audit-instructions: adopt (check, claim, sites) finding identity and admit I30 to I33 to --persist-findings

[kyle-sexton]

Sub-issue of #4113 (report contract).

Problem

Findings have no identity that survives a re-run, so nothing filed from a report can be matched against the next run's output, suppressed, or carried forward. --persist-findings emits only I28 and I29 (the two scanner-seeded families), and scripts/emit-findings.sh consumes scanner rows only; the eight unemitted families are declined no-severity-crosswalk-row.

Change

Two separable items in one PR.

1. Identity adoption. Findings adopt plugins/claude-config/skills/audit-pass/reference/finding-identity.md: identity = (check, claim, sites), sites as sorted (surface, anchor) pairs, content-derived anchor/v1 anchors with the heading-path occurrence discriminator. Each check gains a claim template (free prose in claim is a hard error). A cross-surface I15 conflict is one finding with two sites. primary_site and presentation fields stay outside the hash.
2. Crosswalk admission. Four new rows in the detector-findings crosswalk for I30, I31, I32, I33, each arguing its tier from plugins/review/context/severity.md's tests, each Auto-applicable: No (surface-only; the skill has no fix action), with an emitting fall-through for the judgment-selected rules (I31 and I33 are behavioral and unseeded), a second emit path in emit-findings.sh fed by lane findings beside the scanner-fed one, a Confidence value the contract defines for a model-lane finding (today the contract fixes it to high because a deterministic detector fired), and a counted decline for frontmatter-located I32 rows (the relay is body-scoped; at least one measured I32 row sits on plugins/fleet/skills/reach/SKILL.md:2).

Acceptance criteria

• Two runs over an unchanged tree yield identical finding_id values; editing an I33 opener changes that finding's id; an I15 conflict is one finding with two sites.
• scripts/check-detector-findings-crosswalk.sh passes with the four new rows.
• --persist-findings emits I30, I31, I32, I33 rows from lane findings; frontmatter-located I32 rows are declined and counted, never silently dropped.
• scripts/affected-tests.sh --run passes.

Sources

• plugins/claude-config/skills/audit-pass/reference/finding-identity.md
• docs/conventions/finding-suppression/README.md ("How a consumer derives the id and its constituents is that consumer's own contract")
• docs/conventions/detector-findings/README.md (admission test; "A rule set whose selection involves judgment is fail-safe toward EMITTING")
• plugins/claude-config/skills/audit-instructions/context/persist-findings.md

[kyle-sexton]

This was generated by AI during triage.

Agent Brief

Type: Feature
Summary: Give every audit-instructions finding a stable, re-run-comparable identity, and admit the four unemitted finding families to the persisted-findings output.

Current behavior:
Findings carry no identity that survives a re-run, so nothing filed from one report can be matched against, suppressed in, or carried forward to the next run's output. The persisted-findings output emits only the two scanner-seeded finding families; the eight other finding families are declined for having no severity-crosswalk entry.

Desired behavior:
Every finding's identity is the triple of its check id, a claim, and its sites, where sites are a sorted list of surface-and-anchor pairs and each anchor is derived from the surface's content (not its line number) with a heading-path discriminator for repeated occurrences. Each check defines a claim template; free-form prose in the claim field is a hard error. A conflict finding that spans two surfaces is one finding carrying two sites, not two findings. Presentation fields (which site is shown first, how the finding is rendered) sit outside the identity. Four new rows are added to the severity crosswalk for the four currently-unemitted finding families this audit run actually produces, each argued from the review plugin's own severity tests, each marked as not auto-applicable (the skill only surfaces findings, it does not apply fixes), with a fall-through path for the families whose selection involves model judgment rather than a deterministic pattern match. The persisted-findings emitter gains a second emission path fed by lane (judgment-based) findings alongside its existing scanner-fed path, and defines a confidence value for a lane-sourced finding (fixed to the highest confidence level today, since a deterministic detector still fired even though the presentation is lane-judged). A frontmatter-located occurrence of the routing-reference finding family is counted as a declined finding rather than silently dropped.

Key interfaces:

• finding identity: the triple of check id, claim, and sites, with sites as sorted surface-and-anchor pairs and content-derived anchors carrying a heading-path discriminator
• severity-crosswalk entries for the four newly-admitted finding families, each marked not auto-applicable
• persisted-findings emitter: a lane-fed emission path alongside the existing scanner-fed path, with a defined confidence value for lane-sourced findings

Acceptance criteria:

• Two runs over an unchanged tree produce identical finding identities for every finding.
• Editing a self-referential-opener finding's underlying opener sentence changes that finding's identity.
• A conflict that spans two surfaces is emitted as one finding carrying two sites, not two findings.
• The severity-crosswalk check passes with the four new rows present.
• The persisted-findings output emits findings from all four newly-admitted families when a lane produces them, and a frontmatter-located routing-reference finding is reported as a declined count rather than dropped without a trace.
• The project's affected-tests check passes.

Out of scope:

• The pre-scan gate-set calibration and the self-referential-opener check's own exemption and rollup behavior (tracked separately, audit-instructions: I6 pre-scan adopts the audit-noise gate set; I33 lane fences, excerpt anchors, and per-plugin presentation #4115); this issue defines the identity contract that check keys into, but does not change the check's own detection or presentation logic.
• The token-budgeted lane sizing, unattended flag, and resume capability (tracked separately, audit-instructions: token-budgeted lanes, --unattended, and --resume over per-lane run files #4114).
• The guardrails block-message wording change (tracked separately, guardrails: block-hook-bypass message names the shipped temp-tree literal-path route and the variable-carried residual #4118).