrow staleness scope applied' \
-    && fail undeclared "feature khai 0 paths lại được cấp narrow scope (AC-3 mệnh đề (b)+(c)): $out"
-  pass undeclared
-}
-
-case_under_declared() {
-  # E5 / AC-5: complete paths that miss part of the COVERAGE SET, with the
-  # feature's artifacts in the PR diff → refuse narrow scope and NAME the files.
-  d="$(new_case_tmpdir)"
-  mk_fixture "$d" fx narrow
-  base="$(git -C "$d" rev-parse HEAD)"
-  write_report "$d" fx "$base"
-  ( cd "$d" && echo drift > src/uncovered/new.txt \
-      && echo touched >> _acceptance/fx/run-log.jsonl \
-      && git add -A && git commit -q -m "pr" )
-  vc="$(git -C "$d" rev-parse HEAD)"
-  write_report "$d" fx "$vc"
-  ( cd "$d" && git add -A && git commit -q -m "repin" )
-  out="$(bash "$GATE" "$d" --base "$base" 2>&1)"
-  printf '%s\n' "$out" | grep -q 'src/uncovered/new.txt' \
-    || fail under-declared "uncovered file not named in output: $out"
-  printf '%s\n' "$out" | grep -qi 'not covered\|uncovered' \
-    || fail under-declared "no under-declaration message: $out"
-
-  # The SAME under-declaration in the monorepo layout ($ROOT below the git
-  # top-level). The cross-check only runs when this feature's own
-  # _acceptance/<slug>/ is in the PR diff, and that test reads `git diff
-  # --name-only` output — whose paths are top-level-relative. A
-  # top-level-anchored prefix test therefore never matches here, the
-  # cross-check silently never runs, and narrow scope is granted UNCHECKED:
-  # AC-5 and AC-7 both dead, with no eval noticing. The two layouts must give
-  # the same answer; that is the whole assertion.
-  d2="$(new_case_tmpdir)"
-  base2="$(mk_subdir_crosscheck_fixture "$d2" fx 'pkg/src/covered/**')"
-  write_report "$d2/pkg" fx "$base2"
-  ( cd "$d2" && echo drift > pkg/src/uncovered/new.txt \
-      && echo touched >> pkg/_acceptance/fx/run-log.jsonl \
-      && git add -A && git commit -q -m "pr" )
-  vc2="$(git -C "$d2" rev-parse HEAD)"
-  write_report "$d2/pkg" fx "$vc2"
-  ( cd "$d2" && git add -A && git commit -q -m "repin" )
-  out2="$(bash "$GATE" "$d2/pkg" --base "$base2" 2>&1)"
-  printf '%s\n' "$out2" | grep -qi 'not covered\|uncovered' \
-    || fail under-declared "subdir root: cross-check did not fire, narrow scope granted unchecked: $out2"
-  printf '%s\n' "$out2" | grep -qF 'pkg/src/uncovered/new.txt' \
-    || fail under-declared "subdir root: uncovered file not named in output: $out2"
-  pass under-declared
-}
-
-# ── case_merged_halves helpers ───────────────────────────────────────────────
-# E7 / AC-7 covers seven distinct sub-scenarios (A-G). They stay behind this
-# ONE case (see the KNOWN_CASES note at the top of this file for why they are
-# not split into separate --case entries), but each sub-scenario gets its own
-# helper function below so the top-level case_merged_halves body stays a short
-# list of calls instead of one long function.
-
-# merged_halves_ab — Half A: artifacts NOT in the PR diff → narrow scope, no
-# cross-check. Half B: same feature, artifacts IN the PR diff → cross-check
-# runs. Operates on the shared "$d"/"$base" globals case_merged_halves sets up
-# (Half C/D below reuse the same fixture and PR history).
-merged_halves_ab() {
-  mk_fixture "$d" fx narrow
-  vc="$(git -C "$d" rev-parse HEAD)"
-  write_report "$d" fx "$vc"
-  ( cd "$d" && git add -A && git commit -q -m report )
-  base="$(git -C "$d" rev-parse HEAD)"
-  ( cd "$d" && echo drift > src/uncovered/new.txt && git add -A && git commit -q -m "code only" )
-  outA="$(bash "$GATE" "$d" --base "$base" 2>&1)"
-  printf '%s\n' "$outA" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    && fail merged-halves "half A: narrow scope was not granted: $outA"
-  # Match the cross-check's OWN wording ("do not cover"), not a bare
-  # "uncovered" substring — half A's own drift file lives under
-  # src/uncovered/, so a path-name match would misfire on that filename
-  # inside the (unrelated) T1-escape PR-level NOTE/VIOLATION, not on
-  # whether the cross-check itself actually ran.
-  printf '%s\n' "$outA" | grep -qi 'do not cover' \
-    && fail merged-halves "half A: cross-check ran despite artifacts absent from the PR diff: $outA"
-  ( cd "$d" && echo touched >> _acceptance/fx/run-log.jsonl && git add -A && git commit -q -m "artifact touch" )
-  outB="$(bash "$GATE" "$d" --base "$base" 2>&1)"
-  printf '%s\n' "$outB" | grep -qi 'do not cover' \
-    || fail merged-halves "half B: cross-check did not run with artifacts in the PR diff: $outB"
-}
-
-# merged_halves_cd — Half C: no PR base at all. There is no coverage set to
-# cross-check the declaration against — an empty BASE_SHA must NEVER be read
-# as "declaration covers everything"; it must fall back to whole-tree
-# staleness (the working tree still carries the Half-A drift file, which sits
-# outside this feature's declared "narrow" scope) rather than silently
-# reporting OK. Half D: same as Half C but with an UNRESOLVABLE --base — must
-# fail closed at least as hard as the missing-base case, never more
-# permissively just because a ref string was supplied; since kit 1.24.0 that
-# means refusing to run (exit 2). Reuses the "$d" that
-# merged_halves_ab left behind.
-merged_halves_cd() {
-  outC="$(bash "$GATE" "$d" 2>&1)"
-  printf '%s\n' "$outC" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail merged-halves "half C: no PR base did not fall back to whole-tree staleness: $outC"
-  printf '%s\n' "$outC" | grep -q 'OK \[fx\]' \
-    && fail merged-halves "half C: no PR base wrongly reported OK: $outC"
-
-  # Since kit 1.24.0 this fails closed HARDER than Half C: instead of falling
-  # back to whole-tree staleness, the gate refuses to run at all. An operator
-  # who declared a scope the machine cannot compute gets an error, not a
-  # quieter check (kit ADR 0004 — a CI job with a mistyped base_ref used to
-  # check an empty set and report clean). What this half guards is unchanged —
-  # a bad ref must never buy narrow scope — only the mechanism moved, from
-  # "widest staleness set" to "do not run".
-  outD="$(bash "$GATE" "$d" --base bogus-ref-xyz-does-not-exist 2>&1)"; rcD=$?
-  [ "$rcD" -eq 2 ] \
-    || fail merged-halves "half D: unresolvable PR base did not exit 2 (got $rcD): $outD"
-  printf '%s\n' "$outD" | grep -q 'VIOLATION \[scope\]: base .* resolve' \
-    || fail merged-halves "half D: unresolvable PR base did not report the scope violation: $outD"
-  printf '%s\n' "$outD" | grep -q 'OK \[fx\]' \
-    && fail merged-halves "half D: unresolvable PR base wrongly reported OK: $outD"
-
-  # Half D2: a --base that DOES resolve to a real commit, but shares NO merge
-  # base with HEAD (two disjoint histories) — `git diff A...B` exits 128 in
-  # this case ("no merge base"). `2>/dev/null` alone makes that failure read
-  # as an empty, silently EMPTY diff — "no gaps found" — which used to grant
-  # narrow scope on a doubt exactly like an unresolvable ref, just with a rc
-  # instead of an empty rev-parse. Must fail closed the same way as Half D.
-  orig_branch="$(git -C "$d" symbolic-ref --short HEAD)"
-  ( cd "$d" && git checkout -q --orphan no-merge-base-branch \
-      && git rm -rf --cached . -q >/dev/null 2>&1 \
-      && echo unrelated > unrelated-history.txt && git add -A \
-      && git commit -q -m "disjoint history, no common ancestor with $orig_branch" )
-  nomb_ref="$(git -C "$d" rev-parse HEAD)"
-  ( cd "$d" && git checkout -q "$orig_branch" )
-  outD2="$(bash "$GATE" "$d" --base "$nomb_ref" 2>&1)"
-  printf '%s\n' "$outD2" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail merged-halves "half D2: a base sharing no merge base with HEAD did not fall back to whole-tree staleness: $outD2"
-  printf '%s\n' "$outD2" | grep -q 'OK \[fx\]' \
-    && fail merged-halves "half D2: a base sharing no merge base with HEAD wrongly reported OK: $outD2"
-}
-
-# assert_cross_check_isolation <label> <desc> <slug1> <slug2> — shared shape
-# behind Half E (regex-slug isolation) and Half F (trailing-slash anchoring):
-# two independently narrow-scoped features share one repo (mk_pair_fixture);
-# the PR touches ONLY slug2's artifacts, plus a code change outside declared
-# scope so a wrongly-run cross-check for slug1 would have something to flag
-# as "not covered". Asserts slug1's own cross-check does NOT fire while
-# slug2's does. Uses its own throwaway dir, torn down before returning.
-#
-# Half E: slugs "a.b" (where "." is a regex wildcard) and "axb" (a string the
-# wildcard would match against) — a slug interpolated unescaped into a grep
-# PATTERN lets "." match any character, so "^_acceptance/a.b/" would also
-# match "_acceptance/axb/". A git pathspec is a literal path, not a pattern,
-# and cannot be confused this way.
-#
-# Half F: slugs "fx" and "fx-extra" — the anchoring the old grep pattern
-# relied on (`^_acceptance/$slug/`, trailing slash) must still hold now that
-# the check uses a pathspec instead.
-assert_cross_check_isolation() {
-  ah_label="$1"; ah_desc="$2"; ah_s1="$3"; ah_s2="$4"
-  ah_dir="$(new_case_tmpdir)"
-  mk_pair_fixture "$ah_dir" "$ah_s1" "$ah_s2"
-  ah_vc="$(git -C "$ah_dir" rev-parse HEAD)"
-  write_report "$ah_dir" "$ah_s1" "$ah_vc"
-  write_report "$ah_dir" "$ah_s2" "$ah_vc"
-  ( cd "$ah_dir" && git add -A && git commit -q -m report )
-  ah_base="$(git -C "$ah_dir" rev-parse HEAD)"
-  ( cd "$ah_dir" && echo touched >> "_acceptance/$ah_s2/run-log.jsonl" && echo drift > src/uncovered/new.txt \
-      && git add -A && git commit -q -m "pr touches $ah_s2 only" )
-  ah_out="$(bash "$GATE" "$ah_dir" --base "$ah_base" 2>&1)"
-  printf '%s\n' "$ah_out" | grep -qF "NOTE [$ah_s1]: declared eval paths" \
-    && fail merged-halves "$ah_label ($ah_desc): touching only $ah_s2's artifacts tripped ${ah_s1}'s cross-check: $ah_out"
-  printf '%s\n' "$ah_out" | grep -qF "OK [$ah_s1]" \
-    || fail merged-halves "$ah_label ($ah_desc): $ah_s1 was not reported OK despite its own artifacts being untouched: $ah_out"
-  printf '%s\n' "$ah_out" | grep -qF "NOTE [$ah_s2]: declared eval paths" \
-    || fail merged-halves "$ah_label ($ah_desc): ${ah_s2}'s own cross-check did not run: $ah_out"
-}
-
-# merged_halves_g — Half G / vacuous cross-check (Task 6 finding): a
-# declaration whose globs match NO tracked file must never earn narrow scope
-# permanently just because the PR that introduces it happens to touch nothing
-# but its own _acceptance/<slug>/ — an empty coverage set makes scope_gaps()
-# pass VACUOUSLY (nothing in the diff to flag as "not covered"), so without a
-# separate match-nothing check the declaration is accepted once and then
-# silently hides every future change forever, because every later PR that
-# changes real code without touching _acceptance/<slug>/ skips the
-# cross-check entirely and stale_files() scoped to a match-nothing glob
-# filters the real change straight out.
-merged_halves_g() {
-  h="$(new_case_tmpdir)"
-  mkdir -p "$h/src/covered" "$h/_acceptance"
-  git_init_fixture_repo "$h"
-  write_config "$h"
-  ( cd "$h" && echo seed > src/covered/seed.txt && git add -A && git commit -q -m "repo base, no feature yet" )
-  hbase0="$(git -C "$h" rev-parse HEAD)"
-
-  mkdir -p "$h/_acceptance/fx"
-  write_contract "$h" fx
-  # Match-nothing declaration: "nonexistent-dir/**" cannot match anything
-  # tracked in this fixture repo (only src/covered/** and _acceptance/** exist).
-  write_evals_yaml "$h" fx '    paths: ["nonexistent-dir/**"]' '    paths: ["nonexistent-dir/**"]'
-  echo '{}' > "$h/_acceptance/fx/run-log.jsonl"
-  ( cd "$h" && git add -A && git commit -q -m "introduce fx with match-nothing paths" )
-  hvc="$(git -C "$h" rev-parse HEAD)"
-  write_report "$h" fx "$hvc"
-  ( cd "$h" && git add -A && git commit -q -m "evidence report" )
-  hpr1="$(git -C "$h" rev-parse HEAD)"
-
-  # PR1: base is BEFORE fx existed at all — the coverage set (hbase0...HEAD)
-  # is only _acceptance/fx/* (excluded from scope_gaps by construction), so
-  # it is empty. Post-fix: an empty coverage set at the moment the
-  # declaration is introduced is refused outright (its own NOTE), rather than
-  # passing the cross-check vacuously and being silently granted — the
-  # feature must still report OK (nothing gated changed in this PR either
-  # way), but the "narrow scope applied" wording must NOT appear, because no
-  # scope was actually granted.
-  outG1="$(bash "$GATE" "$h" --base "$hbase0" 2>&1)"
-  printf '%s\n' "$outG1" | grep -q 'OK \[fx\]' \
-    || fail merged-halves "half G: vacuous-pass setup: PR introducing a match-nothing declaration was not reported OK: $outG1"
-  printf '%s\n' "$outG1" | grep -qF 'NOTE [fx]: this PR'"'"'s gated coverage set is empty' \
-    || fail merged-halves "half G: empty coverage set at declaration time was not refused with the dedicated NOTE: $outG1"
-  printf '%s\n' "$outG1" | grep -q 'narrow staleness scope applied' \
-    && fail merged-halves "half G: an empty-coverage-set declaration was still announced as a GRANTED narrow scope: $outG1"
-
-  # PR2: real code change, feature artifacts UNTOUCHED — the cross-check does
-  # not even run here (declaration unchanged since hpr1), so only a guard
-  # that applies regardless of whether the cross-check ran can catch this.
