fix(context-guard): zone bands have no hysteresis, so a session flapping across a boundary re-injects on every crossing

[kyle-sexton]

context-guard's zone bands are hard thresholds and the worsening-only latch has no dwell or
cooldown, so a session hovering across a boundary re-injects the ~1KB (~250 token) guidance block on
every re-crossing. State is persisted regardless of direction, so an improvement silently re-arms
the injection and nothing counts or caps the flap.

The auditor's own grading is a tuning question, not a defect: occupancy usually rises monotonically
and the flap scenario is analytical, not observed. It is filed so the possibility is on the record
before someone tunes the bands.

This is NOT the recurring 10s-timeout defect — do not close it as a duplicate of that. Inbox item
20260730-182801-context-guard-zone-crossing-hook-times-out-100-percent (status: done) was about
four hooks.json registrations declaring timeout: 10 against measured 10.6–21.4s runtimes, so the
hook died rather than ran; it was fixed in context-guard 0.4.8 via PR #2001 (squash-merged as
925c3259), raising all four to 60. This row is about how often the hook injects when it does run
— injection frequency at band edges, not hook completion. That done item's still-open residue
(profile the hot path) is also unrelated.

Rows

• I7 C-CG-A — plugins/context-guard/scripts/context-zone.sh:51-56 and
  plugins/context-guard/hooks/zone-crossing-inject.sh:124-131, :141 — hard shipped bands with no
  dwell, and a latch that re-arms silently on any rank drop, with no re-crossing counter or cap.

Evidence

plugins/context-guard/scripts/context-zone.sh:51-56 at HEAD — hard shipped bands, no dwell:

# SHIPPED DEFAULT BANDS (zones.json absent = zero-config): percentage bands
# smart ≤ 50 < acceptable ≤ 75 < dumb over used_percentage, and per
# window-class token bands over occupancy:

plugins/context-guard/hooks/zone-crossing-inject.sh:124-131 — state persisted regardless of
direction:

# Persist the current zone regardless of direction (improvements update
# silently) — owner-only, atomic enough for a single-writer-per-session file.

followed at :141 by the worsening-only emit gate:

((new_rank > last_rank)) || {

So a rank drop silently re-arms the injection, and nothing counts or caps re-crossings.

Cheapest disposition, and what must NOT be refactored away

Cheapest is to leave the behaviour and note the flap possibility in the cadence-contract header; if
it bites in practice, require improvement by more than one rank, or a minimum turn gap.

Preserve (explicit): zone-crossing-inject.sh is the reference implementation of the I23
counter-steer pattern — two channels with the continuation menu deliberately kept out of model
context (:5-16, :156, :163), and a hook that refuses to claim an operator is present because
"No documented hook behavior tells a hook whether an operator is present" (:23-29). Also preserve
the inert default posture, the worsening-only latch itself, and the structural no-deadlock exemptions
in zone-gate.sh.

Provenance

Severity: LOW · Provenance: AUDITOR_VERIFIED. Route caveat: the packet's audit-notes.md for this
lane was parent-persisted via a step-3 backstop and marked backstop-persisted: unverified — a
fresh-context auditor pass produced the finding, but nothing independently confirms the auditor's own
write was attempted and refused. Anchors re-verified at HEAD by the validation pass.
Audited at context-guard 0.6.4; HEAD is 0.6.5, a library-carry bump whose entry states "No
behaviour of this plugin changes".
Origin: handoff-inbox item 2026-08-10-plugin-quality-audit-four-components
Ledger: .work/handoff-inbox-batch-4/ledgers/I7-four-components-023241Z.md § C-CG-A
Verified against repo HEAD 685dd381.

[kyle-sexton]

Skip — covered by open PR #2308 (fix/2220-context-guard-zone-hysteresis, Closes #2220).