Gap 1 closed. The output gate finds runs of 32+ hex digits
(calibration.HEX_WRAP_MIN_LEN), decodes both byte alignments, keeps text
that is at least 80% printable (the base64 bar, now one shared helper in
entropy) and runs the credential patterns on it. A hex-wrapped AWS key
surfaces as decoded:egress:aws-access-key-id with "in hex run @ N" as
evidence; the value is never in it. Credentials only: a hex-wrapped
injection is not decoded.
Measured before and after on the same trees: all 3583 clean documents
(three FP populations and the 78 pinned OKF concepts) are identical line
for line under both presets (disposition, labels, severity, count,
offset); OKF import stays 47/31. They and 569 READMEs hold 2403 hex runs
of 32+ digits, none of which decodes to text. scan_output CPU 122.9 s
before, 123.4 s after; one solid hex run at the 1M cap 4.2 s -> 5.8 s.
14 new tests (10 red for the right reason first), 6 of 6 mutations red.
Matrix 146/146 + 5/5 gaps, suite 1274 passed, ReDoS sweep 169 patterns.
Gap 4 (count=1) is closed. scan_lexicon still gives one finding per
pattern id at the first offset, and its count is now the number of
matches: the most matches any one view of the text shows (raw, decoded,
folded, rot13). Views are not summed, so count is a lower bound; the
joiner row counts only the splits it reports. The matrix case moved from
gap to caught (lexicon:count), and the gap register records it closed.
Measured before and after on the same trees: the FP populations are
identical line for line at 106/198, 196/2918, 108/389; all 3583 documents
(with the 78 pinned OKF concepts) keep their disposition under both
presets and the same labels and severities; OKF import stays 47/31.
53 documents now carry count > 1 (23 + 23 + 7 + 0), as measured before
building. scan_lexicon over 3505 documents: 96.0 s before, 97.1 s after.
Mutating count back to 1 turns 5 tests red.
docs/LIMITATIONS.md: gaps 2, 3, 5 and 7 now state the rule tried and its
cost (session 1 numbers): 2 fires on the true twin, 3 costs 48 on the
trusted gate, 5 costs 23 of 569 READMEs, 7 catches 2 of 5 rewordings.
Matrix 145/145 + 6/6 gaps, suite 1260 passed.
Row 1: 12 of 16 register entries answer through an existing probe class of
the reused edition watch (positive control 4 of 4); unicode and rfc-3986 need
a host on its list, the commons repository is private, and the Dual LLM post
has no edition.
Row 2: the seven documented gaps are frozen in gaps-frozen.tsv and held by
tests/test_gap_register.py. docs/gap-sweep.py measures the cheapest rule per
gap on the three false-positive corpora and the pinned OKF corpus before
anything is built: gaps 4, 1 and 6 are closable without new alarms; 2, 3, 5
and 7 get measured reasons.
