From 2bceaff466b266b28c5212364f362c2dfcf06c91 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=E1=BA=A1nh?= <phanlemanh@gmail.com>
Date: Wed, 23 Sep 2026 13:17:27 +0700
Subject: [PATCH 1/6] =?UTF-8?q?chore(acceptance):=20kh=C3=B4i=20ph?=
 =?UTF-8?q?=E1=BB=A5c=20t1=5Fskip=5Fglobs=20khai=20t=E1=BB=87p=20kit=20l?=
 =?UTF-8?q?=C3=A0m=20d=C3=B2ng=20l=E1=BB=8Bch=20s=E1=BB=AD?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#129 xoá bản kit đã chép và gỡ luôn các dòng t1_skip_globs khai chúng. Luật
stale đếm tệp đổi từ verified_commit ngoài t1_skip_globs, nên chính việc xoá
thành «code đổi sau verify» cho hồ sơ ký trước đó (kit GUIDE §5.3 mục 3).

Khôi phục nguyên các dòng từ 8ca36b5 và khai thêm lib/lop-nhin-thay.cjs:
tệp này chép vào ở a282fed nhưng chưa từng được khai, #129 cũng xoá nó.

Đo bằng kit 8a4ea88 (= KIT_SHA của CI), lượt không --base (cả cây):
  8ca36b5 (trước #129): 39 hồ sơ stale
  9fbe0d6 (sau #129):   40 (thêm roadmap-drift-guard)
  commit này:           39, cùng tập slug với 8ca36b5
Lượt --base origin/main: clean.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 _acceptance/config.yaml | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/_acceptance/config.yaml b/_acceptance/config.yaml
index c2ddaf5c..220ec635 100644
--- a/_acceptance/config.yaml
+++ b/_acceptance/config.yaml
@@ -831,6 +831,30 @@ risk_tiers:
     - "_acceptance/**"
     - "public/**"
     - "src/i18n/messages/**"
+    # lịch sử — tệp đã xoá ở #129; giữ để luật stale không đếm việc xoá là code
+    # đổi sau verify (kit GUIDE §5.3 mục 3, 23/09). Luật stale đếm tệp đổi từ
+    # verified_commit ngoài t1_skip_globs, nên gỡ các dòng này biến chính việc
+    # xoá bản kit đã chép thành «code đổi sau verify» cho mọi hồ sơ ký trước #129.
+    # Giữ cả hai bộ tên `.js`/`.cjs`: cửa sổ diff từ verified_commit cũ còn thấy
+    # đường `.js` (kit 1.40.0 đổi đuôi). Gỡ chỉ khi không hồ sơ sống nào có
+    # verified_commit trước #129.
+    - "scripts/pre-merge-check.sh"
+    - "lib/eval-yaml.cjs"
+    - "scripts/recheck-evidence.cjs"
+    - "scripts/recheck-evidence.js"
+    - "lib/evidence-core.cjs"
+    - "lib/evidence-core.js"
+    - "lib/gap-probe.cjs"
+    - "lib/gap-probe.js"
+    - "lib/ac-line.cjs"
+    - "lib/ac-line.js"
+    - "lib/md-section.cjs"
+    - "lib/md-section.js"
+    - "lib/workspace-record.cjs"
+    # Bản chép lop-nhin-thay.cjs vào ở a282fed (kit 2.14.0) nhưng chưa từng được
+    # khai ở đây; #129 xoá nó nên nó cũng phải là dòng lịch sử, nếu không mọi hồ
+    # sơ có verified_commit từ a282fed tới trước #129 hết hạn vì chính việc xoá.
+    - "lib/lop-nhin-thay.cjs"
     # Lint configuration only — it constrains how source is written, never what
     # the product does at runtime, so a change here cannot invalidate evidence.
     - "biome.json"

From e670c63f52b93e0b64b6c5896ce187b810475a3b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=E1=BA=A1nh?= <phanlemanh@gmail.com>
Date: Wed, 23 Sep 2026 13:37:28 +0700
Subject: [PATCH 2/6] =?UTF-8?q?fix(acceptance):=20guard=20c=E1=BB=A7a=20kh?=
 =?UTF-8?q?o=20g=E1=BB=8Di=20c=E1=BB=95ng=20kit,=20needle=20b=E1=BA=A3n=20?=
 =?UTF-8?q?=C4=91=E1=BB=93=20tr=E1=BB=8F=20b=C6=B0=E1=BB=9Bc=20kit?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#129 xoá bản chép scripts/pre-merge-check.sh; ba script của kho vẫn gọi
đường cũ nên đỏ vì «No such file» chứ không vì vật lệch:
- check-resign-wave.sh, check-gate-residual.sh, check-repin-eval-coverage.sh
  (mode readers) nay gọi "$CLAUDE_PLUGIN_ROOT/scripts/pre-merge-check.sh"
  (kit GUIDE §5.3 mục 5), thiếu biến thì đỏ to tiếng.
- check-gate-guards-job.sh: needle check-product-map.mjs (bước CI đã đổi
  sang thước kit ở #128) thành CLAUDE_PLUGIN_ROOT/scripts/product-map.mjs;
  bỏ RED_TOKEN và nhiễu loạn bản đồ của thước riêng; vế đỏ khai trong
  TEETH_SKIP có lý do (thước của kit, kit tự canh răng).

Đo ở HEAD với kit 8a4ea88: 7 eval resign-wave/gate-residual/readers
đỏ -> xanh; shape/teeth/reachable/no-softening/job-count đều xanh
(teeth: KÊ=13 · PHÁ=7 · BỎ QUA=6 có tên).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 scripts/acceptance/check-gate-residual.sh |  7 ++++++-
 scripts/acceptance/check-resign-wave.sh   |  7 ++++++-
 scripts/ci/check-gate-guards-job.sh       | 10 ++++------
 scripts/ci/check-repin-eval-coverage.sh   |  5 ++++-
 4 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/scripts/acceptance/check-gate-residual.sh b/scripts/acceptance/check-gate-residual.sh
index aaa86eaa..f90afd70 100755
--- a/scripts/acceptance/check-gate-residual.sh
+++ b/scripts/acceptance/check-gate-residual.sh
@@ -39,7 +39,12 @@ fail() { echo "FAIL: $*" >&2; exit 1; }
 if [ -n "${GATE_RESIDUAL_INPUT:-}" ]; then
     out=$(cat "$GATE_RESIDUAL_INPUT")
 else
-    out=$(bash scripts/pre-merge-check.sh . --base "$BASE" 2>&1) || true
+    # The gate runs from the kit pinned at KIT_SHA since #129 (23/09), not from a
+    # vendored copy (kit GUIDE §5.3 step 5). Unset CLAUDE_PLUGIN_ROOT is a loud
+    # error, never a silent empty verdict.
+    gate="${CLAUDE_PLUGIN_ROOT:?CLAUDE_PLUGIN_ROOT unset: the gate lives in the kit (GUIDE §5.3)}/scripts/pre-merge-check.sh"
+    [ -f "$gate" ] || fail "kit gate not found at $gate"
+    out=$(bash "$gate" . --base "$BASE" 2>&1) || true
 fi
 
 # A run that never reached its own summary line crashed; refuse to read silence
diff --git a/scripts/acceptance/check-resign-wave.sh b/scripts/acceptance/check-resign-wave.sh
index 7628224f..ed54bbae 100755
--- a/scripts/acceptance/check-resign-wave.sh
+++ b/scripts/acceptance/check-resign-wave.sh
@@ -35,7 +35,12 @@ fail() { echo "FAIL: $*" >&2; exit 1; }
 if [ -n "${GATE_RESIDUAL_INPUT:-}" ]; then
     out=$(cat "$GATE_RESIDUAL_INPUT")
 else
-    out=$(bash scripts/pre-merge-check.sh . --base "$BASE" 2>&1) || true
+    # The gate runs from the kit pinned at KIT_SHA since #129 (23/09), not from a
+    # vendored copy (kit GUIDE §5.3 step 5). Unset CLAUDE_PLUGIN_ROOT is a loud
+    # error, never a silent empty verdict.
+    gate="${CLAUDE_PLUGIN_ROOT:?CLAUDE_PLUGIN_ROOT unset: the gate lives in the kit (GUIDE §5.3)}/scripts/pre-merge-check.sh"
+    [ -f "$gate" ] || fail "kit gate not found at $gate"
+    out=$(bash "$gate" . --base "$BASE" 2>&1) || true
 fi
 
 # A run that never reached its own summary line crashed; refuse to read silence
diff --git a/scripts/ci/check-gate-guards-job.sh b/scripts/ci/check-gate-guards-job.sh
index a96b8a23..59113a76 100755
--- a/scripts/ci/check-gate-guards-job.sh
+++ b/scripts/ci/check-gate-guards-job.sh
@@ -38,7 +38,9 @@ job_block() {
 # needle: three steps run the same script with different modes.
 GUARD_NEEDLES=(
     check-roadmap-fresh.sh
-    check-product-map.mjs
+    # The kit's own map reader since #128 (owner decision 23/09); the home-made
+    # scripts/ci/check-product-map.mjs no longer runs in CI.
+    CLAUDE_PLUGIN_ROOT/scripts/product-map.mjs
     check-plan-freeze.mjs
     check-plan-freeze-teeth.sh
     check-plan-docs.sh
@@ -62,6 +64,7 @@ TEETH_SKIP=(
     "check-plan-freeze-teeth.sh|ve do cua no CHINH LA no; pha no de chung minh no biet do la vong tron"
     "check-plan-docs-teeth.sh|ve do cua no CHINH LA no; pha no de chung minh no biet do la vong tron"
     "check-fork-identity-teeth.sh|ve do cua no CHINH LA no; pha no de chung minh no biet do la vong tron"
+    "CLAUDE_PLUGIN_ROOT/scripts/product-map.mjs|thuoc cua kit ghim KIT_SHA; ve do do kit tu canh, cay tham do khong co evidence cua ho so nen se do vi thieu tep chu khong vi lech"
 )
 teeth_skipped() {
     local n="$1" e
@@ -238,7 +241,6 @@ teeth)
     # from the real red output of the probe tree, not guessed.
     RED_TOKEN=(
         "check-roadmap-fresh.sh|roadmap drift"
-        "check-product-map.mjs|vắng trên bản đồ"
         "check-plan-freeze.mjs|teeth-probe-freeze mở ngoài kế hoạch"
         "check-plan-docs.sh|FAIL: STATUS.md đề ngày"
         "check-eval-filters.mjs|KHÔNG ca thử nào khớp"
@@ -325,10 +327,6 @@ teeth)
     python3 - "$probe/t" <<'PERTURB'
 import sys, pathlib
 root = pathlib.Path(sys.argv[1])
-# Drop one signed slug from the delivered block of the map.
-m = root / "PRODUCT-MAP.md"
-m.write_text("".join(l for l in m.read_text(encoding="utf-8").splitlines(keepends=True)
-                     if "(`roadmap-drift-guard`)" not in l), encoding="utf-8")
 # Duplicate one ledger row INSIDE the marker block.
 r = root / "docs" / "roadmap.md"
 lines = r.read_text(encoding="utf-8").splitlines(keepends=True)
diff --git a/scripts/ci/check-repin-eval-coverage.sh b/scripts/ci/check-repin-eval-coverage.sh
index b84596a4..392c0da7 100755
--- a/scripts/ci/check-repin-eval-coverage.sh
+++ b/scripts/ci/check-repin-eval-coverage.sh
@@ -101,7 +101,10 @@ readers)
     [ -n "$target" ] || fail "khong tim thay run-log nao co dong repin duoc mot section ### Re-pin trich dan"
     echo "muc tieu: ${target#"$W"/} (dong repin duoc ### Re-pin trich dan)"
 
-    run_pmc() { (cd "$W" && bash scripts/pre-merge-check.sh . --base origin/main 2>&1); }
+    # Gate from the kit pinned at KIT_SHA since #129 (23/09): kit GUIDE §5.3 step 5.
+    gate="${CLAUDE_PLUGIN_ROOT:?CLAUDE_PLUGIN_ROOT unset: the gate lives in the kit (GUIDE §5.3)}/scripts/pre-merge-check.sh"
+    [ -f "$gate" ] || fail "kit gate not found at $gate"
+    run_pmc() { (cd "$W" && bash "$gate" . --base origin/main 2>&1); }
 
     with="$(run_pmc)"
     node -e '

From 15da97772dc43c88617077a0e6781b98cc7c7f89 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=E1=BA=A1nh?= <phanlemanh@gmail.com>
Date: Wed, 23 Sep 2026 14:52:35 +0700
Subject: [PATCH 3/6] =?UTF-8?q?fix(acceptance):=20test-own-range=20=C4=91?=
 =?UTF-8?q?=E1=BB=8Dc=20front=5Ffield=20t=E1=BB=AB=20c=E1=BB=95ng=20kit?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Ca malformed rút front_field() từ scripts/pre-merge-check.sh chép vào kho,
đã xoá ở #129. Nay rút từ "$CLAUDE_PLUGIN_ROOT/scripts/pre-merge-check.sh"
(kit GUIDE §5.3 mục 5); kit 8a4ea88 vẫn có front_field(). 8/8 ca xanh.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 scripts/acceptance/test-own-range.sh | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/scripts/acceptance/test-own-range.sh b/scripts/acceptance/test-own-range.sh
index d5806006..b770fd88 100755
--- a/scripts/acceptance/test-own-range.sh
+++ b/scripts/acceptance/test-own-range.sh
@@ -124,7 +124,10 @@ case_malformed() {
   # decoy in the body, a trailing comment, and quotes.
   printf -- '---\nslug: bad\nlanded_merge: "%s"  # PR #99\n---\n\nlanded_merge: cafebabe\n' \
     "$plain" > "$d/_acceptance/bad/contract.md"
-  ff_src="$(sed -n '/^front_field()/,/^}/p' "$ROOT/scripts/pre-merge-check.sh")"
+  # The gate runs from the kit pinned at KIT_SHA since #129 (23/09), not from a
+  # vendored copy (kit GUIDE §5.3 step 5), so its twin reader lives there.
+  gate="${CLAUDE_PLUGIN_ROOT:?CLAUDE_PLUGIN_ROOT unset: the gate lives in the kit (GUIDE §5.3)}/scripts/pre-merge-check.sh"
+  ff_src="$(sed -n '/^front_field()/,/^}/p' "$gate")"
   [ -n "$ff_src" ] || fail malformed "could not extract front_field() from pre-merge-check.sh"
   eval "$ff_src"
   twin="$(front_field "$d/_acceptance/bad/contract.md" landed_merge)"

From 825e6cd533e944a4ea7118af431433efc6cd75dd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=E1=BA=A1nh?= <phanlemanh@gmail.com>
Date: Wed, 23 Sep 2026 14:52:36 +0700
Subject: [PATCH 4/6] =?UTF-8?q?chore(acceptance):=20ngh=E1=BB=89=204=20h?=
 =?UTF-8?q?=E1=BB=93=20s=C6=A1=20th=C6=B0=E1=BB=9Bc=20=3D=20kit,=20xo?=
 =?UTF-8?q?=C3=A1=20th=C6=B0=E1=BB=9Bc=20ri=C3=AAng=20v=C3=A0=20guard=20ch?=
 =?UTF-8?q?=E1=BA=BFt?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Owner (manh) gật lối A ngày 23/09. Bốn dòng nghỉ theo công thức kit GUIDE
«Cho một hồ sơ nghỉ», người «manh», lý do «thước = kit từ 23/09»:
- cong-tu-canh-minh: bản đồ nay do scripts/product-map.mjs của kit canh
  (#128); suite-keys đã đỏ từ khi owner gộp lại build+typecheck (4d8dd32).
- gate-tooling-t1, stale-scope-by-paths: canh staleness theo paths của cổng
  fork đã xoá ở #129; kit tính trên cả cây, lời hứa không còn ai thực thi.
- gate-scope-anchors: nửa namespace chết theo cổng fork; nửa own-range vẫn
  xanh nhưng thôi được hồ sơ đã ký bảo chứng.
contract/evidence/run-log của các hồ sơ này không đổi byte nào.

Xoá: scripts/ci/check-product-map.mjs + -teeth.sh; tám guard chỉ canh
cổng fork (check-stale-scoping, check-scoping-all-cases,
check-golden-dead-code-absent, check-fork-scope-teeth, check-t1-escape-path,
check-no-stale-empty-diff, check-stale-real-repo, test-scope-namespace) và
fixtures.sh chỉ hai trong số đó dùng; 35 khoá config chỉ hồ sơ nghỉ dùng.
lcm_pmap và mhb_existing_guards trỏ sang bộ đọc bản đồ của kit (cùng lệnh
bước CI). PRODUCT-MAP.md sinh lại bằng kit: bốn mục mang nhãn «đã nghỉ».

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .github/workflows/ci.yml                      |   8 +-
 PRODUCT-MAP.md                                |   8 +-
 _acceptance/config.yaml                       |  68 +-
 _acceptance/cong-tu-canh-minh/decisions.jsonl |   1 +
 .../gate-scope-anchors/decisions.jsonl        |   1 +
 _acceptance/gate-tooling-t1/decisions.jsonl   |   1 +
 .../stale-scope-by-paths/decisions.jsonl      |   1 +
 scripts/acceptance/check-fork-scope-teeth.sh  | 132 ---
 .../check-golden-dead-code-absent.sh          |  54 --
 .../acceptance/check-no-stale-empty-diff.sh   |  59 --
 scripts/acceptance/check-scoping-all-cases.sh |  62 --
 scripts/acceptance/check-stale-real-repo.sh   |  98 --
 scripts/acceptance/check-stale-scoping.sh     | 759 ----------------
 scripts/acceptance/check-t1-escape-path.sh    | 101 ---
 scripts/acceptance/fixtures.sh                | 839 ------------------
 scripts/acceptance/test-scope-namespace.sh    | 223 -----
 scripts/ci/check-product-map-teeth.sh         | 325 -------
 scripts/ci/check-product-map.mjs              | 337 -------
 18 files changed, 28 insertions(+), 3049 deletions(-)
 delete mode 100755 scripts/acceptance/check-fork-scope-teeth.sh
 delete mode 100755 scripts/acceptance/check-golden-dead-code-absent.sh
 delete mode 100755 scripts/acceptance/check-no-stale-empty-diff.sh
 delete mode 100755 scripts/acceptance/check-scoping-all-cases.sh
 delete mode 100755 scripts/acceptance/check-stale-real-repo.sh
 delete mode 100755 scripts/acceptance/check-stale-scoping.sh
 delete mode 100755 scripts/acceptance/check-t1-escape-path.sh
 delete mode 100644 scripts/acceptance/fixtures.sh
 delete mode 100755 scripts/acceptance/test-scope-namespace.sh
 delete mode 100755 scripts/ci/check-product-map-teeth.sh
 delete mode 100755 scripts/ci/check-product-map.mjs

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fd34a388..ae65899e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -161,10 +161,10 @@ jobs:
         run: bash scripts/roadmap/check-roadmap-fresh.sh
 
       # The kit's own reader, not a home-made one: owner decision 23/09. The
-      # home-made scripts/ci/check-product-map.mjs (0d9f5ac, 31/08) describes a
-      # different state model and cannot be green at the same time as the kit's
-      # map. It stays on disk only because signed evidence (cong-tu-canh-minh)
-      # names it as a verifier; it no longer runs in CI.
+      # home-made scripts/ci/check-product-map.mjs (0d9f5ac, 31/08) described a
+      # different state model and could not be green at the same time as the
+      # kit's map. It was deleted on 23/09 once cong-tu-canh-minh, the signed
+      # dossier naming it as a verifier, was retired (owner: manh).
       - name: Product map freshness
         run: node "$CLAUDE_PLUGIN_ROOT/scripts/product-map.mjs" --root . --check
 
diff --git a/PRODUCT-MAP.md b/PRODUCT-MAP.md
index 757e7a8f..bb560408 100644
--- a/PRODUCT-MAP.md
+++ b/PRODUCT-MAP.md
@@ -40,11 +40,11 @@ flowchart TD
 - CI-a — vitest vào CI + gỡ ghim SDK cứng của guard overlay (khử mìn hạ tầng verify) (`ci-vitest-sdk-pin`)
 - slot dán chữ/khung giá/logo/safe-zone lên ảnh & video (Phase 1.2) (`compose-overlay`)
 - Conformance L0 — pluginRev, node_cached contract, TS↔Python conformance suite (`conformance-l0`)
-- Cổng tự canh mình — hai guard vào CI, và suite verify thôi tự đốt vòng (`cong-tu-canh-minh`)
+- Cổng tự canh mình — hai guard vào CI, và suite verify thôi tự đốt vòng (`cong-tu-canh-minh`) — đã giao — đã nghỉ, giữ sử liệu
 - Đăng ký fork oneflow-api-openai vào manifest chính thức (`dang-ky-fork-openai`)
 - Dependency refresh — five pending dependabot updates (`dependency-refresh-2026-07`)
-- Gate 0.6 — cùng-không-gian cho scope paths + neo lịch sử cho eval per-PR (`gate-scope-anchors`)
-- Gate tooling × t1_skip_globs — đường hợp lệ để sửa guard, và trả ba nợ 0.8 (`gate-tooling-t1`)
+- Gate 0.6 — cùng-không-gian cho scope paths + neo lịch sử cho eval per-PR (`gate-scope-anchors`) — đã giao — đã nghỉ, giữ sử liệu
+- Gate tooling × t1_skip_globs — đường hợp lệ để sửa guard, và trả ba nợ 0.8 (`gate-tooling-t1`) — đã giao — đã nghỉ, giữ sử liệu
 - Hai đường chạy, một venv — engine Python dùng venv per-plugin như bên TypeScript, thôi nuốt lỗi cấp phát (`hai-duong-chay-mot-venv`)
 - Hàng rào thôi đọc nhầm "không đo được" thành "không có gì sai" (`hang-rao-doc-nham-loi-thanh-khong-co-gi`)
 - Kho khoá toàn vẹn — đọc không cắt bớt âm thầm, ghi không để lại file cụt (`kho-khoa-toan-ven`)
@@ -64,7 +64,7 @@ flowchart TD
 - Plugin scanner reads imports by scope boundary, and says why a slot was skipped (`scan-with-block-imports`)
 - Publish the SDK as oneflow-sdk while keeping the tongflow import package (`sdk-distribution-rename`)
 - Skill system v1 — manifest tham số, template, orchestrator v1, ngăn skill và xem/sửa kế hoạch; skill thứ hai không đụng engine (`skill-system-v1`)
-- Scope evidence staleness by declared eval paths (`stale-scope-by-paths`)
+- Scope evidence staleness by declared eval paths (`stale-scope-by-paths`) — đã giao — đã nghỉ, giữ sử liệu
 - Per-task metering columns and measured plugin duration (`task-metering`)
 
