docs(benchmarks): 8.2 final gated round - dev funnel 11.9->19.2 complete, admission NO-GO #3, arm parked

Lever: unique-declaration member-call binding (dc28325). Measurement 1: zero movement
on in-family sites (0 unique-name member calls exist there; unresolved mass is framework
callee names). Screen: all 264 admission records byte-identical at dc28325. Measurement 2
(dev pool, single-lever isolation): complete-share 11.9->19.2 (+360478, exact conservation),
recall/location/FA identical, 5 ordinary none->indeterminate. Measurement 3 (ac-admission-3,
fresh freeze, criteria byte-identical): NO-GO #3, same four gates, 0/12 pairs, 264/264
fresh dc28325-stamped records. Stop condition fired: access-control arm parked permanently
(rule-11 fallback). Remaining gap: entry recognition (4/12 zero-recognition; coverage
8/12) and framework operation facts, not call resolution.

.kiro/specs/detection-core/tasks.md

@@ -147,6 +147,7 @@ _Requirement IDs use N.M where N is the requirement number in requirements.md an
   - _Requirements: 10.1, 10.2, 7.3_
   - _Boundary: fact-pack contract + benchmark_
   - _Depends: 6.1, 4.2_
+  - _Parked 2026-10-31: final gated round NO-GO #3 (rule 10 stop condition, maintainer strategy-review); done-when unreachable for this arm -- the unique-declaration member-call binding increment ships (dc28325, dev complete-share 11.9->19.2 with recall/FA unchanged) but the admission gap is entry recognition (4/12 repos unrecognised; coverage 8/12) and framework operation facts, not call resolution. See benchmarks/measurements/2026-10-31-access-control-admission-unique-binding/_
 - [ ] 8.3 Pre-push hook consumes the core consumer contract
   - pre-push-safety-net builds PushRequest and consumes PushVerdict via core/consumer.py; budget from the measured per-class derivation; one real dev-pool push E2E.
   - Done when an E2E hook run on a dev-pool repo emits a PushVerdict with witnesses/reasons and a measured-class budget.