diff --git a/.gitbot-fleet/report-backs/README.md b/.gitbot-fleet/report-backs/README.md
index 4647d911..303a9e06 100644
--- a/.gitbot-fleet/report-backs/README.md
+++ b/.gitbot-fleet/report-backs/README.md
@@ -6,7 +6,8 @@ without `.json` (for example, `rhodibot.json` becomes `rhodibot`). This identity
 should match the key in `.gitbot-fleet/enrolment.json` (`rhodibot`, `seambot`, ...).
 
 The Hypatia verdict grid reads this directory
-(`.github/workflows/hypatia-scan-reusable.yml` passes it to
+(the standards Hypatia lane, `metadatastician/standards`
+`.github/workflows/hypatia-scan-reusable.yml`, passes it to
 `scripts/verdict-grid.sh --report-backs`), so a report-back here is the only
 way a member's row stops being orange. The envelope is the one in
 `docs/VERDICT-GRID-SPEC.adoc` of
diff --git a/.github/workflows/hypatia-scan-reusable.yml b/.github/workflows/hypatia-scan-reusable.yml
deleted file mode 100644
index ef1645c6..00000000
--- a/.github/workflows/hypatia-scan-reusable.yml
+++ /dev/null
@@ -1,906 +0,0 @@
-# SPDX-License-Identifier: MPL-2.0
-# De-onboarded from actions.lock. This repository keeps no actions.lock, and
-# every action and reusable reference in this file is a literal full commit SHA,
-# so there is nothing a lock would pin. The upstream copy's header claiming lock
-# management is removed rather than the lock invented: an onboarded caller of a
-# cross-repository reusable is the shape that startup-fails with zero jobs.
-#
-# Fork-local copy of metadatastician/standards/.github/workflows/
-# hypatia-scan-reusable.yml at 01c9b0c9f2646ebea0b30a9588462642ac94aee9.
-# Keep that source pin when updating this file and reapply the four fork deltas:
-#   1. Do not upload SARIF for pull_request events. This lane is advisory on
-#      PRs; uploading error-level results creates a separate, blocking
-#      "Code scanning results / Hypatia" check even when the scan job passes.
-#      Raw findings and the verdict grid still cover the PR, while push and
-#      manual runs continue to reconcile code scanning on the default branch.
-#   2. Pin the standards checkout explicitly. job.workflow_sha now names a
-#      MetaManifold commit, not a commit in metadatastician/standards.
-#   3. Filter only upstream-inherited TypeScript paths from the effective
-#      findings, validate the raw/effective JSON with pinned ijson-jcs, and keep
-#      raw scanner outputs plus fork-only paths/rules.
-#   4. Download the gitbot-fleet report-backs (artifact `fleet-report-backs`,
-#      produced by the `fleet` job of hypatia-scan.yml) into
-#      .gitbot-fleet/report-backs/ before the verdict grid renders, so each
-#      enrolled member's row carries evidence instead of "enrolled, but no
-#      report-back was received". Upstream standards added the same step and
-#      input after 01c9b0c9; this copy carries them ahead of its source pin.
-# scripts/check-governance-contract.sh guards these deltas.
-#
-# Hypatia Neurosymbolic CI/CD Security Scan — Reusable Workflow
-name: Hypatia Reusable Scan
-
-on:
-  workflow_call:
-    inputs:
-      block-on-high:
-        description: Refuse current high or critical findings after validated baseline filtering; no baseline is required
-        type: boolean
-        required: false
-        default: false
-      report-backs-artifact:
-        description: >-
-          Name of an artifact, uploaded earlier in the same run, holding the
-          gitbot-fleet report-back envelopes (one <member>.json each). Downloaded
-          into .gitbot-fleet/report-backs/ before the verdict grid renders; a
-          missing artifact is tolerated and leaves the enrolled rows orange. Set
-          to an empty string to skip the download.
-        type: string
-        required: false
-        default: "fleet-report-backs"
-      hypatia-ref:
-        description: >-
-          Hypatia commit to build the scanner from. Defaults to a vetted SHA so a
-          bad hypatia main cannot turn every caller red at once (09-12..14 and
-          09-26..30 outages). Canary callers pass "HEAD" to trial the tip before
-          the default is moved here.
-        type: string
-        required: false
-        default: aa34a4cc6ba39d873710ff39763fdb9cde715f9d
-    secrets:
-      HYPATIA_SCAN_PAT:
-        description: >-
-          Fine-grained read-only PAT used to read Dependabot, code-scanning
-          and secret-scanning alerts; the scan falls back to the built-in
-          GITHUB_TOKEN when it is not supplied. Declared explicitly so
-          callers pass ONLY this secret instead of `secrets: inherit`,
-          which forwarded every caller secret (standards#1108 §6b).
-        required: false
-    outputs:
-      verdict:
-        description: >-
-          Overall state of the lane's verdict grid (docs/VERDICT-GRID-SPEC.adoc):
-          purple, red, orange, yellow, blue, green or grey. Callers that comment
-          on or gate from the grid read this and the verdict-grid artifact.
-        value: ${{ jobs.scan.outputs.verdict }}
-
-permissions:
-  actions: read
-  contents: read
-  security-events: write
-
-jobs:
-  scan:
-    name: Hypatia Neurosymbolic Analysis
-    runs-on: ubuntu-latest
-    # 30 + 10 + 5: the panic-attack build is capped at 10 minutes and its scan
-    # at 5, so a slow build or a hung scan records "not_run" or "error" instead
-    # of timing out, and so failing, the whole job.
-    timeout-minutes: 45
-    outputs:
-      verdict: ${{ steps.grid.outputs.state }}
-    env:
-      # panic-attack v2.5.5, built from source at this commit (cargo --rev
-      # checks out exactly this object; --locked holds every dependency to the
-      # Cargo.lock checksums). There is no release binary to pin instead.
-      # b689a74 (2026-10-08) includes upstream 3f7d0bb, which reports
-      # UnboundedAllocation as Medium, not Critical (standards#1306).
-      PANIC_ATTACK_SHA: b689a74d2762a1c19839ae3fbd59b7fe5ef920ea
-      # pons asinorum, built from source at this commit the same way. Its
-      # `scan --format json` envelope carries each finding's tier and
-      # evidence class, so a heuristic is never read as a proof.
-      PONS_SHA: 32e55677d8fd1f3010848dee22e822c2f385c2a0
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Read the pinned ijson-jcs identity
-        id: ijson_jcs_pin
-        run: |
-          python3 - <<'PY'
-          import os, re, tomllib
-          with open('config/format-tools.toml', 'rb') as stream:
-              pin = tomllib.load(stream)['ijson_jcs']
-          if pin['repository'] != 'https://github.com/hyperpolymath/ijson-jcs':
-              raise SystemExit('unexpected ijson-jcs repository')
-          if not re.fullmatch(r'[0-9a-f]{40}', pin['revision']):
-              raise SystemExit('ijson-jcs must be pinned to an immutable commit')
-          if not re.fullmatch(r'[0-9]+\.[0-9]+\.[0-9]+', pin['rust_toolchain']):
-              raise SystemExit('ijson-jcs Rust toolchain must be an explicit release')
-          with open(os.environ['GITHUB_OUTPUT'], 'a') as stream:
-              stream.write(f"repository={pin['repository']}\n")
-              stream.write(f"revision={pin['revision']}\n")
-              stream.write(f"rust_toolchain={pin['rust_toolchain']}\n")
-          PY
-
-      - name: Cache the pinned ijson-jcs binary
-        id: ijson_jcs_cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ~/.cargo/bin/ijson-jcs
-          key: ijson-jcs-${{ steps.ijson_jcs_pin.outputs.revision }}-${{ steps.ijson_jcs_pin.outputs.rust_toolchain }}-${{ runner.os }}-${{ runner.arch }}
-
-      - name: Install pinned ijson-jcs
-        if: steps.ijson_jcs_cache.outputs.cache-hit != 'true'
-        env:
-          IJSON_JCS_REPOSITORY: ${{ steps.ijson_jcs_pin.outputs.repository }}
-          IJSON_JCS_REVISION: ${{ steps.ijson_jcs_pin.outputs.revision }}
-          IJSON_JCS_RUST_TOOLCHAIN: ${{ steps.ijson_jcs_pin.outputs.rust_toolchain }}
-        run: |
-          set -euo pipefail
-          rustup toolchain install "$IJSON_JCS_RUST_TOOLCHAIN" --profile minimal
-          cargo "+$IJSON_JCS_RUST_TOOLCHAIN" install --quiet \
-            --git "$IJSON_JCS_REPOSITORY" --rev "$IJSON_JCS_REVISION" \
-            --locked --root "$HOME/.cargo" ijson-jcs
-
-      - name: Verify ijson-jcs and test the exception output
-        run: |
-          set -euo pipefail
-          IJSON_JCS="$HOME/.cargo/bin/ijson-jcs"
-          test -x "$IJSON_JCS"
-          "$IJSON_JCS" --version
-          printf '%s' '{"b":2,"a":1}' | "$IJSON_JCS" canon > "$RUNNER_TEMP/ijson-jcs-smoke.json"
-          printf '%s' '{"a":1,"b":2}' | cmp - "$RUNNER_TEMP/ijson-jcs-smoke.json"
-          "$IJSON_JCS" check "$RUNNER_TEMP/ijson-jcs-smoke.json" >/dev/null
-          IJSON_JCS="$IJSON_JCS" bash scripts/tests/test-hypatia-inherited-language-exception.sh
-
-      - name: Setup Elixir for Hypatia scanner
-        uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1
-        with:
-          elixir-version: '1.19.4'
-          otp-version: '28.3'
-
-      - name: Resolve Hypatia scanner commit
-        id: hypatia-rev
-        env:
-          HYPATIA_REF: ${{ inputs.hypatia-ref }}
-        run: |
-          # The scanner is PINNED (input hypatia-ref, default a vetted SHA). Only
-          # an explicit "HEAD" floats, for canary callers. Resolved before the
-          # cache step because the cache key must hash the commit.
-          if [ "$HYPATIA_REF" = "HEAD" ]; then
-            sha=$(git ls-remote https://github.com/hyperpolymath/hypatia.git HEAD | cut -f1)
-          else
-            sha="$HYPATIA_REF"
-          fi
-          if [[ ! "$sha" =~ ^[0-9a-f]{40}$ ]]; then
-            echo "ERROR: hypatia-ref must be a 40-hex commit SHA or HEAD (got: $HYPATIA_REF)" >&2
-            exit 1
-          fi
-          echo "sha=$sha" >> "$GITHUB_OUTPUT"
-          echo "Resolved hypatia HEAD: $sha"
-
-      - name: Cache Hex/Mix and Scanner Build
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.mix
-            ~/.hex
-            ~/hypatia
-          # Source-pinned key: when Hypatia main advances, the SHA changes, the
-          # cache misses, and the clone + escript build below re-run instead of
-          # restoring a stale binary. The old keyless `...-build` key meant the
-          # first scanner ever cached was reused forever, so scanner fixes (e.g.
-          # SD022, hypatia#545) never reached CI. No restore-keys on purpose —
-          # a partial restore would repopulate ~/hypatia and the guards below
-          # would then skip the rebuild, reintroducing the staleness.
-          key: hypatia-scanner-v4-${{ runner.os }}-${{ steps.hypatia-rev.outputs.sha }}
-
-      - name: Check out resolved Hypatia commit
-        env:
-          HYPATIA_SHA: ${{ steps.hypatia-rev.outputs.sha }}
-        run: |
-          set -euo pipefail
-          if [ ! -d "$HOME/hypatia" ]; then
-            git init "$HOME/hypatia"
-            git -C "$HOME/hypatia" remote add origin https://github.com/hyperpolymath/hypatia.git
-            git -C "$HOME/hypatia" fetch --depth 1 origin "$HYPATIA_SHA"
-            git -C "$HOME/hypatia" checkout --detach FETCH_HEAD
-          fi
-          # A cache is usable only when its source matches the key, including
-          # on cache hits. v4 invalidates caches populated by the moving clone.
-          ACTUAL_SHA=$(git -C "$HOME/hypatia" rev-parse HEAD)
-          if [ "$ACTUAL_SHA" != "$HYPATIA_SHA" ]; then
-            echo "::error::Hypatia cached source does not match the resolved commit"
-            exit 1
-          fi
-
-      - name: Build Hypatia scanner
-        run: |
-          cd "$HOME/hypatia"
-          if [ ! -x hypatia ]; then
-            if ! (mix deps.get && mix escript.build); then
-              echo "::error::Hypatia scanner build failed at commit $(git rev-parse HEAD) — see upstream hyperpolymath/hypatia"
-              exit 1
-            fi
-          fi
-          if [ ! -x hypatia ]; then
-            echo "::error::Hypatia scanner binary is missing after build"
-            exit 1
-          fi
-
-      - name: Run Hypatia scan
-        env:
-          # The scanner reads a single env var, GITHUB_TOKEN, to pull Dependabot,
-          # code-scanning and secret-scanning alerts (lib/rules/{dependabot,
-          # code_scanning,secret_scanning}_alerts.ex). Without it those three
-          # checks are skipped with "GITHUB_TOKEN not set" warnings.
-          #
-          # Prefer a fine-grained, read-only PAT (HYPATIA_SCAN_PAT, passed by
-          # the caller as this reusable's one declared secret): the built-in
-          # Actions token CANNOT read Dependabot alerts (no `dependabot`
-          # permission exists for it). Fall back to the built-in token so
-          # code-scanning still works in repos where the PAT isn't present yet.
-          GITHUB_TOKEN: ${{ secrets.HYPATIA_SCAN_PAT || secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          echo "Scanning repository: ${GITHUB_REPOSITORY:-}"
-          # --exit-zero: hypatia-cli exits 1 when findings exist; under the default
-          # `bash -eo pipefail` that aborts this step before the counts/outputs/summary
-          # run AND skips the upload, so the gate fails opaquely. Gate on the severity
-          # counts below, not on the scanner's exit code.
-          HYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . --exit-zero > hypatia-findings.json
-
-          # Emit SARIF for the GitHub Security tab. The code_scanning_alerts
-          # meta-rules are filtered at SARIF render time (lib/hypatia/sarif.ex),
-          # so an upload can never self-echo. Same tool name ("Hypatia") and
-          # category ("hypatia") as the historical upload, so GitHub RECONCILES:
-          # findings fixed in code since the last scan auto-close instead of
-          # orphaning as stale open alerts.
-          HYPATIA_FORMAT=sarif "$HOME/hypatia/hypatia-cli.sh" scan . --exit-zero > hypatia.sarif
-          if [ ! -s hypatia.sarif ]; then
-            echo "::error::Hypatia did not produce hypatia.sarif"
-            exit 2
-          fi
-
-      - name: Validate findings and count severities
-        id: scan
-        run: |
-          set -euo pipefail
-          # Exactly one JSON array of findings, each with a recognised severity.
-          # Missing/truncated/multi-document output is a scanner error and fails
-          # closed; a single well-formed `[]` is a valid clean scan when the
-          # scanner step succeeded (standards#1054).
-          if [ ! -s hypatia-findings.json ]; then
-            echo "::error::Hypatia did not produce hypatia-findings.json"
-            exit 2
-          fi
-          # Validate original bytes as I-JSON before jq can parse or normalize
-          # them. The raw scanner artifact itself remains untouched.
-          "$HOME/.cargo/bin/ijson-jcs" canon < hypatia-findings.json > /dev/null
-          if ! jq -e -s '
-            length == 1 and (.[0] | type == "array" and all(.[];
-              type == "object" and (.severity as $s |
-                ["critical", "high", "medium", "warn", "low", "info", "informational"] | index($s) != null)))
-          ' hypatia-findings.json >/dev/null; then
-            echo "::error::Hypatia did not produce one valid findings array"
-            exit 2
-          fi
-
-          FINDING_COUNT=$(jq '. | length' hypatia-findings.json)
-          CRITICAL=$(jq '[.[] | select(.severity == "critical")] | length' hypatia-findings.json)
-          HIGH=$(jq '[.[] | select(.severity == "high")] | length' hypatia-findings.json)
-          # Hypatia's research rules use "warn" at the same rank as "medium".
-          MEDIUM=$(jq '[.[] | select(.severity == "medium" or .severity == "warn")] | length' hypatia-findings.json)
-
-          {
-            echo "findings_count=$FINDING_COUNT"
-            echo "critical=$CRITICAL"
-            echo "high=$HIGH"
-            echo "medium=$MEDIUM"
-          } >> "$GITHUB_OUTPUT"
-
-          {
-            echo "## Raw Hypatia Scan Results (before fork exception)"
-            echo ""
-            echo "| Severity | Count |"
-            echo "|----------|-------|"
-            echo "| Critical | $CRITICAL |"
-            echo "| High     | $HIGH |"
-            echo "| Medium   | $MEDIUM |"
-            echo "| **Total**| $FINDING_COUNT |"
-            echo ""
-            echo "These are the unmodified scanner counts. The fork-local upstream TypeScript exception and the effective counts used by the verdict grid and gates are reported below."
-          } >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Relativize finding paths
-        run: |
-          # Hoisted out of the gate step so the SARIF filter and the gate share
