fix(asvs): survey progress counted a read-and-parked cell as never read

[wshallwshall]

ASVS-CURRENT.md — the CI-gated page that is the ASVS record under ADR 0156 — printed two different numbers for one quantity:

123 of 345 requirements have been read against the ASVS text (35.7%). 222 have not.

directly above its own table saying 221 unverified. 345 − 221 = 124.

The defect

Survey progress was computed from DECIDED_VERDICTS, which deliberately excludes needs-review. That exclusion is right for verdict counts — the cell was examined and then left open on purpose. But the survey line does not report what was decided, it reports what was read, and a needs-review cell has been read. The constant's own docstring says so: "the second was examined and left open on purpose."

The code used the right set for the wrong question.

The fix

EXAMINED_VERDICTS = DECIDED_VERDICTS | {"needs-review"}, used for progress only. Verdict counts keep DECIDED_VERDICTS, and so does the inherited warning — a parked cell is not an inherited verdict.

Why it survived every gate since the renderer was written

With zero needs-review cells the two sets are identical, so no test, no CI run and no reading of the output could distinguish them. It became observable only when the scorecard acquired its first one (11.4.4, in the V7/V11 baseline sweep) — a latent defect that needed new data, not new code, to surface. That is the shape this repo keeps finding: a control that passes because the case it gets wrong has never occurred.

Verification

• Regression test asserts the two printed figures agree, since a reader comparing them is the only thing that ever noticed.
• Proved red against HEAD before being trusted green. git stash is shared with the primary checkout and the worktree gate refuses it, so the renderer was reverted via git show HEAD: and restored afterwards.
• ruff check + ruff format --check, mypy strict, 35/35 scorecard tests.

Data-only, no behaviour change outside the rendered progress line. The vault's mirrored copy of scripts/asvs/scorecard.py will be synced after merge — its gate now reds on drift between the two.