feat(ledger-health): orphan-token audit + scope batch5 down (#75)

[squid-protocol]

Closes #75.

The problem

A collective deviation_ledger.json entry lists a signal union of N tokens across M languages; the reports read it as the N×M cross-product of excused cells (bias_report.explain_out_of_band, docs/GATING.md "ledgered"). The shapes an entry documents retire one at a time — a decoy gets planted, an engine rule narrows, a metric re-baselines — and nothing notices when the last out-of-band cell a token still explained goes green. The token then sits in the union excusing a dead cell nobody looks at, which the ledger _doc rule already forbids: "a token must hold for EVERY language listed." #75 showed this is structural — batch5-tier2-morphology-shapes had decayed for the third time.

The automation (tools/ledger_orphan_check.py)

A scan-free, baseline-gated audit modelled on na_check.py:

• Flags orphan tokens — a validated signal token that has a comparable cell but is in band on all of them. Resolves api→raw_arch_api (the engine's own RISK_INPUT_COLUMNS map) so it reads the column the signal is actually measured under; skips n/a tokens (that's na_check's domain) and ungated/pseudo-signal tokens (api_orphan_credit, structural_boundaries, vocabulary columns) that are never banded.
• Cannot disagree with the gate — it reuses bias_report.out_of_band_cells/reference_medians, the exact banding bias_report.py --gate uses.
• Baseline-gated, report-not-hard-gate (answering batch5-tier2-morphology-shapes has decayed again: 4 of its 8 signal tokens now excuse nothing, and one of them is factually wrong #75's open question) — docs/orphan_token_baseline.json holds the reviewed backlog; --ci fails only on new orphans; the human report highlights partial-decay entries (some tokens dead while others still hold) as the scope-down candidates.

Responsive wiring:

• verify.yml gates PRs on new orphans (seconds, scan-free).
• bias-history.yml re-baselines in lockstep with the cache against engine main, so engine drift re-baselines itself and a PR's --ci only ever sees orphans the PR introduced.
• bias_report.py prints an orphan summary on every regen.

Current backlog: 47 orphan tokens across 37 entries, 8 partially decayed — the first run already proves #75's thesis was corpus-wide, not a batch5 quirk.

batch5 scope-down

Dropped safety from the union: #59 retired the css/yaml safety pairing and against engine main 08a08c6 all five languages read the median (green), so it excused nothing — removing it changes no gate outcome (gate stays at 0 unexplained). Kept branch/doc (real, still-true documented shapes not deviating today), now recorded in the orphan baseline as reviewed-dormant so the next reader doesn't re-litigate them.

A live demonstration of why this is needed

#75 was measured against engine 15d7af4 and proposed also dropping high_risk_execution (orphaned + its "no JCL form" claim disproved by #72). But against current engine main 08a08c6, high_risk_execution reads 2 vs median 3 for css/html/jcl/yaml and is load-bearing again; meanwhile api's real deviation moved onto raw_arch_api. The audit caught that #75's own hand-analysis had gone stale in five days — exactly the decay it exists to catch — so I did not hand-apply the stale token list; the tool is the source of truth. The verdict records all of this.

Verification

• ledger_orphan_check.py --ci → exit 0 against the committed baseline; drop any baselined token and it exits 1 with the offending cells named.
• bias_report.py --gate equivalent: 0 unexplained cells after the safety drop.
• YAML/JSON validated; no import cycle (deferred import, like findings_report).

Cross-repo

None — self-contained in this repo. No engine change is required; the audit reads the committed docs/bias_data.json cache that bias-history.yml already maintains against engine main.

🤖 Generated with Claude Code