wal: flush 20260717T1751

.claude/WAL.md

@@ -8,7 +8,7 @@ chain:
 [x] 3. fable-real invest COMPLETE (#53-garble ×3 — sub-file cứu) — 13 trục + baseline 8-phép (phép-1 FAIL +3tick/9nhãn/7pause · phép-3 3/3 union · phép-4 14/14) + T7 lật tiền-đề: residual hub mis-site (ps1 sạch — site thật budget:65/:90) · evidence: sub-investigator-codebase-0.md 48.6KB STATUS:COMPLETE
 [x] 4. lead verify V1-V8 8/8 KHỚP + chốt 6 DP default + spec v1 + tự-bắt file-collision LANE-A/C · evidence: spec-adap-khung-nhip-17-07-2026.md
 [x] 5. fable-real review GO_WITH_FIXES 0C/11M/10n (CLEAN-return) → lead áp TRỌN 21 fix → spec v2 · evidence: sub-reviewer-0.md 29.4KB VERDICT-dòng-159
-[!] 6. wf:hmw-implement-3-lane run=.claude/workflows/runs/2026-07-17-S135-adap-khung-nhip-nam-vong runId=wf_d5b91490-a0f (SAME-SESSION-ONLY — S136 dùng relaunch-cắt-gọt) · S136 lead re-run AC từ đĩa: LANE-A VERIFIED 10/10 AC-A (sub-task-0.md DONE 8.1KB) · LANE-C VERIFIED 8/8 AC-C (files landed + e0bb5bbf=2 + 0-site-sống + non-ASCII delta 0; diary sub-task-2.md CỤT baseline-only → harvest on-behalf) · LANE-B NỬA: probe landed+VERIFIED AC-B(1)(2)(3-logic)(6) (2-run byte-y-hệt, probe-loi exit 0, ASCII 0, live-run 3-vế đúng) — THIẾU Items 4+5 (2 detector H25, grep=0) + AC-B(4) fault-inject 9 ca + AC-B(5) + diary sub-task-1.md → RELAUNCH CẮT-GỌT ĐÃ PHÓNG @S136: runId=wf_c3a56fef-520 folder=runs/2026-07-17-S136-laneB-remainder/ (folder MỚI né đè sub-task-0.md LANE-A untracked; backup 2 sub-file @scratchpad/backup-subfiles) 1 task role-less tier:opus = Items 4+5 + AC-B(4) 9-ca + AC-B(5) · sub-task-2.md LANE-C đã lead-scribe on-behalf (TRACE+VERDICT 8/8) · tick S136 9→10 + probe live OVERDUE:light 7/6 (consent-gate chờ anh)
+[x] 6. wf:hmw-implement-3-lane HOÀN TẤT (S135 phóng wf_d5b91490 → pause → S136 /tiep relaunch-cắt-gọt wf_c3a56fef-520) · AC TOÀN WAVE lead re-run từ đĩa: AC-A 10/10 + AC-C 8/8 + AC-B 6/6 (fault-inject 9/9 PASS cây tạm; real-repo role-notebook 14/14 + closeout W1/W2 PASS + W3 S132-tail FLAG=DƯƠNG-GIẢ classified, lead re-verified git 3/3: 72f68d1 immediate-parent chứa HANDOFF+session-log ADDED — per-label folding = đề-xuất treo anh quyết) · evidence: runs/S135.../sub-task-{0,2}.md + runs/2026-07-17-S136-laneB-remainder/sub-task-0.md + implement-synthesis.md ×2 · tick S136 9→10 + probe live OVERDUE:light 7/6 (consent-gate chờ anh)
 [ ] 7. lead git-diff audit + chạy lại AC-A/B/C theo spec v2 §③ + reviewer pre-commit → commit đích-danh (M-7 add-list: 6 cmd .md + 2 scripts + hmw.js + counter + budget.json + adap-report + run-folder) → RESTART Claude Code (cmd .md no-hot-reload) → phiên kế đo phép 7 + phép 1
 [ ] 8. adap-reports ×5 + email hub (nấc + số baseline + carve-out DP-3 + errata mis-site + việc-2 done @S131) + STAGE-2 move 7 file → inbox/ai_infra/ + _index processed
 

.claude/workflows/runs/2026-07-17-S135-adap-khung-nhip-nam-vong/implement-synthesis.md