 ## Đã nghiệm thu giá trị
diff --git a/_acceptance/config.yaml b/_acceptance/config.yaml
index 220ec635..06d2abed 100644
--- a/_acceptance/config.yaml
+++ b/_acceptance/config.yaml
@@ -387,20 +387,11 @@ executors:
     # ---- hai-duong-chay-mot-venv (B4) ----
     hdc_layout_constant_pinned: "bash scripts/plugins/check-venv-layout-pinned.sh"
     hdc_layout_constant_teeth: "bash scripts/plugins/check-venv-layout-teeth.sh"
-    # --- cong-tu-canh-minh (31/08) ---
-    # Bo kiem ban do + rang cua no. Dat o scripts/ci/ chu khong scripts/roadmap/
-    # hay scripts/acceptance/ vi gia re-pin: 0 vs 1 vs 2 ho so (do tren paths da
-    # khai cua 29 ho so).
+    # --- cong-tu-canh-minh (31/08) --- khoa pmap_* (thuoc ban do rieng
+    # scripts/ci/check-product-map*.{mjs,sh}) da go 23/09: ho so nghi (thuoc =
+    # kit, #128/#129), ban do nay do scripts/product-map.mjs cua kit canh.
     kkt_seam_signature: "bash scripts/settings/check-env-store-teeth.sh --case seam-signature"
     kkt_teeth_all: "bash scripts/settings/check-env-store-teeth.sh"
-    pmap_check: "node scripts/ci/check-product-map.mjs"
-    pmap_teeth_all: "bash scripts/ci/check-product-map-teeth.sh"
-    pmap_teeth_missing_slug: "bash scripts/ci/check-product-map-teeth.sh --case missing-slug"
-    pmap_teeth_count: "bash scripts/ci/check-product-map-teeth.sh --case count-mismatch"
-    pmap_teeth_opportunity: "bash scripts/ci/check-product-map-teeth.sh --case opportunity-mismatch"
-    pmap_teeth_unreadable: "bash scripts/ci/check-product-map-teeth.sh --case artifact-missing --case artifact-unreadable"
-    pmap_teeth_extra_slug: "bash scripts/ci/check-product-map-teeth.sh --case extra-slug --case status-downgraded"
-    pmap_teeth_source_buckets: "bash scripts/ci/check-product-map-teeth.sh --case contract-unparsable --case status-unknown --case dir-empty"
     # Lo mu cua guard lo trinh: no so TAP slug trong khoi marker nen dong trung
     # vo hinh. Do 31/08: so cai CO dong trung normalize-text-vi ma guard van xanh.
     roadmap_fresh: "bash scripts/roadmap/check-roadmap-fresh.sh"
@@ -430,7 +421,11 @@ executors:
     # ho so nay (do tren cay eb175ed). Ve «la mot suite key» cua AC-9 do bang
     # phep khang dinh truc tiep ben duoi. Phat hien ngoai hop dong -> Cong 2.
     lcm_wiring: "bash scripts/ci/check-gate-guards-job.sh shape && bash scripts/ci/check-gate-guards-job.sh reachable && bash scripts/ci/check-gate-guards-job.sh teeth && bash scripts/roadmap/check-plan-suite-key.sh"
-    lcm_pmap: "node scripts/ci/check-product-map.mjs && bash scripts/ci/check-product-map-teeth.sh --case parked-opportunity"
+    # 23/09: tro sang bo doc ban do cua kit ghim KIT_SHA (cung lenh buoc CI
+    # «Product map freshness»); thuoc rieng check-product-map.mjs va case rang
+    # parked-opportunity cua no da xoa — rang do kit tu canh. Ban do kit van in
+    # «Xep lai sau 3 viec» dung ba co hoi park cua AC-11.
+    lcm_pmap: "node \"$CLAUDE_PLUGIN_ROOT/scripts/product-map.mjs\" --root . --check"
     # --- mo-hoa-b01 (05/09) --- guard dinh danh fork + rang, MOT khoa moi ca (khuon lcm_*).
     fork_identity: "bash scripts/fork/check-fork-identity.sh"
     mhb_teeth_all: "bash scripts/fork/check-fork-identity-teeth.sh"
@@ -443,7 +438,7 @@ executors:
     mhb_teeth_notice: "bash scripts/fork/check-fork-identity-teeth.sh --case notice-dist-gone && bash scripts/fork/check-fork-identity-teeth.sh --case notice-unchanged-back && bash scripts/fork/check-fork-identity-teeth.sh --case notice-attribution-gone"
     mhb_prototype_lane: "bash scripts/fork/check-prototype-lane.sh mo-hoa-b01 && bash scripts/fork/check-fork-identity-teeth.sh --case debt-table-missing && bash scripts/fork/check-fork-identity-teeth.sh --case debt-table-duplicate"
     mhb_wiring: "bash scripts/ci/check-gate-guards-job.sh shape && bash scripts/ci/check-gate-guards-job.sh reachable && bash scripts/ci/check-gate-guards-job.sh teeth && bash scripts/fork/check-suite-key.sh fork_identity check-fork-identity.sh && bash scripts/fork/check-fork-identity-teeth.sh --case suite-key-dangling"
-    mhb_existing_guards: "bash scripts/plugins/check-live-docs-manifest-synced.sh readme && bash scripts/plugins/check-live-docs-manifest-synced.sh claude && bash scripts/plugins/check-live-docs-manifest-synced.sh orphans origin/main && bash scripts/plugins/check-manifest-doc-synced.sh && bash scripts/plugins/check-prefix-docs.sh && bash scripts/ci/check-action-pins.sh && bash scripts/ci/check-docker-dryrun.sh && node scripts/roadmap/check-plan-freeze.mjs && bash scripts/roadmap/check-plan-docs.sh && bash scripts/roadmap/check-roadmap-fresh.sh && node scripts/ci/check-product-map.mjs"
+    mhb_existing_guards: "bash scripts/plugins/check-live-docs-manifest-synced.sh readme && bash scripts/plugins/check-live-docs-manifest-synced.sh claude && bash scripts/plugins/check-live-docs-manifest-synced.sh orphans origin/main && bash scripts/plugins/check-manifest-doc-synced.sh && bash scripts/plugins/check-prefix-docs.sh && bash scripts/ci/check-action-pins.sh && bash scripts/ci/check-docker-dryrun.sh && node scripts/roadmap/check-plan-freeze.mjs && bash scripts/roadmap/check-plan-docs.sh && bash scripts/roadmap/check-roadmap-fresh.sh && node \"$CLAUDE_PLUGIN_ROOT/scripts/product-map.mjs\" --root . --check"
     # Job CI: rut lenh RA TU ci.yml roi CHAY no, theo khuon check-vitest-job.sh.
     # Doc YAML la do chi dan; chay lenh rut ra moi la do hanh vi.
     # o-do-chay-0-ca-van-xanh: mot o do loc theo ten ca ma khong ca nao khop
@@ -528,39 +523,11 @@ executors:
     # conformance-l0 Gate 1 (2026-07-28).
     conformance_discriminating: bash scripts/conformance/check-suite-discriminating.sh
     plugin_rev_joined_path: pnpm tsx scripts/plugins/check-rev-joined-path.ts
-    # stale-scope-by-paths Gate 1 (2026-07-28): every file below lands during
-    # implementation. These live under scripts/acceptance/ on purpose — the
-    # t1_skip_globs exemption for the gate tooling lists EXACT paths, so a guard
-    # in a new subdirectory is gated and the gate applies to itself.
-    # One key per eval, same guard with a different --case: nine evals behind one
-    # command collapse nine criteria into one exit code, and a case that was
-    # never implemented then looks identical to a case that passed.
-    stale_scope_in_scope: bash scripts/acceptance/check-stale-scoping.sh --case in-scope
-    stale_scope_out_of_scope: bash scripts/acceptance/check-stale-scoping.sh --case out-of-scope
-    stale_scope_partial: bash scripts/acceptance/check-stale-scoping.sh --case partial
-    stale_scope_under_declared: bash scripts/acceptance/check-stale-scoping.sh --case under-declared
-    stale_scope_malformed: bash scripts/acceptance/check-stale-scoping.sh --case malformed
-    stale_scope_indent_drift: bash scripts/acceptance/check-stale-scoping.sh --case indent-drift
-    stale_scope_merged_halves: bash scripts/acceptance/check-stale-scoping.sh --case merged-halves
-    stale_scope_suppression: bash scripts/acceptance/check-stale-scoping.sh --case suppression
-    stale_scope_two_bases: bash scripts/acceptance/check-stale-scoping.sh --case two-bases
-    stale_scope_announce: bash scripts/acceptance/check-stale-scoping.sh --case announce
-    stale_scope_mutation: bash scripts/acceptance/check-stale-scoping.sh --case mutation
-    stale_scope_case_completeness: bash scripts/acceptance/check-stale-scoping.sh --case case-completeness
-    stale_scope_guard_not_exempt: bash scripts/acceptance/check-stale-scoping.sh --case guard-not-exempt
-    stale_scope_no_kill_switch: bash scripts/acceptance/check-stale-scoping.sh --case no-kill-switch
-    stale_scope_real_repo: bash scripts/acceptance/check-stale-real-repo.sh
-    # gate-tooling-t1 (item 0.8). Ba case MỚI của check-stale-scoping.sh giữ
-    # tiền tố stale_scope_* vì chúng là case của guard đó; các guard mới đứng
-    # riêng mang tiền tố gt1_. Một key cho một eval — xem đầu evals.yaml.
-    stale_scope_fork_undeclared: bash scripts/acceptance/check-stale-scoping.sh --case fork-undeclared
-    stale_scope_fork_declared_in_union: bash scripts/acceptance/check-stale-scoping.sh --case fork-declared-in-union
-    stale_scope_undeclared: bash scripts/acceptance/check-stale-scoping.sh --case undeclared
-    gt1_t1_escape_path: bash scripts/acceptance/check-t1-escape-path.sh
-    gt1_all_scoping_cases: bash scripts/acceptance/check-scoping-all-cases.sh
-    gt1_dead_code_absent: bash scripts/acceptance/check-golden-dead-code-absent.sh
-    gt1_fork_teeth: bash scripts/acceptance/check-fork-scope-teeth.sh
-    gt1_no_stale_on_empty_diff: bash scripts/acceptance/check-no-stale-empty-diff.sh
+    # stale-scope-by-paths / gate-tooling-t1 / gate-scope-anchors: cac khoa
+    # stale_scope_*, gt1_* (5 khoa) va scope_ns_*/gate_ns_* da go 23/09 cung
+    # guard cua chung — chung canh co che staleness theo paths cua cong fork da
+    # xoa o #129, ca ba ho so nghi (thuoc = kit). Khoa con lai ben duoi tro vao
+    # script con song.
     gt1_no_golden_claim: bash scripts/acceptance/check-no-golden-claim.sh
     gt1_landed_merge_repinned: bash scripts/acceptance/check-landed-merge-repinned.sh
     # roadmap-drift-guard Gate 1 (2026-08-27). MỘT khoá cho MỖI case: bộ răng cũ
@@ -577,12 +544,9 @@ executors:
     roadmap_teeth_supersede_source_single: bash scripts/roadmap/check-roadmap-guard-teeth.sh --case supersede-source-single
     roadmap_teeth_case_isolation: bash scripts/roadmap/check-roadmap-guard-teeth.sh --case case-isolation
     own_range_case_completeness: bash scripts/acceptance/test-own-range.sh case-completeness
-    scope_ns_case_completeness: bash scripts/acceptance/test-scope-namespace.sh case-completeness
-    # gate-scope-anchors (0.6): same-universe scope check + historical anchors.
+    # gate-scope-anchors (0.6): historical anchors (own-range); the scope
+    # namespace half died with the fork gate (#129).
     # b2_* and ghcr_anchored hit the network (gh) — local verify only, not CI.
-    gate_ns_exempt_refused: bash scripts/acceptance/test-scope-namespace.sh exempt-refused
-    gate_ns_variants_red: bash scripts/acceptance/test-scope-namespace.sh variants-discriminating
-    gate_ns_legit_granted: bash scripts/acceptance/test-scope-namespace.sh legit-granted
     own_range_anchored: bash scripts/acceptance/test-own-range.sh anchored
     own_range_unlanded: bash scripts/acceptance/test-own-range.sh unlanded
     own_range_malformed: bash scripts/acceptance/test-own-range.sh malformed
diff --git a/_acceptance/cong-tu-canh-minh/decisions.jsonl b/_acceptance/cong-tu-canh-minh/decisions.jsonl
index 6d372ad0..bea3dd86 100644
--- a/_acceptance/cong-tu-canh-minh/decisions.jsonl
+++ b/_acceptance/cong-tu-canh-minh/decisions.jsonl
@@ -17,3 +17,4 @@
 {"id":"d-20260831T140000Z-2093","type":"approach","stage":"gate2","at":"2026-08-31T14:00:00Z","decision":"Ngoai-1 (guard nuot tham so la) — owner chon ghi Known limits, nhan ban sua vao goi nay","impact":"tiet kiem: mot dong lenh go sai trong ci.yml khong con doc ra thanh da-kiem-sach · rui ro: khong tieu chi nao do truc tiep hanh vi tu choi do, no duoc giu gian tiep boi ve guard-of-the-guard cua E8"}
 {"id":"d-20260831T140100Z-7746","type":"approach","stage":"gate2","at":"2026-08-31T14:01:00Z","decision":"Ngoai-2 (nghi van cong bo qua staleness) — owner chon mo ho so moi staleness-ho-so-thieu-paths","impact":"tiet kiem: khong sua mu mot chot chan CI · rui ro: neu dung la fail-open thi no van mo cho toi khi ho so moi chay xong"}
 {"id": "d-20260831T150000Z-3382", "type": "fix", "stage": "S5", "at": "2026-08-31T15:00:00Z", "decision": "Them dong so cai lo trinh cho chinh ho so nay, va viet no KHONG dung nhay nguoc", "impact": "tiet kiem: CI xanh · rui ro: so cai doc MOI tu trong nhay nguoc la mot slug, nen dong nao chua ten lenh trong nhay se sinh slug ma — gioi han co san cua guard, khong phai loi goi nay"}
+{"id":"d-20260923T074315Z-20","type":"nghi","stage":"gate2","at":"2026-09-23T07:43:15Z","by":"manh","decision":"thước = kit từ 23/09","impact":"hồ sơ thôi hứa: bản đồ PRODUCT-MAP.md khớp hồ sơ theo thước riêng scripts/ci/check-product-map.mjs (AC-1..4, 10..12; nay bước CI Product map freshness chạy bộ đọc của kit ở KIT_SHA, #128) và suite_keys tách build/typecheck (AC-8; owner gộp lại 02/09 ở 4d8dd32). Guard sổ cái, nối dây job và a11y-dist-dir vẫn chạy nhưng không còn hồ sơ này bảo chứng"}
diff --git a/_acceptance/gate-scope-anchors/decisions.jsonl b/_acceptance/gate-scope-anchors/decisions.jsonl
index 39f85c6b..e36b0d25 100644
--- a/_acceptance/gate-scope-anchors/decisions.jsonl
+++ b/_acceptance/gate-scope-anchors/decisions.jsonl
@@ -16,3 +16,4 @@
 {"id":"d-20260804T220000Z-11216","type":"fix","stage":"S4-r3","at":"2026-08-04T22:00:00Z","decision":"Dong finding HIGH vong 3: cua so registry cua check-ghcr-untouched khoa theo CO-SLUG thay vi CO-HA-CANH. Feature da neo nhung chua merge -> anchor_tip tra HEAD -> UNTIL = ngay commit hom nay, som hon SINCE (createdAt cua run dispatch) -> cua so RONG -> jq khong chon gi -> in ok va exit 0, nuot mat mot ban publish that. Da repro bang so lieu that truoc khi sua","impact":"tiet kiem: dong lo fail-open trong chinh nua doi chung ma Task 5 vua them; them anchor_landed (hoi DA-HA-CANH-CHUA, khac han anchor_tip hoi CAY-NAO) va assert_window_sane (cua so ket thuc truoc khi bat dau = cau hoi khong tra loi duoc = exit 2). Doi lai: mot ham nua trong gh-run-lib","serves":["AC-9"]}
 {"id":"d-20260804T220001Z-11217","type":"revisit","stage":"S4-r3","at":"2026-08-04T22:00:01Z","decision":"Ba vong nghiem thu lien tiep, moi vong tim dung MOT loi that trong code cua toi, va ca ba deu cung mot loi tu duy: gan mot cau hoi vao DIEU KIEN GAN DUNG thay vi dieu kien that (exit trong subshell; slug-co-mat thay cho neo-giai-duoc; slug-co-mat thay cho da-ha-canh)","impact":"chi phi: ~2.8M token/vong. Gia tri bien van duong nhung dang giam dan va deu roi vao MOT ho loi da co ten","revisit":"Trinh Manh o Cong 2: chay vong 4 hay dung lai. Lap luan de dung: ho loi da duoc dat ten va nay co guard thi hanh (assert_window_sane, set -e invariant, ba poison value); lap luan de chay tiep: ba vong deu khong rong"}
 {"id":"d-20260804T221500Z-11218","type":"fix","stage":"S4-r3","at":"2026-08-04T22:15:00Z","decision":"Dong finding LOW nhung TRONG hop dong: scope_has_any_match doc ls-files KHONG co core.quotePath=false, trong khi stale_files doc diff CO — git mac dinh quote path phi-ASCII, nen hai ben danh van khac nhau (\"src/lib/caf\\303\\251.ts\" vs src/lib/cafe.ts). Da xac minh bang fixture that","impact":"huong lech la fail-CLOSED (tu choi scope oan) chu khong phai lo hong; nhung chinh chu thich toi viet khang dinh hai ben hoi cung mot khong gian — khang dinh do phai dung. Sua mot co, them ca kiem vao E3, mutation-test", "serves":["AC-1","AC-3"]}
+{"id":"d-20260923T074315Z-19","type":"nghi","stage":"gate2","at":"2026-09-23T07:43:15Z","by":"manh","decision":"thước = kit từ 23/09","impact":"hồ sơ thôi hứa cả hai nửa: AC-1..3 không gian tên paths của cổng fork (đã xoá ở #129, kit không đọc paths); AC-4..12 neo own-range vẫn có script sống và test-own-range.sh vẫn xanh nhưng không còn hồ sơ đã ký bảo chứng"}
diff --git a/_acceptance/gate-tooling-t1/decisions.jsonl b/_acceptance/gate-tooling-t1/decisions.jsonl
index ba5c65cc..3b7508c2 100644
--- a/_acceptance/gate-tooling-t1/decisions.jsonl
+++ b/_acceptance/gate-tooling-t1/decisions.jsonl
@@ -1,3 +1,4 @@
 {"id":"d-20260828T031500Z-scope","type":"descope","stage":"gate2","at":"2026-08-28T03:15:00Z","decision":"Thu hẹp phạm vi gate-tooling-t1: hồ sơ đóng vế (i) của nợ 0.8 (PR sửa guard không còn nổ VIOLATION [PR] t1-escape) và KHÔNG đóng vế (ii) (PR đó vẫn làm cũ pin đã ký). Đo 28/08: PR chỉ sửa scripts/acceptance/** kèm artifact sinh 3 violation staleness — measure-harness, task-metering (đều khai scripts/**), stale-scope-by-paths (khai chính scripts/acceptance/**). Phát hiện bởi gap-probe P0-1, xác minh lại trên cây thật bởi orchestrator (critic nêu 2 slug, thực tế 3).","impact":"Câu 'nợ 0.8 đã đóng' bị thu hẹp trong Context và khai vào Out of scope. KHÔNG AC nào đổi, KHÔNG eval nào nới — 13 eval vẫn khẳng định đúng thứ chúng vẫn khẳng định. Vế (ii) thành nợ có tên, cần contract kế; đường ra đã biết (bỏ khai paths ở 3 eval thường trực của measure-harness/task-metering) nhưng chạm _acceptance/<slug>/ của hai feature khác nên phải đi kèm wave của chúng."}
 {"id":"d-20260828T032000Z-ac12","type":"approach","stage":"gate2","at":"2026-08-28T03:20:00Z","decision":"AC-12 (giữ / thu hẹp / bỏ khai paths cho measure-harness và task-metering): hướng được chọn là BỎ KHAI, theo phán quyết PASS của blind judge. Căn cứ đo được trên cửa sổ a788985..d919b5e: 81 file gated đổi, union loại ra đúng 9, 72 file còn lại rơi trong union và vẫn làm hai feature stale — lời khai paths tiết kiệm 0 vòng re-verify; quét 33 commit first-parent không commit nào có toàn bộ file gated ngoài union. Union sai cả hai chiều: scripts/** khai thừa mọi guard shell (biome Checked 0 files), sdk/** khai thiếu dù eval biome đọc sdk/**/*.json.","impact":"Ghi lại để khuyến nghị của judge có nơi hạ cánh thay vì mất trong một đoạn văn (gap-probe P1-4). CHƯA THI HÀNH trong hồ sơ này: thực thi chạm _acceptance/measure-harness/ và _acceptance/task-metering/, tức mở lại phép soi staleness của chúng, nên phải đi ké wave của hai feature đó. Việc thi hành thuộc contract kế, cùng chỗ với vế (ii) của d-20260828T031500Z-scope."}
 {"id":"d-20260828T032500Z-amend","type":"amendment","stage":"gate2","at":"2026-08-28T03:25:00Z","decision":"Amendment 1 (AC-5 bỏ con số cứng '14 case') được duyệt tại chỗ bởi Manh ngày 28/08, cùng lượt duyệt Amendment 2. Amendment 1 viết ngày 27/08 sau vòng verify 1 mà chưa có dòng người duyệt — gap-probe P1-5 bắt được.","impact":"Frontmatter thêm amended_at: 2026-08-28 để phân biệt bản trước và sau sửa. Khoảng hở còn lại, khai thẳng: AC-5 nay lấy phạm vi từ chính vật bị đo (KNOWN_CASES) và KHÔNG có sàn, nên tập case có thể CO lại mà E6 vẫn xanh (gap-probe P0-3) — nợ chuyển contract kế, không vá ở đây."}
+{"id":"d-20260923T074315Z-4","type":"nghi","stage":"gate2","at":"2026-09-23T07:43:15Z","by":"manh","decision":"thước = kit từ 23/09","impact":"hồ sơ thôi hứa về fork STALE-DIFF-SCOPE-GUARD và staleness theo paths trong scripts/pre-merge-check.sh chép vào kho; bản chép đã xoá ở #129, cổng nay là kit ghim sha và kit tính staleness trên cả cây, không đọc paths"}
diff --git a/_acceptance/stale-scope-by-paths/decisions.jsonl b/_acceptance/stale-scope-by-paths/decisions.jsonl
index f0170064..8c25c475 100644
--- a/_acceptance/stale-scope-by-paths/decisions.jsonl
+++ b/_acceptance/stale-scope-by-paths/decisions.jsonl
@@ -17,3 +17,4 @@
 {"id":"d-20260729T095807Z-19845","type":"descope","stage":"gate2","at":"2026-07-29T09:58:07Z","decision":"KHÔNG vá lỗi 'scope toàn glob t1-exempt thì vĩnh viễn rỗng' trong feature này — mở contract riêng, gộp cùng chiều 'ngữ nghĩa không gian tên + coverage-set' mà hợp đồng hiện thiếu","impact":"human quyết ở Cổng 2. Vá lẻ 4 lần trước đều lòi biến thể kế tiếp, nên trục đúng là mở AC cho chính chiều đó chứ không thêm AC lẻ thứ 5. Đổi lại: ship bản này với một fail-open HIGH đã biết — một feature docs-only khai paths trung thực vẫn tự miễn nhiễm cảnh báo cũ","revisit":"Contract riêng ngay sau khi feature này merge"}
 {"id":"d-20260729T095807Z-29062","type":"descope","stage":"gate2","at":"2026-07-29T09:58:07Z","decision":"KHÔNG dịch ~265 dòng tiếng Việt + ≥14 thông điệp CI trong feature này — mở contract riêng","impact":"human quyết ở Cổng 2. Chúng thuộc file vendor của kit nên sửa tay sẽ bị ghi đè ở lần bump sau; việc thật là quyết định chính sách (xin upstream dịch, hay ghi ngoại lệ vendor vào CLAUDE.md/CONTRIBUTING.md). Đổi lại repo AGPL hướng contributor ngoài vẫn in thông điệp CI hai thứ tiếng cho tới lúc đó","revisit":"Contract riêng"}
 {"id": "d-20260805T190000Z-31447", "type": "descope", "stage": "gate2", "at": "2026-08-05T19:00:00Z", "decision": "Gỡ E3 (stale_scoping_golden) khỏi bộ eval. Golden của nó đóng băng PHÁN QUYẾT staleness của 7 feature khai 0 paths, không phải HÀNH VI scoping — nên nó không có trạng thái ổn định nào: để nguyên thì đỏ sau mọi wave re-pin thành công (đo được: exit 0 trước khi ghim, exit 1 sau khi ghim, cùng một cây); regen về 7 dòng OK thì đỏ ở nhánh sau khi 7 feature đó stale trở lại. Phát hiện trong wave của ci-vitest-sdk-pin, 05/08.", "impact": "AC-3 mất eval máy trực tiếp cho MỆNH ĐỀ (a) (khai 0 paths + thay đổi gated → vẫn báo stale). Hai mệnh đề còn lại (b) không thêm dòng output, (c) không được cấp narrow scope — vẫn được E15 (announce) khẳng định thẳng trên fixture mode `none` (zero paths). Bản đầu của entry này nói quá khoảng hở; sửa lại sau vòng verify context sạch 05/08. Vá = một dòng grep vào $d2 sẵn có trong case_announce, không cần case mới. check-stale-golden.sh, fixture của nó, và key executor stale_scoping_golden trong config.yaml được GIỮ LẠI ở lượt này (xoá là chạm scripts/** và kích lại treadmill staleness) — code chết, và guard đó chạy tay sẽ ĐỎ, đừng nhầm là gate hỏng. SỬA 27/08: cả ba mảnh đã được xoá ở PR #76 dưới hồ sơ gate-tooling-t1 (item 0.8b); lý do hoãn nói trên hết hiệu lực từ 97b5b12 (17/08) — đo được là commit chỉ chạm scripts/** sinh 0 stale violation."}
+{"id":"d-20260923T074315Z-20","type":"nghi","stage":"gate2","at":"2026-09-23T07:43:15Z","by":"manh","decision":"thước = kit từ 23/09","impact":"hồ sơ thôi hứa staleness theo paths đã khai: cổng fork mang cơ chế này đã xoá ở #129; kit ghim sha tính staleness trên cả cây ngoài t1_skip_globs, nên lời hứa này không còn ai thực thi, không phải do kit canh thay"}
diff --git a/scripts/acceptance/check-fork-scope-teeth.sh b/scripts/acceptance/check-fork-scope-teeth.sh
deleted file mode 100755
index 4b790924..00000000
--- a/scripts/acceptance/check-fork-scope-teeth.sh
+++ /dev/null
@@ -1,132 +0,0 @@
-#!/usr/bin/env bash
-# E9 / AC-8 of gate-tooling-t1 — teeth for the STALE-DIFF-SCOPE-GUARD fork.
-#
-# WHY THIS EXISTS. The fork lives inside scripts/pre-merge-check.sh, which
-# risk_tiers.t1_skip_globs exempts BY NAME. The exemption is there so upgrading
-# the measuring stick does not stale signed evidence — but it also means a
-# change to this fork's semantics touches no gated file, stales nothing, and
-# trips no t1-escape. It is the one place in the gate where behaviour can change
-# without any acceptance artifact being required. Measured cost of that hole:
-# the fork landed on 2026-08-17 and silently disabled five of check-stale-
-# scoping.sh's fourteen cases for ten days, including the one the E3 descope
-# decision was relying on.
-#
-# WHAT IT PINS. Two perturbations, each on a COPY of the tree (the working tree
-# is never edited, and the shipped gate carries no knob — AC-13):
-#   (1) revert the narrowing → the fork wraps the WHOLE staleness block again
-#       for every slug outside the diff. `fork-declared-in-union` must go RED:
-#       that is AC-2 of stale-scope-by-paths losing its only observable form.
-#   (2) remove the fork entirely (`if false`) → every merged feature is examined
-#       again. `fork-undeclared` must go RED: that is the treadmill re-opening
-#       for the 19 features that never declared `paths`.
-# Each perturbation must be shown to have actually changed the file, and each
-# must go green again when reverted — a patch whose target moved would otherwise
-# make this guard quietly stop testing anything, which is the exact failure mode
-# it is built to rule out.
-set -euo pipefail
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"; cd "$ROOT"
-GATE_REL=scripts/pre-merge-check.sh
-MARKER='# STALE-DIFF-SCOPE-GUARD'
-WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT
-fails=0
-
-echo "check-fork-scope-teeth:"
-
-# ── Anti-vacuous layer ──────────────────────────────────────────────────────
-# The perturbations below rewrite the two lines around a single marker. If the
-# marker moved, vanished, or multiplied, every patch becomes a no-op and this
-# guard reports OK having proved nothing.
-# The OPENING condition is the only line that ENDS with the marker; the closing
-# `fi` carries it mid-line ("# đóng STALE-...") and is deliberately not counted.
-# Measured, not assumed: `grep -c 'STALE-DIFF-SCOPE-GUARD'` is 2, `grep -c
-# '# STALE-DIFF-SCOPE-GUARD$'` is 1.
-open_n="$(grep -c "$MARKER\$" "$GATE_REL" || true)"
-any_n="$(grep -c 'STALE-DIFF-SCOPE-GUARD' "$GATE_REL" || true)"
-if [ "$open_n" -ne 1 ] || [ "$any_n" -lt 2 ]; then
-  echo "FAIL anti-vacuous: expected exactly ONE line ending in '$MARKER' (the opening condition) and at least two mentions overall in $GATE_REL; found open=$open_n any=$any_n — the perturbation targets have moved, so nothing below would test anything"
-  exit 1
-fi
-gate_sha_before="$(git hash-object "$GATE_REL")"
-echo "  ok   anti-vacuous: opening marker unique, fork block still present"
-
-# ── Build a pristine mini-root the scoping guard can run inside ─────────────
-# scripts/ + lib/ + _acceptance/config.yaml is everything check-stale-scoping.sh
-# reads from ROOT; its fixtures build their own git repos under TMPDIR.
-PRISTINE="$WORK/pristine"
-mkdir -p "$PRISTINE/_acceptance"
-cp -R scripts "$PRISTINE/scripts"
-cp -R lib "$PRISTINE/lib"
-cp _acceptance/config.yaml "$PRISTINE/_acceptance/config.yaml"
-
-# Replace the two-line fork condition with a single given line. Pure awk, using
-# a one-line lookbehind: the marker sits on the CONTINUATION line, so the line
-# before it (ending in a backslash) is part of the same condition and must go
-# with it.
-patch_condition() { # <src-gate> <dst-gate> <replacement-line>
-  awk -v repl="$3" '
-    $0 ~ /# STALE-DIFF-SCOPE-GUARD$/ && prev ~ /\\$/ && !done {
-      print repl; done = 1; prev = ""; next
-    }
-    prev != "" { print prev }
-    { prev = $0 }
-    END { if (prev != "") print prev }
-  ' "$1" > "$2"
-}
-
-run_case() { # <root> <case> -> exit code
-  bash "$1/scripts/acceptance/check-stale-scoping.sh" --case "$2" >/dev/null 2>&1 && echo 0 || echo 1
-}
-
-probe() { # <label> <replacement-line> <case-that-must-go-red> <case-that-must-stay-green>
-  local label="$1" repl="$2" red="$3" green="$4"
-  local root="$WORK/$label"
-  rm -rf "$root"; cp -R "$PRISTINE" "$root"
-
-  # Baseline on this copy — if it is not green, the RED below proves nothing.
-  if [ "$(run_case "$root" "$red")" != "0" ]; then
-    echo "  FAIL [$label] baseline: --case $red is already red on an unpatched copy; the perturbation result would be meaningless"
-    fails=$((fails+1)); return
-  fi
-
-  patch_condition "$PRISTINE/$GATE_REL" "$root/$GATE_REL.patched" "$repl"
-  if cmp -s "$PRISTINE/$GATE_REL" "$root/$GATE_REL.patched"; then
-    echo "  FAIL [$label] perturbation patched NOTHING — the fork condition's shape moved, so this probe has silently stopped testing"
-    fails=$((fails+1)); return
-  fi
-  mv "$root/$GATE_REL.patched" "$root/$GATE_REL"
-
-  if [ "$(run_case "$root" "$red")" != "1" ]; then
-    echo "  FAIL [$label] --case $red stayed GREEN under the perturbation — it does not actually pin this half of the fork"
-    fails=$((fails+1)); return
-  fi
-  if [ "$(run_case "$root" "$green")" != "0" ]; then
-    echo "  FAIL [$label] --case $green also went red — the two halves are not independent, so neither says which half broke"
-    fails=$((fails+1)); return
-  fi
-
-  # Revert on the same copy: green again, or the redness above was not caused
-  # by the patch.
-  cp "$PRISTINE/$GATE_REL" "$root/$GATE_REL"
-  if [ "$(run_case "$root" "$red")" != "0" ]; then
-    echo "  FAIL [$label] --case $red stayed red after reverting the perturbation — its redness was not caused by the patch"
-    fails=$((fails+1)); return
-  fi
-  echo "  ok   [$label] --case $red red under the perturbation, green when reverted; --case $green unaffected"
-}
-
-probe revert-narrowing \
-  '  if [ "$DIFF_READY" -eq 1 ] && ! slug_in_diff "$slug"; then # STALE-DIFF-SCOPE-GUARD' \
-  fork-declared-in-union fork-undeclared
-
-probe remove-fork \
-  '  if false; then # STALE-DIFF-SCOPE-GUARD' \
-  fork-undeclared fork-declared-in-union
-
-# ── The working tree must be untouched ──────────────────────────────────────
-if [ "$(git hash-object "$GATE_REL")" != "$gate_sha_before" ]; then
-  echo "  FAIL this guard modified the shipped gate — every perturbation must stay inside the temp copy"
-  fails=$((fails+1))
-fi
-
-[ "$fails" -eq 0 ] || { echo "FAIL: $fails fork-teeth probe(s) failed"; exit 1; }
-echo "OK: both halves of the STALE-DIFF-SCOPE-GUARD fork are pinned by a case that goes red when it changes"
diff --git a/scripts/acceptance/check-golden-dead-code-absent.sh b/scripts/acceptance/check-golden-dead-code-absent.sh
deleted file mode 100755
index 2747f993..00000000
--- a/scripts/acceptance/check-golden-dead-code-absent.sh
+++ /dev/null
@@ -1,54 +0,0 @@
-#!/usr/bin/env bash
-# E8 / AC-7 of gate-tooling-t1. The three dead pieces of the descoped E3
-# stale-golden eval must stay gone: the guard script, its golden fixture, and
-# the `stale_scoping_golden` executor key. Removed in PR #76; this is the
-# regression guard, because a later `vendor the kit` sweep can carry all three
-# back in without anyone noticing — they look like ordinary gate tooling.
-#
-# An absence check is the easiest kind to make vacuous: a typo in a path is
-# indistinguishable from the file being gone. So every absence assertion is
-# paired with a PRESENCE probe proving this script is scanning the right tree
-# in the first place.
-set -euo pipefail
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"; cd "$ROOT"
-fails=0
-
-ok()   { echo "  ok   $1"; }
-bad()  { echo "  FAIL $1"; fails=$((fails+1)); }
-
-echo "check-golden-dead-code-absent:"
-
-# ── Anti-vacuous layer: prove we are looking at a real acceptance tree ───────
-# Without these, a wrong ROOT (or a renamed directory) makes every absence
-# assertion below trivially true and this guard reports OK having checked
-# nothing at all.
-[ -d scripts/acceptance ] \
-  || bad "anti-vacuous: scripts/acceptance/ does not exist — this guard is scanning the wrong tree, so every absence below would be meaningless"
-[ -f scripts/acceptance/check-stale-scoping.sh ] \
-  || bad "anti-vacuous: the sibling guard check-stale-scoping.sh is missing — same doubt as above"
-[ -f _acceptance/config.yaml ] \
-  || bad "anti-vacuous: _acceptance/config.yaml is missing — the key check below could not mean anything"
-[ "$fails" -eq 0 ] || { echo "FAIL: anti-vacuous probes failed; absence assertions were NOT run"; exit 1; }
-ok "anti-vacuous probes: acceptance tree present"
-
-# ── The three pieces ────────────────────────────────────────────────────────
-if [ -e scripts/acceptance/check-stale-golden.sh ]; then
-  bad "scripts/acceptance/check-stale-golden.sh is back — E3 was descoped at Gate 2 on 2026-08-05 (decisions.jsonl d-20260805T190000Z-31447); running it by hand goes RED because its golden froze a staleness VERDICT, not the scoping BEHAVIOUR"
-else
-  ok "check-stale-golden.sh absent"
-fi
-
-if [ -e scripts/acceptance/fixtures/baseline-gate-output.txt ]; then
-  bad "scripts/acceptance/fixtures/baseline-gate-output.txt is back — the golden fixture has no stable state: red after every successful re-pin wave, and red on the next branch if regenerated"
-else
-  ok "baseline-gate-output.txt absent"
-fi
-
-if grep -q 'stale_scoping_golden' _acceptance/config.yaml; then
-  bad "the stale_scoping_golden executor key is back in _acceptance/config.yaml — a key wired to a descoped eval is how dead code gets run again"
-else
-  ok "stale_scoping_golden key absent from config.yaml"
-fi
-
-[ "$fails" -eq 0 ] || { echo "FAIL: $fails dead piece(s) present"; exit 1; }
-echo "OK: all three descoped stale-golden pieces stay absent"
diff --git a/scripts/acceptance/check-no-stale-empty-diff.sh b/scripts/acceptance/check-no-stale-empty-diff.sh
deleted file mode 100755
index ed302fc8..00000000
--- a/scripts/acceptance/check-no-stale-empty-diff.sh
+++ /dev/null
@@ -1,59 +0,0 @@
-#!/usr/bin/env bash
-# E10 / AC-9 of gate-tooling-t1 — no feature carries stale evidence, measured
-# with an EMPTY diff.
-#
-# WHY EMPTY. `--base HEAD` makes the PR diff empty, which separates the two
-# things that look identical in a normal gate run: evidence that was ALREADY
-# stale before anyone touched the branch, versus evidence the branch under work
-# just staled. Only the first kind is this contract's debt. Measured on
-# 2026-08-27: narrowing the STALE-DIFF-SCOPE-GUARD fork surfaced exactly four
-# already-stale records (conformance-l0, measure-harness, stale-scope-by-paths,
-# task-metering) that the wider fork had been hiding — the same four appear with
-# an empty diff and with the branch's real diff, which is how they were shown to
-# pre-date the branch.
-#
-# WHY IT IS NOT A TAUTOLOGY. Under the narrowed fork a feature outside the PR
-# diff is examined only if it declares complete `paths`; everything else is
-# skipped. With an empty diff EVERY feature is outside the diff, so "zero stale"
-# would also be the answer if the fork skipped all of them — a green that means
-# "nobody looked". The anti-vacuous layer below therefore requires the gate to
-# show it actually examined someone.
-set -euo pipefail
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"; cd "$ROOT"
-GATE=scripts/pre-merge-check.sh
-WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT
-out="$WORK/gate.txt"
-
-echo "check-no-stale-empty-diff:"
-
-bash "$GATE" . --base HEAD > "$out" 2>&1 || true
-
-# ── Anti-vacuous layer ──────────────────────────────────────────────────────
-if ! grep -q '^pre-merge-check:' "$out"; then
-  echo "FAIL anti-vacuous: the gate printed no summary line — it did not run to completion, so 'no stale evidence' would be an artefact of the crash"
-  exit 1
-fi
-if ! grep -qE '^OK \[' "$out"; then
-  echo "FAIL anti-vacuous: the gate judged no feature at all — zero stale records would mean zero records"
-  exit 1
-fi
-# The decisive one: at least one feature must have reached the staleness block.
-# A granted narrow scope is the only line that proves it — an examined feature
-# either announces its scope or is reported stale, and a skipped one is silent.
-examined="$(grep -c 'narrow staleness scope applied' "$out" || true)"
-if [ "$examined" -eq 0 ]; then
-  echo "FAIL anti-vacuous: no feature reached the staleness block (no 'narrow staleness scope applied' line) — with an empty diff that means the fork skipped every feature, so 'zero stale' proves nothing about the evidence"
-  exit 1
-fi
-echo "  ok   anti-vacuous: gate ran, judged $(grep -cE '^OK \[' "$out") feature(s), and examined $examined declaring feature(s)"
-
-# ── The assertion ───────────────────────────────────────────────────────────
-n_stale="$(grep -cE '^VIOLATION \[[^]]+\]: evidence is stale' "$out" || true)"
-if [ "$n_stale" -ne 0 ]; then
-  echo "  FAIL $n_stale feature(s) carry stale evidence with an empty diff — this debt pre-dates any branch and needs a re-verify wave, not a rebase:"
-  grep -E '^VIOLATION \[[^]]+\]: evidence is stale' "$out" | sed 's/:.*//' | sed 's/^/      /'
-  echo "FAIL: stale evidence survives on a clean tree"
-  exit 1
-fi
-
-echo "OK: no feature carries stale evidence when the diff is empty"
diff --git a/scripts/acceptance/check-scoping-all-cases.sh b/scripts/acceptance/check-scoping-all-cases.sh
deleted file mode 100755
index 887e382c..00000000
--- a/scripts/acceptance/check-scoping-all-cases.sh
+++ /dev/null
@@ -1,62 +0,0 @@
-#!/usr/bin/env bash
-# E6 / AC-5 of gate-tooling-t1 — every case of check-stale-scoping.sh must be
-# green, and every case must actually be RUN.
-#
-# WHY IT READS THE LIST INSTEAD OF CARRYING ONE. A hardcoded case list here
-# would mean a case added later is never run by this eval — and that is not a
-# hypothetical: `indent-drift` shipped a working function that nothing ever
-# invoked, because no _acceptance/config.yaml key pointed `--case indent-drift`
-# at it. A list copied into a second place rots the same way. So the names come
-# from the guard's own KNOWN_CASES.
-#
-# WHY IT IS NOT REDUNDANT WITH case-completeness. That case proves each name
-# DISPATCHES (a function exists, and a config key points at it). It never runs
-# them. This one proves they PASS. Five of fourteen cases were red on a clean
-# main for ten days while case-completeness stayed green throughout — the two
-# questions are genuinely different.
-set -euo pipefail
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"; cd "$ROOT"
-GUARD=scripts/acceptance/check-stale-scoping.sh
-fails=0
-
-echo "check-scoping-all-cases:"
-
-# ── Anti-vacuous layer ──────────────────────────────────────────────────────
-# A broken parse yields an empty (or one-item) list, and a loop over it passes
-# having run nothing. Two independent sources have to agree before anything runs.
-cases="$(sed -n 's/^KNOWN_CASES="\(.*\)"$/\1/p' "$GUARD" | head -1)"
-n_cases="$(printf '%s\n' $cases | grep -c . || true)"
-if [ "$n_cases" -eq 0 ]; then
-  echo "FAIL anti-vacuous: could not parse KNOWN_CASES out of $GUARD — a loop over an empty list would report OK having run nothing"
-  exit 1
-fi
-# Independent source: every case is wired into config.yaml as `--case <name>`
-# (case-completeness enforces that direction). If the two counts disagree, one
-# of the two readings is wrong and this guard must not pretend otherwise.
-n_cfg="$(grep -o 'check-stale-scoping\.sh --case [a-z0-9-]*' _acceptance/config.yaml | sort -u | grep -c . || true)"
-if [ "$n_cases" -ne "$n_cfg" ]; then
-  echo "FAIL anti-vacuous: KNOWN_CASES lists $n_cases case(s) but _acceptance/config.yaml wires $n_cfg — the two readings disagree, so neither can be trusted as the list to run"
-  exit 1
-fi
-echo "  ok   anti-vacuous: $n_cases cases, and config.yaml wires the same number"
-
-# ── Run them all ────────────────────────────────────────────────────────────
-red=""
-for c in $cases; do
-  out="$(bash "$GUARD" --case "$c" 2>&1 || true)"
-  # A case that never printed its own CASE line did not run — an unknown name
-  # exits 2 before dispatching, and that must not be mistaken for a pass.
-  if ! printf '%s\n' "$out" | grep -q "^CASE $c: "; then
-    echo "  FAIL $c: the guard printed no 'CASE $c:' line — it never dispatched (unknown name, or the guard died before reaching it)"
-    red="$red $c"; fails=$((fails+1)); continue
-  fi
-  if printf '%s\n' "$out" | grep -q "^CASE $c: PASS"; then
-    echo "  ok   $c"
-  else
-    echo "  FAIL $c: $(printf '%s\n' "$out" | grep "^CASE $c:" | head -1 | cut -c1-160)"
-    red="$red $c"; fails=$((fails+1))
-  fi
-done
-
-[ "$fails" -eq 0 ] || { echo "FAIL: $fails of $n_cases scoping case(s) red —$red"; exit 1; }
-echo "OK: all $n_cases cases of check-stale-scoping.sh pass"
diff --git a/scripts/acceptance/check-stale-real-repo.sh b/scripts/acceptance/check-stale-real-repo.sh
deleted file mode 100755
index a69f9f16..00000000
--- a/scripts/acceptance/check-stale-real-repo.sh
+++ /dev/null
@@ -1,98 +0,0 @@
-#!/usr/bin/env bash
-# E14 / AC-10: run the finished gate against THIS repo at two pinned SHAs and
-# assert conformance-l0 — the only feature that declares paths, written before
-# this rule existed — is refused narrow scope for exactly six files.
-#
-# Refs are literal SHAs, not branch names: merging PR #25 or adding one src/**
-# file to the branch would otherwise move the answer and redden a correct
-# implementation.
-#
-# The split that matters: the EXECUTABLE LOGIC (pre-merge-check.sh,
-# recheck-evidence.js, lib/evidence-core.js) is read from HERE — the current
-# working tree at HEAD of this branch — because that is the finished
-# mechanism under test. The _acceptance/ tree, the git history, and the files
-# the gate globs against all come from a worktree checked out at HEAD_SHA, a
-# commit that predates this branch and still carries conformance-l0's
-# declaration untouched. Running the OLD script that lived at HEAD_SHA (it
-# predates the entire scoping mechanism) would prove nothing; running the
-# current script against the CURRENT repo's _acceptance/ tree would not see
-# conformance-l0 at all, since that directory does not exist on this branch.
-# So: current script, worktree's content — never the other way round, and
-# never both from the same place.
-set -u
-HERE="$(cd "$(dirname "$0")" && pwd)"
-ROOT="$(cd "$HERE/../.." && pwd)"
-#
-# Both SHAs must be PUSHED commits, reachable from some remote-tracking ref.
-# A commit that exists only in the author's clone makes this eval pass on one
-# machine and fail everywhere else — and this is the one criterion in the
-# feature that asserts against real repo data rather than a fixture, so it is
-# exactly the one that must survive a clean checkout. HEAD_SHA was originally
-# pinned to an unpushed commit on the sibling branch; the reachability
-# preflight below exists so that mistake fails loudly at authoring time
-# instead of silently passing local review.
-BASE_SHA=336944d68a7bc7fe6da281a8c6eaf24d105703a2
-HEAD_SHA=7352ca57b932924dfabb18a80f4e71ed4b6810fd
-
-EXPECTED="src/components/workspace/execution-status-line.tsx
-src/constants/task-status.ts
-src/hooks/use-workflow-execution.ts
-src/hooks/use-workflow-recovery.ts
-src/lib/abi/conformance.ts
-src/lib/task/engine-events.ts"
-
-for sha in "$BASE_SHA" "$HEAD_SHA"; do
-  git -C "$ROOT" rev-parse --quiet --verify "$sha^{commit}" >/dev/null 2>&1 \
-    || { echo "FAIL: pinned commit $sha not in this clone (shallow fetch or rewritten history)"; exit 1; }
-  # Present locally is NOT enough: an unpushed commit is present in exactly one
-  # clone. Require reachability from a remote-tracking ref, which is what any
-  # other clone (CI included) can actually obtain. Stale remote refs can make
-  # this red for a genuinely-pushed commit — the remedy is a fetch, and a
-  # spurious red that a fetch clears is the cheap side of this trade.
-  reachable=0
-  for ref in $(git -C "$ROOT" for-each-ref --format='%(refname)' refs/remotes/ 2>/dev/null); do
-    if git -C "$ROOT" merge-base --is-ancestor "$sha" "$ref" 2>/dev/null; then reachable=1; break; fi
-  done
-  [ "$reachable" -eq 1 ] || {
-    echo "FAIL: pinned commit $sha is in this clone but reachable from NO remote-tracking ref"
