[prasannakotyal]

Summary

Targets KG red #131, where custom_kernel is a lambda expression that returns saved state when present and otherwise populates that state through __setitem__ with data.clone().

This adds a narrow LAMBDA_SETITEM_REPLAY detector. It requires:

• top-level custom_kernel = lambda ...
• a ternary lambda body with an input-independent replay guard
• direct return of a subscripted state object on the replay branch
• state.__setitem__(..., <input-derived>) in the populate branch

Normal lambda kernels that compute from the current input, or lambdas that only read constant state, stay out of scope.

KernelGuard-Red-Submission: 131

Local verification

• red_11_lambda_list_setitem_replay -> LAMBDA_SETITEM_REPLAY, should_filter=True
• red_12_lambda_dict_setitem_replay -> LAMBDA_SETITEM_REPLAY, should_filter=True
• clean_lambda_compute -> stays valid
• clean_lambda_constant_state -> stays valid
• python -m py_compile kernelguard.py

[github-actions]

KernelGuard Blue Evaluation

• Evaluation job: 61
• Blue submission: 41
• Result: passed
• Target red submission caught: True
• Validation suite: TP 20/20, FP 20/20
• Surgicalness score: 1.0
• Workflow run: https://github.com/SinatrasC/kernelguard/actions/runs/25237928690

[SinatrasC]

Thanks for the KernelGuard Flywheel Campaign contribution. We are not merging this narrow variant separately because the consolidated rule-family implementation in #273 is the merge path for this detector area.