fix(secret-gate): a documented fake id must not stop the machine tier

The live-sync heartbeat failed three hourly ticks (22:25, 23:27, 00:28) because a
managed skill that documents how to write a secret gate quotes the vendor's
all-zeros placeholder access-key id, and the shape rule fired on the
documentation. The machine tier is prose ABOUT credentials — the gate's own header
says a gate that fires there gets overridden until it means nothing — and a
heartbeat that cannot commit is a fleet that silently stops syncing config.

- shape hits are judged on the matched token, not the line: a documented fake is
  inert, one live token sharing the file still blocks. The match is judged with
  its following context, because a fixed quantifier truncates `EXAMPLE` to `EXA`
  and the placeholder would vanish from what is examined.
- assignment values keep the stricter rule from the previous commit: a comment on
  the same line cannot vouch for the token beside it.
- `ALLOW_SECRETS` remains the only override; nothing here widens what is scanned,
  it only stops flagging text that was never a credential.

Verified against the payload that is stuck right now: the skill page that the
heartbeat cannot commit passes the fixed hook and was refused by the live one.

Refs #60

omp-docs/log.md

@@ -20,28 +20,63 @@ This page is the bundle's **only** work log: one file, at the root. Never start
 second one in a subdirectory or under another name — `scripts/kb-lint.sh` reports any
 `log.md` that is not this one.
 
+## 2026-10-21 — reviewing a day of work, and finding checks that lie
+
+Two-axis review (Standards / Spec) of everything landed 2026-10-20 → 2026-10-21: 51 commits,
+30 findings, worked on `fix/60-review-findings` (issue #60). Three findings were the same shape —
+a check that reports confidence it did not earn:
+
+- **A guard that cannot see must refuse.** `pcie-probe.sh` dropped the `/dev/kfd` half of its
+  busy check when `fuser` was absent, and `gpu_busy_percent` reads `0` for a resident-but-idle
+  service: the tool measured beside a live endpoint while its own LAW said not to. Missing
+  visibility is now a refusal (exit `3`), not a narrower check.
+- **A swallowed status is a false report.** `deploy.sh` printed `ENABLE` for units systemd
+  refuses to enable (`live-sync.service` has no `[Install]` section; its timer arms it), and the
+  loop walked `*.service` only, so a rebuilt box deployed the heartbeat and never armed its
+  timer. Every outcome now reports what actually happened.
+- **A gate that reads a quoted path reads nothing.** git quotes non-ASCII paths in
+  `--name-only` output; the quoted name came back as an empty diff and the secret gate
+  `continue`d past it. Fail closed means `-z`, and it means the placeholder filter reads the
+  assigned value — a comment saying `# example` cannot vouch for the token beside it.
+
+The law that cost the most, from the probe: **a test that observes the tool's environment instead
+of what the tool passed on cannot see the bug.** The stub probe echoed `$HIP_VISIBLE_DEVICES`
+rather than its argument, so the suite asserted the mask was set and per-card bandwidth was
+unobtainable on the 2×R9700 box. Model the platform rule in the stub and the existing test goes
+red against the old code — that is the red-proof worth having.
+
+Incident, found while verifying the gate: the live-sync heartbeat had failed three hourly ticks,
+because a managed skill that documents how to write a secret gate quotes the vendor's all-zeros
+placeholder id and the gate's shape rule fired on the documentation. Prose about credentials is
+what the machine tier is made of; a gate that blocks it is worked around, and the workaround is
+the hole. Placeholder judgement reads the matched token — plus what follows it, because a fixed
+quantifier truncates `EXAMPLE` to `EXA` — never the whole line. `ALLOW_SECRETS` stays the only
+override, and the heartbeat's own payload was replayed through the fixed hook to prove it lands.
+
 ## 2026-10-21 — a documented mode the panel never had
 
 The home ultrawide had been running at 60 Hz for weeks while `desk-1-home.kdl`
 asked for `3440x1440@239.999`. The page that owns that file documented the same
 phantom mode, so every reader — including tonight's inspection — trusted it.
-`niri msg outputs` says the Sceptre M34's EDID tops out at 180 Hz; there is no
-240 Hz mode to ask for.
+The panel does offer a 240-class mode: `niri msg outputs` lists `3440x1440@239.998`. The defect
+was one character — niri matches mode strings verbatim, and `239.999` is not `239.998`.
 
 Laws, now on [tools/niri/displays](tools/niri/displays.md):
 
-- **An impossible mode does not fail, it falls back.** niri logs
-  `configured mode … could not be found, falling back to preferred` and drives
-  the EDID preferred mode — 60 Hz here. A config typo therefore looks like a
-  dying monitor, and every connector drop re-enacts it.
+- **A mode string must match the advertised string verbatim.** niri does not round:
+  `3440x1440@239.999` does not select `3440x1440@239.998`. It logs
+  `configured mode … could not be found, falling back to preferred` and drives the EDID
+  preferred mode — 60 Hz here. A one-character typo therefore looks like a dying monitor, and
+  every connector drop re-enacts it.
 - **Three layers, three signatures:** config fallback, DP link drops, and
   amdgpu `DMCUB` errors with `EINVAL` page flips after s2idle. Only the first
   yields to a file edit; only the last yields to a reboot. Triage table and
   probes are on the page.
-- **A number in a page is a claim, not a measurement.** Modes, refresh rates and
-  tool availability were wrong on four pages at once — `wlr-randr` was listed as
-  installed while `pacman -Qs wlr` matches nothing. Read the hardware before
-  writing a mode into a runbook, and destroy the stale copies.
+- **A number in a page is a claim, not a measurement.** Mode strings, refresh rates and tool
+  availability were wrong on several pages at once — `wlr-randr` was listed as installed while
+  `pacman -Qs wlr` matches nothing. Read the hardware before writing a mode into a runbook, and
+  destroy the stale copies. A correction is itself a measurement: the first pass at this entry
+  published a second wrong hardware fact, with a `verified:` date stamped on it.
 
 Fix: `desk-1-home.kdl` 239.999 → 180.000 on the identity block and both legacy
 connector blocks, applied live with `niri msg output <panel> mode <mode>` — the