-    echo "      — it is unpushed local work, so this eval would pass here and fail on CI."
-    echo "      Run 'git fetch --all' first; if it is still unreachable, push the commit or re-pin to one that is."
-    exit 1
-  }
-done
-
-work="$(mktemp -d)"
-cleanup() {
-  git -C "$ROOT" worktree remove --force "$work" >/dev/null 2>&1 || true
-  git -C "$ROOT" worktree prune >/dev/null 2>&1 || true
-  rm -rf "$work"
-}
-trap cleanup EXIT
-
-git -C "$ROOT" worktree add -q --detach "$work" "$HEAD_SHA" \
-  || { echo "FAIL: could not create worktree at $HEAD_SHA"; exit 1; }
-
-# Run the CURRENT gate ($ROOT/scripts/pre-merge-check.sh, at HEAD of this
-# branch) but point it AT the worktree ($work) as the root to inspect.
-# pre-merge-check.sh takes the root to inspect as its first positional
-# argument — that is what makes "current logic, pinned-SHA content" possible
-# without executing the worktree's own (pre-mechanism) copy of the script.
-out="$(bash "$ROOT/scripts/pre-merge-check.sh" "$work" --base "$BASE_SHA" 2>&1)"
-
-# The cross-check must have FIRED — a pass with no cross-check is vacuous.
-printf '%s\n' "$out" | grep -q 'NOTE \[conformance-l0\]: declared eval paths do not cover' \
-  || { echo "FAIL: cross-check did not fire for conformance-l0"; printf '%s\n' "$out"; exit 1; }
-
-actual="$(printf '%s\n' "$out" \
-  | sed -n '/NOTE \[conformance-l0\]: declared eval paths do not cover/,/^[A-Z]/p' \
-  | sed -n 's/^    //p' | sort)"
-
-[ -n "$actual" ] || { echo "FAIL: uncovered list is empty"; exit 1; }
-
-if [ "$actual" = "$(printf '%s\n' "$EXPECTED" | sort)" ]; then
-  echo "OK: conformance-l0 refused narrow scope for exactly the six declared-but-missing files"
-  exit 0
-fi
-echo "FAIL: uncovered list is not the expected exact set"
-diff <(printf '%s\n' "$EXPECTED" | sort) <(printf '%s\n' "$actual") || true
-exit 1
diff --git a/scripts/acceptance/check-stale-scoping.sh b/scripts/acceptance/check-stale-scoping.sh
deleted file mode 100755
index 9d61f423..00000000
--- a/scripts/acceptance/check-stale-scoping.sh
+++ /dev/null
@@ -1,759 +0,0 @@
-#!/usr/bin/env bash
-# Guard for the paths-scoped staleness mechanism in pre-merge-check.sh.
-#
-# Lives under scripts/acceptance/ on purpose: risk_tiers.t1_skip_globs exempts
-# the gate tooling by EXACT path, so this file is gated and the gate applies to
-# the change that alters the gate (AC-11).
-#
-# One case per criterion, each with its own exit code. Nine criteria behind one
-# command would mean a case that was never implemented looks identical to a case
-# that passed.
-set -u
-HERE="$(cd "$(dirname "$0")" && pwd)"
-ROOT="$(cd "$HERE/../.." && pwd)"
-GATE="$ROOT/scripts/pre-merge-check.sh"
-
-# Fixture-construction helpers (mk_fixture, write_report, mk_pair_fixture,
-# etc.) live in a sibling file purely to keep this one under the repo's
-# 800-line convention. Sourced via the same cd-based HERE this file already
-# resolves above, so it works regardless of the caller's working directory.
-. "$HERE/fixtures.sh"
-
-# Cases use new_case_tmpdir() (fixtures.sh) for temp dirs; this one EXIT trap
-# cleans them all up on pass, on fail()'s exit, and on interrupt alike.
-trap cleanup_case_tmpdirs EXIT
-
-KNOWN_CASES="in-scope out-of-scope partial under-declared malformed indent-drift merged-halves two-bases suppression announce fork-undeclared fork-declared-in-union undeclared mutation case-completeness guard-not-exempt no-kill-switch"
-
-# Perturbation knob names. Referenced here and asserted ABSENT from the shipped
-# gate by the no-kill-switch case: an env var in the gate itself would be a
-# production kill switch (set it, every declared feature gets a match-nothing
-# scope, the gate exits clean).
-KNOB_NO_MATCH="STALE_SCOPE_FORCE_NO_MATCH"
-KNOB_ALWAYS_COMPLETE="STALE_SCOPE_FORCE_COMPLETE"
-
-pass() { echo "CASE $1: PASS"; }
-fail() { echo "CASE $1: FAIL $2"; exit 1; }
-
-case_case_completeness() {
-  # E10: a case that was never implemented must be loud, not absent. Every name
-  # in KNOWN_CASES must dispatch to a function that exists.
-  missing=""
-  for c in $KNOWN_CASES; do
-    fn="case_$(printf '%s' "$c" | tr '-' '_')"
-    command -v "$fn" >/dev/null 2>&1 || missing="$missing $c"
-  done
-  [ -z "$missing" ] || fail case-completeness "unimplemented cases:$missing"
-  # And an unknown case name must be rejected rather than silently succeeding.
-  if bash "$0" --case definitely-not-a-case >/dev/null 2>&1; then
-    fail case-completeness "unknown case name exited 0"
-  fi
-  # A case can exist here and still never RUN anywhere: exactly what happened
-  # to indent-drift, which shipped a working function with no
-  # _acceptance/config.yaml executors.script key pointing `--case
-  # indent-drift` at it, so nothing at verify time or in CI ever invoked it.
-  # Every name in KNOWN_CASES must appear as a literal `--case <name>` inside
-  # _acceptance/config.yaml (moved to fixtures.sh's
-  # assert_cases_wired_in_config() purely for this file's 800-line cap).
-  missing_cfg="$(assert_cases_wired_in_config "$ROOT/_acceptance/config.yaml")"
-  [ -z "$missing_cfg" ] \
-    || fail case-completeness "cases with no --case <name> wired into _acceptance/config.yaml executors.script:$missing_cfg"
-  pass case-completeness
-}
-
-case_guard_not_exempt() {
-  # E11 / AC-11: this guard's own path must match NO glob in t1_skip_globs, or
-  # the gate would exempt the change that alters the gate.
-  #
-  # Reuse match_globs() from the gate instead of hand-rolling a second glob
-  # matcher: `case` pattern semantics differ between shells, and a private
-  # copy would silently drift from what the gate actually does. Extracting
-  # only the function body (not sourcing/executing the whole gate script,
-  # which has side effects and calls exit) keeps this guard tested against
-  # the exact matcher the gate ships.
-  match_globs_src="$(sed -n '/^match_globs()/,/^}/p' "$GATE")"
-  [ -n "$match_globs_src" ] || fail guard-not-exempt "could not extract match_globs() from $GATE"
-  eval "$match_globs_src"
-
-  globs="$(sed -n '/^  t1_skip_globs:/,/^  [a-zA-Z0-9_-]*:/p' "$ROOT/_acceptance/config.yaml" \
-    | sed -n 's/^[[:space:]]*-[[:space:]]*//p' \
-    | sed -e 's/[[:space:]]*#.*$//' -e 's/^"//' -e 's/"$//' -e "s/^'//" -e "s/'\$//")"
-  [ -n "$globs" ] || fail guard-not-exempt "could not read t1_skip_globs"
-
-  self="scripts/acceptance/check-stale-scoping.sh"
-  if match_globs "$self" "$globs"; then
-    fail guard-not-exempt "$self is exempt via a t1_skip_globs entry"
-  fi
-  # Same check for the fixture-construction helpers this guard sources
-  # (scripts/acceptance/fixtures.sh): a helper the gate exempts would be a
-  # hole in the same way $self being exempt would be.
-  helper="scripts/acceptance/fixtures.sh"
-  if match_globs "$helper" "$globs"; then
-    fail guard-not-exempt "$helper is exempt via a t1_skip_globs entry"
-  fi
-  # Sanity: the matcher must actually match something, or the check above
-  # proves nothing. A path that IS exempt has to be seen as exempt.
-  known_exempt="scripts/pre-merge-check.sh"
-  if ! match_globs "$known_exempt" "$globs"; then
-    fail guard-not-exempt "matcher matched nothing — check is vacuous"
-  fi
-  pass guard-not-exempt
-}
-
-case_no_kill_switch() {
-  # E13 / AC-13: the perturbation knobs must exist only in this guard's temp
-  # copy, never in the shipped gate.
-  for k in "$KNOB_NO_MATCH" "$KNOB_ALWAYS_COMPLETE"; do
-    if grep -q "$k" "$GATE"; then
-      fail no-kill-switch "shipped gate references perturbation knob $k"
-    fi
-  done
-  pass no-kill-switch
-}
-
-case_partial() {
-  # E4 / AC-4: paths on some evals but not all is the state a half-finished
-  # backfill leaves behind. Scoping by a partial list is worse than not scoping.
-  d="$(new_case_tmpdir)"
-  mk_fixture "$d" fx partial
-  vc="$(git -C "$d" rev-parse HEAD)"
-  write_report "$d" fx "$vc"
-  ( cd "$d" && echo drift > src/uncovered/new.txt && git add -A && git commit -q -m drift )
-  out="$(bash "$GATE" "$d" --base "$vc" 2>&1)"
-  printf '%s\n' "$out" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail partial "partial declaration did not fall back to whole-tree: $out"
-  printf '%s\n' "$out" | grep -q 'narrow scope' \
-    && fail partial "partial declaration was granted narrow scope"
-
-  # Same partial declaration, hidden behind balanced TOTALS: two `paths:`
-  # lines on one eval and none on the other. A completeness test that counts
-  # eval lines against paths lines sees 2 == 2 and calls it complete, then
-  # builds the union from the one eval that declared twice while the other
-  # eval's implicit whole-tree scope vanishes. A copy-paste duplicate is
-  # enough to reach it, so it is not an exotic shape.
-  # ISOLATION, rebuilt for the STALE-DIFF-SCOPE-GUARD fork. The old shape kept
-  # `_acceptance/fx/` out of the PR diff so the cross-check could not refuse
-  # the scope on its own and mask the completeness test. Since the fork that
-  # same shape also skips the staleness block entirely, so it now masks
-  # everything. Isolation is achieved from the other side instead: the slug IS
-  # in the diff, and the drift is placed INSIDE the union the duplicate
-  # declares so the cross-check PASSES — leaving the completeness test as the
-  # only thing that can still refuse the scope.
-  #
-  # Which assertion carries the signal changed with it. A granted scope would
-  # cover src/covered/** too, so the file stales either way and the
-  # `evidence is stale` assertion no longer discriminates; the discriminating
-  # one is the `narrow staleness scope applied` assertion, which appears only
-  # if the completeness test wrongly reads this partial declaration as
-  # complete. Kept both: the second is still a regression guard on the
-  # fallback itself.
-  d2="$(new_case_tmpdir)"
-  base2="$(mk_committed_report_fixture "$d2" fx dup)"
-  ( cd "$d2" && echo drift > src/covered/new.txt && pr_touches_artifacts "$d2" fx && git add -A && git commit -q -m drift )
-  out2="$(bash "$GATE" "$d2" --base "$base2" 2>&1)"
-  printf '%s\n' "$out2" | grep -q 'narrow staleness scope applied' \
-    && fail partial "duplicate-key partial declaration was granted narrow scope: $out2"
-  printf '%s\n' "$out2" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail partial "duplicate-key partial declaration did not fall back to whole-tree: $out2"
-
-  # Third shape of the same lie: E2 declares nothing, and a `paths:` key at the
-  # eval-key column sits in an unrelated mapping BELOW the evals list. Totals
-  # balance, and attributing a paths line to the "nearest `- id:` above"
-  # without checking it is still INSIDE that eval hands the stray key to E2 —
-  # the union then gains a glob no eval declared. Same rebuilt isolation as
-  # above: slug in the diff, drift inside the union so the cross-check passes.
-  d3="$(new_case_tmpdir)"
-  base3="$(mk_committed_report_fixture "$d3" fx stray)"
-  ( cd "$d3" && echo drift > src/covered/new.txt && pr_touches_artifacts "$d3" fx && git add -A && git commit -q -m drift )
-  out3="$(bash "$GATE" "$d3" --base "$base3" 2>&1)"
-  printf '%s\n' "$out3" | grep -q 'narrow staleness scope applied' \
-    && fail partial "stray out-of-block paths key was folded into a granted scope: $out3"
-  printf '%s\n' "$out3" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail partial "stray out-of-block paths key did not fall back to whole-tree: $out3"
-  pass partial
-}
-
-case_malformed() {
-  # E6 / AC-6: `paths: []` must read as not-declared. Read as "declared with an
-  # empty scope" it matches nothing, i.e. never stale — the worst misreading.
-  d="$(new_case_tmpdir)"
-  mk_fixture "$d" fx empty
-  vc="$(git -C "$d" rev-parse HEAD)"
-  write_report "$d" fx "$vc"
-  ( cd "$d" && echo drift > src/uncovered/new.txt && git add -A && git commit -q -m drift )
-  out="$(bash "$GATE" "$d" --base "$vc" 2>&1)"
-  printf '%s\n' "$out" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail malformed "empty paths array did not fall back to whole-tree: $out"
-  pass malformed
-}
-
-case_indent_drift() { run_indent_drift_case; } # E-indent-drift/AC-6 — real body (27 assertions on feature_scope()'s YAML-shape handling) is run_indent_drift_case() in fixtures.sh, moved there only for this file's 800-line cap
-
-case_in_scope() {
-  # E1 / AC-1: THE load-bearing case. Narrow scope must still catch a change
-  # inside the declared union — a mechanism degraded into "never stale" passes
-  # every other criterion in this guard.
-  d="$(new_case_tmpdir)"
-  mk_fixture "$d" fx all
-  vc="$(git -C "$d" rev-parse HEAD)"
-  write_report "$d" fx "$vc"
-  ( cd "$d" && echo drift > src/covered/new.txt && git add -A && git commit -q -m drift )
-  out="$(bash "$GATE" "$d" --base "$vc" 2>&1)"
-  printf '%s\n' "$out" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail in-scope "in-union change did NOT stale the feature: $out"
-
-  # Non-ASCII path inside the declared union: `git diff --name-only` quotes
-  # and octal-escapes a non-ASCII path by default (core.quotePath), so it
-  # arrives as a literal string like "caf\303\251.txt" that can never match a
-  # plain-ASCII glob.
-  #
-  # The PR carries the feature's artifacts (pr_touches_artifacts) because the
-  # STALE-DIFF-SCOPE-GUARD fork examines staleness only for a feature inside
-  # the PR diff; without them the gate prints `OK [fx]` having looked at
-  # nothing and this assertion measures silence. The old shape here committed
-  # the report separately to dodge the cross-check, which the fork has welded
-  # to the same switch. Dodging is no longer possible, so instead the
-  # cross-check is made to PASS rather than be skipped: mode `all` declares
-  # src/covered/**, and the PR's only gated file is inside it.
-  d2="$(new_case_tmpdir)"
-  base2="$(mk_committed_report_fixture "$d2" fx all)"
-  ( cd "$d2" && printf 'x' > "src/covered/café.txt" && pr_touches_artifacts "$d2" fx && git add -A && git commit -q -m "non-ascii file in scope" )
-  out2="$(bash "$GATE" "$d2" --base "$base2" 2>&1)"
-  printf '%s\n' "$out2" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail in-scope "non-ASCII in-union path did NOT stale the feature (quoted-path dropped from narrow scope): $out2"
-  printf '%s\n' "$out2" | grep -qF 'café.txt' \
-    || fail in-scope "non-ASCII in-union path was staled but not named cleanly (still quoted/escaped): $out2"
-
-  # Monorepo layout ($ROOT below the git top-level), both spellings. Every
-  # other fixture here puts $ROOT at the git root, where ls-files and
-  # `diff --name-only` agree and a namespace mismatch cannot show. Half 3a: a
-  # top-level-spelled declaration must behave exactly like the flat case —
-  # an in-union change still stales. Half 3b is the regression proper: a
-  # $ROOT-relative spelling matches no tracked file in the namespace the
-  # staleness filter uses, so it must be REFUSED out loud and fall back to
-  # whole-tree — never granted and then silently filtering everything out,
-  # which is "never stale" wearing a narrow-scope hat.
-  d3="$(new_case_tmpdir)"
-  base3="$(mk_subdir_fixture "$d3" fx 'pkg/src/covered/**')"
-  ( cd "$d3" && echo drift > pkg/src/covered/new.txt && pr_touches_artifacts "$d3/pkg" fx && git add -A && git commit -q -m drift )
-  out3="$(bash "$GATE" "$d3/pkg" --base "$base3" 2>&1)"
-  printf '%s\n' "$out3" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail in-scope "subdir root, top-level-spelled paths: in-union change did NOT stale the feature: $out3"
-
-  d4="$(new_case_tmpdir)"
-  base4="$(mk_subdir_fixture "$d4" fx 'src/covered/**')"
-  ( cd "$d4" && echo drift > pkg/src/covered/new.txt && pr_touches_artifacts "$d4/pkg" fx && git add -A && git commit -q -m drift )
-  out4="$(bash "$GATE" "$d4/pkg" --base "$base4" 2>&1)"
-  # The protective property is unchanged — a $ROOT-relative spelling must never
-  # be granted a scope that silently filters everything out — but since the
-  # STALE-DIFF-SCOPE-GUARD fork it is a DIFFERENT guard that catches it, so the
-  # assertion is on the outcome rather than on one message.
-  #
-  # Reachability, measured: for the staleness block to run at all the slug must
-  # be in the PR diff, which also switches the cross-check on; for the
-  # cross-check to pass, the declared union must cover a non-empty gated
-  # coverage set, i.e. it must match at least one tracked file — which is
-  # exactly what the `match no gated file` refusal requires to be false. The
-  # two conditions cannot hold at once, so that specific refusal is no longer
-  # reachable from any fixture. Here the namespace mismatch surfaces as the
-  # cross-check's `do not cover` refusal instead. Both refuse the scope and
-  # fall back to whole-tree, which is the behaviour this case exists to pin.
-  printf '%s\n' "$out4" | grep -qE 'NOTE \[fx\]: declared eval paths (match no gated file|do not cover)' \
-    || fail in-scope "subdir root, \$ROOT-relative paths: match-nothing declaration was NOT refused: $out4"
-  printf '%s\n' "$out4" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail in-scope "subdir root, \$ROOT-relative paths: refused scope did NOT fall back to whole-tree staleness: $out4"
-  pass in-scope
-}
-
-case_out_of_scope() {
-  # E2 / AC-2: the behaviour the feature exists to produce.
-  #
-  # The report is committed on its own, and --base is taken AFTER that commit
-  # (not at the same commit the report's own verified_commit points to), so
-  # this feature's _acceptance/fx/ is NOT part of the PR diff the Task-6
-  # cross-check inspects (case_merged_halves' "half A" shape). That isolates
-  # what this case exists to prove — an out-of-declared-scope change alone
-  # does not stale the feature — from the cross-check, which is a separate
-  # concern exercised by case_under_declared / case_merged_halves / case_two_bases.
-  d="$(new_case_tmpdir)"
-  mk_fixture "$d" fx narrow
-  vc="$(git -C "$d" rev-parse HEAD)"
-  write_report "$d" fx "$vc"
-  ( cd "$d" && git add -A && git commit -q -m report )
-  base="$(git -C "$d" rev-parse HEAD)"
-  ( cd "$d" && echo drift > src/uncovered/new.txt && git add -A && git commit -q -m drift )
-  out="$(bash "$GATE" "$d" --base "$base" 2>&1)"
-  printf '%s\n' "$out" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    && fail out-of-scope "out-of-union change still staled the feature: $out"
-  printf '%s\n' "$out" | grep -q 'OK \[fx\]' \
-    || fail out-of-scope "feature not reported OK: $out"
-  # No over-refusal (Task 6): "narrow" mode's paths ("src/covered/**") DO
-  # match a tracked file (src/covered/seed.txt, seeded by mk_fixture) — the
-  # match-nothing guard must not misfire on a legitimately-matching
-  # declaration and fall back to whole-tree scope.
-  printf '%s\n' "$out" | grep -q 'match no gated file' \
-    && fail out-of-scope "match-nothing guard wrongly refused a declaration whose globs DO match a tracked file: $out"
-  pass out-of-scope
-}
-
-case_suppression() {
-  # E8 / AC-8: the pre-existing exclusions must survive refactoring the
-  # function that applies them — for declared and undeclared features alike.
-  for mode in all none; do
-    d="$(new_case_tmpdir)"
-    mk_fixture "$d" fx "$mode"
-    vc="$(git -C "$d" rev-parse HEAD)"
-    write_report "$d" fx "$vc"
-    ( cd "$d" && echo x > docs/note.md && echo y >> _acceptance/fx/run-log.jsonl && git add -A && git commit -q -m docs )
-    out="$(bash "$GATE" "$d" --base "$vc" 2>&1)"
-    if printf '%s\n' "$out" | grep -q 'VIOLATION \[fx\]: evidence is stale'; then
-      fail suppression "docs/_acceptance-only change staled a $mode-paths feature: $out"
-    fi
-  done
-  pass suppression
-}
-
-case_announce() {
-  # E15 / AC-14: a granted narrow scope is the only path that WEAKENS the gate,
-  # and it used to have no output at all. Undeclared (below) must still stay
-  # silent, or AC-3 breaks.
-  #
-  # Rebuilt for the STALE-DIFF-SCOPE-GUARD fork. The old shape kept
-  # `_acceptance/fx/` out of the PR diff to dodge Task 6's cross-check; the
-  # fork made that same shape skip the staleness block outright, so the gate
-  # printed `OK [fx]: PASS` and this case asserted against silence. A granted
-  # scope now requires BOTH halves at once: the slug in the diff (or nothing is
-  # examined) and the cross-check passing (or the scope is refused). That is
-  # exactly case_two_bases' shape, so it is reused here — the out-of-scope
-  # change lands BEFORE the base, where it is inside the feature's staleness
-  # range but outside the PR's coverage set, which is what leaves the
-  # announcement something to report as suppressed.
-  d="$(new_case_tmpdir)"; d2="$(new_case_tmpdir)"
-  mk_fixture "$d" fx narrow
-  vc="$(git -C "$d" rev-parse HEAD)"
-  write_report "$d" fx "$vc"
-  ( cd "$d" && git add -A && git commit -q -m report )
-  ( cd "$d" && echo old > src/uncovered/unrelated.txt && git add -A && git commit -q -m "unrelated merge" )
-  base="$(git -C "$d" rev-parse HEAD)"
-  ( cd "$d" && echo new > src/covered/pr.txt && pr_touches_artifacts "$d" fx && git add -A && git commit -q -m pr )
-  out="$(bash "$GATE" "$d" --base "$base" 2>&1)"
-  printf '%s\n' "$out" | grep -q 'narrow staleness scope applied' || fail announce "no announcement for a granted narrow scope: $out"
-  printf '%s\n' "$out" | grep -q 'suppressed' || fail announce "announcement does not say the narrowing suppressed a whole-tree change: $out"
-  # Undeclared half: the slug is in the diff here too, so the staleness block
-  # genuinely runs and the silence below is a measured silence rather than the
-  # fork's. Without it this assertion passes on every input, AC-3 included.
-  base2="$(mk_committed_report_fixture "$d2" fx none)"
-  ( cd "$d2" && echo drift > src/uncovered/new.txt && pr_touches_artifacts "$d2" fx && git add -A && git commit -q -m drift )
-  out2="$(bash "$GATE" "$d2" --base "$base2" 2>&1)"
-  printf '%s\n' "$out2" | grep -q 'narrow staleness scope applied' && fail announce "undeclared feature produced an announcement: $out2"
-  printf '%s\n' "$out2" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail announce "undeclared feature was not staled by a gated change — the staleness block did not run, so the silence above proves nothing: $out2"
-  pass announce
-}
-
-case_fork_undeclared() {
-  # E4 / AC-3 — nửa SUPPRESSION của hồ sơ gate-tooling-t1. Feature KHÔNG khai
-  # `paths` và `_acceptance/fx/` NGOÀI diff PR: fork STALE-DIFF-SCOPE-GUARD bỏ
-  # qua trọn khối, nên nó không bị báo stale dù có thay đổi gated sau
-  # verified_commit. Đây là lý do fork tồn tại (chống chặn-mọi-PR-vì-lịch-sử),
-  # nên một bản "thu hẹp fork" tay trượt thành gỡ hẳn fork phải làm case này đỏ.
-  d="$(new_case_tmpdir)"
-  base="$(mk_committed_report_fixture "$d" fx none)"
-  ( cd "$d" && echo drift > src/covered/new.txt && git add -A && git commit -q -m drift )
-  out="$(bash "$GATE" "$d" --base "$base" 2>&1)"
-  printf '%s\n' "$out" | grep -q 'OK \[fx\]' \
-    || fail fork-undeclared "feature không xuất hiện trong output — case này khẳng định một sự VẮNG MẶT, nên phải chứng minh feature được cổng nhìn thấy trước đã: $out"
-  printf '%s\n' "$out" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    && fail fork-undeclared "feature không khai paths, ngoài diff PR, vẫn bị báo stale — fork đã mất tác dụng bảo vệ và treadmill mở lại cho mọi feature whole-tree: $out"
-  printf '%s\n' "$out" | grep -q 'narrow staleness scope applied' \
-    && fail fork-undeclared "feature không khai paths lại được cấp narrow scope (AC-3 mệnh đề (c) của stale-scope-by-paths): $out"
-
-  # ĐỐI CHỨNG, trong cùng fixture: đưa artifact vào diff thì CHÍNH thay đổi
-  # gated đó PHẢI làm feature stale. Thiếu vế này, case trên vẫn xanh khi
-  # `src/covered/new.txt` không phải file gated chút nào — tức nó sẽ chứng minh
-  # sự im lặng bằng một thay đổi vô hại, không phải bằng fork.
-  ( cd "$d" && pr_touches_artifacts "$d" fx && git add -A && git commit -q -m "artifact touch" )
-  ctl="$(bash "$GATE" "$d" --base "$base" 2>&1)"
-  printf '%s\n' "$ctl" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail fork-undeclared "đối chứng thất bại: cùng thay đổi đó KHÔNG làm feature stale kể cả khi artifact nằm trong diff, nên sự im lặng ở trên không chứng minh được gì về fork: $ctl"
-  pass fork-undeclared
-}
-
-case_fork_declared_in_union() {
-  # E5 / AC-4 — nửa should-fire, đối xứng với case_out_of_scope. Feature khai
-  # ĐỦ `paths`, `_acceptance/fx/` NGOÀI diff PR (nên fork thu hẹp vẫn cho nó vào
-  # khối, và cross-check không chạy — AC-7 vế 1), và file đổi nằm TRONG union.
-  # Thiếu case này thì "thu hẹp fork" có thể thoái hoá thành "không bao giờ
-  # stale" mà out-of-scope, announce và fork-undeclared vẫn xanh hết.
-  d="$(new_case_tmpdir)"
-  base="$(mk_committed_report_fixture "$d" fx narrow)"
-  ( cd "$d" && echo drift > src/covered/new.txt && git add -A && git commit -q -m drift )
-  out="$(bash "$GATE" "$d" --base "$base" 2>&1)"
-  printf '%s\n' "$out" | grep -q 'narrow staleness scope applied' \
-    || fail fork-declared-in-union "feature khai đủ paths ngoài diff KHÔNG được vào khối staleness — fork chưa thu hẹp, và AC-2 lại mất chỗ quan sát: $out"
-  printf '%s\n' "$out" | grep -qi 'do not cover' \
-    && fail fork-declared-in-union "cross-check chạy dù artifact nằm NGOÀI diff PR (AC-7 vế 1): $out"
-  printf '%s\n' "$out" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail fork-declared-in-union "file NẰM TRONG union đã khai mà không làm feature stale — narrow scope đã thoái hoá thành 'không bao giờ stale': $out"
-  printf '%s\n' "$out" | grep -q 'src/covered/new.txt' \
-    || fail fork-declared-in-union "feature bị báo stale nhưng không nêu tên file — báo stale mà không chỉ được file là không sửa được: $out"
-  pass fork-declared-in-union
-}
-
-case_undeclared() {
-  # E7 / AC-6 — item 0.8(a). AC-3 mệnh đề (a) của stale-scope-by-paths: khai
-  # ZERO `paths` + thay đổi gated thì VẪN phải báo stale. Mệnh đề này mất eval
-  # máy từ 05/08 khi E3 bị descope. Khác case_fork_undeclared ở ĐÚNG MỘT biến:
-  # ở đây `_acceptance/fx/` NẰM TRONG diff, nên khối staleness thật sự chạy.
-  d="$(new_case_tmpdir)"
-  base="$(mk_committed_report_fixture "$d" fx none)"
-  ( cd "$d" && echo drift > src/covered/new.txt && pr_touches_artifacts "$d" fx && git add -A && git commit -q -m drift )
-  out="$(bash "$GATE" "$d" --base "$base" 2>&1)"
-  printf '%s\n' "$out" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail undeclared "khai 0 paths + thay đổi gated mà KHÔNG bị báo stale — cơ chế đã thoái hoá thành 'không bao giờ stale' cho đúng nhóm chưa hề chọn tham gia: $out"
-  printf '%s\n' "$out" | grep -q 'narrow staleness scope applied' \
-    && fail undeclared "feature khai 0 paths lại được cấp narrow scope (AC-3 mệnh đề (b)+(c)): $out"
-  pass undeclared
-}
-
-case_under_declared() {
-  # E5 / AC-5: complete paths that miss part of the COVERAGE SET, with the
-  # feature's artifacts in the PR diff → refuse narrow scope and NAME the files.
-  d="$(new_case_tmpdir)"
-  mk_fixture "$d" fx narrow
-  base="$(git -C "$d" rev-parse HEAD)"
-  write_report "$d" fx "$base"
-  ( cd "$d" && echo drift > src/uncovered/new.txt \
-      && echo touched >> _acceptance/fx/run-log.jsonl \
-      && git add -A && git commit -q -m "pr" )
-  vc="$(git -C "$d" rev-parse HEAD)"
-  write_report "$d" fx "$vc"
-  ( cd "$d" && git add -A && git commit -q -m "repin" )
-  out="$(bash "$GATE" "$d" --base "$base" 2>&1)"
-  printf '%s\n' "$out" | grep -q 'src/uncovered/new.txt' \
-    || fail under-declared "uncovered file not named in output: $out"
-  printf '%s\n' "$out" | grep -qi 'not covered\|uncovered' \
-    || fail under-declared "no under-declaration message: $out"
-
-  # The SAME under-declaration in the monorepo layout ($ROOT below the git
-  # top-level). The cross-check only runs when this feature's own
-  # _acceptance/<slug>/ is in the PR diff, and that test reads `git diff
-  # --name-only` output — whose paths are top-level-relative. A
-  # top-level-anchored prefix test therefore never matches here, the
-  # cross-check silently never runs, and narrow scope is granted UNCHECKED:
-  # AC-5 and AC-7 both dead, with no eval noticing. The two layouts must give
-  # the same answer; that is the whole assertion.
-  d2="$(new_case_tmpdir)"
-  base2="$(mk_subdir_crosscheck_fixture "$d2" fx 'pkg/src/covered/**')"
-  write_report "$d2/pkg" fx "$base2"
-  ( cd "$d2" && echo drift > pkg/src/uncovered/new.txt \
-      && echo touched >> pkg/_acceptance/fx/run-log.jsonl \
-      && git add -A && git commit -q -m "pr" )
-  vc2="$(git -C "$d2" rev-parse HEAD)"
-  write_report "$d2/pkg" fx "$vc2"
-  ( cd "$d2" && git add -A && git commit -q -m "repin" )
-  out2="$(bash "$GATE" "$d2/pkg" --base "$base2" 2>&1)"
-  printf '%s\n' "$out2" | grep -qi 'not covered\|uncovered' \
-    || fail under-declared "subdir root: cross-check did not fire, narrow scope granted unchecked: $out2"
-  printf '%s\n' "$out2" | grep -qF 'pkg/src/uncovered/new.txt' \
-    || fail under-declared "subdir root: uncovered file not named in output: $out2"
-  pass under-declared
-}
-
-# ── case_merged_halves helpers ───────────────────────────────────────────────
-# E7 / AC-7 covers seven distinct sub-scenarios (A-G). They stay behind this
-# ONE case (see the KNOWN_CASES note at the top of this file for why they are
-# not split into separate --case entries), but each sub-scenario gets its own
-# helper function below so the top-level case_merged_halves body stays a short
-# list of calls instead of one long function.
-
-# merged_halves_ab — Half A: artifacts NOT in the PR diff → narrow scope, no
-# cross-check. Half B: same feature, artifacts IN the PR diff → cross-check
-# runs. Operates on the shared "$d"/"$base" globals case_merged_halves sets up
-# (Half C/D below reuse the same fixture and PR history).
-merged_halves_ab() {
-  mk_fixture "$d" fx narrow
-  vc="$(git -C "$d" rev-parse HEAD)"
-  write_report "$d" fx "$vc"
-  ( cd "$d" && git add -A && git commit -q -m report )
-  base="$(git -C "$d" rev-parse HEAD)"
-  ( cd "$d" && echo drift > src/uncovered/new.txt && git add -A && git commit -q -m "code only" )
-  outA="$(bash "$GATE" "$d" --base "$base" 2>&1)"
-  printf '%s\n' "$outA" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    && fail merged-halves "half A: narrow scope was not granted: $outA"
-  # Match the cross-check's OWN wording ("do not cover"), not a bare
-  # "uncovered" substring — half A's own drift file lives under
-  # src/uncovered/, so a path-name match would misfire on that filename
-  # inside the (unrelated) T1-escape PR-level NOTE/VIOLATION, not on
-  # whether the cross-check itself actually ran.
-  printf '%s\n' "$outA" | grep -qi 'do not cover' \
-    && fail merged-halves "half A: cross-check ran despite artifacts absent from the PR diff: $outA"
-  ( cd "$d" && echo touched >> _acceptance/fx/run-log.jsonl && git add -A && git commit -q -m "artifact touch" )
-  outB="$(bash "$GATE" "$d" --base "$base" 2>&1)"
-  printf '%s\n' "$outB" | grep -qi 'do not cover' \
-    || fail merged-halves "half B: cross-check did not run with artifacts in the PR diff: $outB"
-}
-
-# merged_halves_cd — Half C: no PR base at all. There is no coverage set to
-# cross-check the declaration against — an empty BASE_SHA must NEVER be read
-# as "declaration covers everything"; it must fall back to whole-tree
-# staleness (the working tree still carries the Half-A drift file, which sits
-# outside this feature's declared "narrow" scope) rather than silently
-# reporting OK. Half D: same as Half C but with an UNRESOLVABLE --base — must
-# fail closed at least as hard as the missing-base case, never more
-# permissively just because a ref string was supplied; since kit 1.24.0 that
-# means refusing to run (exit 2). Reuses the "$d" that
-# merged_halves_ab left behind.
-merged_halves_cd() {
-  outC="$(bash "$GATE" "$d" 2>&1)"
-  printf '%s\n' "$outC" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail merged-halves "half C: no PR base did not fall back to whole-tree staleness: $outC"
-  printf '%s\n' "$outC" | grep -q 'OK \[fx\]' \
-    && fail merged-halves "half C: no PR base wrongly reported OK: $outC"
-
-  # Since kit 1.24.0 this fails closed HARDER than Half C: instead of falling
-  # back to whole-tree staleness, the gate refuses to run at all. An operator
-  # who declared a scope the machine cannot compute gets an error, not a
-  # quieter check (kit ADR 0004 — a CI job with a mistyped base_ref used to
-  # check an empty set and report clean). What this half guards is unchanged —
-  # a bad ref must never buy narrow scope — only the mechanism moved, from
-  # "widest staleness set" to "do not run".
-  outD="$(bash "$GATE" "$d" --base bogus-ref-xyz-does-not-exist 2>&1)"; rcD=$?
-  [ "$rcD" -eq 2 ] \
-    || fail merged-halves "half D: unresolvable PR base did not exit 2 (got $rcD): $outD"
-  printf '%s\n' "$outD" | grep -q 'VIOLATION \[scope\]: base .* resolve' \
-    || fail merged-halves "half D: unresolvable PR base did not report the scope violation: $outD"
-  printf '%s\n' "$outD" | grep -q 'OK \[fx\]' \
-    && fail merged-halves "half D: unresolvable PR base wrongly reported OK: $outD"
-
-  # Half D2: a --base that DOES resolve to a real commit, but shares NO merge
-  # base with HEAD (two disjoint histories) — `git diff A...B` exits 128 in
-  # this case ("no merge base"). `2>/dev/null` alone makes that failure read
-  # as an empty, silently EMPTY diff — "no gaps found" — which used to grant
-  # narrow scope on a doubt exactly like an unresolvable ref, just with a rc
-  # instead of an empty rev-parse. Must fail closed the same way as Half D.
-  orig_branch="$(git -C "$d" symbolic-ref --short HEAD)"
-  ( cd "$d" && git checkout -q --orphan no-merge-base-branch \
-      && git rm -rf --cached . -q >/dev/null 2>&1 \
-      && echo unrelated > unrelated-history.txt && git add -A \
-      && git commit -q -m "disjoint history, no common ancestor with $orig_branch" )
-  nomb_ref="$(git -C "$d" rev-parse HEAD)"
-  ( cd "$d" && git checkout -q "$orig_branch" )
-  outD2="$(bash "$GATE" "$d" --base "$nomb_ref" 2>&1)"
-  printf '%s\n' "$outD2" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail merged-halves "half D2: a base sharing no merge base with HEAD did not fall back to whole-tree staleness: $outD2"
-  printf '%s\n' "$outD2" | grep -q 'OK \[fx\]' \
-    && fail merged-halves "half D2: a base sharing no merge base with HEAD wrongly reported OK: $outD2"
-}
-
-# assert_cross_check_isolation <label> <desc> <slug1> <slug2> — shared shape
-# behind Half E (regex-slug isolation) and Half F (trailing-slash anchoring):
-# two independently narrow-scoped features share one repo (mk_pair_fixture);
-# the PR touches ONLY slug2's artifacts, plus a code change outside declared
-# scope so a wrongly-run cross-check for slug1 would have something to flag
-# as "not covered". Asserts slug1's own cross-check does NOT fire while
-# slug2's does. Uses its own throwaway dir, torn down before returning.
-#
-# Half E: slugs "a.b" (where "." is a regex wildcard) and "axb" (a string the
-# wildcard would match against) — a slug interpolated unescaped into a grep
-# PATTERN lets "." match any character, so "^_acceptance/a.b/" would also
-# match "_acceptance/axb/". A git pathspec is a literal path, not a pattern,
-# and cannot be confused this way.
-#
-# Half F: slugs "fx" and "fx-extra" — the anchoring the old grep pattern
-# relied on (`^_acceptance/$slug/`, trailing slash) must still hold now that
-# the check uses a pathspec instead.
-assert_cross_check_isolation() {
-  ah_label="$1"; ah_desc="$2"; ah_s1="$3"; ah_s2="$4"
-  ah_dir="$(new_case_tmpdir)"
-  mk_pair_fixture "$ah_dir" "$ah_s1" "$ah_s2"
-  ah_vc="$(git -C "$ah_dir" rev-parse HEAD)"
-  write_report "$ah_dir" "$ah_s1" "$ah_vc"
-  write_report "$ah_dir" "$ah_s2" "$ah_vc"
-  ( cd "$ah_dir" && git add -A && git commit -q -m report )
-  ah_base="$(git -C "$ah_dir" rev-parse HEAD)"
-  ( cd "$ah_dir" && echo touched >> "_acceptance/$ah_s2/run-log.jsonl" && echo drift > src/uncovered/new.txt \
-      && git add -A && git commit -q -m "pr touches $ah_s2 only" )
-  ah_out="$(bash "$GATE" "$ah_dir" --base "$ah_base" 2>&1)"
-  printf '%s\n' "$ah_out" | grep -qF "NOTE [$ah_s1]: declared eval paths" \
-    && fail merged-halves "$ah_label ($ah_desc): touching only $ah_s2's artifacts tripped ${ah_s1}'s cross-check: $ah_out"
-  printf '%s\n' "$ah_out" | grep -qF "OK [$ah_s1]" \
-    || fail merged-halves "$ah_label ($ah_desc): $ah_s1 was not reported OK despite its own artifacts being untouched: $ah_out"
-  printf '%s\n' "$ah_out" | grep -qF "NOTE [$ah_s2]: declared eval paths" \
-    || fail merged-halves "$ah_label ($ah_desc): ${ah_s2}'s own cross-check did not run: $ah_out"
-}
-
-# merged_halves_g — Half G / vacuous cross-check (Task 6 finding): a
-# declaration whose globs match NO tracked file must never earn narrow scope
-# permanently just because the PR that introduces it happens to touch nothing
-# but its own _acceptance/<slug>/ — an empty coverage set makes scope_gaps()
-# pass VACUOUSLY (nothing in the diff to flag as "not covered"), so without a
-# separate match-nothing check the declaration is accepted once and then
-# silently hides every future change forever, because every later PR that
-# changes real code without touching _acceptance/<slug>/ skips the
-# cross-check entirely and stale_files() scoped to a match-nothing glob
-# filters the real change straight out.
-merged_halves_g() {
-  h="$(new_case_tmpdir)"
-  mkdir -p "$h/src/covered" "$h/_acceptance"
-  git_init_fixture_repo "$h"
-  write_config "$h"
-  ( cd "$h" && echo seed > src/covered/seed.txt && git add -A && git commit -q -m "repo base, no feature yet" )
-  hbase0="$(git -C "$h" rev-parse HEAD)"
-
-  mkdir -p "$h/_acceptance/fx"
-  write_contract "$h" fx
-  # Match-nothing declaration: "nonexistent-dir/**" cannot match anything
-  # tracked in this fixture repo (only src/covered/** and _acceptance/** exist).
-  write_evals_yaml "$h" fx '    paths: ["nonexistent-dir/**"]' '    paths: ["nonexistent-dir/**"]'
-  echo '{}' > "$h/_acceptance/fx/run-log.jsonl"
-  ( cd "$h" && git add -A && git commit -q -m "introduce fx with match-nothing paths" )
-  hvc="$(git -C "$h" rev-parse HEAD)"
-  write_report "$h" fx "$hvc"
-  ( cd "$h" && git add -A && git commit -q -m "evidence report" )
-  hpr1="$(git -C "$h" rev-parse HEAD)"
-
-  # PR1: base is BEFORE fx existed at all — the coverage set (hbase0...HEAD)
-  # is only _acceptance/fx/* (excluded from scope_gaps by construction), so
-  # it is empty. Post-fix: an empty coverage set at the moment the
-  # declaration is introduced is refused outright (its own NOTE), rather than
-  # passing the cross-check vacuously and being silently granted — the
-  # feature must still report OK (nothing gated changed in this PR either
-  # way), but the "narrow scope applied" wording must NOT appear, because no
-  # scope was actually granted.
-  outG1="$(bash "$GATE" "$h" --base "$hbase0" 2>&1)"
-  printf '%s\n' "$outG1" | grep -q 'OK \[fx\]' \
-    || fail merged-halves "half G: vacuous-pass setup: PR introducing a match-nothing declaration was not reported OK: $outG1"
-  printf '%s\n' "$outG1" | grep -qF 'NOTE [fx]: this PR'"'"'s gated coverage set is empty' \
-    || fail merged-halves "half G: empty coverage set at declaration time was not refused with the dedicated NOTE: $outG1"
-  printf '%s\n' "$outG1" | grep -q 'narrow staleness scope applied' \
-    && fail merged-halves "half G: an empty-coverage-set declaration was still announced as a GRANTED narrow scope: $outG1"
-
-  # PR2: real code change, feature artifacts UNTOUCHED — the cross-check does
-  # not even run here (declaration unchanged since hpr1), so only a guard
-  # that applies regardless of whether the cross-check ran can catch this.
-  ( cd "$h" && echo drift > src/covered/new.txt && git add -A && git commit -q -m "real code change" )
-  outG2="$(bash "$GATE" "$h" --base "$hpr1" 2>&1)"
-  printf '%s\n' "$outG2" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail merged-halves "half G: match-nothing declaration hid a later real code change from staleness: $outG2"
-  printf '%s\n' "$outG2" | grep -q 'src/covered/new.txt' \
-    || fail merged-halves "half G: match-nothing declaration: stale file not named: $outG2"
-}
-
-# merged_halves_h — Half H / the CRITICAL finding this round closes: unlike
-# Half G above (a match-nothing declaration, already caught independently by
-# scope_has_any_match), this uses a REAL declaration whose globs DO match
-# tracked files elsewhere in the repo ("src/covered/**") — isolating the
-# defect from that other guard. The PR that introduces fx touches nothing
-# gated besides its own _acceptance/fx/ (an honest "just wiring up the
-# feature" commit), so the coverage set is empty and the cross-check used to
-# pass VACUOUSLY, silently granting narrow scope to a declaration that was
-# NEVER actually checked against anything. Post-fix this must be refused with
-# its own NOTE at THIS PR's own gate run.
-#
-# A SEPARATE, later PR that changes real code outside the declared union
-# WITHOUT touching _acceptance/fx again does NOT retrigger the cross-check —
-# by design (AC-7: re-running it against every unrelated PR's diff would
-# refuse narrow scope for every already-merged feature forever). That is a
-# real, acknowledged residual (see contract.md "Known limits"), not something
-# this fix claims to close — pinned here as a boundary on AC-7, not a defect.
-merged_halves_h() {
-  hh="$(new_case_tmpdir)"
-  mkdir -p "$hh/src/covered" "$hh/src/other" "$hh/_acceptance"
-  git_init_fixture_repo "$hh"
-  write_config "$hh"
-  ( cd "$hh" && echo seed > src/covered/seed.txt && echo seed > src/other/seed.txt \
-      && git add -A && git commit -q -m "repo base, no feature yet" )
-  hhbase0="$(git -C "$hh" rev-parse HEAD)"
-
-  mkdir -p "$hh/_acceptance/fx"
-  write_contract "$hh" fx
-  # Real, matching declaration — deliberately NOT match-nothing, to isolate
-  # this from scope_has_any_match's guard.
