Review follow-up: the mirror said only to delete the old clone, but
deterministic-only is exactly the mode the mirror runs — the one case
where moving the clone and its eval receipt keeps offline work alive.
Now says what mainline says.
DeepSeek Harness joins the host list, and one callout gives the
install command. Setup, limits, and the bundle itself live on the
dsh-aris branch, which carries its own README the way aris-code does.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Reviewers kept proposing machinery this rule already forbade, by renaming
the proposal: a migration shim was defended as "load-bearing compatibility,
not defensive scaffolding". Naming the mechanism was not enough.
Rule 3 now requires a current repo defect the mechanism fixes or an explicit
existing invariant it preserves, says that "load-bearing", "compatibility"
and "not scaffolding" are labels rather than evidence, and asks for the
proposal's factual premises to be checked — a reviewer once pinned three
dependency versions that do not exist.
Tested adversarially on three real incidents with the block in force: it
stopped the unchecked premises, and did not stop the other two, which now
reach for "explicit existing invariant" instead. Closing a word closes only
that word, so the wording stops here; reviewers propose, humans adjudicate.
Synced across the canon, the four skills that embed the block, the Codex
mirror, the regenerated claude-review overlay, and the gemini-review overlay.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ARIS runs on DeepSeek Harness, Codex CLI, Cursor, Trae, Antigravity and
Copilot CLI, where ~/.claude names an installation the user does not have.
~/.aris already holds the global repo pointer, so the launcher's cache and
its eval receipt belong beside it.
Nothing of the user's lives in that directory — the launcher creates it and
resets it to the pin on every run — so an existing clone is not migrated:
the note says to move it only to keep an offline deterministic-only run
working, and to delete it otherwise. A full sweep calls model auditors and
needs the network regardless.
Also widens the host requirement for the nine-dimension sweep, which is no
longer Claude-Code-only.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
When the Codex MCP reviewer provably failed before dispatch (tool absent, spawn failure, rejected pre-execution), reviewer-aware workflows previously ended in REVIEW_UNAVAILABLE even with another OpenAI-compatible endpoint configured. The existing llm-chat MCP can now expose review/review_reply behind LLM_REVIEW_FALLBACK_ENABLED=true (default off).
Boundaries: pre-dispatch-only — never after a timeout or ambiguous failure, where the review may already have run; verdict calls are single-attempt fail-closed (no retry, no fallback model); primary-artifact files are read server-side and shipped to the endpoint; the gate gives llm-chat less trust than existing backends (same/unknown family fails, independence recorded caller_declared, copilot-finalizer states still require codex or manual).
Closes#412
Full-width it dominated the first screen of the sibling-project section;
the frames strip below it was already behind a fold. Same treatment,
summary names what the canvas shows.
The visible list now starts at August; the three July entries join the
existing Earlier-updates block, whose range and count are updated
(78 -> 81 entries EN, 69 -> 72 CN).
The wiki ingests WebSearch/WebFetch-derived material and /idea-creator consumes the rebuilt query_pack.md as prompt context, so a cached pack bypassed rebuild-time scanning. The pack now goes through the pre-existing threat_scan.py (strict scope) immediately before Read; on a hit, scanner error, or unresolved scanner the raw pack is left untouched and the run continues without wiki context. The snapshot/sealing/quarantine sequence from the first revision was trimmed on review — scan-on-read is the whole fix.
Refs #87
Issue #375: after a harness change, Claude simply omitted the Codex review and the evidence gate still passed. The novelty-check and research-review phases now require a real reviewer model + review-session handle before the gate passes; only positive verdicts may call accept/mark-provisional. Section validation is a plain first-match/non-empty check — the adversarial Markdown parsing from the first revision was trimmed on review.
Fixes#375
AUTO_PROCEED=true checkpoints relied on a user-silence timeout that cannot exist in a turn-based CLI; they now report the selected action and continue in the same turn. =false remains an explicit blocking gate, as does Feishu interactive approval. Mainline, Codex mirror, Gemini overlay and docs all updated to the same contract.