@@ -0,0 +1,24 @@
+# implement-synthesis — wave adap khung-nhịp-năm-vòng (stage 4, hmw 3-lane)
+
+> **VERIFIED bởi lead @S136** — tổng-hợp stage implement TRỌN WAVE sau recovery. Câu chuyện run: S135 phóng `wf_d5b91490-a0f` 3 lane → `/pause` 16:55 giữa wave (lane còn chạy nền, land thêm SAU pause) → phiên chết → S136 `/tiep` §4: lead re-run AC từ đĩa + relaunch-cắt-gọt phần thiếu (`wf_c3a56fef-520`, folder `../2026-07-17-S136-laneB-remainder/`). **Đĩa thắng lời kể** (per-turn ≠ per-task N9): LANE-A có diary DONE, LANE-C land-đủ-file nhưng diary cụt (lead scribe on-behalf SAU verify), LANE-B land probe không diary (relaunch).
+
+## AC toàn wave — lead re-run từ đĩa (KHÔNG tin self-report)
+
+| Lane | Files | AC | Verdict |
+|---|---|---|---|
+| **A** commands+contract | tiep/pause/session-end/session-start.md + counter.json (committed trong `0363495 wal: pause` — hook mang đi, điểm mù ④ tự tố-giác đúng thiết-kế) | **AC-A 10/10** — tick 3/4/2 · OR-guard=1 · probe-call 4/4 · pointer §2.1.8 (không chép logic) · so-sánh-SỐ · probe-loi 4/4 · Ratified+canonical · memory-triple=3 · INFORM-byte 2 site · counter-file đích-danh 2/3 | ✅ |
+| **B** scripts+detectors | `nhip-no-probe.ps1` (land SAU pause) + `governance-detectors.ps1` +2 H25 (S136 remainder) | **AC-B 6/6** — (1) 2-run byte-y-hệt+0-mutation · (2) probe-loi exit 0 · (3) 3-vế khớp đối-chứng (light 7/6 post-tick đúng logic — số spec "5/6" là snapshot lúc viết, trôi đúng chiều) · (4) fault-inject **9/9** · (5) real-repo 14/14 + 2-PASS/1-FP-classified · (6) ASCII+exit0+0-self-match | ✅ |
+| **C** residual+doc+sleep | budget.json (committed `a7bafd5 wal: flush`) + adap-report + hmw.js + fable-real.md + sleep-cmd | **AC-C 8/8** — 0-site-sống `draft 2026-07-15` ngoài exclusion · e0bb5bbf=2 + e50a4bd0 + caveat · 2 append additive · câu luật non-JSON-args ×2 · reconcile spec-pointer · cross-file-bleed + grep-ngược · JSON-OK + non-ASCII **delta 0** (50=50 baseline) | ✅ |
+
+## Điểm nổi stage này
+
+1. **Tick đa-điểm-vào SỐNG:** S136 vào bằng `/tiep` → tick fire 9→10 ngay cửa (trước wave: S134/S135 vào `/tiep` = 0-tick, GAP-1 sống). OR-guard session-label + label-convention PIN hoạt-động đúng thiết-kế ngay lần đầu.
+2. **Probe live-run đầu tiên:** `NHIP-NO: kiem light 7/6 deep 7/15 OVERDUE:light | tran-bo-nho 0 over-cap | run-chua-gom 1` — vế-1 đọc post-tick (n-3 đúng), vế-3 khớp orphan-check độc-lập. OVERDUE:light → consent-gate (DP-3) chờ anh.
+3. **FP W3 tail-adjacency** (chi-tiết + đề-xuất per-label folding treo anh quyết → `../2026-07-17-S136-laneB-remainder/implement-synthesis.md`).
+4. **Nấc trung-thực:** tick-wire + probe-wire trong 4 cmd `.md` = **executed + verified-pending-restart** (command no-hot-reload `pause.md:9`) — phép 7 (pause–tiep counter +1) + phép 1 cửa-sổ mới đo SAU restart. KHÔNG khai "verified" trước restart.
+5. **Recovery cost:** relaunch-cắt-gọt chỉ tốn 1 worker (~190K tokens) thay vì chạy lại 3 lane — WAL + diary-trên-đĩa + hook-commit chính là thứ làm được việc này (H22 đúng bài).
+
+## Còn lại của wave (ngoài stage này)
+
+- [!] Stage 5: reviewer pre-commit (đang chạy nền @S136, trace `../2026-07-17-S136-laneB-remainder/sub-reviewer-0.md`) → commit đích-danh M-7 add-list → **RESTART Claude Code** (cmd .md no-hot-reload) — sau restart mới đo phép 7 + phép 1.
+- [ ] Stage 6: adap-reports ×5 + email hub (nấc + baseline T6 + errata mis-site + FP W3 + SELF-CHECK 5-ô "PASS-với-carve-out") + STAGE-2 move 7 file → `inbox/ai_infra/` + `_index` processed.