-          # ONE definition of a finding's path. code_safety / honest_completion
-          # emit ABSOLUTE host paths in .file (Path.expand(repo)) while the
-          # baseline uses repo-relative paths; without this they never match
-          # (hypatia#566 stopgap).
-          if [ -f hypatia-findings.json ]; then
-            jq --arg root "$PWD" '
-              map(if (.file? // "") == $root then .file = "."
-                  elif (.file? // "") | startswith($root + "/")
-                  then .file = (.file | ltrimstr($root + "/"))
-                  else . end)
-            ' hypatia-findings.json > hypatia-findings.relativized.json
-          fi
-
-      - name: Apply upstream-inherited TypeScript exception
-        id: inherited-language
-        if: ${{ always() }}
-        run: |
-          set -euo pipefail
-          # The raw scanner outputs stay intact for audit. This fork-local
-          # exception changes only the effective JSON/SARIF projections used by
-          # the verdict grid, severity advisory, baseline gate, and code scanning.
-          if [ ! -s hypatia-findings.relativized.json ] || [ ! -s hypatia.sarif ]; then
-            echo "::notice::Raw Hypatia output is unavailable; no inherited-TypeScript exception was applied."
-            exit 0
-          fi
-          allowlist=config/hypatia/upstream-typescript-allowlist.txt
-          bash scripts/filter-hypatia-inherited-language.sh \
-            hypatia-findings.relativized.json hypatia.sarif "$allowlist" \
-            hypatia-findings.effective.json hypatia-effective.sarif \
-            "$HOME/.cargo/bin/ijson-jcs"
-
-          RAW_COUNT=$(jq 'length' hypatia-findings.relativized.json)
-          EFFECTIVE_COUNT=$(jq 'length' hypatia-findings.effective.json)
-          EXCLUDED_COUNT=$((RAW_COUNT - EFFECTIVE_COUNT))
-          CRITICAL=$(jq '[.[] | select(.severity == "critical")] | length' hypatia-findings.effective.json)
-          HIGH=$(jq '[.[] | select(.severity == "high")] | length' hypatia-findings.effective.json)
-          MEDIUM=$(jq '[.[] | select(.severity == "medium" or .severity == "warn")] | length' hypatia-findings.effective.json)
-          {
-            echo "raw_findings_count=$RAW_COUNT"
-            echo "excluded_count=$EXCLUDED_COUNT"
-            echo "findings_count=$EFFECTIVE_COUNT"
-            echo "critical=$CRITICAL"
-            echo "high=$HIGH"
-            echo "medium=$MEDIUM"
-          } >> "$GITHUB_OUTPUT"
-          UPSTREAM_SOURCE=$(sed -n 's/^# Source: //p' "$allowlist")
-          {
-            echo "## Fork-local upstream TypeScript exception"
-            echo ""
-            echo "Source snapshot: $UPSTREAM_SOURCE. Only cicd_rules/banned_language_file findings for exact .ts/.tsx paths in $allowlist are exempted."
-            echo ""
-            echo "- Raw findings retained: $RAW_COUNT"
-            echo "- Inherited TypeScript findings excluded from effective results: $EXCLUDED_COUNT"
-            echo "- Findings sent to the verdict grid and gates: $EFFECTIVE_COUNT ($CRITICAL critical, $HIGH high, $MEDIUM medium/warn)"
-            echo "- Fork-only TypeScript paths and all other rules remain reportable."
-            echo "- Raw JSON remains unchanged in hypatia-findings.json; hypatia-findings.effective.json is I-JSON validated and JCS canonicalized with the repo-pinned tool."
-          } >> "$GITHUB_STEP_SUMMARY"
-
-      # panic-attack is ADVISORY: it never fails this job, because this
-      # reusable is called estate-wide and the owner has not made it a gate.
-      # It is never silent either. Until 2026-10 nothing installed it, so the
-      # old step wrote a bare `[]` that read exactly like a clean scan (the CRG
-      # "panic-attack assail passes" evidence). It runs before the standards
-      # checkout below so that it scans the caller's tree, not
-      # .standards-checkout/scripts.
-      - name: Restore panic-attack build cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ~/.panic-attack
-          key: panic-attack-v1-${{ runner.os }}-${{ runner.arch }}-${{ env.PANIC_ATTACK_SHA }}
-
-      - name: Install panic-attack (pinned source build)
-        id: panic-attack-install
-        run: |
-          set -euo pipefail
-          # Every failure path sets `reason` and exits 0; the next step turns
-          # that into status "not_run" in panic-attack-findings.json.
-          root="$HOME/.panic-attack"
-          bin="$root/bin/panic-attack"
-          reason=""
-          # cargo records the installed source in .crates.toml as
-          # "...?rev=<sha>#<sha>". Use a restored binary only when it names the
-          # pinned commit; otherwise rebuild.
-          if [ -x "$bin" ] && grep -qF "#$PANIC_ATTACK_SHA" "$root/.crates.toml" 2>/dev/null; then
-            echo "panic-attack restored from cache at $PANIC_ATTACK_SHA"
-          elif ! command -v cargo >/dev/null 2>&1; then
-            reason="cargo is not available on this runner"
-          elif ! timeout 600 cargo install --git https://github.com/hyperpolymath/panic-attack \
-              --rev "$PANIC_ATTACK_SHA" --locked --force --root "$root" panic-attack; then
-            reason="source build at $PANIC_ATTACK_SHA failed or exceeded 10 minutes"
-          elif [ ! -x "$bin" ]; then
-            reason="no binary after the source build at $PANIC_ATTACK_SHA"
-          fi
-          if [ -n "$reason" ]; then
-            # Leave nothing for the cache to save from a failed build.
-            rm -rf "$root"
-            echo "::warning title=panic-attack not installed::$reason"
-            echo "reason=$reason" >> "$GITHUB_OUTPUT"
-          else
-            echo "bin=$bin" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Run panic-attack assail
-        id: panic-attack
-        env:
-          PA_BIN: ${{ steps.panic-attack-install.outputs.bin }}
-          PA_INSTALL_REASON: ${{ steps.panic-attack-install.outputs.reason }}
-        run: |
-          set -euo pipefail
-          # panic-attack-findings.json is a status ENVELOPE, never a bare array:
-          #   status     "ran" | "not_run" | "error"
-          #   tool, ref  "panic-attack" and the pinned commit
-          #   reason     why it did not run or failed; null when it ran
-          #   exit_code  the assail exit code; null when it never started
-          #   counts     unsuppressed {critical, high, medium, low}; null unless ran
-          #   report     panic-attack's own AssailReport; null unless ran
-          # Only status "ran" carries a result. Anything else is not a pass.
-          out=panic-attack-findings.json
-          marker() {
-            jq -n --arg status "$1" --arg reason "$2" --argjson exit_code "$3" \
-              --arg ref "$PANIC_ATTACK_SHA" '{status: $status, tool: "panic-attack",
-                ref: $ref, reason: $reason, exit_code: $exit_code, counts: null,
-                report: null}' > "$out"
-          }
-          status=ran
-          reason=""
-          if [ -z "${PA_BIN:-}" ] || [ ! -x "$PA_BIN" ]; then
-            status=not_run
-            reason="${PA_INSTALL_REASON:-panic-attack is not installed}"
-            marker not_run "$reason" null
-          else
-            report=$(mktemp)
-            log=$(mktemp)
-            rc=0
-            # The report goes to --output; stdout carries only a banner.
-            timeout 300 "$PA_BIN" assail . --output "$report" > "$log" 2>&1 || rc=$?
-            if [ "$rc" -eq 124 ]; then
-              status=error
-              reason="panic-attack assail did not finish within 5 minutes"
-              marker error "$reason" "$rc"
-            elif [ "$rc" -ne 0 ]; then
-              status=error
-              reason="panic-attack assail exited $rc"
-              marker error "$reason" "$rc"
-            elif ! jq -e -s 'length == 1 and (.[0] | type == "object" and
-                (.weak_points | type == "array") and all(.weak_points[]; type == "object" and
-                  (.severity as $s | ["Low", "Medium", "High", "Critical"] | index($s) != null)))' \
-                "$report" > /dev/null 2>&1; then
-              status=error
-              reason="panic-attack assail exited 0 without a valid report"
-              marker error "$reason" 0
-            else
-              jq --arg ref "$PANIC_ATTACK_SHA" '
-                [.weak_points[] | select(.suppressed != true) | .severity] as $s
-                | {status: "ran", tool: "panic-attack", ref: $ref, reason: null,
-                   exit_code: 0,
-                   counts: {critical: ($s | map(select(. == "Critical")) | length),
-                            high: ($s | map(select(. == "High")) | length),
-                            medium: ($s | map(select(. == "Medium")) | length),
-                            low: ($s | map(select(. == "Low")) | length)},
-                   report: .}' "$report" > "$out"
-            fi
-            if [ "$status" = error ]; then
-              echo "::group::panic-attack output"
-              cat "$log"
-              echo "::endgroup::"
-            fi
-          fi
-
-          echo "status=$status" >> "$GITHUB_OUTPUT"
-          if [ "$status" = ran ]; then
-            critical=$(jq '.counts.critical' "$out")
-            high=$(jq '.counts.high' "$out")
-            medium=$(jq '.counts.medium' "$out")
-            low=$(jq '.counts.low' "$out")
-            {
-              echo "critical=$critical"
-              echo "high=$high"
-            } >> "$GITHUB_OUTPUT"
-            if [ $((critical + high)) -gt 0 ]; then
-              echo "::warning title=panic-attack findings (advisory)::$critical critical and $high high finding(s). This scan does not gate; see panic-attack-findings.json in the hypatia-scan-findings artifact."
-            fi
-            {
-              echo "## panic-attack assail (advisory, does not gate)"
-              echo ""
-              echo "| Severity | Count |"
-              echo "|----------|-------|"
-              echo "| Critical | $critical |"
-              echo "| High     | $high |"
-              echo "| Medium   | $medium |"
-              echo "| Low      | $low |"
-              echo ""
-              echo "Built from hyperpolymath/panic-attack@$PANIC_ATTACK_SHA. Findings panic-attack suppresses as likely false positives are not counted."
-            } >> "$GITHUB_STEP_SUMMARY"
-          else
-            if [ "$status" = error ]; then label=ERROR; else label="NOT RUN"; fi
-            echo "::warning title=panic-attack $label::$reason. panic-attack-findings.json records status $status, which is not a pass."
-            {
-              echo "## panic-attack assail: $label"
-              echo ""
-              echo "**Status \`$status\`:** $reason."
-              echo ""
-              echo "No scan result was produced, so this is **not** a pass."
-              echo "\`panic-attack-findings.json\` records \`\"status\": \"$status\"\`."
-            } >> "$GITHUB_STEP_SUMMARY"
-          fi
-
-      # pons asinorum is ADVISORY on the same terms as panic-attack: a status
-      # envelope (ran | not_run | error) that is never a bare pass, built from
-      # source at PONS_SHA and cached by that commit.
-      - name: Restore pons build cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ~/.pons
-          key: pons-v1-${{ runner.os }}-${{ runner.arch }}-${{ env.PONS_SHA }}
-
-      - name: Install pons asinorum (pinned source build)
-        id: pons-install
-        run: |
-          set -euo pipefail
-          root="$HOME/.pons"
-          bin="$root/bin/pons"
-          reason=""
-          if [ -x "$bin" ] && grep -qF "#$PONS_SHA" "$root/.crates.toml" 2>/dev/null; then
-            echo "pons restored from cache at $PONS_SHA"
-          elif ! command -v cargo >/dev/null 2>&1; then
-            reason="cargo is not available on this runner"
-          elif ! timeout 600 cargo install --git https://github.com/hyperpolymath/pons-asinorum \
-              --rev "$PONS_SHA" --locked --force --root "$root" pons-cli; then
-            reason="source build at $PONS_SHA failed or exceeded 10 minutes"
-          elif [ ! -x "$bin" ]; then
-            reason="no binary after the source build at $PONS_SHA"
-          fi
-          if [ -n "$reason" ]; then
-            rm -rf "$root"
-            echo "::warning title=pons not installed::$reason"
-            echo "reason=$reason" >> "$GITHUB_OUTPUT"
-          else
-            echo "bin=$bin" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Run pons asinorum scan
-        id: pons
-        env:
-          PONS_BIN: ${{ steps.pons-install.outputs.bin }}
-          PONS_INSTALL_REASON: ${{ steps.pons-install.outputs.reason }}
-        run: |
-          set -euo pipefail
-          # pons-findings.json is the same status envelope as panic-attack's;
-          # `report` is pons's own JSON envelope when status is "ran".
-          out=pons-findings.json
-          marker() {
-            jq -n --arg status "$1" --arg reason "$2" --argjson exit_code "$3" \
-              --arg ref "$PONS_SHA" '{status: $status, tool: "pons-asinorum",
-                ref: $ref, reason: $reason, exit_code: $exit_code, counts: null,
-                report: null}' > "$out"
-          }
-          if [ -z "${PONS_BIN:-}" ] || [ ! -x "$PONS_BIN" ]; then
-            marker not_run "${PONS_INSTALL_REASON:-pons is not installed}" null
-          else
-            report=$(mktemp)
-            log=$(mktemp)
-            rc=0
-            timeout 300 "$PONS_BIN" scan --format json . > "$report" 2> "$log" || rc=$?
-            if [ "$rc" -eq 124 ]; then
-              marker error "pons scan did not finish within 5 minutes" "$rc"
-            elif [ "$rc" -ne 0 ]; then
-              marker error "pons scan exited $rc" "$rc"
-            elif ! jq -e -s 'length == 1 and (.[0] | type == "object" and
-                (.findings | type) == "array" and all(.findings[]; type == "object" and
-                  ((.severity | ascii_upcase) as $s | ["INFO", "WARN", "ERROR"] | index($s) != null)))' \
-                "$report" > /dev/null 2>&1; then
-              marker error "pons scan exited 0 without a valid report" 0
-            else
-              jq --arg ref "$PONS_SHA" '
-                [.findings[].severity | ascii_upcase] as $s
-                | {status: "ran", tool: "pons-asinorum", ref: $ref, reason: null, exit_code: 0,
-                   counts: {error: ($s | map(select(. == "ERROR")) | length),
-                            warn: ($s | map(select(. == "WARN")) | length),
-                            info: ($s | map(select(. == "INFO")) | length)},
-                   report: .}' "$report" > "$out"
-            fi
-            if [ "$(jq -r .status "$out")" = error ]; then
-              echo "::group::pons output"
-              cat "$log"
-              echo "::endgroup::"
-            fi
-          fi
-          status=$(jq -r .status "$out")
-          echo "status=$status" >> "$GITHUB_OUTPUT"
-          if [ "$status" = ran ]; then
-            {
-              echo "## pons asinorum scan (advisory, does not gate)"
-              echo ""
-              echo "| Severity | Count |"
-              echo "|----------|-------|"
-              jq -r '"| ERROR | \(.counts.error) |", "| WARN | \(.counts.warn) |", "| INFO | \(.counts.info) |"' "$out"
-              echo ""
-              echo "Built from hyperpolymath/pons-asinorum@$PONS_SHA. Each finding carries its tier and evidence class; a heuristic is labelled as one."
-            } >> "$GITHUB_STEP_SUMMARY"
-          else
-            echo "::warning title=pons $status::$(jq -r .reason "$out"). pons-findings.json records status $status, which is not a pass."
-          fi
-
-      - name: Check out standards for the SARIF baseline filter
-        id: fetch_filter
-        # ⚠ continue-on-error is on the CHECKOUT, never on the check. If the
-        # fetch fails the next step still runs and says so; putting the flag on
-        # the filter itself would produce exactly the fake gate this estate
-        # keeps finding. Pinned to main because github.workflow_sha resolves to
-        # the CALLER's SHA, which would 404 here.
-        # advisory-by-design, not fail-closed: this checkout fails OPEN.
-        # "Filter SARIF through the baseline before upload" below falls back
-        # to uploading the SARIF UNFILTERED when the fetched filter script is
-        # unavailable — an unfiltered upload can only show more alerts, never
-        # hide real ones.
-        # hypatia: allow research_extensions/RE005 -- advisory-by-design, fails OPEN; see comment above.
-        continue-on-error: true
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          repository: metadatastician/standards