Fixes#30
Regenerating the Claude-review overlay double-escaped quotes in paper-figure/paper-plan/paper-write, emitting invalid YAML that strict loaders skip (82 -> 79 skills). Fix is in the generator: normalize the legacy escape layer, serialize frontmatter via json.dumps (JSON strings are a valid YAML subset), regenerate the three files, and lock both generator behavior and checked-in artifacts with regression tests.
The three CI test failures on the branch were the pre-existing meta.json ordering bug fixed on main in f4f20f9; the PR's own tests pass.
save_trace.sh writes two files matching "*.meta.json" into one run dir —
the per-call <prefix>-<purpose>.meta.json, which carries model_family and
effort_unpinned, and run.meta.json, which carries neither. Two helpers
took next(glob(...)), i.e. whichever directory iteration yielded first.
CI runs python-version '3.x' unpinned. The ubuntu leg moved CPython
3.14.6 -> 3.14.7 between Aug 11 and Aug 15 and three tests went red with
KeyError; macOS stayed green because APFS happened to yield the call meta
first. No repo code changed — the commits GitHub blamed touched only
arxiv files and a JPEG. The tests had been betting on iteration order
since July and finally lost.
Both helpers now derive the meta from the request they already read, so
the pairing is explicit rather than incidental. Verified by monkeypatching
Path.glob to return results reverse-sorted, which reproduces exactly the
three failures CI reports on the original code and none on this one.
The other next(glob(...)) calls in these tests are left alone: each test
gets a fresh tmp_path and makes one call, so there is only ever one run
dir, one request and one response to pick.
arXiv/CDN HTML error pages over 10KiB were written as .pdf, reported as success, and served from cache forever — the cached path had zero validation. _validate_pdf (size + %PDF- header in the first 1KiB) now guards both the fresh-download and cached paths; an invalid cached entry is unlinked before raising so the next call re-downloads. Two regression tests.
Co-authored-by: Iams4kura <Iams4kura@users.noreply.github.com>
Both were running four to five lines with the signal counts spelled out
twice over. Cut to a bold lead line and one italic qualifier each. The
centered pull-quotes went with them — at two callouts they had started
to space the page out more than they punctuated it.
HERO came out of this repo's own reviewer output — the same cross-model
review that catches real defects also spent a measurable share of its
budget on hashes nobody reads. Both READMEs now carry it alongside the
Anti-Autoresearch and Movie-Director callouts.
gpt-5.6-sol over-defends systematically. Measured over one day of real maintenance review (2026-08-10, ~10 rounds at xhigh/ultra), every discarded proposal fell into the same four categories: adding hash binding to a gate that already had four layers; adding a lint to mechanize a rule this corpus deliberately keeps as prose; adding a dual-spelling compatibility layer for what was a typo; hardening a race that closes in milliseconds. None was self-limiting. The same reviewer, in the same rounds, found five genuine shipped defects including the one that killed every job in /experiment-queue at 60 seconds.
New shared reference review-scope-limits.md holds the contract. Its block bounds what a reviewer may PROPOSE, never what it may look for, and says so in its first line: worded as 'do not report corner cases' it would have suppressed the bare-string depends_on hang, which sounds rare but which our own SKILL.md examples produce. The test is whether it happens here, not how rare it sounds.
Inserted at the nine prompt bodies where the reviewer audits code or mechanism: auto-review-loop (all five bodies), paper-writing Phase 1.5, experiment-bridge Phase 2.5, meta-optimize Step 4, meta-apply's jury — plus Codex mirrors and the gemini overlay.
Deliberately excluded from 18 other call sites. Two exclusions are load-bearing: the patent suite would be INVERTED (patent-review's prompt is an examiner persona where defensive rigor IS the deliverable), and experiment-audit would contradict itself (its prompt is a deliberately mechanized A-F PASS/WARN/FAIL checklist while clause 5 forbids over-mechanizing judgement).
