docs(getff-freshness-widening): S0 — fold the trace umbrella's routed-onward residuals into the kickoff

[artyhoo]

What

Stage S0 of getff-freshness-widening: the umbrella kickoff was authored before its upstream (getff-any-stack-trace) finished, and its own §0 re-plan rule obliges folding that umbrella's landed diffs + done.md residuals before S1 dispatch. Seven corrections, one file.

#	Correction	Evidence
D1	S4 said «js/rust parity»; done.md routed «cargo + go» here. Go lane added to scope.	setup.d/47-go.sh, packages/core/backends/golangci/, PR #1236
D2	--refresh routed here by R1 §5.1, named in no stage → own stage S4b	§1 binds one PR per stage; S4 already carries three lanes + fixture debt
D3	cargo rung-5 cascade named as its own S4 deliverable	done.md routed-onward list, distinct item
D4	S5 said «RE-RUN» a protocol that never ran → «FIRST run», host-only, re-park over a warm run	done.md: «RUN — PARKED … the RUN defers to the host»
D5	«byte-identity gate across ALL THREE copies» named a nonexistent mechanism	deps-hash-check.test.ts:515-527 compares two files; grep -n plugin → 0 hits; third copy generated by scripts/generate-plugin-twins.sh via .husky/pre-commit:155-166
D6	fail-closed — no host-verify contract (exit 2)	now §4, three commands each traced to a §2 «works» criterion
D7	fail-closed — no park contract → autonomous dispatch blocked	now §5

Why this landed from the host, not the container

S0 was dispatched to aif (task 6cfa9c79). The worker did the full verification pass and independently confirmed every one of D1–D7 — then hit a hard wall: Claude Code refuses writes to .claude/** paths inside the container (every channel — Edit, Write, Bash heredoc; filesystem permissions are fine). It correctly parked rather than guessing or faking, and its reviewer independently verified the block and returned a Blocking verdict. Zero commits, clean tree.

Two things follow, both recorded in the kickoff's new §5:

1. S2 hits the same wall — it must edit .claude/hooks/deps-hash-check.sh. It is not container-dispatchable as written; route it to a host session or pre-authorize the path.
2. The task nonetheless reached status=done with manualReviewRequired=false despite a BLOCKER in its log and a Blocking review verdict. A park-flag watcher cannot be trusted as the only stall detector.

Verification (on this host)

bash scripts/host-verify.sh getff-freshness-widening        → 3/3 PASS, exit 0   (was exit 2)
grep -qi 'park it as a question' <kickoff>                  → present            (was absent)
npx vitest run packages/core/hooks/check-kickoff-traps.test.ts → 52/52
npx vitest run packages/core/principles/12-ai-laziness-traps.test.ts → 7/7
git status --porcelain                                      → exactly one file

Parked questions

None outstanding. The pre-registered park candidate — D5, the plugin-twin's real guarding mechanism — was resolved with evidence rather than parked: the twin is auto-generated (scripts/generate-plugin-twins.sh, wired at .husky/pre-commit:155-166), and its md5 delta from the source is exactly the injected # AUTO-GENERATED header — diff <(sed '2d' plugin/hooks/deps-hash-check) .claude/hooks/deps-hash-check.sh is empty. The hook header's «3-way guard» is therefore imprecise, not false: two mechanisms, not one gate.

Noted, deliberately not fixed here (one concern per PR): that pre-commit channel is author-side and skippable — a --no-verify commit, or a machine where make install-hooks never ran, leaves the twin stale. Real but out of this umbrella's scope.

§1.7 Skipped: dispatch-input correction only — this PR edits one kickoff.md under .claude/orchestrator-prompts/, a path outside the §4b discipline-bearing list (no rule, principle, template, skill, agent, CLAUDE.md or SSOT surface is touched); the change makes the kickoff match already-landed upstream state rather than introducing any new discipline.

Fidelity verdict

FIDELITY: skipped — no ## Provenance substrate is declared for this PR: the aif dispatch produced zero commits (hard-blocked on .claude/** writes) and the diff was authored on the host, so there is no container-produced work for a fidelity auditor to compare against the spec. The stage's own six acceptance criteria are quoted with their host output above.