Fix 8 confirmed issues from static-review investigation

1. (High) dedupe MODE-OFF collapse: stable_key fallback now requires
   line-inclusive code_paths match (not path-only), preventing two
   distinct same-file bugs with same title+CWE from collapsing. Same-
   batch Step 3 also tightened to require line-inclusive match.
2. (Medium) KB_SNAPSHOT format/claims: architecture's comment-wrapped
   marker vs threat-model's bare header documented correctly; false
   reader claims fixed (report does NOT read KB_SNAPSHOT; planner does
   NOT read per-file markers; critic reads state field as primary).
3. (Low) schema.json active_snapshot description: absent=MODE-OFF
   (verdicts allowed), not DEGRADED. snapshot_pinned=false=HALT only
   when active_snapshot IS present.
4. (Low) vcs_info.snapshot_id description: marked redundant with
   active_snapshot.snapshot_id; default meta-agent doesn't write it.
5. (Medium) meta-agent crash-resume: step reference fixed (step 5 is
   state write, not step 6 which is GC).
6. (High) meta-agent dirty checks: .mantis_snapshots/ and workspace/
   added to ALL per-VCS exclude sets (git, hg, multi-vcs); previously
   missing, causing silent sync suppression when state_root is inside
   the target repo.
7. (Medium) architecture parent-rollup: expanded from 1-hop to 2-hop
   to match plan's dependency-aware fan-out depth.
8. (Medium) report: render possible_duplicate_of as advisory note in
   finding entries (was written by dedupe but invisible everywhere).

No .py committed. mdformat clean. Schema valid.

TAG=agy
CONV=aab01c59-a0bc-4e12-b8d8-07a15022423a

Change-Id: I4f06f3ff50c353f30f557d46645906df470531ae

Author: nickg-ca

mantis-architecture/SKILL.md

@@ -176,10 +176,14 @@ VCS):**
        `CODE_ROOT`; carry forward all other KB entries unchanged (they were
        built against the same code, just a different snapshot ID). Re-stamp
        `KB_SNAPSHOT: CUR` on every (re)written file.
-       - **Parent-rollup:** When invalidating a KB entry for changed file F,
-         also invalidate any KB entry that REFERENCES F (e.g., an entity that
-         imports F's module). This ensures downstream architectural analysis is
-         updated when a dependency changes.
+        - **Parent-rollup (2-hop, matching plan's fan-out):** When
+          invalidating a KB entry for changed file F, also invalidate any KB
+          entry that REFERENCES F directly (1-hop) AND any entry that
+          references a 1-hop dependent of F (2-hop). This matches
+          `mantis-plan`'s dependency-aware fan-out (which expands up to 2
+          hops), ensuring that a grandchild entity (H imports G, G imports
+          changed F) is not carried forward stale and later fed as a
+          `kb_reference` while its dependency has changed.
        - **Guardrail:** If ANY uncertainty arises (can't determine which KB
          entries map to which source files, the KB structure is ambiguous, or
          changed_files is empty but KB_ID != CUR), fall back to full rebuild
@@ -256,8 +260,14 @@ VCS):**
      FIRST line of `index.md`, each `entities/*.md`, and each
      `vulnerabilities/*.md` exactly `<!-- KB_SNAPSHOT: <SNAPSHOT_ID> -->`
      (substitute `CUR` from step 0b; it is an HTML comment so it does not
-     render). This is how the next pass's freshness gate (step 0b) and
-     downstream readers (Planner, Threat Modeler) detect drift.
+     render). This is how the next pass's freshness gate (step 0b) detects
+     drift. (Note: `mantis-threat-model` writes a bare `KB_SNAPSHOT:` header on
+     `THREAT_MODEL.md` only, not the comment-wrapped marker; the freshness gate
+     reads `kb_snapshot_id` from state as its primary source and the file marker
+     as a secondary check. `mantis-critic` reads the `KB_SNAPSHOT:` marker on
+     the first line of `THREAT_MODEL.md` first, falling back to `kb_snapshot_id`
+     in state if the marker is absent. Neither `mantis-plan` nor `mantis-report`
+     reads per-file KB_SNAPSHOT markers.)
 