-  ( cd "$h" && echo drift > src/covered/new.txt && git add -A && git commit -q -m "real code change" )
-  outG2="$(bash "$GATE" "$h" --base "$hpr1" 2>&1)"
-  printf '%s\n' "$outG2" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail merged-halves "half G: match-nothing declaration hid a later real code change from staleness: $outG2"
-  printf '%s\n' "$outG2" | grep -q 'src/covered/new.txt' \
-    || fail merged-halves "half G: match-nothing declaration: stale file not named: $outG2"
-}
-
-# merged_halves_h — Half H / the CRITICAL finding this round closes: unlike
-# Half G above (a match-nothing declaration, already caught independently by
-# scope_has_any_match), this uses a REAL declaration whose globs DO match
-# tracked files elsewhere in the repo ("src/covered/**") — isolating the
-# defect from that other guard. The PR that introduces fx touches nothing
-# gated besides its own _acceptance/fx/ (an honest "just wiring up the
-# feature" commit), so the coverage set is empty and the cross-check used to
-# pass VACUOUSLY, silently granting narrow scope to a declaration that was
-# NEVER actually checked against anything. Post-fix this must be refused with
-# its own NOTE at THIS PR's own gate run.
-#
-# A SEPARATE, later PR that changes real code outside the declared union
-# WITHOUT touching _acceptance/fx again does NOT retrigger the cross-check —
-# by design (AC-7: re-running it against every unrelated PR's diff would
-# refuse narrow scope for every already-merged feature forever). That is a
-# real, acknowledged residual (see contract.md "Known limits"), not something
-# this fix claims to close — pinned here as a boundary on AC-7, not a defect.
-merged_halves_h() {
-  hh="$(new_case_tmpdir)"
-  mkdir -p "$hh/src/covered" "$hh/src/other" "$hh/_acceptance"
-  git_init_fixture_repo "$hh"
-  write_config "$hh"
-  ( cd "$hh" && echo seed > src/covered/seed.txt && echo seed > src/other/seed.txt \
-      && git add -A && git commit -q -m "repo base, no feature yet" )
-  hhbase0="$(git -C "$hh" rev-parse HEAD)"
-
-  mkdir -p "$hh/_acceptance/fx"
-  write_contract "$hh" fx
-  # Real, matching declaration — deliberately NOT match-nothing, to isolate
-  # this from scope_has_any_match's guard.
-  write_evals_yaml "$hh" fx '    paths: ["src/covered/**"]' '    paths: ["src/covered/**"]'
-  echo '{}' > "$hh/_acceptance/fx/run-log.jsonl"
-  ( cd "$hh" && git add -A && git commit -q -m "introduce fx with a real, matching declaration, nothing else" )
-  hhvc="$(git -C "$hh" rev-parse HEAD)"
-  write_report "$hh" fx "$hhvc"
-  ( cd "$hh" && git add -A && git commit -q -m "evidence report" )
-  hhpr1="$(git -C "$hh" rev-parse HEAD)"
-
-  # PR1 (the declaring PR): coverage set (hhbase0...HEAD) is only
-  # _acceptance/fx/* — empty. Must be refused, not silently granted.
-  outH1="$(bash "$GATE" "$hh" --base "$hhbase0" 2>&1)"
-  printf '%s\n' "$outH1" | grep -q 'OK \[fx\]' \
-    || fail merged-halves "half H: declaring PR was not reported OK: $outH1"
-  printf '%s\n' "$outH1" | grep -qF 'NOTE [fx]: this PR'"'"'s gated coverage set is empty' \
-    || fail merged-halves "half H: a real, matching declaration introduced with an empty coverage set was not refused: $outH1"
-  printf '%s\n' "$outH1" | grep -q 'narrow staleness scope applied' \
-    && fail merged-halves "half H: a declaration never actually cross-checked was still announced as a GRANTED narrow scope: $outH1"
-
-  # PR2: real code OUTSIDE the declared union, artifacts left untouched — the
-  # acknowledged residual. Documented, not asserted as fixed: the cross-check
-  # correctly does NOT run (AC-7), so this still reports OK. If a future
-  # change makes this start failing, that is AC-7 being violated (the
-  # cross-check running against every unrelated PR), not a bug being
-  # reintroduced — check contract.md "Known limits" before touching this.
-  ( cd "$hh" && echo drift > src/other/new.txt && git add -A && git commit -q -m "real code outside declared paths" )
-  outH2="$(bash "$GATE" "$hh" --base "$hhpr1" 2>&1)"
-  printf '%s\n' "$outH2" | grep -qi 'do not cover' \
-    && fail merged-halves "half H: cross-check ran for a PR that never touched _acceptance/fx — AC-7 regressed: $outH2"
-}
-
-case_merged_halves() {
-  # E7 / AC-7: cross-check fires only when the declaration is new or changed.
-  d="$(new_case_tmpdir)"
-  merged_halves_ab
-  merged_halves_cd
-  assert_cross_check_isolation "half E" "regex-slug" a.b axb
-  assert_cross_check_isolation "half F" "trailing-slash" fx fx-extra
-  merged_halves_h
-  merged_halves_g
-  pass merged-halves
-}
-
-case_two_bases() {
-  # E12 / AC-12: the fixture that tells the two ranges apart. paths cover the
-  # COVERAGE SET but NOT everything changed since verified_commit. Cross-checked
-  # against the per-feature range instead, no honest declaration ever covers it
-  # and narrow scope is refused for every merged feature forever.
-  d="$(new_case_tmpdir)"
-  mk_fixture "$d" fx narrow
-  vc="$(git -C "$d" rev-parse HEAD)"
-  write_report "$d" fx "$vc"
-  ( cd "$d" && git add -A && git commit -q -m report )
-  # Unrelated history AFTER verified_commit and BEFORE the PR base.
-  ( cd "$d" && echo old > src/uncovered/unrelated.txt && git add -A && git commit -q -m "unrelated merge" )
-  base="$(git -C "$d" rev-parse HEAD)"
-  # The PR itself touches only covered code plus the feature's artifacts.
-  ( cd "$d" && echo new > src/covered/pr.txt \
-      && echo touched >> _acceptance/fx/run-log.jsonl \
-      && git add -A && git commit -q -m pr )
-  out="$(bash "$GATE" "$d" --base "$base" 2>&1)"
-  printf '%s\n' "$out" | grep -q 'src/uncovered/unrelated.txt' \
-    && fail two-bases "cross-check used the per-feature range, not the coverage set: $out"
-  # Match the cross-check's OWN wording ("do not cover"), not a bare
-  # "uncovered" substring — this fixture's src/uncovered/unrelated.txt (seeded
-  # above) would otherwise satisfy a path-name match on its own filename,
-  # independent of whether the cross-check actually refused narrow scope.
-  printf '%s\n' "$out" | grep -qi 'do not cover' \
-    && fail two-bases "narrow scope refused although the coverage set is covered: $out"
-  pass two-bases
-}
-case_mutation() { run_mutation_case; } # E9/AC-9 — real body (incl. sed patches + assertions) is run_mutation_case() in fixtures.sh, moved there only for this file's 800-line cap
-usage() { echo "usage: $0 --case <$(echo "$KNOWN_CASES" | tr ' ' '|')>" >&2; exit 2; }
-
-CASE=""
-while [ $# -gt 0 ]; do
-  case "$1" in
-    --case) [ $# -ge 2 ] || usage; CASE="$2"; shift 2 ;;
-    *) usage ;;
-  esac
-done
-[ -n "$CASE" ] || usage
-
-known=0
-for c in $KNOWN_CASES; do [ "$c" = "$CASE" ] && known=1; done
-[ "$known" -eq 1 ] || { echo "unknown case: $CASE" >&2; exit 2; }
-
-"case_$(printf '%s' "$CASE" | tr '-' '_')"
diff --git a/scripts/acceptance/check-t1-escape-path.sh b/scripts/acceptance/check-t1-escape-path.sh
deleted file mode 100755
index 2879bcf9..00000000
--- a/scripts/acceptance/check-t1-escape-path.sh
+++ /dev/null
@@ -1,101 +0,0 @@
-#!/usr/bin/env bash
-# E1 / AC-1 of gate-tooling-t1 — there must be a legal way to change a guard.
-#
-# risk_tiers.t1_skip_globs exempts the vendored gate tooling by EXACT path
-# (scripts/pre-merge-check.sh, scripts/recheck-evidence.*, lib/*.cjs). The eight
-# guards this repo writes itself under scripts/acceptance/** are NOT on that
-# list — deliberately, because the gate must apply to changes in what the gate
-# measures (AC-11 of stale-scope-by-paths). The consequence is that a PR
-# touching only those guards trips the T1-escape backstop unless it carries
-# acceptance artifacts. That is the intended door, and this guard pins that the
-# door both OPENS and STAYS SHUT.
-#
-# MEASURED ON A FIXTURE, NEVER ON THIS BRANCH. Running the gate against the
-# current checkout would make the result a property of whatever the branch
-# happens to touch today — the exact mistake that made the deleted stale-golden
-# guard unmaintainable (it froze a branch-shaped verdict and called it
-# behaviour). The fixture below owns its own repo, its own config and its own
-# base, so the answer is the same on every branch and every machine.
-#
-# THE TWO HALVES run against ONE fixture, in order, so the deciding variable is
-# visibly the artifacts and nothing else:
-#   B (should-fire)     PR changes only scripts/acceptance/<guard>.sh  → VIOLATION
-#   A (should-NOT-fire) same PR plus an _acceptance/ artifact touch    → no VIOLATION
-set -euo pipefail
-HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-ROOT="$(cd "$HERE/../.." && pwd)"
-GATE="$ROOT/scripts/pre-merge-check.sh"
-. "$HERE/fixtures.sh"
-WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT
-ESCAPE='VIOLATION \[PR\]: non-T1 files changed'
-GUARD_REL=scripts/acceptance/check-fixture-guard.sh
-fails=0
-
-echo "check-t1-escape-path:"
-
-d="$WORK/fx"
-mkdir -p "$d"
-mk_fixture "$d" fx narrow
-vc="$(git -C "$d" rev-parse HEAD)"
-write_report "$d" fx "$vc"
-( cd "$d" && git add -A && git commit -q -m report )
-base="$(git -C "$d" rev-parse HEAD)"
-
-# The PR: a repo-authored guard changes. Nothing else.
-mkdir -p "$d/scripts/acceptance"
-printf '#!/usr/bin/env bash\necho guard\n' > "$d/$GUARD_REL"
-( cd "$d" && git add -A && git commit -q -m "change a repo-authored guard" )
-
-# ── Anti-vacuous layer ──────────────────────────────────────────────────────
-# Both halves below are about a gated file being present in the diff. If it is
-# not, half A passes because nothing gated changed at all — a green that says
-# nothing. Assert the diff shape directly rather than trusting the setup.
-in_diff() { git -C "$d" diff --name-only "$base...HEAD" | grep -qx "$1"; }
-if ! in_diff "$GUARD_REL"; then
-  echo "FAIL anti-vacuous: $GUARD_REL is not in the fixture PR diff — neither half would mean anything"
-  exit 1
-fi
-# And the fixture's own config must really treat that path as non-T1, or half B
-# fails for a reason that has nothing to do with the backstop.
-if grep -qE '^\s+- "scripts' "$d/_acceptance/config.yaml"; then
-  echo "FAIL anti-vacuous: the fixture config exempts scripts/** — half B could not fire for the intended reason"
-  exit 1
-fi
-echo "  ok   anti-vacuous: guard file in the PR diff, and non-T1 in the fixture config"
-
-run_gate() { bash "$GATE" "$d" --base "$base" 2>&1 || true; }
-
-# ── Half B — should FIRE ────────────────────────────────────────────────────
-outB="$(run_gate)"
-if ! printf '%s\n' "$outB" | grep -q 'pre-merge-check:'; then
-  echo "  FAIL [half B] the gate produced no summary line — it did not run, so its silence proves nothing"
-  fails=$((fails+1))
-elif printf '%s\n' "$outB" | grep -q "$ESCAPE"; then
-  echo "  ok   [half B] a guard-only PR with no acceptance artifacts trips the T1-escape backstop"
-else
-  echo "  FAIL [half B] a PR changing only $GUARD_REL did NOT trip the T1-escape backstop — the door is unguarded, and any guard can be changed with no acceptance artifact at all"
-  fails=$((fails+1))
-fi
-
-# ── Half A — must NOT fire ──────────────────────────────────────────────────
-# Same PR, one artifact added. `_acceptance/**` is excluded from every staleness
-# set, so this changes nothing except whether the PR carries gate artifacts.
-( cd "$d" && echo touched >> _acceptance/fx/run-log.jsonl && git add -A && git commit -q -m "carry acceptance artifacts" )
-if ! in_diff "$GUARD_REL"; then
-  echo "  FAIL [half A] the guard change fell out of the diff — half A would pass because nothing gated changed"
-  fails=$((fails+1))
-else
-  outA="$(run_gate)"
-  if ! printf '%s\n' "$outA" | grep -q 'pre-merge-check:'; then
-    echo "  FAIL [half A] the gate produced no summary line — it did not run"
-    fails=$((fails+1))
-  elif printf '%s\n' "$outA" | grep -q "$ESCAPE"; then
-    echo "  FAIL [half A] the PR carries acceptance artifacts and STILL trips the T1-escape backstop — there is then no legal way to change a guard at all, which is the debt this contract exists to pay"
-    fails=$((fails+1))
-  else
-    echo "  ok   [half A] the same PR carrying acceptance artifacts passes the backstop"
-  fi
-fi
-
-[ "$fails" -eq 0 ] || { echo "FAIL: $fails half/halves of the T1-escape door misbehaved"; exit 1; }
-echo "OK: changing a repo-authored guard is legal with acceptance artifacts and blocked without them"
diff --git a/scripts/acceptance/fixtures.sh b/scripts/acceptance/fixtures.sh
deleted file mode 100644
index cc05adb5..00000000
--- a/scripts/acceptance/fixtures.sh
+++ /dev/null
@@ -1,839 +0,0 @@
-#!/usr/bin/env bash
-# Fixture-construction helpers for scripts/acceptance/check-stale-scoping.sh
-# — PLUS two full case bodies:
-#   - run_mutation_case() (backing case_mutation / E9 / AC-9), complete with
-#     its perturbation sed patches and every assertion `--case mutation` makes.
