A baselined guard that stops refusing anything is now a failure, not 26 fixes;
fixed holes need an actual pass. --report preserves hand-written text above the
generated marker. Two tests added; report regenerated.
Co-Authored-By: RuFlo <ruv@ruv.net>
scripts/probe-mod-guards.mjs bundles each hooks/guard.ts with esbuild and runs a
97-probe corpus through its verdict: invisible/bidi splits, nesting to 5000,
wide/huge inputs, secrets in object keys, encodings, regex-DoS stress timed per
call (50 ms gate), benign look-alikes. Calibrates each guard's real secret
surface first so a miss is a real bypass. A fast subset runs last in
smoke-all-plugins against a known-holes baseline. Findings (4 root causes across
32 guards, no ReDoS/crash/hang) are in v3/docs/validation/mod-guard-probe-2026-10.md.
No plugin code changed.
Co-Authored-By: RuFlo <ruv@ruv.net>