acer: /review + harden liris C036 mlc-engine-wiring-increment (95bc522)

Full adversarial audit of the engine-wiring frontier — the critical property CONFIRMED-SAFE:
transitive import closure = 3 Node builtins (crypto/path/url) + 4 pure-compute modules, NO
fs/child_process/http/net/dynamic-import/eval; runtime probe zero active handles; process_launch=0
holds at runtime. C036_status=OPEN_LIVE_ENGINE_NOT_LAUNCHED honest; Fischer genuine draft-standin;
total + injection-proof (forged-gate-row attempt sanitized, rows stay 7==7). No hidden live launch.

Two LOW findings fixed (catches propagate to canonical tool, bilateral norm):
C038 honesty: engine_counts fischer/mamba/aot trivially == entries (per-line overlay) -> labeled
overlay_lanes=...not-signal in the MLCEWIRELANES row.
C039 cosmetic: cap=0 fell through `||12` -> Number.isFinite so cap=0 emits 0 rows.
Regression-locked; ledger appended C038/C039 (total 39, closed 27, open 4). Suite 283/283, clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/ACER-ATTACK-LIRIS-MLC-ENGINE-WIRING-2026-06-14.hbp

@@ -0,0 +1,7 @@
+ACERATKMLCHDR|host=acer|date=2026-06-14|topic=review-and-harden-liris-mlc-engine-wiring-increment|target=liris-95bc522|method=full-transitive-import-closure-audit+runtime-handle-probe+adversarial-agent|tag=PROVEN|json=0
+ACERATKMLCVERDICT|liris_C036_increment=HELD-SAFE-CONFIRMED|capability_escape=NONE-import-closure-is-3-node-builtins-crypto-path-url-plus-4-pure-compute-modules-no-fs-no-child_process-no-http-no-dynamic-import-no-eval|runtime=zero-active-handles-zero-active-requests|process_launch=0-holds-at-runtime|tag=PROVEN-SAFE|json=0
+ACERATKMLCHONESTY|C036_status=OPEN_LIVE_ENGINE_NOT_LAUNCHED-accurate|fischer=DRAFT_STANDIN_NOT_FISCHER-genuine-no-live-4794|mintPid-is-pure-sha-derivation-no-disk-no-network-the-mint-name-is-benign|no-liveness-overclaim|tag=PROVEN|json=0
+ACERATKMLCINJECTION|total-against-null-throwing-getters-hostile-toString|injection-neutralized-safe()-strips-pipe-cr-lf|from.pid-X-pipe-json1-newline-MLCEWIREGATE-forge-attempt-SANITIZED-rows-stay-7eq7-no-forged-gate-row-survives|tag=PROVEN-SAFE|json=0
+ACERATKMLCCATCHES|C038-decorative-count-LOW=engine_counts-fischer-mamba-aot-trivially-equal-entries-per-line-overlay-FIXED-now-labeled-overlay_lanes-not-signal|C039-cap-zero-LOW=cap0-fell-through-||12-FIXED-Number.isFinite-so-cap0-emits-0-rows|both-LOW-neither-weakens-no-launch-guarantee|tag=ACER-CATCH-x2-FIXED|json=0
+ACERATKMLCCONVERGE|bilateral=liris-built-95bc522-acer-reviewed-hardened|catches-propagate-C038-C039-into-canonical-tool+ledger|the-engine-wiring-frontier-stays-descriptor-only-no-live-launch-until-fabric-daemon-contract|tag=PROVEN|json=0
+ACERATKMLCFTR|state=C036-INCREMENT-1-REVIEWED-CONFIRMED-SAFE-AND-HARDENED|C036-remaining=live-MTP-HRM-Fischer-Mamba-engine-crank-still-OPEN-needs-fabric-ranked-daemon-contract|next=ask-fabric|tag=PROVEN|json=0

docs/ACER-ATTACK-LIRIS-MLC-ENGINE-WIRING-2026-06-14.hbp.sha256

@@ -0,0 +1 @@
+765D95226806F9B14F9F5A9F9D107F474C66682C60C57723E5CB19169D0B6AA4  ACER-ATTACK-LIRIS-MLC-ENGINE-WIRING-2026-06-14.hbp

tests/mlc-engine-wiring-increment.unit.test.mjs

@@ -66,6 +66,14 @@ test('emitted rows are HBP-only and carry the live-launch gate', () => {
   assert.ok(rows.some((row) => row.startsWith('MLCEWIRELANES|') && row.includes('fischer_score_kind=DRAFT_STANDIN_NOT_FISCHER')));
 });
 
