diff --git a/.github/workflows/asvs-tally-lint.yml b/.github/workflows/asvs-tally-lint.yml
new file mode 100644
index 00000000..8019ee66
--- /dev/null
+++ b/.github/workflows/asvs-tally-lint.yml
@@ -0,0 +1,74 @@
+name: ASVS tally lint
+
+# Refuses a NEW hard-coded ASVS verdict tally in a document (ADR 0156, BACKLOG #1203).
+#
+# WHY THIS IS A SEPARATE WORKFLOW RATHER THAN A pytest TEST, which is where a guard would normally
+# live in this repo. The defect this catches is written into DOCUMENTS, so the pull request that
+# introduces it is usually docs-only -- and on a docs-only pull request ci.yml's `changes` job sets
+# `code=false` and the whole pytest suite is skipped. A guard reachable only through pytest would
+# therefore not run on the exact shape it exists to police. ci.yml already carries two guards that
+# were ungated for precisely this reason (the BACKLOG number-space gate and the status invariant),
+# and the note above them records what the second one cost before it was.
+#
+# The natural home is that same ungated "Doc guards" step in ci.yml. It is not used here because
+# ci.yml's `changes` job is under an open pull request (MEFORORG#299) and a second edit to those
+# lines would conflict. FOLLOW-UP: once #299 lands, fold this into the doc-guards list and delete
+# this file, so there is one place that decides which guards run on a docs-only pull request rather
+# than two.
+#
+# BOTH PATHS ARE LIVE MEANWHILE, deliberately and not as belt-and-braces theatre: this workflow
+# covers docs-only pull requests, and tests/test_asvs_tally_lint.py runs the same lint inside the
+# required `test` legs for code pull requests. They cannot disagree -- both invoke the same module
+# against the same frozen baseline.
+#
+# NOT A REQUIRED CHECK, and it must not become one without the owner's decision: it is paths-
+# filtered, so it does not report on a pull request that touches no document, and a required check
+# that never reports blocks that pull request forever (the required-but-absent trap, docs/CI.md).
+# .github/required-contexts.txt is the record of what is required; it is not listed there.
+on:
+  pull_request:
+    # The filter MUST include this workflow, the lint, and the baseline. A gate excluded from its
+    # own trigger cannot observe changes to itself -- a broken lint or a quietly widened baseline
+    # would merge green and be discovered later by an unrelated documentation edit.
+    paths: &tally_paths
+      - 'docs/**'
+      - 'scripts/docs/asvs_tally_lint.py'
+      - 'scripts/docs/asvs_tally_baseline.txt'
+      - '.github/workflows/asvs-tally-lint.yml'
+  push:
+    branches: [main]
+    paths: *tally_paths
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: asvs-tally-lint-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  tally:
+    name: no new hard-coded ASVS tally
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false # read-only lint job; don't persist the token (zizmor: artipacked)
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14'
+
+      # No install step and no dependency: the lint is stdlib-only, which is also what lets the
+      # assessment repo mirror and run it on a bare interpreter. tests/test_asvs_verifier_vault_contract.py
+      # holds that property for every mirrored tool, so it cannot be lost quietly here.
+      #
+      # The lint prints the file count, the idiom breakdown and the per-file counts before its
+      # verdict, so a run that scanned nothing cannot be read as a run that found nothing.
+      - name: Refuse a new hard-coded ASVS tally
+        run: |
+          python scripts/docs/asvs_tally_lint.py docs \
+            --baseline scripts/docs/asvs_tally_baseline.txt \
+            --allow docs/security/ASVS-CURRENT.md
diff --git a/docs/BACKLOG.md b/docs/BACKLOG.md
index 053630c1..fbba25d5 100644
--- a/docs/BACKLOG.md
+++ b/docs/BACKLOG.md
@@ -8824,3 +8824,163 @@ larger change than this one.
 **Source:** found 2026-08-09 while probing for a second instance of the `#1106` class before building a
 generalised check, on the reasoning that a meta-check built from one instance is shaped like that
 instance. Two domains were probed; this one leaked.
+
+## 1202. the vault ASVS gate runs a verifier this repo owns, on a bare interpreter, and nothing here checked it would run
+
+> 🔢 **Filed 2026-08-09 - FIXED in the same change. Proved by injecting four contract violations into `scripts/asvs/scorecard.py` and confirming each landed before believing the red.** Value **6/10** · Difficulty **2/10**. The ASVS gate lives in the vault and measures THIS tree. Two of its three claims about this tree need no private data -- that `scripts/asvs/scorecard.py` exists at that literal path, and that it runs as a bare script on stdlib alone -- and neither repo checked either of them.
+
+**Cluster:** CI correctness / gate blindness. **Priority:** P2. **Verdict:** build (done).
+**Severity:** no product effect and no PHI effect. The cost is that the ASVS record would go on being
+verified by a stale instrument while every check stayed green.
+
+**The shape.** The vault executes the verifier twice, and neither job installs anything:
+`asvs-scorecard.yml` runs `python scripts/asvs/scorecard.py` after a bare `actions/setup-python`, and
+`asvs-verifier-drift.yml`'s `preflight` job runs the INCOMING engine copy as
+`python ../engine/scripts/asvs/scorecard.py` from the vault checkout -- so `sys.path[0]` is
+`scripts/asvs`, not either repo root. `asvs-scorecard.yml` states the invariant in as many words:
+"No install step and no dependency: the verifier is stdlib-only (tomllib, json, re) precisely so this
+job cannot rot on a lockfile it does not own." **Asserted in a comment, enforced nowhere** -- which is
+the compensating-control-on-a-false-premise defect Secure_Development_Standards SDS-3.7 names.
+
+**Why this repo's own tests could not see it.** `tests/test_asvs_scorecard.py` imports the module --
+`from scripts.asvs.scorecard import ...` -- inside a pytest session with the repo root on `sys.path`
+and the project's full extras installed. That is a different import context from the one the vault
+uses, so the invocation that actually matters was never exercised here.
+
+**Measured.** With a USED `import httpx` appended to `scripts/asvs/scorecard.py` (httpx is a real
+engine dependency, so this is not dead code a linter rejects anyway), every pre-existing gate returned
+a verdict IDENTICAL to its unmutated verdict: `ruff check .` PASS -> PASS, `ruff format --check .`
+unchanged, `mypy` unchanged (it types `messagefoundry` and `messagefoundry_webconsole`, not
+`scripts/`), and `tests/test_asvs_scorecard.py` 54 tests PASS -> PASS. `python -I -S -c "import httpx"`
+returns 1, confirming the mutation models the vault runner and not a lint opinion.
+
+**What breaking it would cost, stated exactly.** Not a red gate. The mirror job opens its pull request
+as a DRAFT when the incoming verifier does not run, and a draft is never merged -- so the vault keeps
+verifying the record with its PREVIOUS copy while reporting drift as a warning. That is the recurring
+condition (six hand-made mirror commits, the last found 326 lines behind) that splitting
+`asvs-verifier-drift.yml` out was written to end.
+
+**The guard.** `tests/test_asvs_verifier_vault_contract.py`: the file exists at the hardcoded path; a
+stdlib-only `ast` scan over EVERY import including deferred ones; and a `python -I -S <script> --help`
+run from an unrelated working directory. Four injected violations were each confirmed to land (by
+digest) before their red was believed. A module-level third-party import, a first-party import and a
+rename red both the scan and the smoke run; **a third-party import DEFERRED into a function body reds
+only the `ast` scan and passes the smoke run**, which is why the scan is the load-bearing half.
+
+**Trigger, checked rather than assumed.** Extracting the live `noncode` regex out of `ci.yml` and
+running real `grep -E`: a PR touching only `scripts/asvs/scorecard.py` classifies `code=true`, as does
+one touching only the guard's own file -- so the gate is inside its own trigger -- while a
+`docs/SECURITY.md`-only PR correctly stays `code=false`. No new workflow and no new required context
+were needed; the trigger was already right and the check was what did not exist.
+
+**Not in scope, and not fixable here.** The gate's third claim -- that the recorded evidence anchors
+still resolve -- needs the private assessment record, so it can only run where that record is. No
+credential-free cross-repo trigger exists for it; the vault's daily cron remains its only authority.
+
+## 1204. a forward-only lint refusing a NEW hard-coded ASVS tally, with the idiom set rebuilt from the corpus
+
+> 🔢 **Filed 2026-08-09 - FIXED in the same change. Every idiom is driven from both sides, and the eight documents that motivated it were confirmed RED before it landed.** Value **7/10** · Difficulty **3/10**. ADR 0156 made the ASVS count computed. It did not stop anyone writing one down: 44 documents assert a whole-corpus tally, roughly fifty distinct tallies exist, and approximately one is correct.
+
+**Cluster:** Documentation correctness / gate blindness. **Priority:** P2. **Verdict:** build (done).
+**Severity:** no product effect and no PHI effect. The cost is a security record whose published
+numbers disagree with each other and with the tool that derives them.
+
+**Why a lint and not a sweep.** A one-time banner sweep over a file list was tried on the assessment
+corpus. It cost roughly 850 net lines, needed its own repair commit, and the defect regenerated
+inside four days because eight new documents were written after it. **A pass over a file list cannot
+constrain what is written next.** This lint is therefore forward-only: existing tallies are RECORDED
+in `scripts/docs/asvs_tally_baseline.txt`, not edited, and the baseline may only shrink -- it stores
+an occurrence count per claim, so adding a copy of an already-grandfathered tally fails, and removing
+one fails until the entry comes down with it.
+
+**The idiom set was rebuilt from the corpus, and the previous attempt's recall was reproduced first.**
+That attempt matched two shapes, an `N / N / N / N` tuple and `N of 345`. Re-implementing exactly
+those two and running them over the corpus reds **2 of the 8 chapter reports** -- matching the
+register's independent finding that it missed 6 of 8. The five idioms here red **8 of 8**. Two of them
+are shapes the old set could not see at all: a **Markdown table row** whose cells close to the corpus
+total, which is the shape the one CORRECT record is written in, and an **arithmetic assertion** that
+closes to it. A third, markdown-emphasis tolerance, is worth naming on its own: one chapter report
+writes its tally with the verdict words in backticks, and a detector using a bare `\s*` walks past it.
+
+**The discriminator, and why the previous attempt produced 73 false hits.** A run of integers counts
+as a tally only when it SUMS TO THE PINNED CORPUS TOTAL. An unbounded slash tuple matches HL7 field
+notation (`MSH-9/10/12`, `PID-3/4/18`), X12 transaction sets, HTTP status-code lists and config
+defaults; every one of those is now a permanent negative-control test. Corpus STRUCTURE is also
+deliberately not flagged -- the requirement count and the level split are pinned constants that cannot
+go stale, and flagging them is what made the previous attempt red the method document's own worked
+example, which is a literal letter rather than a count.