The hash clause says do not PROPOSE NEW binding: meta-apply's own provenance stamp carries a content_hash and a literal-minded jury could otherwise KILL a patch for touching it, which the human cannot override. No lint enforces the block's presence — adding one would be the exact failure the contract prevents.
Two bugs this exposed: the claude-review overlay had been stale since 2026-07-13 while its skills-codex source changed 2026-07-15 (it is a generated file nobody regenerated); and a regression I introduced doing that regeneration, which carried the source's {"backend":"codex"} acquittal example into a pack whose backend is claude-review — fixed in the generator. Plus one insertion site I missed: the mirror's nightmare tier spawns a FRESH reviewer that inherits nothing and has the widest repository access.
Three rounds of cross-model review; the last two findings were both found by it. 610 passed; inventory consistent; reference count 30 -> 31 with the mirror twin.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Two upstream changes landed after #394 bumped the pin to 98a75fc, so the pin lagged by two commits within the same hour:
- Anti-Autoresearch#21 — the deterministic-only fallback ran two of its four checkers, and the adjudication step's glob would have dropped the other two's output anyway, so GRIM / GRIMMER / variance-impossibility / statcheck never ran in that mode. This one matters here: the Codex-native path IS the deterministic-only mode.
- Anti-Autoresearch#22 — deleted the counter-check's demotion capability, which could never fire. No behaviour change; it stops report.schema.json describing auto-clearing that does not happen.
This does not violate the bump-once rule it was written under. That rule exists because fresh rejects every stored gate.json at an older pin with PIN_MISMATCH, forcing a re-sweep. #394 has not shipped in a release yet, so no user has paid that cost: landing this now collapses both into the single re-sweep users were always going to do.
610 passed; inventory consistent.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Moves the pin from d8f510c to 98a75fc, past both upstream merges: the deleted report self-binding hashes (Anti-Autoresearch#19) and the reporting model (Anti-Autoresearch#20). One bump, not two — fresh rejects every stored gate.json at the old pin with PIN_MISMATCH before it checks anything else, so each bump already forces a re-sweep for every user.
Zero Python logic changes on this side: forensics_gate.py's _severity() already reads _severity_final or severity, and upstream kept both that field and the four verdict tokens. The only code change is its docstring, which promised a content-binding feature upstream has now deleted because nothing consumed it. GATE_VERSION deliberately not bumped — fresh rejects a version mismatch before anything else, which would invalidate stored gates this change has nothing to say about.
Prose that moves with the pin: upstream is a rules-only reporter, not an adjudicator that owns the verdict; HARD_FLAGS means an auditor proposed something critical and it is on your table to read, never 'the machine found fraud'; SOFT_FLAGS gains the caveat that a WARN can sit on top of a sweep where verdict-bearing dimensions never ran; waive is promoted from last resort to a first-class outcome. /paper-writing Phase 5.9 and the three codex mirrors follow. The Pin-bump checklist gains a release note.
What users will notice: more open obligations, because findings the removed gates used to demote to info now arrive above info. Nothing got worse in the paper — more of what the auditors said is visible.
610 passed; inventory consistent.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Seven commits, three rounds of cross-model review before merge.
**experiment-queue scheduler** — five compounding defects in the detached scheduler that gets scp'd to the GPU host, a file with no test coverage. screen_exists() built its grep pattern inside an f-string as '.{name}\t', searching for a literal backslash + t while screen -ls emits a real TAB, so every healthy running job was judged dead at the first 60s poll and its screen killed. The 'screen alive, process gone' branch had a comment and no return and fell through to running forever — unreachable until the first fix made it live. failed_other had no exit and was not terminal, so the scheduler looped forever. output_exists() quoted the whole path and killed glob expansion while the manifest examples use wildcards. And depends_on given as a bare string — the shape both SKILL.md examples showed — was iterated character by character, so a dependent phase never became ready: a third way to hang, caused by our own docs. load_state normalizes the string form on both the fresh-manifest and resume paths so manifests and state files from the old docs still run.