-  write_evals_yaml "$hh" fx '    paths: ["src/covered/**"]' '    paths: ["src/covered/**"]'
-  echo '{}' > "$hh/_acceptance/fx/run-log.jsonl"
-  ( cd "$hh" && git add -A && git commit -q -m "introduce fx with a real, matching declaration, nothing else" )
-  hhvc="$(git -C "$hh" rev-parse HEAD)"
-  write_report "$hh" fx "$hhvc"
-  ( cd "$hh" && git add -A && git commit -q -m "evidence report" )
-  hhpr1="$(git -C "$hh" rev-parse HEAD)"
-
-  # PR1 (the declaring PR): coverage set (hhbase0...HEAD) is only
-  # _acceptance/fx/* — empty. Must be refused, not silently granted.
-  outH1="$(bash "$GATE" "$hh" --base "$hhbase0" 2>&1)"
-  printf '%s\n' "$outH1" | grep -q 'OK \[fx\]' \
-    || fail merged-halves "half H: declaring PR was not reported OK: $outH1"
-  printf '%s\n' "$outH1" | grep -qF 'NOTE [fx]: this PR'"'"'s gated coverage set is empty' \
-    || fail merged-halves "half H: a real, matching declaration introduced with an empty coverage set was not refused: $outH1"
-  printf '%s\n' "$outH1" | grep -q 'narrow staleness scope applied' \
-    && fail merged-halves "half H: a declaration never actually cross-checked was still announced as a GRANTED narrow scope: $outH1"
-
-  # PR2: real code OUTSIDE the declared union, artifacts left untouched — the
-  # acknowledged residual. Documented, not asserted as fixed: the cross-check
-  # correctly does NOT run (AC-7), so this still reports OK. If a future
-  # change makes this start failing, that is AC-7 being violated (the
-  # cross-check running against every unrelated PR), not a bug being
-  # reintroduced — check contract.md "Known limits" before touching this.
-  ( cd "$hh" && echo drift > src/other/new.txt && git add -A && git commit -q -m "real code outside declared paths" )
-  outH2="$(bash "$GATE" "$hh" --base "$hhpr1" 2>&1)"
-  printf '%s\n' "$outH2" | grep -qi 'do not cover' \
-    && fail merged-halves "half H: cross-check ran for a PR that never touched _acceptance/fx — AC-7 regressed: $outH2"
-}
-
-case_merged_halves() {
-  # E7 / AC-7: cross-check fires only when the declaration is new or changed.
-  d="$(new_case_tmpdir)"
-  merged_halves_ab
-  merged_halves_cd
-  assert_cross_check_isolation "half E" "regex-slug" a.b axb
-  assert_cross_check_isolation "half F" "trailing-slash" fx fx-extra
-  merged_halves_h
-  merged_halves_g
-  pass merged-halves
-}
-
-case_two_bases() {
-  # E12 / AC-12: the fixture that tells the two ranges apart. paths cover the
-  # COVERAGE SET but NOT everything changed since verified_commit. Cross-checked
-  # against the per-feature range instead, no honest declaration ever covers it
-  # and narrow scope is refused for every merged feature forever.
-  d="$(new_case_tmpdir)"
-  mk_fixture "$d" fx narrow
-  vc="$(git -C "$d" rev-parse HEAD)"
-  write_report "$d" fx "$vc"
-  ( cd "$d" && git add -A && git commit -q -m report )
-  # Unrelated history AFTER verified_commit and BEFORE the PR base.
-  ( cd "$d" && echo old > src/uncovered/unrelated.txt && git add -A && git commit -q -m "unrelated merge" )
-  base="$(git -C "$d" rev-parse HEAD)"
-  # The PR itself touches only covered code plus the feature's artifacts.
-  ( cd "$d" && echo new > src/covered/pr.txt \
-      && echo touched >> _acceptance/fx/run-log.jsonl \
-      && git add -A && git commit -q -m pr )
-  out="$(bash "$GATE" "$d" --base "$base" 2>&1)"
-  printf '%s\n' "$out" | grep -q 'src/uncovered/unrelated.txt' \
-    && fail two-bases "cross-check used the per-feature range, not the coverage set: $out"
-  # Match the cross-check's OWN wording ("do not cover"), not a bare
-  # "uncovered" substring — this fixture's src/uncovered/unrelated.txt (seeded
-  # above) would otherwise satisfy a path-name match on its own filename,
-  # independent of whether the cross-check actually refused narrow scope.
-  printf '%s\n' "$out" | grep -qi 'do not cover' \
-    && fail two-bases "narrow scope refused although the coverage set is covered: $out"
-  pass two-bases
-}
-case_mutation() { run_mutation_case; } # E9/AC-9 — real body (incl. sed patches + assertions) is run_mutation_case() in fixtures.sh, moved there only for this file's 800-line cap
-usage() { echo "usage: $0 --case <$(echo "$KNOWN_CASES" | tr ' ' '|')>" >&2; exit 2; }
-
-CASE=""
-while [ $# -gt 0 ]; do
-  case "$1" in
-    --case) [ $# -ge 2 ] || usage; CASE="$2"; shift 2 ;;
-    *) usage ;;
-  esac
-done
-[ -n "$CASE" ] || usage
-
-known=0
-for c in $KNOWN_CASES; do [ "$c" = "$CASE" ] && known=1; done
-[ "$known" -eq 1 ] || { echo "unknown case: $CASE" >&2; exit 2; }
-
-"case_$(printf '%s' "$CASE" | tr '-' '_')"
diff --git a/scripts/acceptance/check-t1-escape-path.sh b/scripts/acceptance/check-t1-escape-path.sh
deleted file mode 100755
index 2879bcf9..00000000
--- a/scripts/acceptance/check-t1-escape-path.sh
+++ /dev/null
@@ -1,101 +0,0 @@
-#!/usr/bin/env bash
-# E1 / AC-1 of gate-tooling-t1 — there must be a legal way to change a guard.
-#
-# risk_tiers.t1_skip_globs exempts the vendored gate tooling by EXACT path
-# (scripts/pre-merge-check.sh, scripts/recheck-evidence.*, lib/*.cjs). The eight
-# guards this repo writes itself under scripts/acceptance/** are NOT on that
-# list — deliberately, because the gate must apply to changes in what the gate
-# measures (AC-11 of stale-scope-by-paths). The consequence is that a PR
-# touching only those guards trips the T1-escape backstop unless it carries
-# acceptance artifacts. That is the intended door, and this guard pins that the
-# door both OPENS and STAYS SHUT.
-#
-# MEASURED ON A FIXTURE, NEVER ON THIS BRANCH. Running the gate against the
-# current checkout would make the result a property of whatever the branch
-# happens to touch today — the exact mistake that made the deleted stale-golden
-# guard unmaintainable (it froze a branch-shaped verdict and called it
-# behaviour). The fixture below owns its own repo, its own config and its own
-# base, so the answer is the same on every branch and every machine.
-#
-# THE TWO HALVES run against ONE fixture, in order, so the deciding variable is
-# visibly the artifacts and nothing else:
-#   B (should-fire)     PR changes only scripts/acceptance/<guard>.sh  → VIOLATION
-#   A (should-NOT-fire) same PR plus an _acceptance/ artifact touch    → no VIOLATION
-set -euo pipefail
-HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-ROOT="$(cd "$HERE/../.." && pwd)"
-GATE="$ROOT/scripts/pre-merge-check.sh"
-. "$HERE/fixtures.sh"
-WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT
-ESCAPE='VIOLATION \[PR\]: non-T1 files changed'
-GUARD_REL=scripts/acceptance/check-fixture-guard.sh
-fails=0
-
-echo "check-t1-escape-path:"
-
-d="$WORK/fx"
-mkdir -p "$d"
-mk_fixture "$d" fx narrow
-vc="$(git -C "$d" rev-parse HEAD)"
-write_report "$d" fx "$vc"
-( cd "$d" && git add -A && git commit -q -m report )
-base="$(git -C "$d" rev-parse HEAD)"
-
-# The PR: a repo-authored guard changes. Nothing else.
-mkdir -p "$d/scripts/acceptance"
-printf '#!/usr/bin/env bash\necho guard\n' > "$d/$GUARD_REL"
-( cd "$d" && git add -A && git commit -q -m "change a repo-authored guard" )
-
-# ── Anti-vacuous layer ──────────────────────────────────────────────────────
-# Both halves below are about a gated file being present in the diff. If it is
-# not, half A passes because nothing gated changed at all — a green that says
-# nothing. Assert the diff shape directly rather than trusting the setup.
-in_diff() { git -C "$d" diff --name-only "$base...HEAD" | grep -qx "$1"; }
-if ! in_diff "$GUARD_REL"; then
-  echo "FAIL anti-vacuous: $GUARD_REL is not in the fixture PR diff — neither half would mean anything"
-  exit 1
-fi
-# And the fixture's own config must really treat that path as non-T1, or half B
-# fails for a reason that has nothing to do with the backstop.
-if grep -qE '^\s+- "scripts' "$d/_acceptance/config.yaml"; then
-  echo "FAIL anti-vacuous: the fixture config exempts scripts/** — half B could not fire for the intended reason"
-  exit 1
-fi
-echo "  ok   anti-vacuous: guard file in the PR diff, and non-T1 in the fixture config"
-
-run_gate() { bash "$GATE" "$d" --base "$base" 2>&1 || true; }
-
-# ── Half B — should FIRE ────────────────────────────────────────────────────
-outB="$(run_gate)"
-if ! printf '%s\n' "$outB" | grep -q 'pre-merge-check:'; then
-  echo "  FAIL [half B] the gate produced no summary line — it did not run, so its silence proves nothing"
-  fails=$((fails+1))
-elif printf '%s\n' "$outB" | grep -q "$ESCAPE"; then
-  echo "  ok   [half B] a guard-only PR with no acceptance artifacts trips the T1-escape backstop"
-else
-  echo "  FAIL [half B] a PR changing only $GUARD_REL did NOT trip the T1-escape backstop — the door is unguarded, and any guard can be changed with no acceptance artifact at all"
-  fails=$((fails+1))
-fi
-
-# ── Half A — must NOT fire ──────────────────────────────────────────────────
-# Same PR, one artifact added. `_acceptance/**` is excluded from every staleness
-# set, so this changes nothing except whether the PR carries gate artifacts.
-( cd "$d" && echo touched >> _acceptance/fx/run-log.jsonl && git add -A && git commit -q -m "carry acceptance artifacts" )
-if ! in_diff "$GUARD_REL"; then
-  echo "  FAIL [half A] the guard change fell out of the diff — half A would pass because nothing gated changed"
-  fails=$((fails+1))
-else
-  outA="$(run_gate)"
-  if ! printf '%s\n' "$outA" | grep -q 'pre-merge-check:'; then
-    echo "  FAIL [half A] the gate produced no summary line — it did not run"
-    fails=$((fails+1))
-  elif printf '%s\n' "$outA" | grep -q "$ESCAPE"; then
-    echo "  FAIL [half A] the PR carries acceptance artifacts and STILL trips the T1-escape backstop — there is then no legal way to change a guard at all, which is the debt this contract exists to pay"
-    fails=$((fails+1))
-  else
-    echo "  ok   [half A] the same PR carrying acceptance artifacts passes the backstop"
-  fi
-fi
-
-[ "$fails" -eq 0 ] || { echo "FAIL: $fails half/halves of the T1-escape door misbehaved"; exit 1; }
-echo "OK: changing a repo-authored guard is legal with acceptance artifacts and blocked without them"
diff --git a/scripts/acceptance/fixtures.sh b/scripts/acceptance/fixtures.sh
deleted file mode 100644
index cc05adb5..00000000
--- a/scripts/acceptance/fixtures.sh
+++ /dev/null
@@ -1,839 +0,0 @@
-#!/usr/bin/env bash
-# Fixture-construction helpers for scripts/acceptance/check-stale-scoping.sh
-# — PLUS two full case bodies:
-#   - run_mutation_case() (backing case_mutation / E9 / AC-9), complete with
-#     its perturbation sed patches and every assertion `--case mutation` makes.
-#   - run_indent_drift_case() (backing case_indent_drift / E-indent-drift /
-#     AC-6), the 27 assertions pinning every YAML shape feature_scope() must
-#     refuse or accept (indentation drift, block-scalar decoys, multi-line
-#     arrays, quoting variants, bracket-class globs, trailing comments/junk).
-# Neither is a thin wrapper hiding here — each is the actual substance of its
-# case. They live in this file, rather than beside the other case_* functions
-# in check-stale-scoping.sh, purely because that file was already sitting at
-# this repo's 800-line-per-file cap (CLAUDE.md) when each was added. See
-# case_mutation()'s and case_indent_drift()'s own comments in that file for
-# the pointer back to here.
-#
-# Everything else in this file — write_config, write_contract,
-# write_evals_yaml, mk_fixture, mk_pair_fixture, mk_committed_report_fixture,
-# run_gate_with_drift, and the new_case_tmpdir/cleanup_case_tmpdirs pair
-# below — is ordinary fixture construction with no case_* entry points and
-# no CLI of its own; it is only ever sourced.
-#
-# check-stale-scoping.sh sources this via `. "$HERE/fixtures.sh"`, where HERE
-# is resolved with `cd "$(dirname "$0")"` — that cd-based resolution already
-# makes the source path independent of the caller's working directory. This
-# file mirrors that same cd-based approach for its OWN directory, in case a
-# future helper here needs to reference a sibling path (e.g. under
-# scripts/acceptance/fixtures/), so robustness survives regardless of which
-# file ends up doing the resolving.
-set -u
-FIXTURES_HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-
-# ── Temp-directory tracking ─────────────────────────────────────────────────
-# Every case_* in check-stale-scoping.sh builds one or more throwaway fixture
-# repos under mktemp -d. fail() calls `exit`, which bypasses a per-function
-# `trap ... RETURN` — so any case that fails via fail() used to leave its
-# directories behind. Routing every `mktemp -d` through new_case_tmpdir()
-# instead records the path in a registry FILE (see below); check-stale-
-# scoping.sh installs ONE script-level `trap cleanup_case_tmpdirs EXIT`, so
-# cleanup runs on the pass path, the fail() exit path, and an interrupt
-# (INT/TERM, which also reach EXIT in bash) alike — regardless of which case
-# or helper created the dir.
-#
-# A registry FILE, not a shell variable, is required here: every call site is
-# `d="$(new_case_tmpdir)"`, and bash runs the right-hand side of `$(...)` in a
-# subshell — a subshell mutating a global variable does not propagate that
-# mutation back to the parent shell once the subshell exits, so an in-memory
-# list would silently discard every recorded path. Appending to a file is a
-# real filesystem write, which does survive the subshell exiting.
-CASE_TMPDIR_REGISTRY="$(mktemp)"
-
-# new_case_tmpdir — mktemp -d wrapper: creates the directory, appends it to
-# CASE_TMPDIR_REGISTRY for the caller's script-level EXIT trap, and echoes
-# the path — same call shape as `d="$(mktemp -d)"`, so every existing call
-# site is a drop-in `d="$(new_case_tmpdir)"` replacement.
-new_case_tmpdir() {
-  nct_dir="$(mktemp -d)"
-  printf '%s\n' "$nct_dir" >> "$CASE_TMPDIR_REGISTRY"
-  printf '%s\n' "$nct_dir"
-}
-
-# cleanup_case_tmpdirs — remove every directory new_case_tmpdir has recorded
-# so far, then the registry file itself. Meant to be installed once as
-# `trap cleanup_case_tmpdirs EXIT` by the caller script, not called directly
-# by any case.
-cleanup_case_tmpdirs() {
-  if [ -f "$CASE_TMPDIR_REGISTRY" ]; then
-    while IFS= read -r ctr_dir; do
-      [ -n "$ctr_dir" ] && rm -rf "$ctr_dir"
-    done < "$CASE_TMPDIR_REGISTRY"
-    rm -f "$CASE_TMPDIR_REGISTRY"
-  fi
-}
-
-# assert_cases_wired_in_config <config.yaml-path> — for every name in
-# KNOWN_CASES (check-stale-scoping.sh global), checks that a literal
-# `--case <name>` string appears in the given _acceptance/config.yaml.
-# Prints the space-prefixed list of any case names not found there (empty
-# string if all are wired). A case function can exist and still never run
-# anywhere — exactly what happened to indent-drift, which shipped a working
-# case_indent_drift() with no executors.script key pointing `--case
-# indent-drift` at it — so this is what case_case_completeness (in
-# check-stale-scoping.sh) uses to catch that class of gap. Moved here purely
-# for that file's 800-line cap.
-assert_cases_wired_in_config() {
-  acw_cfg="$1"
-  acw_missing=""
-  for acw_c in $KNOWN_CASES; do
-    grep -qE -- "--case ${acw_c}([[:space:]]|\$)" "$acw_cfg" 2>/dev/null \
-      || acw_missing="$acw_missing $acw_c"
-  done
-  printf '%s' "$acw_missing"
-}
-
-# write_config <dir> — canonical _acceptance/config.yaml fixture content: the
-# same risk_tiers/executors/signoff shape every fixture in this guard needs.
-# Callers must have already created "<dir>/_acceptance".
-write_config() {
-  cat > "$1/_acceptance/config.yaml" <<CFG
-schema_version: 1
-enforcement: strict
-recheck: off
-executors:
-  test:
-    unit: "true"
-risk_tiers:
-  t1_skip_globs:
-    - "docs/**"
-    - "**/*.md"
-    - "_acceptance/**"
-  t3_paths:
-    - "src/critical/**"
-signoff:
-  required_for: [T2, T3]
-CFG
-}
-
-# write_contract <dir> <slug> — canonical signed-off T2 contract fixture.
-# Callers must have already created "<dir>/_acceptance/<slug>".
-write_contract() {
-  cat > "$1/_acceptance/$2/contract.md" <<CON
----
-schema_version: 1
-feature: fixture
-slug: $2
-risk_tier: T2
-status: signed-off
-approved_by: Fixture
----
-# Acceptance Contract: $2
-CON
-}
-
-# write_evals_yaml <dir> <slug> <p1-line> <p2-line> — a two-eval evals.yaml
-# (E1/AC-1, E2/AC-2, both `executor: test` / `cmd: config:executors.test.unit`).
-# p1/p2 are complete "    paths: [...]" lines inserted verbatim into E1/E2
-# respectively, or "" to leave that eval with no `paths` key at all.
-write_evals_yaml() {
-  {
-    echo "schema_version: 1"
-    echo "feature_slug: $2"
-    echo "evals:"
-    echo "  - id: E1"
-    echo "    criterion: AC-1"
-    echo "    executor: test"
-    echo "    cmd: config:executors.test.unit"
-    [ -n "$3" ] && echo "$3"
-    echo "  - id: E2"
-    echo "    criterion: AC-2"
-    echo "    executor: test"
-    echo "    cmd: config:executors.test.unit"
-    [ -n "$4" ] && echo "$4"
-    # Optional $5: content appended AFTER the evals list — for shapes that put
-    # a `paths:` key outside any eval item.
-    [ -n "${5:-}" ] && echo "$5"
-    :
-  } > "$1/_acceptance/$2/evals.yaml"
-}
-
-# git_init_fixture_repo <dir> — init a throwaway git repo with a fixed
-# fixture identity, no commit (callers add files then commit themselves).
-git_init_fixture_repo() {
-  (
-    cd "$1"
-    git init -q .
-    git config user.email fixture@example.com
-    git config user.name Fixture
-  )
-}
-
-# mk_fixture <dir> <slug> <paths-mode>
-# Builds a throwaway git repo with one signed feature. paths-mode:
-#   all      — every eval declares paths covering src/covered/**
-#   none     — no eval declares paths
-#   partial  — first eval declares, second does not
-#   empty    — every eval declares `paths: []`
-#   narrow   — every eval declares paths that do NOT cover src/uncovered/**
-mk_fixture() {
-  d="$1"; slug="$2"; mode="$3"
-  mkdir -p "$d/_acceptance/$slug" "$d/src/covered" "$d/src/uncovered" "$d/docs"
-  write_config "$d"
-  write_contract "$d" "$slug"
-  # Reset before the case: this file has no `local`, so a value set by one
-  # mode's branch would otherwise survive into the NEXT mk_fixture call and
-  # silently append a trailer to an unrelated fixture (see mk_pair_fixture's
-  # note on the same hazard).
-  trailer=""
-  case "$mode" in
-    none)    p1=""; p2="" ;;
-    partial) p1='    paths: ["src/covered/**"]'; p2="" ;;
-    empty)   p1='    paths: []'; p2='    paths: []' ;;
-    narrow)  p1='    paths: ["src/covered/**"]'; p2='    paths: ["src/covered/**"]' ;;
-    # Two paths lines on the FIRST eval, none on the second: a copy-paste
-    # duplicate. The file-wide totals still balance (2 evals, 2 paths lines),
-    # so any completeness test that compares counts rather than distribution
-    # reads this partial declaration as complete.
-    dup)     p1='    paths: ["src/covered/**"]
-    paths: ["src/uncovered/**"]'; p2="" ;;
-    # E2 declares NOTHING; a `paths:` key sits at the eval-key column in an
-    # unrelated mapping BELOW the evals list. Totals balance again (2 evals,
-    # 2 paths lines), and "nearest `- id:` above" hands the stray key to E2 —
-    # so the union silently gains a glob no eval ever declared.
-    stray)   p1='    paths: ["src/covered/**"]'; p2=""
-             trailer='misc:
-  sub:
-    paths: ["docs/**"]' ;;
-    all|*)   p1='    paths: ["src/covered/**"]'; p2='    paths: ["src/covered/**", "src/uncovered/**"]' ;;
-  esac
-  write_evals_yaml "$d" "$slug" "$p1" "$p2" "${trailer:-}"
-  echo '{}' > "$d/_acceptance/$slug/run-log.jsonl"
-  git_init_fixture_repo "$d"
-  (
-    cd "$d"
-    echo seed > src/covered/seed.txt
-    echo seed > src/uncovered/seed.txt
-    git add -A
-    git commit -q -m "fixture base"
-  )
-}
-
-# write_report <dir> <slug> <verified_commit>
-write_report() {
-  cat > "$1/_acceptance/$2/evidence-report.md" <<REP
----
-schema_version: 2
-feature_slug: $2
-verdict: PASS
-failed_evals: []
-verified_by: fixture
-enforcement_mode: strict
-bypass_used: false
-verified_commit: $3
-human_signoff: Fixture 2026-07-28
----
-# Evidence Report: $2
-REP
-}
-
-# pr_touches_artifacts <dir> <slug> — append a byte to the feature's run-log so
-# the PR commit the caller is about to make includes `_acceptance/<slug>/`.
-#
-# Required since the STALE-DIFF-SCOPE-GUARD fork (97b5b12): the gate skips the
-# WHOLE staleness block — verdict, narrow scope and its announcement alike —
-# for any feature whose own `_acceptance/<slug>/` is outside the PR diff. A
-# fixture that leaves the artifacts out of the diff therefore asserts against
-# silence, and passes or fails for reasons unrelated to what it set out to
-# measure. run-log.jsonl is the cheapest carrier: `_acceptance/**` is excluded
-# from every staleness set (AC-8), so this puts the slug in the diff WITHOUT
-# contributing a stale file of its own.
-#
-# Note for the caller: putting the artifacts in the diff also switches the
-# Task-6 cross-check ON (AC-7). Under this fork the two are welded together —
-# "examined but not cross-checked" is no longer an expressible shape — so a
-# case that needs a granted narrow scope must also keep the PR's gated
-# coverage set inside the declared union, the way case_two_bases does.
-pr_touches_artifacts() {
-  echo touched >> "$1/_acceptance/$2/run-log.jsonl"
-}
-
-# mk_committed_report_fixture <dir> <slug> <paths-mode> — mk_fixture() plus a
-# report committed in its OWN commit (prints the post-report commit SHA on
-# stdout, for the caller's --base). Any case that needs "this feature's
-# _acceptance/<slug>/ is NOT part of the PR diff" (case_out_of_scope's shape)
-# instead of re-deriving that three-step dance inline.
-mk_committed_report_fixture() {
-  mcf_dir="$1"; mcf_slug="$2"; mcf_mode="$3"
-  mk_fixture "$mcf_dir" "$mcf_slug" "$mcf_mode"
-  mcf_vc="$(git -C "$mcf_dir" rev-parse HEAD)"
-  write_report "$mcf_dir" "$mcf_slug" "$mcf_vc"
-  ( cd "$mcf_dir" && git add -A && git commit -q -m report )
-  git -C "$mcf_dir" rev-parse HEAD
-}
-
-# mk_subdir_fixture <repo-dir> <slug> <paths-glob> — the monorepo layout: the
-# git repo is <repo-dir>, but the acceptance tree and the sources live one
-# level down in <repo-dir>/pkg, which is the root the gate is pointed at. Every
-# other fixture in this suite puts $ROOT at the git top-level, where the
-# ls-files and diff --name-only namespaces happen to coincide and a namespace
-# bug is invisible. <paths-glob> is written verbatim into both evals, so a
-# caller can declare either spelling (top-level `pkg/src/covered/**` or
-# $ROOT-relative `src/covered/**`) and assert what the gate does with it.
-#
-# Prints the post-report commit SHA on stdout, same contract as
-# mk_committed_report_fixture, so --base is taken AFTER the report and this
-# feature's own _acceptance/<slug>/ is NOT in the PR diff (no cross-check) —
-# the shape every later PR has, which is where the namespace hole opens.
-mk_subdir_fixture() {
-  sf_repo="$1"; sf_slug="$2"; sf_glob="$3"
-  mkdir -p "$sf_repo/pkg/_acceptance/$sf_slug" "$sf_repo/pkg/src/covered" "$sf_repo/pkg/src/uncovered"
-  write_config "$sf_repo/pkg"
-  write_contract "$sf_repo/pkg" "$sf_slug"
-  write_evals_yaml "$sf_repo/pkg" "$sf_slug" "    paths: [\"$sf_glob\"]" "    paths: [\"$sf_glob\"]"
-  echo '{}' > "$sf_repo/pkg/_acceptance/$sf_slug/run-log.jsonl"
-  git_init_fixture_repo "$sf_repo"
-  (
-    cd "$sf_repo"
-    echo seed > pkg/src/covered/seed.txt
-    echo seed > pkg/src/uncovered/seed.txt
-    git add -A
-    git commit -q -m "fixture base"
-  )
-  sf_vc="$(git -C "$sf_repo" rev-parse HEAD)"
-  write_report "$sf_repo/pkg" "$sf_slug" "$sf_vc"
-  ( cd "$sf_repo" && git add -A && git commit -q -m report )
-  git -C "$sf_repo" rev-parse HEAD
-}
-
-# mk_subdir_crosscheck_fixture <repo-dir> <slug> <paths-glob> — the monorepo
-# layout of mk_subdir_fixture, but staged so the feature's OWN
-# _acceptance/<slug>/ is part of the PR diff: that is the one condition under
-# which the declaration is cross-checked against the gated diff, and it is
-# exactly the condition mk_subdir_fixture deliberately excludes (it takes its
-# base AFTER the report commit).
-#
-# Prints the fixture-base SHA and stops there, leaving the report/PR/re-pin
-# staging to the caller so it can mirror case_under_declared's flat shape line
-# for line — the whole point is that the two layouts differ ONLY in where the
-# acceptance tree sits, so any divergence in the gate's answer is the bug.
-mk_subdir_crosscheck_fixture() {
-  sx_repo="$1"; sx_slug="$2"; sx_glob="$3"
-  mkdir -p "$sx_repo/pkg/_acceptance/$sx_slug" "$sx_repo/pkg/src/covered" "$sx_repo/pkg/src/uncovered"
-  write_config "$sx_repo/pkg"
-  write_contract "$sx_repo/pkg" "$sx_slug"
-  write_evals_yaml "$sx_repo/pkg" "$sx_slug" "    paths: [\"$sx_glob\"]" "    paths: [\"$sx_glob\"]"
-  echo '{}' > "$sx_repo/pkg/_acceptance/$sx_slug/run-log.jsonl"
-  git_init_fixture_repo "$sx_repo"
-  (
-    cd "$sx_repo"
-    echo seed > pkg/src/covered/seed.txt
-    echo seed > pkg/src/uncovered/seed.txt
-    git add -A
-    git commit -q -m "fixture base"
-  )
-  git -C "$sx_repo" rev-parse HEAD
-}
-
-# mk_pair_fixture <dir> <slug1> <slug2>
-# Two independently narrow-scoped features (paths cover src/covered/** only)
-# sharing ONE repo — for guards that assert one feature's cross-check cannot
-# be tripped by a change confined to the OTHER feature's artifacts (regex-slug
-# confusion, trailing-slash anchoring).
-#
-# Deliberately does NOT bind its first parameter to a variable named "d" —
-# this file has no `local`, so every parameter assignment here is a plain
-# global. A caller that still holds its own fixture dir in "$d" after calling
-# this function would have that "$d" silently clobbered by this function's
-# own reassignment of it, corrupting any use of "$d" the caller makes later.
-mk_pair_fixture() {
-  pf_dir="$1"; s1="$2"; s2="$3"
-  mkdir -p "$pf_dir/_acceptance/$s1" "$pf_dir/_acceptance/$s2" "$pf_dir/src/covered" "$pf_dir/src/uncovered"
-  write_config "$pf_dir"
-  for s in "$s1" "$s2"; do
-    write_contract "$pf_dir" "$s"
-    write_evals_yaml "$pf_dir" "$s" '    paths: ["src/covered/**"]' '    paths: ["src/covered/**"]'
-    echo '{}' > "$pf_dir/_acceptance/$s/run-log.jsonl"
-  done
-  git_init_fixture_repo "$pf_dir"
-  (
-    cd "$pf_dir"
-    echo seed > src/covered/seed.txt
-    echo seed > src/uncovered/seed.txt
-    git add -A
-    git commit -q -m "fixture base"
-  )
-}
-
-# run_gate_with_drift <gate-path> <fixture-mode> <drift-path> — build a signed
-# fx feature (mk_committed_report_fixture), commit one drifting file AFTER
-# that commit, then run <gate-path> with --base at the post-report commit —
-# the same "artifacts not in the PR diff" shape case_out_of_scope uses, so
-# Task 6's coverage cross-check never runs and never masks what the caller is
-# actually trying to observe. Echoes the gate's combined stdout+stderr.
-run_gate_with_drift() {
-  rgw_gate="$1"; rgw_mode="$2"; rgw_drift="$3"
-  rgw_shape="${4:-out-of-diff}"
-  rgw_dir="$(new_case_tmpdir)"
-  rgw_base="$(mk_committed_report_fixture "$rgw_dir" fx "$rgw_mode")"
-  # Shape matters since STALE-DIFF-SCOPE-GUARD was narrowed (2026-08-27): a
-  # feature outside the PR diff is examined only when it declares complete
-  # `paths`. A DECLARED fixture can therefore stay out-of-diff (the default,
-  # and the shape that exercises the narrow-scope path with no cross-check),
-  # while a fixture the gate treats as UNDECLARED — any `partial` mode — must
-  # pass `in-diff`, or the gate skips it and the assertion ends up measuring
-  # the fork rather than the mechanism under test.
-  if [ "$rgw_shape" = "in-diff" ]; then
-    pr_touches_artifacts "$rgw_dir" fx
-  fi
-  ( cd "$rgw_dir" && echo drift > "$rgw_drift" && git add -A && git commit -q -m drift )
-  bash "$rgw_gate" "$rgw_dir" --base "$rgw_base" 2>&1
-}
-
-# run_mutation_case — full body of check-stale-scoping.sh's case_mutation
-# (E9 / AC-9); kept here (rather than in check-stale-scoping.sh, which is
-# already at the repo's 800-line-per-file cap) purely for line budget. Relies
-# on $GATE and pass()/fail() from the caller's shell — this file is always
-# sourced into check-stale-scoping.sh, never executed standalone.
-#
-# Two mutations, each applied to a TEMP COPY of the gate — the working tree
-# is never edited and the shipped gate carries no knob (AC-13):
-#   (a) narrow scope forced to match nothing → mechanism becomes "never stale"
-#   (b) completeness forced to always pass  → mechanism becomes blind trust
-# Each perturbation is verified to have actually changed the file (cmp) — a
-# sed whose target text has moved patches nothing, the "mutation" then runs
-# the unmodified gate, and the case would pass while proving nothing.
-run_mutation_case() {
-  work="$(new_case_tmpdir)"
-  cp "$GATE" "$work/gate.sh"
-  # recheck-evidence.js is deliberately NOT copied here: every fixture this
-  # case runs through write_config() sets `recheck: off` (fixtures.sh's
-  # write_config), and pre-merge-check.sh only invokes recheck-evidence.js
-  # when RECHECK_MODE is "strict" or "warn" — never "off". A copy would sit
-  # unused in $work on every run.
-
-  # Baseline: the unpatched temp copy must reproduce the real gate's in-scope
-  # catch, or nothing below proves anything about the mutations.
-  base_out="$(run_gate_with_drift "$work/gate.sh" all src/covered/new.txt)"
-  printf '%s\n' "$base_out" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail mutation "temp copy does not reproduce the real gate: $base_out"
-
-  # (a) neutralize the scope check inside stale_files() so a set scope always
-  # "continue"s — every changed file is skipped whenever narrow scope applies,
-  # i.e. a feature with a narrow scope is never reported stale again.
-  sed 's/match_globs "\$f" "\$scope" || continue/continue/' \
-    "$work/gate.sh" > "$work/gate_a.sh"
-  cmp -s "$work/gate.sh" "$work/gate_a.sh" \
-    && fail mutation "perturbation (a) patched nothing — the sed target moved"
-  a_out="$(run_gate_with_drift "$work/gate_a.sh" all src/covered/new.txt)"
-  printf '%s\n' "$a_out" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    && fail mutation "perturbation (a) did not go RED — in-scope changes are not actually caught"
-
-  # (b) neutralize feature_scope's completeness proof: a "partial" declaration
-  # (one eval left undeclared) is then trusted as complete, scoping ONLY to
-  # what WAS declared and silently dropping the undeclared eval's implicit
-  # "everything" — drift outside that narrowed scope goes unreported.
-  #
-  # Completeness lives in TWO places since the per-eval distribution proof was
-  # added: the file-wide total, and the awk that walks each eval item. Patching
-  # only the total leaves the awk still refusing, so the mechanism does NOT
-  # break and this perturbation would silently stop testing anything — the
-  # exact vacuous-guard failure this case exists to rule out. Both sites are
-  # patched, and each is asserted to have actually matched, so a future edit
-  # that moves either one turns this case red instead of quietly weakening it.
-  sed 's/\[ "\$n_evals" -eq "\$n_paths" \] || return 1/:/' \
-    "$work/gate.sh" > "$work/gate_b0.sh"
-  cmp -s "$work/gate.sh" "$work/gate_b0.sh" \
-    && fail mutation "perturbation (b) patched nothing — the total-count sed target moved"
-  sed 's/END { if (open \&\& n != 1) bad = 1; exit (bad ? 1 : 0) }/END { exit 0 }/' \
-    "$work/gate_b0.sh" > "$work/gate_b.sh"
-  cmp -s "$work/gate_b0.sh" "$work/gate_b.sh" \
-    && fail mutation "perturbation (b) patched nothing — the per-eval awk sed target moved"
-  b_out="$(run_gate_with_drift "$work/gate_b.sh" partial src/uncovered/new.txt)"
-  printf '%s\n' "$b_out" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    && fail mutation "perturbation (b) did not go RED — a partial declaration is trusted"
-
-  # Revert: the unpatched copy is green again on both shapes.
-  r1="$(run_gate_with_drift "$work/gate.sh" all src/covered/new.txt)"
-  printf '%s\n' "$r1" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail mutation "revert: in-scope change no longer caught"
-  # Unpatched + `partial` = treated as UNDECLARED, so the narrowed fork skips it
-  # out-of-diff; in-diff is what makes the whole-tree fallback observable here.
-  r2="$(run_gate_with_drift "$work/gate.sh" partial src/uncovered/new.txt in-diff)"
-  printf '%s\n' "$r2" | grep -q 'VIOLATION \[fx\]: evidence is stale' \
-    || fail mutation "revert: partial declaration no longer falls back"
-  pass mutation
-}
-
-# run_indent_drift_case — full body of check-stale-scoping.sh's
-# case_indent_drift (E-indent-drift / AC-6); kept here (rather than in
-# check-stale-scoping.sh, which is already at the repo's 800-line-per-file
-# cap) purely for line budget. Relies on $GATE and pass()/fail() from the
-# caller's shell — this file is always sourced into check-stale-scoping.sh,
-# never executed standalone.
-run_indent_drift_case() {
-  # E-indent-drift: an eval whose leading whitespace drifts from the canonical
-  # 2/4-space indent (an ordinary typo, or a literal tab) must not become
-  # invisible to BOTH feature_scope() counters at once — that lets n_evals and
-  # n_paths coincide by accident, feature_scope returns 0 ("complete"), and the
-  # drifted eval's total absence of a `paths` declaration goes unnoticed.
-  #
-  # Reuse feature_scope() from the gate instead of hand-rolling a second
-  # parser, the same way case_guard_not_exempt reuses match_globs(): a private
-  # copy would silently drift from what the gate actually does. Extracting
-  # only the function body (not sourcing/executing the whole gate script,
-  # which has side effects and calls exit) keeps this guard tested against the
-  # exact parser the gate ships.
-  feature_scope_src="$(sed -n '/^feature_scope()/,/^}/p' "$GATE")"
-  [ -n "$feature_scope_src" ] || fail indent-drift "could not extract feature_scope() from $GATE"
-  eval "$feature_scope_src"
-
-  d="$(new_case_tmpdir)"
-
-  # Space-drift variant: E1 canonically indented and declares paths; E2
-  # drifted to a 3-space "- id:" / "criterion:" pair and declares none.
-  cat > "$d/space-drift.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    paths: ["src/covered/**"]
-   - id: E2
-     criterion: AC-2
-YAML
-  out="$(feature_scope "$d/space-drift.yaml")"; rc=$?
-  [ "$rc" -ne 0 ] \
-    || fail indent-drift "space-drifted eval was invisible to both counters — feature_scope returned 0 (globs: $out)"
-
-  # Tab-drift variant: same shape, drifted line prefixed with a literal tab
-  # instead of an odd space count.
-  printf 'schema_version: 1\nfeature_slug: fx\nevals:\n  - id: E1\n    paths: ["src/covered/**"]\n\t- id: E2\n\tcriterion: AC-2\n' \
-    > "$d/tab-drift.yaml"
-  out="$(feature_scope "$d/tab-drift.yaml")"; rc=$?
-  [ "$rc" -ne 0 ] \
-    || fail indent-drift "tab-drifted eval was invisible to both counters — feature_scope returned 0 (globs: $out)"
-
-  # Block-scalar decoy: E2 declares no `paths`, but its `expected: |` block
-  # scalar contains a prose line that reads "paths: [...]" at the SAME
-  # indentation an eval-level declaration would use. A parser that counts
-  # `paths:` occurrences without excluding block-scalar bodies mistakes that
-  # prose for a declaration and folds its glob into the union.
-  cat > "$d/block-scalar-decoy.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    criterion: AC-1
-    paths: ["src/covered/**"]
-  - id: E2
-    criterion: AC-2
-    expected: |
-    exit 0; decoy prose at eval-key indentation:
-    paths: ["src/decoy/**"]
-    must not be read as a declaration
-YAML
-  out="$(feature_scope "$d/block-scalar-decoy.yaml")"; rc=$?
-  [ "$rc" -ne 0 ] \
-    || fail indent-drift "block-scalar decoy 'paths:' prose was counted as a declaration — feature_scope returned 0 (globs: $out)"
-
-  # Top-level-key decoy: a feature-level `paths:` key that is a sibling of
-  # `evals:` (not under any eval item) must not be counted toward
-  # completeness or joined into the union — E2 below declares no `paths` of
-  # its own.
-  cat > "$d/toplevel-key-decoy.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-paths: ["src/decoy/**"]
-evals:
-  - id: E1
-    criterion: AC-1
-    paths: ["src/covered/**"]
-  - id: E2
-    criterion: AC-2
-YAML
-  out="$(feature_scope "$d/toplevel-key-decoy.yaml")"; rc=$?
-  [ "$rc" -ne 0 ] \
-    || fail indent-drift "feature-level top-level 'paths:' key was counted as an eval declaration — feature_scope returned 0 (globs: $out)"
-
-  # Multi-line array: E2's `paths:` opens a bracket array but its globs
-  # continue on following lines, closing on a THIRD line. A line-based
-  # extractor cannot read continuation lines, so a parser that counts this
-  # opening line toward completeness (matching only the prefix, not
-  # requiring the closing `]` on the same line) reaches a false "complete"
-  # reading while contributing zero globs for E2 — the exact defect this
-  # case guards against regressing.
-  cat > "$d/multiline-array.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    criterion: AC-1
-    paths: ["src/covered/**"]
-  - id: E2
-    criterion: AC-2
-    paths: [
-      "src/extra/**",
-      "src/more/**"
-    ]
-YAML
-  out="$(feature_scope "$d/multiline-array.yaml")"; rc=$?
-  [ "$rc" -ne 0 ] \
-    || fail indent-drift "multi-line 'paths:' array was counted as a complete declaration — feature_scope returned 0 (globs: $out)"
-
-  # Same shape, but the multi-line array is the ONLY eval in the file — this
-  # used to return non-zero already, but for the wrong reason (the union
-  # came out empty, tripping the LAST-resort "zero globs" check). Assert the
-  # actual completeness check (n_evals vs n_paths) is what refuses it, not
-  # an accidental empty union: a file with a real second declared eval whose
-  # globs happened to overlap would otherwise slip through.
-  cat > "$d/multiline-array-only.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    criterion: AC-1
-    paths: [
-      "src/extra/**",
-      "src/more/**"
-    ]
-YAML
-  out="$(feature_scope "$d/multiline-array-only.yaml")"; rc=$?
-  [ "$rc" -ne 0 ] \
-    || fail indent-drift "multi-line 'paths:' array as the only eval was counted as a complete declaration — feature_scope returned 0 (globs: $out)"
-
-  # Trailing inline comment: `paths: [...] # note` must yield the clean glob
-  # with the comment stripped, not a garbage glob with "# note" appended.
-  # This is the success-path counterpart to the two cases above: the file IS
-  # a complete, single-line declaration, so feature_scope must accept it
-  # (rc 0) and the emitted union must contain no "#" fragment.
-  cat > "$d/trailing-comment.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    criterion: AC-1
-    paths: ["src/covered/**"] # note
-  - id: E2
-    criterion: AC-2
-    paths: ["src/more/**"]
-YAML
-  out="$(feature_scope "$d/trailing-comment.yaml")"; rc=$?
-  [ "$rc" -eq 0 ] \
-    || fail indent-drift "single-line 'paths:' array with a trailing comment was refused — feature_scope returned $rc"
-  printf '%s\n' "$out" | grep -q '#' \
-    && fail indent-drift "trailing comment leaked into the emitted glob union: $out"
-  printf '%s\n' "$out" | grep -qx 'src/covered/\*\*' \
-    || fail indent-drift "expected clean glob 'src/covered/**' missing from union: $out"
-
-  # Bracket-class glob: a glob containing `]` (from a character class like
-  # `foo[0-9]`) must survive intact — this is the defect that shipped four
-  # rounds in a row: `[^]]*` (or any bracket-splitting extractor) stops at the
-  # FIRST `]`, truncating the glob and dropping every sibling after it.
-  cat > "$d/bracket-glob.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    criterion: AC-1
-    paths: ["src/foo[0-9]/**", "src/bar/**"]
-  - id: E2
-    criterion: AC-2
-    paths: ["src/more/**"]
-YAML
-  out="$(feature_scope "$d/bracket-glob.yaml")"; rc=$?
-  [ "$rc" -eq 0 ] \
-    || fail indent-drift "bracket-class glob declaration was refused — feature_scope returned $rc"
-  printf '%s\n' "$out" | grep -qx 'src/foo\[0-9\]/\*\*' \
-    || fail indent-drift "bracket-class glob truncated or missing from union: $out"
-  printf '%s\n' "$out" | grep -qx 'src/bar/\*\*' \
-    || fail indent-drift "sibling glob after a bracket-class glob was dropped from union: $out"
-
-  # Single-quoted items: not the accepted grammar — refused, not tolerated.
-  cat > "$d/single-quoted.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    criterion: AC-1
-    paths: ['src/a/**']
-YAML
-  out="$(feature_scope "$d/single-quoted.yaml")"; rc=$?
-  [ "$rc" -ne 0 ] \
-    || fail indent-drift "single-quoted paths items were accepted — feature_scope returned 0 (globs: $out)"
-
-  # Nested array: not the accepted grammar — refused, not tolerated.
-  cat > "$d/nested-array.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    criterion: AC-1
-    paths: [["a"], "b"]
-YAML
-  out="$(feature_scope "$d/nested-array.yaml")"; rc=$?
-  [ "$rc" -ne 0 ] \
-    || fail indent-drift "nested array paths was accepted — feature_scope returned 0 (globs: $out)"
-
-  # Trailing non-comment suffix: anything after `]` that is not a `#`
-  # comment must be refused, not silently ignored.
-  cat > "$d/trailing-junk.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    criterion: AC-1
-    paths: ["a"] junk
-YAML
-  out="$(feature_scope "$d/trailing-junk.yaml")"; rc=$?
-  [ "$rc" -ne 0 ] \
-    || fail indent-drift "trailing non-comment suffix after ']' was accepted — feature_scope returned 0 (globs: $out)"
-
-  # Hyphenated-key block-scalar decoy: a key-name allow-list (e.g.
-  # `[a-zA-Z_]*:`) never matches `expected-output:`, so its block-scalar body
-  # is read as ordinary content and a decoy `paths:` line inside it is
-  # mistaken for a real declaration. The guard must refuse the whole file
-  # structurally (by "value starts with `|`/`>`"), regardless of the key
-  # spelling.
-  cat > "$d/hyphen-key-block-scalar.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    criterion: AC-1
-    paths: ["src/covered/**"]
