docs(readme,security,contributing): meet the repo standard — 0 ERROR

The per-repo gate flagged four ERRORs and two WARNs. Fixed, in the order the
work actually gets done in:

MISSING
- `## Honest limitations` -> `## Known limitations`, `## Out-of-scope
  (documented boundary)` -> `## Non-goals`. Both sections existed under names
  no reader or agent scans for; the contract wants predictable top-level
  headings. Pointers followed: the in-README anchor, SECURITY.md's out-of-scope
  preamble, CONTRIBUTING.md's scope section, and the consumer-facing
  docs/ADOPTION-BRIEF.md. Historical records (CHANGELOG, docs/PLAN.md,
  docs/OKF-INGESTION-BRIEF.md) keep the name they were written with.

WEAKENING
- README now opens with one line identical to the forge description, above the
  badges. That is the only place a machine can check description == README.
- Forge description shortened 207 -> 178 codepoints (bound 180), and the same
  string written to pyproject's `description` so the fourth copy cannot drift.

The tests badge is dropped, not updated. `tests-699_passing` as a static image
is a claim dressed as evidence: there is no CI runner on this forge, so nothing
verifies it. Replaced with the honest substitute in Install — the single command
that runs the suite from a clean clone, stated together with the fact that
nothing runs it automatically.

Two WARNs deliberately left standing:
- H1 `# llm-ingestion-guard` != repo name. The register itself records
  llm-ingestion-guard as "a package, not a repo"; the H1 names what you pip
  install. Renaming the repo is the operator's call, not this commit's.
- The `Status` badge trips the same claim-badge regex, but `alpha` asserts
  maturity, not a run — the same reason version/license/platform are exempt.
  Measured false positive in the gate's classifier, reported upstream.

CONTRIBUTING.md

@@ -59,7 +59,7 @@ The suite is the release gate: a change is not done until the whole suite is gre
 ## Scope and honest limits
 
 New detection is welcome, but the project ships its **limitations** as a control (see
-`README.md` → *Honest limitations*). If a change narrows a stated gap, update that
+`README.md` → *Known limitations*). If a change narrows a stated gap, update that
 section. If it introduces a new deliberate boundary, document it there rather than
 leaving a silent miss. Absolute claims ("catches all …", "cannot be bypassed") do not
 belong in this codebase.

README.md

@@ -1,9 +1,10 @@
 # llm-ingestion-guard
 
+Write-time defensive layer for Python pipelines that persist LLM output: sanitize, fence, tool-less quarantined transform, capability isolation, scan before persist, fail-secure.
+
 ![Version](https://img.shields.io/badge/version-0.3.4-blue)
 ![Status](https://img.shields.io/badge/status-alpha-orange)
 ![Python](https://img.shields.io/badge/python-3.10%2B-purple)
-![Tests](https://img.shields.io/badge/tests-699_passing-green)
 ![License](https://img.shields.io/badge/license-MIT-lightgrey)
 
 **Write-time ingestion is the trust boundary that query-time guardrails
@@ -53,6 +54,14 @@ are not required — the core is deterministic and dependency-free.
 **Tags are the stable contract.** Every release is version-synced before tagging,
 and published tags are never moved.
 
+**Verify it yourself — nothing runs the suite automatically.** There is no CI
+runner on the forge, so the test count is not something a badge can honestly
+assert. From a clean clone:
+
+```bash
+pip install -e ".[dev]" && pytest        # the whole suite
+```
+
 Two consequences worth knowing before you depend on this:
 
 - A git URL is a PEP 508 *direct reference*: it pins one exact tag, not a range
@@ -173,7 +182,7 @@ source of truth for
 total recall over every class, that every documented gap still holds (a closed gap
 fails the test), and that every lexicon pattern has a case — so the matrix cannot
 fall behind the code. The four classes it deliberately does **not** stop are called
-out in [Honest limitations](#honest-limitations).
+out in [Known limitations](#known-limitations).
 