**manual-review cross-family gate** — validate_reviewer_identity() only enforces when the caller passes require_reviewer_model, and that flag appeared in exactly one skill. research-review, experiment-audit, idea-creator, proof-checker and rebuttal now pass it. Landed together with all its prerequisites: the family table widened to DeepSeek/Moonshot/Qwen (the models the guide recommends were the ones the gate refused), the browser UI now shows the server's rejection reason instead of a generic retry prompt, file mode no longer deletes the response the user just pasted, and both MANUAL_REVIEW_GUIDE.md and _CN.md document the Reviewer-Model header in the same commit — the required action is a human paste, which no skill edit can deliver.
**Smaller fixes** — research_wiki matched '# One-line thesis' while the renderer writes '## One-line thesis', so query_pack's Key Papers has always been title-only, silently degrading /idea-creator's main input. figure-spec invoked mcp__codex__codex without granting it, on the default paper path. reviewer-routing spelled the gemini tools with an underscore in five places. forensics_gate now names the coverage dimensions that never ran, without re-deciding on them. The kill-argument verdict table claimed every (counts, severity) tuple hits exactly one row and did not, in both directions. Four Chinese backend-switching guides scoped a rewrite job to 12 skills when the real numbers are 46 grants / 28 invocation blocks.
Deliberately not changed: launch_job's PID capture records the bash wrapper, but if python exits the pipe closes and the wrapper and screen exit with it, so the screen-gone check catches that; the realistic failure is a hung python where every PID is alive. The root README's dated News entries keep their original wording — they record what shipped that day.
Full suite 610 passed on both CI legs; check_skills_inventory consistent.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The old closing clause ("non-Copilot hosts retain the Codex default") was
technically complete but easy to miss; most users run exactly that setup.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
EN gains the #383 evidence-gate entry (the #360 entry rode in with its PR);
CN gains translations of both to restore bilingual parity.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Two prompt templates still said "The author (Claude)" — with the native
Copilot route the executor is whatever model the host runs, and the family
routing/stop gate already treat it that way. Cosmetic only.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The gate's own resumable-runs.md addition already states the doctrine
correctly ("a gate does not replace the per-phase acceptance record"), but
run() overreached it: on PASS it called run_state.accept() on all five
semantic stages — upgrading even `provisional` ones — on the strength of
file-exists + heading-present evidence. Per resumable-runs.md, a
deterministic file-exists check may accept only a purely mechanical phase;
these stages carry quality semantics, and resume relies on
done-but-not-accepted to know a stage's own audit is still pending.
run() now records gates.idea-discovery-evidence and nothing else. Tests
updated: PASS asserts phases stay `done`, and a new test pins that the gate
never calls run_state.accept. SKILL wording (both mirrors) aligned.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Cross-model review of the merged #386/#387 work found two paths the fix
missed, both of which a normal upgrading user hits:
- The arXiv dedup scan and the edges.jsonl / gap-map / brief readers all
read wiki files directly, bypassing the friendly message that only
_load_paper_frontmatter had. A legacy cp936 wiki still produced a bare
UnicodeDecodeError traceback on ordinary commands. Extracted the reader as
_read_wiki_text() and routed every wiki-internal read through it; the
--from-file path stays as-is since its "this wiki" wording would be wrong.
Verified: rebuild_index and rebuild_query_pack on a GBK wiki now name the
exact file to convert instead of raising.
- verify_papers.py read the on-disk cache as UTF-8 but its except tuple
omitted UnicodeDecodeError, so a legacy cache crashed the command rather
than being ignored — which is what the surrounding code already intends
for an unreadable cache.
News entry corrected on three counts of overclaim: a Chinese title
containing ASCII terms (LLM, GPT) never collapsed to `untitled`, so the
claim is now scoped to Chinese-only titles colliding within the same year;
"English slugs unchanged" is really ASCII slugs unchanged (accented Latin
names like Müller do change, for the better); and "existing wikis verified
intact" overstated it — legacy cp936 wikis genuinely need converting, so it
now says existing UTF-8 wikis stay compatible and describes what a legacy
wiki sees.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
One entry covering both PRs: the encoding fix (research-wiki was
locale-bound) and the slugify fix (Chinese papers silently dropped as
duplicates), plus the research-lit local-library warning. EN + CN.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
slugify() stripped every non-ASCII character from both the title and the
author, so any Chinese paper produced `<year>_untitled` with an empty author.
