Dated harness-fact stamps are past their own expiry and three quoted upstream spans no longer match the page

[kyle-sexton]

Merged from source-control-worktree/.../audit-notes.md F3, F4, F6 (MEDIUM, MEDIUM, LOW), discovery-research/.../audit-notes.md finding 4 (LOW), discovery-explore/.../audit-notes.md F1 (MEDIUM), typos-format-hook/.../audit-notes.md F2 (low). One dated record per harness fact plus recheck trigger; six lapsed.

Expired stamps:

• source-control/skills/worktree/SKILL.md:57-81, nesting invariant. Line 81: "Unconditional expiry. 2.1.244, or 2026-11-07. Whichever comes first." Host CLI 2.1.278, 34 releases past. Still labelled verified, still the SSOT. Last adjudicated 2.1.224; the 2.1.232 probe is a fixture failure. No claim on which arm is true.
• discovery/skills/explore/reference/dispatch.md:214 (2026-08-08) and twin skills/research/context/dispatch.md:252: docs carry no partial-return semantics for maxTurns. They now do; see the companion maxTurns issue.

Spans that no longer match, grep -c -F against rung-1 fetches:

• source-control/skills/worktree/SKILL.md:30-46 (stamped "fetched 2026-08-10") claims "an isolated session's tool calls are screened by three checks"; both quoted spans return 0 against https://code.claude.com/docs/en/worktrees.md (fetched 2026-09-19, 37,648 bytes). Line 87: "Claude Code applies four checks:", can't-verify now a fourth Command-shape check; the third span still matches at line 94. Provenance only.
• source-control/skills/worktree/context/create.md attributes "raw text substitution, not shell-escaped" to plugins-reference user configuration. https://code.claude.com/docs/en/plugins-reference.md (fetched 2026-09-19, 141,682 bytes) returns 0 for raw text substitution, not shell-escaped and shell-escaped. Line 620: shell-running fields reject ${user_config.*} since v2.1.207; skill and agent content is still substituted (line 618). Write-tool temp-file mitigation correct; attribution wrong.
• discovery/reference/parent-contract.md quotes "Claude Code withholds the Agent tool from every subagent except a fork"; grep -c -F returns 0 only because the plugin stripped the markdown link that https://code.claude.com/docs/en/sub-agents.md (fetched 2026-09-19, 115,522 bytes) carries at line 991. Its recheck trigger, "any of the named pages stops carrying the quoted span", now fails.
• typos-format/README.md "Hook budget accounting" publishes 26.0 spawn-equivalents, measured 2026-09-02 against 0.6.35. The auditor measured 18.7 on 0.6.55 (n=8, interleaved against a bash -c : floor, same method); the 0.6.55 CHANGELOG describes a builtin field parser that spawns nothing where jq ran. It feeds the hook-budget convention.

Fix: re-fetch, re-quote with link markup (or mark link-normalized), correct counts, re-date. For the nesting invariant, run fixtures/nesting-invariant-probe.sh on 2.1.278 and refresh the stamp, or downgrade the header from "verified" to "expired, pending re-probe".

Verification: expiry-versus-installed-version check in nesting-invariant-ssot.test.sh; contract.test.sh assertion that no file asserts the retired maxTurns claim.

🤖 Generated with Claude Code

https://claude.ai/code/session_01F7GFS5autRMSaea6kSoXzx

[kyle-sexton]

This comes from the 2026-09-29 audit of the Cursor run. Draft PR: #5317 (Refs #4264).

What the audit found. The heading was still "verified" over an expired stamp, and the expiry gate passed on a static marker forever.

Fixed in #5317. The heading is renamed "dated measurement", the marker is time-bounded (nesting-invariant-ssot.test.sh fails 30 days after the marked date), and the host-probed version is dropped.

Still missing. The authenticated re-probe needs operator credentials, so no agent can run it. Tracked in the follow-up filed today: #5318.

The issue stays closed: its either-or criterion (downgrade the header) is met once #5317 merges.