    - **`AS_OF` tags (REQUIRED when running the freshness gate, i.e. HALT or
      PINNED; never write a timeless verdict):** Any assertion DERIVED FROM A

mantis-critic/SKILL.md

@@ -146,10 +146,11 @@ Execute the critic evaluation as follows:
    sources (try in order, first match wins):
 
    1. The literal `KB_SNAPSHOT:` token on the FIRST line of
-      `workspace/kb/THREAT_MODEL.md` (this is what the producers — architecture
-      and threat-model — actually write; do NOT look for `kb_snapshot_id:` or
-      `Snapshot:` — those tokens are never written and the gate would never
-      match).
+      `workspace/kb/THREAT_MODEL.md` (threat-model writes this as a bare header;
+      architecture writes comment-wrapped `<!-- KB_SNAPSHOT: ... -->` on each KB
+      file). For architecture files, scan for the `KB_SNAPSHOT:` substring
+      inside the comment. Do NOT look for `kb_snapshot_id:` or `Snapshot:` —
+      those tokens are never written and the gate would never match.
    2. Else the `kb_snapshot_id` value in `workspace/.mantis_state.json` (which
       architecture writes in its state-stamp step).
    3. Else `""` (no prior KB provenance). The blanket mass-mark below is gated

mantis-dedupe/SKILL.md

@@ -204,7 +204,14 @@ Execute your task as follows:
      is false at the PASS level (`active_snapshot.snapshot_pinned` — it is NOT a
      per-finding field) and Block B is uninformative — fall back to today's
      dedup by `signature` if present, else `stable_key` = normalized_title +
-     first `code_paths` entry (path only). This preserves dedup for targets that
+     first `code_paths` entry **including its trailing `:line`**
+     (line-inclusive, same as Step 2). Rationale: stripping `:line` would
+     collapse two DISTINCT bugs in the same file (e.g. `parser.c:100` vs
+     `parser.c:900`) with the same title+CWE into one — silently deleting a real
+     finding. Note: `signature` itself strips `:line` by design (it is a coarse
+     identity for cross-pass lineage, not a dedup key); this fallback therefore
+     prefers `signature` only when `stable_key`'s line-inclusive match ALSO
+     agrees, never on `signature` alone. This preserves dedup for targets that
      can never MATCH. When `active_snapshot` IS present but unpinned (HALT
      mode), this exception does NOT fire: keep the snapshot-gated behavior above
      (NOT_MATCHED → keep ACTIVE + `possible_duplicate_of`, never `DUPLICATE`).
@@ -213,9 +220,11 @@ Execute your task as follows:
      ALWAYS kept active (never trashed), regardless of mode.
 
 3. **Filter Duplicate Findings in Current Batch:** Check the current findings
-   against each other to find duplicates (using `code_paths` and `title`
-   similarities). If multiple findings refer to the exact same flaw or highly
-   overlapping code paths, they must be merged.
+   against each other to find duplicates. Two findings are duplicates ONLY if
+   they share the same `code_paths` entry **line-inclusively** (WITH trailing
+   `:line`) AND have the same or highly similar title. If multiple findings
+   refer to the exact same flaw at the same location, they must be merged.
+   Findings at different lines in the same file are DISTINCT — never merge them.
 