-  - id: E2
-    criterion: AC-2
-    expected-output: |
-    decoy prose:
-    paths: ["src/decoy/**"]
-YAML
-  out="$(feature_scope "$d/hyphen-key-block-scalar.yaml")"; rc=$?
-  [ "$rc" -ne 0 ] \
-    || fail indent-drift "hyphenated-key ('expected-output:') block-scalar decoy was not refused — feature_scope returned 0 (globs: $out)"
-
-  # Digit-suffixed-key variant of the same bypass: `note2:` is equally
-  # outside any letter-only allow-list.
-  cat > "$d/digit-key-block-scalar.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    criterion: AC-1
-    paths: ["src/covered/**"]
-  - id: E2
-    criterion: AC-2
-    note2: |
-    decoy prose:
-    paths: ["src/decoy/**"]
-YAML
-  out="$(feature_scope "$d/digit-key-block-scalar.yaml")"; rc=$?
-  [ "$rc" -ne 0 ] \
-    || fail indent-drift "digit-suffixed-key ('note2:') block-scalar decoy was not refused — feature_scope returned 0 (globs: $out)"
-
-  # Single-line value containing `>` after the colon, but NOT as the first
-  # character of the value: must NOT be refused. This is the other direction
-  # of the same check — the block-scalar guard must key off the indicator
-  # being the START of the value, not merely present somewhere on the line.
-  cat > "$d/value-contains-gt.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    criterion: AC-1
-    expected: "exit 0; a > b"
-    paths: ["src/covered/**"]
-  - id: E2
-    criterion: AC-2
-    paths: ["src/more/**"]
-YAML
-  out="$(feature_scope "$d/value-contains-gt.yaml")"; rc=$?
-  [ "$rc" -eq 0 ] \
-    || fail indent-drift "a single-line value merely containing '>' after the colon was wrongly refused — feature_scope returned $rc"
-  printf '%s\n' "$out" | grep -qx 'src/covered/\*\*' \
-    || fail indent-drift "expected glob 'src/covered/**' missing from union: $out"
-  printf '%s\n' "$out" | grep -qx 'src/more/\*\*' \
-    || fail indent-drift "expected glob 'src/more/**' missing from union: $out"
-
-  # Colon-in-key decoy (the live Critical this round closes): a quoted key
-  # whose OWN text contains a colon (`"note: x":`) defeats an extractor that
-  # anchors the block-scalar guard on the FIRST colon in the line — it lands
-  # mid-key instead of at the key's true end, reads the rest of the line as
-  # if it were the value, and never recognizes the `|` that follows as a
-  # block-scalar indicator. The prose beneath it (including a decoy
-  # `paths:` line) then leaks straight into either counter.
-  cat > "$d/colon-in-key.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    paths: ["src/covered/**"]
-  - id: E2
-    "note: x": |
-    decoy:
-    paths: ["src/decoy/**"]
-YAML
-  out="$(feature_scope "$d/colon-in-key.yaml")"; rc=$?
-  [ "$rc" -ne 0 ] \
-    || fail indent-drift "colon-in-key decoy ('\"note: x\":') was not refused — feature_scope returned 0 (globs: $out)"
-
-  # Quoted key: not a shape this line-based parser can read reliably (is the
-  # key `expected`, or is the key `"expected"` — a different string?) — must
-  # be refused structurally, not tolerated as if unquoting were free.
-  cat > "$d/quoted-key.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    paths: ["src/covered/**"]
-  - id: E2
-    "expected": |
-    decoy prose:
-    paths: ["src/decoy/**"]
-YAML
-  out="$(feature_scope "$d/quoted-key.yaml")"; rc=$?
-  [ "$rc" -ne 0 ] \
-    || fail indent-drift "quoted key ('\"expected\":') was not refused — feature_scope returned 0 (globs: $out)"
-
-  # Key with an embedded space: `my key: |` is not `[A-Za-z_][A-Za-z0-9_-]*:`
-  # and must be refused rather than treated as some normalized key name.
-  cat > "$d/space-in-key.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    paths: ["src/covered/**"]
-  - id: E2
-    my key: |
-    decoy prose:
-    paths: ["src/decoy/**"]
-YAML
-  out="$(feature_scope "$d/space-in-key.yaml")"; rc=$?
-  [ "$rc" -ne 0 ] \
-    || fail indent-drift "key with an embedded space ('my key:') was not refused — feature_scope returned 0 (globs: $out)"
-
-  # Hyphenated key with a single-line (non-block-scalar) value: must NOT be
-  # refused. This is the positive counterpart to the key-grammar checks
-  # above — a legal, ordinary eval-level key that merely happens to be
-  # kebab-case, with every eval in the file declaring real `paths`, must
-  # still be accepted and its `paths` still joined into the union.
-  cat > "$d/hyphen-key-singleline.yaml" <<'YAML'
-schema_version: 1
-feature_slug: fx
-evals:
-  - id: E1
-    criterion: AC-1
-    extra-note: "hello"
-    paths: ["src/covered/**"]
-  - id: E2
-    criterion: AC-2
-    paths: ["src/more/**"]
-YAML
-  out="$(feature_scope "$d/hyphen-key-singleline.yaml")"; rc=$?
-  [ "$rc" -eq 0 ] \
-    || fail indent-drift "hyphenated key with a single-line value ('extra-note: \"hello\"') was wrongly refused — feature_scope returned $rc"
-  printf '%s\n' "$out" | grep -qx 'src/covered/\*\*' \
-    || fail indent-drift "expected glob 'src/covered/**' missing from union: $out"
-  printf '%s\n' "$out" | grep -qx 'src/more/\*\*' \
-    || fail indent-drift "expected glob 'src/more/**' missing from union: $out"
-
-  pass indent-drift
-}
diff --git a/scripts/acceptance/test-scope-namespace.sh b/scripts/acceptance/test-scope-namespace.sh
deleted file mode 100755
index caad51a6..00000000
--- a/scripts/acceptance/test-scope-namespace.sh
+++ /dev/null
@@ -1,223 +0,0 @@
-#!/usr/bin/env bash
-# Guard for the path-namespace half of gate-scope-anchors — variant 5 of the
-# "asked in one universe, answered in another" family that stale-scope-by-paths
-# named, fixed four of, and left open with an explicit "do not patch piecemeal".
-#
-# scope_has_any_match() decides whether a feature's declared `paths` are usable
-# at all; stale_files() then applies them. When the two disagree about WHICH
-# files exist, a wholly honest declaration can be granted a scope that filters
-# out every real change, forever, on every later pull request — silently. That
-# is the shape tested here.
-#
-# Lives under scripts/acceptance/ on purpose: t1_skip_globs exempts the gate
-# tooling by EXACT path, so this file is gated and the gate applies to the change
-# that alters the gate.
-set -u
-HERE="$(cd "$(dirname "$0")" && pwd)"
-ROOT="$(cd "$HERE/../.." && pwd)"
-GATE="$ROOT/scripts/pre-merge-check.sh"
-
-KNOWN_CASES="exempt-refused variants-discriminating legit-granted case-completeness"
-
-TMPDIRS="$(mktemp)"
-new_tmp() { d="$(mktemp -d)"; printf '%s\n' "$d" >> "$TMPDIRS"; printf '%s' "$d"; }
-cleanup() {
-  [ -f "$TMPDIRS" ] || return 0
-  while IFS= read -r d; do [ -n "$d" ] && rm -rf "$d"; done < "$TMPDIRS"
-  rm -f "$TMPDIRS"
-}
-trap cleanup EXIT
-
-pass() { echo "CASE $1: PASS"; }
-fail() { echo "CASE $1: FAIL $2"; exit 1; }
-
-# Extract the two functions under test from a gate FILE and define them in this
-# shell. Sourcing the whole gate is not an option (it has side effects and calls
-# exit), and a private copy would drift from what actually ships. This is the
-# same extraction check-stale-scoping.sh's guard-not-exempt case uses — and it is
-# what lets a perturbed COPY be tested without any knob in the shipped gate.
-load_gate_fns() { # <gate-file>
-  local src
-  src="$(sed -n '/^match_globs()/,/^}/p' "$1")
-$(sed -n '/^scope_has_any_match()/,/^}/p' "$1")"
-  case "$src" in
-    *match_globs*scope_has_any_match*) ;;
-    *) return 1 ;;
-  esac
-  eval "$src"
-}
-
-# A fixture repo whose tracked files are mostly exempt ones, plus real source so
-# the repo is not degenerate.
-mk_repo() {
-  local d
-  d="$(new_tmp)"
-  (
-    cd "$d" || exit 1
-    git init -q .
-    git config user.email t@t
-    git config user.name t
-    mkdir -p docs src/lib _acceptance/feat
-    printf 'd\n' > docs/guide.md
-    printf 'c\n' > CHANGELOG.md
-    printf 's\n' > src/lib/real.ts
-    printf 'a\n' > _acceptance/feat/contract.md
-    git add -A && git commit -qm base
-  ) >/dev/null 2>&1 || return 1
-  printf '%s' "$d"
-}
-
-case_exempt_refused() {
-  # AC-1 / E1: a union that only ever matches exempt files must be REFUSED.
-  # stale_files() drops those files before scope is applied, so such a scope
-  # could never report anything again — granting it makes the feature
-  # permanently un-stale, silently.
-  d="$(mk_repo)" || fail exempt-refused "could not build the fixture repo"
-  load_gate_fns "$GATE" || fail exempt-refused "could not extract the gate functions"
-  T1_GLOBS="docs/**
-CHANGELOG.md"
-  if scope_has_any_match "$d" 'docs/**'; then
-    fail exempt-refused "narrow scope granted to a union that only matches t1-exempt files"
-  fi
-  if scope_has_any_match "$d" 'CHANGELOG.md'; then
-    fail exempt-refused "narrow scope granted to a union that only matches an exempt literal"
-  fi
-  # _acceptance/** is dropped by stale_files() through a different branch, so it
-  # is a separate way into the same hole and gets its own assertion.
-  if scope_has_any_match "$d" '_acceptance/**'; then
-    fail exempt-refused "narrow scope granted to a union that only matches _acceptance/"
-  fi
-  pass exempt-refused
-}
-
-case_legit_granted() {
-  # AC-3 / E3: the suppression half. A declaration pointing at real gated code
-  # must STILL be granted — a fix that refuses everyone rebuilds the treadmill
-  # that stale-scope-by-paths existed to remove.
-  d="$(mk_repo)" || fail legit-granted "could not build the fixture repo"
-  load_gate_fns "$GATE" || fail legit-granted "could not extract the gate functions"
-  T1_GLOBS="docs/**
-CHANGELOG.md"
-  scope_has_any_match "$d" 'src/lib/**' \
-    || fail legit-granted "narrow scope refused for a union pointing at real code"
-  # A mixed union is legitimate too: it can still report something.
-  scope_has_any_match "$d" 'docs/**
-src/lib/**' || fail legit-granted "mixed union refused although it matches real code"
-
-  # A non-ASCII filename is the same namespace question in a different disguise:
-  # git quotes such paths in ls-files by default while stale_files() reads them
-  # unquoted from diff. If the two disagree, a declaration whose only match is
-  # such a file is refused narrow scope even though staleness could report it.
-  ( cd "$d" && printf 's\n' > "src/lib/café.ts" && git add -A && git commit -qm accented ) >/dev/null 2>&1 \
-    || fail legit-granted "could not add a non-ASCII fixture file"
-  ( cd "$d" && git rm -q --cached src/lib/real.ts && git commit -qm "leave only the accented file" ) >/dev/null 2>&1 \
-    || fail legit-granted "could not isolate the non-ASCII file"
-  scope_has_any_match "$d" 'src/lib/**' \
-    || fail legit-granted "a union whose only match is a non-ASCII path was refused — ls-files and diff are spelling it differently"
-  pass legit-granted
-}
-
-case_variants_discriminating() {
-  # AC-2 / E2: the variants stale-scope-by-paths already fixed must still be
-  # catchable. Perturb a COPY of the gate — never the shipped one, where an env
-  # knob would itself be the fail-open (check-stale-scoping.sh's no-kill-switch
-  # case asserts exactly that) — and require each perturbation to make this
-  # harness red.
-  d="$(mk_repo)" || fail variants-discriminating "could not build the fixture repo"
-  T1_GLOBS="docs/**
-CHANGELOG.md"
-
-  # v1 — namespace: ls-files WITHOUT --full-name prints paths relative to the
-  # directory asked about, while every other consumer of these globs matches
-  # against `git diff --name-only`, which prints paths relative to the git
-  # top-level. The two coincide only when the root IS the git root; in the
-  # monorepo layout the gate supports they diverge, and a declaration that
-  # matches the ls-files spelling then filters out every real change.
-  ( cd "$d" && mkdir -p pkg && git mv src pkg/src && git commit -qm move ) >/dev/null 2>&1 \
-    || fail variants-discriminating "could not build the monorepo-shaped fixture"
-  copy="$(new_tmp)/gate.sh"
-  cp "$GATE" "$copy"
-  perl -0pi -e 's/ls-files --full-name/ls-files/' "$copy"
-  grep -q 'ls-files --full-name' "$copy" \
-    && fail variants-discriminating "v1 perturbation did not apply"
-  load_gate_fns "$copy" || fail variants-discriminating "could not extract from the perturbed copy (v1)"
-  if scope_has_any_match "$d/pkg" 'pkg/src/**'; then
-    fail variants-discriminating "v1 (namespace) not caught: a top-level-relative union matched a directory-relative listing"
-  fi
-  load_gate_fns "$GATE" || fail variants-discriminating "could not reload the shipped gate"
-  scope_has_any_match "$d/pkg" 'pkg/src/**' \
-    || fail variants-discriminating "v1 control failed: the shipped gate must still accept this union"
-
-  # v2 — prefix: matching only the leading path component, so a declaration of
-  # `src/not-real/**` would be accepted merely because `src/` exists. Perturb
-  # match_globs to compare leading components instead of whole patterns.
-  #
-  # The probe deliberately uses a NON-exempt prefix (`src/`, not `docs/`): under
-  # the prefix perturbation the exempt filter above degrades in the same way, so
-  # an exempt-prefixed probe would be skipped as exempt and the perturbation
-  # would look inert. The "perturbation is inert" assertion below is what makes
-  # that failure loud instead of a vacuous green.
-  d2="$(mk_repo)" || fail variants-discriminating "could not build the v2 fixture repo"
-  copy2="$(new_tmp)/gate2.sh"
-  cp "$GATE" "$copy2"
-  python3 - "$copy2" <<'PERTURB' || fail variants-discriminating "v2 perturbation did not apply"
-import sys
-p = sys.argv[1]
-s = open(p).read()
-old = '    case "$1" in $g) return 0 ;; esac\n'
-new = '    case "${1%%/*}" in ${g%%/*}) return 0 ;; esac\n'
-if old not in s:
-    sys.exit(1)
-open(p, 'w').write(s.replace(old, new))
-PERTURB
-  load_gate_fns "$copy2" || fail variants-discriminating "could not extract from the perturbed copy (v2)"
-  if ! scope_has_any_match "$d2" 'src/not-real/**'; then
-    fail variants-discriminating "v2 perturbation is inert: a prefix matcher must accept src/not-real/**"
-  fi
-  load_gate_fns "$GATE" || fail variants-discriminating "could not reload the shipped gate"
-  if scope_has_any_match "$d2" 'src/not-real/**'; then
-    fail variants-discriminating "v2 (prefix) not caught: the shipped gate accepts a path that does not exist"
-  fi
-
-  # v3 / v4 — total-vs-distribution and look-behind attribution live in
-  # feature_scope() and slug_acceptance_touched(), already pinned by
-  # check-stale-scoping.sh's partial and merged-halves cases. Assert those stay
-  # wired rather than duplicating them: a second copy of a guard is a second
-  # thing to drift.
-  for c in partial merged-halves; do
-    grep -F -- "--case $c" "$ROOT/_acceptance/config.yaml" >/dev/null \
-      || fail variants-discriminating "variant guard '--case $c' is no longer wired in config.yaml"
-  done
-  pass variants-discriminating
-}
-
-case_case_completeness() {
-  missing=""
-  for c in $KNOWN_CASES; do
-    fn="case_$(printf '%s' "$c" | tr '-' '_')"
-    command -v "$fn" >/dev/null 2>&1 || missing="$missing $c"
-  done
-  [ -z "$missing" ] || fail case-completeness "unimplemented cases:$missing"
-  if bash "$0" definitely-not-a-case >/dev/null 2>&1; then
-    fail case-completeness "an unknown case name exited 0"
-  fi
-  missing_cfg=""
-  for c in $KNOWN_CASES; do
-    grep -F -- "test-scope-namespace.sh $c" "$ROOT/_acceptance/config.yaml" >/dev/null 2>&1 \
-      || missing_cfg="$missing_cfg $c"
-  done
-  [ -z "$missing_cfg" ] \
-    || fail case-completeness "cases with no executors.script entry in _acceptance/config.yaml:$missing_cfg"
-  pass case-completeness
-}
-
-main() {
-  [ "$#" -ge 1 ] || { echo "usage: $(basename "$0") <case>" >&2; exit 2; }
-  case " $KNOWN_CASES " in
-    *" $1 "*) ;;
-    *) echo "unknown case '$1' (known: $KNOWN_CASES)" >&2; exit 2 ;;
-  esac
-  "case_$(printf '%s' "$1" | tr '-' '_')"
-}
-
-main "$@"
diff --git a/scripts/ci/check-product-map-teeth.sh b/scripts/ci/check-product-map-teeth.sh
deleted file mode 100755
index e0293005..00000000
--- a/scripts/ci/check-product-map-teeth.sh
+++ /dev/null
@@ -1,325 +0,0 @@
-#!/usr/bin/env bash
-# Teeth for check-product-map.mjs.
-#
-# ONE EXIT CODE PER CASE. A case that was never implemented looks identical to a
-# case that passed, and both are green. This repo already paid for that lesson
-# once — see the `stale-scope-by-paths` comment in _acceptance/config.yaml.
-#
-# `--case` is REPEATABLE here, unlike scripts/roadmap/check-roadmap-guard-teeth.sh
-# which takes one name and overwrites on repeat. Three declared executors pass
-# two or three cases in a single invocation (pmap_teeth_unreadable,
-# pmap_teeth_extra_slug, pmap_teeth_source_buckets); overwriting would silently
-# measure only the last one and report the rest as covered.
-#
-# An unknown `--case` is REFUSED loudly (exit 2 + the valid list) rather than
-# skipped: a typo that exits 0 turns an eval into a permanent green no-op, which
-# is the same fail-open class the checker under test exists to close.
-#
-# Usage (from the repo root):
-#   bash scripts/ci/check-product-map-teeth.sh                    # every case
-#   bash scripts/ci/check-product-map-teeth.sh --case missing-slug
-#   bash scripts/ci/check-product-map-teeth.sh --list
-set -euo pipefail
-cd "$(dirname "$0")/../.."
-
-repo_root=$(pwd)
-checker="$repo_root/scripts/ci/check-product-map.mjs"
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' EXIT
-
-# Order is the reading order of the report, not an execution dependency: every
-# case builds its own fixture from scratch and can run alone.
-CASES=(
-    clean
-    missing-slug
-    count-mismatch
-    opportunity-mismatch
-    artifact-missing
-    artifact-unreadable
-    extra-slug
-    status-downgraded
-    contract-unparsable
-    status-unknown
-    dir-empty
-    parked-opportunity
-)
-
-is_case() {
-    local n="$1" c
-    for c in "${CASES[@]}"; do [ "$c" = "$n" ] && return 0; done
-    return 1
-}
-
-# A minimal tree the checker can read: PRODUCT-MAP.md plus the two files it
-# classifies dossiers by. Nothing else is copied, so a case cannot accidentally
-# pass because of a file the checker never reads.
-build_fixture() {
-    rm -rf "$tmp/t"
-    mkdir -p "$tmp/t/_acceptance"
-    cp "$repo_root/PRODUCT-MAP.md" "$tmp/t/PRODUCT-MAP.md"
-    for d in "$repo_root"/_acceptance/*/; do
-        slug=$(basename "$d")
-        mkdir -p "$tmp/t/_acceptance/$slug"
-        [ -f "$d/contract.md" ] && cp "$d/contract.md" "$tmp/t/_acceptance/$slug/contract.md"
-        [ -f "$d/opportunity.md" ] && cp "$d/opportunity.md" "$tmp/t/_acceptance/$slug/opportunity.md"
-    done
-    return 0
-}
-
-# The checker runs once per case and its output is KEPT. Several criteria are
-# about the MESSAGE (name the slug, print both numbers), and a teeth script that
-# throws output away can only ever assert red-or-green — a fix that impoverishes
-# the message would keep every case passing.
-check_capture() {
-    local rc=0
-    (cd "$tmp/t" && node "$checker") >"$tmp/out" 2>&1 || rc=$?
-    return $rc
-}
-check_is_red() { ! check_capture; }
-check_is_green() { check_capture; }
-out_has() { grep -Eq -- "$1" "$tmp/out"; }
-
-# --- the cases ------------------------------------------------------------
-# Each returns 0 when the checker behaved as the criterion requires.
-
-# AC-1 control. Without it a checker hardcoded to `exit 1` passes every red case
-# below, and the whole suite reads as proof of teeth it does not have.
-case_clean() {
-    build_fixture
-    check_is_green || return 1
-    # The count line must be PRESENT and all three numbers EQUAL. A checker that
-    # prints "0 signed, 0 on the map, 0 in the node" is also green, and that
-    # green means nothing.
-    out_has 'đã giao: [0-9]+ hồ sơ ký, [0-9]+ mục trên bản đồ, nút mermaid [0-9]+' || return 1
-    python3 - "$tmp/out" <<'COUNTS'
-import sys, pathlib, re
-m = re.search(r"đã giao: (\d+) hồ sơ ký, (\d+) mục trên bản đồ, nút mermaid (\d+)",
-              pathlib.Path(sys.argv[1]).read_text(encoding="utf-8"))
-if not m: raise SystemExit("thiếu dòng đếm")
-a, b, c = (int(x) for x in m.groups())
-if not (a == b == c): raise SystemExit(f"ba số lệch: {a} / {b} / {c}")
-if a == 0: raise SystemExit("cây thật phải có hồ sơ đã ký")
-COUNTS
-}
-
-# AC-1. Drop ONE signed slug from the `## Đã giao` block.
-#
-# The fixture FIRST adds a second mention of that slug elsewhere in the file,
-# then removes it from the block. Without that, this case cannot tell "reads
-# inside the block" from "greps the whole file" — a whole-file grep would pass
-# it. Adding the decoy to the COPY rather than to PRODUCT-MAP.md itself is
-# deliberate: that file is generated, so a hand-added line would vanish on the
-# next regeneration and take this case's discriminating power with it.
-case_missing_slug() {
-    build_fixture
-    python3 - "$tmp/t/PRODUCT-MAP.md" <<'DECOY'
-import sys, pathlib
-p = pathlib.Path(sys.argv[1])
-t = p.read_text(encoding="utf-8")
-slug = "chong-mat-khoa-byo"
-# Decoy outside every parsed block: a prose line under the mermaid diagram.
-t = t.replace("## Đang cân nhắc cơ hội",
-              f"> Ghi chú mồi nhử: `{slug}` cũng được nhắc ở đây.\n\n## Đang cân nhắc cơ hội", 1)
-# Now remove the real entry from the delivered block.
-t = "".join(l for l in t.splitlines(keepends=True) if f"(`{slug}`)" not in l)
-p.write_text(t, encoding="utf-8")
-DECOY
-    check_is_red || return 1
-    out_has 'chong-mat-khoa-byo' || return 1 # names the slug, not "the map is off"
-}
-
-# AC-2. Wrong number in the mermaid node. The message must carry BOTH numbers:
-# naming one says neither how far off it is nor in which direction. This is the
-# drift that actually happened — the map read 22 while 26 dossiers were signed.
-case_count_mismatch() {
-    build_fixture
-    python3 - "$tmp/t/PRODUCT-MAP.md" <<'BREAK'
-import sys, pathlib, re
-p = pathlib.Path(sys.argv[1])
-p.write_text(re.sub(r"Đã giao<br/>\d+ việc", "Đã giao<br/>99 việc",
-                    p.read_text(encoding="utf-8")), encoding="utf-8")
-BREAK
-    check_is_red || return 1
-    python3 - "$tmp/out" <<'BOTH'
-import sys, pathlib, re
-t = pathlib.Path(sys.argv[1]).read_text(encoding="utf-8")
-line = next((l for l in t.splitlines() if "99" in l and "FAIL" in l), None)
-if line is None: raise SystemExit("không có dòng FAIL nào nêu số 99")
-nums = {int(n) for n in re.findall(r"\d+", line)}
-if not (nums - {99}): raise SystemExit(f"chỉ nêu một số: {line}")
-BOTH
-}
-
-# AC-3. A new opportunity-only dossier the map does not know about. The
-# opportunity block gets the same treatment as the delivered one; a guard that
-# only watches the popular half is a guard with a documented blind side.
-case_opportunity_mismatch() {
-    build_fixture
-    mkdir -p "$tmp/t/_acceptance/teeth-probe-opportunity"
-    printf '# probe\n' >"$tmp/t/_acceptance/teeth-probe-opportunity/opportunity.md"
-    check_is_red || return 1
-    out_has 'cân nhắc cơ hội' || return 1
-}
-
-# lat-cat-chung-minh AC-11. A parked opportunity (decision: park) belongs in
-# "Xếp lại sau", not "Đang cân nhắc cơ hội". Before 04/09 the checker binned every
-# opportunity-only dossier as "cân nhắc" and the two sides disagreed on every
-# parked item the moment the map was regenerated.
-case_parked_opportunity() {
-    build_fixture
-    mkdir -p "$tmp/t/_acceptance/teeth-probe-parked"
-    printf -- '---\nschema_version: 1\nslug: teeth-probe-parked\nstage: decided\ndecision: park\n---\n' \
-        >"$tmp/t/_acceptance/teeth-probe-parked/opportunity.md"
-    check_is_red || return 1
-    # Hai `out_has` doc lap quet TOAN BO stdout khong do duoc mot QUAN HE: sau khi
-    # go dung nhanh phan loai park, slug hien o dong FAIL cua o "cân nhắc" con
-    # chuoi "Xếp lại sau" van hien o cac dong FAIL cua ba ho so park that, nen ca
-    # hai deu xanh va ca nay PASS tren dung hoi quy no khai la minh bat (do o S4
-    # vong 3). Slug va O phai nam tren CUNG MOT dong.
-    grep -Eq 'teeth-probe-parked.*\(Xếp lại sau\)' "$tmp/out"
-}
-
-# AC-4 fail-closed (a): the artifact is not there at all.
-case_artifact_missing() {
-    build_fixture
-    rm -f "$tmp/t/PRODUCT-MAP.md"
-    check_is_red || return 1
-    out_has 'PRODUCT-MAP.md' || return 1
-}
-
-# AC-4 fail-closed (b): the file is present but the thing to read inside it is
-# not. A checker that cannot find what it came to check has checked nothing, and
-# exiting 0 there is a lie worse than silence.
-case_artifact_unreadable() {
-    build_fixture
-    python3 - "$tmp/t/PRODUCT-MAP.md" <<'HIDE'
-import sys, pathlib, re
-p = pathlib.Path(sys.argv[1])
-t = p.read_text(encoding="utf-8")
-t = t.replace("## Đã giao\n", "## Đã giao (đổi tiêu đề)\n", 1)
-t = re.sub(r"Đã giao<br/>\d+ việc", "Đã giao", t)
-p.write_text(t, encoding="utf-8")
-HIDE
-    check_is_red || return 1
-    out_has 'không tìm thấy|không đọc được' || return 1
-}
-
-# AC-11. The map advertises a slug that has no dossier at all. AC-1 only walks
-# dossiers -> map, so this direction was uncovered: a withdrawn dossier leaves
-# its row behind and everything stays green. This repo withdrew one for real
-# (`normalize-text-vi`, 26/08).
-case_extra_slug() {
-    build_fixture
-    python3 - "$tmp/t/PRODUCT-MAP.md" <<'GHOST'
-import sys, pathlib
-p = pathlib.Path(sys.argv[1])
-p.write_text(p.read_text(encoding="utf-8").replace(
-    "## Đã giao\n\n", "## Đã giao\n\n- Việc ma (`teeth-probe-ghost`)\n", 1), encoding="utf-8")
-GHOST
-    check_is_red || return 1
-    out_has 'teeth-probe-ghost' || return 1
-}
-
-# AC-11. The dossier still exists but is no longer signed, and the row stays.
-case_status_downgraded() {
-    build_fixture
-    python3 - "$tmp/t/_acceptance/roadmap-drift-guard/contract.md" <<'DOWN'
-import sys, pathlib, re
-p = pathlib.Path(sys.argv[1])
-p.write_text(re.sub(r"(?m)^status: signed-off$", "status: draft",
-                    p.read_text(encoding="utf-8")), encoding="utf-8")
-DOWN
-    check_is_red || return 1
-    out_has 'roadmap-drift-guard' || return 1
-}
-
-# AC-12 bucket four: frontmatter that does not parse at all.
-case_contract_unparsable() {
-    build_fixture
-    printf -- '---\nstatus: [unclosed\n' >"$tmp/t/_acceptance/roadmap-drift-guard/contract.md"
-    check_is_red || return 1
-    out_has 'roadmap-drift-guard' || return 1
-}
-
-# AC-12 bucket four: a status outside the closed set. The quoted form is the
-# realistic typo, and it must land in bucket four — NOT in "signed" and NOT
-# silently in "some other status". Binning it silently is the fail-OPEN: the
-# dossier drops out of the must-appear set, the counts still balance, and the
-# checker goes green while the map is missing exactly that dossier.
-case_status_unknown() {
-    build_fixture
-    python3 - "$tmp/t/_acceptance/roadmap-drift-guard/contract.md" <<'QUOTED'
-import sys, pathlib, re
-p = pathlib.Path(sys.argv[1])
-p.write_text(re.sub(r"(?m)^status: signed-off$", 'status: "signed-off"',
-                    p.read_text(encoding="utf-8")), encoding="utf-8")
-QUOTED
-    check_is_red || return 1
-    out_has 'roadmap-drift-guard' || return 1
-}
-
-# AC-12 bucket four: a directory with neither contract.md nor opportunity.md.
-case_dir_empty() {
-    build_fixture
-    mkdir -p "$tmp/t/_acceptance/teeth-probe-empty"
-    check_is_red || return 1
-    out_has 'teeth-probe-empty' || return 1
-}
-
-# --- runner ---------------------------------------------------------------
-run_case() {
-    local name="$1" fn="case_${1//-/_}"
-    if declare -F "$fn" >/dev/null && "$fn"; then
-        echo "CASE $name: PASS"
-        return 0
-    fi
-    echo "CASE $name: FAIL"
-    return 1
-}
-
-refuse() {
-    echo "check-product-map-teeth: $1" >&2
-    echo "case hợp lệ: ${CASES[*]}" >&2
-    exit 2
-}
-
-# --- CLI ------------------------------------------------------------------
-# Mode is settled before anything runs: a typo must never turn a CHECK into a
-# silent pass.
-SELECTED=()
-while [ $# -gt 0 ]; do
-    case "$1" in
-    --list)
-        printf '%s\n' "${CASES[@]}"
-        exit 0
-        ;;
-    --case)
-        [ $# -ge 2 ] || refuse "\`--case\` cần một tên ngay sau nó — nhận được (trống)"
-        case "$2" in --*) refuse "\`--case\` cần một tên ngay sau nó — nhận được \`$2\`" ;; esac
-        is_case "$2" || refuse "case lạ \`$2\`"
-        SELECTED+=("$2")
-        shift 2
-        ;;
-    *) refuse "tham số lạ \`$1\` — chỉ nhận \`--case <tên>\` và \`--list\`" ;;
-    esac
-done
-[ ${#SELECTED[@]} -eq 0 ] && SELECTED=("${CASES[@]}")
-
-if [ ${#SELECTED[@]} -eq ${#CASES[@]} ]; then
-    echo "→ răng của check-product-map.mjs"
-else
-    echo "→ răng: ${SELECTED[*]}"
-fi
-
-pass=0
-fail=0
-for c in "${SELECTED[@]}"; do
-    if run_case "$c"; then pass=$((pass + 1)); else fail=$((fail + 1)); fi
-done
-
-echo
-if [ "$fail" -ne 0 ]; then
-    echo "❌ răng: $pass đạt / $fail hỏng — bộ kiểm bản đồ không đáng tin"
-    exit 1
-fi
-echo "✅ răng: $pass/$pass case — mỗi case một mã thoát riêng"
diff --git a/scripts/ci/check-product-map.mjs b/scripts/ci/check-product-map.mjs
deleted file mode 100755
index 8e668d82..00000000
--- a/scripts/ci/check-product-map.mjs
+++ /dev/null
@@ -1,337 +0,0 @@
-#!/usr/bin/env node
-// Asserts PRODUCT-MAP.md still matches the dossiers under _acceptance/.
-//
-// Why this exists: `product-map.mjs --check` had ZERO references in
-// .github/workflows/ci.yml (measured 31/08), so it only ran when somebody typed
-// it. The map drifted by four slugs — it advertised 22 delivered items while 26
-// dossiers were signed — and nobody knew.
-//
-// NODE BUILTINS ONLY. The `acceptance-gate` job in .github/workflows/ci.yml has
-// no `pnpm install` step, so node_modules does not exist when this runs.
-// scripts/roadmap/roadmap-drift.mjs is the precedent for hand-rolled parsing.
-//
-// This ASSERTS an invariant rather than regenerating and diffing (the shape
-// `gen_abi_clean` uses for generated TypeScript), because the generator lives in
-// a plugin cache a clean CI runner does not have. Vendoring it would freeze a
-// copy that then drifts into a fork, leaving two different rulers for one thing.
-// Deliberate deviation from the repo's own pattern — see the design doc §4.
-//
-// Run from the repo root: `node scripts/ci/check-product-map.mjs`.
-// Its teeth are proven separately by check-product-map-teeth.sh.
-import { readdirSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-
-const MAP = "PRODUCT-MAP.md";
-const ACCEPTANCE_DIR = "_acceptance";
-
-// The closed set of contract states. A value outside it is NOT quietly treated
-// as "some other status" — see classifyDossiers.
-const STATUS_CLOSED = new Set([
-    "draft",
-    "approved",
-    "implemented",
-    "verified",
-    "machine-cleared",
-    "signed-off",
-]);
-
-// Takes no arguments, and REFUSES the ones it does not know rather than ignoring
-// them. A checker that swallows an unknown flag and exits 0 cannot be told apart
-// from a checker that ran, so a typo in the ci.yml `run:` line would read as a
-// clean check forever — the same fail-open this file exists to close.
-if (process.argv.length > 2) {
-    console.error(
-        `check-product-map: không nhận tham số nào — nhận được: ${process.argv.slice(2).join(" ")}`,
-    );
-    process.exit(2);
-}
-
-const failures = [];
-const fail = (rule, msg) => failures.push(`FAIL ${rule}: ${msg}`);
-const read = (p) => readFileSync(p, "utf8");
-
-function report() {
-    if (failures.length === 0) return;
-    for (const f of failures) console.error(f);
-    console.error(
-        `\n❌ ${MAP} không khớp với ${ACCEPTANCE_DIR}/ — ${failures.length} chỗ lệch.`,
-    );
-    process.exit(1);
-}
-
-// --- read the map, fail-closed ---------------------------------------------
-// A checker that cannot find what it came to check has checked nothing. Exiting
-// 0 here would be a lie worse than silence, so a missing artifact stops the run
-// immediately rather than letting the assertions below read an empty string and
-// find nothing wrong with it.
-let map;
-try {
-    map = read(MAP);
-} catch (err) {
-    fail("bản đồ", `không đọc được ${MAP} (${err.code ?? "lỗi"})`);
-    report();
-    process.exit(1);
-}
-
-/**
- * The `(`slug`)` tokens inside a `## <heading>` section, in document order.
- * Returns null when the heading itself is absent — distinct from an empty
- * section, which is a legitimate state the map renders as "chưa có".
- */
-function blockItems(heading) {
-    // Line-based rather than one regex. The regex form used `\z` for end-of-
-    // input, which JavaScript does not have: it degrades to a literal `z`, so
-    // the section silently ended at the first word containing one and the
-    // checker read 10 of 27 rows while still exiting non-zero — a broken
-    // checker that looks like a working one.
-    const lines = map.split("\n");
-    const start = lines.findIndex((l) => l.trim() === `## ${heading}`);
-    if (start === -1) return null;
-    let end = lines.length;
-    for (let i = start + 1; i < lines.length; i++) {
-        if (lines[i].startsWith("## ")) {
-            end = i;
-            break;
-        }
-    }
-    return lines
-        .slice(start + 1, end)
-        .flatMap((l) =>
-            [...l.matchAll(/\(`([a-z0-9][a-z0-9-]*)`\)/g)].map((x) => x[1]),
-        );
-}
-
-/**
- * The number inside a mermaid node label, e.g. `Đã giao<br/>27 việc`.
- * An empty bucket renders `chưa có` rather than `0 việc`, so that form maps to
- * 0 — treating it as unparsable would make every empty bucket a false alarm.
- * Returns null when neither form is present, which IS a real failure.
- */
-function mermaidCount(label) {
-    const withNumber = map.match(new RegExp(`${label}<br/>(\\d+)\\s*việc`));
-    if (withNumber) return Number(withNumber[1]);
-    if (new RegExp(`${label}<br/>chưa có`).test(map)) return 0;
-    return null;
-}
-
-/**
- * Every directory under _acceptance/ lands in exactly one closed bucket:
- * signed · signed-but-awaiting-UAT · in progress · awaiting scope approval ·
- * opportunity-only · parked · NOT CLASSIFIABLE.
- *
- * The last bucket is red BY NAME, never a silent skip. Without it a dossier
- * whose frontmatter is off by a quote (`status: "signed-off"`) or a capital
- * (`Signed-off`), or whose YAML is broken, gets binned as "not signed": it drops
- * out of the must-appear set, the counts still balance, and the whole checker
- * goes green while the map is missing exactly that dossier. That is a fail-OPEN
- * sitting inside a checker sold as fail-closed.
- */
-// The generator files a dossier by CONTRACT STATUS first, and only falls back to
-// the opportunity's stage/decision when there is no contract. Read the same two
-// fields here or the two sides disagree about every parked or awaiting-UAT item
-// (measured 2026-09-04: regenerating with kit 2.8.0 turned this checker red on a
-// dossier neither side had got wrong).
-function opportunityDecision(slug) {
-    let text;
-    try {
-        text = read(join(ACCEPTANCE_DIR, slug, "opportunity.md"));
-    } catch {
-        return null;
-    }
-    const fm = text.match(/^---\r?\n([\s\S]*?)\r?\n---/);
-    if (!fm) return "";
-    const m = fm[1].match(/^decision:[ \t]*(.*)$/m);
-    return m ? m[1].trim() : "";
-}
-
-function classifyDossiers() {
-    const out = {
-        signed: [],
-        awaitingUat: [],
-        inProgress: [],
-        opportunity: [],
-        parked: [],
-        other: [],
-        unclassified: [],
-    };
-    for (const d of readdirSync(ACCEPTANCE_DIR, { withFileTypes: true })) {
-        if (!d.isDirectory()) continue;
-        const slug = d.name;
-
-        let contract = null;
-        try {
-            contract = read(join(ACCEPTANCE_DIR, slug, "contract.md"));
-        } catch {
-            // No contract — the directory may still be an opportunity.
-        }
-
-        if (contract === null) {
-            const decision = opportunityDecision(slug);
-            if (decision === null) {
-                out.unclassified.push({
-                    slug,
-                    reason: "không có contract.md lẫn opportunity.md",
-                });
-            } else if (decision === "park") {
-                out.parked.push(slug);
-            } else {
-                out.opportunity.push(slug);
-            }
-            continue;
-        }
-
-        const fm = contract.match(/^---\r?\n([\s\S]*?)\r?\n---/);
-        if (!fm) {
-            out.unclassified.push({
-                slug,
-                reason: "frontmatter không đọc được",
-            });
-            continue;
-        }
-
-        const m = fm[1].match(/^status:[ \t]*(.*)$/m);
-        // Deliberately NOT stripping quotes or lowercasing: `"signed-off"` is a
-        // typo to surface, not to normalise away. Normalising is exactly how it
-        // stays invisible.
-        const status = m ? m[1].trim() : "";
-        if (!STATUS_CLOSED.has(status)) {
-            out.unclassified.push({
-                slug,
-                reason: `status lạ \`${status || "(trống)"}\``,
-            });
-        } else if (status === "signed-off") {
-            // A signed dossier that came from an opportunity still owes a UAT
-            // session, so the generator parks it one bucket short of "Đã giao".
-            const decision = opportunityDecision(slug);
-            if (decision === "build" || decision === "iterate")
-                out.awaitingUat.push(slug);
-            else out.signed.push(slug);
-        } else if (status === "draft") {
-            out.other.push(slug);
-        } else {
-            // approved / implemented / verified — code is being written.
-            out.inProgress.push(slug);
-        }
-    }
-    for (const k of [
-        "signed",
-        "awaitingUat",
-        "inProgress",
-        "opportunity",
-        "parked",
-    ])
-        out[k].sort();
-    return out;
-}
-
-const dossiers = classifyDossiers();
-
-// --- the source side must be classifiable ----------------------------------
-for (const { slug, reason } of dossiers.unclassified)
-    fail("nguồn", `\`${slug}\` không phân loại được: ${reason}`);
-
-/**
- * One bucket, both directions, three numbers.
- *
- * The reverse direction (map -> dossiers) is not decoration: a dossier that is
- * WITHDRAWN leaves its row behind, and a forward-only check stays green while
- * the map advertises work that was never delivered. This repo withdrew one for
- * real (`normalize-text-vi`, 26/08).
- */
-function checkBucket({ rule, heading, node, expected }) {
-    const items = blockItems(heading);
-    const count = mermaidCount(node);
-    // The generator omits a section whose bucket is empty (measured 04/09: the
-    // map carried four headings for ten sections). Absent heading + nothing
-    // expected + a mermaid node reading "chưa có" is the healthy empty state,
-    // not drift. Any other combination still fails by name.
-    if (items === null) {
-        if (expected.length === 0 && count === 0) return;
-        fail(rule, `không tìm thấy khối "## ${heading}" trong ${MAP}`);
-        return;
-    }
-    if (count === null) {
-        fail(rule, `không đọc được nút mermaid "${node}" trong ${MAP}`);
-        return;
-    }
-
-    const onMap = new Set(items);
-    for (const slug of expected)
-        if (!onMap.has(slug))
-            fail(
-                rule,
-                `\`${slug}\` có hồ sơ nhưng vắng trên bản đồ (${heading})`,
-            );
-
-    const known = new Set(expected);
-    for (const slug of items)
-        if (!known.has(slug))
-            fail(
-                rule,
-                `bản đồ còn mục \`${slug}\` ở "${heading}" nhưng không có hồ sơ nào ở trạng thái đó`,
-            );
-
-    // All three counts in ONE assertion. Naming a single number tells the reader
-    // neither how far off the map is nor in which direction.
-    if (!(expected.length === items.length && items.length === count))
-        fail(
-            rule,
-            `${heading} lệch: ${expected.length} hồ sơ, ${items.length} mục trên bản đồ, nút mermaid ${count}`,
-        );
-}
-
-checkBucket({
-    rule: "đã giao",
-    heading: "Đã giao",
-    node: "Đã giao",
-    expected: dossiers.signed,
-});
-checkBucket({
-    rule: "cân nhắc cơ hội",
-    heading: "Đang cân nhắc cơ hội",
-    node: "Đang cân nhắc cơ hội",
-    expected: dossiers.opportunity,
-});
-checkBucket({
-    rule: "chờ phiên nghiệm thu",
-    heading: "Đã giao — chờ phiên nghiệm thu",
-    node: "Chờ phiên nghiệm thu",
-    expected: dossiers.awaitingUat,
-});
-checkBucket({
-    rule: "đang làm",
-    heading: "Đang làm",
-    node: "Đang làm",
-    expected: dossiers.inProgress,
-});
-checkBucket({
-    rule: "xếp lại sau",
-    heading: "Xếp lại sau",
-    node: "Xếp lại sau",
-    expected: dossiers.parked,
-});
-
-// --- report ----------------------------------------------------------------
-report();
-
-const delivered = blockItems("Đã giao") ?? [];
-const opportunities = blockItems("Đang cân nhắc cơ hội") ?? [];
-console.log(
-    `   đã giao: ${dossiers.signed.length} hồ sơ ký, ${delivered.length} mục trên bản đồ, nút mermaid ${mermaidCount("Đã giao")}`,
-);
-console.log(
-    `   cơ hội: ${dossiers.opportunity.length} hồ sơ, ${opportunities.length} mục trên bản đồ, nút mermaid ${mermaidCount("Đang cân nhắc cơ hội")}`,
-);
-// The parked bucket gets the same three-value shape as the two lines above:
-// AC-11 promises a RELATION between dossiers, map entries and mermaid nodes, and
-// checkBucket verifies all three — but until now it printed only the first, so a
-// green run could not be reconciled against what the criterion claims (S4 round
-// 1). A number nobody can cross-check is a number nobody can audit.
-const parked = blockItems("Xếp lại sau") ?? [];
-console.log(
-    `   xếp lại sau: ${dossiers.parked.length} hồ sơ, ${parked.length} mục trên bản đồ, nút mermaid ${mermaidCount("Xếp lại sau")}`,
-);
-console.log(
-    `   chờ phiên nghiệm thu: ${dossiers.awaitingUat.length} · đang làm: ${dossiers.inProgress.length} · chờ duyệt phạm vi: ${dossiers.other.length}`,
-);
-console.log(`✅ ${MAP} khớp với ${ACCEPTANCE_DIR}/ — không có trôi.`);