.claude/workflows/runs/2026-07-17-S135-adap-khung-nhip-nam-vong/run.md

@@ -29,6 +29,6 @@
 - [x] 1. fable-real invest — COMPLETE 48.6KB/17-section, 264 dòng (return #53-garble → sub-file cứu, lần ×3 liên tiếp cho fable-real) · ⭐ T7 lật tiền-đề: hub residual #1 mis-site (`git log -S` chứng ps1 CHƯA TỪNG chứa cụm draft; 2 site thật = memory-budget.json:65/:90) · baseline 8-phép: phép-1 FAIL sống (+3 tick/9 nhãn-phiên/7 wal-pause) · phép-3 PASS 3/3 union · phép-4 PASS 14/14 · vòng-1 tự-verify FAIL (S133/S134 closeout 0 spawn H1/H2) · 6 DP
 - [x] 2. lead verify V1-V8 — 8/8 KHỚP (tick/counter 0-match tiep+pause · draft-2026-07-15 đúng 2 site sống · ps1:25/:117 honest-RANGE · 7 pause · 0 vết H1/H2 sau 08:39 · budget :65/:90/:121 + start:206 + hmw.js:97-98 nguyên văn) + chốt 6 DP default + tự-bắt file-collision LANE-A/C (session-start.md ownership → trọn LANE-A) → spec v1
 - [x] 3. fable-real review spec v1 — **GO_WITH_FIXES 0C/11M/10n, return CLEAN 0-garble** · tự re-run 8 spot-check khớp + bắt M-2 self-coverage blind-spot (diary inv-cb:23 ngoài exclusion → AC FAIL oan) + M-9 label-convention chưa thành văn + M-10 ghost-wire byte-INFORM · lead áp TRỌN 21 fix (11M+10n) → **spec v2** (sub-reviewer-0.md 29.4KB)
-- [!] 4. hmw implement 3 lane role-less tier:'opus' (Opus 4.8 MAX per anh, args.run RUN-TRACE, DP-4 dogfood pointer-prompt)
-- [ ] 5. reviewer pre-commit → commit/push
+- [x] 4. hmw implement 3 lane role-less tier:'opus' (Opus 4.8 MAX per anh, args.run RUN-TRACE, DP-4 dogfood pointer-prompt) — S135 pause giữa chừng → S136 /tiep §4 relaunch-cắt-gọt LANE-B remainder (folder `../2026-07-17-S136-laneB-remainder/` — né đè sub-task-0.md; wf_c3a56fef-520). AC toàn wave lead re-run: **A 10/10 · B 6/6 · C 8/8** (chi-tiết → `implement-synthesis.md`)
+- [!] 5. reviewer pre-commit (spawned @S136, chạy nền) → commit/push đích-danh M-7
 - [ ] 6. adap-reports ×5 + report email hub + STAGE-2 move 7 file → `inbox/ai_infra/` + `_index` processed

