docs: stop the source disclosing what the docs withhold

[velzepooz]

The doc restructuring in #32 published a careful general-terms doc set here while keeping design records, gap lists and measured results out of the repository. Reviewing that work turned up the obvious problem with it: the committed source disclosed more than the documentation withheld. Withholding a document while the code prints the same thing is theatre.

This is the follow-up. Comments and prose only.

The rule applied

Keep the constraint; drop the advantage.

These comments exist so nobody "simplifies" a deliberately narrow predicate, and that reasoning had to survive — losing it is worse than the disclosure, because the next contributor widens the predicate and reopens a hole. What went is anything handing a reader a measurement of how much room remains, the shape of an input that defeats a check, or a pointer to a record that does not exist in a clone.

Removed across 20 Go files and CHANGELOG.md: measured precision, recall and F1 tables; corpus pool composition and per-sample counts; lift values and before/after tallies; two covert-channel constructions, one of which appeared in three separate places; a worked reverse-shell payload with the grade it received; named corpus specimens; internal decision-record and review-item citations; and paths into a directory tree that is not part of this repository.

What was deliberately kept

• The adversarial suite is published on purpose. cmd/skill-detector/adversarial_test.go, its tables and the testdata/adversarial/ fixtures describe cases the engine does not currently catch, and the tables fail when one of those cases changes state. That standing gate is worth more than the concealment giving it up would buy, and AGENTS.md now records the decision so the next person doing this work does not delete it.
• Comments describing bypasses found and closed, sitting above the tests that keep them closed.
• Test names and fixtures for attacks the scanner detects.
• Every CHANGELOG.md entry, version, date and grade-changing warning.

Two failure modes this had to avoid, and one it hit

Scrubbing can go wrong in both directions, and only one of them is obvious.

Over-scrubbing — a comment that loses the reason a predicate is narrow. Reviewed file by file against "could someone reading only the new comment safely modify this code?"; four comments that had lost their point were repaired.

Strengthening a claim — this one it hit, in eleven places. Zero-in-a-corpus was repeatedly rendered as a universal: "0 malicious hits on the bench corpus" became "does not appear in hostile ones". A bounded measurement became a claim about all inputs that nothing supports and that a rule author might rely on. Worse, in CHANGELOG.md a measured bound — "discards 0 of 20000 genuine payloads" — became "discards no genuine payload", an unconditional guarantee a case-stability threshold cannot make, with the cost half dropped so the entry read as free. Elsewhere "no sample has the gap shape" became "vanishingly rare" while the untouched next sentence still said "zero prevalence", so the entry argued with itself.

All eleven were re-bounded. The scope was restored; the counts were not.

That class is the reason a token scanner is not a review: it sees the absence of a word, never the presence of a falsehood.

Verification

• Comment-only, proven mechanically. A go/scanner token dump across all 88 tracked .go files shows no non-comment token changed anywhere, and no token count moved, with exactly eight enumerated STRING exceptions in adversarial_test.go where measured figures were removed from why: metadata. That field is read only as a t.Errorf format argument, so the change is behaviour-neutral by construction.
• go build, go vet, go test -count=1 ./... — 12 of 12 packages pass.
• CHANGELOG.md structure checked against main: 13 version headings identical, 67 entry bullets against 67, all grade-changing warnings present by name.

https://claude.ai/code/session_01XAY7LzfeuEZBgSLuzpWUAH