+
+**Proved on real files, both directions.** Eight mutations, one per idiom, appended to a real document
+in this repo: all eight RED, each confirmed to have landed by digest before its red was believed.
+Five controls appended through the identical path: all five stayed GREEN.
+
+**Trigger, and why it is a separate workflow.** The defect is written into DOCUMENTS, so the pull
+request carrying it is usually docs-only -- and a docs-only pull request sets `code=false` and skips
+the entire pytest suite. A guard reachable only through pytest would not run on the shape it exists
+to police, which is the same defect two guards in `ci.yml` were ungated to fix. Measured with the live
+globs and the live regex: a docs-only pull request FIRES the new workflow and ran no pytest at all
+before. The workflow includes its own file, the lint and the baseline in its trigger.
+
+**Scope, stated plainly.** The engine can only lint the documents it holds. The bulk of the affected
+corpus lives in the assessment repo and can only be linted there; the tool is stdlib-only and
+mirrorable for that reason, and `tests/test_asvs_verifier_vault_contract.py` now holds that property
+over a LIST of mirrored tools rather than the single one it was written for. Wiring it in on that side
+is a change in that repo, not this one. **Retiring the existing 44 documents is explicitly not part of
+this item** -- that is a sweep, it was costed and refused, and it is the owner's decision.
+
+## 1205. half the ASVS record is prose nothing checks: ~2,000 `file:line` citations, none verified
+
+> 🔢 **Filed 2026-08-09 - the FORWARD-ONLY gate is built; the existing population is grandfathered and NOT swept.** Value **7/10** · Difficulty **3/10**. Roughly two thousand `file:line` citations live inside `residual` prose across about 250 cells. Nothing checks any of them, and a sample measured 44.9% stale.
+
+**Cluster:** Documentation correctness / gate blindness. **Priority:** P2. **Verdict:** build (gate done; the population is a separate decision).
+**Severity:** no product effect and no PHI effect. The cost is that the part of the record a reviewer
+actually reads is the part with no gate behind it.
+
+**The demonstration case, verified against public engine code at this commit.** Cell 6.3.3's gated
+`[[cell.evidence]]` anchor for the exposure check points at `messagefoundry/__main__.py:1125`, and
+that line reads `instance_exposed = not settings.api.is_loopback or ...` -- correct, and the only
+occurrence of that statement in the file. The prose in the SAME CELL cites `__main__.py:1917`, which
+is the middle of a warning string about the browser console. **The gated half is right and the read
+half is wrong, in one cell, about one control.**
+
+**Measured at the pinned record.** 2,052 citations across 247 cells; 1,086 name a bare basename with
+no directory. On the "cannot resolve even in principle" claim the honest split is finer than the
+round number suggests: resolved against this worktree, 129 of those basenames match no file at all,
+276 match two or more, and 677 happen to match exactly one. So *unresolvable in practice* is 405; the
+remaining 677 resolve only by luck of there being one candidate, which is not a property the citation
+format guarantees. Both figures are recorded rather than one being quoted.
+
+**Bulk promotion into gated anchors was refused and is not attempted.** Roughly a thousand
+hand-authored tokens, it doubles the gated surface, and it makes *delete the citation* the cheapest
+compliant act on the basenames.
+
+**THE KEY IS THE DESIGN.** A citation is identified by `cell id + field + FILE`, never by its line
+number. Three consequences: the population of (cell, field, file) pairs cannot grow; the occurrence
+count in the frozen baseline stops an existing pair growing either, so the total can only shrink; and
+**repairing a stale line number is FREE and needs no baseline edit, while adding a citation is
+refused and deleting one costs an edit.** That ordering is chosen deliberately -- it makes correction
+the cheapest compliant act, which is the exact inverse of the incentive the rejected approach created.
+
+**It refuses to succeed on an empty scan.** The tool runs where the data is, which is not this repo,
+so the dangerous failure is the silent one: pointed at a renamed field or a document with no cells,
+"no new citations" and "nothing was examined" would otherwise share an exit code. Both now exit 2, and
+the scan inventory prints before the verdict.
+
+**Proved at scale against the real record, locally.** Baseline of 1,233 claims over 2,052
+occurrences; a new path-qualified citation REDs, a new bare basename REDs, deleting a citation without
+lowering the baseline REDs, a renamed field and a missing baseline both exit 2 -- and repairing 6.3.3's
+stale line stays GREEN with no baseline edit. Every mutation confirmed to have landed before its
+verdict was believed.
+
+**Where it can run, stated plainly.** The record exists only in the assessment repo, so unlike the
+tally lint this one has NO engine-side subject at all. What ships here is the tool, stdlib-only and
+mirrorable on the ADR 0156 section 7 footing, with fixture tests; the baseline and the wiring belong
+beside the data. **No engine workflow is added, deliberately** -- a gate pointed at nothing is the
+failure this tool refuses to commit itself.
+
+**One hypothesis I held and measurement refuted.** I expected a baseline keyed on cell id to leak
+verdicts, since residuals sound like a property of unresolved cells. Measured: cited residuals occur
+across every verdict class, including a large majority of the passing ones, and the split of
+cited-residual cells is close to even between pass and not-pass. **The verdict-leak argument does not
+hold** and is withdrawn. The baseline still belongs beside the data, on the stronger ground that a
+frozen list is unverifiable from a repo that cannot see what it grandfathers.
diff --git a/scripts/docs/asvs_residual_lint.py b/scripts/docs/asvs_residual_lint.py
new file mode 100644
index 00000000..a5da7c60
--- /dev/null
+++ b/scripts/docs/asvs_residual_lint.py
@@ -0,0 +1,255 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Copyright (C) 2026 MessageFoundry Organization and contributors
+"""Refuse a NEW ``file:line`` citation in ASVS scorecard prose (ADR 0156).
+
+Half the assessment record is prose nothing checks. Roughly two thousand ``file:line`` citations
+live inside ``residual`` text across ~250 cells; a sample measured 44.9% of them stale. The
+demonstration case is cell 6.3.3, where the GATED evidence anchor for ``instance_exposed`` points at
+``messagefoundry/__main__.py:1125`` -- which is correct -- while the prose in the SAME CELL cites
+``__main__.py:1917``, which is a different statement altogether. **A reviewer reads the prose.**
+
+WHAT THIS IS NOT. It does not promote those citations into gated anchors. That was costed and
+refused: roughly a thousand hand-authored tokens, it doubles the gated surface, and it makes
+*delete the citation* the cheapest compliant act on the ~1,000 bare basenames.
+
+THE KEY IS THE POINT, so it is stated before the code. A citation is identified by
+``cell id + field + FILE``, and deliberately **not** by its line number. Three consequences, and the
+third is the whole design:
+
+  * the population of (cell, field, file) citations cannot grow, and because the baseline carries an
+    occurrence COUNT, the number of citations inside an existing one cannot grow either. The total
+    can only shrink;
+  * a baseline keyed on line numbers would be invalidated by every edit above a citation, which
+    turns a frozen list into a list that must be re-typed -- the decaying-budget failure this
+    programme is unpicking elsewhere;
+  * **REPAIRING A STALE LINE IS FREE. ADDING A CITATION IS NOT. DELETING ONE COSTS A BASELINE EDIT.**
+    That ordering is chosen. The rejected approach made deletion the cheapest compliant act; this
+    makes correction the cheapest, which is the behaviour actually wanted from someone who has just
+    noticed a citation is wrong.
+
+IT REFUSES TO SUCCEED ON AN EMPTY SCAN. This tool runs where the data is, which is not this repo, so
+the failure that matters most is the silent one: pointed at a moved file, a renamed field or an
+empty document, "no new citations" and "nothing was examined" are the same exit code. Both are
+therefore errors, and the scan inventory is printed before the verdict rather than after it.
+
+Stdlib only, so it can be mirrored and run without an install -- the property
+``tests/test_asvs_verifier_vault_contract.py`` holds over every mirrored tool.
+
+    python scripts/docs/asvs_residual_lint.py <scorecard.toml> --baseline <baseline.txt>
+    python scripts/docs/asvs_residual_lint.py <scorecard.toml> --print-keys > <baseline.txt>
+"""
+
+from __future__ import annotations
+
+import argparse
+import re
+import tomllib
+from collections.abc import Iterable, Iterator
+from dataclasses import dataclass
+from pathlib import Path
+
+# A source reference carrying a line number. The extension list is closed on purpose: an open
+# `\w+\.\w+:\d+` matches version strings, host:port pairs and ordinary sentences, and a citation
+# lint whose first delivery is false positives does not get a second one.
+CITATION = re.compile(
+    r"(?<![\w/\\.-])"
+    r"([\w][\w./\\-]*\.(?:py|toml|md|yml|yaml|json|ts|tsx|ps1|sh|cfg|ini|txt|lock))"
+    r"\s*:\s*(\d+)\b"
+)
+
+# The prose field scanned unless told otherwise. `absence[].mutation` also carries citations (32 of
+# them across 24 cells, measured) and can be added with --field; it is not on by default because the
+# brief scopes this to residuals and a wider default would change what an existing baseline means.
+DEFAULT_FIELDS = ("residual",)
+
+
+@dataclass(frozen=True)
+class Citation:
+    """One ``file:line`` citation found in a cell's prose."""
+
+    cell: str
+    field: str
+    file: str
+    line: int
+
+    @property
+    def bare(self) -> bool:
+        """A basename with no directory component -- it names no location by itself."""
+        return "/" not in self.file and "\\" not in self.file
+
+    def key(self) -> str:
+        """Baseline identity. Note the ABSENCE of the line number: see the module docstring."""
+        return f"{self.cell}\t{self.field}\t{self.file}"
+
+
+class EmptyScan(RuntimeError):
+    """Raised when nothing was examined. Never let that report as success."""
+
+
+def _field_values(cell: dict[str, object], field: str) -> Iterator[str]:
+    """Resolve a field spec against one cell.
+
+    ``residual`` is a plain string field; ``absence[].mutation`` addresses a member of every entry
+    in a list of tables. Both forms occur in the record, so both are supported rather than the
+    caller being asked to flatten first.
+    """
+    head, _, rest = field.partition("[].")
+    value = cell.get(head)
+    if not rest:
+        if isinstance(value, str):
+            yield value
+        return
+    if isinstance(value, list):
+        for entry in value:
+            if isinstance(entry, dict):
+                inner = entry.get(rest)
+                if isinstance(inner, str):
+                    yield inner
+
+
+def scan_cells(
+    cells: Iterable[dict[str, object]], fields: Iterable[str]
+) -> tuple[list[Citation], int, int]:
+    """Return (citations, cells examined, prose characters examined)."""
+    fields = tuple(fields)
+    out: list[Citation] = []
+    n_cells = 0
+    n_chars = 0
+    for cell in cells:
+        n_cells += 1
+        cid = str(cell.get("id", "?"))
