fix(scan): scope a partition census gap to its own partition, and write the rule down

A missing JavaScript file cannot make a PHP answer wrong. A census gap now carries the partition it
was raised for, and reaches only that partition questions. On the measured plugin four JavaScript
files -- a webpack build output, a minified select2, a build config and one source file -- had taken
the admissibility of 4,425 PHP regions with them.

Two controls exercise the real boundaries rather than injecting a reason, and both were confirmed to
FAIL with the old classification restored, so they guard what they claim to.

And the rule is now in the design, because this was the fifth instance found and fixed one at a time.
Two invariants, eleven instances between them:

  A degradation is owned by the narrowest scope that caused it. Vendor exclusion as a global veto,
  line ambiguity inherited by every question, an empty scope blocking a sibling comparison, a language
  boundary demoting every answer, a census gap demoting every answer. The fourth and fifth cost the
  declared v0.1 target its entire admissibility, and neither passing subject could reveal it because
  both hold one language.

  A token matches the thing it names, not text that contains it. gets inside fgets, resolve inside
  resolveUrl, user inside users, a sink word inside a comment, a dotted setting on its last segment,
  a flow query reading the receiver.

Each carries a review test: a new degradation must state the scope it reaches and justify demoting
that far, and a text match must be bounded AND confined to the part of the node that names the callee.

1,419 tests pass, eighteen skipped.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

.kiro/specs/pre-push-safety-net/design.md

@@ -24,6 +24,53 @@ an irrelevant old defect, or an unactionable witness can still produce noise.
 - Do not build a second ranker/scope heuristic, an incremental CPG engine, a daemon, an automatic fixer,
   or a mandatory model service. Do not scan intermediate pushed history in this feature.
 
+## Two invariants this project keeps rediscovering
+
+Added 2026-09-21 after the same two defects appeared eleven times between them. Each instance was
+found by measurement, fixed in one place, and then found again somewhere else, because the RULE was
+never written down. Both are cheap to check in review and expensive to find in a benchmark.
+
+### A degradation is owned by the narrowest scope that caused it
+
+A gap recorded at repository scope silences questions it has no evidence about. The test for a
+repository-wide gap is whether it could make a reported answer WRONG everywhere, not whether it cost
+coverage somewhere.
+
+| instance | the blast radius | where it was fixed |
+|---|---|---|
+| vendor exclusion acting as a global completion veto | every question in the repository | M1b, task 10.6 |
+| line ambiguity inherited by every question | every question in a file | M1b |
+| an empty scope blocking another question's comparison | a sibling's answer | task 12.3 |
+| a language partition boundary demoting every answer | 4,425 PHP regions, by 36 JavaScript ones | task 13.4 |
+| a partition census gap demoting every answer | 4,425 PHP regions, by four build artefacts | task 13.4 |
+
+The fourth and fifth cost the declared v0.1 target its entire admissibility: a WordPress plugin is
+PHP plus admin JavaScript, so the product could detect defects on its own target and never admit
+one. Neither passing subject could reveal it, because both hold one language.
+
+**In review:** every new degradation reason must state the scope it reaches — one question, one file,
+one partition, or the whole read — and a reason that demotes an outcome must justify reaching that
+far. A gap that costs coverage without threatening correctness is a declared exclusion: it stays
+published and it does not demote.
+
+### A token matches the thing it names, not text that contains it
+
+Every matcher in this project searches text for a declared name, and each time the search was allowed
+to look somewhere the name does not appear AS the thing, it claimed something else.
+
+| instance | what it matched instead | where it was fixed |
+|---|---|---|
+| `gets` inside `fgets` | the safe API reported as the dangerous one, 26 times | task 5.13 |
+| `resolve` inside `resolveUrl` | a sanitizer that sanitized nothing | contributor-scan |
+| `user` inside `users` in a SQL string | a textbook IDOR read as guarded | authorization-obligations |
+| a sink word inside a comment | a prototype finding on a handler with no such call | task 14.1 |
+| a dotted setting matched on its last segment | an editor's `setOptions` read as a template engine's | task 14.3 |
+| a flow query reading the call's receiver | `res.end()`, which takes no data, reported like a write | task 14.3 |
+
+**In review:** a text match must be bounded AND confined to the part of the node that names the
+callee. Whole-node text, an argument subtree, a receiver and a trailing path segment are all places
+the name can appear without being what is called.
+
 ## Boundary Commitments
 
 ### This Spec Owns

.kiro/specs/pre-push-safety-net/tasks.md

@@ -568,6 +568,8 @@ Preserve all completed task evidence below.
   - Recording the boundary is right: a flow from PHP into JavaScript is semantics the partitioned graph cannot follow. Demoting every question is not, including one wholly inside a single PHP file. Task 12.3 already fixed this bug class one level down, making an empty-scope gap question-owned "so it cannot block another question's comparison"; the same principle applies to a partition boundary.
   - Do not reclassify the reason as a declared exclusion. That would claim cross-language flows are out of scope when they are unresolved, which is the opposite of what this project's degradation vocabulary exists to say.
   - Done when a question whose scope lies inside one partition completes, a question whose scope could cross a partition boundary stays unresolved with the boundary named, and no question completes by widening its scope. Evidence: `benchmarks/measurements/2026-09-21-two-languages-defeat-completion.json`.
+  - _Both halves implemented 2026-09-21._ A language boundary is now a declared limit: it can hide a finding and never invent one, so it stays published and stops demoting. And an integrity gap raised by a partition census now carries the partition it came from and reaches only that partition's questions, because a missing JavaScript file cannot make a PHP answer wrong. Two controls exercise the real boundaries rather than injecting a reason, and both were confirmed to FAIL with the classification restored. The rule behind both is now written in the design as an invariant, with all five instances listed, because this is the fifth time it has been found and fixed one instance at a time.
+  - _Not yet verified on a subject._ PMPro is the measurement that motivated this and it must be re-run to show a PHP question completing. That run is what closes this task.
   - _Boundary: contributor-scan query/context evidence, Ranker Scope Contract_
   - _Depends: 13.3_
   - _Requirements: 2.1, 2.2, 6.3, 8.1_