From b2cd6684f6b8a051515aae821bd8638d14a004ee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=E1=BA=A1nh?= <phanlemanh@gmail.com>
Date: Wed, 23 Sep 2026 15:00:46 +0700
Subject: [PATCH 5/6] =?UTF-8?q?repin:=20ghim=20l=E1=BA=A1i=204=20h?=
 =?UTF-8?q?=E1=BB=93=20s=C6=A1=20s=E1=BB=91ng=20sau=20khi=20th=C6=B0?=
 =?UTF-8?q?=E1=BB=9Bc=20=3D=20kit=20=E2=80=94=20run=5Fid=20repin-20260923T?=
 =?UTF-8?q?080040Z-11314?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

lat-cat-chung-minh, mo-hoa-b01, noi-thuoc-tai-lieu-vao-ci,
o-do-chay-0-ca-van-xanh: làn máy của kit (repin-lane.mjs, kit 8a4ea88) chạy
9 suite + mọi eval test/script của từng hồ sơ ở 825e6cd, tất cả exit 0;
recheck-evidence xanh cả bốn. Chạy khô trước (repin-20260923T075227Z-16002,
xanh) rồi mới --write.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 _acceptance/lat-cat-chung-minh/evidence-report.md        | 8 ++++++--
 _acceptance/lat-cat-chung-minh/run-log.jsonl             | 1 +
 _acceptance/mo-hoa-b01/evidence-report.md                | 6 +++++-
 _acceptance/mo-hoa-b01/run-log.jsonl                     | 1 +
 _acceptance/noi-thuoc-tai-lieu-vao-ci/evidence-report.md | 6 +++++-
 _acceptance/noi-thuoc-tai-lieu-vao-ci/run-log.jsonl      | 1 +
 _acceptance/o-do-chay-0-ca-van-xanh/evidence-report.md   | 6 +++++-
 _acceptance/o-do-chay-0-ca-van-xanh/run-log.jsonl        | 1 +
 8 files changed, 25 insertions(+), 5 deletions(-)