-#   - run_indent_drift_case() (backing case_indent_drift / E-indent-drift /
-#     AC-6), the 27 assertions pinning every YAML shape feature_scope() must
-#     refuse or accept (indentation drift, block-scalar decoys, multi-line
-#     arrays, quoting variants, bracket-class globs, trailing comments/junk).
-# Neither is a thin wrapper hiding here — each is the actual substance of its
-# case. They live in this file, rather than beside the other case_* functions
-# in check-stale-scoping.sh, purely because that file was already sitting at
-# this repo's 800-line-per-file cap (CLAUDE.md) when each was added. See
-# case_mutation()'s and case_indent_drift()'s own comments in that file for
-# the pointer back to here.
-#
-# Everything else in this file — write_config, write_contract,
-# write_evals_yaml, mk_fixture, mk_pair_fixture, mk_committed_report_fixture,
-# run_gate_with_drift, and the new_case_tmpdir/cleanup_case_tmpdirs pair
-# below — is ordinary fixture construction with no case_* entry points and
-# no CLI of its own; it is only ever sourced.
-#
-# check-stale-scoping.sh sources this via `. "$HERE/fixtures.sh"`, where HERE
-# is resolved with `cd "$(dirname "$0")"` — that cd-based resolution already
-# makes the source path independent of the caller's working directory. This
-# file mirrors that same cd-based approach for its OWN directory, in case a
-# future helper here needs to reference a sibling path (e.g. under
-# scripts/acceptance/fixtures/), so robustness survives regardless of which
-# file ends up doing the resolving.
-set -u
-FIXTURES_HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-
-# ── Temp-directory tracking ─────────────────────────────────────────────────
-# Every case_* in check-stale-scoping.sh builds one or more throwaway fixture
-# repos under mktemp -d. fail() calls `exit`, which bypasses a per-function
-# `trap ... RETURN` — so any case that fails via fail() used to leave its
-# directories behind. Routing every `mktemp -d` through new_case_tmpdir()
-# instead records the path in a registry FILE (see below); check-stale-
-# scoping.sh installs ONE script-level `trap cleanup_case_tmpdirs EXIT`, so
-# cleanup runs on the pass path, the fail() exit path, and an interrupt
-# (INT/TERM, which also reach EXIT in bash) alike — regardless of which case
-# or helper created the dir.
-#
-# A registry FILE, not a shell variable, is required here: every call site is
-# `d="$(new_case_tmpdir)"`, and bash runs the right-hand side of `$(...)` in a
-# subshell — a subshell mutating a global variable does not propagate that
-# mutation back to the parent shell once the subshell exits, so an in-memory
-# list would silently discard every recorded path. Appending to a file is a
-# real filesystem write, which does survive the subshell exiting.
-CASE_TMPDIR_REGISTRY="$(mktemp)"
-
-# new_case_tmpdir — mktemp -d wrapper: creates the directory, appends it to
-# CASE_TMPDIR_REGISTRY for the caller's script-level EXIT trap, and echoes
-# the path — same call shape as `d="$(mktemp -d)"`, so every existing call
-# site is a drop-in `d="$(new_case_tmpdir)"` replacement.
-new_case_tmpdir() {
-  nct_dir="$(mktemp -d)"
-  printf '%s\n' "$nct_dir" >> "$CASE_TMPDIR_REGISTRY"
-  printf '%s\n' "$nct_dir"
-}
-
-# cleanup_case_tmpdirs — remove every directory new_case_tmpdir has recorded
-# so far, then the registry file itself. Meant to be installed once as
-# `trap cleanup_case_tmpdirs EXIT` by the caller script, not called directly
-# by any case.
-cleanup_case_tmpdirs() {
-  if [ -f "$CASE_TMPDIR_REGISTRY" ]; then
-    while IFS= read -r ctr_dir; do
-      [ -n "$ctr_dir" ] && rm -rf "$ctr_dir"
-    done < "$CASE_TMPDIR_REGISTRY"
-    rm -f "$CASE_TMPDIR_REGISTRY"
-  fi
-}
-
-# assert_cases_wired_in_config <config.yaml-path> — for every name in
-# KNOWN_CASES (check-stale-scoping.sh global), checks that a literal
-# `--case <name>` string appears in the given _acceptance/config.yaml.
-# Prints the space-prefixed list of any case names not found there (empty
-# string if all are wired). A case function can exist and still never run
-# anywhere — exactly what happened to indent-drift, which shipped a working
-# case_indent_drift() with no executors.script key pointing `--case
-# indent-drift` at it — so this is what case_case_completeness (in
-# check-stale-scoping.sh) uses to catch that class of gap. Moved here purely
-# for that file's 800-line cap.
-assert_cases_wired_in_config() {
-  acw_cfg="$1"
-  acw_missing=""
-  for acw_c in $KNOWN_CASES; do
-    grep -qE -- "--case ${acw_c}([[:space:]]|\$)" "$acw_cfg" 2>/dev/null \
-      || acw_missing="$acw_missing $acw_c"
-  done
-  printf '%s' "$acw_missing"
-}
-
-# write_config <dir> — canonical _acceptance/config.yaml fixture content: the
-# same risk_tiers/executors/signoff shape every fixture in this guard needs.
-# Callers must have already created "<dir>/_acceptance".
-write_config() {
-  cat > "$1/_acceptance/config.yaml" <<CFG
-schema_version: 1
-enforcement: strict
-recheck: off
-executors:
-  test:
-    unit: "true"
-risk_tiers:
-  t1_skip_globs:
-    - "docs/**"
-    - "**/*.md"
-    - "_acceptance/**"
-  t3_paths:
-    - "src/critical/**"
-signoff:
-  required_for: [T2, T3]
-CFG
-}
-
-# write_contract <dir> <slug> — canonical signed-off T2 contract fixture.
-# Callers must have already created "<dir>/_acceptance/<slug>".
-write_contract() {
-  cat > "$1/_acceptance/$2/contract.md" <<CON
----
-schema_version: 1
-feature: fixture
-slug: $2
-risk_tier: T2
-status: signed-off
-approved_by: Fixture
----
-# Acceptance Contract: $2
-CON
-}
-
-# write_evals_yaml <dir> <slug> <p1-line> <p2-line> — a two-eval evals.yaml
-# (E1/AC-1, E2/AC-2, both `executor: test` / `cmd: config:executors.test.unit`).
-# p1/p2 are complete "    paths: [...]" lines inserted verbatim into E1/E2
-# respectively, or "" to leave that eval with no `paths` key at all.
-write_evals_yaml() {
-  {
-    echo "schema_version: 1"
-    echo "feature_slug: $2"
-    echo "evals:"
-    echo "  - id: E1"
-    echo "    criterion: AC-1"
-    echo "    executor: test"
-    echo "    cmd: config:executors.test.unit"
-    [ -n "$3" ] && echo "$3"
-    echo "  - id: E2"
-    echo "    criterion: AC-2"
-    echo "    executor: test"
-    echo "    cmd: config:executors.test.unit"
-    [ -n "$4" ] && echo "$4"
-    # Optional $5: content appended AFTER the evals list — for shapes that put
-    # a `paths:` key outside any eval item.
-    [ -n "${5:-}" ] && echo "$5"
-    :
-  } > "$1/_acceptance/$2/evals.yaml"
-}
-
-# git_init_fixture_repo <dir> — init a throwaway git repo with a fixed
-# fixture identity, no commit (callers add files then commit themselves).
-git_init_fixture_repo() {
-  (
-    cd "$1"
-    git init -q .
-    git config user.email fixture@example.com
-    git config user.name Fixture
-  )
-}
-
-# mk_fixture <dir> <slug> <paths-mode>
-# Builds a throwaway git repo with one signed feature. paths-mode:
-#   all      — every eval declares paths covering src/covered/**
-#   none     — no eval declares paths
-#   partial  — first eval declares, second does not
-#   empty    — every eval declares `paths: []`
-#   narrow   — every eval declares paths that do NOT cover src/uncovered/**
-mk_fixture() {
-  d="$1"; slug="$2"; mode="$3"
-  mkdir -p "$d/_acceptance/$slug" "$d/src/covered" "$d/src/uncovered" "$d/docs"
-  write_config "$d"
-  write_contract "$d" "$slug"
-  # Reset before the case: this file has no `local`, so a value set by one
-  # mode's branch would otherwise survive into the NEXT mk_fixture call and
-  # silently append a trailer to an unrelated fixture (see mk_pair_fixture's
-  # note on the same hazard).
-  trailer=""
-  case "$mode" in
-    none)    p1=""; p2="" ;;
-    partial) p1='    paths: ["src/covered/**"]'; p2="" ;;
-    empty)   p1='    paths: []'; p2='    paths: []' ;;
-    narrow)  p1='    paths: ["src/covered/**"]'; p2='    paths: ["src/covered/**"]' ;;
-    # Two paths lines on the FIRST eval, none on the second: a copy-paste
-    # duplicate. The file-wide totals still balance (2 evals, 2 paths lines),
-    # so any completeness test that compares counts rather than distribution
-    # reads this partial declaration as complete.
-    dup)     p1='    paths: ["src/covered/**"]
-    paths: ["src/uncovered/**"]'; p2="" ;;
-    # E2 declares NOTHING; a `paths:` key sits at the eval-key column in an
-    # unrelated mapping BELOW the evals list. Totals balance again (2 evals,
-    # 2 paths lines), and "nearest `- id:` above" hands the stray key to E2 —
-    # so the union silently gains a glob no eval ever declared.
-    stray)   p1='    paths: ["src/covered/**"]'; p2=""
-             trailer='misc:
-  sub:
-    paths: ["docs/**"]' ;;
-    all|*)   p1='    paths: ["src/covered/**"]'; p2='    paths: ["src/covered/**", "src/uncovered/**"]' ;;
-  esac
-  write_evals_yaml "$d" "$slug" "$p1" "$p2" "${trailer:-}"
-  echo '{}' > "$d/_acceptance/$slug/run-log.jsonl"
-  git_init_fixture_repo "$d"
-  (
-    cd "$d"
-    echo seed > src/covered/seed.txt
-    echo seed > src/uncovered/seed.txt
-    git add -A
-    git commit -q -m "fixture base"
-  )
-}
-
-# write_report <dir> <slug> <verified_commit>
-write_report() {
-  cat > "$1/_acceptance/$2/evidence-report.md" <<REP
----
-schema_version: 2
-feature_slug: $2
-verdict: PASS
-failed_evals: []
-verified_by: fixture
-enforcement_mode: strict
-bypass_used: false
-verified_commit: $3
-human_signoff: Fixture 2026-07-28
----
-# Evidence Report: $2
-REP
-}
-
-# pr_touches_artifacts <dir> <slug> — append a byte to the feature's run-log so
-# the PR commit the caller is about to make includes `_acceptance/<slug>/`.
-#
-# Required since the STALE-DIFF-SCOPE-GUARD fork (97b5b12): the gate skips the
-# WHOLE staleness block — verdict, narrow scope and its announcement alike —
-# for any feature whose own `_acceptance/<slug>/` is outside the PR diff. A
-# fixture that leaves the artifacts out of the diff therefore asserts against
-# silence, and passes or fails for reasons unrelated to what it set out to
-# measure. run-log.jsonl is the cheapest carrier: `_acceptance/**` is excluded
-# from every staleness set (AC-8), so this puts the slug in the diff WITHOUT
-# contributing a stale file of its own.
-#
-# Note for the caller: putting the artifacts in the diff also switches the
-# Task-6 cross-check ON (AC-7). Under this fork the two are welded together —
-# "examined but not cross-checked" is no longer an expressible shape — so a
-# case that needs a granted narrow scope must also keep the PR's gated
-# coverage set inside the declared union, the way case_two_bases does.
-pr_touches_artifacts() {
-  echo touched >> "$1/_acceptance/$2/run-log.jsonl"
-}
-
-# mk_committed_report_fixture <dir> <slug> <paths-mode> — mk_fixture() plus a
-# report committed in its OWN commit (prints the post-report commit SHA on
-# stdout, for the caller's --base). Any case that needs "this feature's
-# _acceptance/<slug>/ is NOT part of the PR diff" (case_out_of_scope's shape)
-# instead of re-deriving that three-step dance inline.
-mk_committed_report_fixture() {
-  mcf_dir="$1"; mcf_slug="$2"; mcf_mode="$3"
-  mk_fixture "$mcf_dir" "$mcf_slug" "$mcf_mode"
-  mcf_vc="$(git -C "$mcf_dir" rev-parse HEAD)"
-  write_report "$mcf_dir" "$mcf_slug" "$mcf_vc"
-  ( cd "$mcf_dir" && git add -A && git commit -q -m report )
-  git -C "$mcf_dir" rev-parse HEAD
-}
-
-# mk_subdir_fixture <repo-dir> <slug> <paths-glob> — the monorepo layout: the
-# git repo is <repo-dir>, but the acceptance tree and the sources live one
-# level down in <repo-dir>/pkg, which is the root the gate is pointed at. Every
-# other fixture in this suite puts $ROOT at the git top-level, where the
-# ls-files and diff --name-only namespaces happen to coincide and a namespace
-# bug is invisible. <paths-glob> is written verbatim into both evals, so a
-# caller can declare either spelling (top-level `pkg/src/covered/**` or
-# $ROOT-relative `src/covered/**`) and assert what the gate does with it.
-#
-# Prints the post-report commit SHA on stdout, same contract as
-# mk_committed_report_fixture, so --base is taken AFTER the report and this
-# feature's own _acceptance/<slug>/ is NOT in the PR diff (no cross-check) —
-# the shape every later PR has, which is where the namespace hole opens.
