[CLAUDE] Docs: S95 session-end closeout — Harness-17 adopt + STATUS/HANDOFF/ledger + session log

- STATUS mega-line prepend S95 (H17 adopt 3-workflow + 10/10 floor + 2 commit + cicd #476) + In-Progress→S95 + bundle-hash live 0T6vVJST/BGXEVZO6 (cicd re-snapshot, was stale S85)
- HANDOFF S95 brief + NEXT (frontend-designer distill = H17 loop finding · monthly re-tier)
- error-ledger: AS-10 recurrence S95 (E-006, WF1+WF3 self-write reverted 4th fire; instruction-fix NOT 100% — WF3 explicit-return-only STILL self-wrote → git-diff = net) + Active-Guard git-diff-containment 4/4 held
- session log 2026-07-01-S95-harness17-adopt.md
- user-memory: +feedback_faultinjection_proves_teeth (reusable verify pattern)
- 0 production code; 434 test unchanged; docs-only CI-skip

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/governance/error-ledger.md

@@ -47,7 +47,7 @@ Detect by **action-signature** (NOT "AI tự phán có vi phạm không"). Scan
 | agent frontmatter `model: inherit` (not `[1m]`) | gotcha #37 | procedural | — | ✅ (FD agent loaded S48) | ++ |
 | **lead = sole RAG-writer** (`store_memory` stripped, mechanized) | store_memory rebootstrap-loss (S41) + AS-3 | procedural | 2 (NamGroup + SE S41) | ✅ runtime S48 (0/8 subs) | +++ (failure-safe) |
 | session-end verify memory byte>0 | S46 0-byte (AS-8) | procedural | 1 (S46) | ✅ S49 (new mem 2355B + 0 byte-0 scan) | ++ |
-| **git-diff + chunk-count post-P2 containment** (defense-in-depth, HMW) | R1 sub-write residual (AS-10) · store_memory bypass (AS-3) | **procedural** (institutionalized S50 = standard B6 post-wave audit) | 1 (S49) | ✅ S49 (caught inv-api self-MEMORY in git-diff; chunk 2414=2414) + **S50 wave `h2-verify` (git-diff agent-memory EMPTY, chunk 2415=2415, 0 leak)** + **S93 (WF1 3-agent residual caught+reverted; WF2 0-residual after explicit return-only)** | ++ (G-015 honest — NOT allowlist-alone) |
+| **git-diff + chunk-count post-P2 containment** (defense-in-depth, HMW) | R1 sub-write residual (AS-10) · store_memory bypass (AS-3) | **procedural** (institutionalized S50 = standard B6 post-wave audit) | 1 (S49) | ✅ S49 (caught inv-api self-MEMORY in git-diff; chunk 2414=2414) + **S50 wave `h2-verify` (git-diff agent-memory EMPTY, chunk 2415=2415, 0 leak)** + **S93 (WF1 3-agent residual caught+reverted; WF2 0-residual after explicit return-only)** + **S95 (WF1+WF3 residual caught+reverted 2×; WF3 explicit-return-only STILL self-wrote → instruction-fix NOT 100%, git-diff = the net)** | +++ (G-015 honest — 4 fires/4 catches/0 escape; NOT allowlist-alone, NOT instruction-alone) |
 | heavy spawn → `run_in_background` | looks-frozen | **procedural** (2-strike met) | 2 (S45, S48) | ✅ S48 (FD bg) + S50 (all 4 monitor+wave spawns bg) | + |
 | RAG glob `**/`-anchored (not root) | gotcha #10 node_modules leak | procedural | 1 (S41) | ✅ (2406 clean) | ++ |
 | dump bảng env-đích TRƯỚC identifier-based data op (lock/seed-by-email) | gotcha #60 (AS-12) | episodic | 1 (S57bis lock NO-OP) | ✅ S58 (recon dump → fix `5998163` → Run #382 đo 34 locked) | ++ |
@@ -88,6 +88,7 @@ Detect by **action-signature** (NOT "AI tự phán có vi phạm không"). Scan
 - **fix:** (process) em-main commit-gate `git diff` review = backstop, **HELD** — every changed line reviewed pre-commit → accurate / benign / correctly-placed / 0-mojibake / chunk-2415 → **adopted per AS-10 keep-if-correct** (NOT a content bug: matches what §L.b prescribes). (guard) "git-diff + chunk-count post-P2 containment" already promoted procedural this session; AS-10 now has its **first real fire**.
 - **prevention/guard:** RECOMMEND (anh / AI_INFRA, charter-v2 infra): harden monitor tool-grant — `Write/Edit` removal alone leaves Bash residual → consider a session-end hook blocking sub-Bash-write to tracked paths, OR accept commit-gate as sufficient defense-in-depth. Fidelity: if monitors write, their reports MUST disclose it → escalate 🟥 reviewer if recurs. Provenance timing-implicated, **not definitively attributable** (no false accusation).
 - **recurrence S93 (2026-06-29):** AS-10 2nd fire — 3 WF1 workflow-agents (investigator-codebase ×2 + reviewer, return-only) self-wrote agent-memory (diary append + archive self-curate + 1 stray `project_s92_*` mis-named file). git-diff post-P2 containment caught ALL → em-main reverted (kept cicd-monitor PE-deploy harvest hợp-lệ). Guard HELD again. **WF2 fix:** added explicit "RETURN-ONLY: do NOT write ANY file incl MEMORY.md" to every lane prompt → **0 residual** (instruction-fix worked, git-diff confirmed). Lesson: workflow-agent frontmatter "update MEMORY before return" fights return-only mandate → prompt MUST override + git-diff is the net (G-015, not mechanized).
+- **recurrence S95 (2026-07-01, H17 adopt):** AS-10 **3rd + 4th fire** — WF1 (investigator-codebase self-compacted its MEMORY.md 25.5→16.98KB, CLAIMED archive-move but `archive/2026-06.md` was NOT created → keeping it would have LOST 8.5KB) + WF3-Lane-A (reviewer self-wrote diary + new `project_s95_harness17_faultinjection.md`). git-diff post-P2 caught BOTH → em-main reverted; cicd-monitor diary KEPT (normal-monitor-spawn, NOT return-only = legit). Guard HELD 2×. **🔑 Instruction-fix NOT 100%:** WF2(H17) had explicit return-only → 0 residual, but **WF3 ALSO had explicit "TUYỆT ĐỐI return-only" yet reviewer STILL self-wrote** → persona-write is stochastic; explicit-prompt REDUCES but does NOT eliminate → **git-diff-revert remains the mandatory net (G-015 reconfirmed, instruction-alone insufficient).** Distinction codified: workflow-return-only-agent = REVERT; normal-monitor-spawn (diary verdict) = KEEP. **Dogfood:** contained WHILE adopting H17 whose C3-floor = single-writer — the very floor being adopted saved real data. Guard net-effect ++ (4 fires, 4 catches, 0 escape).
 - **tags:** [containment-residual-write / monitor-sub+workflow-agent / governance-docs+agent-memory]
 
 ### E-005 — AS-1 `git add -A` on S49 governance commit (self-caught @session-end §L.a)