v1.3.2 — three live FPs from one field report: bystander rule-fire, immortal ledger nags, diagnosis-only asks

1. A compiled rule fired 🔴 on an untracked BYSTANDER file: the Stop path
   fed runCompiledRules the wider scanDiff, whose untracked-content merge
   exists for the SECURITY scanners — so no-commit-local-only-files matched
   the shebang of scripts/dev-server.mjs, a file never committed, staged, or
   edited that session. Rules now grade the AUTHORED reality only (git diff +
   tool ledger + MCP SQL); documented trade: a Bash-heredoc-authored file
   dodges doc rules in-session (security scanners + pre-commit/CI still see
   it). End-to-end regression through the real Stop path, both directions.

2. The task ledger never healed: tier was backfilled only when null, so a
   task minted HARD by a PRE-v1.2.1 classifier (t1d7d, "I do have image
   attirbutions.md…") nagged for 300+ turns after the classifier was fixed.
   tier + deliverable are now RE-DERIVED every turn (idempotent) and an ask
   yielding no deliverables is reaped — every classifier fix is now
   retroactive. Reap is TWO-PHASE (minted keys win) after review found the
   100-char truncation-key collision could silently delete another ask's
   live task, order-dependently.

3. A DIAGNOSIS-ONLY ask minted unclosable HARD deliverables (t7dep,
   "…Game.js has been modified heavily… Can you see what is happening"):
   passive-voice REQUEST verbs read as commands, and the correct outcome was
   an EMPTY diff (the agent restored the file). New ask-wide diagnosisOnly
   gate: no active REQUEST verb (passive phrases + determiner-preceded
   verb-nouns blanked) AND a question/read/verify clause → all tokens soft.
   The 4th instance of the v1.0.5/v1.2.1/v1.3.1 unclosable-wedge root defect.

Adversarial review (Fable): CHANGES REQUIRED → fixed → APPROVED. Findings:
2^n backtracking in PASSIVE_VOICE_RE ('recently' vs \w+ly ambiguity, 57 s
at 28 reps — would wedge every Stop after one poisoned paste); the reap
collision above; gate-boundary FN (EXTRA_REQUEST_VERB_RE, scoped to the
gate's off-switch so it can only restore pre-fix behavior, never mint).

Healing verified against the REAL hindsight ledger: t1d7d + t7dep re-derive
to soft and stale out silently; tzjeb (genuinely deferred work) stays
pending. Self-check 702 → 726; red-team 14/14; corpus unchanged (17/23).

Co-Authored-By: Claude Fable 5 noreply@anthropic.com

Full symptom → root-cause → fix → regression-test in FIXES.md (v1.3.2).