[squid-protocol]

Group titles

before	after
Keywords	Keyword Extraction
(new position, see below)	Non-planted Keyword Extraction
Dependency Graph	Dependency Graph Creation
Shape Descriptors	Internal Function Metrics
Risk Scores	Calculated Risk Exposure — Per File
Program Length + Vocabulary	Program Size & Vocabulary (merged)

Length and vocabulary merge because they answer one question — how big and how wordy did the same
program come out — and are ungated for one reason.

Languages in band, per row

Every row now prints the count in the band's own bottom-right corner (43/45). The bar to the left
already gives the share, but a reader comparing two rows at the same percentage still has to know
whether that is 43 of 45 or 4 of 5 — n varies per row as n/a cells and population-less languages
drop out. Drawn after the dots with a white halo (paint-order="stroke"), because anything near
+25% sits directly under the label; verified by rasterising the SVG rather than assuming.

Non-planted keyword extraction is now SCORED

It sat with length and vocabulary on the "languages vary too much for a band to mean anything"
argument. That argument does not apply to it: the corpus plants nothing these rules match, so the
honest reading is 0 in every language — which is exactly the comparable claim the chart exists to
make. It now scores on exact agreement against the zero median, the basis every zero-median metric
already uses, and sits directly after Keyword Extraction because it asks the same question with the
answer inverted.

Scoring it moves 37 nonzero cells from unverdicted to needing a verdict, so all 37 were audited
— each language's own rule run over its code and comment streams, reading what actually matched.
They resolve three ways, ledgered as non-planted-rules-match-idiom-and-planted-tokens
(intended-morphology):

1. The language's mandatory form, which the probe program cannot avoid writing — const
   (javascript 17, typescript 14), let (swift 11), val (kotlin/scala), final/FINAL,
   INTEGER, PARAMETER, .freeze; DISPLAY/WRITE/echo as the language's only output
   primitive; %% as yacc's mandatory section separator.
2. A token planted for another signal, counted again — eval, iex, Type.forName and
   solidity's assembly are the high_risk_execution / safety_bypasses plants; jcl's DISP=(OLD is
   keyword-rosetta#72's; swift's Sendable is on the immutability line above it.
3. Actually planted, despite the group's name — spec_exposure jcl/yaml are the [SPEC-2732]
   tags SPEC.md plants in exactly those two languages, and dead_code jcl is //*PROBEDEAD.
   unplanted_inputs is derived as "governed by a risk formula and not in the manifest's PLANTED
   18", so a signal the SPEC plants in a language or two without giving it a manifest column lands
   in this group anyway. Worth knowing before the group's name is taken literally.

The one that was none of those

makefile dead_code = 7, and every hit is prose. # decoy: ×4 (the corpus's own furniture),
# HACK: (the fragile_debt plant), # TODO: (planned_debt), # author: (ownership). makefile's is
the only comment-anchored dead_code rule that is shape-anchored (<identifier>:) rather than
keyword-anchored — shell, python and yaml all require a real keyword, and those languages carry the
identical comments and correctly read 0. Two of the seven double-count the debt plants, and
dead_code feeds risk_dead_code.

Filed as gitgalaxy#2851 and ledgered separately as makefile-dead-code-reads-prose-labels
(upstream-bug), so it reads as the open defect it is instead of hiding inside the morphology entry.

Effect

	before	after
unexplained cells	6	6 (unchanged — the epic's close criterion does not move)
gated metrics	48	55
ledgered cells	100	137
open-defect share	34/2296	35/2645 (the one new defect is the makefile cell)

Verified end to end against engine main with PYTHONPATH pointed at the same worktree — the
provenance guard added in #92 confirms it. All three ledger gates pass.

Artifacts are not committed here: bias-history.yml regenerates them on merge, and this PR touches
tools/** so that runs automatically.