.claude/workflows/runs/2026-07-17-S136-laneB-remainder/implement-synthesis.md

@@ -0,0 +1,32 @@
+# implement-synthesis — LANE-B remainder (S136 recovery)
+
+> **VERIFIED bởi lead** (không phải lời worker). Run wf_c3a56fef-520, 1 worker role-less tier:'opus', ~20 phút, return CLEAN 0-garble + diary ghi-trong-lúc-làm `sub-task-0.md` 10.3KB.
+
+## Deliverable
+
+1. **2 detector H25 appended** vào `scripts/governance-detectors.ps1` (trước Summary — flag đếm vào TOTAL):
+   - `H25-closeout-ritual` (GAP-2): 3 closeout gần nhất, union-window `(prev..this]` per-close (T4a), 4 sổ nghi-thức {STATUS · HANDOFF · sessions/* NEW `--diff-filter=A` · agent-memory/**}, thiếu → FLAG MED kể tên; lone-closeout → skip có lý-do.
+   - `H25-role-notebook` (GAP-3): roster 14 trừ README; parse 2-bước `^sub-(.+)-\d+\.md$` → exact-match roster; UNMAPPED chỉ INFORM (S122); has-run mà diary MISSING hoặc **0-byte** → FLAG MED (anti-Goodhart).
+2. **Fault-inject 9/9 PASS** (cây tạm `-RepoRoot`, orchestrator `scratchpad/fault-inject-h25.ps1` 9KB): FLAG-đúng 4 ca (fake-close 4/4 sổ · diary-delete · diary-0-byte · probe CONFIG-THIEU in-line) + IM-đúng 5 ca (control ×2 · tail-union-reach · lone-skip-no-crash · alien-prefix UNMAPPED). Matrix verbatim → `sub-task-0.md` §5.
+
+## Lead verify (2-nguồn-khớp)
+
+| Phép | Kết-quả |
+|---|---|
+| `grep -c H25` detectors | **4** (baseline 0) |
+| Parse `[Parser]::ParseFile` | **0 errors** |
+| pure-ASCII toàn file 60003B | **0 byte >127** (delta append = 0) |
+| Detector re-run bởi lead | Output **khớp 100%** lời khai: W1 S134 `[ok]` · W2 S133 `[ok]` · W3 S132 FLAG · role-notebook 14/14 flagged=0 · UNMAPPED 27 · 0 self-match · exit 0 |
+| FP W3 re-verify độc-lập (git) | **3/3**: `72f68d1` chứa `docs/HANDOFF.md` + `sessions/2026-07-17-S131-S132-...md` **ADDED** (`--diff-filter=A`) · `9e874ca` parent = `72f68d1` ⇒ ritual đóng trọn ở lower-bound bị loại — flag oan THẬT |
+| Isolation | Chỉ `governance-detectors.ps1` (M) + `sub-task-0.md` (??) — sub-task-0.md gốc S135 nguyên 8187B |
+
+## ⚑ Treo anh quyết — per-label folding
+
+W3 = dương-giả class **tail-adjacency** (closeout gộp nhãn `S131-S132` đóng trọn ở commit trước, tail-supplement tạo window 1-commit). Fix đúng hướng = fold các closeout **cùng nhãn batch** vào 1 cửa-sổ ("union-per-label" — khớp baseline spec:90 phép-3). Worker + lead ĐỀU KHÔNG tự áp (sửa detector cho im = Goodhart cấm). Trade-off cần anh cân: fold theo nhãn có thể bị LẠM-DỤNG (đặt nhãn gộp để trốn ritual từng phiên) — ngược lại giữ per-commit thì mỗi tail-supplement sau closeout gộp sẽ +1 FP. Flag hiện sống trên repo (TOTAL 46 = 45 pre-existing + 1 FP này).
+
+## memoryDelta (harvest @P3 — lead verified, APPEND-only)
+
+- **task:** LANE-B remainder S136 — 2 detector H25 + fault-inject 9-ca + AC-B(4)(5)(6).
+- **verdict:** SHIPPED, teeth-proven 2 chiều, 1 FP classified-not-silenced, isolation clean.
+- **learned:** union-window per-commit còn FP khi tail-close có predecessor là immediate-parent cùng batch — ritual nằm ở lower-bound BỊ LOẠI; fix = fold-per-label nhưng là OWNER-decision (tự áp để xanh = Goodhart).
+- **surprise:** "3 closeout gần nhất" là moving-target — lúc spec viết baseline "phép-3 PASS 3/3" thì 3-gần-nhất là set KHÁC (chưa có S133/S134); acceptance-literal tự-lão-hoá đúng class S109/S121. Letter-suffix batch (`investigator-codebase-A..E`) rơi UNMAPPED conservative-correct vì role vẫn has-run qua diary.

.claude/workflows/runs/2026-07-17-S136-laneB-remainder/run.md

@@ -13,5 +13,6 @@
 
 ## Stages
 
-- [ ] 0. hmw 1-task LANE-B remainder (detector H25 ×2 + fault-inject matrix)
-- [ ] 1. lead re-run AC-B(4)(5) verify + harvest → synthesis (ghi ở folder này + errata-pointer về folder gốc)
+- [x] 0. hmw 1-task LANE-B remainder (wf_c3a56fef-520, ~20min, return CLEAN 0-garble) — 2 detector H25 appended + fault-inject 9/9 PASS + real-repo AC-B(5)
+- [x] 1. lead verify: H25=4 · parse 0-err · pure-ASCII 0 · detector re-run output khớp lời khai 100% · FP W3 re-verified git độc-lập 3/3 (72f68d1 chứa HANDOFF + session-log ADDED, 9e874ca parent=72f68d1) · sub-task-0.md gốc S135 NGUYÊN 8187B (không đè) · isolation clean → `implement-synthesis.md`
+- [!] 2. reviewer pre-commit (sub-reviewer-0.md folder này) → commit wave đích-danh M-7