+        for field in fields:
+            for text in _field_values(cell, field):
+                n_chars += len(text)
+                for m in CITATION.finditer(text):
+                    out.append(Citation(cid, field, m.group(1), int(m.group(2))))
+    return out, n_cells, n_chars
+
+
+def load_scorecard(path: Path) -> list[dict[str, object]]:
+    data = tomllib.loads(path.read_text(encoding="utf-8"))
+    cells = data.get("cell")
+    if not isinstance(cells, list) or not cells:
+        raise EmptyScan(
+            f"{path} contains no [[cell]] entries. Refusing to report a clean scan of nothing: "
+            f"'no new citations' and 'nothing was examined' must not share an exit code."
+        )
+    return [c for c in cells if isinstance(c, dict)]
+
+
+def load_baseline(path: Path | None) -> dict[str, int]:
+    """Grandfathered citations as ``key -> occurrence count``."""
+    out: dict[str, int] = {}
+    if path is None:
+        return out
+    if not path.is_file():
+        raise EmptyScan(
+            f"baseline {path} does not exist. A missing baseline silently reclassifies every "
+            f"grandfathered citation as NEW, or -- read the other way -- makes the gate vacuous. "
+            f"Pass --no-baseline to scan without one deliberately."
+        )
+    for raw in path.read_text(encoding="utf-8").splitlines():
+        line = raw.rstrip("\n")
+        if not line.strip() or line.lstrip().startswith("#"):
+            continue
+        key, _, count = line.rpartition("\t")
+        if not key or not count.isdigit() or key.count("\t") != 2:
+            raise ValueError(
+                f"malformed baseline line (expected 'cell<TAB>field<TAB>file<TAB>count'): {line!r}"
+            )
+        out[key] = int(count)
+    return out
+
+
+def counted(cites: Iterable[Citation]) -> dict[str, int]:
+    out: dict[str, int] = {}
+    for c in cites:
+        out[c.key()] = out.get(c.key(), 0) + 1
+    return out
+
+
+def main(argv: list[str] | None = None) -> int:
+    ap = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    ap.add_argument("scorecard", type=Path)
+    ap.add_argument("--baseline", type=Path, default=None)
+    ap.add_argument(
+        "--no-baseline",
+        action="store_true",
+        help="scan with no baseline at all (every citation reads as NEW); for generating one.",
+    )
+    ap.add_argument(
+        "--field", action="append", default=None, help="prose field to scan; repeatable."
+    )
+    ap.add_argument("--print-keys", action="store_true")
+    args = ap.parse_args(argv)
+
+    fields = tuple(args.field) if args.field else DEFAULT_FIELDS
+    try:
+        cells = load_scorecard(args.scorecard)
+        baseline = {} if args.no_baseline else load_baseline(args.baseline)
+    except EmptyScan as exc:
+        print(f"FAIL: {exc}")
+        return 2
+
+    cites, n_cells, n_chars = scan_cells(cells, fields)
+
+    # THE INVENTORY COMES FIRST. A run that examined nothing must be visibly different from a run
+    # that found nothing, and only the inventory distinguishes them.
+    bare = [c for c in cites if c.bare]
+    print(f"SCANNED: {args.scorecard}")
+    print(f"SCANNED: {n_cells} cells, fields {list(fields)}, {n_chars} characters of prose")
+    print(
+        f"SCANNED: baseline {args.baseline} -> {len(baseline)} claims ({sum(baseline.values())} occurrences)"
+    )
+    print(
+        f"FOUND:   {len(cites)} citations across {len({c.cell for c in cites})} cells; "
+        f"{len(bare)} are bare basenames that name no directory"
+    )
+
+    if n_chars == 0:
+        print(
+            f"FAIL: examined {n_cells} cells and found ZERO characters of prose in {list(fields)}. "
+            f"That is a field name that no longer resolves, not a clean record."
+        )
+        return 2
+
+    observed = counted(cites)
+    if args.print_keys:
+        for key in sorted(observed):
+            print(f"{key}\t{observed[key]}")
+
+    new = [c for c in cites if observed[c.key()] > baseline.get(c.key(), 0)]
+    stale = sorted(k for k, n in baseline.items() if observed.get(k, 0) < n)
+
+    rc = 0
+    if new:
+        rc = 1
+        seen: set[str] = set()
+        print(f"\nFAIL: {len(new)} citation(s) beyond what the frozen baseline grandfathers:")
+        for c in sorted(new, key=lambda c: (c.cell, c.field, c.file, c.line)):
+            if c.key() in seen:
+                continue
+            seen.add(c.key())
+            print(
+                f"  cell {c.cell} [{c.field}] {c.file}:{c.line}"
+                f"{'   (bare basename -- names no location)' if c.bare else ''}"
+            )
+        print(
+            "\nA file:line in prose is checked by nothing and goes stale silently -- measured at "
+            "44.9% in a sample, with cell 6.3.3 citing a line in the same file its own gated anchor "
+            "gets right. Cite the behaviour, or add a real [[cell.evidence]] anchor, which IS gated. "
+            "REPAIRING an existing citation's line number is free and needs no baseline edit."
+        )
+    if stale:
+        rc = 1
+        print(f"\nFAIL: {len(stale)} baseline entr(ies) over-count the record. The list may only")
+        print("SHRINK -- lower or delete these in the change that removed the citation:")
+        for k in stale:
+            print(f"  have {observed.get(k, 0)}, baseline says {baseline[k]}:  {k}")
+    if rc == 0:
+        print("\nOK: no new file:line citation in scorecard prose.")
+    return rc
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/scripts/docs/asvs_tally_baseline.txt b/scripts/docs/asvs_tally_baseline.txt
new file mode 100644
index 00000000..f73c1c0a
--- /dev/null
+++ b/scripts/docs/asvs_tally_baseline.txt
@@ -0,0 +1,30 @@
+# Grandfathered ASVS tallies -- FROZEN, and this list may only SHRINK.
+#
+# Format:  <path> TAB <idiom> TAB <tally token> TAB <occurrence count>
+# Produced by:  python scripts/docs/asvs_tally_lint.py docs --print-keys
+#
+# These are the hard-coded ASVS verdict tallies already in this repo's documents when the lint
+# landed. They are RECORDED, not edited. A one-time sweep was tried on the assessment corpus: it
+# cost about 850 net lines, needed its own repair commit, and the defect regenerated inside four
+# days because new documents were written after it. This file is what makes the lint forward-only.
+#
+# To retire one: delete the tally from the document AND lower or delete its line here, in the same
+# change. A line left behind over-counts the tree and FAILS the lint. That is the ratchet.
+docs/BACKLOG.md	SLASH_RUN	192/20/0/133	1
+docs/BACKLOG.md	SLASH_RUN	212/0/0/133	2
+docs/Secure_Build_Scorecard_MEFOR.md	LABELLED_VERDICTS	5fail,46partial,179pass	1
+docs/Secure_Build_Scorecard_MEFOR.md	SLASH_RUN	175/50/2/118	1
+docs/Secure_Build_Scorecard_MEFOR.md	SLASH_RUN	179/46/5/115	3
+docs/Secure_Build_Scorecard_MEFOR.md	SLASH_RUN	192/20/0/133	1
+docs/Secure_Build_Scorecard_MEFOR.md	SLASH_RUN	199/51/2/93	1
+docs/Secure_Build_Scorecard_MEFOR.md	SLASH_RUN	212/0/0/133	1
+docs/Secure_Build_Scorecard_MEFOR.md	SLASH_RUN	214/0/0/131	1
+docs/adr/0019-pluggable-keyprovider-hsm-kms-vault.md	SLASH_RUN	178/20/6/141	1
+docs/adr/0019-pluggable-keyprovider-hsm-kms-vault.md	SLASH_RUN	189/20/3/133	2
+docs/adr/0019-pluggable-keyprovider-hsm-kms-vault.md	SLASH_RUN	192/20/0/133	2
+docs/archive/backlog/BACKLOG-CLOSED.md	AGAINST_TOTAL	68of345	1
+docs/archive/backlog/BACKLOG-CLOSED.md	LABELLED_VERDICTS	0fail,0partial,131na,214pass	1
+docs/archive/backlog/BACKLOG-CLOSED.md	SLASH_RUN	179/46/5/115	1
+docs/archive/backlog/BACKLOG-CLOSED.md	SLASH_RUN	189/52/10/94	1
+docs/archive/backlog/BACKLOG-CLOSED.md	TABLE_ROW	179|51|5|110	1
+docs/archive/backlog/BACKLOG-CLOSED.md	TABLE_ROW	189|57|10|89	1
diff --git a/scripts/docs/asvs_tally_lint.py b/scripts/docs/asvs_tally_lint.py
new file mode 100644
index 00000000..af7dbe79
--- /dev/null
+++ b/scripts/docs/asvs_tally_lint.py
@@ -0,0 +1,319 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Copyright (C) 2026 MessageFoundry Organization and contributors
+"""Refuse a NEW hard-coded ASVS verdict tally in a Markdown document (ADR 0156).
+
+ADR 0156 made the count computed. It did not stop anyone writing one down. Measured on the
+assessment corpus: 44 documents assert a whole-corpus tally, roughly 50 distinct tallies exist, and
+approximately one is correct -- and the correct one is a rendered Markdown table that a grep for the
+corpus's own ``N / N / N / N`` idiom does not even find.
+
+**This is forward-only and it is not a sweep.** A one-time pass over a file list was tried, cost
+about 850 net lines, needed its own repair commit, and the defect regenerated inside four days
+because eight new documents were written after it. Existing tallies are recorded in a frozen
+baseline that may only SHRINK; a tally that is not in the baseline fails.
+
+WHAT COUNTS AS A TALLY, stated as a rule rather than left to the regexes. A tally is a hard-coded
+count of cells **by verdict or survey status** -- the numbers that move whenever anything is
+re-scored. Facts about the **structure** of the pinned corpus do not move and are deliberately NOT
+flagged: "345 requirements", "253 L1+L2, 92 L3-only", "all 345 cells have a row". Flagging those was
+the previous attempt's biggest source of noise, and it is what made it red the method document's own
+worked example.
+
+THE IDIOM SET WAS REBUILT FROM THE CORPUS, NOT GUESSED. The previous attempt matched two shapes --
+an ``N / N / N / N`` tuple and ``N of 345`` -- and missed 6 of the 8 chapter reports that were its
+own motivating evidence. Every idiom below is anchored to real text in the corpus, and the two that
+the old attempt lacked (``TABLE_ROW`` and ``ARITHMETIC``) are exactly the shapes it could not see.
+
+Runnable on its own::
+
+    python scripts/docs/asvs_tally_lint.py docs
+    python scripts/docs/asvs_tally_lint.py --baseline scripts/docs/asvs_tally_baseline.txt docs
+
+It prints the files it scanned, the idioms it matched and the per-file counts, so a run that scanned
+nothing cannot be mistaken for a run that found nothing. Stdlib only, so it can be mirrored into the
+assessment repo and run there without an install -- the same property ``scripts/asvs/scorecard.py``
+is held to.