-          persist-credentials: false
-          # Includes the filter's completion output and literal-glob matching.
-          # Keep the helper immutable and compatible with the strict gate.
-          ref: 6b0bfce648cf9b306693cea0af0bd5f6fc9fea0f
-          path: .standards-checkout
-          sparse-checkout: |
-            scripts
-          sparse-checkout-cone-mode: false
-
-      - name: Filter SARIF through the baseline before upload
-        id: filter_baseline
-        run: |
-          # ⚠ WITHOUT THIS, ACKNOWLEDGING A FINDING DOES NOT UNBLOCK ANYTHING.
-          # A finding travelled two paths that never met: the gate filtered
-          # findings.json through the baseline, while the SARIF went to code
-          # scanning UNFILTERED. The `code_scanning` ruleset rule blocks on
-          # those alerts and has no knowledge of the baseline, so a pull
-          # request stayed BLOCKED with every required check green and nothing
-          # to point at.
-          #
-          # Measured 2026-08-07: 147 open pull requests across 91 repositories
-          # were held this way by 1,777 alerts, ZERO of which were introduced
-          # by the pull request they blocked.
-          #
-          # The filter FAILS OPEN in every error path — an unfiltered upload is
-          # a safe failure, a silently over-filtered one hides real alerts.
-          if [ -f .standards-checkout/scripts/filter-sarif-by-baseline.sh ]; then
-            FILTER=.standards-checkout/scripts/filter-sarif-by-baseline.sh
-          elif [ -f scripts/filter-sarif-by-baseline.sh ]; then
-            FILTER=scripts/filter-sarif-by-baseline.sh
-          else
-            echo "  filter script unavailable — SARIF uploaded unfiltered"; exit 0
-          fi
-          # Use the CALLER's apply-baseline.sh — the same copy the gate runs,
-          # so the SARIF and the gate cannot disagree about what is acknowledged.
-          APPLY_BASELINE=scripts/apply-baseline.sh \
-            bash "$FILTER" hypatia-effective.sarif hypatia-findings.effective.json .hypatia-baseline.json
-
-      - name: Upload SARIF to code scanning
-        # Advisory PR scans must not create a second, blocking code-scanning
-        # check. Findings remain in the PR artifact and verdict grid; uploads
-        # on push/workflow_dispatch still reconcile the Security tab.
-        if: github.event_name != 'pull_request'
-        # NOTE: this does NOT make under-permissioned callers "skip gracefully".
-        # This workflow declares `security-events: write` at the top, so a
-        # caller granting only `read` is rejected at startup and NO step of
-        # this job ever executes — `continue-on-error` cannot rescue a job
-        # that was never created. Callers MUST grant `security-events: write`.
-        # This flag only tolerates a genuine upload failure (e.g. Advanced
-        # Security disabled on a private repo) once the job is actually running.
-        continue-on-error: true
-        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee  # v4.39.0 (the SHA, not the tag, is pinned: Dependabot resolves it to 4.39.0)
-        with:
-          sarif_file: hypatia-effective.sarif
-          category: hypatia
-
-      - name: Upload findings artifacts
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          name: hypatia-scan-findings
-          path: |
-            hypatia-findings.json
-            hypatia-findings.effective.json
-            panic-attack-findings.json
-            pons-findings.json
-          retention-days: 90
-
-      # ── VERDICT GRID (docs/VERDICT-GRID-SPEC.adoc) ──────────────────────
-      # One table for the lane: Hypatia, panic-attack, pons and every
-      # gitbot-fleet report-back under .gitbot-fleet/, graded by the worst
-      # finding present, with missing or unreadable evidence orange and
-      # explicit exclusions grey. It lands in the job summary, in the
-      # verdict-grid artifact (report.json, report.md, badge.json) and in the
-      # `verdict` output. The PR comment is the CALLER's job: this reusable
-      # declares only the permissions every existing caller already grants,
-      # and a called workflow may not ask for more than its caller.
-      - name: Check out the verdict grid renderer at this workflow's commit
-        if: ${{ always() }}
-        # continue-on-error on the CHECKOUT only: the render step below
-        # reports a missing renderer as orange, never as a pass.
-        continue-on-error: true
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          repository: metadatastician/standards
-          # This fork-local reusable's job.workflow_sha belongs to
-          # MetaManifold, not standards, so the source commit must be literal.
-          ref: 01c9b0c9f2646ebea0b30a9588462642ac94aee9
-          path: .standards-grid
-          persist-credentials: false
-          sparse-checkout: |
-            scripts/verdict-grid.sh
-            scripts/lib/verdict-grid.jq
-          sparse-checkout-cone-mode: false
-
-      - name: Read the previous verdict grid
-        if: ${{ always() && github.event_name == 'pull_request' }}
-        # Best effort: the token may lack pull-request read on the caller. A
-        # missing previous grid only means "no comparable baseline".
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          gh api --paginate --slurp "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" \
-            | jq -r '[.[][] | select(.user.login == "github-actions[bot]" and (.body | contains("<!-- verdict-grid:")))]
-                     | last | .body // ""' \
-            > "$RUNNER_TEMP/grid-previous.md" || : > "$RUNNER_TEMP/grid-previous.md"
-
-      # Fork delta 4: fleet report-backs. Produced per run by the `fleet` job of
-      # hypatia-scan.yml and reaching this job only as an artifact; never
-      # committed. continue-on-error: no artifact leaves the enrolled rows orange.
-      # Nothing committed may pose as evidence: only files the artifact supplies
-      # are read. The committed README.md is not *.json and is left alone.
-      - name: Clear any checked-out fleet report-backs
-        if: ${{ always() }}
-        run: |
-          set -euo pipefail
-          mkdir -p .gitbot-fleet/report-backs
-          # Every entry named *.json goes, symlinks and directories included: a committed
-          # symlink survives a -type f filter and the renderer follows it to its target.
-          find .gitbot-fleet/report-backs -mindepth 1 -maxdepth 1 -name '*.json' -print -exec rm -rf -- {} +
-
-      - name: Download the fleet report-backs
-        if: ${{ always() && inputs.report-backs-artifact != '' }}
-        continue-on-error: true
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
-        with:
-          name: ${{ inputs.report-backs-artifact }}
-          path: .gitbot-fleet/report-backs
-
-      - name: Render the verdict grid
-        id: grid
-        if: ${{ always() }}
-        env:
-          HYPATIA_REF: ${{ steps.hypatia-rev.outputs.sha }}
-          PR_NUMBER: ${{ github.event.pull_request.number || 'local' }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
-        run: |
-          set -uo pipefail
-          renderer=.standards-grid/scripts/verdict-grid.sh
-          mkdir -p verdict-grid
-          if [ ! -f "$renderer" ]; then
-            # No renderer is missing evidence, rendered as such, never a pass.
-            jq -n '{schemaVersion: 1, label: "Hypatia grid", message: "indeterminate", color: "orange"}' > verdict-grid/badge.json
-            printf '%s\n%s\n' '<!-- verdict-grid:hypatia regenerated on every run -->' \
-              '🟠 indeterminate · the verdict grid renderer could not be checked out from metadatastician/standards; see the job log.' \
-              > verdict-grid/report.md
-            cat verdict-grid/report.md >> "$GITHUB_STEP_SUMMARY"
-            echo "state=orange" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          # Prefer the exception-aware projection. If that step could not run,
-          # fall back to raw findings so a failed exception transform can never
-          # hide scanner output; the job itself still records the failure.
-          findings=hypatia-findings.json
-          [ -f hypatia-findings.relativized.json ] && findings=hypatia-findings.relativized.json
-          [ -f hypatia-findings.effective.json ] && findings=hypatia-findings.effective.json
-          enrolment=""
-          [ -f .gitbot-fleet/enrolment.json ] && enrolment=.gitbot-fleet/enrolment.json
-          # The renderer appends the grid to the step summary and writes
-          # state= to GITHUB_OUTPUT itself; its exit code is 0 for any
-          # rendered verdict and 2 only for a usage error.
-          bash "$renderer" render --out verdict-grid \
-            --hypatia "$findings" --panic panic-attack-findings.json --pons pons-findings.json \
-            --report-backs .gitbot-fleet/report-backs --enrolment "$enrolment" \
-            --previous "$RUNNER_TEMP/grid-previous.md" \
-            --sha "$HEAD_SHA" --run "$GITHUB_RUN_ID" \
-            --url "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
-            --pr "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" \
-            --hypatia-ref "$HYPATIA_REF" --panic-ref "$PANIC_ATTACK_SHA" --pons-ref "$PONS_SHA" > /dev/null
-
-      - name: Upload the verdict grid
-        if: ${{ always() }}
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          name: verdict-grid
-          path: verdict-grid
-          if-no-files-found: error
-          retention-days: 90
-
-      - name: Gate on baseline (blocking when a baseline is committed)
-        if: '!inputs.block-on-high && (steps.inherited-language.outputs.findings_count > 0 || hashFiles(''.hypatia-baseline.json'') != '''')'
-        run: |
-          # Wave-8 gate promotion: when the calling repo commits a
-          # .hypatia-baseline.json (schema: .machine_readable/hypatia-baseline.
-          # schema.json) AND ships scripts/apply-baseline.sh, findings are
-          # filtered against the baseline and any UNBASELINED finding at or
-          # above the blocking threshold FAILS this job. Repos without a
-          # baseline keep the honest ADVISORY behaviour below — the gate arms
-          # itself the moment a baseline lands (standards#399/#437/#446).
-          if [ -f scripts/apply-baseline.sh ] && [ -f .hypatia-baseline.json ]; then
-            echo "Baseline present — running BLOCKING gate (threshold: high)."
-            # Use the exception-aware findings so inherited upstream TypeScript
-            # is treated consistently by the gate and the Security tab. Paths
-            # were relativized before applying the fork-local exception.
-            bash scripts/apply-baseline.sh hypatia-findings.effective.json .hypatia-baseline.json blocking
-          else
-            echo "No committed baseline — gate stays advisory (see next step)."
-          fi
-
-      - name: Block high and critical findings when requested
-        id: blocking-findings
-        if: inputs.block-on-high
-        env:
-          HYPATIA_BASELINE_FILTERED: ${{ steps.filter_baseline.outputs.filtered }}
-        run: |
-          set -euo pipefail
-          # Use the scanner's authoritative SARIF projection, after the same
-          # baseline filter used for the Security tab. Raw JSON also contains
-          # code_scanning_alerts: historical GitHub alert summaries, including
-          # alerts fixed by this PR that cannot close until it reaches main.
-          # Hypatia already excludes those meta-rules in its SARIF renderer.
-          # Counting them here creates a circular merge dependency. Raw JSON
-          # remains in the artifact for the fleet's historical-debt review.
-          # Validate a present baseline even when there are no current errors.
-          # Advisory mode validates without gating historical meta-findings;
-          # the final filtered SARIF below supplies the blocking decision.
-          if [ -f .hypatia-baseline.json ]; then
-            if [ ! -f scripts/apply-baseline.sh ]; then
-              echo "::error::A committed baseline requires scripts/apply-baseline.sh"
-              exit 2
-            fi
-            bash scripts/apply-baseline.sh hypatia-findings.effective.json .hypatia-baseline.json advisory >/dev/null
-            if [ "${HYPATIA_BASELINE_FILTERED:-}" != "true" ]; then
-              echo "::error::Baseline validation passed but SARIF filtering did not complete"
-              exit 2
-            fi
-          fi
-          # Missing/truncated output must never become a clean security gate.
-          if ! jq -se '
-            length == 1 and (.[0] |
-              .version == "2.1.0" and (.runs | type == "array" and length > 0) and
-              all(.runs[];
-                .tool.driver.name == "Hypatia" and
-                (.results | type == "array") and
-                all(.results[];
-                  type == "object" and (.ruleId | type == "string" and length > 0) and
-                  (.level as $level | ["error", "warning", "note", "none"] | index($level) != null))))
-          ' hypatia-effective.sarif >/dev/null; then
-            echo "::error::Hypatia did not produce one valid exception-aware SARIF findings document"
-            exit 2
-          fi
-          count=$(jq '[.runs[].results[] | select(.level == "error")] | length' hypatia-effective.sarif)
-          if [ "$count" -gt 0 ]; then
-            echo "::error::Hypatia found $count current high or critical finding(s); see the SARIF artifact"
-            exit 1
-          fi
-          echo "Hypatia blocking gate: no current high or critical findings after baseline filtering"
-
-      - name: Check for critical issues (ADVISORY — does not gate)
-        if: '!inputs.block-on-high && steps.inherited-language.outputs.critical > 0'
-        run: |
-          # This scan is ADVISORY / fix-forward WHEN NO BASELINE IS COMMITTED
-          # (the step above becomes the blocking gate once .hypatia-baseline.json
-          # lands). The label and summary state that explicitly so a green check
-          # carrying critical findings is not mistaken for "no critical findings".
-          echo "::warning title=Hypatia (ADVISORY, non-blocking)::${{ steps.inherited-language.outputs.critical }} effective critical finding(s). This scan does not gate — review hypatia-findings.effective.json; raw findings remain in hypatia-findings.json."
-          {
-            echo "### Hypatia scan — ADVISORY (does not gate)"
-            echo ""
-            echo "**${{ steps.inherited-language.outputs.critical }} effective critical finding(s)** reported after the upstream TypeScript exception."
-            echo "This scan is fix-forward and **never fails the build**; a green"
-            echo "check here does not mean zero critical findings. See the"
-            echo "\`hypatia-scan-findings\` artifact. Blocking promotion: standards#399/#437."
-          } >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 22873b5b..c51a5b12 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -1,21 +1,20 @@
 # SPDX-License-Identifier: MPL-2.0
 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
-# Fork governance lane. The DEED and K9 conformance lanes call
-# metadatastician/standards directly, at one full commit SHA (owner decision,
-# 2026-11-10). The Actions policy of this repository must permit
+# Fork governance lane. The DEED, K9 and Hypatia lanes and the comment poster
+# call metadatastician/standards directly, all at one full commit SHA (owner
+# decision, 2026-11-10). The Actions policy of this repository must permit
 # `metadatastician/standards/.github/workflows/*@*` for those calls to start.
-# The Hypatia verdict grid still uses a fork-local copy of the standards
-# reusable so its advisory PR scan cannot become a blocking
-# code-scanning-results check. Every source is pinned to a commit.
+# The Hypatia lane is advisory on pull requests: it does not upload SARIF
+# there, so its scan cannot become a blocking code-scanning-results check.
 # The grid covers Hypatia, panic-attack, pons
 # asinorum and the gitbot-fleet report-backs under .gitbot-fleet/. This workflow
 # is the fork's; nothing in it is proposed upstream, and upstream's ci.yml is
 # untouched.
 #
-# The reusable renders the grid; the two jobs below post it on the pull
-# request and publish the badges, because a called workflow may not request
-# permissions its caller does not grant.
+# The lanes render their grids and ask for no write permission. The standards
+# posting engine writes the one pull-request comment, and the badges job
+# publishes the badge endpoints on a push to main.
 name: Governance (fork)
 