.claude/workflows/runs/2026-07-17-S136-laneB-remainder/sub-reviewer-0.md

@@ -0,0 +1,47 @@
+# sub-reviewer-0 — ADVERSARIAL PRE-COMMIT REVIEW (S136 laneB-remainder + full wave)
+
+> Vai: reviewer (READ-ONLY code; Write only to THIS trace file). Anti-#53: ghi-đĩa-trong-lúc-làm.
+> VERDICT ở CUỐI file (cập nhật liên tục). Nếu return garble → file này là nguồn cứu.
+
+## Scope
+- Wave adap khung-nhịp-năm-vòng S135→S136, 7 item AI_INFRA.
+- Diff: (a) committed origin/main..HEAD (LANE-A cmd + counter) + (b) working-tree M (LANE-C + LANE-B detector + probe ??).
+- Spec canonical: runs/2026-07-17-S135-.../spec-adap-khung-nhip-17-07-2026.md §② Items 1-8 + §③ AC-A/B/C.
+
+---
+
+## PROVISIONAL VERDICT (updated as I go)
+VERDICT: (pending — investigation in progress)
+
+---
+
+## A. Detector H25 code audit (Category 2 — core) — governance-detectors.ps1:900-1091
+
+### A1. H25-closeout-ritual (Item 4) — line-by-line vs spec
+- Regex `$CloseoutSubjectRx = '^\[CLAUDE\] Docs: S\d+.*(?:closeout|session-end)'` (L930). Spec wrote capturing `(closeout|session-end)`; code uses non-capturing `(?:...)` — functionally identical for -match. OK.
+- Held-in-variable + only applied to git SUBJECTS (L943), never to scanned files → 0 self-match / citation-trap avoided. OK (matches feedback_citation_trap lesson).
+- Window = `$prev.Hash..$cur.Hash` (L967) → git range is HALF-OPEN (prev, cur]. Matches spec "(closeout-trước-nó .. nó]". OK.
+- `git log --name-only --pretty=format: $range` (L970) union of all touches. OK.
+- NEW-session = `--diff-filter=A ... -- docs/changelog/sessions/` (L974) non-empty. Matches spec "sửa file cũ ≠ có log mới". OK.
+- 4 books check L978-981:
+  - STATUS: `$union -contains 'docs/STATUS.md'` — git emits forward-slash paths → literal matches. OK.
+  - HANDOFF: same. OK.
+  - NEW-session: `$newSess.Count -eq 0`. OK.
+  - agent-memory: `$union -match '^\.claude/agent-memory/'` — forward-slash (git canonical), matches. OK.
+- (iv) skip-no-predecessor: L962 `if ($i+1 -ge $closeouts.Count)` → skip msg, no crash. OK.
+- Non-git-tree: L933 `Test-Path (Join-Path $RepoRoot '.git')` → skip w/ reason L952. OK.
+- HONEST-LIMIT comment L916-921 = documents the S132-tail FP + says do-not-special-case + surface to owner. Matches spec Item 4 intent + honesty (S81).
+
+### A2. H25-role-notebook (Item 5) — line-by-line vs spec
+- roster = agents/*.md minus README (L1009-1010). OK.
+- greedy 2-step parse L1028-1029: `^sub-(.+)-\d+\.md$` then `^sub-(.+)\.md$`. Greedy `.+` — analyzed edge cases (reviewer-1-verdict → UNMAPPED; investigator-codebase-0 → mapped). Safe direction (won't false-map roster). OK.
+- has-run = mapped-sub OR diaryExists (L1041). On real repo all 14 have diaries → prefix-map irrelevant to flag result, only affects UNMAPPED INFORM list.
+- 0-byte anti-Goodhart L1047: `if ($diaryExists -and $bytes -gt 0){ok} else{flag}` → 0-byte → flag. OK.
+- UNMAPPED INFORM-only L1059-1063. OK (S122 measure-content-not-name).
+
+### A3. Summary/C4 self-exclusion L1069-1085 — asserts 0 self-match + 0 leaked-excluded. exit 0 L1091. OK.
+
+**Detector code verdict so far: structurally MATCHES spec Items 4+5. Now verifying RUNTIME (AC-B5) + FP W3 + fault-inject spot-run.**
+
+---
+(continuing...)