+"""
+
+from __future__ import annotations
+
+import argparse
+import re
+from collections.abc import Iterable, Iterator
+from dataclasses import dataclass
+from pathlib import Path
+
+# The pinned ASVS 5.0.0 corpus size. It is a CONSTANT, which is the whole reason a number that sums
+# to it is a whole-corpus tally rather than a coincidence.
+CORPUS_TOTAL = 345
+
+# Verdict and survey-status words, as the corpus actually writes them. `verified` / `re-verified` /
+# `unverified` are in here because the survey moved on those words for a fortnight and every one of
+# those counts went stale the same way a verdict count does.
+_VERDICT = (
+    r"pass(?:es|ed)?|partials?|fail(?:s|ed|ures?)?|n/?a|unverified|not[- ]re-?verified"
+    r"|re-?verified|verified|needs[- ]review|contingent|examined"
+)
+# Markdown emphasis sits BETWEEN the number and the word all over this corpus -- "24 `pass`, 15
+# `partial`, 5 `na`" is the V6 chapter report's tally, and it is why a naive `\s*` misses 1 in 8.
+_EMPH = r"[`*_\"']*"
+_GAP = rf"\s*{_EMPH}\s*"
+
+# I1 -- a slash-separated run of integers that SUMS TO THE CORPUS TOTAL.
+#   "current scorecard 189 / 20 / 3 / 133"      (docs/adr/0019)
+#   "ASVS score synced to 212/0/0/133"          (docs/BACKLOG.md)
+# The sum test is what keeps HL7 field notation (PID-3/4/18), status-code lists (403 / 401 / 400 /
+# 409) and config defaults (5 / 2 / 300) out. An unbounded slash tuple produced 73 false hits.
+_SLASH_RUN = re.compile(r"\b\d{1,3}(?:\s*/\s*\d{1,3}){2,}\b")
+
+# I2 -- a MARKDOWN TABLE ROW whose integers sum to the corpus total.
+#   "| Interim re-score (#1208, merged) | 236 | 48 | 0 | 61 | 345 |"
+# This is the shape the old idiom set could not see at all, and it is the shape the ONE correct
+# record is written in.
+_TABLE_ROW = re.compile(r"^\s*\|.*\|\s*$")
+
+# I3 -- three or more DISTINCT verdict classes each carrying a count, on one line.
+#   "168 pass / 105 partial / 3 fail / 65 na / 4 needs-review"
+#   "175 P / 50 Part / 2 Fail / 118 N/A"
+# Three classes rather than two: two co-occurring counts happen in ordinary prose, three do not.
+_LABELLED = re.compile(rf"\b(\d{{1,3}}){_GAP}(?:cells?\s+)?({_VERDICT})\b", re.IGNORECASE)
+_LABELLED_REV = re.compile(rf"\b({_VERDICT}){_GAP}[:=]{_GAP}(\d{{1,3}})\b", re.IGNORECASE)
+_ABBREV = re.compile(rf"\b(\d{{1,3}}){_GAP}(P|Part|F|NA|N/A)\b")
+
+# I4 -- a count stated AGAINST the corpus total. Any such number is a whole-corpus claim by
+# construction, and it goes stale on the next re-score.
+#   "Combined survey is now 316/345 verified"    "205 of those 345 cells rest on an assumption"
+# A bare letter placeholder is NOT a count: the method document's worked example is literally
+# "N of 345", and redding that was a defect of the previous attempt.
+_AGAINST_TOTAL = re.compile(
+    rf"\b\d{{1,3}}\s*(?:/|of(?:\s+(?:the|those))?|out\s+of)\s*(?:the\s+)?{CORPUS_TOTAL}\b",
+    re.IGNORECASE,
+)
+
+# I5 -- an arithmetic assertion that closes to the corpus total.
+#   "`195 + 89 + 0 + 61 = 345`"   "`205 + 140 = 345`"
+_ARITHMETIC = re.compile(rf"\b\d{{1,3}}(?:\s*\+\s*\d{{1,3}})+\s*=\s*{CORPUS_TOTAL}\b")
+
+_INT = re.compile(r"\d{1,3}")
+
+
+@dataclass(frozen=True)
+class Hit:
+    """One matched tally."""
+
+    path: str
+    line: int
+    idiom: str
+    token: str
+    text: str
+
+    def key(self) -> str:
+        """Baseline identity: file, idiom, and the TALLY ITSELF -- never the line number, and
+        never the surrounding prose.
+
+        Not the line number, because a baseline keyed on one is invalidated by any edit above it;
+        that turns a frozen list into a list that has to be re-typed, which is the decaying-budget
+        failure this programme is unpicking elsewhere.
+
+        Not the whole line either, for the same reason one step in: fixing a typo in the sentence
+        around a grandfathered tally would red the build and invite a re-type. The key moves only
+        when the NUMBERS move -- which is exactly the moment the claim should be looked at again.
+        """
+        return f"{self.path}\t{self.idiom}\t{self.token}"
+
+
+def _normalize_verdict(raw: str) -> str:
+    v = raw.lower().replace("n/a", "na").replace("_", "").replace(" ", "-")
+    v = re.sub(r"(?:ures|ure|es|ed|s)$", "", v)
+    v = {"p": "pass", "part": "partial", "f": "fail", "pas": "pass"}.get(v, v)
+    return v.replace("re-verified", "reverified")
+
+
+def _counted_verdicts(line: str) -> set[tuple[int, str]]:
+    """Every (count, verdict-class) pair asserted on one line."""
+    pairs: set[tuple[int, str]] = set()
+    for m in _LABELLED.finditer(line):
+        pairs.add((int(m.group(1)), _normalize_verdict(m.group(2))))
+    for m in _LABELLED_REV.finditer(line):
+        pairs.add((int(m.group(2)), _normalize_verdict(m.group(1))))
+    for m in _ABBREV.finditer(line):
+        pairs.add((int(m.group(1)), _normalize_verdict(m.group(2))))
+    return pairs
+
+
+def idioms_for_line(line: str) -> list[tuple[str, str]]:
+    """Every (idiom, tally-token) this single line trips, in a stable order.
+
+    The token is the tally reduced to its numbers, so it identifies the CLAIM rather than the
+    sentence that carries it.
+    """
+    out: list[tuple[str, str]] = []
+
+    seen: set[str] = set()
+    for m in _SLASH_RUN.finditer(line):
+        nums = [int(x) for x in _INT.findall(m.group(0))]
+        tok = "/".join(str(n) for n in nums)
+        if sum(nums) == CORPUS_TOTAL and tok not in seen:
+            seen.add(tok)
+            out.append(("SLASH_RUN", tok))
+
+    if _TABLE_ROW.match(line):
+        cells = [c.strip() for c in line.strip().strip("|").split("|")]
+        nums = [int(c) for c in cells if re.fullmatch(r"\d{1,3}", c)]
+        # Two or more numeric cells, and some contiguous run of them closes to the total. A single
+        # numeric cell is a per-cell table, not a tally.
+        for i in range(len(nums)):
+            acc = 0
+            for j in range(i, len(nums)):
+                acc += nums[j]
+                if acc == CORPUS_TOTAL and j > i:
+                    out.append(("TABLE_ROW", "|".join(str(n) for n in nums[i : j + 1])))
+                    break
+            else:
+                continue
+            break
+
+    verdicts = _counted_verdicts(line)
+    if len({v for _, v in verdicts}) >= 3:
+        out.append(("LABELLED_VERDICTS", ",".join(f"{n}{v}" for n, v in sorted(verdicts))))
+
+    for m in _AGAINST_TOTAL.finditer(line):
+        tok = re.sub(r"\s+", "", m.group(0)).lower()
+        out.append(("AGAINST_TOTAL", tok))
+
+    for m in _ARITHMETIC.finditer(line):
+        out.append(("ARITHMETIC", re.sub(r"\s+", "", m.group(0))))
+
+    return out
+
+
+def scan_text(path: str, text: str) -> list[Hit]:
+    """Every tally in one document."""
+    hits: list[Hit] = []
+    for n, line in enumerate(text.splitlines(), 1):
+        for idiom, token in idioms_for_line(line):
+            hits.append(Hit(path, n, idiom, token, line.strip()))
+    return hits
+
+
+def iter_markdown(roots: Iterable[Path], repo: Path) -> Iterator[tuple[str, Path]]:
+    for root in roots:
+        base = root if root.is_absolute() else repo / root
+        if base.is_file():
+            yield base.relative_to(repo).as_posix(), base
+            continue
+        for p in sorted(base.rglob("*.md")):
+            yield p.relative_to(repo).as_posix(), p
+
+
+def load_baseline(path: Path | None) -> dict[str, int]:
+    """Grandfathered tallies as ``key -> occurrence count``.
+
+    The count is what stops the baseline being a licence to add more of the same: one extra copy of
+    an already-grandfathered tally is a NEW tally, and removing one leaves the recorded count too
+    high, which fails and forces the entry down. The list can only shrink.