 on:
@@ -45,7 +44,6 @@ jobs:
         run: |
           bash scripts/check-governance-contract.sh
           bash scripts/tests/test-governance-contract.sh
-          bash scripts/tests/test-hypatia-inherited-language-exception.sh
           bash scripts/tests/test-ci-logging.sh
           bash scripts/tests/test-scanner-boundaries.sh
           # Branch triage and the pull-request freshness rule: the scripts the
@@ -59,7 +57,7 @@ jobs:
     # permitting metadatastician/standards, this run fails at plan time with
     # zero jobs and no error line in any check summary: read the workflow page.
     # The K9 lane below must keep the same pin; the contract check enforces it.
-    uses: metadatastician/standards/.github/workflows/deed-conformance.yml@f85b6c11e5b02c51b1f0a94d40f39d9d72246396
+    uses: metadatastician/standards/.github/workflows/deed-conformance.yml@d73229d8220a35f66e99678966797dd6399dda1f
     permissions:
       contents: read
     with:
@@ -67,7 +65,7 @@ jobs:
 
   k9:
     name: K9 conformance
-    uses: metadatastician/standards/.github/workflows/k9-conformance.yml@f85b6c11e5b02c51b1f0a94d40f39d9d72246396
+    uses: metadatastician/standards/.github/workflows/k9-conformance.yml@d73229d8220a35f66e99678966797dd6399dda1f
     permissions:
       contents: read
       pull-requests: read
@@ -77,6 +75,52 @@ jobs:
       require-files: true
       fail-on-indeterminate: true
 
+  # The previous governance comment of this pull request, for the "Since
+  # previous revision" column of the Hypatia grid. Only a comment written by
+  # github-actions[bot] is read. The Hypatia lane itself asks for no
+  # pull-request permission, so this job reads the comment and hands it over as
+  # an artifact. A missing artifact leaves the column without a comparison.
+  previous-grid:
+    name: Capture previous bot-authored Hypatia grid
+    if: ${{ github.event_name == 'pull_request' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      pull-requests: read
+    steps:
+      - name: Read previous trusted comment
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+          : > "$RUNNER_TEMP/grid-previous.md"
+          if ! gh api --paginate --slurp "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" \
+               > "$RUNNER_TEMP/grid-comments.json"; then
+            echo "::warning::Cannot read prior PR comments; historical comparison unavailable."
+          elif ! jq -e 'type == "array" and all(.[]; type == "array")' "$RUNNER_TEMP/grid-comments.json" >/dev/null; then
+            echo "::warning::Malformed PR comments response; historical comparison unavailable."
+          else
+            jq -r '[.[][] | select((.user.login // "") == "github-actions[bot]"
+                     and ((.body // "") | contains("<!-- verdict-grid:hypatia ")))]
+                     | last | .body // ""' "$RUNNER_TEMP/grid-comments.json" \
+              > "$RUNNER_TEMP/grid-previous.md"
+            if [ -s "$RUNNER_TEMP/grid-previous.md" ]; then
+              echo "Trusted prior Hypatia PR grid captured."
+            else
+              echo "::notice::No previous bot-authored Hypatia grid for this PR."
+            fi
+          fi
+
+      - name: Upload previous PR grid evidence
+        if: ${{ always() }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: hypatia-grid-previous
+          path: ${{ runner.temp }}/grid-previous.md
+          if-no-files-found: error
+          retention-days: 7
+
   # Fleet report-backs, produced before the Hypatia lane renders so each enrolled
   # gitbot-fleet member's row (.gitbot-fleet/enrolment.json) carries evidence
   # instead of "enrolled, but no report-back was received". Same owner
@@ -93,101 +137,54 @@ jobs:
     name: Hypatia verdict grid
     # After the fleet job whatever its result (a dead fleet job renders as orange
     # fleet rows, never as a missing lane), but never after a failed contract.
-    needs: [workflow-contract, fleet]
+    # previous-grid is skipped on a push; a skipped need does not stop this job.
+    needs: [workflow-contract, fleet, previous-grid]
     if: ${{ !cancelled() && needs.workflow-contract.result == 'success' }}
-    # Fork-local so advisory PR scans do not upload error-level SARIF and
-    # create a second blocking check. The source pin and deltas are documented
-    # in the called file and checked by scripts/check-governance-contract.sh.
-    uses: ./.github/workflows/hypatia-scan-reusable.yml
+    # The standards lane, called directly at the same commit as the DEED and K9
+    # lanes. Two opt-in inputs keep the two behaviours the fork-local copy
+    # existed for; scripts/check-governance-contract.sh guards both.
+    uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@d73229d8220a35f66e99678966797dd6399dda1f
     permissions:
       actions: read
       contents: read
       security-events: write
+    with:
+      # This lane is advisory on pull requests. An upload there creates a
+      # separate, blocking "Code scanning results / Hypatia" check even when
+      # the scan job passes. Push and manual runs still upload.
+      sarif-upload-on-pull-request: false
+      # The TypeScript files this fork received from upstream. Only the
+      # banned-language finding on these exact paths is excused; the grid
+      # still reports each one as excluded. The contract check ties the list
+      # to the audited upstream snapshot.
+      inherited-language-paths: config/hypatia/upstream-typescript-allowlist.txt
+      # This repository has no frozen archive tree.
+      scope-excludes: ""
+      previous-grid-artifact: ${{ github.event_name == 'pull_request' && 'hypatia-grid-previous' || '' }}
     secrets:
       HYPATIA_SCAN_PAT: ${{ secrets.HYPATIA_SCAN_PAT }}
 
   verdict:
-    name: Post the verdict grid
+    name: Post the fork governance summary
     needs: [deed, k9, hypatia]
     if: ${{ always() && github.event_name == 'pull_request' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
+    # The standards posting engine: one comment, in the order that
+    # 3-practice/fork-governance/SPEC.adoc fixes. canon-ref names the renderer
+    # commit and must equal the lane pin.
+    uses: metadatastician/standards/.github/workflows/fork-governance-reusable.yml@d73229d8220a35f66e99678966797dd6399dda1f
     permissions:
       contents: read
       actions: read
       pull-requests: write
-    steps:
-      - name: Download the verdict grid
-        continue-on-error: true
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
-        with:
-          name: verdict-grid
-          path: verdict-grid
-
-      - name: Download the K9 conformance grid
-        continue-on-error: true
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
-        with:
-          name: k9-grid
-          path: k9-grid
-
-      - name: Update the compact PR verdict
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          DEED_RESULT: ${{ needs.deed.result }}
-          K9_RESULT: ${{ needs.k9.result }}
-          K9_VERDICT: ${{ needs.k9.outputs.verdict }}
-          HYPATIA_RESULT: ${{ needs.hypatia.result }}
-          HYPATIA_VERDICT: ${{ needs.hypatia.outputs.verdict }}
-        run: |
-          set -euo pipefail
-          # The DEED lane is a conformance row: pass is green, failure red,
-          # anything else (skipped, cancelled, no result) orange. The grid
-          # itself comes from the artifact; a missing artifact is orange.
-          case "$DEED_RESULT" in
-            success) deed='🟢 conformant' ;;
-            failure) deed='🔴 failing' ;;
-            *)       deed="🟠 indeterminate ($DEED_RESULT)" ;;
-          esac
-          # A rendered grid is not proof that its job completed successfully.
-          case "$K9_RESULT" in
-            success) k9="${K9_VERDICT:-orange}" ;;
-            failure) k9=red ;;
-            *)       k9=orange ;;
-          esac
-          {
-            echo '<!-- fork-governance-verdict: regenerated on every run -->'
-            echo '# Fork governance'
-            echo
-            echo "| Lane | Status | Run |"
-            echo "|---|---|---|"
-            echo "| DEED syntax (repo deed) | $deed | [run $GITHUB_RUN_ID]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID) |"
-            echo "| K9 conformance (L0–L2; L3 not verified) | $k9 (job: $K9_RESULT) | same run |"
-            echo "| Hypatia verdict grid | ${HYPATIA_VERDICT:-orange} (job: $HYPATIA_RESULT) | same run |"
-            echo
-            if [ -s verdict-grid/report.md ]; then
-              cat verdict-grid/report.md
-            else
-              echo '🟠 indeterminate · no verdict-grid artifact was produced by the Hypatia lane; see the run.'
-            fi
-            echo
-            if [ -s k9-grid/report.md ]; then
-              cat k9-grid/report.md
-            else
-              echo '🟠 indeterminate · no K9 grid artifact was produced; see the run.'
-            fi
-          } > "$RUNNER_TEMP/body.md"
-          # One comment per PR, updated in place; newest run wins.
-          comment_id=$(gh api --paginate --slurp "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" \
-            | jq -r '[.[][] | select(.user.login == "github-actions[bot]" and (.body | contains("<!-- fork-governance-verdict:")))] | last | .id // ""')
-          jq -n --rawfile body "$RUNNER_TEMP/body.md" '{body: $body}' > "$RUNNER_TEMP/comment.json"
-          if [ -n "$comment_id" ]; then
-            gh api -X PATCH "repos/$GITHUB_REPOSITORY/issues/comments/$comment_id" --input "$RUNNER_TEMP/comment.json" >/dev/null
-          else
-            gh api -X POST "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" --input "$RUNNER_TEMP/comment.json" >/dev/null
-          fi
-          echo "published the governance verdict to #$PR_NUMBER"
+    with:
+      pr-number: ${{ github.event.pull_request.number }}
+      deed-result: ${{ needs.deed.result }}
+      k9-result: ${{ needs.k9.result }}
+      k9-verdict: ${{ needs.k9.outputs.verdict }}
+      hypatia-result: ${{ needs.hypatia.result }}
+      hypatia-verdict: ${{ needs.hypatia.outputs.verdict }}
+      hypatia-advisory: ${{ needs.hypatia.outputs.advisory }}
+      canon-ref: d73229d8220a35f66e99678966797dd6399dda1f
 
   badges:
     name: Publish badges
diff --git a/docs/maintenance/repository-hygiene.md b/docs/maintenance/repository-hygiene.md
index 2a24af42..0a47c72c 100644
--- a/docs/maintenance/repository-hygiene.md
+++ b/docs/maintenance/repository-hygiene.md
@@ -296,10 +296,21 @@ SHA, and the two fork-local copies (`deed-conformance-reusable.yml`,
 `k9-conformance-reusable.yml`) are deleted. This needs the entry
 `metadatastician/standards/.github/workflows/*@*` in Settings → Actions →
 General. Without it the `Governance (fork)` run fails at plan time with zero
-jobs. The contract now permits exactly those two cross-owner calls, each at a
-full commit SHA and both at the same commit. The Hypatia, Scorecard and
-secret-scanner lanes are still fork-local. The text below describes the state
-before that date.
+jobs.
+
+The Hypatia lane and the comment poster followed on the same day. The
+fork-local `hypatia-scan-reusable.yml` existed for two behaviours, and the
+standards lane now offers both as opt-in inputs:
+`sarif-upload-on-pull-request: false` and `inherited-language-paths` (the
+upstream TypeScript list in `config/hypatia/`). The copy, its filter script
+`scripts/filter-hypatia-inherited-language.sh` and that script's test are
+deleted. The pull-request comment now comes from the standards posting engine,
+so it has the layout that `3-practice/fork-governance/SPEC.adoc` fixes.
+
+The contract permits exactly four cross-owner calls (DEED, K9, Hypatia, the
+posting engine), each at a full commit SHA and all at the same commit. The
+Scorecard and secret-scanner lanes are still fork-local. The text below
+describes the state before that date.
 