.claude/workflows/runs/2026-07-17-S136-laneB-remainder/sub-task-0.md

@@ -0,0 +1,101 @@
+# sub-task-0 — LANE-B REMAINDER (S136 recovery /tiep)
+
+> Vai: implementer (Write/Edit tool). Task: append 2 detector H25 vao scripts/governance-detectors.ps1 + fault-inject 9 ca + real-repo run + AC-B(4)(5)(6).
+> Ghi-dia-trong-luc-lam (anti-#53). Cap nhat tung buoc.
+
+## 0. Trang-thai vao (lead da verify — KHONG dung lai)
+- `scripts/nhip-no-probe.ps1` DA LAND + verified AC-B(1)(2)(3-logic)(6). KHONG sua tru ca fault-inject CONFIG-THIEU lo bug that.
+- `scripts/governance-detectors.ps1` grep 'H25' = 0 → 2 detector CHUA co. Day la viec cua toi.
+
+## 1. Ground-truth (do tu dia truoc khi code)
+
+### 1a. Closeout commits (regex `^\[CLAUDE\] Docs: S\d+.*(closeout|session-end)`) — newest first
+| # | commit | subject | predecessor closeout | window |
+|---|--------|---------|----------------------|--------|
+| 1 | 99fc373 | S134 closeout | e53a693 | (e53a693 .. 99fc373] = {6664a61, 99fc373} |
+| 2 | e53a693 | S133 closeout | 9e874ca | (9e874ca .. e53a693] = {d4fbced + 5 wal:flush + e53a693} |
+| 3 | 9e874ca | S132 closeout-tail | 72f68d1 | (72f68d1 .. 9e874ca] = {9e874ca} ONLY (72f68d1 = immediate parent) |
+
+### 1b. Union-window ritual-book check on REAL repo (validated via git BEFORE coding)
+| window | STATUS.md | HANDOFF.md | NEW session (--diff-filter=A) | agent-memory/** | verdict |
+|--------|-----------|------------|-------------------------------|-----------------|---------|
+| W1 S134 | YES | YES | YES (S134 file added) | YES (6 diaries) | PASS |
+| W2 S133 | YES | YES | YES (S133 file added) | YES (4 diaries) | PASS |
+| W3 S132-tail | YES | **NO** | **NO** (S131-S132 file MODIFIED not added in window) | YES (cicd) | **FLAG x2** |
+
+**W3 root-cause (verified):** `9e874ca` parent = `72f68d1` → window = tail commit ONLY. HANDOFF + NEW-session-file were done in `72f68d1` (the EXCLUDED lower bound = the prior session-end that fully closed S131-S132). Tail is a legitimate supplement (late cicd #397 result) → ritual for the SESSION was completed → **W3 flag = FALSE POSITIVE (tail-adjacency artifact)**.
+- Decision: implement LITERAL per-commit per instruction. Report W3 as FP + classify (task: "Neu co FLAG that → phan-loai duong-that/duong-gia, KHONG sua detector cho im"). Surface per-label refinement to lead (canonical spec:90 baseline says "union-per-label"; my relay said per-commit). DO NOT unilaterally redesign (owner owns mechanism; adding same-label-skip specifically to green real-repo = "sua detector cho im" = FORBIDDEN).
+
+### 1c. Roster (14 agents, README excluded) + diary bytes
+cicd-monitor 22607 | database-agent 7388 | frontend-designer 21492 | harvest-curator 19282 | implementer-backend 17927 | implementer-frontend 15951 | investigator-api 8510 | investigator-codebase 23420 | lead-omission-auditor 3691 | lead-view-auditor 3332 | office-document 3323 | reviewer 17506 | test-specialist 22140 | tooling-auditor 18051
+→ 14/14 diaries byte>0. Expect role-notebook = 0 FLAG on real repo.
+
+### 1d. sub-*.md prefix survey (real runs/) — MAPPED vs UNMAPPED
+- MAPPED (roster roles): sub-cicd-monitor-*, sub-implementer-backend-*, sub-implementer-frontend-*, sub-investigator-codebase-*, sub-reviewer-*, sub-test-specialist-* ...
