docs(board): register GT-633 — the guard whose expected value was a copy of its actual value

reference/core/control-center/evidence/gap-closure-evidence.json

@@ -8853,6 +8853,33 @@
       ],
       "dependencyDisposition": "accepted-scope",
       "dependencyRationale": "What this gate does NOT do is stated rather than left to be discovered. It detects a security-marked commit that no published version contains; it cannot detect a security fix nobody marked, which is a convention problem and belongs to GT-623 (release-please derives no bump from the non-conventional `security(...)` type this repository has used twice). It also reports, but does not fail on, a package whose published version is absent from this history -- an INEXACT boundary after a history rewrite -- because scanning the whole history conservatively is better than skipping the package silently. Finally, the gate needs the network: without a registry answer the package is skipped and named, and a run where EVERY package is skipped is a failure rather than a pass."
+    },
+    {
+      "id": "GT-633",
+      "closedAt": "2026-07-30",
+      "closureCommit": "29e940d4",
+      "evidence": [
+        "src/rulesets/standards/capture-native-evaluability-snapshot.mjs",
+        "src/rulesets/standards/iso-5055-mapping.test.mjs",
+        "src/packages/core-domain/test/rule-corpus-triage.ts",
+        "src/packages/core-domain/src/application/validators/rule-corpus-triage.spec.ts",
+        ".harness/scripts/ci/41-validate-evidence-commands.mjs",
+        ".harness/scripts/ci/46-validate-derived-artifact-order.mjs",
+        ".github/workflows/docs.yml",
+        ".github/workflows/ci-cd.yml"
+      ],
+      "validationCommands": [
+        "node src/rulesets/standards/capture-native-evaluability-snapshot.mjs --check -> the snapshot is a faithful capture of the Core triage (389 rules). Before the fix there was no capture script at all, so this command could not exist.",
+        "node --test src/rulesets/standards/iso-5055-mapping.test.mjs -> 9/9. The guard now reads PINNED_CLASS_COUNTS out of rule-corpus-triage.spec.ts and THROWS when it cannot find it; the six hardcoded literals it used to compare against are gone.",
+        "npm run test --workspace src/packages/core-domain -> 1368 passed / 125 suites, including the GT-598 block that compares the committed snapshot against a freshly computed triage in both directions.",
+        "node .harness/scripts/ci/46-validate-derived-artifact-order.mjs --verbose -> 5 links, 7 artifacts, chain current AND at a fixed point. Swapping the capture/mapping pair is rejected: \"ISO/IEC 5055 corpus mapping consumes native-evaluability-snapshot.json, which a LATER link writes.\"",
+        "node --test .harness/scripts/ci/46-validate-derived-artifact-order.test.mjs -> 8/8, with link positions derived from CHAIN rather than typed as literals.",
+        "node --test .harness/scripts/ci/41-validate-evidence-commands.test.mjs -> 40/40, and 5 of the 6 new tests observed RED against the pre-fix parser.",
+        "NEGATIVE, both failure modes: reverting documentation-only to 129 turns the mapping guard red, and building the mapping from a stale snapshot turns the stamp test red. The laundering path is caught.",
+        "RATCHET, measured on the runner rather than locally: 309 -> 304 -> 40 -> 38 dead references, the budget lowered at each step only from the count the CI job printed. 38 remain and are not path rot."
+      ],
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "What this closure does NOT do is stated rather than left to be discovered. 38 dead references survive the migration and are deliberately left dead, because each would require INVENTING evidence to clear: 15 name the vendored, gitignored .harness/bin/opa (environment-sensitive, not a wrong path); 4 name a script ABSORBED into 04-check-bilingual-parity rather than moved, so repointing them would claim a command nobody ran; 6 name artifacts that were deleted; 5 are root-level npm test recorded without the workspace they ran in, which cannot be inferred; the rest are build output and prose the extractor reads as commands. A recorded command may be repaired when its artifact MOVED, never when it was deleted, replaced or absorbed. Separately, the two guard PARSER defects found here were fixed rather than tolerated (0aee3eb0), so they are not part of this remainder. The budget rule stands: --max-dead may be lowered only from a count the CI job itself printed, never from a local measurement."
     }
   ]
 }

reference/core/control-center/gaps/gap-reference-catalog.es.md

@@ -7855,6 +7855,31 @@ Serie histórica de gaps registrada en el antiguo `gap-analysis-core.es.md`, pre
   - [x] El tipo `security` está declarado en la config de commitlint con un mapeo explícito de salto de versión, o se deja de usar.
   - [x] Ningún hook de `.husky/` imprime un mensaje de "skipping" y sale con cero — un hook que no puede correr se borra, no se silencia.
 
