chore(override-vocab): narrow 'ремонт инфраструктуры' to verify-only

Reduces full-opt-out from 11→3 categories (tdd-gate / verify-before-commit /
verify-before-push). Requires_justification 'ремонт:' kept intact.

Driver: brain-retro #10 trend analysis — 'ремонт инфраструктуры' fired
26 times on 2026-05-28 (vs 71 on 27.05). Used as side-effect to bypass
classifier/chain/skill hooks. Per Level 1 plan.

Also flips test 'global override "ремонт инфраструктуры" suppresses semgrep-security'
to assert new behaviour (toBeFalsy) in tools/enforce-semgrep-security.test.mjs.
Old test asserted truthy — now ремонт инфраструктуры no longer suppresses semgrep-security.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/observer/STATUS.md

@@ -1,6 +1,6 @@
 # Brain Status (auto-generated)
 
-Last updated: 2026-05-28T12:48:40.926Z
+Last updated: 2026-05-28T14:30:13.332Z
 
 | Контролёр | Состояние | Детали |
 |---|---|---|
@@ -8,13 +8,13 @@ Last updated: 2026-05-28T12:48:40.926Z
 | C2 Cross-ref consistency | ✅ | [cross-ref-checker] OK — 0 drift in 4 files |
 | C3 Observer-of-observer | ✅ | [observer-of-observer] OK — last read 0 week(s) ago |
 | C4 Сигнальный статус | ✅ | This file (self-reference) |
-| C5 Observer-coverage | ⚠️ | 598 episode(s) this month · Stop-hook + post-commit OK · 20 missed activation(s) — see /brain-retro |
+| C5 Observer-coverage | ⚠️ | 620 episode(s) this month · Stop-hook + post-commit OK · 20 missed activation(s) — see /brain-retro |
 | C6 Chain map sync | ✅ | [chain-map-checker] OK — 16 chains in sync |
 
 ## Метрики (информационные, не алерты)
 
-- Observer evidence: 598 episodes this month, 0 observer_error markers, 117 PII matches before filter
-- Legacy v1 episodes (not in factor analysis): 459
+- Observer evidence: 620 episodes this month, 0 observer_error markers, 125 PII matches before filter
+- Legacy v1 episodes (not in factor analysis): 481
 - Last /brain-retro: 1 day(s) ago
 - Использование узлов: см. `/brain-retro` (раз в спринт). missed_activations: 20. **Неиспользованные узлы — не алерт, если профильной задачи не было** (Pravila §16.4 v1.36; capability-readiness; см. memory `feedback_brain_unused_tools_not_problem` — outside-repo memory store).
 
@@ -24,16 +24,16 @@ Baseline дисциплины роутера (этап 2 router discipline overh
 
 | Тип задачи | Эпизодов | % с триггер-матчем | % через скил |
 |---|---|---|---|
-| analysis | 26 | 30.8% | 15.4% |
+| analysis | 27 | 29.6% | 14.8% |
 | bugfix | 18 | 22.2% | 27.8% |
 | planning | 16 | 18.8% | 18.8% |
 | feature | 15 | 13.3% | 0.0% |
 | cleanup | 6 | 0.0% | 0.0% |
 | refactor | 1 | 0.0% | 0.0% |
 
-Router step distribution: 1: 253, 2: 223, 3: 58, 5: 57
+Router step distribution: 1: 265, 2: 227, 3: 61, 5: 59
 
-Boundaries applied (ADR / границы): 70 of 591 эпизодов (11.8%).
+Boundaries applied (ADR / границы): 73 of 612 эпизодов (11.9%).
 
 ## Активные многоэтапные проекты
 
@@ -51,10 +51,10 @@ Boundaries applied (ADR / границы): 70 of 591 эпизодов (11.8%).
 
 | Компонент | Токены (in/out) | USD |
 |---|---|---|
-| Classifier (Sonnet 4.6) | 2134/27284 | $0.42 |
+| Classifier (Sonnet 4.6) | 2468/32811 | $0.50 |
 | Self-assessment (Sonnet 4.6) | 0/0 | $0.00 |
 | Reviewer (Opus 4.7 + fallback) | 0/0 | $0.00 |
-| **Итого** | | **$0.42** |
+| **Итого** | | **$0.50** |
 
 ## Аномалии классификатора
 
@@ -67,7 +67,7 @@ Episodes since last run: 542 / threshold: 10
 
 ## Reviewer: субагент vs fallback
 
-0 эпизодов проверено из 598.
+0 эпизодов проверено из 620.
 
 ## Reviewer findings
 
@@ -109,9 +109,9 @@ Episodes since last run: 542 / threshold: 10
 
 | Фраза | За всё время | За сегодня |
 |---|---|---|
-| `recovery` | 790 | 517 ⚠️ |
+| `recovery` | 816 | 543 ⚠️ |
 | `ремонт инфраструктуры` | 185 | 26 ⚠️ |
-| `без скилов` | 144 | 86 ⚠️ |
+| `без скилов` | 171 | 113 ⚠️ |
 | `срочно` | 93 | 11 ⚠️ |
 | `memory dump` | 17 | 9 ⚠️ |
 | `direct ok` | 6 | 0 |
@@ -119,7 +119,13 @@ Episodes since last run: 542 / threshold: 10
 
 ## System Health
 
-Долго работающих процессов нет (порог CPU > 1ч).
+Топ-3 процессов с CPU > 1ч:
+
+| PID | Имя | CPU-время | Возраст |
+|---|---|---|---|
+| 9756 | Code | 1.14ч | NaNч |
+
+⚠️ Проверь, не «осиротевшие» ли это процессы от завершённых Claude-сессий.
 
 ## Алерт-индикаторы
 

tools/enforce-override-vocab.json

@@ -74,18 +74,10 @@
       "suppresses": [
         "tdd-gate",
         "verify-before-commit",
-        "verify-before-push",
-        "writing-plans-required",
-        "skill-required",
-        "memory-sync-coverage",
-        "classifier-mismatch",
-        "coverage-skill-match",
-        "graph-first",
-        "chain-recommendation",
-        "semgrep-security"
+        "verify-before-push"
       ],
       "requires_justification": "ремонт:",
-      "description": "Bypass all rules (full opt-out). Requires 'ремонт: <what>' line in same prompt."
+      "description": "Infrastructure repair — bypass TDD-gate + verify hooks only. Other rules (skill-required, classifier-mismatch, chain-recommendation, graph-first, semgrep-security, memory-sync-coverage, coverage-skill-match, writing-plans-required) require their own override phrases."
     }
   ]
 }

tools/enforce-semgrep-security.test.mjs

@@ -173,8 +173,8 @@ describe('override vocab coverage', () => {
     const o = findOverride("memory dump", 'semgrep-security');
     expect(o).toBeTruthy();
   });
-  it("global override \"ремонт инфраструктуры\" suppresses semgrep-security", () => {
+  it("global override \"ремонт инфраструктуры\" does NOT suppress semgrep-security (narrowed to verify-only)", () => {
     const o = findOverride("ремонт инфраструктуры\nремонт: test reason", 'semgrep-security');
-    expect(o).toBeTruthy();
+    expect(o).toBeFalsy();
   });
 });