[CLAUDE] Docs: S101 H18 WF2 review closeout — re-run wf_955643c3-f7d PASS_WITH_CONCERNS + stamp + model-note Opus-S101

- WF2 gốc wf_31ea3985-92c mất theo CLI-restart → re-run fresh 3-lane adversarial
- Lane-A detector-teeth PASS (fault-inject 4/4 tái-dựng độc-lập -RepoRoot, MED derived-stale 11→0)
- Lane-B ledger-retire PASS_WITH_CONCERNS: 1 CONCERN workflows/README:51 nhãn-cũ "ledger orphan-scan" sweep-S100-sót → FIXED
- Lane-C PARTIAL: codify+n-a-H8+containment first-hand; frontier-hash+reviewer_gate dựa record-S100 (broadcast inbound vắng repo)
- Lane-C #53 return-garble → recover first-hand; AS-10 residual sub-write reverted (git-diff backstop)
- Stamp run-id+verdict → adap-report:5 + engine §J:283; STATUS/HANDOFF flip + session-log
- Model-note reconcile: runtime=Opus S101 (Fable unavailable, settings pin fable → H5-fallback revert-free) — STATUS:24 + agents/README:3
- Harvest reviewer + tooling-auditor memory (B3)
- Email AI_INFRA wf2-verdict + 3 flag (reviewer_gate-missing · frontier-hash-mismatch · process-gap broadcast-not-committed)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.claude/workflows/README.md

@@ -48,5 +48,5 @@ Phân biệt RAW (prefix `sub-`) vs VERIFIED (suffix `-synthesis.md`) bằng **T
 ## Guard
 - **S1:** Workflow CHỈ repo SOLUTION_ERP — KHÔNG fan-out repo/corpus khác (`cross_project_search` = READ reference only).
 - **S2/S3:** chỉ chạy khi HMW-mode ON (`/ultra-on` → marker `.claude/hmw-mode.on`) + checkpoint INFORM (`hmw.js` throw nếu `checkpointApproved≠true`) + sub KHÔNG spawn sub.
-- **Anti-bypass detector (h10-refine b): SE TAILORED-OUT** — SE chạy workflow qua Anthropic Workflow tool (KHÔNG có CLI-launcher để lách như node-CLI) → bypass-surface ~N/A; containment = git-diff + run-folder TRACKED + ledger orphan-scan (G-015). 3 nguyên-tắc detector (whitelist launcher · path-variant match · anchor launch-key + nghiệm-thu quan-hệ) đã cân-nhắc, N/A cho threat-model SE. Chi-tiết `runs/README.md`.
+- **Anti-bypass detector (h10-refine b): SE TAILORED-OUT** — SE chạy workflow qua Anthropic Workflow tool (KHÔNG có CLI-launcher để lách như node-CLI) → bypass-surface ~N/A; containment = git-diff + run-folder TRACKED + folder-scan orphan (🧊 `_ledger` retired H18-B S100) (G-015). 3 nguyên-tắc detector (whitelist launcher · path-variant match · anchor launch-key + nghiệm-thu quan-hệ) đã cân-nhắc, N/A cho threat-model SE. Chi-tiết `runs/README.md`.
 - **G-015 accuracy (no-overclaim):** run-folder TRACKED ≠ read-only-ENFORCED — sub vẫn giữ Bash (write-channel mở: ghi-ngoài-repo git-diff mù / curl Qdrant). Containment THẬT = **em-main single-writer + git-diff (in-repo, run-folder tracked nên hiện) + chunk-count (RAG)**, defense-in-depth, KHÔNG sandbox cứng. KHÔNG claim "ENFORCED", KHÔNG bỏ chunk-count.