NA-0686 — infra-literal gate self-test, new needle classes, and one naming edit

[Tebbens4832]

Lane: NA-0686. Spine ruling: D-1325.

Carries the spine's updated scripts/ci/infra_literal_scan.py — byte-identical across all four repositories (md5 verified) — and its new self-test.

The gate had no tests

Its refusal to report a pass over an empty input (NOTHING EXAMINED, exit 2) was correct, valuable, and completely unguarded. That is how a CI gate silently becomes a no-op when a base ref is not fetched: CI goes green and everyone believes it.

scripts/ci/infra_literal_scan_selftest.py (13 checks) pins:

• the NOTHING EXAMINED refusal in tree and diff mode;
• ⚠ the deliberate asymmetry that staged mode does not refuse — a deletion-only or rename-only commit legitimately has no added lines, and blocking those would make the pre-commit hook unusable. Exactly the kind of detail that gets "simplified" away later;
• that the scan reports what it examined, not merely a verdict;
• both new classes firing and going green again;
• the Tier-1 per-path allowlist behaving as a budget rather than an exemption.

It runs before the scan, so a broken instrument fails before it can report clean.

⚠ The self-test carries no operator literal. It runs inside the tree the Tier-1 scan examines, so a test written the obvious way — paste the literal, assert the scan finds it — would make the gate fail on its own test file. Every needle is assembled at run time from fragments that never appear contiguously in the source.

Two new Tier-2b classes

CGNAT (100.64/10) and the retired public dynamic-DNS domain — each proven fail-closed on a synthetic added line and green again on removal. Tier-2b added-line semantics are deliberate: this repository carries 8 dated-record occurrences of the DDNS class, which report what was true when written; the history stays and every new one fails.

Naming (ENG-0090)

README.md:7: "the transport-only server boundary" → "relay boundary" — the D-1320 ruling's cross-repo remainder, one word.

Measurements

• infra-literal scan (tree): clean, 81 files / 17 051 lines examined
• scanner self-test: 13 checks, 0 failed

Spine evidence: qsl-protocol docs/governance/evidence/NA-0686_as_built.md.