+- UNMAPPED (prefix not a roster role): sub-impl-runsreadme, sub-impl-sleepcmd, sub-invest-A/B/C, sub-invest-codebase-A-mapping/..., sub-investigator-2-spec-draft, sub-investigator-codebase-A..E (letter-suffix not numeric), sub-lead-omission (not -auditor), sub-lead-view, sub-review-r1/r2/r3/R2/R3, sub-reviewer-1-verdict/3-verdict, sub-task-*, sub-w1-task-*, sub-w2-task-*, sub-w3-task-* ...
+- These UNMAPPED must be LISTED, NOT flagged (S122 measure-content-not-name).
+
+## 2. Detector design (locked)
+
+### H25-closeout-ritual (per-commit, LITERAL)
+1. `git -C $RepoRoot log --format='%H|%s'` → filter subjects by `^\[CLAUDE\] Docs: S\d+.*(closeout|session-end)` → ordered list newest-first.
+2. Loop i in 0..2 (3 most recent). upper=list[i]. lower=list[i+1] (immediately-preceding closeout).
+3. If lower missing (i is last closeout in history) → skip case (iv), print reason, no crash.
+4. Union files = `git log --name-only --pretty=format: lower..upper` (any touch).
+   NEW-session = `git log --diff-filter=A --name-only --pretty=format: lower..upper -- docs/changelog/sessions/` non-empty.
+5. Check 4 books: STATUS.md (union), HANDOFF.md (union), NEW-session (diff-filter=A), agent-memory/** (union). Missing → FLAG MED naming book.
+
+### H25-role-notebook (measure content not name)
+1. roster = `.claude/agents/*.md` minus README (14).
+2. Scan `runs/*/sub-*.md`. Parse `^sub-(.+)-\d+\.md$` (role+numeric idx) else `^sub-(.+)\.md$`. candidate ∈ roster → MAPPED (role has-run). else → UNMAPPED (collect distinct).
+3. has-run(role) = (mapped sub-file exists) OR (diary MEMORY.md exists on disk, any size).
+4. FLAG MED if has-run(role) AND NOT (diary exists AND byte>0 via (Get-Item).Length). Name missing vs 0-byte.
+5. Print UNMAPPED list (INFORM, no flag).
+
+## 3. AC-B(5) — REAL-REPO RUN (governance-detectors.ps1, no -RepoRoot)
+```
+H25-closeout-ritual: closeouts found 73 ; scoring 3 most-recent
+  [ok] 99fc373 S134: union (e53a693..99fc373] all 4 books      PASS
+  [ok] e53a693 S133: union (9e874ca..e53a693] all 4 books      PASS
+  [MED] 9e874ca S132: window (72f68d1..9e874ca] missing 2/4 -> HANDOFF, NEW-session   FLAG
+H25-role-notebook: roster=14 ; diaries-ok=14 ; flagged=0 ; inert=0   PASS
+  UNMAPPED (27, INFORM not flagged): impl-runsreadme, impl-sleepcmd, invest-A/B/C, invest-codebase-*, investigator-2-spec-draft, investigator-codebase-A..E, lead-omission, lead-view, reviewer-1-verdict, reviewer-3-verdict, reviewer-R2/R3, review-r1/r2/r3, task, w1-task, w2-task, w3-task
+Summary: 0 self-match (C4 satisfied) ; TOTAL FLAGS 46 (45 pre-existing other-detectors + 1 my closeout-FP)
+```
+**Classification of the 1 flag beyond "3 PASS" expectation:** W3 S132 = **FALSE POSITIVE** (duong-gia). Root-cause verified 1b/parent-check: `9e874ca` parent = `72f68d1` (immediate) + same session batch (S131-S132) → 1-commit window; HANDOFF + NEW-session were done in `72f68d1` = the EXCLUDED lower-bound (the session-end that fully closed S131-S132). The tail is a legit supplement (late cicd #397). No real ritual drift. NOT silenced (per task: classify, don't hack detector). Surfaced to lead: canonical spec:90 baseline = "union-per-label"; per-label folding of same-batch closes would fold this to PASS. Owner decision (do NOT self-apply — adding same-label-skip to green real-repo = "sua detector cho im" = forbidden).
+- role-notebook 14/14 + UNMAPPED = EXACTLY spec-expected. 0 duong-that, 0 duong-gia.
+
+## 4. AC-B(6) — code-mo-i
+- pure-ASCII: whole file 60003 bytes, non-ASCII count = **0** → append delta 0 non-ASCII. PASS.
+- syntax: `[Parser]::ParseFile` → **0 errors**. PASS.