+#### GT-633
+
+**Título:** Una guarda cuyo valor esperado era una copia de su valor real
+
+- **Propósito:** Quitar un check que solo podía pasar, y convertir el snapshot que vigila en una captura real en vez de una copia mantenida a mano.
+- **Evidencia:** `iso-5055-mapping.test.mjs` afirmaba `evaluability.counts` contra seis literales idénticos a los que ya había leído dentro de `native-evaluability-snapshot.json`. En `ac8594df` Core fijaba `documentation-only: 136` y el snapshot decía 129; el test pasó. En `integration/gt-572-595-604` Core fijaba `native-handler: 151` / `unimplemented-native: 48` frente a 139/60 del snapshot; el test volvió a pasar. Las doce reglas cerradas por esa integración seguían registradas como `unimplemented-native`. No existía script de captura: `grep` del nombre devolvía el consumidor, dos READMEs y el test.
+- **Componente:** `Governance` · **Criticidad:** P1 · **Complejidad:** M
+- **Procedencia:** Encontrado el 2026-07-29 al leer la afirmación de la propia guarda de que leía `rule-corpus-triage.spec.ts`. Cerrado en `c856752b`, `beb6f50f`, `104fd7a1`, `0aee3eb0` y `29e940d4`.
+- **Criterios de aceptación:**
+  - [x] La guarda deriva sus cuentas esperadas de la fuente de verdad de Core, y LANZA en vez de pasar cuando no las encuentra.
+  - [x] Existe un script de captura, ejecuta el triage real de Core, y el snapshot se recaptura desde él — y después se reconstruye el mapeo, en ese orden.
+  - [x] La suite de Core compara el snapshot comiteado contra un triage recalculado, cuentas y clase por regla, en ambos sentidos.
+  - [x] El orden `captura → mapeo` está declarado como dato y una declaración intercambiada se rechaza.
+  - [x] La guarda del mapeo corre en un workflow; antes no corría en ninguno.
+  - [x] El ratchet de referencias muertas solo baja desde un conteo que imprimió el propio job de CI, nunca desde una medición local.
+- **Modos de fallo transferibles:**
+  - Una guarda cuyo valor esperado es copia de su valor real solo puede pasar. La comparación debe alcanzar una fuente que el artefacto bajo prueba no controle.
+  - Un artefacto derivado estampado desde otro blanquea una entrada obsoleta dentro de algo mayor mientras el `--check` de cada uno sigue pasando — por eso el orden va en una cadena, no en prosa.
+  - Una medición alcanzable solo por su propio test no se puede capturar, así que la copia consumidora se mantiene a mano y deriva. Extraerla fue el arreglo.
+  - Un `dead` falso en una guarda de evidencia se lee como evidencia obsoleta e invita a "reparar" registros que ya eran correctos; 27 se reordenaron alrededor de un bug de parser antes de arreglarlo.
+  - Posiciones de test escritas como literales (`link 2 of 3`) hacen que una adición ajena parezca una regresión en otro sitio; derívalas.
+  - Pillado en el acto: dos tests escritos para probar un arreglo de parser pasaban también contra el parser VIEJO, porque la raíz de la fixture no declaraba `scripts` y la rama bajo prueba se saltaba. Con la fixture viva, los seis tests fallaron 5 de 6 contra el parser viejo.
+- **Remanente abierto:** sobreviven 38 referencias muertas que no son rot de rutas — el desglose está en la fila. Ninguna es reparable sin inventar evidencia. La regla vigente registrada sobre el flag `--max-dead`: el presupuesto solo baja desde un conteo que imprimió el job de CI.
+- **Referencias:** [`GT-598`](#gt-598) (origen), [`GT-578`](#gt-578) (el ratchet), [`GT-595`](#gt-595), [`GT-630`](#gt-630) (la cadena), [`GT-632`](#gt-632).
+
 #### GT-632
 