 ## The reusable contract (adopt-this checklist)
 
@@ -201,7 +210,7 @@ The actual product is this checklist, encoded as code you wire in order:
 Steps 1-2 are `prepare_input`; steps 6-7 are `screen_output`; steps 3-5 are
 yours; the contract asserters harden step 3-4.
 
-## Honest limitations
+## Known limitations
 
 Conceding these plainly is itself a control — it prevents the false assurance that
 a green scan means safe content. The highest-impact items:
@@ -230,7 +239,7 @@ a green scan means safe content. The highest-impact items:
 [`docs/LIMITATIONS.md`](docs/LIMITATIONS.md). Several carry field measurements from
 consumer corpora, including the false positives the URL-shape rule actually produces.
 
-## Out-of-scope (documented boundary)
+## Non-goals
 
 Embedding/vector-layer defenses (OWASP LLM08, downstream of persist); multimodal
 steganography; query-time / runtime guardrails; semantic factuality verification.

SECURITY.md

@@ -43,7 +43,7 @@ In scope (a real finding):
   closed;
 - a ReDoS or unbounded-resource input against the scanner.
 
-Out of scope (documented boundaries — see the **Honest limitations** section of
+Out of scope (documented boundaries — see the **Known limitations** section of
 `README.md`, not vulnerabilities):
 
 - semantic / factual poisoning invisible to lexicon + entropy;

docs/ADOPTION-BRIEF.md

@@ -5,7 +5,7 @@ especially one converging on Google's Open Knowledge Format (OKF v0.1) — and n
 to decide **when** and **where** to add a write-time ingestion guard.
 
 **Status of the guard:** `v0.2` (alpha). Stdlib-only core, framework-agnostic.
-Public API may still change. Read the honest-limitations section before you rely
+Public API may still change. Read the known-limitations section before you rely
 on it.
 
 This brief is self-contained: you can plan an inclusion from it alone. Every
@@ -194,10 +194,10 @@ untrusted ingest path goes live*, wired at the point where enriched content is
 committed. If today you only have first-party ingest, note the guard as a
 dependency to add when (not if) you open an external/inbox/received-bundle path.
 
-## 8. Honest limitations (read these — a green scan is not "safe")
+## 8. Known limitations (read these — a green scan is not "safe")
 
 Conceding these is itself a control. The full list is in the guard's `README.md`
-("Honest limitations"); the ones that matter most for a wiki/second-brain:
+("Known limitations"); the ones that matter most for a wiki/second-brain:
 
 - **Semantic / factual poisoning is invisible** to lexicon + entropy: a
   plausible-but-wrong concept (wrong join-path, wrong metric, wrong runbook step)
@@ -225,7 +225,7 @@ Conceding these is itself a control. The full list is in the guard's `README.md`
 
 ## 9. Where to read more (in the guard repo)
 
-- `README.md` — usage, the full contract, and the complete honest-limitations list.
+- `README.md` — usage, the full contract, and the complete known-limitations list.
 - `docs/BRIEF.md` — design rationale and the nearest-neighbour survey (§11).
 - `docs/OKF-INGESTION-BRIEF.md` — the OKF threat-surface analysis (frontmatter,
   `resource`, cross-link graph, reserved names, provenance) the adapter implements.

pyproject.toml

@@ -5,7 +5,7 @@ build-backend = "hatchling.build"
 [project]
 name = "llm-ingestion-guard"
 version = "0.3.4"
-description = "A minimal, dependency-light defensive layer for LLM ingestion pipelines — the write-time siblings of query-time chatbot guardrails."
+description = "Write-time defensive layer for Python pipelines that persist LLM output: sanitize, fence, tool-less quarantined transform, capability isolation, scan before persist, fail-secure."
 readme = "README.md"
 requires-python = ">=3.10"
 license = { file = "LICENSE" }