fix(gates): restore the round-2 checker — #1375's squash landed the doc but a STALE copy of its instrument

[ZacxDev]

Follow-up to #1375, which merged partially.

Measured on origin/main after that merge:

• claudedocs/gate-inventory-2026-09-08.md is byte-identical to the branch tip ✓
• scripts/check-gate-inventory.py is 166 lines against the branch's 286, and contains
  zero of the round-2 changes ✗

Cause, recorded because the failure mode is easy to repeat: the first
gh pr merge --squash --delete-branch errored locally with
fatal: 'main' is already used by worktree at '…' — but the API merge had already fired
against the PR head as GitHub knew it, before the last push propagated. The local error read as
"the merge did not happen". It had, partially.

🔴 The state that left on main is worse than either version alone: the document declares
<!-- inventory-rows: 81 --> and <!-- inventory-tally: KEEP=51 TIER=30 DROP=0 -->, and the
checker sitting beside it reads neither marker — so the document asserts it is machine-checked
while nothing checks it. It also reinstated all three defects an adversarial audit had found:

1. The scoping control was VACUOUS. Its fixture contained no ## 3. line, so in_scope was
   False from the first line regardless of the SECTION_END branch it claimed to cover.
   Deleting that branch left the self-test fully green. The round-2 fixture opens the scope
   first — mutation-checked: with the branch deleted the control now fails with its own
   error (rows=2, problems=1), i.e. it is reachable.
2. Evidence acceptance was vocabulary, not evidence. The bare word CONFIRMED and a bare
   ×N count both passed. Decisive control: replacing all 81 evidence cells with CONFIRMED
   yielded RESULT: PASS. It now requires a lookup-able identifier — a UUID session id,
   agent-<12+ hex>, a ≥7-hex sha in backticks, or #<digits>. The same control now fails all
   81 rows.
3. The zero-row guard was narrower than its docstring, which promised a vacuous green could
   not certify an empty table. A document truncated to one row passed. It now cross-checks
   the row count and the verdict tally against the document's own markers, and exits 2 when
   either marker is missing — absent expectation means cannot-vouch, never a pass.

No document change. The doc already on main is the correct round-2 text; this is the
instrument catching up to it.

Verification

Both tiers, on this tree (origin/main 5b564844 + this one file):

tier	command	result
dev-host	scripts/gate.sh --tier both	GATE: RESULT=PASS exit=0 — pytest 21,127 collected / 21,125 passed / 2 skipped / 0 failed (floor 20,342); node 1,449/1,449; 43 PASS targets, 0 FAIL, 0 timeout panics
sandbox	nix build .#checks.x86_64-linux.pytests	rc=0, real streaming build, valid store output
sandbox	nix build .#checks.x86_64-linux.nodetests	rc=0, valid store output
instrument	check-gate-inventory.py --self-test	all 9 controls pass
instrument	vs the doc on main	rows checked: 81 (declared: 81) problems: 0

Sandbox derivations built one at a time; store-output validity is the check, since a failing
derivation produces no output path.

⚠ One earlier gate run on this branch failed and it was my own contamination, not this change.
test_no_predictable_tmp_path_is_live_while_the_verifier_runs tripped on 29 stale
/tmp/nebula-relay-pre.<pid> files left by my earlier runs against the pre-#1407 nebula code.
All 29 PIDs were dead; removed after re-checking liveness immediately before each delete. Current
main does not leak them — the file now runs 30/30 twice with zero leftovers. Reporting it
because "the gate failed once" would otherwise read as a red suite.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HXxTANDijZTVxj398NrWBU