 **Title:** La política ABAC compilada se resuelve en una ruta previa al refactor, denegando toda herramienta MCP en producción

reference/core/control-center/gaps/gap-reference-catalog.md

@@ -7950,6 +7950,31 @@ Historical gap series tracked in the former `gap-analysis-core.md`, preserved fo
   - [x] The `security` type is either declared in the commitlint config with an explicit version-bump mapping, or removed from use.
   - [x] No hook in `.husky/` prints a "skipping" message and exits zero — a hook that cannot run is deleted, not silenced.
 
+#### GT-633
+
+**Title:** A guard whose expected value was a copy of its actual value
+
+- **Purpose:** Remove a check that could only ever pass, and make the snapshot it guards a real capture rather than a hand-maintained copy.
+- **Evidence:** `iso-5055-mapping.test.mjs` asserted `evaluability.counts` against six literals identical to those inside `native-evaluability-snapshot.json`, which it had already read. On `ac8594df` Core pinned `documentation-only: 136` and the snapshot said 129; the test passed. On `integration/gt-572-595-604` Core pinned `native-handler: 151` / `unimplemented-native: 48` against the snapshot's 139/60; the test passed. All twelve rules closed by that integration were still recorded as `unimplemented-native`. No capture script existed: `grep` for the filename returned the consumer, two READMEs and the test.
+- **Component:** `Governance` · **Criticality:** P1 · **Complexity:** M
+- **Provenance:** Found 2026-07-29 while reading the guard's own claim that it read `rule-corpus-triage.spec.ts`. Closed across `c856752b`, `beb6f50f`, `104fd7a1`, `0aee3eb0` and `29e940d4`.
+- **Acceptance criteria:**
+  - [x] The guard derives its expected counts from the Core source of truth, and THROWS rather than passing when it cannot find them.
+  - [x] A capture script exists, runs Core's real triage, and the snapshot is recaptured from it — then the mapping rebuilt, in that order.
+  - [x] Core's own suite compares the committed snapshot against a freshly computed triage, counts and per-rule class, in both directions.
+  - [x] The `capture → mapping` order is declared as data and a swapped declaration is rejected.
+  - [x] The mapping guard runs in a workflow; it previously ran in none.
+  - [x] The dead-reference ratchet is lowered only from a count the CI job itself printed, never from a local measurement.
+- **Transferable failure modes:**
+  - A guard whose expected value is a copy of its actual value can only ever pass. The comparison must reach a source the artifact under test does not control.
+  - A derived artifact stamped from another launders a stale input into something larger while each artifact's own `--check` still passes — which is why order belongs in a chain, not in prose.
+  - A measurement reachable only by its own test cannot be captured, so the consumer copy gets hand-maintained and drifts. Extracting it was the fix.
+  - A false `dead` in an evidence guard reads as stale evidence and invites "repairing" records that were already correct; 27 were reordered around one parser bug before it was fixed.
+  - Test positions typed as literals (`link 2 of 3`) make an unrelated addition look like a regression elsewhere; derive them.
+  - Caught in the act: two tests written to prove a parser fix passed against the OLD parser too, because the fixture root declared no `scripts` and the branch under test was skipped. With the fixture made live the six tests failed 5 of 6 against the old parser.
+- **Open remainder:** 38 dead references survive and are not path rot — see the row for the breakdown. None is repairable without inventing evidence. The standing rule recorded above the `--max-dead` flag: the budget may be lowered only from a count the CI job printed.
+- **References:** [`GT-598`](#gt-598) (origin), [`GT-578`](#gt-578) (the ratchet), [`GT-595`](#gt-595), [`GT-630`](#gt-630) (the chain), [`GT-632`](#gt-632).
+
 #### GT-632
 
 **Title:** The compiled ABAC policy is resolved at a pre-refactor path, denying every MCP tool in production