 Neither copy re-implements anything. The DEED copy is the upstream *caller*
 path — the self-test, fixture-corpus and uuid-v8 steps were gated on
@@ -366,7 +377,8 @@ recorded here so the choice does not have to be rediscovered.
    six-day-old tree 119 commits behind. That is owner work, not cleanup.
 6. **Reconciling the `hyperpolymath/standards` pins.** Seven workflows reference
    that repository at four different commits, two of them inside
-   `hypatia-scan-reusable.yml` itself. Some pins are deliberate and pinned by
+   `hypatia-scan-reusable.yml` itself (that file was deleted on 2026-11-10; the
+   governance lanes now share one pin). Some pins are deliberate and pinned by
    `scripts/check-governance-contract.sh` (`c6d78606…` for K9, the secret
    scanner and Scorecard; `01c9b0c9…` for the verdict-grid renderer), so a
    reconciliation has to move the contract's constants and the allowlist digest
diff --git a/scripts/check-governance-contract.sh b/scripts/check-governance-contract.sh
index 637191df..7ca801db 100644
--- a/scripts/check-governance-contract.sh
+++ b/scripts/check-governance-contract.sh
@@ -2,19 +2,17 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
-# Guard the fork-local Hypatia scan contract. A PR scan remains visible without
-# creating an independent blocking SARIF check, and the upstream TypeScript
-# exception stays exact-path, narrow-rule, and audit-preserving.
+# Guard the fork's governance contract. The DEED, K9 and Hypatia lanes and the
+# comment poster call metadatastician/standards at one full commit SHA. A PR
+# scan stays visible without an independent blocking SARIF check, and the
+# upstream TypeScript exception stays exact-path and narrow-rule.
 set -euo pipefail
 
 ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$ROOT"
 
 CALLER=.github/workflows/hypatia-scan.yml
-REUSABLE=.github/workflows/hypatia-scan-reusable.yml
 ALLOWLIST=config/hypatia/upstream-typescript-allowlist.txt
-FORMAT_TOOLS=config/format-tools.toml
-STANDARDS_SHA=01c9b0c9f2646ebea0b30a9588462642ac94aee9
 UPSTREAM_SHA=a325589d3d318847c15b21cd34fb7d6e7a6d2f7b
 # SHA-256 of the sorted unique paths audited at UPSTREAM_SHA, with a final LF.
 ALLOWLIST_SHA256=531f92fdf33487a03b03381c40a6cc9a53a771b870b92fc18feed18c9c1798a7
@@ -56,23 +54,16 @@ step_block() { # file step-name
   ' "$1"
 }
 
-for file in "$CALLER" "$REUSABLE"; do
-  if [ -s "$file" ]; then
-    pass "$file exists"
-  else
-    fail "$file is missing or empty"
-  fi
-done
+if [ -s "$CALLER" ]; then
+  pass "$CALLER exists"
+else
+  fail "$CALLER is missing or empty"
+fi
 if [ -s "$ALLOWLIST" ]; then
   pass "$ALLOWLIST exists"
 else
   fail "$ALLOWLIST is missing or empty"
 fi
-if [ -s "$FORMAT_TOOLS" ]; then
-  pass "$FORMAT_TOOLS exists"
-else
-  fail "$FORMAT_TOOLS is missing or empty"
-fi
 
 # Do not continue with misleading secondary errors if an input is absent.
 if [ "$failures" -gt 0 ]; then
@@ -114,62 +105,63 @@ if [ "$failures" -gt 0 ]; then
 fi
 
 caller="$(cat "$CALLER")"
-reusable="$(cat "$REUSABLE")"
 
-contains "$caller" 'uses: ./.github/workflows/hypatia-scan-reusable.yml' \
-  'the governance lane calls the fork-local reusable'
-# The standards repository is metadatastician/standards; it was
-# hyperpolymath/standards until the transfer on 2026-10-25. Both names are
-# checked, because a bypass through either one skips the fork guard.
-not_contains "$caller" 'uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@' \
-  'the governance lane cannot bypass the fork guard by calling standards directly'
-not_contains "$caller" 'uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@' \
-  'the governance lane cannot bypass the fork guard through the pre-transfer name'
+# Print the pin of each call to the named standards workflow, one per line. No
+# call is no output, never a failed command: the checks below report it.
+lane_pin() {
+  local lane=$1
+  { grep -E "^    uses: metadatastician/standards/\.github/workflows/${lane}@[0-9a-f]{40}\$" <<<"$caller" || true; } \
+    | sed 's/.*@//'
+}
+
+# The Hypatia lane calls metadatastician/standards directly (owner decision,
+# 2026-11-10). The fork-local copy existed for two behaviours. Both are now
+# opt-in inputs of the standards lane, and removing either one changes what a
+# pull request can be blocked by, so both are required here.
+hypatia_pin="$(lane_pin 'hypatia-scan-reusable\.yml')"
+if [[ "$(grep -c . <<<"$hypatia_pin" || true)" == 1 ]]; then
+  pass 'the Hypatia lane calls the standards lane at one immutable commit'
+else
+  fail 'the Hypatia lane must call metadatastician/standards hypatia-scan-reusable.yml at one full commit SHA'
+fi
+if [ ! -e .github/workflows/hypatia-scan-reusable.yml ]; then
+  pass 'no stale fork-local copy of the Hypatia lane remains'
+else
+  fail 'a fork-local hypatia-scan-reusable.yml must not sit beside the direct call'
+fi
+if grep -Eq '^      sarif-upload-on-pull-request: false$' <<<"$caller"; then
+  pass 'pull request scans do not create an independent blocking code-scanning check'
+else
+  fail 'the Hypatia lane must set sarif-upload-on-pull-request: false'
+fi
+if grep -Eq "^      inherited-language-paths: ${ALLOWLIST//./\\.}\$" <<<"$caller"; then
+  pass 'the Hypatia lane applies the upstream TypeScript exception'
+else
+  fail "the Hypatia lane must set inherited-language-paths: $ALLOWLIST"
+fi
+if grep -Eq '^      block-on-(high|critical): true$' <<<"$caller"; then
+  fail 'the Hypatia lane is advisory here; a blocking threshold needs an owner decision and a baseline'
+else
+  pass 'the Hypatia lane stays advisory'
+fi
 contains "$caller" 'needs: [workflow-contract]' \
   'this contract runs before the fleet job'
-contains "$caller" 'needs: [workflow-contract, fleet]' \
-  'the Hypatia scan runs after both the contract and the fleet report-backs'
+contains "$caller" 'needs: [workflow-contract, fleet, previous-grid]' \
+  'the Hypatia scan runs after the contract, the fleet report-backs and the previous grid'
 contains "$caller" "if: \${{ !cancelled() && needs.workflow-contract.result == 'success' }}" \
   'a dead fleet job still lets the Hypatia lane render; a failed contract or a cancelled run does not'
-# Fork delta 4: the fleet report-backs. The producer is pinned to a gitbot-fleet
-# commit (same owner, so the Actions policy allows the reusable); the consumer
-# step must sit before the grid renders, or the rows stay orange with the
-# artifact sitting unread in the run.
+contains "$caller" "previous-grid-artifact: \${{ github.event_name == 'pull_request' && 'hypatia-grid-previous' || '' }}" \
+  'the revision comparison reads the previous grid only on pull requests'
+contains "$caller" '(.user.login // "") == "github-actions[bot]"' \
+  'only a bot-authored comment is read as the previous grid'
+# The fleet report-backs. The producer is pinned to a gitbot-fleet commit (same
+# owner, so the Actions policy allows the reusable). The standards lane
+# downloads the `fleet-report-backs` artifact before it renders the grid.
 if grep -Eq '^    uses: hyperpolymath/gitbot-fleet/\.github/workflows/fleet-report-back-reusable\.yml@[0-9a-f]{40}$' <<<"$caller"; then
   pass 'the fleet report-backs come from gitbot-fleet at an immutable commit'
 else
   fail 'the fleet report-backs must come from hyperpolymath/gitbot-fleet pinned to a 40-hex commit'
 fi
-if fleet_clear="$(step_block "$REUSABLE" 'Clear any checked-out fleet report-backs')"; then
-  contains "$fleet_clear" "find .gitbot-fleet/report-backs -mindepth 1 -maxdepth 1 -name '*.json' -print -exec rm -rf -- {} +" \
-    'a committed envelope can never pose as report-back evidence'
-  clear_line=$(grep -nF -- '- name: Clear any checked-out fleet report-backs' "$REUSABLE" | cut -d: -f1 | head -n1)
-  dl_line0=$(grep -nF -- '- name: Download the fleet report-backs' "$REUSABLE" | cut -d: -f1 | head -n1)
-  if [ -n "$clear_line" ] && [ -n "$dl_line0" ] && [ "$clear_line" -lt "$dl_line0" ]; then
-    pass 'the checked-out report-backs are cleared before the artifact is downloaded'
-  else
-    fail 'the report-backs clear step must precede the download'
-  fi
-else
-  fail 'the fleet report-backs clear step exists'
-fi
-if fleet_dl="$(step_block "$REUSABLE" 'Download the fleet report-backs')"; then
-  contains "$fleet_dl" 'path: .gitbot-fleet/report-backs' \
-    'the report-backs land where the renderer reads them'
-  contains "$fleet_dl" 'continue-on-error: true' \
-    'a missing report-backs artifact leaves rows orange instead of killing the lane'
-  contains "$fleet_dl" 'name: ${{ inputs.report-backs-artifact }}' \
-    'the artifact name is the caller-visible input, not a literal'
-  dl_line=$(grep -nF -- '- name: Download the fleet report-backs' "$REUSABLE" | cut -d: -f1 | head -n1)
-  render_line=$(grep -nF -- '- name: Render the verdict grid' "$REUSABLE" | cut -d: -f1 | head -n1)
-  if [ -n "$dl_line" ] && [ -n "$render_line" ] && [ "$dl_line" -lt "$render_line" ]; then
-    pass 'the report-backs are downloaded before the verdict grid renders'
-  else
-    fail 'the report-backs download must precede the verdict grid render step'
-  fi
-else
-  fail 'the fleet report-backs download step exists'
-fi
 if grep -Eq '^  pull_request:$' <<<"$caller"; then
   pass 'governance still runs for pull requests'
 else
@@ -181,142 +173,6 @@ else
   fail 'governance still runs for pushes to the default branch'
 fi
 
-contains "$reusable" "hypatia-scan-reusable.yml at $STANDARDS_SHA." \
-  'the fork records its immutable standards source'
-not_contains "$reusable" 'ref: ${{ job.workflow_sha }}' \
-  'a standards checkout cannot use the MetaManifold workflow SHA'
-
-if jcs_pin="$(step_block "$REUSABLE" 'Read the pinned ijson-jcs identity')"; then
-  contains "$jcs_pin" 'config/format-tools.toml' \
-    'the JCS tool pin comes from the repository format-tools manifest'
-  contains "$jcs_pin" "['ijson_jcs']" \
-    'the JCS installer reads the ijson-jcs identity from the manifest'
-  contains "$jcs_pin" "pin['rust_toolchain']" \
-    'the JCS Rust toolchain is resolved from the same manifest'
-else
-  fail 'the pinned ijson-jcs identity step exists'
-fi
-if jcs_install="$(step_block "$REUSABLE" 'Install pinned ijson-jcs')"; then
-  contains "$jcs_install" 'cargo "+$IJSON_JCS_RUST_TOOLCHAIN" install --quiet' \
-    'ijson-jcs is built with the pinned Rust toolchain'
-  contains "$jcs_install" '--git "$IJSON_JCS_REPOSITORY" --rev "$IJSON_JCS_REVISION"' \
-    'ijson-jcs is built from the immutable repository revision'
-  contains "$jcs_install" '--locked' \
-    'ijson-jcs dependencies are installed from Cargo.lock'
-else
-  fail 'the pinned ijson-jcs install step exists'
-fi
-if jcs_verify="$(step_block "$REUSABLE" 'Verify ijson-jcs and test the exception output')"; then
-  contains "$jcs_verify" 'IJSON_JCS="$IJSON_JCS" bash scripts/tests/test-hypatia-inherited-language-exception.sh' \
-    'the exception transform is tested with the real pinned canonicalizer'
-else
-  fail 'the pinned ijson-jcs smoke and exception test step exists'
-fi
-
-if upload="$(step_block "$REUSABLE" 'Upload SARIF to code scanning')"; then
-  contains "$upload" "if: github.event_name != 'pull_request'" \
-    'advisory pull-request scans skip SARIF upload'
-  contains "$upload" 'uses: github/codeql-action/upload-sarif@' \
-    'push and manual scans retain code-scanning reconciliation'
-  contains "$upload" 'sarif_file: hypatia-effective.sarif' \
-    'code scanning receives the exception-aware SARIF projection'
-else
-  fail 'the SARIF upload step exists'
-fi
-
-if scan="$(step_block "$REUSABLE" 'Run Hypatia scan')"; then
-  not_contains "$scan" 'if: github.event_name' \
-    'the Hypatia scanner itself remains enabled for every event'
-  contains "$scan" 'hypatia-findings.json' \
-    'the scanner still emits raw JSON findings'
-else
-  fail 'the Hypatia scan step exists'
-fi
-
-if exception="$(step_block "$REUSABLE" 'Apply upstream-inherited TypeScript exception')"; then
-  contains "$exception" 'if: ${{ always() }}' \
-    'the exception step records a result even after scan failures'
-  contains "$exception" 'scripts/filter-hypatia-inherited-language.sh' \
-    'the fork-local allowlist transform is applied after path normalization'
-  contains "$exception" 'hypatia-findings.effective.json' \
-    'the exception creates a distinct effective findings projection'
-  contains "$exception" 'hypatia-effective.sarif' \
-    'the exception creates a distinct effective SARIF projection'
-  contains "$exception" '"$HOME/.cargo/bin/ijson-jcs"' \
-    'the effective findings are canonicalized with the pinned CLI'
-else
-  fail 'the upstream-inherited TypeScript exception step exists'
-fi
-if raw_validation="$(step_block "$REUSABLE" 'Validate findings and count severities')"; then
-  contains "$raw_validation" 'ijson-jcs" canon < hypatia-findings.json' \
-    'raw findings are strict I-JSON validated before jq parses them'
-else
-  fail 'raw I-JSON validation is part of the findings check'
-fi
-
-if artifacts="$(step_block "$REUSABLE" 'Upload findings artifacts')"; then
-  contains "$artifacts" 'hypatia-findings.json' \
-    'raw findings remain available on advisory pull-request runs'
-  contains "$artifacts" 'hypatia-findings.effective.json' \
-    'the exception-aware findings remain available alongside raw evidence'
-  not_contains "$artifacts" 'if: github.event_name' \
-    'artifact upload is not accidentally restricted by event'
-else
-  fail 'the findings-artifact step exists'
-fi
-
-if grid="$(step_block "$REUSABLE" 'Render the verdict grid')"; then
-  contains "$grid" 'if: ${{ always() }}' \
-    'the verdict grid still renders after scanner failures'
-  contains "$grid" '--hypatia' \
-    'the verdict grid still consumes Hypatia findings'
-  contains "$grid" 'hypatia-findings.effective.json' \
-    'the verdict grid prefers the exception-aware projection'
-else
-  fail 'the verdict-grid render step exists'
-fi
-
-if baseline="$(step_block "$REUSABLE" 'Filter SARIF through the baseline before upload')"; then
-  contains "$baseline" 'hypatia-effective.sarif hypatia-findings.effective.json' \
-    'baseline filtering uses the same exception-aware findings as the grid'
-else
-  fail 'the SARIF baseline-filter step exists'
-fi
-if gate="$(step_block "$REUSABLE" 'Gate on baseline (blocking when a baseline is committed)')"; then
-  contains "$gate" 'hypatia-findings.effective.json' \
-    'the baseline gate consumes exception-aware findings'
-  if grep -Fxq "        if: '!inputs.block-on-high && (steps.inherited-language.outputs.findings_count > 0 || hashFiles(''.hypatia-baseline.json'') != '''')'" <<<"$gate"; then
-    pass 'the advisory baseline gate requires nonblocking mode and either findings or a committed baseline'
-  else
-    fail 'the advisory baseline gate requires nonblocking mode and either findings or a committed baseline'
-  fi
-else
-  fail 'the baseline gate step exists'
-fi
-if blocking="$(step_block "$REUSABLE" 'Block high and critical findings when requested')"; then
-  contains "$blocking" 'hypatia-effective.sarif' \
-    'the blocking gate evaluates exception-aware SARIF'
-else
-  fail 'the requested high/critical gate step exists'
-fi
-if advisory="$(step_block "$REUSABLE" 'Check for critical issues (ADVISORY — does not gate)')"; then
-  contains "$advisory" 'steps.inherited-language.outputs.critical' \
-    'the critical advisory count excludes only the inherited TypeScript exception'
-else
-  fail 'the critical advisory step exists'
-fi
-not_contains "$reusable" 'steps.scan.outputs.critical > 0' \
-  'the raw critical count cannot drive an exception-inconsistent advisory'
-
-if renderer="$(step_block "$REUSABLE" 'Check out the verdict grid renderer at this workflow'"'"'s commit')"; then
-  contains "$renderer" 'repository: metadatastician/standards' \
-    'the renderer comes from the standards repository'
-  contains "$renderer" "ref: $STANDARDS_SHA" \
-    'the standards renderer uses the immutable source pin'
-else
-  fail 'the standards renderer checkout exists'
-fi
-
 # Only real reference lines count. A comment may (and the fork-local DEED lane
 # does) explain the transfer by naming the old owner; a `uses:` or a checkout
 # `repository:` naming it is a broken reference.
@@ -355,26 +211,12 @@ else
   pass 'no workflow claims an actions.lock this repository does not have'
 fi
 