+    """
+    out: dict[str, int] = {}
+    if path is None or not path.is_file():
+        return out
+    for raw in path.read_text(encoding="utf-8").splitlines():
+        line = raw.rstrip("\n")
+        if not line.strip() or line.lstrip().startswith("#"):
+            continue
+        key, _, count = line.rpartition("\t")
+        if not key or not count.isdigit():
+            raise ValueError(f"malformed baseline line (expected 'key<TAB>count'): {line!r}")
+        out[key] = int(count)
+    return out
+
+
+def counted(hits: Iterable[Hit]) -> dict[str, int]:
+    out: dict[str, int] = {}
+    for h in hits:
+        out[h.key()] = out.get(h.key(), 0) + 1
+    return out
+
+
+def main(argv: list[str] | None = None) -> int:
+    ap = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    ap.add_argument("roots", nargs="*", default=["docs"], help="files or directories to scan")
+    ap.add_argument("--repo", type=Path, default=Path(__file__).resolve().parents[2])
+    ap.add_argument("--baseline", type=Path, default=None)
+    ap.add_argument(
+        "--allow",
+        action="append",
+        default=[],
+        help="a path prefix that is exempt (the rendered record).",
+    )
+    ap.add_argument("--print-keys", action="store_true", help="emit baseline keys for the findings")
+    args = ap.parse_args(argv)
+
+    docs = list(iter_markdown([Path(r) for r in args.roots], args.repo))
+    baseline = load_baseline(args.baseline)
+    allow = tuple(args.allow)
+
+    scanned = 0
+    skipped = 0
+    hits: list[Hit] = []
+    for rel, p in docs:
+        if rel.startswith(allow):
+            skipped += 1
+            continue
+        scanned += 1
+        hits.extend(scan_text(rel, p.read_text(encoding="utf-8", errors="replace")))
+
+    observed = counted(hits)
+    new = [h for h in hits if observed[h.key()] > baseline.get(h.key(), 0)]
+    grandfathered = sum(min(n, baseline.get(k, 0)) for k, n in observed.items())
+
+    print(
+        f"SCANNED: {scanned} markdown files ({skipped} allowlisted) under {[str(r) for r in args.roots]}"
+    )
+    print(
+        f"SCANNED: baseline {args.baseline} carries {len(baseline)} grandfathered claims "
+        f"({sum(baseline.values())} occurrences)"
+    )
+    print(
+        f"FOUND:   {len(hits)} tallies total, {grandfathered} grandfathered, "
+        f"{len(hits) - grandfathered} NEW"
+    )
+    per_idiom: dict[str, int] = {}
+    for h in hits:
+        per_idiom[h.idiom] = per_idiom.get(h.idiom, 0) + 1
+    print(f"FOUND:   idioms {per_idiom or '{}'}")
+    per_file: dict[str, int] = {}
+    for h in hits:
+        per_file[h.path] = per_file.get(h.path, 0) + 1
+    for path in sorted(per_file, key=lambda k: (-per_file[k], k)):
+        print(f"         {per_file[path]:4d}  {path}")
+
+    if args.print_keys:
+        for key in sorted(observed):
+            print(f"{key}\t{observed[key]}")
+
+    stale = sorted(k for k, n in baseline.items() if observed.get(k, 0) < n)
+    rc = 0
+    if new:
+        rc = 1
+        print(f"\nFAIL: {len(new)} hard-coded ASVS tally/tallies are not grandfathered:")
+        for h in sorted(new, key=lambda h: (h.path, h.line)):
+            print(f"  {h.path}:{h.line}: [{h.idiom} {h.token}] {h.text[:150]}")
+        print(
+            "\nThe count is computed (ADR 0156). Cite the rendered record instead of copying a "
+            "number out of it: every copy goes stale on the next re-score, and of the roughly "
+            "fifty that exist, approximately one is correct."
+        )
+    if stale:
+        rc = 1
+        print(f"\nFAIL: {len(stale)} baseline entr(ies) now over-count what is in the tree.")
+        print("The baseline may only SHRINK -- lower or delete these in the change that removed")
+        print("the tally, so a fix is recorded rather than leaving a licence behind:")
+        for k in stale:
+            print(f"  have {observed.get(k, 0)}, baseline says {baseline[k]}:  {k}")
+    if rc == 0:
+        print("\nOK: no new hard-coded ASVS tally.")
+    return rc
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/tests/test_asvs_residual_lint.py b/tests/test_asvs_residual_lint.py
new file mode 100644
index 00000000..aa3efef4
--- /dev/null
+++ b/tests/test_asvs_residual_lint.py
@@ -0,0 +1,258 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Copyright (C) 2026 MessageFoundry Organization and contributors
+"""Tests for the forward-only residual citation lint (``scripts/docs/asvs_residual_lint.py``).
+
+The record this lint polices lives in the assessment repo, not here, so these run against
+FIXTURES -- which is the same arrangement ``scripts/asvs/scorecard.py`` has (ADR 0156 section 7:
+data-free tool, fixtures in the public repo, real data in the vault). Nothing from the real record
+appears in this file.
+
+Because the tool runs where it cannot be watched, the empty-scan behaviour is tested as hard as the
+detection is. A citation lint that silently examined nothing reports exactly what a clean record
+reports.
+"""
+
+from __future__ import annotations
+
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+from scripts.docs.asvs_residual_lint import (
+    CITATION,
+    Citation,
+    EmptyScan,
+    counted,
+    load_baseline,
+    load_scorecard,
+    main,
+    scan_cells,
+)
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+LINT_REL = "scripts/docs/asvs_residual_lint.py"
+
+
+def write_scorecard(tmp_path: Path, body: str) -> Path:
+    p = tmp_path / "scorecard.toml"
+    p.write_text(body, encoding="utf-8")
+    return p
+
+
+ONE_CELL = """
+[[cell]]
+id = "6.3.3"
+verdict = "partial"
+residual = "The gate reads messagefoundry/__main__.py:1125 but the prose says __main__.py:1917."
+"""
+
+
+# --------------------------------------------------------------------------------------------
+# Detection, both directions.
+# --------------------------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    ("why", "text", "expected"),
+    [
+        (
+            "path-qualified",
+            "see messagefoundry/config/settings.py:1359",
+            [("messagefoundry/config/settings.py", "1359")],
+        ),
+        ("bare basename", "see settings.py:1359", [("settings.py", "1359")]),
+        (
+            "windows separator",
+            r"see messagefoundry\auth\service.py:724",
+            [(r"messagefoundry\auth\service.py", "724")],
+        ),
+        ("markdown doc", "docs/SECURITY.md:752 says otherwise", [("docs/SECURITY.md", "752")]),
+        ("a lockfile", "requirements.lock:961 pins it", [("requirements.lock", "961")]),
+        ("spaced colon", "settings.py : 1359", [("settings.py", "1359")]),
+        ("two on one line", "a.py:1 and b/c.py:22", [("a.py", "1"), ("b/c.py", "22")]),
+    ],
+)
+def test_the_citation_shapes_that_occur_are_detected(
+    why: str, text: str, expected: list[tuple[str, str]]
+) -> None:
+    assert CITATION.findall(text) == expected, why
+
+
+@pytest.mark.parametrize(
+    ("why", "text"),
+    [
+        ("a file with no line", "see settings.py for the default"),
+        ("a prose line reference", "see line 1125 of the module"),
+        ("a version string", "requires Python 3.14:0 is not a citation"),
+        ("a host and port", "binds 127.0.0.1:8765 by default"),
+        ("a bare number", "the value is 1125"),
+        ("a time", "at 06:17 daily"),
+        ("an unknown extension", "image.png:12"),
+        # A citation already inside a longer path token must not also match its own tail.
+        ("no double-count of a suffix", "messagefoundry/config/settings.py:1359"),
+    ],
+)
+def test_the_lint_stays_silent_on_text_that_is_not_a_citation(why: str, text: str) -> None:
+    found = CITATION.findall(text)
+    if why == "no double-count of a suffix":
+        assert found == [("messagefoundry/config/settings.py", "1359")], why
+    else:
+        assert found == [], f"false positive ({why}): {found} on {text!r}"
+
+
+def test_the_detector_is_live_and_the_negative_control_is_a_real_zero() -> None:
+    """A broken regex returns nothing on everything, which reads exactly like a clean record."""
+    assert CITATION.findall("ZZQQ nothing citation-shaped here at all") == []
+    assert CITATION.findall("a/b.py:7") == [("a/b.py", "7")]
+
+
+def test_a_bare_basename_is_flagged_as_naming_no_location() -> None:
+    assert Citation("1.1.1", "residual", "settings.py", 5).bare is True
+    assert Citation("1.1.1", "residual", "messagefoundry/config/settings.py", 5).bare is False
+
+
+# --------------------------------------------------------------------------------------------
+# The key, which is the design.
+# --------------------------------------------------------------------------------------------
+
+
+def test_the_key_ignores_the_line_number_but_not_the_file_cell_or_field() -> None:
+    a = Citation("6.3.3", "residual", "__main__.py", 1917)
+    repaired = Citation("6.3.3", "residual", "__main__.py", 1125)
+    other_file = Citation("6.3.3", "residual", "service.py", 1917)
+    other_cell = Citation("6.3.4", "residual", "__main__.py", 1917)
+    other_field = Citation("6.3.3", "absence[].mutation", "__main__.py", 1917)
+    assert a.key() == repaired.key(), "repairing a line must not read as a new citation"
+    assert a.key() != other_file.key()
+    assert a.key() != other_cell.key()
+    assert a.key() != other_field.key()
+
+
+def test_repairing_a_stale_line_number_is_free(tmp_path: Path) -> None:
+    """The headline property: correction costs nothing, growth is refused, deletion costs an edit.
+
+    The rejected alternative made *delete the citation* the cheapest compliant act. This makes
+    *fix it* the cheapest, which is what is actually wanted from someone who just noticed it is wrong.
+    """
+    sc = write_scorecard(tmp_path, ONE_CELL)
+    base = tmp_path / "b.txt"
+    base.write_text(
+        "6.3.3\tresidual\tmessagefoundry/__main__.py\t1\n6.3.3\tresidual\t__main__.py\t1\n",
+        encoding="utf-8",
+    )
+    assert main([str(sc), "--baseline", str(base)]) == 0
+
+    # Repair the stale line in place. No baseline edit.
+    sc.write_text(ONE_CELL.replace("__main__.py:1917", "__main__.py:1125"), encoding="utf-8")
+    assert main([str(sc), "--baseline", str(base)]) == 0, (
+        "a repair must not require a baseline edit"
+    )
+
+    # Adding a citation to a NEW file in the same cell is refused.
+    sc.write_text(ONE_CELL + "\n# and auth/service.py:724\n", encoding="utf-8")
+    sc.write_text(
+        ONE_CELL.replace("prose says", "prose says auth/service.py:724 and"), encoding="utf-8"
+    )
+    assert main([str(sc), "--baseline", str(base)]) == 1
+
+
+def test_an_extra_occurrence_of_a_grandfathered_citation_is_new(tmp_path: Path) -> None:
+    sc = write_scorecard(tmp_path, ONE_CELL)
+    base = tmp_path / "b.txt"
+    base.write_text(
+        "6.3.3\tresidual\tmessagefoundry/__main__.py\t1\n6.3.3\tresidual\t__main__.py\t1\n",
+        encoding="utf-8",
+    )
+    assert main([str(sc), "--baseline", str(base)]) == 0
+    sc.write_text(ONE_CELL.rstrip('"\n') + ' Again at __main__.py:2000."\n', encoding="utf-8")
+    assert main([str(sc), "--baseline", str(base)]) == 1
+
+
+def test_the_baseline_may_only_shrink(tmp_path: Path) -> None:
+    sc = write_scorecard(tmp_path, '[[cell]]\nid = "1.1.1"\nresidual = "no citations here."\n')
+    base = tmp_path / "b.txt"
+    base.write_text("1.1.1\tresidual\tsettings.py\t1\n", encoding="utf-8")
+    assert main([str(sc), "--baseline", str(base)]) == 1, "an over-counting entry must fail"
+
+
+def test_a_malformed_baseline_line_is_refused_rather_than_ignored(tmp_path: Path) -> None:
+    bad = tmp_path / "b.txt"
+    bad.write_text("1.1.1\tresidual\tsettings.py\n", encoding="utf-8")
+    with pytest.raises(ValueError, match="malformed baseline line"):
+        load_baseline(bad)
+
+
+# --------------------------------------------------------------------------------------------
+# Empty-scan refusal. This tool runs where nobody is watching it.
