R-03A798: what the hunt lexical guard actually reads

Status: settled. The guard's boundary is a case-insensitive match on one literal substring. Everything outside that substring passes, including the four words the repository's own documentation says are banned, and the "other checks" the question attributes them to do not exist.

Reproduce: python hunts/r_03a798/probe.py (~40 s, no mpmath, no network). Data: results.json.

Method

The guard source is not re-implemented, which would only measure my reading of it. tests/test_hunt_probe_discipline.py is copied unmodified into a sandbox repo root in a tempdir, given a minimal hunts/README.md that satisfies its sibling guards, and run by pytest against one planted specimen file at a time. The verdict per specimen is the guard's own exit status.

The control that makes the rest readable: with an empty specimen the sandbox guard is green (specimen_baseline.empty_specimen_guard_green: true), so each failure below is caused by the specimen and not by the sandbox.

Result 1: the specimen battery

The premise handed to this hunt is borne out on its main point and wrong on its subordinate one. The guard does not detect synonyms, true. They are "separately banned but by other checks", false; see result 2.

Two gaps the premise did not raise, and which I think matter more:

• The guard is not even tight on its own word. Eight of the thirteen reserved-word specimens pass. A hunt that writes the claim as certify or breaks it with a zero-width space is not caught. This is not a proposal to chase homoglyphs, an adversary is the wrong model here. But certify and certification are what an honest writer types by accident, and the hyphen-break is what a line-wrapping editor does unbidden.
• The guard cannot tell a claim from a discussion of the rule. It caught Nothing here is <reserved>; that word belongs to zeta/rigor.py: a sentence enforcing the rule. CLAUDE.md states this is deliberate ("intent does not exempt a file; the test reads the bytes"), and it has a cost this hunt paid: probe.py cannot spell the word it studies, so it assembles it at runtime and redacts it from results.json. Only hunts/README.md has an exemption. This is a real design choice with a real price, not a defect, recorded so the price is visible.

Result 2, the census: what enforcement exists

Mechanically, over every tests/*.py that both addresses hunts/ and reads file text:

documented_bans_with_no_enforcing_test in results.json is ["verified", "confirmed", "definitively", "proves"]: all four. There is exactly one whole-tree lexical guard over hunts/, and it scans one word.

(Correction to the probe's own output: its coarse scans_whole_hunts_tree flag also marks test_zeta23ext_imports.py, which in fact rglobs only within hunts/frontier_math/zeta23ext. The flag is a keyword heuristic; the table above is the hand-checked reading of the same five files.)

This was already known and written down, hunts/wide_search/HANDOFF.md records "banned by documentation but not by a test" as a session note. What was not known is that the statement one paragraph above it in CLAUDE.md, "the lexical rules are lexical … the test reads the bytes", is true of the reserved word and not true of the other four. A rule that reads as machine-enforced and is not is worse than a rule that reads as review discipline, because it spends credibility it has not earned.

Result 3: the gap is already realised, not hypothetical

Occurrences of the four words in the committed hunts/ tree today, with the suite green (this hunt's own directory excluded):

The use / rule-mention split is a heuristic (a line naming two or more of the four is read as quoting the rule), and reading the hits shows it over-counts: hunts/frontier_math/zeta23ext/README.md:158 says the source paper proves the lemmas, which is a statement about the literature and perfectly proper. Do not read "15 uses" as "15 violations": I did not adjudicate them one by one, and that is the point. The durable finding is not a count of offences; it is that the count is unknown to the tree, because nothing measures it. A few are plainly the overclaiming shape the rule exists to stop, e.g. hunts/higher_xi/LEAN-FRONTIER.md:292 ("Every intermediate inequality of both chains was verified") and hunts/frontier_math/PROOF-LEDGER.md:645 ("top-3 verified on explicit K=1200 matrices").

What I chose, and why

I did not write the missing guard. Three reasons, in order of weight. First, it is outside this hunt's scope, tests/ is not mine to write, and the brief's kill condition is explicit. Second, the repository's own design discipline says an abstraction needs a live consumer and the smallest thing that works; a vocabulary list is a policy decision about what the lab is willing to fail a build over, and harness/VERDICT.md is what happens when that decision is made by whoever is holding the keyboard. Third, and most substantively: a wider word list is not obviously the right fix. The false-positive cost is real and this hunt measured a sample of it, the reserved-word guard already fails sentences that enforce the rule, and proves in "the source paper proves" is correct English that a lexical ban would break. A ban list scoped to whole-file text is a blunt instrument; the cheap honest options are (a) extend the list and accept the friction with an explicit exemption mechanism, or (b) demote the four words in hunts/README.md and CLAUDE.md from implied-enforced to stated review discipline. Both are defensible. Choosing is the operator's, and the choice is named in HANDBACK.json.

I did not chase evasions as an adversary model. The homoglyph and zero-width results are in the table because they were cheap and they bound the guard's shape, not because I think a hunt will smuggle a claim past it. The morphology gap (certify, certification) is the one with an innocent failure mode, and it is the one worth acting on.

What I could not settle

• Whether the four words should be enforced at all. This is a policy question about the lab's tolerance for false positives, not a measurable one, and I deliberately did not answer it.
• How many of the 15 use-class hits are genuine overclaims. Requires reading each in context and a judgment about the claim behind it. I read four; the rest are listed in results.json with file and line for whoever does.
• Whether the guard is bypassable in ways I did not think to try. The battery is 29 specimens I chose. Absence of detection is measured; absence of other gaps is not, and I make no claim about it.

A blocker the operator has to clear

Creating hunts/r_03a798/ makes tests/test_hunt_probe_discipline.py::test_every_hunt_directory_is_covered_by_the_case_log fail, because every hunt directory must appear in hunts/README.md's case log and this hunt's brief forbids writing outside hunts/r_03a798/. The failure is on the branch as landed and I did not hide it. One line in hunts/README.md's case log clears it. This is a structural collision between the case-log guard and the write-scope rule that every scoped hunt brief will hit, not a mistake in this one, see the first loose thread.

Loose threads

1. Every scoped hunt brief collides with the case-log guard. A brief that says "write only inside hunts/<name>/" cannot satisfy a guard that requires an entry in hunts/README.md. Any hunt opened this way lands the branch red. Why it might matter: it trains agents to either violate their write scope or hand back a red suite, and both are bad habits to install. First step: decide which side gives, either briefs grant a one-line exemption for the case log, or the guard learns to accept a hunt directory whose MISSION.md carries a valid huntspec block as self-classifying.
2. The morphology gap has an innocent failure mode. certify and certification are what someone writes without meaning to claim anything, and they pass. Why it might matter: it is the only gap here that a careful writer hits by accident rather than by intent. First step: change the guard's needle from the full word to its six-letter stem and run the suite, the corpus scan in results.json gives the false-positive count before anyone commits to it.
3. The guard has no exemption mechanism except one hard-coded path. Only hunts/README.md may discuss the rule; a hunt that studies the guard must obfuscate itself, as this one does. Why it might matter: it makes the lexical guards themselves the one part of the tree that resists being studied in place. First step: consider a per-file opt-out marker the guard honours, and count how many files would legitimately claim it (right now: one).
4. hunts/director_run/CLAIMS.md uses FORMALLY VERIFIED as a status label. Why it might matter: it is the banned vocabulary functioning as a disposition in a claims ledger, which is exactly the load-bearing use the rule targets, as opposed to prose about the literature. First step: read that file's disposition vocabulary against CLAUDE.md's certainty ladder and see whether the labels and the rungs agree.