+test('cap=0 emits zero MLCEWIRE detail rows (not the 12 default); lane overlay is labeled non-signal (acer review 95bc522)', () => {
+  const rows0 = emitRows({ nodes: 18, cap: 0 });
+  assert.equal(rows0.filter((row) => row.startsWith('MLCEWIRE|')).length, 0);
+  assert.ok(rows0.some((row) => row.startsWith('MLCEWIRESUM|') && row.includes('emitted=0')));
+  const rows = emitRows({ nodes: 12, cap: 5 });
+  assert.ok(rows.some((row) => row.startsWith('MLCEWIRELANES|') && row.includes('overlay_lanes=') && row.includes('not-signal')));
+});
+
 test('tool imports no spawn/write/network/live engine capability', () => {
   const src = readFileSync(join(repo, 'tools/behcs/mlc-engine-wiring-increment.mjs'), 'utf8');
   assert.equal(/child_process|spawnSync|\.spawn\(|execSync|writeFileSync|appendFileSync|fetch\(|http\.request|https\.request|Start-Process|Stop-Process/.test(src), false);

tests/mlc-engine-wiring-increment.unit.test.mjs.sha256

@@ -1 +1 @@
-8FDB0D945FEC7462F6B56754AB8D51B777C85955CA7CFE2C206722EDA9185537  mlc-engine-wiring-increment.unit.test.mjs
+E00C7EADBB46ECF26BAD195B23B06DDA8232E5C78EEE10965DF21CC872B5D673  mlc-engine-wiring-increment.unit.test.mjs

tests/supervisor-collision-router.system.test.mjs

@@ -98,6 +98,7 @@ const sealedFiles = [
   'docs/LIRIS-CATCH-COUNT-LEDGER-2026-06-14.hbp',
   'docs/ACER-SLICE-ENGINE-COSIGN-MINT-2026-06-14.hbp',
   'docs/LIRIS-MLC-ENGINE-WIRING-INCREMENT-2026-06-14.hbp',
+  'docs/ACER-ATTACK-LIRIS-MLC-ENGINE-WIRING-2026-06-14.hbp',
   'docs/acer-ecosystem-fullbody-receipt-20260612.hbp',
   'docs/CLAIMSLEDGER-2026-06-12.hbp',
   'docs/CLAIMSGATE-PARITY-BASELINE-2026-06-12.hbp',

tests/supervisor-collision-router.system.test.mjs.sha256

@@ -1 +1 @@
-D661EEE6012782CDE87C9EE08335C539900569862E129A846164CE05ECFA7FA8  supervisor-collision-router.system.test.mjs
+401BCC7464FCC3FE8673C1902BCDB201FF53F921FAF6455A81981C9BC5E9048F  supervisor-collision-router.system.test.mjs

tools/behcs/catch-count-ledger.mjs

@@ -60,6 +60,8 @@ export const CATCH_ROWS = Object.freeze([
   row({ id: 'C035', date: '2026-06-14', vantage: 'acer-native', source: 'docs/ACER-SLICE-ENGINE-COSIGN-MINT-2026-06-14.hbp', file_or_test: 'canon/laws/LAW-SLICE-ENGINE.md', defect_class: 'class1-cosign-gate', severity: 'MEDIUM', status: closed, owner: 'operator-pair', fix_commit: 'cosign-seq3565-c26eaacb', summary: 'LAW-SLICE-ENGINE-class1-cosign-MINTED-seq3565-row_hash-c26eaacbc85121e8-under-OP-JESSE-apex-standing-quintuple-2026-06-14' }),
   row({ id: 'C036', date: '2026-06-13', vantage: 'liris-plan', source: 'docs/LIRIS-SELFHEAL-200STEP-INTEGRATION-2026-06-13.hbp', file_or_test: 'docs/TARGET-ARCHITECTURE-200-STEP-DELTA-2026-06-11.hbp', defect_class: 'live-engine-wiring-gate', severity: 'HIGH', status: open, owner: 'operator', fix_commit: 'none-open-operator-gated', summary: 'live-MTP-HRM-Fischer-Mamba-engine-wiring-fails-held-safe-gate-until-separate-authorization' }),
   row({ id: 'C037', date: '2026-06-12', vantage: 'liris-plan', source: 'docs/LIRIS-CROWN-PLAN-DEEPENING-READBACK-2026-06-12.hbp', file_or_test: 'README.md', defect_class: 'catch-count-ambiguity', severity: 'LOW', status: closed, owner: 'liris', fix_commit: 'this-ledger-commit', summary: 'README-18-vs-session-circa34-resolved-by-enumerable-ledger-floor-and-open-status' }),
+  row({ id: 'C038', date: '2026-06-14', vantage: 'acer-review', source: 'docs/ACER-ATTACK-LIRIS-MLC-ENGINE-WIRING-2026-06-14.hbp', file_or_test: 'tools/behcs/mlc-engine-wiring-increment.mjs', defect_class: 'decorative-count-honesty', severity: 'LOW', status: closed, owner: 'acer', fix_commit: 'acer-mlc-wire-review', summary: 'engine_counts-fischer-mamba-aot-trivially-equal-entries-per-line-overlay-now-labeled-not-signal' }),
+  row({ id: 'C039', date: '2026-06-14', vantage: 'acer-review', source: 'docs/ACER-ATTACK-LIRIS-MLC-ENGINE-WIRING-2026-06-14.hbp', file_or_test: 'tools/behcs/mlc-engine-wiring-increment.mjs', defect_class: 'cap-zero-fallthrough', severity: 'LOW', status: closed, owner: 'acer', fix_commit: 'acer-mlc-wire-review', summary: 'cap=0-fell-through-||12-to-default-now-Number.isFinite-honored-so-cap0-emits-0-rows' }),
 ]);
 