-upload_count="$(grep -c 'uses: github/codeql-action/upload-sarif@' "$REUSABLE" || true)"
-if [ "$upload_count" -eq 1 ]; then
-  pass 'there is exactly one SARIF upload site to guard'
-else
-  fail "expected one SARIF upload site, found $upload_count"
-fi
 
 # These are independent conformance families. An empty K9 corpus must be
 # shown explicitly; missing semantic evidence must not become a green DEED row.
 #
-# Both lanes call metadatastician/standards directly (owner decision,
-# 2026-11-10). A pin that is not a full commit SHA is a float, and two
-# different pins are two standards revisions in one verdict.
-# Print the pin of each call to the named standards lane, one per line. No
-# call is no output, never a failed command: the checks below report it.
-lane_pin() {
-  local lane=$1
-  { grep -E "^    uses: metadatastician/standards/\.github/workflows/${lane}@[0-9a-f]{40}\$" <<<"$caller" || true; } \
-    | sed 's/.*@//'
-}
+# A pin that is not a full commit SHA is a float, and two different pins are
+# two standards revisions in one verdict.
 k9_pin="$(lane_pin 'k9-conformance\.yml')"
 if [[ "$(grep -c . <<<"$k9_pin" || true)" == 1 ]]; then
   pass 'K9 validation calls the standards lane at one immutable commit'
@@ -387,9 +229,33 @@ contains "$caller" 'fail-on-indeterminate: true' \
   'missing K9 semantic evidence fails closed'
 contains "$caller" 'needs: [deed, k9, hypatia]' \
   'the PR verdict waits for all three independent lanes'
-contains "$caller" 'name: k9-grid' 'the K9 artifact remains visible in the PR verdict'
+contains "$caller" 'name: k9-grid' 'the K9 artifact remains visible to the badge job'
 contains "$caller" 'out/k9-grid.json' 'the governance-badges branch publishes the K9 badge'
-contains "$caller" '${K9_VERDICT:-orange}' 'an absent K9 verdict is indeterminate'
+
+# The comment comes from the standards posting engine, so its markers and its
+# order are the ones 3-practice/fork-governance/SPEC.adoc fixes. canon-ref
+# names the renderer commit: a second commit there is a second renderer.
+verdict_pin="$(lane_pin 'fork-governance-reusable\.yml')"
+if [[ "$(grep -c . <<<"$verdict_pin" || true)" == 1 ]]; then
+  pass 'the PR comment comes from the standards posting engine at one immutable commit'
+else
+  fail 'the verdict job must call metadatastician/standards fork-governance-reusable.yml at one full commit SHA'
+fi
+canon_ref="$({ grep -E '^      canon-ref: [0-9a-f]{40}$' <<<"$caller" || true; } | sed 's/.*: //')"
+if [[ -n "$canon_ref" && "$canon_ref" == "$verdict_pin" ]]; then
+  pass 'the comment renderer is the posting engine commit'
+else
+  fail "canon-ref must be the full commit SHA of the posting engine - canon-ref=$canon_ref engine=$verdict_pin"
+fi
+contains "$caller" "if: \${{ always() && github.event_name == 'pull_request' }}" \
+  'the comment is posted even when a lane fails'
+for input in 'deed-result: ${{ needs.deed.result }}' 'k9-result: ${{ needs.k9.result }}' \
+    'k9-verdict: ${{ needs.k9.outputs.verdict }}' 'hypatia-result: ${{ needs.hypatia.result }}' \
+    'hypatia-verdict: ${{ needs.hypatia.outputs.verdict }}' 'hypatia-advisory: ${{ needs.hypatia.outputs.advisory }}'; do
+  contains "$caller" "$input" "the posting engine receives ${input%%:*} from the lane, not a typed value"
+done
+not_contains "$caller" 'gh api -X POST "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments"' \
+  'this workflow has no second comment poster'
 
 secret_workflow="$(cat .github/workflows/secret-scanner.yml)"
 contains "$secret_workflow" 'uses: ./.github/workflows/secret-scanner-reusable.yml' \
@@ -422,29 +288,30 @@ fi
 # `metadatastician` on 2026-10-25 and two lanes went dark that way. On
 # 2026-11-10 the owner decided to permit metadatastician/standards reusables
 # in the policy. The rule below is the durable part: the only cross-owner reusables
-# are the two named standards lanes, each at a full commit SHA. Anything else
+# are the four named standards workflows, each at a full commit SHA. Anything else
 # stays fork-local or owned by the repository owner.
 cross_owner="$(grep -rnE '^[[:space:]]*uses:[[:space:]]+[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+/\.github/workflows/' \
   .github/workflows/ 2>/dev/null \
   | grep -vE 'uses:[[:space:]]+\./\.github/workflows/' \
   | grep -vE 'uses:[[:space:]]+hyperpolymath/' \
-  | grep -vE 'uses:[[:space:]]+metadatastician/standards/\.github/workflows/(deed|k9)-conformance\.yml@[0-9a-f]{40}[[:space:]]*$' || true)"
+  | grep -vE 'uses:[[:space:]]+metadatastician/standards/\.github/workflows/(deed-conformance|k9-conformance|hypatia-scan-reusable|fork-governance-reusable)\.yml@[0-9a-f]{40}[[:space:]]*$' || true)"
 if [ -z "$cross_owner" ]; then
   pass 'every reusable workflow is fork-local, owner-owned or a pinned standards lane'
 else
   fail "a reusable workflow outside the permitted set fails at plan time with no jobs - $cross_owner"
 fi
 
