fix(getff-freshness-widening): S1b — close the two round-3 MINORs (emitted proof corpus · shipped-layer narrative)

[artyhoo]

Summary

Closes the two MINOR findings the round-3 cold fidelity audit recorded against getff-freshness-widening S1b. Both were deliberately left out of #1353 because folding them in would have moved the PR head off the audited SHA (packages/core/hooks/checks/pr-body-fidelity.ts:165 requires Audited-SHA to prefix the head), so they land here as a follow-up. Neither changes behaviour: one restores fidelity between a proof fixture and the artefact it certifies, the other removes review narrative from a file that ships to consumers.

Changes

• MINOR 1 — the M1 proof corpus is emitted, not copied (tests/install-sh/python-rules-lock.test.sh). Arm (13) hand-built its five synthetic locks, joining rule objects with },{ while the real emitter joins with }, { (_py_json_rules builds the separator as out="$out, ", setup.d/45-python.sh:534). The auditor verified the byte is non-load-bearing today — identical verdicts on both shapes — but a proof fixture one byte off the artefact it certifies is #sync-by-copy-paste (dual-implementation-discipline.md §8) at the fixture level, and is what hides the next boundary defect. Rather than re-synchronise the copy, the copy is removed: each case now calls the real _py_json_rules through the existing PY_LAYER_LIB_ONLY=1 seam against a synthetic generation-context fragment dir, so the separator, the {"id":…,"provenance":[],"tier":2} fallback object and the "rules": …, framing are the artefact's own bytes by construction.
• New corpus-precondition arm. An emitted corpus can fail to materialise (broken seam, renamed _py_json_rules) in a way a hand-written one could not; five empty files would make every grep miss and read as a regex defect. The guard sends the next reader at the seam, not at the pattern (attention-is-not-a-mechanism §1).
• MINOR 2 — audit-round retelling dropped from a shipped layer (setup.d/45-python.sh:518-521). The _py_json_rules docstring retold the round-2 audit ("it said «line 648» while the same hunk … pushed the caller to 654") inside a file installed into consumer projects. The substantive repair — naming _py_write_rules_lock instead of a line number — stays untouched; only the retelling is removed, with the surviving rationale restated in the consumer's terms.

Criterion 3's discriminating power is preserved, not simplified away

The stage constraint was explicit: on the current fixture the researched rule is emitted last, so the live assertion alone cannot exhibit the round-1 crossing defect — criterion 3 rests entirely on the synthetic proof. All five shapes stay, and the emitted corpus was re-scored against the two historically defeated patterns to prove the teeth survive the rewrite:

pattern	honest	dishonest	empty	multi	multi_honest
shipped	pass	ok	ok	ok	pass
round-1 defeated ("[^}]*"tier":0)	pass	LEAK	ok	LEAK	pass
round-2 defeated (unbounded .*)	pass	ok	ok	LEAK	pass

Only the shipped pattern is clean on all five. The round-1 pattern still leaks on the dishonest and multi-rule cases; the round-1 repair still leaks on the multi-rule case.

Prior-art consult

• Both commits carry the escape-hatch Prior-art: trailer. Neither is a capability commit under the CLAUDE.md definition: no new package.json dependency, no new file, and nothing under packages/ (the diff is one tests/install-sh/ script and one setup.d/ comment).
• No new capability area surfaced — this is fixture-fidelity rework on an existing gate plus a comment removal.
• No existing SSOT entries matched (no capability area to match).
• No context7 queries required — no new capability area.

Test plan

• bash tests/install-sh/python-rules-lock.test.sh — 33 passed, 0 failed, including (13) M1 discrimination 5/5 and the new (13) M1 corpus emitted by the real _py_json_rules
• bash tests/install-sh/rules-lock-schema-parity.test.sh — 13 passed, 0 failed
• npx vitest run packages/core/synthesizer — 186/186
• npx vitest run packages/core/install — 100/100
• bash scripts/build-synth-bundle.sh --check — in sync
• SNAPSHOT_MODE=compare bash tests/install-sh/snapshot.sh — 15 pass / 0 fail, byte-identical (no delivered bytes move; the installer layer has no shipped twin)
• make self-audit — composition 46/46, principles 353 passed / 1 skipped, always-on 31297B within the 54000B ceiling
• npm test --workspace=@rules-as-tests/core --run — RED on this host, and equally RED without these commits. See the note below; not caused by this PR.

Note on the core workspace suite

The full core suite is red on this host independently of this change. Controlled A/B in a single worktree at merge-base 8d2e7173cf, running the same three files with and without these two commits, is identical — 1 file / 4 tests failed (hooks/getff-work.test.ts) in both. The failing families are hooks/ and skills/ tests that spawn git/worktree/shell state (getff-work, create-worktree, priority-score, dup-detect); they touch nothing this PR edits.

Two separate effects were isolated while checking this, both worth recording:

1. Unprovisioned worktree inflates the failure count. Before running scripts/worktree-node-modules.sh, this worktree reported extra failures that vanished after provisioning — the hazard CLAUDE.md documents (the WorktreeCreate hook is not registered, so worktrees born outside create-worktree.sh are unprovisioned).
2. The remainder is load-dependent flake plus host state. Full-suite counts wobble run to run (85 failed at base vs 87 with these commits, in opposite directions from the file counts), while the targeted runs are stable and identical.

Provenance

n/a

Review findings

n/a

Fidelity verdict

FIDELITY: skipped — non-stage follow-up PR closing two recorded MINOR findings from the S1b round-3 audit; no kickoff substrate governs it, and both fixes are behaviour-preserving.

Parked questions

n/a

§1.7 Self-discipline check (REQUIRED if PR touches discipline-bearing files)

§1.7 Skipped: mechanical maintenance — a test-fixture fidelity rework plus a comment removal; no discipline rule, principle, or skill is introduced or extended, and no changed path matches the discipline trigger.