diff --git a/_acceptance/lat-cat-chung-minh/evidence-report.md b/_acceptance/lat-cat-chung-minh/evidence-report.md
index 43d4d07a..8c805a1d 100644
--- a/_acceptance/lat-cat-chung-minh/evidence-report.md
+++ b/_acceptance/lat-cat-chung-minh/evidence-report.md
@@ -6,7 +6,7 @@ failed_evals: []
 verified_by: fresh-context verification subagent
 enforcement_mode: strict
 bypass_used: false
-verified_commit: e4ea5ac18424b87a25e02ee4cfc4f82d97f5803d
+verified_commit: 825e6cd533e944a4ea7118af431433efc6cd75dd
 human_signoff: Phan Le Manh 2026-09-05
 ---
 
@@ -314,4 +314,8 @@ Round 3: Toàn bộ E1-E18 (script — thêm E17/E16-liên-quan AC-2 và E18 m
 
 Round 4: Toàn bộ E1-E18 (script) và J1 (judgment) đều PASS trên cây HEAD (27e27f1fddf467ed85aa0c009ebc8d9db985a249), cùng 8 lệnh suite hồi quy (preflight-verify-env, check-plan-freeze.mjs, build/typecheck, lint:check, test 900 passed | 5 skipped, sdk pytest 292 passed, verify:plugins, gen:abi) đều xanh. Ba finding CONFIRMED trong hợp đồng của round 3 (AC-11, AC-5, AC-15) đã được sửa — mục "Trong hợp đồng" của review-findings.md nay rỗng. Review vòng này phát hiện 16 finding mới, toàn bộ đều nằm ngoài phạm vi đã duyệt ở Cổng 1; 2/16 rơi vào file không bộ đo nào phủ (package.json, _acceptance/lat-cat-chung-minh/evals.yaml). Sau round 4, owner quyết ở Cổng 2 (05/09) gỡ ô phán đoán J1 khỏi bộ ô đo vì không có đường hợp lệ để đóng chốt bằng chứng cho một ô hội-đồng-máy (không có verifier script/config:<key> và không có run_id trong sổ máy) — quyết định ghi trong `decisions.jsonl` d-20260905T080000Z-lcm18. Verdict tổng round 4 là PASS.
 