-mk_subdir_fixture() {
-  sf_repo="$1"; sf_slug="$2"; sf_glob="$3"
-  mkdir -p "$sf_repo/pkg/_acceptance/$sf_slug" "$sf_repo/pkg/src/covered" "$sf_repo/pkg/src/uncovered"
-  write_config "$sf_repo/pkg"
-  write_contract "$sf_repo/pkg" "$sf_slug"
-  write_evals_yaml "$sf_repo/pkg" "$sf_slug" "    paths: [\"$sf_glob\"]" "    paths: [\"$sf_glob\"]"
-  echo '{}' > "$sf_repo/pkg/_acceptance/$sf_slug/run-log.jsonl"
-  git_init_fixture_repo "$sf_repo"
-  (
-    cd "$sf_repo"
-    echo seed > pkg/src/covered/seed.txt
-    echo seed > pkg/src/uncovered/seed.txt
-    git add -A
-    git commit -q -m "fixture base"
-  )
-  sf_vc="$(git -C "$sf_repo" rev-parse HEAD)"
-  write_report "$sf_repo/pkg" "$sf_slug" "$sf_vc"
-  ( cd "$sf_repo" && git add -A && git commit -q -m report )
-  git -C "$sf_repo" rev-parse HEAD
-}
-
-# mk_subdir_crosscheck_fixture <repo-dir> <slug> <paths-glob> — the monorepo
-# layout of mk_subdir_fixture, but staged so the feature's OWN
-# _acceptance/<slug>/ is part of the PR diff: that is the one condition under
-# which the declaration is cross-checked against the gated diff, and it is
-# exactly the condition mk_subdir_fixture deliberately excludes (it takes its
-# base AFTER the report commit).
-#
-# Prints the fixture-base SHA and stops there, leaving the report/PR/re-pin
-# staging to the caller so it can mirror case_under_declared's flat shape line
-# for line — the whole point is that the two layouts differ ONLY in where the
-# acceptance tree sits, so any divergence in the gate's answer is the bug.
-mk_subdir_crosscheck_fixture() {
-  sx_repo="$1"; sx_slug="$2"; sx_glob="$3"
-  mkdir -p "$sx_repo/pkg/_acceptance/$sx_slug" "$sx_repo/pkg/src/covered" "$sx_repo/pkg/src/uncovered"
-  write_config "$sx_repo/pkg"
-  write_contract "$sx_repo/pkg" "$sx_slug"
-  write_evals_yaml "$sx_repo/pkg" "$sx_slug" "    paths: [\"$sx_glob\"]" "    paths: [\"$sx_glob\"]"
-  echo '{}' > "$sx_repo/pkg/_acceptance/$sx_slug/run-log.jsonl"
-  git_init_fixture_repo "$sx_repo"
-  (
-    cd "$sx_repo"
-    echo seed > pkg/src/covered/seed.txt
-    echo seed > pkg/src/uncovered/seed.txt
-    git add -A
-    git commit -q -m "fixture base"
-  )
-  git -C "$sx_repo" rev-parse HEAD
-}
-
-# mk_pair_fixture <dir> <slug1> <slug2>
-# Two independently narrow-scoped features (paths cover src/covered/** only)
-# sharing ONE repo — for guards that assert one feature's cross-check cannot
-# be tripped by a change confined to the OTHER feature's artifacts (regex-slug
-# confusion, trailing-slash anchoring).
-#
-# Deliberately does NOT bind its first parameter to a variable named "d" —
-# this file has no `local`, so every parameter assignment here is a plain
-# global. A caller that still holds its own fixture dir in "$d" after calling
-# this function would have that "$d" silently clobbered by this function's
-# own reassignment of it, corrupting any use of "$d" the caller makes later.
-mk_pair_fixture() {
-  pf_dir="$1"; s1="$2"; s2="$3"
-  mkdir -p "$pf_dir/_acceptance/$s1" "$pf_dir/_acceptance/$s2" "$pf_dir/src/covered" "$pf_dir/src/uncovered"
-  write_config "$pf_dir"
-  for s in "$s1" "$s2"; do
-    write_contract "$pf_dir" "$s"
-    write_evals_yaml "$pf_dir" "$s" '    paths: ["src/covered/**"]' '    paths: ["src/covered/**"]'
-    echo '{}' > "$pf_dir/_acceptance/$s/run-log.jsonl"
-  done
-  git_init_fixture_repo "$pf_dir"
-  (
-    cd "$pf_dir"
-    echo seed > src/covered/seed.txt
-    echo seed > src/uncovered/seed.txt
-    git add -A
-    git commit -q -m "fixture base"
-  )
-}
-
-# run_gate_with_drift <gate-path> <fixture-mode> <drift-path> — build a signed
-# fx feature (mk_committed_report_fixture), commit one drifting file AFTER
-# that commit, then run <gate-path> with --base at the post-report commit —
-# the same "artifacts not in the PR diff" shape case_out_of_scope uses, so
-# Task 6's coverage cross-check never runs and never masks what the caller is
-# actually trying to observe. Echoes the gate's combined stdout+stderr.
-run_gate_with_drift() {
-  rgw_gate="$1"; rgw_mode="$2"; rgw_drift="$3"
-  rgw_shape="${4:-out-of-diff}"
-  rgw_dir="$(new_case_tmpdir)"
-  rgw_base="$(mk_committed_report_fixture "$rgw_dir" fx "$rgw_mode")"
-  # Shape matters since STALE-DIFF-SCOPE-GUARD was narrowed (2026-08-27): a
-  # feature outside the PR diff is examined only when it declares complete
-  # `paths`. A DECLARED fixture can therefore stay out-of-diff (the default,
-  # and the shape that exercises the narrow-scope path with no cross-check),
-  # while a fixture the gate treats as UNDECLARED — any `partial` mode — must
-  # pass `in-diff`, or the gate skips it and the assertion ends up measuring
-  # the fork rather than the mechanism under test.
-  if [ "$rgw_shape" = "in-diff" ]; then
-    pr_touches_artifacts "$rgw_dir" fx
-  fi
-  ( cd "$rgw_dir" && echo drift > "$rgw_drift" && git add -A && git commit -q -m drift )
-  bash "$rgw_gate" "$rgw_dir" --base "$rgw_base" 2>&1
-}
-
-# run_mutation_case — full body of check-stale-scoping.sh's case_mutation
-# (E9 / AC-9); kept here (rather than in check-stale-scoping.sh, which is
-# already at the repo's 800-line-per-file cap) purely for line budget. Relies
-# on $GATE and pass()/fail() from the caller's shell — this file is always
-# sourced into check-stale-scoping.sh, never executed standalone.
-#
-# Two mutations, each applied to a TEMP COPY of the gate — the working tree
-# is never edited and the shipped gate carries no knob (AC-13):
-#   (a) narrow scope forced to match nothing → mechanism becomes "never stale"
-#   (b) completeness forced to always pass  → mechanism becomes blind trust
-# Each perturbation is verified to have actually changed the file (cmp) — a
-# sed whose target text has moved patches nothing, the "mutation" then runs
-# the unmodified gate, and the case would pass while proving nothing.
-run_mutation_case() {
-  work="$(new_case_tmpdir)"
-  cp "$GATE" "$work/gate.sh"
-  # recheck-evidence.js is deliberately NOT copied here: every fixture this
-  # case runs through write_config() sets `recheck: off` (fixtures.sh's
-  # write_config), and pre-merge-check.sh only invokes recheck-evidence.js
-  # when RECHECK_MODE is "strict" or "warn" — never "off". A copy would sit
-  # unused in $work on every run.
-
-  # Baseline: the unpatched temp copy must reproduce the real gate's in-scope
-  # catch, or nothing below proves anything about the mutations.
-  base_out="$(run_gate_with_drift "$work/gate.sh" all src/covered/new.txt)"
-  printf '%s\n' "$base_out" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail mutation "temp copy does not reproduce the real gate: $base_out"
-
-  # (a) neutralize the scope check inside stale_files() so a set scope always
-  # "continue"s — every changed file is skipped whenever narrow scope applies,
-  # i.e. a feature with a narrow scope is never reported stale again.
-  sed 's/match_globs "\$f" "\$scope" || continue/continue/' \
-    "$work/gate.sh" > "$work/gate_a.sh"
-  cmp -s "$work/gate.sh" "$work/gate_a.sh" \
-    && fail mutation "perturbation (a) patched nothing — the sed target moved"
-  a_out="$(run_gate_with_drift "$work/gate_a.sh" all src/covered/new.txt)"
-  printf '%s\n' "$a_out" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    && fail mutation "perturbation (a) did not go RED — in-scope changes are not actually caught"
-
-  # (b) neutralize feature_scope's completeness proof: a "partial" declaration
-  # (one eval left undeclared) is then trusted as complete, scoping ONLY to
-  # what WAS declared and silently dropping the undeclared eval's implicit
-  # "everything" — drift outside that narrowed scope goes unreported.
-  #
-  # Completeness lives in TWO places since the per-eval distribution proof was
-  # added: the file-wide total, and the awk that walks each eval item. Patching
-  # only the total leaves the awk still refusing, so the mechanism does NOT
-  # break and this perturbation would silently stop testing anything — the
-  # exact vacuous-guard failure this case exists to rule out. Both sites are
-  # patched, and each is asserted to have actually matched, so a future edit
-  # that moves either one turns this case red instead of quietly weakening it.
-  sed 's/\[ "\$n_evals" -eq "\$n_paths" \] || return 1/:/' \
-    "$work/gate.sh" > "$work/gate_b0.sh"
-  cmp -s "$work/gate.sh" "$work/gate_b0.sh" \
-    && fail mutation "perturbation (b) patched nothing — the total-count sed target moved"
-  sed 's/END { if (open \&\& n != 1) bad = 1; exit (bad ? 1 : 0) }/END { exit 0 }/' \
-    "$work/gate_b0.sh" > "$work/gate_b.sh"
-  cmp -s "$work/gate_b0.sh" "$work/gate_b.sh" \
-    && fail mutation "perturbation (b) patched nothing — the per-eval awk sed target moved"
-  b_out="$(run_gate_with_drift "$work/gate_b.sh" partial src/uncovered/new.txt)"
-  printf '%s\n' "$b_out" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    && fail mutation "perturbation (b) did not go RED — a partial declaration is trusted"
-
-  # Revert: the unpatched copy is green again on both shapes.
-  r1="$(run_gate_with_drift "$work/gate.sh" all src/covered/new.txt)"
-  printf '%s\n' "$r1" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail mutation "revert: in-scope change no longer caught"
-  # Unpatched + `partial` = treated as UNDECLARED, so the narrowed fork skips it
-  # out-of-diff; in-diff is what makes the whole-tree fallback observable here.
-  r2="$(run_gate_with_drift "$work/gate.sh" partial src/uncovered/new.txt in-diff)"
-  printf '%s\n' "$r2" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail mutation "revert: partial declaration no longer falls back"
-  pass mutation
-}
-
-# run_indent_drift_case — full body of check-stale-scoping.sh's
-# case_indent_drift (E-indent-drift / AC-6); kept here (rather than in
-# check-stale-scoping.sh, which is already at the repo's 800-line-per-file
-# cap) purely for line budget. Relies on $GATE and pass()/fail() from the
-# caller's shell — this file is always sourced into check-stale-scoping.sh,
-# never executed standalone.
-run_indent_drift_case() {
-  # E-indent-drift: an eval whose leading whitespace drifts from the canonical
-  # 2/4-space indent (an ordinary typo, or a literal tab) must not become
-  # invisible to BOTH feature_scope() counters at once — that lets n_evals and
-  # n_paths coincide by accident, feature_scope returns 0 ("complete"), and the
-  # drifted eval's total absence of a `paths` declaration goes unnoticed.
-  #
-  # Reuse feature_scope() from the gate instead of hand-rolling a second
-  # parser, the same way case_guard_not_exempt reuses match_globs(): a private
-  # copy would silently drift from what the gate actually does. Extracting
-  # only the function body (not sourcing/executing the whole gate script,
-  # which has side effects and calls exit) keeps this guard tested against the
-  # exact parser the gate ships.
-  feature_scope_src="$(sed -n '/^feature_scope()/,/^}/p' "$GATE")"
-  [ -n "$feature_scope_src" ] || fail indent-drift "could not extract feature_scope() from $GATE"
-  eval "$feature_scope_src"
-
-  d="$(new_case_tmpdir)"
-
-  # Space-drift variant: E1 canonically indented and declares paths; E2
-  # drifted to a 3-space "- id:" / "criterion:" pair and declares none.
-  cat > "$d/space-drift.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    paths: ["src/covered/**"]
-   - id: E2
-     criterion: AC-2
-YAML
-  out="$(feature_scope "$d/space-drift.yaml")"; rc=$?
-  [ "$rc" -ne 0 ] \
-    || fail indent-drift "space-drifted eval was invisible to both counters — feature_scope returned 0 (globs: $out)"
-
-  # Tab-drift variant: same shape, drifted line prefixed with a literal tab
-  # instead of an odd space count.
-  printf 'schema_version: 1\nfeature_slug: fx\nevals:\n  - id: E1\n    paths: ["src/covered/**"]\n\t- id: E2\n\tcriterion: AC-2\n' \
-    > "$d/tab-drift.yaml"
-  out="$(feature_scope "$d/tab-drift.yaml")"; rc=$?
-  [ "$rc" -ne 0 ] \
-    || fail indent-drift "tab-drifted eval was invisible to both counters — feature_scope returned 0 (globs: $out)"
-
-  # Block-scalar decoy: E2 declares no `paths`, but its `expected: |` block
-  # scalar contains a prose line that reads "paths: [...]" at the SAME
-  # indentation an eval-level declaration would use. A parser that counts
-  # `paths:` occurrences without excluding block-scalar bodies mistakes that
-  # prose for a declaration and folds its glob into the union.
-  cat > "$d/block-scalar-decoy.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    criterion: AC-1
-    paths: ["src/covered/**"]
-  - id: E2
-    criterion: AC-2
-    expected: |
-    exit 0; decoy prose at eval-key indentation:
-    paths: ["src/decoy/**"]
-    must not be read as a declaration
-YAML
-  out="$(feature_scope "$d/block-scalar-decoy.yaml")"; rc=$?
-  [ "$rc" -ne 0 ] \
-    || fail indent-drift "block-scalar decoy 'paths:' prose was counted as a declaration — feature_scope returned 0 (globs: $out)"
-
-  # Top-level-key decoy: a feature-level `paths:` key that is a sibling of
-  # `evals:` (not under any eval item) must not be counted toward
-  # completeness or joined into the union — E2 below declares no `paths` of
-  # its own.
-  cat > "$d/toplevel-key-decoy.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-paths: ["src/decoy/**"]
-evals:
-  - id: E1
-    criterion: AC-1
-    paths: ["src/covered/**"]
-  - id: E2
-    criterion: AC-2
-YAML
-  out="$(feature_scope "$d/toplevel-key-decoy.yaml")"; rc=$?
