v3.26.0 — The Covenant-Drift Membrane

One signal, no lexical guards. Fixes a reported false-positive class where the immune tripwire quarantined an honest analyst ring (a business-model review naming "forced inference" / "bypass") and then molted a scar from generic topic vocabulary that refused the next benign question on the same topic — a self-amplifying failure.

Compromise is now defined by exactly one thing: the agent's sealed action drifting from the genesis covenant — the alignment words in block 0 (loving, joyful, peaceful, patient, kind, good, faithful, gentle, self-controlled; the fruitages of the spirit, Galatians 5:22-23). A harmful action is antithetical to those fruitages, so a covenant-harmony check is sufficient: it blocks exactly the antithetical actions and nothing else.

Removed

• The lexical apparatus: 79 injection-pattern regexes, homoglyph / base64 / hex / ROT13 normalization + decode-and-scan, the severity model, and scar-vocabulary membrane matching.
• tools/immune_bench.py and tests/jailbreak_corpus.py.

Changed

• Tripwire / screen / detect fire only on covenant drift (poq.covenant_breach, frame-aware). An analyst ring that merely NAMES attack vocabulary in a mention frame is in harmony and left untouched.
• Scars are inert records (no lexical vector, no generic-token antibody) — they can never poison a topic. immune forget-scar --id <id> retires one.
• Dormancy's pause screen re-anchored to covenant drift; SKILL.md + docstring rewritten; selftest phases 16/20/21/22 rewritten to covenant drift with an explicit incident-regression check. Full selftest PASS; all five bundles scan 4/100 SAFE.

Trade-off (stated honestly)

This reverses v3.20's lexical input-screening: the membrane no longer blocks a jailbreak attempt at the input. The trust boundary is the agent's alignment with its covenant, enforced at the outcome (what it seals), not a blocklist of attack patterns.