+
 deed_pin="$(lane_pin 'deed-conformance\.yml')"
 if [[ "$(grep -c . <<<"$deed_pin" || true)" == 1 ]]; then
   pass 'DEED validation calls the standards lane at one immutable commit'
 else
   fail 'DEED validation must call metadatastician/standards deed-conformance.yml at one full commit SHA'
 fi
-if [[ -n "$deed_pin" && "$deed_pin" == "$k9_pin" ]]; then
-  pass 'the DEED and K9 lanes use the same standards commit'
+if [[ -n "$deed_pin" && "$deed_pin" == "$k9_pin" && "$deed_pin" == "$hypatia_pin" && "$deed_pin" == "$verdict_pin" ]]; then
+  pass 'the three lanes and the posting engine use the same standards commit'
 else
-  fail "the DEED and K9 lanes must use one standards commit - deed=$deed_pin k9=$k9_pin"
+  fail "the three lanes and the posting engine must use one standards commit - deed=$deed_pin k9=$k9_pin hypatia=$hypatia_pin verdict=$verdict_pin"
 fi
 contains "$caller" 'require-files: true' \
   'a zero-file DEED corpus cannot silently pass'
diff --git a/scripts/filter-hypatia-inherited-language.sh b/scripts/filter-hypatia-inherited-language.sh
deleted file mode 100755
index feee1010..00000000
--- a/scripts/filter-hypatia-inherited-language.sh
+++ /dev/null
@@ -1,141 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: AGPL-3.0-only
-# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
-#
-# Apply the fork-local, upstream-inherited TypeScript exception without mutating
-# Hypatia's raw JSON or SARIF outputs. Only exact allowlisted .ts/.tsx paths and
-# the cicd_rules/banned_language_file rule are affected. CI passes the pinned
-# ijson-jcs CLI to validate raw inputs and canonicalize the effective JSON.
-set -euo pipefail
-
-# Write the command synopsis to standard error and exit the script with status 2.
-usage() {
-  echo "Usage: $0 RAW_FINDINGS.json RAW.sarif ALLOWLIST.txt EFFECTIVE_FINDINGS.json EFFECTIVE.sarif [IJSON_JCS]" >&2
-  exit 2
-}
-
-[[ $# -eq 5 || $# -eq 6 ]] || usage
-raw_findings=$1
-raw_sarif=$2
-allowlist=$3
-effective_findings=$4
-effective_sarif=$5
-canonicalizer=${6:-}
-
-for input in "$raw_findings" "$raw_sarif" "$allowlist"; do
-  if [[ ! -s "$input" ]]; then
-    echo "Required input is missing or empty: $input" >&2
-    exit 1
-  fi
-done
-
-# Print the absolute path for $1 to standard output, followed by a newline.
-# Resolve relative components and symlinks portably, including output paths
-# whose parent directories do not exist yet, without GNU `realpath -m`.
-# Resolution is non-strict: inaccessible components or symlink loops may remain
-# unresolved. Hard-link aliases require the caller's file-identity checks.
-# Python invocation failures propagate as a non-zero exit status.
-canonicalize_path() {
-  # A non-newline sentinel prevents command substitution from trimming the path.
-  python3 -c 'import os, sys; sys.stdout.write(os.path.realpath(sys.argv[1]) + ".")' "$1"
-}
-raw_findings=$(canonicalize_path "$raw_findings")
-raw_findings=${raw_findings%.}
-raw_sarif=$(canonicalize_path "$raw_sarif")
-raw_sarif=${raw_sarif%.}
-allowlist=$(canonicalize_path "$allowlist")
-allowlist=${allowlist%.}
-effective_findings=$(canonicalize_path "$effective_findings")
-effective_findings=${effective_findings%.}
-effective_sarif=$(canonicalize_path "$effective_sarif")
-effective_sarif=${effective_sarif%.}
-for output in "$effective_findings" "$effective_sarif"; do
-  if [[ "$output" == "$raw_findings" || "$output" == "$raw_sarif" || "$output" == "$allowlist" \
-      || "$output" -ef "$raw_findings" || "$output" -ef "$raw_sarif" || "$output" -ef "$allowlist" ]]; then
-    echo "Input, allowlist, and output paths must resolve to distinct files." >&2
-    exit 1
-  fi
-done
-if [[ "$effective_findings" == "$effective_sarif" || "$effective_findings" -ef "$effective_sarif" ]]; then
-  echo "Input, allowlist, and output paths must resolve to distinct files." >&2
-  exit 1
-fi
-
-if [[ -n "$canonicalizer" ]]; then
-  if [[ ! -x "$canonicalizer" ]]; then
-    echo "ijson-jcs canonicalizer is missing or not executable: $canonicalizer" >&2
-    exit 1
-  fi
-  # Validate raw inputs before jq sees them, so unsafe I-JSON numbers or
-  # duplicate keys cannot be silently normalized during the transform.
-  "$canonicalizer" canon < "$raw_findings" >/dev/null
-  "$canonicalizer" canon < "$raw_sarif" >/dev/null
-fi
-jq -e 'type == "array" and all(.[]; type == "object")' "$raw_findings" >/dev/null
-jq -e 'type == "object" and (.runs | type == "array") and all(.runs[]; type == "object" and ((.results // []) | type == "array"))' "$raw_sarif" >/dev/null
-
-tmpdir=$(mktemp -d)
-trap 'rm -rf "$tmpdir"' EXIT
-
-# Comments and blank lines make the tracked allowlist self-documenting.
-jq -Rn '[inputs | sub("\\r$"; "") | select(length > 0) | select((startswith("#")) | not)] | unique' "$allowlist" > "$tmpdir/allowlist.json"
-jq -e 'length > 0 and all(.[]; type == "string" and (startswith("/") | not) and (contains("\\") | not) and (test("(^|/)\\.\\.?(/|$)") | not) and test("\\.(ts|tsx)$"))' "$tmpdir/allowlist.json" >/dev/null
-
-# The input to this step is already repository-relative. Normalize harmless
-# leading ./ and Windows separators, but otherwise require an exact path match.
-jq --argjson allowed "$(cat "$tmpdir/allowlist.json")" '
-  # Yield a path with forward slashes and one leading ./ prefix removed,
-  # including repeated slashes in that prefix. Yield "" for non-string inputs.
-  def norm_path:
-    if type == "string" then gsub("\\\\"; "/") | sub("^\\./+"; "") else "" end;
-  map(
-    . as $finding
-    | (($finding.file // "") | norm_path) as $path
-    | if $finding.rule_module == "cicd_rules"
-         and $finding.type == "banned_language_file"
-         and ($path | test("\\.(ts|tsx)$"))
-         and (($allowed | index($path)) != null)
-      then empty
-      else $finding
-      end
-  )
-' "$raw_findings" > "$tmpdir/effective-findings.json"
-
-jq --argjson allowed "$(cat "$tmpdir/allowlist.json")" '
-  # Yield a path with forward slashes and one leading ./ prefix removed,
-  # including repeated slashes in that prefix. Yield "" for non-string inputs.
-  def norm_path:
-    if type == "string" then gsub("\\\\"; "/") | sub("^\\./+"; "") else "" end;
-  .runs |= map(
-    . as $run
-    | .results = (($run.results // []) | map(
-        . as $result
-        | (($result.locations[0].physicalLocation.artifactLocation.uri // "") | norm_path) as $path
-        | select(
-            (
-              $result.ruleId == "hypatia/cicd_rules/banned_language_file"
-              and ($path | test("\\.(ts|tsx)$"))
-              and (($allowed | index($path)) != null)
-            ) | not
-          )
-      ))
-  )
-' "$raw_sarif" > "$tmpdir/effective.sarif"
-
-if [[ -n "$canonicalizer" ]]; then
-  "$canonicalizer" canon < "$tmpdir/effective-findings.json" > "$tmpdir/effective-findings.jcs.json"
-  "$canonicalizer" check "$tmpdir/effective-findings.jcs.json" >/dev/null
-  mv "$tmpdir/effective-findings.jcs.json" "$tmpdir/effective-findings.json"
-fi
-
-mkdir -p "${effective_findings%/*}" "${effective_sarif%/*}"
-cp "$tmpdir/effective-findings.json" "$effective_findings"
-cp "$tmpdir/effective.sarif" "$effective_sarif"
-
-raw_count=$(jq 'length' "$raw_findings")
-effective_count=$(jq 'length' "$effective_findings")
-if [[ -n "$canonicalizer" ]]; then
-  echo 'Effective findings are I-JSON validated and JCS canonicalized with the supplied pinned ijson-jcs CLI.' >&2
-fi
-printf 'Upstream-inherited TypeScript exception: excluded %d of %d findings; raw scan outputs were preserved.\n' \
-  "$((raw_count - effective_count))" "$raw_count" >&2
diff --git a/scripts/tests/test-governance-contract.sh b/scripts/tests/test-governance-contract.sh
index 8ebbc135..72065e12 100644
--- a/scripts/tests/test-governance-contract.sh
+++ b/scripts/tests/test-governance-contract.sh
@@ -7,7 +7,6 @@ fixture=$(mktemp -d)
 trap 'rm -rf "$fixture"' EXIT
 mkdir -p "$fixture/scripts/ci" "$fixture/config/hypatia" "$fixture/.github/workflows"
 cp "$ROOT/scripts/check-governance-contract.sh" "$fixture/scripts/"
-cp "$ROOT/config/format-tools.toml" "$fixture/config/"
 reset_fixture() {
   cp "$ROOT"/.github/workflows/*.yml "$fixture/.github/workflows/"
   cp "$ROOT/config/hypatia/upstream-typescript-allowlist.txt" "$fixture/config/hypatia/"
@@ -15,23 +14,31 @@ reset_fixture() {
 }
 reset_fixture
 bash "$fixture/scripts/check-governance-contract.sh" > "$fixture/log" 2>&1
-for mutation in allowlist-addition baseline-zero-gate baseline-operator-gate baseline-grouping-gate sarif upstream-exception effective-grid jcs-manifest jcs-canonicalizer raw-ijson k9-pin k9-require k9-indeterminate k9-verdict scanner-advisory scanner-secrets scanner-trigger scorecard-trigger stale-standards-owner scorecard-owner deed-unpinned scorecard-remote lane-pins-split scorecard-source-sha scorecard-no-upload scorecard-quiet-reconcile cross-owner-reusable fleet-unpinned fleet-before-contract fleet-dropped-download fleet-download-after-render fleet-download-fatal fleet-committed-evidence fleet-symlinked-evidence fleet-ignores-cancel stale-standards-remote lock-header-without-lock; do
+for mutation in allowlist-addition sarif-on-pull-request sarif-input-dropped inherited-paths-dropped inherited-paths-elsewhere hypatia-unpinned hypatia-blocking hypatia-stale-copy previous-grid-untrusted verdict-unpinned canon-ref-split canon-ref-floating verdict-typed-result verdict-skips-failures k9-pin k9-require k9-indeterminate scanner-advisory scanner-secrets scanner-trigger scorecard-trigger stale-standards-owner scorecard-owner deed-unpinned scorecard-remote lane-pins-split scorecard-source-sha scorecard-no-upload scorecard-quiet-reconcile cross-owner-reusable fleet-unpinned fleet-before-contract fleet-ignores-cancel stale-standards-remote lock-header-without-lock; do
   reset_fixture
   case "$mutation" in
     allowlist-addition) echo 'frontend/src/fork-only.ts' >> "$fixture/config/hypatia/upstream-typescript-allowlist.txt" ;;
-    baseline-zero-gate) sed -i "/- name: Gate on baseline/,/^[[:space:]]*run:/ s@^        if: .*@        if: '!inputs.block-on-high \\&\\& steps.inherited-language.outputs.findings_count > 0'@" "$fixture/.github/workflows/hypatia-scan-reusable.yml" ;;
-    baseline-operator-gate) sed -i '/- name: Gate on baseline/,/^[[:space:]]*run:/ s/ || / \&\& /' "$fixture/.github/workflows/hypatia-scan-reusable.yml" ;;
-    baseline-grouping-gate) sed -i '/- name: Gate on baseline/,/^[[:space:]]*run:/ { s/&& (steps/\&\& steps/; s/)\x27$/\x27/; }' "$fixture/.github/workflows/hypatia-scan-reusable.yml" ;;
-    sarif) sed -i "/if: github.event_name != 'pull_request'/d" "$fixture/.github/workflows/hypatia-scan-reusable.yml" ;;
-    upstream-exception) sed -i 's@bash scripts/filter-hypatia-inherited-language.sh@bash scripts/no-op-filter.sh@' "$fixture/.github/workflows/hypatia-scan-reusable.yml" ;;
-    effective-grid) sed -i '/- name: Render the verdict grid/,/- name: Upload the verdict grid/s/hypatia-findings.effective.json/hypatia-findings.relativized.json/g' "$fixture/.github/workflows/hypatia-scan-reusable.yml" ;;
-    jcs-manifest) sed -i '/- name: Read the pinned ijson-jcs identity/,/- name: Cache the pinned ijson-jcs binary/s@config/format-tools.toml@config/other-tools.toml@' "$fixture/.github/workflows/hypatia-scan-reusable.yml" ;;
-    jcs-canonicalizer) sed -i '/- name: Apply upstream-inherited TypeScript exception/,/- name: Restore panic-attack build cache/s@"$HOME/.cargo/bin/ijson-jcs"@@' "$fixture/.github/workflows/hypatia-scan-reusable.yml" ;;
-    raw-ijson) sed -i '/- name: Validate findings and count severities/,/- name: Relativize finding paths/s@"$HOME/.cargo/bin/ijson-jcs" canon < hypatia-findings.json > /dev/null@@' "$fixture/.github/workflows/hypatia-scan-reusable.yml" ;;
+    # The Hypatia lane is the standards lane, called directly. The two opt-in
+    # inputs are what the fork-local copy existed for: without the first, a
+    # pull request gets a second, blocking code-scanning check; without the
+    # second, every upstream TypeScript file grades as a banned language.
+    sarif-on-pull-request) sed -i 's/^      sarif-upload-on-pull-request: false$/      sarif-upload-on-pull-request: true/' "$fixture/.github/workflows/hypatia-scan.yml" ;;
+    sarif-input-dropped) sed -i '/^      sarif-upload-on-pull-request: false$/d' "$fixture/.github/workflows/hypatia-scan.yml" ;;
+    inherited-paths-dropped) sed -i '/^      inherited-language-paths: /d' "$fixture/.github/workflows/hypatia-scan.yml" ;;
+    inherited-paths-elsewhere) sed -i 's|^      inherited-language-paths: .*|      inherited-language-paths: config/hypatia/other-list.txt|' "$fixture/.github/workflows/hypatia-scan.yml" ;;
+    hypatia-unpinned) sed -i -E 's|(hypatia-scan-reusable\.yml)@[0-9a-f]{40}|\1@main|' "$fixture/.github/workflows/hypatia-scan.yml" ;;
+    hypatia-blocking) sed -i 's/^      sarif-upload-on-pull-request: false$/&\n      block-on-high: true/' "$fixture/.github/workflows/hypatia-scan.yml" ;;
+    hypatia-stale-copy) echo 'name: stale copy' > "$fixture/.github/workflows/hypatia-scan-reusable.yml" ;;
+    previous-grid-untrusted) sed -i 's/(.user.login \/\/ "") == "github-actions\[bot\]"/true/' "$fixture/.github/workflows/hypatia-scan.yml" ;;
+    # One comment, from the standards posting engine, rendered at the lane pin.
+    verdict-unpinned) sed -i -E 's|(fork-governance-reusable\.yml)@[0-9a-f]{40}|\1@main|' "$fixture/.github/workflows/hypatia-scan.yml" ;;
+    canon-ref-split) sed -i -E 's|^      canon-ref: [0-9a-f]{40}$|      canon-ref: 75bd5994470661a099df562d6d5ad2fe744dbd66|' "$fixture/.github/workflows/hypatia-scan.yml" ;;
+    canon-ref-floating) sed -i -E 's|^      canon-ref: [0-9a-f]{40}$|      canon-ref: main|' "$fixture/.github/workflows/hypatia-scan.yml" ;;
+    verdict-typed-result) sed -i 's|hypatia-result: ${{ needs.hypatia.result }}|hypatia-result: success|' "$fixture/.github/workflows/hypatia-scan.yml" ;;
+    verdict-skips-failures) sed -i "s|if: \${{ always() \&\& github.event_name == 'pull_request' }}|if: \${{ github.event_name == 'pull_request' }}|" "$fixture/.github/workflows/hypatia-scan.yml" ;;
     k9-pin) sed -i -E 's|(k9-conformance\.yml)@[0-9a-f]{40}|\1@main|' "$fixture/.github/workflows/hypatia-scan.yml" ;;
     k9-require) sed -i 's/require-files: true/require-files: false/g' "$fixture/.github/workflows/hypatia-scan.yml" ;;
     k9-indeterminate) sed -i 's/fail-on-indeterminate: true/fail-on-indeterminate: false/' "$fixture/.github/workflows/hypatia-scan.yml" ;;
-    k9-verdict) sed -i 's/${K9_VERDICT:-orange}/${K9_VERDICT:-green}/' "$fixture/.github/workflows/hypatia-scan.yml" ;;
     scanner-advisory) echo '    continue-on-error: true' >> "$fixture/.github/workflows/secret-scanner.yml" ;;
     scanner-secrets) echo '    secrets: inherit' >> "$fixture/.github/workflows/secret-scanner.yml" ;;
     scanner-trigger) sed -i 's/^  pull_request:/  pull_request_target:/' "$fixture/.github/workflows/secret-scanner.yml" ;;
@@ -51,15 +58,10 @@ for mutation in allowlist-addition baseline-zero-gate baseline-operator-gate bas
     lane-pins-split) sed -i -E 's|(deed-conformance\.yml)@[0-9a-f]{40}|\1@75bd5994470661a099df562d6d5ad2fe744dbd66|' "$fixture/.github/workflows/hypatia-scan.yml" ;;
     scorecard-remote) sed -i 's|uses: ./.github/workflows/scorecard-reusable.yml|uses: metadatastician/standards/.github/workflows/scorecard-reusable.yml@c6d78606f3928c22c3b0bdc6f5f5b47b96e05a5d|' "$fixture/.github/workflows/scorecard.yml" ;;
     cross-owner-reusable) sed -i -E 's|uses: metadatastician/standards/\.github/workflows/k9-conformance\.yml@[0-9a-f]{40}|uses: someone/else/.github/workflows/k9.yml@main|' "$fixture/.github/workflows/hypatia-scan.yml" ;;
-    # Fork delta 4: the fleet report-backs must come from an immutable gitbot-fleet
-    # commit, be downloaded before the grid renders, and never kill the lane.
+    # The fleet report-backs must come from an immutable gitbot-fleet commit and
+    # never kill the lane. The standards lane downloads them before the grid.
     fleet-unpinned) sed -i -E 's|(fleet-report-back-reusable\.yml)@[0-9a-f]{40}|\1@main|' "$fixture/.github/workflows/hypatia-scan.yml" ;;
-    fleet-before-contract) sed -i 's|needs: \[workflow-contract, fleet\]|needs: [fleet]|' "$fixture/.github/workflows/hypatia-scan.yml" ;;