 function safe(value) {

tools/behcs/catch-count-ledger.mjs.sha256

@@ -1 +1 @@
-31AC51230C8824E5E9EDCBCBB064CB32462A6A87D6A23D961CD1F9C6F34EB8B8  catch-count-ledger.mjs
+DEE5200A612989814A3B69F757DB4904CF95FE6BC31F9521F8A6160DEDA84BC9  catch-count-ledger.mjs

tools/behcs/mlc-engine-wiring-increment.mjs

@@ -179,12 +179,13 @@ export function buildWiring(input = {}) {
 export function emitRows(input = {}) {
   try {
     const opts = isObj(input) ? input : {};
-    const cap = Math.max(0, Math.min(Number.parseInt(String(prop(opts, 'cap', 12)), 10) || 12, 64));
+    const capN = Number.parseInt(String(prop(opts, 'cap', 12)), 10);
+    const cap = Math.max(0, Math.min(Number.isFinite(capN) ? capN : 12, 64)); // cap=0 means 0 rows, not the 12 default
     const built = buildWiring(opts);
     const counts = built.summary.engine_counts;
     const rows = [
       `MLCEWIREHDR|tool=${WIRING_ID}|source=${WATCHER_ID}|stage=C036-increment-1-descriptor-matrix|fabric_request_id=${safe(built.fabric_request_id)}|read_only=1|hbp_rows_only=1|process_launch=0|no_spawn=1|no_fetch=1|no_write=1|no_mint=1|no_live_engine=1|json=0`,
-      `MLCEWIRELANES|mtp=${safe(counts.mtp)}|hrm=${safe(counts.hrm)}|gnn=${safe(counts.gnn)}|fischer=${safe(counts.fischer)}|mamba=${safe(counts.mamba)}|aot=${safe(counts.aot)}|fischer_score_kind=${FISCHER_SCORE_KIND}|json=0`,
+      `MLCEWIRELANES|mtp=${safe(counts.mtp)}|hrm=${safe(counts.hrm)}|gnn=${safe(counts.gnn)}|fischer=${safe(counts.fischer)}|mamba=${safe(counts.mamba)}|aot=${safe(counts.aot)}|fischer_score_kind=${FISCHER_SCORE_KIND}|primary_partition=mtp_hrm_gnn-sum-eq-entries|overlay_lanes=fischer_mamba_aot-per-line-overlay-count-eq-entries-not-signal|json=0`,
       `MLCEWIREGATE|C036_status=OPEN_LIVE_ENGINE_NOT_LAUNCHED|live_launch=${LIVE_GATE}|reason=descriptor-matrix-only-until-fabric-ranks-daemon-contract|process_launch=0|json=0`,
     ];
     for (const entry of built.entries.slice(0, cap)) {

tools/behcs/mlc-engine-wiring-increment.mjs.sha256

@@ -1 +1 @@
-F28A6371CDAE51F759977D149A053999E0DEA1D5CBAC8E52CD47AA20CFCDED81  mlc-engine-wiring-increment.mjs
+DC7FA91D555A2D34850DF40B95C38510AF445F109511E2DFDBB39C601C23C1E3  mlc-engine-wiring-increment.mjs