-  [ "$rc" -ne 0 ] \
-    || fail indent-drift "feature-level top-level 'paths:' key was counted as an eval declaration — feature_scope returned 0 (globs: $out)"
-
-  # Multi-line array: E2's `paths:` opens a bracket array but its globs
-  # continue on following lines, closing on a THIRD line. A line-based
-  # extractor cannot read continuation lines, so a parser that counts this
-  # opening line toward completeness (matching only the prefix, not
-  # requiring the closing `]` on the same line) reaches a false "complete"
-  # reading while contributing zero globs for E2 — the exact defect this
-  # case guards against regressing.
-  cat > "$d/multiline-array.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    criterion: AC-1
-    paths: ["src/covered/**"]
-  - id: E2
-    criterion: AC-2
-    paths: [
-      "src/extra/**",
-      "src/more/**"
-    ]
-YAML
-  out="$(feature_scope "$d/multiline-array.yaml")"; rc=$?
-  [ "$rc" -ne 0 ] \
-    || fail indent-drift "multi-line 'paths:' array was counted as a complete declaration — feature_scope returned 0 (globs: $out)"
-
-  # Same shape, but the multi-line array is the ONLY eval in the file — this
-  # used to return non-zero already, but for the wrong reason (the union
-  # came out empty, tripping the LAST-resort "zero globs" check). Assert the
-  # actual completeness check (n_evals vs n_paths) is what refuses it, not
-  # an accidental empty union: a file with a real second declared eval whose
-  # globs happened to overlap would otherwise slip through.
-  cat > "$d/multiline-array-only.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    criterion: AC-1
-    paths: [
-      "src/extra/**",
-      "src/more/**"
-    ]
-YAML
-  out="$(feature_scope "$d/multiline-array-only.yaml")"; rc=$?
-  [ "$rc" -ne 0 ] \
-    || fail indent-drift "multi-line 'paths:' array as the only eval was counted as a complete declaration — feature_scope returned 0 (globs: $out)"
-
-  # Trailing inline comment: `paths: [...] # note` must yield the clean glob
-  # with the comment stripped, not a garbage glob with "# note" appended.
-  # This is the success-path counterpart to the two cases above: the file IS
-  # a complete, single-line declaration, so feature_scope must accept it
-  # (rc 0) and the emitted union must contain no "#" fragment.
-  cat > "$d/trailing-comment.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    criterion: AC-1
-    paths: ["src/covered/**"] # note
-  - id: E2
-    criterion: AC-2
-    paths: ["src/more/**"]
-YAML
-  out="$(feature_scope "$d/trailing-comment.yaml")"; rc=$?
-  [ "$rc" -eq 0 ] \
-    || fail indent-drift "single-line 'paths:' array with a trailing comment was refused — feature_scope returned $rc"
-  printf '%s\n' "$out" | grep -q '#' \
-    && fail indent-drift "trailing comment leaked into the emitted glob union: $out"
-  printf '%s\n' "$out" | grep -qx 'src/covered/\*\*' \
-    || fail indent-drift "expected clean glob 'src/covered/**' missing from union: $out"
-
-  # Bracket-class glob: a glob containing `]` (from a character class like
-  # `foo[0-9]`) must survive intact — this is the defect that shipped four
-  # rounds in a row: `[^]]*` (or any bracket-splitting extractor) stops at the
-  # FIRST `]`, truncating the glob and dropping every sibling after it.
-  cat > "$d/bracket-glob.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    criterion: AC-1
-    paths: ["src/foo[0-9]/**", "src/bar/**"]
-  - id: E2
-    criterion: AC-2
-    paths: ["src/more/**"]
-YAML
-  out="$(feature_scope "$d/bracket-glob.yaml")"; rc=$?
-  [ "$rc" -eq 0 ] \
-    || fail indent-drift "bracket-class glob declaration was refused — feature_scope returned $rc"
-  printf '%s\n' "$out" | grep -qx 'src/foo\[0-9\]/\*\*' \
-    || fail indent-drift "bracket-class glob truncated or missing from union: $out"
-  printf '%s\n' "$out" | grep -qx 'src/bar/\*\*' \
-    || fail indent-drift "sibling glob after a bracket-class glob was dropped from union: $out"
-
-  # Single-quoted items: not the accepted grammar — refused, not tolerated.
-  cat > "$d/single-quoted.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    criterion: AC-1
-    paths: ['src/a/**']
-YAML
-  out="$(feature_scope "$d/single-quoted.yaml")"; rc=$?
-  [ "$rc" -ne 0 ] \
-    || fail indent-drift "single-quoted paths items were accepted — feature_scope returned 0 (globs: $out)"
-
-  # Nested array: not the accepted grammar — refused, not tolerated.
-  cat > "$d/nested-array.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    criterion: AC-1
-    paths: [["a"], "b"]
-YAML
-  out="$(feature_scope "$d/nested-array.yaml")"; rc=$?
-  [ "$rc" -ne 0 ] \
-    || fail indent-drift "nested array paths was accepted — feature_scope returned 0 (globs: $out)"
-
-  # Trailing non-comment suffix: anything after `]` that is not a `#`
-  # comment must be refused, not silently ignored.
-  cat > "$d/trailing-junk.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    criterion: AC-1
-    paths: ["a"] junk
-YAML
-  out="$(feature_scope "$d/trailing-junk.yaml")"; rc=$?
-  [ "$rc" -ne 0 ] \
-    || fail indent-drift "trailing non-comment suffix after ']' was accepted — feature_scope returned 0 (globs: $out)"
-
-  # Hyphenated-key block-scalar decoy: a key-name allow-list (e.g.
-  # `[a-zA-Z_]*:`) never matches `expected-output:`, so its block-scalar body
-  # is read as ordinary content and a decoy `paths:` line inside it is
-  # mistaken for a real declaration. The guard must refuse the whole file
-  # structurally (by "value starts with `|`/`>`"), regardless of the key
-  # spelling.
-  cat > "$d/hyphen-key-block-scalar.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    criterion: AC-1
-    paths: ["src/covered/**"]
-  - id: E2
-    criterion: AC-2
-    expected-output: |
-    decoy prose:
-    paths: ["src/decoy/**"]
-YAML
-  out="$(feature_scope "$d/hyphen-key-block-scalar.yaml")"; rc=$?
-  [ "$rc" -ne 0 ] \
-    || fail indent-drift "hyphenated-key ('expected-output:') block-scalar decoy was not refused — feature_scope returned 0 (globs: $out)"
-
-  # Digit-suffixed-key variant of the same bypass: `note2:` is equally
-  # outside any letter-only allow-list.
-  cat > "$d/digit-key-block-scalar.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    criterion: AC-1
-    paths: ["src/covered/**"]
-  - id: E2
-    criterion: AC-2
-    note2: |
-    decoy prose:
-    paths: ["src/decoy/**"]
-YAML
-  out="$(feature_scope "$d/digit-key-block-scalar.yaml")"; rc=$?
-  [ "$rc" -ne 0 ] \
-    || fail indent-drift "digit-suffixed-key ('note2:') block-scalar decoy was not refused — feature_scope returned 0 (globs: $out)"
-
-  # Single-line value containing `>` after the colon, but NOT as the first
-  # character of the value: must NOT be refused. This is the other direction
-  # of the same check — the block-scalar guard must key off the indicator
-  # being the START of the value, not merely present somewhere on the line.
-  cat > "$d/value-contains-gt.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    criterion: AC-1
-    expected: "exit 0; a > b"
-    paths: ["src/covered/**"]
-  - id: E2
-    criterion: AC-2
-    paths: ["src/more/**"]
-YAML
-  out="$(feature_scope "$d/value-contains-gt.yaml")"; rc=$?
-  [ "$rc" -eq 0 ] \
-    || fail indent-drift "a single-line value merely containing '>' after the colon was wrongly refused — feature_scope returned $rc"
-  printf '%s\n' "$out" | grep -qx 'src/covered/\*\*' \
-    || fail indent-drift "expected glob 'src/covered/**' missing from union: $out"
-  printf '%s\n' "$out" | grep -qx 'src/more/\*\*' \
-    || fail indent-drift "expected glob 'src/more/**' missing from union: $out"
-
-  # Colon-in-key decoy (the live Critical this round closes): a quoted key
-  # whose OWN text contains a colon (`"note: x":`) defeats an extractor that
-  # anchors the block-scalar guard on the FIRST colon in the line — it lands
-  # mid-key instead of at the key's true end, reads the rest of the line as
-  # if it were the value, and never recognizes the `|` that follows as a
-  # block-scalar indicator. The prose beneath it (including a decoy
-  # `paths:` line) then leaks straight into either counter.
-  cat > "$d/colon-in-key.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    paths: ["src/covered/**"]
-  - id: E2
-    "note: x": |
-    decoy:
-    paths: ["src/decoy/**"]
-YAML
-  out="$(feature_scope "$d/colon-in-key.yaml")"; rc=$?
-  [ "$rc" -ne 0 ] \
-    || fail indent-drift "colon-in-key decoy ('\"note: x\":') was not refused — feature_scope returned 0 (globs: $out)"
-
-  # Quoted key: not a shape this line-based parser can read reliably (is the
-  # key `expected`, or is the key `"expected"` — a different string?) — must
-  # be refused structurally, not tolerated as if unquoting were free.
-  cat > "$d/quoted-key.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    paths: ["src/covered/**"]
-  - id: E2
-    "expected": |
-    decoy prose:
-    paths: ["src/decoy/**"]
-YAML
-  out="$(feature_scope "$d/quoted-key.yaml")"; rc=$?
-  [ "$rc" -ne 0 ] \
-    || fail indent-drift "quoted key ('\"expected\":') was not refused — feature_scope returned 0 (globs: $out)"
-
-  # Key with an embedded space: `my key: |` is not `[A-Za-z_][A-Za-z0-9_-]*:`
-  # and must be refused rather than treated as some normalized key name.
-  cat > "$d/space-in-key.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    paths: ["src/covered/**"]
-  - id: E2
-    my key: |
-    decoy prose:
-    paths: ["src/decoy/**"]
-YAML
-  out="$(feature_scope "$d/space-in-key.yaml")"; rc=$?
-  [ "$rc" -ne 0 ] \
-    || fail indent-drift "key with an embedded space ('my key:') was not refused — feature_scope returned 0 (globs: $out)"
-
-  # Hyphenated key with a single-line (non-block-scalar) value: must NOT be
-  # refused. This is the positive counterpart to the key-grammar checks
-  # above — a legal, ordinary eval-level key that merely happens to be
-  # kebab-case, with every eval in the file declaring real `paths`, must
-  # still be accepted and its `paths` still joined into the union.
-  cat > "$d/hyphen-key-singleline.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    criterion: AC-1
-    extra-note: "hello"
-    paths: ["src/covered/**"]
-  - id: E2
-    criterion: AC-2
-    paths: ["src/more/**"]
-YAML
-  out="$(feature_scope "$d/hyphen-key-singleline.yaml")"; rc=$?
-  [ "$rc" -eq 0 ] \
-    || fail indent-drift "hyphenated key with a single-line value ('extra-note: \"hello\"') was wrongly refused — feature_scope returned $rc"
-  printf '%s\n' "$out" | grep -qx 'src/covered/\*\*' \
-    || fail indent-drift "expected glob 'src/covered/**' missing from union: $out"
-  printf '%s\n' "$out" | grep -qx 'src/more/\*\*' \
-    || fail indent-drift "expected glob 'src/more/**' missing from union: $out"
-
-  pass indent-drift
-}
diff --git a/scripts/acceptance/test-own-range.sh b/scripts/acceptance/test-own-range.sh
index d5806006..b770fd88 100755
--- a/scripts/acceptance/test-own-range.sh
+++ b/scripts/acceptance/test-own-range.sh
@@ -124,7 +124,10 @@ case_malformed() {
   # decoy in the body, a trailing comment, and quotes.
   printf -- '---\nslug: bad\nlanded_merge: "%s"  # PR #99\n---\n\nlanded_merge: cafebabe\n' \
     "$plain" > "$d/_acceptance/bad/contract.md"
-  ff_src="$(sed -n '/^front_field()/,/^}/p' "$ROOT/scripts/pre-merge-check.sh")"
+  # The gate runs from the kit pinned at KIT_SHA since #129 (23/09), not from a
+  # vendored copy (kit GUIDE §5.3 step 5), so its twin reader lives there.
+  gate="${CLAUDE_PLUGIN_ROOT:?CLAUDE_PLUGIN_ROOT unset: the gate lives in the kit (GUIDE §5.3)}/scripts/pre-merge-check.sh"
+  ff_src="$(sed -n '/^front_field()/,/^}/p' "$gate")"
   [ -n "$ff_src" ] || fail malformed "could not extract front_field() from pre-merge-check.sh"
   eval "$ff_src"
   twin="$(front_field "$d/_acceptance/bad/contract.md" landed_merge)"
diff --git a/scripts/acceptance/test-scope-namespace.sh b/scripts/acceptance/test-scope-namespace.sh
deleted file mode 100755
index caad51a6..00000000
--- a/scripts/acceptance/test-scope-namespace.sh
+++ /dev/null
@@ -1,223 +0,0 @@
-#!/usr/bin/env bash
-# Guard for the path-namespace half of gate-scope-anchors — variant 5 of the
-# "asked in one universe, answered in another" family that stale-scope-by-paths
-# named, fixed four of, and left open with an explicit "do not patch piecemeal".
-#
-# scope_has_any_match() decides whether a feature's declared `paths` are usable
-# at all; stale_files() then applies them. When the two disagree about WHICH
-# files exist, a wholly honest declaration can be granted a scope that filters
-# out every real change, forever, on every later pull request — silently. That
-# is the shape tested here.
-#
-# Lives under scripts/acceptance/ on purpose: t1_skip_globs exempts the gate
-# tooling by EXACT path, so this file is gated and the gate applies to the change
-# that alters the gate.
-set -u
-HERE="$(cd "$(dirname "$0")" && pwd)"
-ROOT="$(cd "$HERE/../.." && pwd)"
-GATE="$ROOT/scripts/pre-merge-check.sh"
-
-KNOWN_CASES="exempt-refused variants-discriminating legit-granted case-completeness"
-
-TMPDIRS="$(mktemp)"
-new_tmp() { d="$(mktemp -d)"; printf '%s\n' "$d" >> "$TMPDIRS"; printf '%s' "$d"; }
-cleanup() {
-  [ -f "$TMPDIRS" ] || return 0
-  while IFS= read -r d; do [ -n "$d" ] && rm -rf "$d"; done < "$TMPDIRS"
-  rm -f "$TMPDIRS"
-}
-trap cleanup EXIT
-
-pass() { echo "CASE $1: PASS"; }
-fail() { echo "CASE $1: FAIL $2"; exit 1; }
-
-# Extract the two functions under test from a gate FILE and define them in this
-# shell. Sourcing the whole gate is not an option (it has side effects and calls
-# exit), and a private copy would drift from what actually ships. This is the
-# same extraction check-stale-scoping.sh's guard-not-exempt case uses — and it is
-# what lets a perturbed COPY be tested without any knob in the shipped gate.
-load_gate_fns() { # <gate-file>
-  local src
-  src="$(sed -n '/^match_globs()/,/^}/p' "$1")
-$(sed -n '/^scope_has_any_match()/,/^}/p' "$1")"
-  case "$src" in
-    *match_globs*scope_has_any_match*) ;;
-    *) return 1 ;;
-  esac
-  eval "$src"
-}
-
-# A fixture repo whose tracked files are mostly exempt ones, plus real source so
-# the repo is not degenerate.
-mk_repo() {
-  local d
-  d="$(new_tmp)"
-  (
-    cd "$d" || exit 1
-    git init -q .
-    git config user.email t@t
-    git config user.name t
-    mkdir -p docs src/lib _acceptance/feat
-    printf 'd\n' > docs/guide.md
-    printf 'c\n' > CHANGELOG.md
-    printf 's\n' > src/lib/real.ts
-    printf 'a\n' > _acceptance/feat/contract.md
-    git add -A && git commit -qm base
-  ) >/dev/null 2>&1 || return 1
-  printf '%s' "$d"
-}
-
-case_exempt_refused() {
-  # AC-1 / E1: a union that only ever matches exempt files must be REFUSED.
-  # stale_files() drops those files before scope is applied, so such a scope
-  # could never report anything again — granting it makes the feature
-  # permanently un-stale, silently.
-  d="$(mk_repo)" || fail exempt-refused "could not build the fixture repo"
-  load_gate_fns "$GATE" || fail exempt-refused "could not extract the gate functions"
-  T1_GLOBS="docs/**
-CHANGELOG.md"
-  if scope_has_any_match "$d" 'docs/**'; then
-    fail exempt-refused "narrow scope granted to a union that only matches t1-exempt files"
-  fi
-  if scope_has_any_match "$d" 'CHANGELOG.md'; then
-    fail exempt-refused "narrow scope granted to a union that only matches an exempt literal"
-  fi
-  # _acceptance/** is dropped by stale_files() through a different branch, so it
-  # is a separate way into the same hole and gets its own assertion.
-  if scope_has_any_match "$d" '_acceptance/**'; then
-    fail exempt-refused "narrow scope granted to a union that only matches _acceptance/"
-  fi
-  pass exempt-refused
-}
-
-case_legit_granted() {
-  # AC-3 / E3: the suppression half. A declaration pointing at real gated code
-  # must STILL be granted — a fix that refuses everyone rebuilds the treadmill
-  # that stale-scope-by-paths existed to remove.
-  d="$(mk_repo)" || fail legit-granted "could not build the fixture repo"
-  load_gate_fns "$GATE" || fail legit-granted "could not extract the gate functions"
-  T1_GLOBS="docs/**
-CHANGELOG.md"
-  scope_has_any_match "$d" 'src/lib/**' \
-    || fail legit-granted "narrow scope refused for a union pointing at real code"
-  # A mixed union is legitimate too: it can still report something.
-  scope_has_any_match "$d" 'docs/**
-src/lib/**' || fail legit-granted "mixed union refused although it matches real code"
-
-  # A non-ASCII filename is the same namespace question in a different disguise:
-  # git quotes such paths in ls-files by default while stale_files() reads them
-  # unquoted from diff. If the two disagree, a declaration whose only match is
-  # such a file is refused narrow scope even though staleness could report it.
-  ( cd "$d" && printf 's\n' > "src/lib/café.ts" && git add -A && git commit -qm accented ) >/dev/null 2>&1 \
-    || fail legit-granted "could not add a non-ASCII fixture file"
-  ( cd "$d" && git rm -q --cached src/lib/real.ts && git commit -qm "leave only the accented file" ) >/dev/null 2>&1 \
-    || fail legit-granted "could not isolate the non-ASCII file"
-  scope_has_any_match "$d" 'src/lib/**' \
-    || fail legit-granted "a union whose only match is a non-ASCII path was refused — ls-files and diff are spelling it differently"
-  pass legit-granted
-}
-
-case_variants_discriminating() {
-  # AC-2 / E2: the variants stale-scope-by-paths already fixed must still be
-  # catchable. Perturb a COPY of the gate — never the shipped one, where an env
-  # knob would itself be the fail-open (check-stale-scoping.sh's no-kill-switch
-  # case asserts exactly that) — and require each perturbation to make this
-  # harness red.
-  d="$(mk_repo)" || fail variants-discriminating "could not build the fixture repo"
-  T1_GLOBS="docs/**
-CHANGELOG.md"
-
-  # v1 — namespace: ls-files WITHOUT --full-name prints paths relative to the
-  # directory asked about, while every other consumer of these globs matches
-  # against `git diff --name-only`, which prints paths relative to the git
-  # top-level. The two coincide only when the root IS the git root; in the
-  # monorepo layout the gate supports they diverge, and a declaration that
-  # matches the ls-files spelling then filters out every real change.
-  ( cd "$d" && mkdir -p pkg && git mv src pkg/src && git commit -qm move ) >/dev/null 2>&1 \
-    || fail variants-discriminating "could not build the monorepo-shaped fixture"
-  copy="$(new_tmp)/gate.sh"
-  cp "$GATE" "$copy"
-  perl -0pi -e 's/ls-files --full-name/ls-files/' "$copy"
-  grep -q 'ls-files --full-name' "$copy" \
-    && fail variants-discriminating "v1 perturbation did not apply"
-  load_gate_fns "$copy" || fail variants-discriminating "could not extract from the perturbed copy (v1)"
-  if scope_has_any_match "$d/pkg" 'pkg/src/**'; then
-    fail variants-discriminating "v1 (namespace) not caught: a top-level-relative union matched a directory-relative listing"
-  fi
-  load_gate_fns "$GATE" || fail variants-discriminating "could not reload the shipped gate"
-  scope_has_any_match "$d/pkg" 'pkg/src/**' \
-    || fail variants-discriminating "v1 control failed: the shipped gate must still accept this union"
-
-  # v2 — prefix: matching only the leading path component, so a declaration of
-  # `src/not-real/**` would be accepted merely because `src/` exists. Perturb
-  # match_globs to compare leading components instead of whole patterns.
-  #
-  # The probe deliberately uses a NON-exempt prefix (`src/`, not `docs/`): under
-  # the prefix perturbation the exempt filter above degrades in the same way, so
-  # an exempt-prefixed probe would be skipped as exempt and the perturbation
-  # would look inert. The "perturbation is inert" assertion below is what makes
-  # that failure loud instead of a vacuous green.
-  d2="$(mk_repo)" || fail variants-discriminating "could not build the v2 fixture repo"
-  copy2="$(new_tmp)/gate2.sh"
-  cp "$GATE" "$copy2"
-  python3 - "$copy2" <<'PERTURB' || fail variants-discriminating "v2 perturbation did not apply"
-import sys
-p = sys.argv[1]
-s = open(p).read()
-old = '    case "$1" in $g) return 0 ;; esac\n'
-new = '    case "${1%%/*}" in ${g%%/*}) return 0 ;; esac\n'
-if old not in s:
-    sys.exit(1)
-open(p, 'w').write(s.replace(old, new))
-PERTURB
-  load_gate_fns "$copy2" || fail variants-discriminating "could not extract from the perturbed copy (v2)"
-  if ! scope_has_any_match "$d2" 'src/not-real/**'; then
-    fail variants-discriminating "v2 perturbation is inert: a prefix matcher must accept src/not-real/**"
-  fi
-  load_gate_fns "$GATE" || fail variants-discriminating "could not reload the shipped gate"
-  if scope_has_any_match "$d2" 'src/not-real/**'; then
-    fail variants-discriminating "v2 (prefix) not caught: the shipped gate accepts a path that does not exist"
-  fi
-
-  # v3 / v4 — total-vs-distribution and look-behind attribution live in
-  # feature_scope() and slug_acceptance_touched(), already pinned by
-  # check-stale-scoping.sh's partial and merged-halves cases. Assert those stay
-  # wired rather than duplicating them: a second copy of a guard is a second
-  # thing to drift.
-  for c in partial merged-halves; do
-    grep -F -- "--case $c" "$ROOT/_acceptance/config.yaml" >/dev/null \
-      || fail variants-discriminating "variant guard '--case $c' is no longer wired in config.yaml"
-  done
-  pass variants-discriminating
-}
-
-case_case_completeness() {
-  missing=""
-  for c in $KNOWN_CASES; do
-    fn="case_$(printf '%s' "$c" | tr '-' '_')"
-    command -v "$fn" >/dev/null 2>&1 || missing="$missing $c"
-  done
-  [ -z "$missing" ] || fail case-completeness "unimplemented cases:$missing"
-  if bash "$0" definitely-not-a-case >/dev/null 2>&1; then
-    fail case-completeness "an unknown case name exited 0"
-  fi
-  missing_cfg=""
-  for c in $KNOWN_CASES; do
-    grep -F -- "test-scope-namespace.sh $c" "$ROOT/_acceptance/config.yaml" >/dev/null 2>&1 \
-      || missing_cfg="$missing_cfg $c"
-  done
-  [ -z "$missing_cfg" ] \
-    || fail case-completeness "cases with no executors.script entry in _acceptance/config.yaml:$missing_cfg"
-  pass case-completeness
-}
-
-main() {
-  [ "$#" -ge 1 ] || { echo "usage: $(basename "$0") <case>" >&2; exit 2; }
-  case " $KNOWN_CASES " in
-    *" $1 "*) ;;
-    *) echo "unknown case '$1' (known: $KNOWN_CASES)" >&2; exit 2 ;;
-  esac
-  "case_$(printf '%s' "$1" | tr '-' '_')"
-}
-
-main "$@"
diff --git a/scripts/ci/check-gate-guards-job.sh b/scripts/ci/check-gate-guards-job.sh
index a96b8a23..59113a76 100755
--- a/scripts/ci/check-gate-guards-job.sh
+++ b/scripts/ci/check-gate-guards-job.sh
@@ -38,7 +38,9 @@ job_block() {
 # needle: three steps run the same script with different modes.
 GUARD_NEEDLES=(
     check-roadmap-fresh.sh
-    check-product-map.mjs
+    # The kit's own map reader since #128 (owner decision 23/09); the home-made
+    # scripts/ci/check-product-map.mjs no longer runs in CI.
+    CLAUDE_PLUGIN_ROOT/scripts/product-map.mjs
     check-plan-freeze.mjs
     check-plan-freeze-teeth.sh
     check-plan-docs.sh
@@ -62,6 +64,7 @@ TEETH_SKIP=(
     "check-plan-freeze-teeth.sh|ve do cua no CHINH LA no; pha no de chung minh no biet do la vong tron"
     "check-plan-docs-teeth.sh|ve do cua no CHINH LA no; pha no de chung minh no biet do la vong tron"
     "check-fork-identity-teeth.sh|ve do cua no CHINH LA no; pha no de chung minh no biet do la vong tron"
+    "CLAUDE_PLUGIN_ROOT/scripts/product-map.mjs|thuoc cua kit ghim KIT_SHA; ve do do kit tu canh, cay tham do khong co evidence cua ho so nen se do vi thieu tep chu khong vi lech"
 )
 teeth_skipped() {
     local n="$1" e
@@ -238,7 +241,6 @@ teeth)
     # from the real red output of the probe tree, not guessed.
     RED_TOKEN=(
         "check-roadmap-fresh.sh|roadmap drift"
-        "check-product-map.mjs|vắng trên bản đồ"
         "check-plan-freeze.mjs|teeth-probe-freeze mở ngoài kế hoạch"
         "check-plan-docs.sh|FAIL: STATUS.md đề ngày"
         "check-eval-filters.mjs|KHÔNG ca thử nào khớp"
@@ -325,10 +327,6 @@ teeth)
     python3 - "$probe/t" <<'PERTURB'
 import sys, pathlib
 root = pathlib.Path(sys.argv[1])
-# Drop one signed slug from the delivered block of the map.
-m = root / "PRODUCT-MAP.md"
-m.write_text("".join(l for l in m.read_text(encoding="utf-8").splitlines(keepends=True)
-                     if "(`roadmap-drift-guard`)" not in l), encoding="utf-8")
 # Duplicate one ledger row INSIDE the marker block.
 r = root / "docs" / "roadmap.md"
 lines = r.read_text(encoding="utf-8").splitlines(keepends=True)
diff --git a/scripts/ci/check-product-map-teeth.sh b/scripts/ci/check-product-map-teeth.sh
deleted file mode 100755
index e0293005..00000000
--- a/scripts/ci/check-product-map-teeth.sh
+++ /dev/null
@@ -1,325 +0,0 @@
-#!/usr/bin/env bash
-# Teeth for check-product-map.mjs.
-#
-# ONE EXIT CODE PER CASE. A case that was never implemented looks identical to a
-# case that passed, and both are green. This repo already paid for that lesson
-# once — see the `stale-scope-by-paths` comment in _acceptance/config.yaml.
-#
-# `--case` is REPEATABLE here, unlike scripts/roadmap/check-roadmap-guard-teeth.sh
-# which takes one name and overwrites on repeat. Three declared executors pass
-# two or three cases in a single invocation (pmap_teeth_unreadable,
-# pmap_teeth_extra_slug, pmap_teeth_source_buckets); overwriting would silently
-# measure only the last one and report the rest as covered.
-#
-# An unknown `--case` is REFUSED loudly (exit 2 + the valid list) rather than
-# skipped: a typo that exits 0 turns an eval into a permanent green no-op, which
-# is the same fail-open class the checker under test exists to close.
-#
-# Usage (from the repo root):
-#   bash scripts/ci/check-product-map-teeth.sh                    # every case
-#   bash scripts/ci/check-product-map-teeth.sh --case missing-slug
-#   bash scripts/ci/check-product-map-teeth.sh --list
-set -euo pipefail
-cd "$(dirname "$0")/../.."