-    fleet-dropped-download) sed -i '/^      - name: Download the fleet report-backs$/,/^          path: .gitbot-fleet\/report-backs$/d' "$fixture/.github/workflows/hypatia-scan-reusable.yml" ;;
-    fleet-download-after-render) awk '/^      - name: Download the fleet report-backs$/{hold=1} hold && /^      - name: Render the verdict grid$/{hold=0; print; printf "%s", buf; buf=""; next} hold{buf=buf $0 "\n"; next} {print}' "$fixture/.github/workflows/hypatia-scan-reusable.yml" > "$fixture/reordered.yml" && mv "$fixture/reordered.yml" "$fixture/.github/workflows/hypatia-scan-reusable.yml" ;;
-    fleet-download-fatal) sed -i '/^      - name: Download the fleet report-backs$/,/^          path: .gitbot-fleet\/report-backs$/{/continue-on-error: true/d}' "$fixture/.github/workflows/hypatia-scan-reusable.yml" ;;
-    fleet-committed-evidence) sed -i '/^      - name: Clear any checked-out fleet report-backs$/,/-exec rm -rf -- {} +$/d' "$fixture/.github/workflows/hypatia-scan-reusable.yml" ;;
-    fleet-symlinked-evidence) sed -i "s|-mindepth 1 -maxdepth 1 -name '\*.json' -print -exec rm -rf -- {} +|-maxdepth 1 -name '*.json' -type f -print -delete|" "$fixture/.github/workflows/hypatia-scan-reusable.yml" ;;
+    fleet-before-contract) sed -i 's|needs: \[workflow-contract, fleet, previous-grid\]|needs: [fleet]|' "$fixture/.github/workflows/hypatia-scan.yml" ;;
     fleet-ignores-cancel) sed -i "s|if: \${{ !cancelled() \&\& needs.workflow-contract.result == 'success' }}|if: \${{ always() \&\& needs.workflow-contract.result == 'success' }}|" "$fixture/.github/workflows/hypatia-scan.yml" ;;
     # A script that fetches by URL keeps working across a transfer's redirect
     # while naming an owner that no longer holds the repository: a coordinate
@@ -93,10 +95,19 @@ for mutation in allowlist-addition baseline-zero-gate baseline-operator-gate bas
     grep -Fq 'ERROR: DEED validation must call metadatastician/standards deed-conformance.yml at one full commit SHA' "$fixture/log"
   fi
   if [[ "$mutation" == lane-pins-split ]]; then
-    grep -Fq 'ERROR: the DEED and K9 lanes must use one standards commit' "$fixture/log"
+    grep -Fq 'ERROR: the three lanes and the posting engine must use one standards commit' "$fixture/log"
   fi
-  if [[ "$mutation" == baseline-*-gate ]]; then
-    grep -Fq 'ERROR: the advisory baseline gate requires nonblocking mode and either findings or a committed baseline' "$fixture/log"
+  if [[ "$mutation" == sarif-on-pull-request || "$mutation" == sarif-input-dropped ]]; then
+    grep -Fq 'ERROR: the Hypatia lane must set sarif-upload-on-pull-request: false' "$fixture/log"
+  fi
+  if [[ "$mutation" == inherited-paths-* ]]; then
+    grep -Fq 'ERROR: the Hypatia lane must set inherited-language-paths: config/hypatia/upstream-typescript-allowlist.txt' "$fixture/log"
+  fi
+  if [[ "$mutation" == hypatia-unpinned ]]; then
+    grep -Fq 'ERROR: the Hypatia lane must call metadatastician/standards hypatia-scan-reusable.yml at one full commit SHA' "$fixture/log"
+  fi
+  if [[ "$mutation" == canon-ref-* ]]; then
+    grep -Fq 'ERROR: canon-ref must be the full commit SHA of the posting engine' "$fixture/log"
   fi
   echo "ok - rejected $mutation"
 done
diff --git a/scripts/tests/test-hypatia-inherited-language-exception.sh b/scripts/tests/test-hypatia-inherited-language-exception.sh
deleted file mode 100755
index 9e9e6563..00000000
--- a/scripts/tests/test-hypatia-inherited-language-exception.sh
+++ /dev/null
@@ -1,238 +0,0 @@
-#!/usr/bin/env bash
-# Tests the narrow upstream-inherited TypeScript exception for both Hypatia
-# findings JSON and SARIF, including the negative cases that must remain visible.
-set -euo pipefail
-
-ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
-FILTER="$ROOT_DIR/scripts/filter-hypatia-inherited-language.sh"
-canonicalizer_arg=${IJSON_JCS:-}
-if [[ -n "$canonicalizer_arg" && ! -x "$canonicalizer_arg" ]]; then
-  echo "IJSON_JCS is not executable: $canonicalizer_arg" >&2
-  exit 1
-fi
-tmpdir=$(mktemp -d)
-trap 'rm -rf "$tmpdir"' EXIT
-
-cat > "$tmpdir/allowlist.txt" <<'EOF'
-# Test snapshot
-frontend/src/App.tsx
-frontend/src/api/client.ts
-EOF
-cp "$tmpdir/allowlist.txt" "$tmpdir/allowlist.original.txt"
-
-cat > "$tmpdir/raw-findings.json" <<'EOF'
-[
-  {"rule_module":"cicd_rules","type":"banned_language_file","file":"./frontend/src/App.tsx","severity":"critical"},
-  {"rule_module":"cicd_rules","type":"banned_language_file","file":"frontend/src/api/client.ts","severity":"critical"},
-  {"rule_module":"cicd_rules","type":"banned_language_file","file":"frontend/src/utils/text.test.ts","severity":"critical"},
-  {"rule_module":"code_safety","type":"unsafe_call","file":"frontend/src/App.tsx","severity":"high"},
-  {"rule_module":"cicd_rules","type":"banned_language_file","file":"scripts/new-tool.py","severity":"high"}
-]
-EOF
-
-cat > "$tmpdir/raw.sarif" <<'EOF'
-{
-  "version": "2.1.0",
-  "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
-  "runs": [{
-    "tool": {"driver": {"name": "Hypatia"}},
-    "results": [
-      {"ruleId":"hypatia/cicd_rules/banned_language_file","locations":[{"physicalLocation":{"artifactLocation":{"uri":"./frontend/src/App.tsx"}}}]},
-      {"ruleId":"hypatia/cicd_rules/banned_language_file","locations":[{"physicalLocation":{"artifactLocation":{"uri":"frontend/src/api/client.ts"}}}]},
-      {"ruleId":"hypatia/cicd_rules/banned_language_file","locations":[{"physicalLocation":{"artifactLocation":{"uri":"frontend/src/utils/text.test.ts"}}}]},
-      {"ruleId":"hypatia/code_safety/unsafe_call","locations":[{"physicalLocation":{"artifactLocation":{"uri":"frontend/src/App.tsx"}}}]},
-      {"ruleId":"hypatia/cicd_rules/banned_language_file","locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/new-tool.py"}}}]}
-    ]
-  }]
-}
-EOF
-
-cp "$tmpdir/raw-findings.json" "$tmpdir/raw-findings.original.json"
-cp "$tmpdir/raw.sarif" "$tmpdir/raw.original.sarif"
-bash "$FILTER" \
-  "$tmpdir/raw-findings.json" \
-  "$tmpdir/raw.sarif" \
-  "$tmpdir/allowlist.txt" \
-  "$tmpdir/effective-findings.json" \
-  "$tmpdir/effective.sarif" \
-  "$canonicalizer_arg"
-if [[ -n "${IJSON_JCS:-}" ]]; then
-  "$IJSON_JCS" check "$tmpdir/effective-findings.json" >/dev/null
-fi
-
-# Only the two exact inherited TypeScript paths are removed from findings.
-jq -e 'length == 3' "$tmpdir/effective-findings.json" >/dev/null
-jq -e 'any(.[]; .file == "frontend/src/utils/text.test.ts" and .rule_module == "cicd_rules" and .type == "banned_language_file")' "$tmpdir/effective-findings.json" >/dev/null
-jq -e 'any(.[]; .file == "frontend/src/App.tsx" and .rule_module == "code_safety")' "$tmpdir/effective-findings.json" >/dev/null
-jq -e 'any(.[]; .file == "scripts/new-tool.py" and .type == "banned_language_file")' "$tmpdir/effective-findings.json" >/dev/null
-jq -e 'all(.[]; .file != "./frontend/src/App.tsx" and .file != "frontend/src/api/client.ts" or .rule_module != "cicd_rules" or .type != "banned_language_file")' "$tmpdir/effective-findings.json" >/dev/null
-
-# The corresponding SARIF filter has the same narrow scope.
-jq -e '.runs[0].results | length == 3' "$tmpdir/effective.sarif" >/dev/null
-jq -e '[.runs[0].results[] | select(.ruleId == "hypatia/cicd_rules/banned_language_file" and .locations[0].physicalLocation.artifactLocation.uri == "frontend/src/utils/text.test.ts")] | length == 1' "$tmpdir/effective.sarif" >/dev/null
-jq -e '[.runs[0].results[] | select(.ruleId == "hypatia/code_safety/unsafe_call")] | length == 1' "$tmpdir/effective.sarif" >/dev/null
-jq -e '[.runs[0].results[] | select(.ruleId == "hypatia/cicd_rules/banned_language_file" and .locations[0].physicalLocation.artifactLocation.uri == "scripts/new-tool.py")] | length == 1' "$tmpdir/effective.sarif" >/dev/null
-
-# Exercise the committed upstream snapshot itself: App.tsx is inherited, while
-# the fork-only test file is intentionally absent from the allowlist.
-cat > "$tmpdir/repo-findings.json" <<'EOF'
-[
-  {"rule_module":"cicd_rules","type":"banned_language_file","file":"frontend/src/App.tsx","severity":"critical"},
-  {"rule_module":"cicd_rules","type":"banned_language_file","file":"frontend/src/utils/text.test.ts","severity":"critical"}
-]
-EOF
-cat > "$tmpdir/repo.sarif" <<'EOF'
-{
-  "version": "2.1.0",
-  "runs": [{"results": [
-    {"ruleId":"hypatia/cicd_rules/banned_language_file","locations":[{"physicalLocation":{"artifactLocation":{"uri":"frontend/src/App.tsx"}}}]},
-    {"ruleId":"hypatia/cicd_rules/banned_language_file","locations":[{"physicalLocation":{"artifactLocation":{"uri":"frontend/src/utils/text.test.ts"}}}]}
-  ]}]
-}
-EOF
-bash "$FILTER" \
-  "$tmpdir/repo-findings.json" \
-  "$tmpdir/repo.sarif" \
-  "$ROOT_DIR/config/hypatia/upstream-typescript-allowlist.txt" \
-  "$tmpdir/repo-effective-findings.json" \
-  "$tmpdir/repo-effective.sarif" \
-  "$canonicalizer_arg"
-if [[ -n "${IJSON_JCS:-}" ]]; then
-  "$IJSON_JCS" check "$tmpdir/repo-effective-findings.json" >/dev/null
-fi
-jq -e 'length == 1 and .[0].file == "frontend/src/utils/text.test.ts"' "$tmpdir/repo-effective-findings.json" >/dev/null
-jq -e '.runs[0].results | length == 1 and .[0].locations[0].physicalLocation.artifactLocation.uri == "frontend/src/utils/text.test.ts"' "$tmpdir/repo-effective.sarif" >/dev/null
-
-# The source artifacts are immutable audit evidence.
-cmp "$tmpdir/raw-findings.json" "$tmpdir/raw-findings.original.json"
-cmp "$tmpdir/raw.sarif" "$tmpdir/raw.original.sarif"
-
-# Every output/input pairing must reject aliases before writing either output.
-mkdir -p "$tmpdir/child"
-ln -s "$tmpdir" "$tmpdir/parent-alias"
-for raw in raw-findings.json raw.sarif; do
-  ln -s "$tmpdir/$raw" "$tmpdir/symlink-$raw"
-  ln "$tmpdir/$raw" "$tmpdir/hardlink-$raw"
-  for alias in "$tmpdir/$raw" "$tmpdir/./$raw" "$tmpdir/child/../$raw" \
-      "$tmpdir/parent-alias/$raw" "$tmpdir/symlink-$raw" "$tmpdir/hardlink-$raw"; do
-    for output_kind in findings sarif; do
-      printf 'untouched companion output\n' > "$tmpdir/companion"
-      cp "$tmpdir/companion" "$tmpdir/companion.original"
-      outputs=("$alias" "$tmpdir/companion")
-      if [[ "$output_kind" == sarif ]]; then
-        outputs=("$tmpdir/companion" "$alias")
-      fi
-      if bash "$FILTER" "$tmpdir/raw-findings.json" "$tmpdir/raw.sarif" \
-          "$tmpdir/allowlist.txt" "${outputs[@]}" "$canonicalizer_arg" > "$tmpdir/collision.log" 2>&1; then
-        echo "ERROR: accepted $output_kind output colliding with $alias" >&2
-        exit 1
-      fi
-      grep -Fq 'Input, allowlist, and output paths must resolve to distinct files.' "$tmpdir/collision.log"
-      cmp "$tmpdir/raw-findings.json" "$tmpdir/raw-findings.original.json"
-      cmp "$tmpdir/raw.sarif" "$tmpdir/raw.original.sarif"
-      cmp "$tmpdir/companion" "$tmpdir/companion.original"
-    done
-  done
-done
-
-# The allowlist is a protected input just like the raw scanner artifacts.
-ln -s "$tmpdir/allowlist.txt" "$tmpdir/symlink-allowlist.txt"
-ln "$tmpdir/allowlist.txt" "$tmpdir/hardlink-allowlist.txt"
-for alias in "$tmpdir/allowlist.txt" "$tmpdir/./allowlist.txt" \
-    "$tmpdir/symlink-allowlist.txt" "$tmpdir/hardlink-allowlist.txt"; do
-  for output_kind in findings sarif; do
-    printf 'untouched companion output\n' > "$tmpdir/companion"
-    cp "$tmpdir/companion" "$tmpdir/companion.original"
-    outputs=("$alias" "$tmpdir/companion")
-    if [[ "$output_kind" == sarif ]]; then
-      outputs=("$tmpdir/companion" "$alias")
-    fi
-    if bash "$FILTER" "$tmpdir/raw-findings.json" "$tmpdir/raw.sarif" \
-        "$tmpdir/allowlist.txt" "${outputs[@]}" "$canonicalizer_arg" > "$tmpdir/collision.log" 2>&1; then
-      echo "ERROR: accepted $output_kind output colliding with allowlist alias $alias" >&2
-      exit 1
-    fi
-    grep -Fq 'Input, allowlist, and output paths must resolve to distinct files.' "$tmpdir/collision.log"
-    cmp "$tmpdir/allowlist.txt" "$tmpdir/allowlist.original.txt"
-    cmp "$tmpdir/raw-findings.json" "$tmpdir/raw-findings.original.json"
-    cmp "$tmpdir/raw.sarif" "$tmpdir/raw.original.sarif"
-    cmp "$tmpdir/companion" "$tmpdir/companion.original"
-  done
-done
-
-# Canonicalize raw input aliases too, and reject aliased effective outputs.
-for collision in raw-alias output-alias; do
-  inputs=("$tmpdir/raw-findings.json" "$tmpdir/raw.sarif")
-  outputs=("$tmpdir/companion" "$tmpdir/./companion")
-  if [[ "$collision" == raw-alias ]]; then
-    inputs=("$tmpdir/symlink-raw-findings.json" "$tmpdir/symlink-raw.sarif")
-    outputs=("$tmpdir/raw-findings.json" "$tmpdir/companion")
-  fi
-  if bash "$FILTER" "${inputs[@]}" "$tmpdir/allowlist.txt" \
-      "${outputs[@]}" "$canonicalizer_arg" > "$tmpdir/collision.log" 2>&1; then
-    echo "ERROR: accepted $collision collision" >&2
-    exit 1
-  fi
-  grep -Fq 'Input, allowlist, and output paths must resolve to distinct files.' "$tmpdir/collision.log"
-  cmp "$tmpdir/raw-findings.json" "$tmpdir/raw-findings.original.json"
-  cmp "$tmpdir/raw.sarif" "$tmpdir/raw.original.sarif"
-  cmp "$tmpdir/companion" "$tmpdir/companion.original"
-done
-
-# Missing output directories remain supported after canonicalization.
-bash "$FILTER" "$tmpdir/raw-findings.json" "$tmpdir/raw.sarif" \
-  "$tmpdir/allowlist.txt" "$tmpdir/new/findings/effective.json" \
-  "$tmpdir/new/sarif/effective.sarif" "$canonicalizer_arg"
-cmp "$tmpdir/effective-findings.json" "$tmpdir/new/findings/effective.json"
-cmp "$tmpdir/effective.sarif" "$tmpdir/new/sarif/effective.sarif"
-echo 'PASS: path collisions are rejected before writes; distinct new output paths remain supported.'
-
-# Command substitution must preserve every trailing newline in resolved paths.
-for suffix in $'\n' $'\n\n'; do
-  inputs=("$tmpdir/raw-findings.json$suffix" "$tmpdir/raw.sarif$suffix" "$tmpdir/allowlist.txt$suffix")
-  cp "$tmpdir/raw-findings.original.json" "${inputs[0]}"
-  cp "$tmpdir/raw.original.sarif" "${inputs[1]}"
-  cp "$tmpdir/allowlist.original.txt" "${inputs[2]}"
-  outputs=("$tmpdir/newline$suffix/effective-findings.json$suffix" "$tmpdir/newline$suffix/effective.sarif$suffix")
-  bash "$FILTER" "${inputs[@]}" "${outputs[@]}" "$canonicalizer_arg"
-  cmp "$tmpdir/effective-findings.json" "${outputs[0]}"
-  cmp "$tmpdir/effective.sarif" "${outputs[1]}"
-  cmp "$tmpdir/raw-findings.original.json" "${inputs[0]}"
-  cmp "$tmpdir/raw.original.sarif" "${inputs[1]}"
-  cmp "$tmpdir/allowlist.original.txt" "${inputs[2]}"
-  [[ ! -e "${outputs[0]%$suffix}" && ! -e "${outputs[1]%$suffix}" ]]
-
-  # Symlinks to newline-terminated input names must still be protected.
-  ln -sf "${inputs[0]}" "$tmpdir/newline-alias"
-  if bash "$FILTER" "${inputs[@]}" "$tmpdir/newline-alias" "${outputs[1]}" \
-      "$canonicalizer_arg" > "$tmpdir/collision.log" 2>&1; then
-    echo 'ERROR: accepted an output aliasing an input with trailing newlines' >&2
-    exit 1
-  fi
-  grep -Fq 'Input, allowlist, and output paths must resolve to distinct files.' "$tmpdir/collision.log"
-  cmp "$tmpdir/raw-findings.original.json" "${inputs[0]}"
-  cmp "$tmpdir/effective.sarif" "${outputs[1]}"
-done
-echo 'PASS: trailing newlines in input and output paths are preserved and aliases remain protected.'
-
-# Simulate macOS/BSD environments where GNU `realpath -m` is unavailable.
-mkdir -p "$tmpdir/no-realpath-bin"
-cat > "$tmpdir/no-realpath-bin/realpath" <<'EOF'
-#!/bin/sh
-echo 'ERROR: GNU realpath must not be required' >&2
-exit 127
-EOF
-chmod +x "$tmpdir/no-realpath-bin/realpath"
-PATH="$tmpdir/no-realpath-bin:$PATH" bash "$FILTER" \
-  "$tmpdir/raw-findings.json" "$tmpdir/raw.sarif" "$tmpdir/allowlist.txt" \
-  "$tmpdir/portable/findings/effective.json" "$tmpdir/portable/sarif/effective.sarif" \
-  "$canonicalizer_arg"
-cmp "$tmpdir/effective-findings.json" "$tmpdir/portable/findings/effective.json"
-cmp "$tmpdir/effective.sarif" "$tmpdir/portable/sarif/effective.sarif"
-echo 'PASS: path resolution works without a GNU realpath executable.'
-
-if [[ -n "$canonicalizer_arg" ]]; then
-  echo "PASS: inherited TypeScript paths are narrowly filtered; raw, fork-only, and unrelated findings remain; effective JSON is I-JSON/JCS checked."
-else
-  echo "PASS: inherited TypeScript paths are narrowly filtered; raw, fork-only, and unrelated findings remain (JCS check skipped: no ijson-jcs CLI supplied)."
-fi