 4. **Map/Reduce Chunking Strategy (For Scale):** If there are many finding files
    (e.g., > 20 items), use a Map/Reduce approach to group them by target file or

mantis-meta-agent/SKILL.md

@@ -150,16 +150,18 @@ Execute your orchestration duties in a continuous loop:
         (Else pass-1 summary pollution makes the tree permanently "dirty" and
         sync silently never runs.) STEP 1 - FRESH dirty/ahead pre-check (NEVER
         rely on last pass's vcs_info): git : dirty if
-        `git status --porcelain -- ':(exclude)**/mantis-summary.md'         ':(exclude)**/*.bak-*'`
+        `git status --porcelain         -- ':(exclude)**/mantis-summary.md'         ':(exclude)**/*.bak-*'         ':(exclude)workspace/'         ':(exclude).mantis_snapshots/'`
         is non-empty; ahead if `git rev-list --count @{u}..HEAD 2>/dev/null`
         errors or > 0; detached if `git symbolic-ref -q HEAD` errors. hg : dirty
-        if `hg status -X '**/mantis-summary.md' -X 'workspace/**'` non-empty.
-        multi-vcs : dirty if `repo forall -c 'git status --porcelain'` produces
-        ANY output. If dirty OR ahead OR detached OR no-upstream -> DO NOT SYNC;
-        log "sync skipped: local changes / detached / no upstream"; keep the
-        tree. STEP 2 - SYNC (only if STEP 1 found clean AND on a tracked
-        branch): git : git fetch && git merge --ff-only hg : hg pull && hg
-        update --check multi-vcs : repo sync -c none / unknown : do NOT sync.
+        if
+        `hg status -X '**/mantis-summary.md' -X '*.bak-*' -X 'workspace/**' -X '.mantis_snapshots/**'`
+        non-empty. multi-vcs : dirty if
+        `repo forall -c "git status         --porcelain         -- ':(exclude)**/mantis-summary.md'         ':(exclude)**/*.bak-*'         ':(exclude)workspace/'         ':(exclude).mantis_snapshots/'"`
+        produces ANY output. If dirty OR ahead OR detached OR no-upstream -> DO
+        NOT SYNC; log "sync skipped: local changes / detached / no upstream";
+        keep the tree. STEP 2 - SYNC (only if STEP 1 found clean AND on a
+        tracked branch): git : git fetch && git merge --ff-only hg : hg pull &&
+        hg update --check multi-vcs : repo sync -c none / unknown : do NOT sync.
         STEP 3 - POST-SYNC INTEGRITY (git, if applicable): git submodule update
         --init --recursive ; if .gitattributes uses filter=lfs, git lfs pull. If
         either is needed but unavailable/fails -> force content_hash into
@@ -214,8 +216,8 @@ Execute your orchestration duties in a continuous loop:
         before any copy/detect): if `state.active_snapshot.pass == N` on entry,
         REUSE that dir (no re-copy/re-pin). If `snapshot_pinned` was true but
         the dir is now missing -> STOP and yield to the user (never re-pin to a
-        possibly-drifted live tree). If reusing, skip steps 1–5 and go straight
-        to step 6 (state write).
+        possibly-drifted live tree). If reusing, skip steps 1–4 and go straight
+        to step 5 (state write + snapshot_history append).
 
         1. Detect vcs_info (existing meta-agent detection). VCS_ID = commit_hash
            (git/hg) / manifest revision (multi-vcs) / "" (else).

mantis-report/SKILL.md

@@ -212,6 +212,11 @@ Execute the reporting stage as follows:
      are visible as such. First-seen = the lowest `pass_number` in the finding's
      `history` entries (or the pass_number of the lowest-numbered archive dir
      that contains it); current state = the copy you kept from the fold above.
+   - **Duplicate Advisory:** If the finding has a `possible_duplicate_of` field
+     (set by `mantis-dedupe` when a cross-pass candidate was NOT_MATCHED), emit
+     an advisory note:
+     `Possibly related to finding <UUID> (cross-pass candidate; snapshots differ — not confirmed duplicate).`
+     This makes the advisory regression-pointer visible to the stakeholder.
    - **Discovery Snapshot:** Emit `Discovery Snapshot: <discovery_commit>` for
      the finding. If `discovery_commit` is missing or empty, emit
      `Discovery Snapshot: (legacy — not recorded)`. Never omit or drop the