Two different papers by the same author in the same year therefore got the
same slug, and ingest_paper skipped the second one as a duplicate:
slugify("扩散语言模型的表征视角", "张三", 2026) -> 2026_untitled
slugify("图神经网络的可解释性研究", "张三", 2026) -> 2026_untitled
A Chinese-language literature sweep silently kept only the first paper per
(author, year). Found while verifying the #385 encoding fix end to end.
The title regex now keeps word characters in any script (still dropping the
underscore that \w would otherwise admit, so ASCII output is unchanged), the
author keeps any alphabetic character, both sides are NFC-normalized, and a
non-ASCII keyword is capped at 48 characters since scripts without spaces
yield one long token. No hashing and no collision registry: the slug stays
human-readable and derived only from the paper's own metadata.
ASCII titles and authors slugify byte-identically — locked by a test. Papers
already ingested keep their existing slugs and edges; only newly ingested
non-ASCII papers get the corrected id.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
#385 — tools/research_wiki.py had ~30 text file ops but passed encoding= on
only 6, so the store inherited the platform default. On cp936 (Chinese
Windows) that wrote research-wiki/ in GBK: not portable to collaborators on
other platforms, and rebuild_index died with UnicodeDecodeError as soon as
any external tool rewrote a file as UTF-8. All text ops now pass
encoding="utf-8"; the arXiv HTTP resp.read() stays raw bytes. Same fix for
tools/verify_papers.py, which is in the same class (persistent cache +
user-specified JSON report, ensure_ascii=False). The discriminator is
ensure_ascii=False, not the raw op count — watchdog.py and the lock-file
opens in iteration_log.py / run_state.py write pure ASCII and are untouched.
No errors="replace": silently swapping bytes for U+FFFD corrupts a store
whose whole purpose is faithful accumulation. Instead _load_paper_frontmatter
catches UnicodeDecodeError and exits naming the offending file and the fix, so
a legacy cp936 wiki gets a clear message rather than a traceback. One line in
the research-wiki SKILL records the UTF-8 invariant and the one-time
conversion for legacy wikis — no migration machinery.
#384 — /research-lit resolves PAPER_LIBRARY from three paths and, when all
three missed, skipped to Step 1 silently. Users whose PDFs live in a
reference manager ran `— sources: all`, got nothing from `local`, and were
never told; the reporter measured 82 of ~120 Zotero PDFs matching once the
path was configured. Step 0c now emits a WARN naming the one-line fix (the
"## Paper Library" heading) before continuing. Left as a runtime warning
rather than an installer probe: the defect is silence, the warning fires
exactly when the user is searching and can act, and a candidate-path guess
would need writing twice and would be wrong for many setups. Codex mirror
carries the same warning against AGENTS.md.
Test reproduces the reported failure (non-ASCII edge evidence round-trips as
UTF-8; rebuild_index reads it back) — verified to fail when the fix is
reverted under a C locale.
Closes#385Closes#384
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
posterly is /paper-poster-html's upstream (its measurement-gate machinery,
MIT, already credited); its developer shipped a major design-variety update
after ICML and asked for a pointer. GitHub + blog links, developer-reported
adoption numbers attributed as such. EN + CN.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Same one-phrase highlight the workflow section got — the News entry named
the derivation-structure gate without its real selling point.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The derivation-structure gate (target-first rewrite, acyclic dependency
graph, no subgoal assuming the target) was listed under "Edit for
exposition", underselling its real value: a proof that resists a clean
top-down rewrite is usually hiding a gap, and circular reasoning surfaces
during the rewrite. One-line addition in both EN and CN. Note: this stays
complementary to /proof-checker's whole-paper dependency DAG (incl.