+# --------------------------------------------------------------------------------------------
+
+
+def test_a_scorecard_with_no_cells_is_an_error_not_a_clean_run(tmp_path: Path) -> None:
+    sc = write_scorecard(tmp_path, '[scorecard]\nanchor_commit = "deadbeef"\n')
+    with pytest.raises(EmptyScan, match="no \\[\\[cell\\]\\] entries"):
+        load_scorecard(sc)
+    assert main([str(sc), "--no-baseline"]) == 2, "must not exit 0 having examined nothing"
+
+
+def test_a_field_that_resolves_to_nothing_is_an_error_not_a_clean_run(tmp_path: Path) -> None:
+    """The failure that matters most: a renamed field reports 'no new citations'."""
+    sc = write_scorecard(tmp_path, ONE_CELL)
+    assert main([str(sc), "--no-baseline", "--field", "residuel"]) == 2
+    assert main([str(sc), "--no-baseline", "--field", "residual"]) == 1
+
+
+def test_a_missing_baseline_file_is_an_error_not_an_empty_baseline(tmp_path: Path) -> None:
+    sc = write_scorecard(tmp_path, ONE_CELL)
+    assert main([str(sc), "--baseline", str(tmp_path / "nope.txt")]) == 2
+    with pytest.raises(EmptyScan, match="does not exist"):
+        load_baseline(tmp_path / "nope.txt")
+
+
+def test_the_run_prints_what_it_scanned(tmp_path: Path, capsys: pytest.CaptureFixture[str]) -> None:
+    sc = write_scorecard(tmp_path, ONE_CELL)
+    main([str(sc), "--no-baseline"])
+    out = capsys.readouterr().out
+    assert "SCANNED: 1 cells" in out
+    assert "characters of prose" in out
+    assert "bare basenames" in out, "the headline defect must be counted, not just the total"
+
+
+# --------------------------------------------------------------------------------------------
+# Field resolution and bookkeeping.
+# --------------------------------------------------------------------------------------------
+
+
+def test_a_list_of_tables_field_can_be_scanned(tmp_path: Path) -> None:
+    """`absence[].mutation` carries citations too, so the field spec supports that shape."""
+    sc = write_scorecard(
+        tmp_path,
+        '[[cell]]\nid = "2.2.2"\nresidual = "clean."\n'
+        '[[cell.absence]]\nmutation = "re-adding auth/service.py:99 would break it"\n',
+    )
+    cites, n_cells, n_chars = scan_cells(load_scorecard(sc), ["absence[].mutation"])
+    assert n_cells == 1 and n_chars > 0
+    assert [c.key() for c in cites] == ["2.2.2\tabsence[].mutation\tauth/service.py"]
+    assert main([str(sc), "--no-baseline"]) == 0, "the default field set must not see it"
+    assert main([str(sc), "--no-baseline", "--field", "absence[].mutation"]) == 1
+
+
+def test_scan_and_count_report_cells_fields_and_occurrences(tmp_path: Path) -> None:
+    sc = write_scorecard(tmp_path, ONE_CELL)
+    cites, n_cells, n_chars = scan_cells(load_scorecard(sc), ["residual"])
+    assert n_cells == 1
+    assert n_chars > 0
+    assert counted(cites) == {
+        "6.3.3\tresidual\tmessagefoundry/__main__.py": 1,
+        "6.3.3\tresidual\t__main__.py": 1,
+    }
+
+
+def test_the_lint_runs_as_a_bare_script(tmp_path: Path) -> None:
+    """Same mirror contract as the verifier: stdlib only, no install, from an unrelated cwd."""
+    cmd = [sys.executable, "-I", "-S", str(REPO_ROOT / LINT_REL), "--help"]
+    print(f"SCANNED: {' '.join(cmd)} (cwd={tmp_path})")
+    proc = subprocess.run(cmd, cwd=tmp_path, capture_output=True, text=True, timeout=120)
+    assert proc.returncode == 0, f"rc={proc.returncode}\n{proc.stderr}"
+    assert "--baseline" in proc.stdout
diff --git a/tests/test_asvs_tally_lint.py b/tests/test_asvs_tally_lint.py
new file mode 100644
index 00000000..2840f340
--- /dev/null
+++ b/tests/test_asvs_tally_lint.py
@@ -0,0 +1,273 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Copyright (C) 2026 MessageFoundry Organization and contributors
+"""Tests for the forward-only ASVS tally lint (``scripts/docs/asvs_tally_lint.py``).
+
+Every idiom is driven from BOTH sides. A detector that has only ever been shown text it should
+catch is a detector whose false-positive rate nobody measured, and the previous attempt at this lint
+failed in exactly that direction: it produced 73 false hits on HL7 field notation in this repo's own
+documents while missing 6 of the 8 documents that motivated it.
+
+The fixtures are SYNTHETIC reproductions of shapes measured in the assessment corpus. They are not
+copied from it: the corpus is a private security record, its tallies ARE the posture, and a public
+test file is not a place to put them. Each fixture carries the shape it stands for.
+"""
+
+from __future__ import annotations
+
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+from scripts.docs.asvs_tally_lint import (
+    CORPUS_TOTAL,
+    Hit,
+    counted,
+    idioms_for_line,
+    load_baseline,
+    main,
+    scan_text,
+)
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+LINT_REL = "scripts/docs/asvs_tally_lint.py"
+BASELINE = REPO_ROOT / "scripts" / "docs" / "asvs_tally_baseline.txt"
+
+
+def idioms(line: str) -> set[str]:
+    return {name for name, _ in idioms_for_line(line)}
+
+
+# --------------------------------------------------------------------------------------------
+# Positive: every idiom fires on the shape it was derived from.
+# --------------------------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    ("shape", "line", "expected"),
+    [
+        # The tuple the previous attempt did catch. Kept so a refactor cannot lose it.
+        ("slash tuple, tight", "ASVS score synced to 212/0/0/133 (#425).", "SLASH_RUN"),
+        ("slash tuple, spaced", "current scorecard **189 / 20 / 3 / 133**", "SLASH_RUN"),
+        # A Markdown table row. The old idiom set could not see this shape AT ALL -- and it is the
+        # shape the one correct record is written in.
+        ("table row", "| + all remaining build cells | 271 | 13 | 0 | 61 | 345 |", "TABLE_ROW"),
+        ("table row, no total column", "| Posture A | 179 | 51 | 5 | 110 |", "TABLE_ROW"),
+        # Labelled verdicts. Three distinct classes, in the several ways the corpus writes them.
+        (
+            "labelled, slash-separated",
+            "168 pass / 105 partial / 3 fail / 65 na / 4 needs-review",
+            "LABELLED_VERDICTS",
+        ),
+        (
+            "labelled, abbreviated columns",
+            "Posture A 175 P / 50 Part / 2 Fail / 118 N/A",
+            "LABELLED_VERDICTS",
+        ),
+        # THE ONE-IN-EIGHT MISS. Markdown emphasis sits between the number and the word, and a
+        # detector using a bare `\\s*` walks straight past it.
+        (
+            "labelled, backticked verdict words",
+            "**24 `pass`, 15 `partial`, 5 `na`, zero `fail`.**",
+            "LABELLED_VERDICTS",
+        ),
+        (
+            "labelled, bolded verdict words",
+            "**19 pass, 8 na, 2 needs-review, 0 partial, 0 fail**",
+            "LABELLED_VERDICTS",
+        ),
+        # A count stated against the corpus total.
+        (
+            "against total, slash",
+            f"Combined survey is now 316/{CORPUS_TOTAL} verified",
+            "AGAINST_TOTAL",
+        ),
+        (
+            "against total, prose",
+            f"205 of those {CORPUS_TOTAL} cells rest on an assumption",
+            "AGAINST_TOTAL",
+        ),
+        (
+            "against total, zero",
+            f"the re-verification is done: 0 of {CORPUS_TOTAL} cells remain",
+            "AGAINST_TOTAL",
+        ),
+        # Arithmetic that closes to the total.
+        ("arithmetic", f"`195 + 89 + 0 + 61 = {CORPUS_TOTAL}`", "ARITHMETIC"),
+        ("arithmetic, two terms", f"`205 + 140 = {CORPUS_TOTAL}`", "ARITHMETIC"),
+    ],
+)
+def test_each_idiom_reds_the_shape_it_was_derived_from(
+    shape: str, line: str, expected: str
+) -> None:
+    got = idioms(line)
+    assert expected in got, (
+        f"{shape}: expected {expected}, got {sorted(got) or 'nothing'} for {line!r}"
+    )
+
+
+# --------------------------------------------------------------------------------------------
+# Negative controls. These are not decoration: the measured failure of the previous attempt was 73
+# false hits, all from notation that merely LOOKS like a tally.
+# --------------------------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    ("why", "line"),
+    [
+        ("HL7 field notation", "ones: PID-3/4/18 (`MRN`/`ID`), PID-19 (`SSN`), PID-5/6/9 (`NAME`)"),
+        ("HL7 field notation", "Routing usually needs only MSH-9/10/12, yet `hl7.parse` walks"),
+        ("X12 transaction sets", "A business **271/277/278** returned by the partner"),
+        ("HTTP status codes", "**DENY** (403 / 401 / 400 / 409 / refused connection)"),
+        ("config defaults", "| retry_backoff_seconds | num | 5 / 2 / 300 | exponential backoff |"),
+        ("FIPS document numbers", "Monitor NIST PQC (FIPS 203/204/205)."),
+        ("cache sizes", "| OIDC pending flows | 512 / 16 / 300 s | 300 s TTL |"),
+        ("test counts", "9/9/9 (sqlite/ss/pg) + SS store 73 + PG store 81"),
+        ("a version string", "Compatible with 1/2/3 of the published profiles"),
+        # Corpus STRUCTURE is a pinned constant. It does not go stale, so flagging it is noise --
+        # and flagging it is what made the previous attempt red the method document.
+        (
+            "corpus size",
+            f"a self-assessment against OWASP ASVS 5.0 Level 3 ({CORPUS_TOTAL} requirements)",
+        ),
+        ("corpus structure", f"{CORPUS_TOTAL} requirements total: 253 L1+L2, 92 L3-only."),
+        (
+            "corpus structure",
+            f"A test asserts every one of the {CORPUS_TOTAL} ids appears exactly once",
+        ),
+        ("corpus structure", f"Populating {CORPUS_TOTAL} cells is real work."),
+        # The method document's worked example is a LETTER, not a count.
+        ("the method doc's own template", f'The honest phrasing is "N of {CORPUS_TOTAL} verified"'),
+        # Two co-occurring counts happen in ordinary prose; three do not.