-
-repo_root=$(pwd)
-checker="$repo_root/scripts/ci/check-product-map.mjs"
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' EXIT
-
-# Order is the reading order of the report, not an execution dependency: every
-# case builds its own fixture from scratch and can run alone.
-CASES=(
-    clean
-    missing-slug
-    count-mismatch
-    opportunity-mismatch
-    artifact-missing
-    artifact-unreadable
-    extra-slug
-    status-downgraded
-    contract-unparsable
-    status-unknown
-    dir-empty
-    parked-opportunity
-)
-
-is_case() {
-    local n="$1" c
-    for c in "${CASES[@]}"; do [ "$c" = "$n" ] && return 0; done
-    return 1
-}
-
-# A minimal tree the checker can read: PRODUCT-MAP.md plus the two files it
-# classifies dossiers by. Nothing else is copied, so a case cannot accidentally
-# pass because of a file the checker never reads.
-build_fixture() {
-    rm -rf "$tmp/t"
-    mkdir -p "$tmp/t/_acceptance"
-    cp "$repo_root/PRODUCT-MAP.md" "$tmp/t/PRODUCT-MAP.md"
-    for d in "$repo_root"/_acceptance/*/; do
-        slug=$(basename "$d")
-        mkdir -p "$tmp/t/_acceptance/$slug"
-        [ -f "$d/contract.md" ] && cp "$d/contract.md" "$tmp/t/_acceptance/$slug/contract.md"
-        [ -f "$d/opportunity.md" ] && cp "$d/opportunity.md" "$tmp/t/_acceptance/$slug/opportunity.md"
-    done
-    return 0
-}
-
-# The checker runs once per case and its output is KEPT. Several criteria are
-# about the MESSAGE (name the slug, print both numbers), and a teeth script that
-# throws output away can only ever assert red-or-green — a fix that impoverishes
-# the message would keep every case passing.
-check_capture() {
-    local rc=0
-    (cd "$tmp/t" && node "$checker") >"$tmp/out" 2>&1 || rc=$?
-    return $rc
-}
-check_is_red() { ! check_capture; }
-check_is_green() { check_capture; }
-out_has() { grep -Eq -- "$1" "$tmp/out"; }
-
-# --- the cases ------------------------------------------------------------
-# Each returns 0 when the checker behaved as the criterion requires.
-
-# AC-1 control. Without it a checker hardcoded to `exit 1` passes every red case
-# below, and the whole suite reads as proof of teeth it does not have.
-case_clean() {
-    build_fixture
-    check_is_green || return 1
-    # The count line must be PRESENT and all three numbers EQUAL. A checker that
-    # prints "0 signed, 0 on the map, 0 in the node" is also green, and that
-    # green means nothing.
-    out_has 'đã giao: [0-9]+ hồ sơ ký, [0-9]+ mục trên bản đồ, nút mermaid [0-9]+' || return 1
-    python3 - "$tmp/out" <<'COUNTS'
-import sys, pathlib, re
-m = re.search(r"đã giao: (\d+) hồ sơ ký, (\d+) mục trên bản đồ, nút mermaid (\d+)",
-              pathlib.Path(sys.argv[1]).read_text(encoding="utf-8"))
-if not m: raise SystemExit("thiếu dòng đếm")
-a, b, c = (int(x) for x in m.groups())
-if not (a == b == c): raise SystemExit(f"ba số lệch: {a} / {b} / {c}")
-if a == 0: raise SystemExit("cây thật phải có hồ sơ đã ký")
-COUNTS
-}
-
-# AC-1. Drop ONE signed slug from the `## Đã giao` block.
-#
-# The fixture FIRST adds a second mention of that slug elsewhere in the file,
-# then removes it from the block. Without that, this case cannot tell "reads
-# inside the block" from "greps the whole file" — a whole-file grep would pass
-# it. Adding the decoy to the COPY rather than to PRODUCT-MAP.md itself is
-# deliberate: that file is generated, so a hand-added line would vanish on the
-# next regeneration and take this case's discriminating power with it.
-case_missing_slug() {
-    build_fixture
-    python3 - "$tmp/t/PRODUCT-MAP.md" <<'DECOY'
-import sys, pathlib
-p = pathlib.Path(sys.argv[1])
-t = p.read_text(encoding="utf-8")
-slug = "chong-mat-khoa-byo"
-# Decoy outside every parsed block: a prose line under the mermaid diagram.
-t = t.replace("## Đang cân nhắc cơ hội",
-              f"> Ghi chú mồi nhử: `{slug}` cũng được nhắc ở đây.\n\n## Đang cân nhắc cơ hội", 1)
-# Now remove the real entry from the delivered block.
-t = "".join(l for l in t.splitlines(keepends=True) if f"(`{slug}`)" not in l)
-p.write_text(t, encoding="utf-8")
-DECOY
-    check_is_red || return 1
-    out_has 'chong-mat-khoa-byo' || return 1 # names the slug, not "the map is off"
-}
-
-# AC-2. Wrong number in the mermaid node. The message must carry BOTH numbers:
-# naming one says neither how far off it is nor in which direction. This is the
-# drift that actually happened — the map read 22 while 26 dossiers were signed.
-case_count_mismatch() {
-    build_fixture
-    python3 - "$tmp/t/PRODUCT-MAP.md" <<'BREAK'
-import sys, pathlib, re
-p = pathlib.Path(sys.argv[1])
-p.write_text(re.sub(r"Đã giao<br/>\d+ việc", "Đã giao<br/>99 việc",
-                    p.read_text(encoding="utf-8")), encoding="utf-8")
-BREAK
-    check_is_red || return 1
-    python3 - "$tmp/out" <<'BOTH'
-import sys, pathlib, re
-t = pathlib.Path(sys.argv[1]).read_text(encoding="utf-8")
-line = next((l for l in t.splitlines() if "99" in l and "FAIL" in l), None)
-if line is None: raise SystemExit("không có dòng FAIL nào nêu số 99")
-nums = {int(n) for n in re.findall(r"\d+", line)}
-if not (nums - {99}): raise SystemExit(f"chỉ nêu một số: {line}")
-BOTH
-}
-
-# AC-3. A new opportunity-only dossier the map does not know about. The
-# opportunity block gets the same treatment as the delivered one; a guard that
-# only watches the popular half is a guard with a documented blind side.
-case_opportunity_mismatch() {
-    build_fixture
-    mkdir -p "$tmp/t/_acceptance/teeth-probe-opportunity"
-    printf '# probe\n' >"$tmp/t/_acceptance/teeth-probe-opportunity/opportunity.md"
-    check_is_red || return 1
-    out_has 'cân nhắc cơ hội' || return 1
-}
-
-# lat-cat-chung-minh AC-11. A parked opportunity (decision: park) belongs in
-# "Xếp lại sau", not "Đang cân nhắc cơ hội". Before 04/09 the checker binned every
-# opportunity-only dossier as "cân nhắc" and the two sides disagreed on every
-# parked item the moment the map was regenerated.
-case_parked_opportunity() {
-    build_fixture
-    mkdir -p "$tmp/t/_acceptance/teeth-probe-parked"
-    printf -- '---\nschema_version: 1\nslug: teeth-probe-parked\nstage: decided\ndecision: park\n---\n' \
-        >"$tmp/t/_acceptance/teeth-probe-parked/opportunity.md"
-    check_is_red || return 1
-    # Hai `out_has` doc lap quet TOAN BO stdout khong do duoc mot QUAN HE: sau khi
-    # go dung nhanh phan loai park, slug hien o dong FAIL cua o "cân nhắc" con
-    # chuoi "Xếp lại sau" van hien o cac dong FAIL cua ba ho so park that, nen ca
-    # hai deu xanh va ca nay PASS tren dung hoi quy no khai la minh bat (do o S4
-    # vong 3). Slug va O phai nam tren CUNG MOT dong.
-    grep -Eq 'teeth-probe-parked.*\(Xếp lại sau\)' "$tmp/out"
-}
-
-# AC-4 fail-closed (a): the artifact is not there at all.
-case_artifact_missing() {
-    build_fixture
-    rm -f "$tmp/t/PRODUCT-MAP.md"
-    check_is_red || return 1
-    out_has 'PRODUCT-MAP.md' || return 1
-}
-
-# AC-4 fail-closed (b): the file is present but the thing to read inside it is
-# not. A checker that cannot find what it came to check has checked nothing, and
-# exiting 0 there is a lie worse than silence.
-case_artifact_unreadable() {
-    build_fixture
-    python3 - "$tmp/t/PRODUCT-MAP.md" <<'HIDE'
-import sys, pathlib, re
-p = pathlib.Path(sys.argv[1])
-t = p.read_text(encoding="utf-8")
-t = t.replace("## Đã giao\n", "## Đã giao (đổi tiêu đề)\n", 1)
-t = re.sub(r"Đã giao<br/>\d+ việc", "Đã giao", t)
-p.write_text(t, encoding="utf-8")
-HIDE
-    check_is_red || return 1
-    out_has 'không tìm thấy|không đọc được' || return 1
-}
-
-# AC-11. The map advertises a slug that has no dossier at all. AC-1 only walks
-# dossiers -> map, so this direction was uncovered: a withdrawn dossier leaves
-# its row behind and everything stays green. This repo withdrew one for real
-# (`normalize-text-vi`, 26/08).
-case_extra_slug() {
-    build_fixture
-    python3 - "$tmp/t/PRODUCT-MAP.md" <<'GHOST'
-import sys, pathlib
-p = pathlib.Path(sys.argv[1])
-p.write_text(p.read_text(encoding="utf-8").replace(
-    "## Đã giao\n\n", "## Đã giao\n\n- Việc ma (`teeth-probe-ghost`)\n", 1), encoding="utf-8")
-GHOST
-    check_is_red || return 1
-    out_has 'teeth-probe-ghost' || return 1
-}
-
-# AC-11. The dossier still exists but is no longer signed, and the row stays.
-case_status_downgraded() {
-    build_fixture
-    python3 - "$tmp/t/_acceptance/roadmap-drift-guard/contract.md" <<'DOWN'
-import sys, pathlib, re
-p = pathlib.Path(sys.argv[1])
-p.write_text(re.sub(r"(?m)^status: signed-off$", "status: draft",
-                    p.read_text(encoding="utf-8")), encoding="utf-8")
-DOWN
-    check_is_red || return 1
-    out_has 'roadmap-drift-guard' || return 1
-}
-
-# AC-12 bucket four: frontmatter that does not parse at all.
-case_contract_unparsable() {
-    build_fixture
-    printf -- '---\nstatus: [unclosed\n' >"$tmp/t/_acceptance/roadmap-drift-guard/contract.md"
-    check_is_red || return 1
-    out_has 'roadmap-drift-guard' || return 1
-}
-
-# AC-12 bucket four: a status outside the closed set. The quoted form is the
-# realistic typo, and it must land in bucket four — NOT in "signed" and NOT
-# silently in "some other status". Binning it silently is the fail-OPEN: the
-# dossier drops out of the must-appear set, the counts still balance, and the
-# checker goes green while the map is missing exactly that dossier.
-case_status_unknown() {
-    build_fixture
-    python3 - "$tmp/t/_acceptance/roadmap-drift-guard/contract.md" <<'QUOTED'
-import sys, pathlib, re
-p = pathlib.Path(sys.argv[1])
-p.write_text(re.sub(r"(?m)^status: signed-off$", 'status: "signed-off"',
-                    p.read_text(encoding="utf-8")), encoding="utf-8")
-QUOTED
-    check_is_red || return 1
-    out_has 'roadmap-drift-guard' || return 1
-}
-
-# AC-12 bucket four: a directory with neither contract.md nor opportunity.md.
-case_dir_empty() {
-    build_fixture
-    mkdir -p "$tmp/t/_acceptance/teeth-probe-empty"
-    check_is_red || return 1
-    out_has 'teeth-probe-empty' || return 1
-}
-
-# --- runner ---------------------------------------------------------------
-run_case() {
-    local name="$1" fn="case_${1//-/_}"
-    if declare -F "$fn" >/dev/null && "$fn"; then
-        echo "CASE $name: PASS"
-        return 0
-    fi
-    echo "CASE $name: FAIL"
-    return 1
-}
-
-refuse() {
-    echo "check-product-map-teeth: $1" >&2
-    echo "case hợp lệ: ${CASES[*]}" >&2
-    exit 2
-}
-
-# --- CLI ------------------------------------------------------------------
-# Mode is settled before anything runs: a typo must never turn a CHECK into a
-# silent pass.
-SELECTED=()
-while [ $# -gt 0 ]; do
-    case "$1" in
-    --list)
-        printf '%s\n' "${CASES[@]}"
-        exit 0
-        ;;
-    --case)
-        [ $# -ge 2 ] || refuse "\`--case\` cần một tên ngay sau nó — nhận được (trống)"
-        case "$2" in --*) refuse "\`--case\` cần một tên ngay sau nó — nhận được \`$2\`" ;; esac
-        is_case "$2" || refuse "case lạ \`$2\`"
-        SELECTED+=("$2")
-        shift 2
-        ;;
-    *) refuse "tham số lạ \`$1\` — chỉ nhận \`--case <tên>\` và \`--list\`" ;;
-    esac
-done
-[ ${#SELECTED[@]} -eq 0 ] && SELECTED=("${CASES[@]}")
-
-if [ ${#SELECTED[@]} -eq ${#CASES[@]} ]; then
-    echo "→ răng của check-product-map.mjs"
-else
-    echo "→ răng: ${SELECTED[*]}"
-fi
-
-pass=0
-fail=0
-for c in "${SELECTED[@]}"; do
-    if run_case "$c"; then pass=$((pass + 1)); else fail=$((fail + 1)); fi
-done
-
-echo
-if [ "$fail" -ne 0 ]; then
-    echo "❌ răng: $pass đạt / $fail hỏng — bộ kiểm bản đồ không đáng tin"
-    exit 1
-fi
-echo "✅ răng: $pass/$pass case — mỗi case một mã thoát riêng"
diff --git a/scripts/ci/check-product-map.mjs b/scripts/ci/check-product-map.mjs
deleted file mode 100755
index 8e668d82..00000000
--- a/scripts/ci/check-product-map.mjs
+++ /dev/null
@@ -1,337 +0,0 @@
-#!/usr/bin/env node
-// Asserts PRODUCT-MAP.md still matches the dossiers under _acceptance/.
