numbers_kept can never fire on the loop path — numbers are sentinels by the time the gate runs

[ssamba1]

WHAT

meaning_preserved's first veto is numbers_kept(source, candidate). On the loop path it is
unreachable: lock() replaces every numeral with a ⟦HZ…⟧ sentinel before any rewriter sees
the text, and the gate compares the MASKED source against the MASKED candidate. Both sides therefore
carry identical sentinels where the numbers were, and the check is always True.

Found while fixing --inspect (W7 slice 8): a test written to make the loop drop a number and see
numbers_kept named as the veto could not be made to pass, because the gate never sees a number.

EVIDENCE

• untell/scripts/run.py calls meaning_preserved(masked, candidate, sim, sim_bar) — masked, by
  design and with a measured justification in the surrounding comment.
• untell/scripts/preserve.py locks numerals: W7 slice 12's completeness matrix shows percentages,
  currency, dates, versions and bare quantities all locking and round-tripping byte-exact.
• The sentinel-integrity check in the loop already rejects any candidate whose sentinel multiset
  differs, so a dropped number is caught EARLIER and by a different mechanism.
• The slice's test had to be renamed from test_number_dropped_names_numbers_kept to
  test_polarity_flip_names_polarity_kept because no loop-reachable input triggers the numbers gate.

WHY IT MATTERS

This is the repo's own "a check with no subjects" class (Result 150; W7 slice 3 swept the audit for
it and found none — this instance is in the meaning gate instead, which nobody swept).

The consequences are not obviously bad: the number IS protected, by the sentinel check. But:

1. numbers_kept is presented in the codebase as one of the reasons a candidate is rejected, and it
   cannot be. Anyone reading the gate list is misled about what protects numbers.
2. It costs a call per candidate for a guaranteed-True answer.
3. If the masking contract ever changed, the gate would silently start mattering again with no test
   covering the transition — the opposite hazard.

ACCEPTANCE

• Determine whether numbers_kept is reachable on ANY path (the unmasked/library path, browser
  mode, or a caller invoking meaning_preserved directly) — census the callers, do not assume.
• If reachable only off-loop: document that in the function and in the gate list, so "which gate
  protects numbers on the loop path" has one honest answer (the sentinel check).
• If unreachable everywhere: remove it with the census proving it dead, or keep it with a test that
  pins the masking contract it depends on.
• Either way: a test asserting that a dropped number IS rejected on the loop path, naming whichever
  mechanism actually does the rejecting.