+        ("two classes only", "12 pass and 4 fail in that chapter"),
+    ],
+)
+def test_the_lint_stays_silent_on_notation_that_only_looks_like_a_tally(
+    why: str, line: str
+) -> None:
+    got = idioms(line)
+    assert not got, f"false positive ({why}): {sorted(got)} on {line!r}"
+
+
+def test_a_sum_that_misses_the_total_is_not_a_whole_corpus_tally() -> None:
+    """The sum test is the whole discriminator, so prove it discriminates in both directions."""
+    assert idioms("scores were 212/0/0/133") == {"SLASH_RUN"}, "212+0+0+133 == 345 must red"
+    assert idioms("scores were 212/0/0/134") == set(), "212+0+0+134 == 346 must not red"
+    assert idioms("scores were 212/0/0/132") == set(), "212+0+0+132 == 344 must not red"
+
+
+def test_the_negative_control_corpus_is_not_trivially_empty() -> None:
+    """A pattern that cannot occur must return zero -- and the machinery must still be live.
+
+    An empty or broken pattern set returns zero on everything, which is numerically identical to a
+    clean run. So assert BOTH halves on the same call path: nothing on text that cannot be a tally,
+    and something on text that must be.
+    """
+    impossible = "ZZQQ this line contains no numbers and no verdict words at all"
+    assert idioms(impossible) == set()
+    assert idioms("212/0/0/133") == {"SLASH_RUN"}
+
+
+# --------------------------------------------------------------------------------------------
+# The baseline ratchet.
+# --------------------------------------------------------------------------------------------
+
+
+def test_this_repo_is_clean_against_its_own_frozen_baseline(
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    rc = main(["docs", "--repo", str(REPO_ROOT), "--baseline", str(BASELINE)])
+    out = capsys.readouterr().out
+    print(out)
+    assert "SCANNED:" in out, "the lint must report what it scanned, not only what it found"
+    assert rc == 0, f"docs/ carries a new hard-coded ASVS tally:\n{out}"
+
+
+def test_the_baseline_is_not_empty_and_parses() -> None:
+    """A baseline that silently failed to load would make every existing tally look NEW -- or, with
+    the comparison the other way round, make the gate vacuous. Assert it is actually populated."""
+    baseline = load_baseline(BASELINE)
+    assert len(baseline) >= 10, f"baseline looks truncated: {len(baseline)} claims"
+    assert all(n >= 1 for n in baseline.values())
+    assert all(k.count("\t") == 2 for k in baseline), "every key is path/idiom/token"
+
+
+def test_a_malformed_baseline_line_is_refused_rather_than_ignored(tmp_path: Path) -> None:
+    bad = tmp_path / "b.txt"
+    bad.write_text("docs/x.md\tSLASH_RUN\t1/2/3\n", encoding="utf-8")
+    with pytest.raises(ValueError, match="malformed baseline line"):
+        load_baseline(bad)
+
+
+def test_the_baseline_grandfathers_only_the_recorded_number_of_occurrences(tmp_path: Path) -> None:
+    """One extra copy of an already-grandfathered tally is a NEW tally."""
+    doc = tmp_path / "docs" / "d.md"
+    doc.parent.mkdir(parents=True)
+    doc.write_text("score 212/0/0/133 here\n", encoding="utf-8")
+    base = tmp_path / "b.txt"
+    base.write_text("docs/d.md\tSLASH_RUN\t212/0/0/133\t1\n", encoding="utf-8")
+    assert main(["docs", "--repo", str(tmp_path), "--baseline", str(base)]) == 0
+
+    doc.write_text("score 212/0/0/133 here\nand again 212/0/0/133\n", encoding="utf-8")
+    assert main(["docs", "--repo", str(tmp_path), "--baseline", str(base)]) == 1
+
+
+def test_the_baseline_may_only_shrink(tmp_path: Path) -> None:
+    """Removing a tally without lowering its baseline entry FAILS, so the ratchet cannot idle."""
+    doc = tmp_path / "docs" / "d.md"
+    doc.parent.mkdir(parents=True)
+    doc.write_text("nothing to see here\n", encoding="utf-8")
+    base = tmp_path / "b.txt"
+    base.write_text("docs/d.md\tSLASH_RUN\t212/0/0/133\t1\n", encoding="utf-8")
+    rc = main(["docs", "--repo", str(tmp_path), "--baseline", str(base)])
+    assert rc == 1, "a baseline entry that over-counts the tree must fail"
+
+
+def test_a_new_tally_in_a_clean_tree_fails(tmp_path: Path) -> None:
+    doc = tmp_path / "docs" / "d.md"
+    doc.parent.mkdir(parents=True)
+    doc.write_text("prose with no tally\n", encoding="utf-8")
+    assert main(["docs", "--repo", str(tmp_path)]) == 0
+    doc.write_text("prose with no tally\nposture is 189 / 20 / 3 / 133 today\n", encoding="utf-8")
+    assert main(["docs", "--repo", str(tmp_path)]) == 1
+
+
+def test_the_allowlist_exempts_the_rendered_record(tmp_path: Path) -> None:
+    """``ASVS-CURRENT.md`` IS the rendered record; a tally there is the point, not a defect."""
+    doc = tmp_path / "docs" / "security" / "ASVS-CURRENT.md"
+    doc.parent.mkdir(parents=True)
+    doc.write_text("| pass | partial | fail | na |\n| 168 | 105 | 3 | 69 |\n", encoding="utf-8")
+    assert main(["docs", "--repo", str(tmp_path)]) == 1, "without the allowlist it must red"
+    assert (
+        main(["docs", "--repo", str(tmp_path), "--allow", "docs/security/ASVS-CURRENT.md"]) == 0
+    ), "with the allowlist it must pass"
+
+
+# --------------------------------------------------------------------------------------------
+# Bookkeeping the scan itself.
+# --------------------------------------------------------------------------------------------
+
+
+def test_scan_text_reports_line_numbers_and_tokens() -> None:
+    hits = scan_text("docs/x.md", "a\nb 212/0/0/133 c\nd\n")
+    assert hits == [Hit("docs/x.md", 2, "SLASH_RUN", "212/0/0/133", "b 212/0/0/133 c")]
+    assert counted(hits) == {"docs/x.md\tSLASH_RUN\t212/0/0/133": 1}
+
+
+def test_the_key_ignores_prose_around_the_tally_but_not_the_numbers() -> None:
+    """Editing the sentence must not invalidate a grandfathered entry; editing the TALLY must."""
+    a = scan_text("docs/x.md", "the score was 212/0/0/133 at the time\n")[0]
+    b = scan_text("docs/x.md", "score: 212/0/0/133\n")[0]
+    c = scan_text("docs/x.md", "the score was 189/20/3/133 at the time\n")[0]
+    assert a.key() == b.key()
+    assert a.key() != c.key()
+
+
+def test_the_lint_runs_as_a_bare_script(tmp_path: Path) -> None:
+    """Same mirror contract as the verifier: stdlib only, no install, from an unrelated cwd."""
+    cmd = [sys.executable, "-I", "-S", str(REPO_ROOT / LINT_REL), "--help"]
+    print(f"SCANNED: {' '.join(cmd)} (cwd={tmp_path})")
+    proc = subprocess.run(cmd, cwd=tmp_path, capture_output=True, text=True, timeout=120)
+    assert proc.returncode == 0, f"rc={proc.returncode}\n{proc.stderr}"
+    assert "--baseline" in proc.stdout
diff --git a/tests/test_asvs_verifier_vault_contract.py b/tests/test_asvs_verifier_vault_contract.py
new file mode 100644
index 00000000..7b4de230
--- /dev/null
+++ b/tests/test_asvs_verifier_vault_contract.py
@@ -0,0 +1,272 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Copyright (C) 2026 MessageFoundry Organization and contributors
+"""The engine's half of the vault ASVS gate's RUNTIME contract (ADR 0156).
+
+The ASVS gate does not live here. It lives in the vault repo, and it makes three claims about
+THIS tree:
+
+  1. the evidence anchors recorded in the scorecard still resolve in the engine source;
+  2. ``scripts/asvs/scorecard.py`` exists at exactly that path;
+  3. that file RUNS -- as a bare script, on a bare interpreter, with nothing installed.
+
+Claim 1 needs the private assessment record and can only ever be checked where that record is.
+Claims 2 and 3 are properties of THIS tree alone, and until this module existed neither repo
+checked either of them.
+
+WHY THAT MATTERS, precisely. The vault runs the verifier twice, in two workflows, and NEITHER
+installs anything:
+
+  * ``asvs-scorecard.yml`` -- ``actions/setup-python`` then ``python scripts/asvs/scorecard.py``.
+    Its own comment states the invariant and the reason: "No install step and no dependency: the
+    verifier is stdlib-only (tomllib, json, re) precisely so this job cannot rot on a lockfile it
+    does not own."
+  * ``asvs-verifier-drift.yml`` -- its ``preflight`` job executes the INCOMING engine copy, as
+    ``python ../engine/scripts/asvs/scorecard.py`` with the working directory set to the vault
+    checkout. So ``sys.path[0]`` is ``.../scripts/asvs``: not the engine root, not the vault root.
+    A first-party import has nothing to resolve against.
+
+That invariant was asserted in a comment and enforced nowhere. The engine's own tests import the
+module -- ``from scripts.asvs.scorecard import ...`` -- from a pytest session with the repo root on
+``sys.path`` and the project's full extras installed. So the exact invocation the vault uses was
+never exercised here, and an added ``import httpx`` would pass every check in this repo.
+
+WHAT BREAKING IT COSTS, since a soft failure invites the reasoning that it does not matter. The
+mirror job opens its pull request as a DRAFT when the incoming verifier does not run, and a draft
+is never merged. So the vault keeps verifying the record with its OLD copy while reporting drift as
+a warning -- which is the exact recurring condition (six hand-made mirror commits, the last of them
+326 lines behind) that splitting the drift workflow out was built to end. The gate does not go red.
+It goes stale, quietly, which is the failure mode this whole programme exists to remove.
+
+The check therefore belongs HERE, in the repo that can cause the drift, on the trigger that already
+fires for it: any pull request touching ``scripts/asvs/**`` is code by ci.yml's docs-only detector,
+so the required ``test`` leg runs this module. No new workflow and no new required context.
+
+Runnable on its own -- ``python tests/test_asvs_verifier_vault_contract.py`` -- which prints the full
+inventory it scanned and exits non-zero on a violation. The inventory is printed rather than merely
+counted so that a run which scanned nothing cannot be mistaken for a run which found nothing.
+"""
+
+from __future__ import annotations
+
+import ast
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+
+# Hardcoded in BOTH vault workflows (as ``engine/scripts/asvs/scorecard.py`` and
+# ``../engine/scripts/asvs/scorecard.py``). A rename here is a silent break there: the parity step
+# resolves the missing file to the sentinel "MISSING" and warns rather than failing.