-//
-// Why this exists: `product-map.mjs --check` had ZERO references in
-// .github/workflows/ci.yml (measured 31/08), so it only ran when somebody typed
-// it. The map drifted by four slugs — it advertised 22 delivered items while 26
-// dossiers were signed — and nobody knew.
-//
-// NODE BUILTINS ONLY. The `acceptance-gate` job in .github/workflows/ci.yml has
-// no `pnpm install` step, so node_modules does not exist when this runs.
-// scripts/roadmap/roadmap-drift.mjs is the precedent for hand-rolled parsing.
-//
-// This ASSERTS an invariant rather than regenerating and diffing (the shape
-// `gen_abi_clean` uses for generated TypeScript), because the generator lives in
-// a plugin cache a clean CI runner does not have. Vendoring it would freeze a
-// copy that then drifts into a fork, leaving two different rulers for one thing.
-// Deliberate deviation from the repo's own pattern — see the design doc §4.
-//
-// Run from the repo root: `node scripts/ci/check-product-map.mjs`.
-// Its teeth are proven separately by check-product-map-teeth.sh.
-import { readdirSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-
-const MAP = "PRODUCT-MAP.md";
-const ACCEPTANCE_DIR = "_acceptance";
-
-// The closed set of contract states. A value outside it is NOT quietly treated
-// as "some other status" — see classifyDossiers.
-const STATUS_CLOSED = new Set([
-    "draft",
-    "approved",
-    "implemented",
-    "verified",
-    "machine-cleared",
-    "signed-off",
-]);
-
-// Takes no arguments, and REFUSES the ones it does not know rather than ignoring
-// them. A checker that swallows an unknown flag and exits 0 cannot be told apart
-// from a checker that ran, so a typo in the ci.yml `run:` line would read as a
-// clean check forever — the same fail-open this file exists to close.
-if (process.argv.length > 2) {
-    console.error(
-        `check-product-map: không nhận tham số nào — nhận được: ${process.argv.slice(2).join(" ")}`,
-    );
-    process.exit(2);
-}
-
-const failures = [];
-const fail = (rule, msg) => failures.push(`FAIL ${rule}: ${msg}`);
-const read = (p) => readFileSync(p, "utf8");
-
-function report() {
-    if (failures.length === 0) return;
-    for (const f of failures) console.error(f);
-    console.error(
-        `\n❌ ${MAP} không khớp với ${ACCEPTANCE_DIR}/ — ${failures.length} chỗ lệch.`,
-    );
-    process.exit(1);
-}
-
-// --- read the map, fail-closed ---------------------------------------------
-// A checker that cannot find what it came to check has checked nothing. Exiting
-// 0 here would be a lie worse than silence, so a missing artifact stops the run
-// immediately rather than letting the assertions below read an empty string and
-// find nothing wrong with it.
-let map;
-try {
-    map = read(MAP);
-} catch (err) {
-    fail("bản đồ", `không đọc được ${MAP} (${err.code ?? "lỗi"})`);
-    report();
-    process.exit(1);
-}
-
-/**
- * The `(`slug`)` tokens inside a `## <heading>` section, in document order.
- * Returns null when the heading itself is absent — distinct from an empty
- * section, which is a legitimate state the map renders as "chưa có".
- */
-function blockItems(heading) {
-    // Line-based rather than one regex. The regex form used `\z` for end-of-
-    // input, which JavaScript does not have: it degrades to a literal `z`, so
-    // the section silently ended at the first word containing one and the
-    // checker read 10 of 27 rows while still exiting non-zero — a broken
-    // checker that looks like a working one.
-    const lines = map.split("\n");
-    const start = lines.findIndex((l) => l.trim() === `## ${heading}`);
-    if (start === -1) return null;
-    let end = lines.length;
-    for (let i = start + 1; i < lines.length; i++) {
-        if (lines[i].startsWith("## ")) {
-            end = i;
-            break;
-        }
-    }
-    return lines
-        .slice(start + 1, end)
-        .flatMap((l) =>
-            [...l.matchAll(/\(`([a-z0-9][a-z0-9-]*)`\)/g)].map((x) => x[1]),
-        );
-}
-
-/**
- * The number inside a mermaid node label, e.g. `Đã giao<br/>27 việc`.
- * An empty bucket renders `chưa có` rather than `0 việc`, so that form maps to
- * 0 — treating it as unparsable would make every empty bucket a false alarm.
- * Returns null when neither form is present, which IS a real failure.
- */
-function mermaidCount(label) {
-    const withNumber = map.match(new RegExp(`${label}<br/>(\\d+)\\s*việc`));
-    if (withNumber) return Number(withNumber[1]);
-    if (new RegExp(`${label}<br/>chưa có`).test(map)) return 0;
-    return null;
-}
-
-/**
- * Every directory under _acceptance/ lands in exactly one closed bucket:
- * signed · signed-but-awaiting-UAT · in progress · awaiting scope approval ·
- * opportunity-only · parked · NOT CLASSIFIABLE.
- *
- * The last bucket is red BY NAME, never a silent skip. Without it a dossier
- * whose frontmatter is off by a quote (`status: "signed-off"`) or a capital
- * (`Signed-off`), or whose YAML is broken, gets binned as "not signed": it drops
- * out of the must-appear set, the counts still balance, and the whole checker
- * goes green while the map is missing exactly that dossier. That is a fail-OPEN
- * sitting inside a checker sold as fail-closed.
- */
-// The generator files a dossier by CONTRACT STATUS first, and only falls back to
-// the opportunity's stage/decision when there is no contract. Read the same two
-// fields here or the two sides disagree about every parked or awaiting-UAT item
-// (measured 2026-09-04: regenerating with kit 2.8.0 turned this checker red on a
-// dossier neither side had got wrong).
-function opportunityDecision(slug) {
-    let text;
-    try {
-        text = read(join(ACCEPTANCE_DIR, slug, "opportunity.md"));
-    } catch {
-        return null;
-    }
-    const fm = text.match(/^---\r?\n([\s\S]*?)\r?\n---/);
-    if (!fm) return "";
-    const m = fm[1].match(/^decision:[ \t]*(.*)$/m);
-    return m ? m[1].trim() : "";
-}
-
-function classifyDossiers() {
-    const out = {
-        signed: [],
-        awaitingUat: [],
-        inProgress: [],
-        opportunity: [],
-        parked: [],
-        other: [],
-        unclassified: [],
-    };
-    for (const d of readdirSync(ACCEPTANCE_DIR, { withFileTypes: true })) {
-        if (!d.isDirectory()) continue;
-        const slug = d.name;
-
-        let contract = null;
-        try {
-            contract = read(join(ACCEPTANCE_DIR, slug, "contract.md"));
-        } catch {
-            // No contract — the directory may still be an opportunity.
-        }
-
-        if (contract === null) {
-            const decision = opportunityDecision(slug);
-            if (decision === null) {
-                out.unclassified.push({
-                    slug,
-                    reason: "không có contract.md lẫn opportunity.md",
-                });
-            } else if (decision === "park") {
-                out.parked.push(slug);
-            } else {
-                out.opportunity.push(slug);
-            }
-            continue;
-        }
-
-        const fm = contract.match(/^---\r?\n([\s\S]*?)\r?\n---/);
-        if (!fm) {
-            out.unclassified.push({
-                slug,
-                reason: "frontmatter không đọc được",
-            });
-            continue;
-        }
-
-        const m = fm[1].match(/^status:[ \t]*(.*)$/m);
-        // Deliberately NOT stripping quotes or lowercasing: `"signed-off"` is a
-        // typo to surface, not to normalise away. Normalising is exactly how it
-        // stays invisible.
-        const status = m ? m[1].trim() : "";
-        if (!STATUS_CLOSED.has(status)) {
-            out.unclassified.push({
-                slug,
-                reason: `status lạ \`${status || "(trống)"}\``,
-            });
-        } else if (status === "signed-off") {
-            // A signed dossier that came from an opportunity still owes a UAT
-            // session, so the generator parks it one bucket short of "Đã giao".
-            const decision = opportunityDecision(slug);
-            if (decision === "build" || decision === "iterate")
-                out.awaitingUat.push(slug);
-            else out.signed.push(slug);
-        } else if (status === "draft") {
-            out.other.push(slug);
-        } else {
-            // approved / implemented / verified — code is being written.
-            out.inProgress.push(slug);
-        }
-    }
-    for (const k of [
-        "signed",
-        "awaitingUat",
-        "inProgress",
-        "opportunity",
-        "parked",
-    ])
-        out[k].sort();
-    return out;
-}
-
-const dossiers = classifyDossiers();
-
-// --- the source side must be classifiable ----------------------------------
-for (const { slug, reason } of dossiers.unclassified)
-    fail("nguồn", `\`${slug}\` không phân loại được: ${reason}`);
-
-/**
- * One bucket, both directions, three numbers.
- *
- * The reverse direction (map -> dossiers) is not decoration: a dossier that is
- * WITHDRAWN leaves its row behind, and a forward-only check stays green while
- * the map advertises work that was never delivered. This repo withdrew one for
- * real (`normalize-text-vi`, 26/08).
- */
-function checkBucket({ rule, heading, node, expected }) {
-    const items = blockItems(heading);
-    const count = mermaidCount(node);
-    // The generator omits a section whose bucket is empty (measured 04/09: the
-    // map carried four headings for ten sections). Absent heading + nothing
-    // expected + a mermaid node reading "chưa có" is the healthy empty state,
-    // not drift. Any other combination still fails by name.
-    if (items === null) {
-        if (expected.length === 0 && count === 0) return;
-        fail(rule, `không tìm thấy khối "## ${heading}" trong ${MAP}`);
-        return;
-    }
-    if (count === null) {
-        fail(rule, `không đọc được nút mermaid "${node}" trong ${MAP}`);
-        return;
-    }
-
-    const onMap = new Set(items);
-    for (const slug of expected)
-        if (!onMap.has(slug))
-            fail(
-                rule,
-                `\`${slug}\` có hồ sơ nhưng vắng trên bản đồ (${heading})`,
-            );
-
-    const known = new Set(expected);
-    for (const slug of items)
-        if (!known.has(slug))
-            fail(
-                rule,
-                `bản đồ còn mục \`${slug}\` ở "${heading}" nhưng không có hồ sơ nào ở trạng thái đó`,
-            );
-
-    // All three counts in ONE assertion. Naming a single number tells the reader
-    // neither how far off the map is nor in which direction.
-    if (!(expected.length === items.length && items.length === count))
-        fail(
-            rule,
-            `${heading} lệch: ${expected.length} hồ sơ, ${items.length} mục trên bản đồ, nút mermaid ${count}`,
-        );
-}
-
-checkBucket({
-    rule: "đã giao",
-    heading: "Đã giao",
-    node: "Đã giao",
-    expected: dossiers.signed,
-});
-checkBucket({
-    rule: "cân nhắc cơ hội",
-    heading: "Đang cân nhắc cơ hội",
-    node: "Đang cân nhắc cơ hội",
-    expected: dossiers.opportunity,
-});
-checkBucket({
-    rule: "chờ phiên nghiệm thu",
-    heading: "Đã giao — chờ phiên nghiệm thu",
-    node: "Chờ phiên nghiệm thu",
-    expected: dossiers.awaitingUat,
-});
-checkBucket({
-    rule: "đang làm",
-    heading: "Đang làm",
-    node: "Đang làm",
-    expected: dossiers.inProgress,
-});
-checkBucket({
-    rule: "xếp lại sau",
-    heading: "Xếp lại sau",
-    node: "Xếp lại sau",
-    expected: dossiers.parked,
-});
-
-// --- report ----------------------------------------------------------------
-report();
-
-const delivered = blockItems("Đã giao") ?? [];
-const opportunities = blockItems("Đang cân nhắc cơ hội") ?? [];
-console.log(
-    `   đã giao: ${dossiers.signed.length} hồ sơ ký, ${delivered.length} mục trên bản đồ, nút mermaid ${mermaidCount("Đã giao")}`,
-);
-console.log(
-    `   cơ hội: ${dossiers.opportunity.length} hồ sơ, ${opportunities.length} mục trên bản đồ, nút mermaid ${mermaidCount("Đang cân nhắc cơ hội")}`,
-);
-// The parked bucket gets the same three-value shape as the two lines above:
-// AC-11 promises a RELATION between dossiers, map entries and mermaid nodes, and
-// checkBucket verifies all three — but until now it printed only the first, so a
-// green run could not be reconciled against what the criterion claims (S4 round
-// 1). A number nobody can cross-check is a number nobody can audit.
-const parked = blockItems("Xếp lại sau") ?? [];
-console.log(
-    `   xếp lại sau: ${dossiers.parked.length} hồ sơ, ${parked.length} mục trên bản đồ, nút mermaid ${mermaidCount("Xếp lại sau")}`,
-);
-console.log(
-    `   chờ phiên nghiệm thu: ${dossiers.awaitingUat.length} · đang làm: ${dossiers.inProgress.length} · chờ duyệt phạm vi: ${dossiers.other.length}`,
-);
-console.log(`✅ ${MAP} khớp với ${ACCEPTANCE_DIR}/ — không có trôi.`);
diff --git a/scripts/ci/check-repin-eval-coverage.sh b/scripts/ci/check-repin-eval-coverage.sh
index b84596a4..392c0da7 100755
--- a/scripts/ci/check-repin-eval-coverage.sh
+++ b/scripts/ci/check-repin-eval-coverage.sh
@@ -101,7 +101,10 @@ readers)
     [ -n "$target" ] || fail "khong tim thay run-log nao co dong repin duoc mot section ### Re-pin trich dan"
     echo "muc tieu: ${target#"$W"/} (dong repin duoc ### Re-pin trich dan)"
 
-    run_pmc() { (cd "$W" && bash scripts/pre-merge-check.sh . --base origin/main 2>&1); }
+    # Gate from the kit pinned at KIT_SHA since #129 (23/09): kit GUIDE §5.3 step 5.
+    gate="${CLAUDE_PLUGIN_ROOT:?CLAUDE_PLUGIN_ROOT unset: the gate lives in the kit (GUIDE §5.3)}/scripts/pre-merge-check.sh"
+    [ -f "$gate" ] || fail "kit gate not found at $gate"
+    run_pmc() { (cd "$W" && bash "$gate" . --base origin/main 2>&1); }
 
     with="$(run_pmc)"
     node -e '