measure(m3): two languages in a repository defeat completion, and so defeat admission

No PHP question is ever marked completed, and PHP was never the variable. partitions.py raises
cross_partition_semantics_unresolved whenever more than one language partition exists, that reason
is a member of GRAPH_INTEGRITY_GAPS, and a graph-integrity gap demotes every completed outcome in
the scan. Admission requires a completed outcome.

The evidence is one column wide. NodeGoat is JavaScript alone and completes 299 of 299. VAmPI is
Python alone and completes 35 of 35. PMPro is PHP with 36 regions of bundled JavaScript and
completes 0 of 127 and 0 of 520 while establishing 19 and 43 findings. NodeGoat own degradation,
vendor_semantics_unresolved, is a DECLARED exclusion rather than an integrity gap, which is exactly
why it does not demote.

This lands on the declared v0.1 target. A WordPress plugin is PHP plus its admin JavaScript, so
every one of them is multi-language, so on the target this tool was built for it can detect defects
and never admit one. Neither subject that currently passes could reveal it, which is why a census
across a third subject was worth running.

Recording the boundary is right: a flow from PHP into JavaScript is semantics the partitioned graph
cannot follow. Demoting every question is not, including one wholly inside a single PHP file. Task
12.3 already fixed this bug class one level down by making a gap question-owned so it could not
block another question comparison; the same principle applies to a partition boundary. Reclassifying
the reason as a declared exclusion is explicitly the wrong fix, because that would claim
cross-language flows are out of scope when they are unresolved.

Task 13.4 rewritten with the diagnosis, and the milestone amendment now ranks it with M2 rather
than behind it: a narrow JavaScript-only release can proceed without it, the WordPress target
cannot proceed at all.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

.kiro/specs/pre-push-safety-net/release-milestones.md

@@ -48,6 +48,16 @@ threshold and no owner boundary.
    it would ship silence. Output encoding, path, prototype and deserialization have not earned a
    place either. M4 explicitly does not require every language or family to become eligible.
 
+**Amendment to the amendment, same day.** Decision 1's re-run exposed something larger than the
+runtime limit it was chasing. A repository holding two languages can never complete a question,
+because a partition boundary is classified as a graph-integrity gap and such a gap demotes every
+completed outcome; and a completed outcome is what admission requires. NodeGoat completes 299 of
+299 and VAmPI 35 of 35 because each holds one language, while PMPro completes none of 520 and
+still establishes 43 findings. The declared v0.1 target is WordPress plugins, and a plugin is PHP
+plus its admin JavaScript, so on the target this tool was built for it can detect and never admit.
+Task 13.4 carries it, and it now ranks with M2 rather than behind it: a narrow JavaScript-only
+release can proceed without it, and the WordPress target cannot proceed at all.
+
 **The risk this amendment does not remove.** Every number so far comes from two repositories used
 to build the analyser, and one week of examining them surfaced seven false positives. On untouched
 code the precision estimate will move, against a bar of 95% with zero false alerts on the fixed and