semantic-circularity detection) — same invariant, independently checked at
drafting time vs submission time.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Renames the standalone-theory section to "Workflow 7" (nav bullet, News
headline, and boundary tip updated to match) and adds the house-style
collapsed ASCII flow diagram — freeze target → local attempt → audit →
notation/structure gates → GPT Pro handoff on stall → re-audit → final.md,
with the DeepSeek branch and run-directory state noted — in both EN and CN,
matching the W3/W4 diagram convention.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Adds the #381 What's New entry and a "Standalone Theory Workflow" section
after Workflow 6 (Rebuttal-style format: hook, numbered emoji stages, Skills
involved, tips), plus a nav bullet in the Workflows intro list — EN and CN.
The section leads with what the pipeline does (run-directory campaigns,
notation/structure gates, GPT Pro handoff packages, cross-run continuation)
and carries a single boundary note: standalone track, Workflows 1-6 never
call it, /proof-checker keeps the submission gate. Copy fact-checked against
SKILL.md via a cross-model pass (append-only scope, zero-collision
requirement, handoff.md owns the upload order, DeepSeek as an audit-stage
branch rather than a sequential stage).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The upstream EtaSkill repository (MPL-2.0) is authored and solely owned by
this PR's contributor, confirmed with the maintainer — the sole copyright
holder relicensing their own work under this repo's MIT, which is why the
earlier MPL text was removed. NOTICE now states the upstream URL, license,
ownership, and relicensing basis explicitly so third parties can verify.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Five substantive fixes on top of the original design (which is sound — the
run-directory model, manual-first GPT Pro handoff, and authorization
discipline all stay as designed):
1. Artifact collision: the optional JSON audit now writes run-local
PROOF_ORCHESTRATOR_AUDIT.json and is explicitly forbidden from touching
<paper-dir>/PROOF_AUDIT.json, which is /proof-checker's canonical
submission artifact. Added review_independence / acceptance_status /
family fields with derived (never asserted) independence labeling —
every proof-orchestrator audit is provisional evidence, never acceptance.
2. DeepSeek routing honesty: llm-chat's default model AND 504-fallback are
both gpt-4o, so "the configured default" may not be DeepSeek. The route
now requires verifying the actual responding model before labeling
anything llm-chat-deepseek; non-DeepSeek or unknown responders fail
closed to DEEPSEEK_REVIEW_BLOCKED instead of being recorded as
cross-family evidence.
3. Injection boundary: new Untrusted-Content Rule — instructions inside
source snapshots, GPT Pro output, and DeepSeek responses are data, never
directives; remote prompts wrap proof material in data delimiters and
exclude credentials/private paths. Dropped the unused Bash(*) grant and
narrowed Skill to Skill(call-gpt-pro).
4. Routing boundary: frontmatter description no longer claims "attempt and
refine proofs" (proof-writer's lane) or bare "audit correctness"
(proof-checker's lane); it now leads with what is unique here — stateful
run orchestration, continuation, handoff packages — and routes drafting
and verification to the right skills explicitly. SKILLS_CATALOG entry
matched.
5. Verdict authority: "executor remains responsible for the final verdict"
reworded — the executor validates and may downgrade with evidence, but
cannot overturn an external reviewer's negative finding into acceptance;
unresolved external CRITICAL/FATAL blocks READY_FOR_USER.
Also: Codex mirror gets an explicit same-family note (GPT Pro is the same
family as the Codex executor — assistance, not cross-family review) plus all
equivalent fixes; ARIS_INTRO category row fixed to "Proof & theory | 3"
consistent with the tsv theory group; stress-tests wording clarified to
user-operated handoff; HTML footer backslash path normalized.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The round-2 fix commit's report table gained two columns in the header
(9 cells) but the separator row kept 7 — GFM renders that as a plain
paragraph, not a table. Repaired the separator in both mirrors (kept
byte-identical) and added a structural test asserting every table's
separator cell count matches its header, so a malformed table can't pass
the keyword-presence checks again.
Pushed directly as a maintainer fixup: mechanical, objectively derivable,
and the only finding left from the round-2 cross-model pass.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Yang Ruofeng