apply-protected-cast.sh splices derive-protected-experts.py output into the recipe's PROTECTED-BEGIN/END section (refuses to re-derive, trashes the pre-edit recipe). kld-gate-swift15.sh boots the candidate on the serving pin in --kld-ref mode (pool fully resident, no disk tier) and enforces mean KL<=0.03 / top-1>=95% from the JSON report.