docs(benchmarks): 8.2 final gated round - dev funnel 11.9->19.2 complete, admission NO-GO #3, arm parked

Lever: unique-declaration member-call binding (dc28325). Measurement 1: zero movement
on in-family sites (0 unique-name member calls exist there; unresolved mass is framework
callee names). Screen: all 264 admission records byte-identical at dc28325. Measurement 2
(dev pool, single-lever isolation): complete-share 11.9->19.2 (+360478, exact conservation),
recall/location/FA identical, 5 ordinary none->indeterminate. Measurement 3 (ac-admission-3,
fresh freeze, criteria byte-identical): NO-GO #3, same four gates, 0/12 pairs, 264/264
fresh dc28325-stamped records. Stop condition fired: access-control arm parked permanently
(rule-11 fallback). Remaining gap: entry recognition (4/12 zero-recognition; coverage
8/12) and framework operation facts, not call resolution.

.kiro/specs/detection-core/tasks.md

@@ -147,6 +147,7 @@ _Requirement IDs use N.M where N is the requirement number in requirements.md an
   - _Requirements: 10.1, 10.2, 7.3_
   - _Boundary: fact-pack contract + benchmark_
   - _Depends: 6.1, 4.2_
+  - _Parked 2026-10-31: final gated round NO-GO #3 (rule 10 stop condition, maintainer strategy-review); done-when unreachable for this arm -- the unique-declaration member-call binding increment ships (dc28325, dev complete-share 11.9->19.2 with recall/FA unchanged) but the admission gap is entry recognition (4/12 repos unrecognised; coverage 8/12) and framework operation facts, not call resolution. See benchmarks/measurements/2026-10-31-access-control-admission-unique-binding/_
 - [ ] 8.3 Pre-push hook consumes the core consumer contract
   - pre-push-safety-net builds PushRequest and consumes PushVerdict via core/consumer.py; budget from the measured per-class derivation; one real dev-pool push E2E.
   - Done when an E2E hook run on a dev-pool repo emits a PushVerdict with witnesses/reasons and a measured-class budget.

.kiro/steering/detection-quality.md

@@ -73,3 +73,18 @@ and authorized **exactly one further gated round on operation facts and call res
 for the recognized entry shapes**. This is the final incremental round for this arm:
 a third admission NO-GO parks it permanently regardless of diagnosis, and the rule-11
 fallback (narrowed one-ecosystem advisory product plus proof-based BLOCK) applies.
+
+### Final gated round outcome (2026-10-31): ARM PARKED
+
+The final round ran its full course (`benchmarks/measurements/2026-10-31-access-control-admission-unique-binding/`):
+the authorized resolution lever (unique-declaration member-call binding, dc28325) moved the
+dev-pool funnel (complete-calls share 11.9% -> 19.2%) with dev recall and false alarms exactly
+unchanged, but is disconnected from the admission population -- zero unique-name member calls
+exist across all 12 admission repositories. Admission run ac-admission-3 reproduced run 2
+exactly: 0/12 pairs, third NO-GO on the same pre-registered criteria. The stop condition
+fired: **the access-control arm is parked permanently**; the rule-11 fallback (narrowed
+one-ecosystem advisory product plus proof-based BLOCK) applies. The binding itself ships --
+it is a strict improvement where repository-defined names exist. Diagnosis for any future
+strategy review: the remaining admission gap is entry recognition (4/12 repositories with
+zero frameworks recognised; coverage 8/12) and operation facts for framework-defined
+operations, not call resolution.