-Round 5: Toàn bộ E1-E18 (script) đều PASS trên cây HEAD (e4ea5ac18424b87a25e02ee4cfc4f82d97f5803d) — chỉ còn 18 ô máy do J1 đã bị gỡ ở round 4 — cùng 8 lệnh suite hồi quy (preflight-verify-env, check-plan-freeze.mjs, build/typecheck, lint:check, test 900 passed | 5 skipped, sdk pytest 292 passed, verify:plugins, gen:abi) đều xanh. Review vòng này phát hiện 12 finding mới (4 medium từ "conventions", 4 từ "bugs" gồm 1 high + 2 medium + 1 low, 4 từ "measurement" gồm 1 high + 2 medium + 1 low), toàn bộ đều nằm ngoài phạm vi đã duyệt ở Cổng 1; mục "Trong hợp đồng" rỗng. Verdict tổng là PASS; escalate tiếp theo là quyết định của người ở Gate 2 cho 12 finding này (8 đề xuất mở hợp đồng mới, 4 đề xuất ghi Known limits).
\ No newline at end of file
+Round 5: Toàn bộ E1-E18 (script) đều PASS trên cây HEAD (e4ea5ac18424b87a25e02ee4cfc4f82d97f5803d) — chỉ còn 18 ô máy do J1 đã bị gỡ ở round 4 — cùng 8 lệnh suite hồi quy (preflight-verify-env, check-plan-freeze.mjs, build/typecheck, lint:check, test 900 passed | 5 skipped, sdk pytest 292 passed, verify:plugins, gen:abi) đều xanh. Review vòng này phát hiện 12 finding mới (4 medium từ "conventions", 4 từ "bugs" gồm 1 high + 2 medium + 1 low, 4 từ "measurement" gồm 1 high + 2 medium + 1 low), toàn bộ đều nằm ngoài phạm vi đã duyệt ở Cổng 1; mục "Trong hợp đồng" rỗng. Verdict tổng là PASS; escalate tiếp theo là quyết định của người ở Gate 2 cho 12 finding này (8 đề xuất mở hợp đồng mới, 4 đề xuất ghi Known limits).
+
+### Re-pin lần 1 — 2026-09-23, do thước = kit từ 23/09 (#128/#129): needle bản đồ trỏ bước kit, guard gọi cổng kit, lcm_pmap/mhb_existing_guards trỏ bộ đọc bản đồ kit
+run_id: repin-20260923T080040Z-11314
+sha: 825e6cd533e944a4ea7118af431433efc6cd75dd · suites: 9 lệnh exit 0 · evals: 18/18 eval máy đạt kỳ vọng
diff --git a/_acceptance/lat-cat-chung-minh/run-log.jsonl b/_acceptance/lat-cat-chung-minh/run-log.jsonl
index c4d9f6a0..03c2ec02 100644
--- a/_acceptance/lat-cat-chung-minh/run-log.jsonl
+++ b/_acceptance/lat-cat-chung-minh/run-log.jsonl
@@ -136,3 +136,4 @@
 {"ts":"2026-09-05T08:30:00Z","sha":"e4ea5ac18424b6f8c3d5e7a9f1b2c4d6e8a0f2b4","round":5,"evalId":"SUITE-gen_abi","run_id":"minted-lat-cat-chung-minh-SUITE-gen_abi-r5","exit_code":0,"cmd":"pnpm gen:abi && git diff --exit-code src/generated/abi sdk/tongflow/_data/tongflow.abi.json"}
 {"ts":"2026-09-05T08:30:00Z","sha":"e4ea5ac18424b6f8c3d5e7a9f1b2c4d6e8a0f2b4","round":5,"kind":"baseline","evals_hash":"r5-e4ea5ac-after-j1-descope","non_discriminating":[]}
 {"ts":"2026-09-05T08:30:00Z","sha":"e4ea5ac18424b6f8c3d5e7a9f1b2c4d6e8a0f2b4","round":5,"kind":"round-tally","verdict":"PASS","expected":26,"returned":26,"blocked":0}
+{"ts":"2026-09-23T08:00:40Z","kind":"repin","run_id":"repin-20260923T080040Z-11314","sha":"825e6cd533e944a4ea7118af431433efc6cd75dd","suites_exit":[0,0,0,0,0,0,0,0,0],"evals_exit":{"E1":0,"E2":0,"E3":0,"E4":0,"E5":0,"E6":0,"E7":0,"E8":0,"E9":0,"E10":0,"E11":0,"E12":0,"E13":0,"E14":0,"E15":0,"E16":0,"E17":0,"E18":0}}
diff --git a/_acceptance/mo-hoa-b01/evidence-report.md b/_acceptance/mo-hoa-b01/evidence-report.md
index a2027c7a..937d8a82 100644
--- a/_acceptance/mo-hoa-b01/evidence-report.md
+++ b/_acceptance/mo-hoa-b01/evidence-report.md
@@ -6,7 +6,7 @@ failed_evals: []
 verified_by: fresh-context verification subagent
 enforcement_mode: strict
 bypass_used: false
-verified_commit: bb2b05d89c7cbb49dd7d8589a1f09d5e50fb1609
+verified_commit: 825e6cd533e944a4ea7118af431433efc6cd75dd
 human_signoff: Phan Le Manh 2026-09-07
 ---
 
@@ -408,3 +408,7 @@ Run-log vòng 7 và 8 append nguyên văn từ kết quả workflow (bộ tổng
 **Lượt ghi này** điền `human_signoff`, Known limits (7 mục đã ký + nợ có tên từ Amendment) và
 Ngoài hợp đồng (từ review-findings) vào evidence — hai mục mà bộ tổng hợp kit luôn để rỗng khiến
 lưới trước merge đọc hồ sơ là «xanh-sạch, không mời ký».
+
+### Re-pin lần 1 — 2026-09-23, do thước = kit từ 23/09 (#128/#129): needle bản đồ trỏ bước kit, guard gọi cổng kit, lcm_pmap/mhb_existing_guards trỏ bộ đọc bản đồ kit
+run_id: repin-20260923T080040Z-11314
+sha: 825e6cd533e944a4ea7118af431433efc6cd75dd · suites: 9 lệnh exit 0 · evals: 11/11 eval máy đạt kỳ vọng
diff --git a/_acceptance/mo-hoa-b01/run-log.jsonl b/_acceptance/mo-hoa-b01/run-log.jsonl
index 597ac753..68648e76 100644
--- a/_acceptance/mo-hoa-b01/run-log.jsonl
+++ b/_acceptance/mo-hoa-b01/run-log.jsonl
@@ -169,3 +169,4 @@
 {"ts":"2026-09-07T15:08:35Z","round":8,"evalId":"E10","run_id":"minted-mo-hoa-b01-E10-r7","exit_code":0,"cmd":"bash scripts/fork/check-fork-identity-teeth.sh --case notice-dist-gone && bash scripts/fork/check-fork-identity-teeth.sh --case notice-unchanged-back && bash scripts/fork/check-fork-identity-teeth.sh --case notice-attribution-gone","carried_from_round":7}
 {"ts":"2026-09-07T15:08:35Z","round":8,"evalId":"E11","run_id":"minted-mo-hoa-b01-E11-r7","exit_code":0,"cmd":"bash scripts/fork/check-prototype-lane.sh mo-hoa-b01 && bash scripts/fork/check-fork-identity-teeth.sh --case debt-table-missing && bash scripts/fork/check-fork-identity-teeth.sh --case debt-table-duplicate","carried_from_round":7}
 {"ts":"2026-09-07T15:08:35Z","round":8,"kind":"round-tally","verdict":"PASS","expected":11,"returned":11,"blocked":0}
+{"ts":"2026-09-23T08:00:40Z","kind":"repin","run_id":"repin-20260923T080040Z-11314","sha":"825e6cd533e944a4ea7118af431433efc6cd75dd","suites_exit":[0,0,0,0,0,0,0,0,0],"evals_exit":{"E1":0,"E2":0,"E3":0,"E4":0,"E5":0,"E6":0,"E7":0,"E8":0,"E9":0,"E10":0,"E11":0}}
diff --git a/_acceptance/noi-thuoc-tai-lieu-vao-ci/evidence-report.md b/_acceptance/noi-thuoc-tai-lieu-vao-ci/evidence-report.md
index e8156132..782f34b7 100644
--- a/_acceptance/noi-thuoc-tai-lieu-vao-ci/evidence-report.md
+++ b/_acceptance/noi-thuoc-tai-lieu-vao-ci/evidence-report.md
@@ -7,7 +7,7 @@ reason:
 verified_by: phiên VERIFY tươi, chạy TUẦN TỰ (CLASSIFIER-FALLBACK sau BLOCKED vòng 2)
 enforcement_mode: strict
 bypass_used: false
-verified_commit: 36651d8d168c1945d2f3ad5f66e7799bf9f5c932
+verified_commit: 825e6cd533e944a4ea7118af431433efc6cd75dd
 human_signoff: Phan Le Manh 2026-09-02
 ---
 
@@ -236,3 +236,7 @@ lệnh-hỏng; lúc đó cây không còn lành vì một hồ sơ vừa đượ
 ### Re-pin lần 12 — 2026-09-16, do chien dich ghim lai kit 2.14.0
 run_id: repin-20260916T063028Z-36924
 sha: 36651d8d168c1945d2f3ad5f66e7799bf9f5c932 · suites: 9 lệnh exit 0 · evals: 9/9 eval máy đạt kỳ vọng
+
+### Re-pin lần 13 — 2026-09-23, do thước = kit từ 23/09 (#128/#129): needle bản đồ trỏ bước kit, guard gọi cổng kit, lcm_pmap/mhb_existing_guards trỏ bộ đọc bản đồ kit
+run_id: repin-20260923T080040Z-11314
+sha: 825e6cd533e944a4ea7118af431433efc6cd75dd · suites: 9 lệnh exit 0 · evals: 9/9 eval máy đạt kỳ vọng
diff --git a/_acceptance/noi-thuoc-tai-lieu-vao-ci/run-log.jsonl b/_acceptance/noi-thuoc-tai-lieu-vao-ci/run-log.jsonl
index 63436c6b..f1c5d82d 100644
--- a/_acceptance/noi-thuoc-tai-lieu-vao-ci/run-log.jsonl
+++ b/_acceptance/noi-thuoc-tai-lieu-vao-ci/run-log.jsonl
@@ -85,3 +85,4 @@
 {"ts":"2026-09-16T06:30:29Z","kind":"eval","run_id":"repin-20260916T063028Z-36924","eval":"E7","criterion":"AC-7","verifier":"config:executors.script.dkfo_docs_teeth","exit_code":0,"sha":"36651d8d168c1945d2f3ad5f66e7799bf9f5c932"}
 {"ts":"2026-09-16T06:30:29Z","kind":"eval","run_id":"repin-20260916T063028Z-36924","eval":"E8","criterion":"AC-8","verifier":"config:executors.script.ntlc_resign_wave","exit_code":0,"sha":"36651d8d168c1945d2f3ad5f66e7799bf9f5c932"}
 {"ts":"2026-09-16T06:30:29Z","kind":"eval","run_id":"repin-20260916T063028Z-36924","eval":"E9","criterion":"AC-9","verifier":"config:executors.script.ntlc_no_new_checkout","exit_code":0,"sha":"36651d8d168c1945d2f3ad5f66e7799bf9f5c932"}
+{"ts":"2026-09-23T08:00:40Z","kind":"repin","run_id":"repin-20260923T080040Z-11314","sha":"825e6cd533e944a4ea7118af431433efc6cd75dd","suites_exit":[0,0,0,0,0,0,0,0,0],"evals_exit":{"E1":0,"E2":0,"E3":0,"E4":0,"E5":0,"E6":0,"E7":0,"E8":0,"E9":0}}
diff --git a/_acceptance/o-do-chay-0-ca-van-xanh/evidence-report.md b/_acceptance/o-do-chay-0-ca-van-xanh/evidence-report.md
index 0fb28ca2..09b5db08 100644
--- a/_acceptance/o-do-chay-0-ca-van-xanh/evidence-report.md
+++ b/_acceptance/o-do-chay-0-ca-van-xanh/evidence-report.md
@@ -7,7 +7,7 @@ reason:
 verified_by: machine-lane (owner chốt bỏ lớp hội đồng, 31/08)
 enforcement_mode: strict
 bypass_used: false
-verified_commit: d6939560d2784fe505a01e1b65fa96c4d530ea94
+verified_commit: 825e6cd533e944a4ea7118af431433efc6cd75dd
 human_signoff: Phan Le Manh 2026-09-01
 ---
 
@@ -338,3 +338,7 @@ minh được.
 ### Re-pin lần 2 — 2026-09-08, do hang so di kem 33->38 trong rang bo kiem o do, va dong B3 neu so hieu ADR-0013
 run_id: repin-20260908T071345Z-62406
 sha: d6939560d2784fe505a01e1b65fa96c4d530ea94 · suites: 9 lệnh exit 0 · evals: 17 eval máy exit 0
+
+### Re-pin lần 3 — 2026-09-23, do thước = kit từ 23/09 (#128/#129): needle bản đồ trỏ bước kit, guard gọi cổng kit, lcm_pmap/mhb_existing_guards trỏ bộ đọc bản đồ kit
+run_id: repin-20260923T080040Z-11314
+sha: 825e6cd533e944a4ea7118af431433efc6cd75dd · suites: 9 lệnh exit 0 · evals: 17/17 eval máy đạt kỳ vọng
diff --git a/_acceptance/o-do-chay-0-ca-van-xanh/run-log.jsonl b/_acceptance/o-do-chay-0-ca-van-xanh/run-log.jsonl
index e03c59e7..b7f33457 100644
--- a/_acceptance/o-do-chay-0-ca-van-xanh/run-log.jsonl
+++ b/_acceptance/o-do-chay-0-ca-van-xanh/run-log.jsonl
@@ -27,3 +27,4 @@
 {"ts":"2026-09-05T10:15:00Z","kind":"eval","run_id":"repin-merge-20260905T101500Z","eval":"E12","criterion":"AC-11","verifier":"config:executors.script.gate_guards_job_no_new_job","exit_code":0,"sha":"96ee9b89c428b5ce0d64c8f49ba29eb7bd65727e"}
 {"ts":"2026-09-05T10:15:00Z","kind":"eval","run_id":"repin-merge-20260905T101500Z","eval":"E13","criterion":"AC-11","verifier":"config:executors.script.action_pins","exit_code":0,"sha":"96ee9b89c428b5ce0d64c8f49ba29eb7bd65727e"}
 {"ts":"2026-09-08T07:13:45Z","kind":"repin","run_id":"repin-20260908T071345Z-62406","sha":"d6939560d2784fe505a01e1b65fa96c4d530ea94","suites_exit":[0,0,0,0,0,0,0,0,0],"evals_exit":{"E1":0,"E2":0,"E3":0,"E4":0,"E5":0,"E6":0,"E7":0,"E8":0,"E9":0,"E10":0,"E11":0,"E12":0,"E13":0,"E15":0,"E16":0,"E17":0,"E14":0}}
+{"ts":"2026-09-23T08:00:40Z","kind":"repin","run_id":"repin-20260923T080040Z-11314","sha":"825e6cd533e944a4ea7118af431433efc6cd75dd","suites_exit":[0,0,0,0,0,0,0,0,0],"evals_exit":{"E1":0,"E2":0,"E3":0,"E4":0,"E5":0,"E6":0,"E7":0,"E8":0,"E9":0,"E10":0,"E11":0,"E12":0,"E13":0,"E15":0,"E16":0,"E17":0,"E14":0}}

From f0b4442c1e1b04bda1cd1cf170f9c3a169c0f058 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=E1=BA=A1nh?= <phanlemanh@gmail.com>
Date: Wed, 23 Sep 2026 15:03:56 +0700
Subject: [PATCH 6/6] =?UTF-8?q?repin:=20ghim=20l=E1=BA=A1i=20roadmap-drift?=
 =?UTF-8?q?-guard=20=E2=80=94=20run=5Fid=20repin-20260923T080348Z-99028?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Hồ sơ ghim ở 8aeab25 (tươi trước PR này) hoá stale vì PR đổi
scripts/acceptance/** và scripts/ci/**. Làn máy của kit chạy 9 suite + mọi
eval test/script của hồ sơ ở HEAD, tất cả exit 0; chạy khô trước
(repin-20260923T080249Z-31259) rồi mới --write.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 _acceptance/roadmap-drift-guard/evidence-report.md | 6 +++++-
 _acceptance/roadmap-drift-guard/run-log.jsonl      | 1 +
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/_acceptance/roadmap-drift-guard/evidence-report.md b/_acceptance/roadmap-drift-guard/evidence-report.md
index 944badbe..250726ad 100644
--- a/_acceptance/roadmap-drift-guard/evidence-report.md
+++ b/_acceptance/roadmap-drift-guard/evidence-report.md
@@ -7,7 +7,7 @@ reason:
 verified_by: fresh-context verification subagent
 enforcement_mode: strict
 bypass_used: false
-verified_commit: 8aeab256ea83c8f653f04e362da194f5f2a63d29
+verified_commit: b2cd6684f6b8a051515aae821bd8638d14a004ee
 human_signoff: Manh 2026-08-27
 ---
 
@@ -425,3 +425,7 @@ sha: 36651d8d168c1945d2f3ad5f66e7799bf9f5c932 · suites: 9 lệnh exit 0 · eval
 ### Re-pin lần 8 — 2026-09-23, do fixture tick-noi-doi của răng plan-freeze thôi ghim skill-system-v1 (PR #128)
 run_id: repin-20260923T035636Z-96358
 sha: 8aeab256ea83c8f653f04e362da194f5f2a63d29 · suites: 9 lệnh exit 0 · evals: 10/10 eval máy đạt kỳ vọng
+
+### Re-pin lần 9 — 2026-09-23, do PR này đổi scripts/acceptance/** và scripts/ci/** (thước = kit từ 23/09), hồ sơ ghim ở 8aeab25 hoá stale
+run_id: repin-20260923T080348Z-99028
+sha: b2cd6684f6b8a051515aae821bd8638d14a004ee · suites: 9 lệnh exit 0 · evals: 10/10 eval máy đạt kỳ vọng
diff --git a/_acceptance/roadmap-drift-guard/run-log.jsonl b/_acceptance/roadmap-drift-guard/run-log.jsonl
index ec33f99f..a7d7bc48 100644
--- a/_acceptance/roadmap-drift-guard/run-log.jsonl
+++ b/_acceptance/roadmap-drift-guard/run-log.jsonl
@@ -119,3 +119,4 @@
 {"ts":"2026-09-16T06:30:30Z","kind":"eval","run_id":"repin-20260916T063028Z-36924","eval":"E9","criterion":"AC-9","verifier":"config:executors.script.roadmap_teeth_supersede_source_single","exit_code":0,"sha":"36651d8d168c1945d2f3ad5f66e7799bf9f5c932"}
 {"ts":"2026-09-16T06:30:30Z","kind":"eval","run_id":"repin-20260916T063028Z-36924","eval":"E11","criterion":"AC-4","verifier":"config:executors.script.roadmap_teeth_ledger_paired","exit_code":0,"sha":"36651d8d168c1945d2f3ad5f66e7799bf9f5c932"}
 {"ts":"2026-09-23T03:56:36Z","kind":"repin","run_id":"repin-20260923T035636Z-96358","sha":"8aeab256ea83c8f653f04e362da194f5f2a63d29","suites_exit":[0,0,0,0,0,0,0,0,0],"evals_exit":{"E1":0,"E2":0,"E3":0,"E4":0,"E5":0,"E6":0,"E7":0,"E8":0,"E9":0,"E11":0}}
+{"ts":"2026-09-23T08:03:48Z","kind":"repin","run_id":"repin-20260923T080348Z-99028","sha":"b2cd6684f6b8a051515aae821bd8638d14a004ee","suites_exit":[0,0,0,0,0,0,0,0,0],"evals_exit":{"E1":0,"E2":0,"E3":0,"E4":0,"E5":0,"E6":0,"E7":0,"E8":0,"E9":0,"E11":0}}