+- exit 0: script ends `exit 0` (unchanged, my detectors are advisory Write-Flag only). PASS.
+- 0 self-match: Summary self-match check = 0 (my detectors scan git + filenames + diary-bytes, never add the .ps1 to any MD corpus). PASS.
+
+## 5. AC-B(4) — FAULT-INJECT MATRIX (9 ca, temp git tree via -RepoRoot, S95 proves-teeth)
+Orchestrator: scratchpad/fault-inject-h25.ps1 ; tree-root: %TEMP%\h25-fi-20260717-174129 (temp, KHONG dung repo that).
+| # | case | setup | expected | RESULT | evidence |
+|---|------|-------|----------|--------|----------|
+| c-i | closeout fake | S11 closeout touches only foo.txt, window (S10..S11] empty of books | FLAG 4/4 | **PASS** | `MED git:eca9ba2 (S11) missing 4 of 4 books -> STATUS,HANDOFF,NEW-session,agent-memory` |
+| c-ii | closeout control | S21 close + wal:flush(diary) + STATUS/HANDOFF/NEW-session | PASS | **PASS** | `[ok] d013bb6 S21: union (19b24d2..d013bb6] has all 4 ritual books` ; 0 gap |
+| c-iii | tail union-reach | tail S31 touches STATUS only; HANDOFF+NEW-session done by in-window wal:flush | NO FLAG | **PASS** | `[ok] 3bec765 S31: union (4d2320f..3bec765] has all 4 ritual books` ; 0 gap |
+| c-iv | lone closeout | 1 closeout only, no predecessor | skip reason, no crash | **PASS** | `[skip] 2fe1887 S40: no earlier close ... not scored, not flagged` + reached Summary/TOTAL FLAGS |
+| r-ii | role control | 14 agents + 14 diaries byte>0 + sub-files | PASS | **PASS** | `roster=14 ; diaries-ok=14 ; flagged=0` |
+| r-i | role delete | delete reviewer diary (sub-file kept) | FLAG MISSING | **PASS** | `MED agent-memory/reviewer/MEMORY.md ... diary is MISSING` ; diaries-ok=13 flagged=1 |
+| r-iv | role 0-byte | truncate reviewer diary to 0 bytes | FLAG 0-byte | **PASS** | bytes=0 ; `MED ... diary is 0-byte (empty notebook)` ; flagged=1 (anti-Goodhart) |
+| r-iii | role alien | add sub-invest-A-0.md + sub-w1-task-0.md | UNMAPPED, no flag | **PASS** | `UNMAPPED (2): invest-A, w1-task` ; flagged=0 (S122) |
+| p-1 | probe CONFIG-THIEU | counter.json ok + budget.json missing h24_cadence | CONFIG-THIEU in-line + exit0 | **PASS** | `NHIP-NO: kiem CONFIG-THIEU(h24_cadence) | tran-bo-nho 0 over-cap | run-chua-gom 0` ; exit 0 ; not probe-loi |
+
+**9/9 PASS ; 0 FAIL.** Teeth proven BOTH directions: FLAG-correct (c-i, r-i, r-iv, p-1) + PASS/IM-correct (c-ii, c-iii, c-iv, r-ii, r-iii). Probe CONFIG-THIEU handled the missing-key IN-LINE in ve-1 (not generic probe-loi) → **0 probe bug found → no probe change** (respecting "KHONG sua probe").
+
+## 6. Isolation (B6) + AC-B rollup
+- Files I touched (in-repo): `scripts/governance-detectors.ps1` (M, LANE-B code) + this `sub-task-0.md` (?? my sub-file). NOTHING else. (scratchpad fault-inject-h25.ps1 = outside repo.)
+- AC-B rollup: (1)(2)(3) = probe, LEAD-verified pre-state (not re-done). (4) fault-inject 9/9 PASS. (5) real-repo: role-notebook 14/14 clean + UNMAPPED-27; closeout 2 PASS + 1 FP (S132 tail, classified duong-gia, NOT silenced, per-label refinement surfaced to owner). (6) exit 0 + pure-ASCII delta 0 + parse 0-err + 0 self-match.
+
+## 7. Progress log
+- [x] Read spec Items 4+5 + AC-B + existing 2 scripts.
+- [x] Ground-truth git windows + diaries + prefixes.
+- [x] Append 2 detectors (H25-closeout-ritual + H25-role-notebook).
+- [x] AC-B5 real-repo run (2 PASS + 1 FP closeout ; 14/14 role-notebook).
+- [x] AC-B6 pure-ASCII delta(0) + parse(0-err) + exit 0 + 0 self-match.
+- [x] AC-B4 fault-inject 9/9 PASS on temp tree.
+- [x] Isolation verified (2 in-repo files only).