docs(trekresearch): split the Independence crossing's two risks and name the right control for each

The Phase 4.5 amendment to the Independence hard rule crosses that rule
deliberately, and the crossing is defensible: bounded to Phase 4.5 and the
Phase 5 loop, the initial swarm stays blind, and it resolves a tension the
brief created itself by asking for exactly this mining of Phase-4 output.

The defect was the compensating-control claim. query-privacy-gate.mjs was
named as THE control for the crossing, but it inspects outbound query
CONTENT for paths, repo identifiers and secret-shaped strings. It cannot
prevent a local finding from steering an external agent's question. It
compensates the EGRESS risk; the BIAS risk was left with no control while
the text read as though it had one.

Both risks are now stated separately with the control that actually bears on
each:

  Bias   - structural, not a gate. The initial external swarm stays blind, so
           an independent baseline exists BEFORE anything crosses; the
           crossing only ADDS to that baseline; and at effort: high - the only
           effort at which any of this runs - contrarian-researcher is forced
           always-on, so the brief always carries an adversarial
           counter-evidence pass over the result the crossed queries fed.
  Egress - query-privacy-gate.mjs, unchanged, with its non-overridable
           hard-block tier.

Fixed at both sites: the Hard rules entry and the Phase 4.5 paragraph that
repeated the same attribution.

A doc-consistency pin now fails if the amendment names the privacy gate as
the compensating control again, and requires it to name both
contrarian-researcher and the egress framing - so the two cannot quietly
re-merge.

Review finding 4888ae847240142933469d70bafb6a9c23b7b2eb (MINOR).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LuGhWAbWyRFBFeemfhxoVv

commands/trekresearch.md

@@ -449,8 +449,12 @@ agent surfaced that no interview dimension claims.
 
 Every outbound query generated from a discovered dimension passes
 `query-privacy-gate.mjs` before it leaves the machine — see the per-turn
-protocol in Phase 5. That gate is the compensating control for the
-Independence crossing this phase makes (see Hard rules → Independence).
+protocol in Phase 5. That gate controls the **egress** risk this phase's
+Independence crossing creates: local paths and identifiers travelling inside a
+query. It does **not** control the **bias** risk — it inspects query content and
+cannot stop a local finding from steering an external agent's question. The bias
+controls are structural (blind initial swarm, append-only crossing, unconditional
+`contrarian-researcher` at `effort: high`); see Hard rules → Independence.
 
 ## Phase 5 — Targeted follow-ups
 
@@ -895,13 +899,29 @@ Low effort: inline research only, no agent swarm (existing
   **Amended (v5.10) for Phase 4.5:** dimension discovery deliberately crosses this
   rule. Its candidate dimensions are mined from the Phase-4 result set, which
   contains output from the five local codebase agents, so a discovered dimension
-  can carry local context into an external query. The crossing is bounded to
-  Phase 4.5 and the Phase 5 loop it feeds, it never applies to the initial
-  external swarm (which stays blind to local findings), and the compensating
-  control is `query-privacy-gate.mjs`: every outbound query is inspected before
-  it leaves the machine, with a hard-block tier for secret-shaped strings that no
-  operator flag can override. Triangulation still happens AFTER independent
-  research.
+  can carry local context into an external query.
+
+  The crossing creates **two distinct risks**, and they do not share a control:
+
+  - **Bias** — a local finding shapes what an external agent is asked. Its
+    controls are structural, not a gate: the initial external swarm stays blind
+    to local findings, so an **independent baseline already exists** before
+    anything crosses; the crossing is confined to Phase 4.5 and the Phase 5 loop
+    it feeds, which only ADD to that baseline and never revise it; and at
+    `effort: high` — the only effort at which any of this runs —
+    `contrarian-researcher` is forced always-on, so the brief always carries an
+    adversarial counter-evidence pass over the result the crossed queries fed.
+    Triangulation still happens AFTER independent research.
+  - **Egress** — local paths, repo identifiers or secret-shaped strings leave the
+    machine inside a query. That is what `query-privacy-gate.mjs` controls: every
+    outbound query is inspected before it leaves, with a hard-block tier for
+    secret-shaped strings that no operator flag can override.
+
+  The privacy gate was previously named as the compensating control for the
+  crossing as a whole. It is not: it inspects query CONTENT and cannot stop a
+  local finding from steering an external agent's question. Attributing the bias
+  risk to it left that risk with no control while the text read as though it had
+  one.
 - **Graceful degradation:** If MCP tools are unavailable (Tavily, Gemini, MS Learn),
   proceed with available tools and note limitations in brief metadata.
 - **Cost:** Model resolution at Agent-spawn sites is a three-layer fallback: