[CLAUDE] Docs: vá 9 finding audit S143 + mở enum gap-incident-unrecorded

Audit 3 lane (reviewer FAIL 1C/4M/4m/1nit + 2 vai H24 = 6 FLAG), lead tự
re-đo từng finding trước khi vá.

CRITICAL/MAJOR:
- Re-anchor 5 adap-report: sha wal: tiền-closeout (1a0fa59/a458102/96ab2679)
  dangling sau squash -> hub clone không resolve nổi. Đổi sang 2757e41.
  LUẬT: cite outward = commit SẼ SỐNG sau squash, không bao giờ wal:.
- Đính chính claim OK-reachable: phép đo tự huỷ trong cùng phiên (squash lật
  sang squash-benign). Sự thật mạnh hơn: cả 2 nhánh lành đã chạy runtime.
- TRIPLE 17/17/17 chọn enum dễ: README:225 (tự xưng "ĐỦ roster") còn 14 +
  "4 monitor"; README:27 ("Roster THẬT") còn 14. Cả 2 vá -> 17/7.
- TOTAL 46 "== baseline" sai: baseline ghi trong repo là 45. Tách claim-DELTA
  (bền) khỏi claim-TUYỆT-ĐỐI (phải neo commit+thời-điểm).

FLAG view-residual-asym: STATUS:450 + README:190 còn khai "NO Write/Edit" như
cơ-chế chặn -> sửa thành tuyên-bố ý-định (runtime vẫn cấp, 9/9 vai; nhân-chứng
reviewer đã Write+Edit thật).

FLAG gap-carry-dropped: HANDOFF carry 13 -> 14, trả [carry:session-model-adopt].
FLAG gap-decision-sunk: 3 mục "Chờ-anh" chìm 2 nhãn phiên -> lên NEXT anh (10)(11)(12).

Enum flag_classes 10 -> 11: +gap-incident-unrecorded (anh duyệt). Vai
lead-omission từ chối tự chế class và escalate đúng luật CLOSED-enum.

Bài học acceptance: AC4 grep theo SỐ nên 2 site liệt-kê-TÊN lọt lưới.
Lần sau đếm PHẦN TỬ rồi so canonical, đừng so hình-dạng chuỗi.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/nhip-no-probe.ps1

@@ -19,7 +19,7 @@
         the no-default signal H24-2 depends on.
 
   Output contract - EXACTLY one line:
-    NHIP-NO: kiem light a/e deep b/f <ok|OVERDUE:light|deep> | tran-bo-nho x over-cap | run-chua-gom y
+    NHIP-NO: kiem light a/e deep b/f <ok|OVERDUE:light|deep> | tran-bo-nho x over-cap | run-chua-gom y | pull-cach N ngay
       * kiem  = audit cadence: a = counter - last_audit.light_at_counter (light debt),
                 e = h24_cadence.light_every ; b/f = deep pair. OVERDUE when a>=e or b>=f.
       * tran-bo-nho = x agent-memory/*/MEMORY.md files whose (Get-Item).Length exceeds
@@ -28,6 +28,19 @@
       * run-chua-gom = y orphan run-folders per the DUAL-ACCEPT rule ported verbatim
                 from tiep.md:40-53 (flat *-synthesis.md OR C8 harvest/*-synthesis.md,
                 each non-empty; retired form-3 NOT ported).
+      * pull-cach   = N days since the most recent INBOUND receive-date in
+                broadcasts/_index.md (col-1 of rows ABOVE the OUTBOUND header).
+                WHY THIS VE EXISTS (S143): the standing instruction was "watch
+                broadcasts/inbox" - but inbox only ever holds mail ALREADY pulled,
+                so it can NEVER surface un-pulled mail. It stayed silent by design
+                while SE waited on a hub reply that had been sitting in the hub
+                outbox since 18-07, until the hub had to send a nudge. This ve
+                measures the thing that was actually blind.
+                THRESHOLD IS DELIBERATELY ABSENT: prints the raw number only.
+                If key h24_cadence.pull_warn_days is present it also appends
+                OVERDUE:pull - but SE does NOT invent that number (owner's call,
+                same discipline as declining to pick session_ctx_kb).
+                Unparseable/absent index -> 'pull-cach n-a' (NEVER kills ve 1-3).
 
 .PARAMETER RepoRoot
   Repo root. Default = resolved one level up from this script (scripts/ -> repo root).
@@ -145,7 +158,47 @@ try {
     }
     $runSeg = ("run-chua-gom {0}" -f $orphan)
 
-    Write-Host ("NHIP-NO: kiem {0} | {1} | {2}" -f $kiemSeg, $tranSeg, $runSeg)
+    # -----------------------------------------------------------------------
+    # Ve 4 - pull-cach (broadcast pull lag). Own try/catch ON PURPOSE: a NEW ve
+    # must never be able to blind the 3 ves that already work. Any failure here
+    # degrades to 'pull-cach n-a', it does NOT fall through to probe-loi.
+    # -----------------------------------------------------------------------
+    $pullSeg = 'pull-cach n-a'
+    try {
+        $idxPath = Join-Path $RepoRoot 'broadcasts\_index.md'
+        if (Test-Path -LiteralPath $idxPath) {
+            $lines = Get-Content -LiteralPath $idxPath -Encoding UTF8
+            # Rows ABOVE the OUTBOUND header are INBOUND. Match on the ASCII token
+            # only - the real heading carries an emoji this script must not contain.
+            $cut = $lines.Count
+            for ($i = 0; $i -lt $lines.Count; $i++) {
+                if ($lines[$i] -match '^#{1,6}.*OUTBOUND') { $cut = $i; break }
+            }
+            $newest = $null
+            for ($i = 0; $i -lt $cut; $i++) {
+                if ($lines[$i] -match '^\|\s*(\d{4}-\d{2}-\d{2})\s*\|') {
+                    $d = [datetime]::ParseExact($Matches[1], 'yyyy-MM-dd', $null)
+                    if ($null -eq $newest -or $d -gt $newest) { $newest = $d }
+                }
+            }
+            if ($null -ne $newest) {
+                $days = [int]([datetime]::Now.Date - $newest.Date).TotalDays
+                $pullSeg = ("pull-cach {0} ngay" -f $days)
+                # Threshold is OPTIONAL and owner-owned. Absent key = stay INFORM,
+                # do NOT assume a default (that would be inventing owner's number).
+                $warn = $null
+                if ($null -ne $cad) { $warn = $cad.pull_warn_days }
+                if ($null -ne $warn -and $days -ge [int]$warn) {
+                    $pullSeg = ("pull-cach {0}/{1} ngay OVERDUE:pull" -f $days, [int]$warn)
+                }
+            }
+        }
+    }
+    catch {
+        $pullSeg = 'pull-cach n-a'
+    }
+
+    Write-Host ("NHIP-NO: kiem {0} | {1} | {2} | {3}" -f $kiemSeg, $tranSeg, $runSeg, $pullSeg)
 }
 catch {
     # A probe NEVER blocks a stop point. Any failure prints one generic line.