+VERIFIER_REL = "scripts/asvs/scorecard.py"
+VERIFIER = REPO_ROOT / VERIFIER_REL
+
+# ``__main__`` is what a module names when it imports itself under direct execution; it is not a
+# distribution and never needs installing. Nothing else is exempt -- notably not ``messagefoundry``,
+# because the vault's preflight invocation puts only ``scripts/asvs`` on ``sys.path``.
+_ALWAYS_AVAILABLE = frozenset({"__main__"})
+
+
+def import_roots(source: str, filename: str) -> dict[str, list[int]]:
+    """Top-level package name of every import in ``source``, mapped to the lines it appears on.
+
+    ``ast.walk`` rather than a scan of module-level statements: the verifier defers two imports
+    (``hashlib``, ``json``) into function bodies, and a deferred third-party import is exactly as
+    fatal on a bare interpreter as a top-level one -- it just fails later, on the code path that
+    matters, instead of at startup. A ``--help`` smoke test cannot see those; this can.
+    """
+    roots: dict[str, list[int]] = {}
+    for node in ast.walk(ast.parse(source, filename=filename)):
+        if isinstance(node, ast.Import):
+            for alias in node.names:
+                roots.setdefault(alias.name.split(".")[0], []).append(node.lineno)
+        elif isinstance(node, ast.ImportFrom):
+            # ``level > 0`` is a relative import: it resolves against the containing PACKAGE, and
+            # scripts/asvs has no ``__init__.py``, so under the vault's script invocation there is
+            # no package to resolve against. Record it under a name that can never be stdlib.
+            if node.level:
+                roots.setdefault(f"<relative import level {node.level}>", []).append(node.lineno)
+            elif node.module:
+                roots.setdefault(node.module.split(".")[0], []).append(node.lineno)
+    return roots
+
+
+def non_stdlib(roots: dict[str, list[int]]) -> dict[str, list[int]]:
+    """The subset of ``roots`` a bare CPython could not import."""
+    return {
+        name: lines
+        for name, lines in roots.items()
+        if name not in sys.stdlib_module_names and name not in _ALWAYS_AVAILABLE
+    }
+
+
+def scan(rel: str = VERIFIER_REL) -> tuple[str, dict[str, list[int]], dict[str, list[int]]]:
+    source = (REPO_ROOT / rel).read_text(encoding="utf-8")
+    roots = import_roots(source, rel)
+    return source, roots, non_stdlib(roots)
+
+
+# EVERY tool this repo expects the assessment repo to MIRROR AND RUN, not just the verifier.
+#
+# The stdlib-only rule is a property of the arrangement, not of one file: the assessment repo runs
+# these on a bare `setup-python` with no install step, so any third-party import is fatal there and
+# invisible here. The rule was discovered on the verifier; it is stated once, over a list, because a
+# fix that does not generalise is the one that comes back -- and the second entry arrived four days
+# after the first.
+MIRRORED_TOOLS = (
+    VERIFIER_REL,
+    # Not yet wired into a vault workflow. They are listed anyway, and deliberately: the cheap
+    # moment to hold a tool to this contract is BEFORE it acquires a dependency, not after someone
+    # discovers the vault's copy will not run.
+    #
+    # Worded to avoid the literal phrase tests/test_cutover_slug_rot.py ratchets on. That guard
+    # cannot separate "a COPIED TOOL" from "this REPO is a mirror of a private source", which is the
+    # rot it exists to stop -- and a coarse regex over prose is the right trade there. So the cost of
+    # saying this unambiguously is mine to pay, not the ceiling's to absorb.
+    "scripts/docs/asvs_tally_lint.py",
+    # This one has NO engine-side subject at all -- the record it reads exists only in the vault --
+    # so this list is the only thing standing between it and a dependency nothing here would notice.
+    "scripts/docs/asvs_residual_lint.py",
+)
+
+
+def test_the_verifier_is_at_the_path_the_vault_hardcodes() -> None:
+    assert VERIFIER.is_file(), (
+        f"{VERIFIER_REL} is missing from this tree. Two vault workflows resolve that literal path "
+        f"in an engine checkout; asvs-scorecard.yml's parity step treats a missing file as the "
+        f"sentinel 'MISSING' and WARNS rather than failing, so a rename here degrades the ASVS "
+        f"gate silently. If the file must move, move the vault's two references in the same change."
+    )
+
+
+@pytest.mark.parametrize("rel", MIRRORED_TOOLS)
+def test_a_mirrored_tool_imports_only_the_standard_library(rel: str) -> None:
+    assert (REPO_ROOT / rel).is_file(), f"{rel} is listed as a mirrored tool but is not in the tree"
+    source, roots, bad = scan(rel)
+    n_lines = source.count("\n") + 1
+    n_imports = sum(len(v) for v in roots.values())
+
+    # Print the inventory, not just the verdict: a scan that silently stopped seeing imports and a
+    # scan that legitimately found none are the same number, and only the inventory tells them apart.
+    print(f"SCANNED: {rel} ({n_lines} lines, {n_imports} import statements)")
+    print(f"FOUND:   {len(roots)} distinct import roots: {sorted(roots)}")
+    print(f"FOUND:   {len(bad)} non-stdlib roots: {sorted(bad)}")
+
+    # The scan must be capable of seeing anything at all. Zero imports means a broken scanner far
+    # more plausibly than it means a 1,000-line tool that imports nothing.
+    assert n_imports > 0, (
+        f"scanned {rel} ({n_lines} lines) and found ZERO import statements -- that is a "
+        f"broken scan, not a clean file"
+    )
+
+    assert not bad, (
+        f"{rel} imports {sorted(bad)} outside the standard library "
+        f"(lines {sorted(ln for lines in bad.values() for ln in lines)}). "
+        f"Scanned {n_imports} import statements across {n_lines} lines. "
+        f"The vault runs mirrored tools on a bare interpreter with NO install step. "
+        f"A non-stdlib import does not red the ASVS gate -- it strands the auto-mirror as an "
+        f"unmergeable draft and leaves the vault verifying its record with the previous copy."
+    )
+
+
+def test_the_verifier_runs_as_a_bare_script_with_nothing_installed(tmp_path: Path) -> None:
+    """Execute it the way the vault does, from a directory that is not this repo.
+
+    ``-S`` drops site-packages, so only the standard library is importable -- a faithful stand-in
+    for the vault's freshly-provisioned ``setup-python`` interpreter. ``-I`` additionally ignores
+    ``PYTHONPATH`` and the user site directory, so a developer's environment cannot make this pass
+    where CI would fail. The working directory is a temp dir because the vault's cwd is its own
+    checkout, never this one: anything resolved relative to cwd is already wrong there.
+    """
+    cmd = [sys.executable, "-I", "-S", str(VERIFIER), "--help"]
+    print(f"SCANNED: {' '.join(cmd)} (cwd={tmp_path})")
+    proc = subprocess.run(cmd, cwd=tmp_path, capture_output=True, text=True, timeout=120)
+    print(
+        f"FOUND:   rc={proc.returncode}, {len(proc.stdout)} bytes stdout, {len(proc.stderr)} stderr"
+    )
+
+    assert proc.returncode == 0, (
+        f"{VERIFIER_REL} does not run on a stdlib-only interpreter from an unrelated working "
+        f"directory (rc={proc.returncode}).\n"
+        f"--- stderr ---\n{proc.stderr}\n"
+        f"The vault invokes it exactly this way: `python scripts/asvs/scorecard.py` in "
+        f"asvs-scorecard.yml, and `python ../engine/scripts/asvs/scorecard.py` from the vault "
+        f"checkout in asvs-verifier-drift.yml's preflight job. Neither installs anything."
+    )
+    assert "--scorecard" in proc.stdout, (
+        f"the bare-interpreter run exited 0 but did not print the verifier's own CLI; got "
+        f"{proc.stdout[:400]!r}. An exit code alone does not prove the right program ran."
+    )
+
+
+# --------------------------------------------------------------------------------------------
+# The scanner's own tests. A guard nothing drives ships looking green, so the detector is proved
+# to fire on each shape it exists to catch, and proved SILENT on the shapes it must not flag.
+# --------------------------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    ("mutation", "expected"),
+    [
+        ("import httpx\n", "httpx"),
+        ("from fastapi import FastAPI\n", "fastapi"),
+        ("import os\nimport yaml.parser\n", "yaml"),
+        # Deferred into a function body -- invisible to any smoke test of the entry point.
+        ("def f():\n    import pydantic\n    return pydantic\n", "pydantic"),
+        # Deferred into a branch that only runs on the failure path.
+        ("import sys\nif sys.argv:\n    import requests\n", "requests"),
+        # A first-party import. Legal here, fatal there: the vault puts only scripts/asvs on the path.
+        ("from messagefoundry.config import settings\n", "messagefoundry"),
+        ("import messagefoundry\n", "messagefoundry"),
+        # A relative import needs a package; scripts/asvs has no __init__.py.
+        ("from . import helpers\n", "<relative import level 1>"),
+    ],
+)
+def test_the_scanner_reds_on_a_contract_violation(mutation: str, expected: str) -> None:
+    bad = non_stdlib(import_roots(mutation, "<mutation>"))
+    assert expected in bad, f"scanner did not flag {expected!r} in {mutation!r}; it reported {bad}"
+
+
+def test_the_scanner_is_silent_on_stdlib_only_source() -> None:
+    """Negative control. A pattern that cannot occur must return zero, not 'no output'.
+
+    This mirrors the verifier's real import shape -- module level, a ``from`` import, and two
+    deferred ones -- so a scanner that had degenerated into matching everything would show up
+    here as a non-empty result rather than as a passing test.
+    """
+    clean = (
+        "from __future__ import annotations\n"
+        "import argparse\n"
+        "import tomllib\n"
+        "from pathlib import Path\n"
+        "def f():\n"
+        "    import hashlib\n"
+        "    import json\n"
+        "    return hashlib, json, Path, argparse, tomllib\n"
+    )
+    roots = import_roots(clean, "<control>")
+    bad = non_stdlib(roots)
+    # The control is only meaningful if the scan saw something: assert on both halves.
+    assert len(roots) == 6, f"control source should yield 6 import roots, got {sorted(roots)}"
+    assert bad == {}, f"negative control flagged {bad} on stdlib-only source"
+
+
+def main() -> int:
+    if not VERIFIER.is_file():
+        print(f"MISSING: {VERIFIER_REL}")
+        return 1
+    source, roots, bad = scan()
+    n_lines = source.count("\n") + 1
+    n_imports = sum(len(v) for v in roots.values())
+    print(f"SCANNED: {VERIFIER_REL} ({n_lines} lines, {n_imports} import statements)")
+    for name in sorted(roots):
+        mark = "STDLIB" if name not in bad else "NOT-STDLIB"
+        print(f"  {mark:11s} {name:24s} line(s) {sorted(roots[name])}")
+    print(f"FOUND:   {len(bad)} non-stdlib import root(s)")
+    return 1 if bad else 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())