[T-Crypt]

Validation-only run. No production files changed (tracked diff before this commit was empty; this PR adds 9 new files under .router/2026-10-14-gemma-codemap-validation/ only).

What changed (run folder only):

• plan.md: validate 7 improvements (embed2 cutover, index coverage, batteries, muse-router fast path, per-role cloud skills, typed handoffs, Gemma4 decision) on throwaway copies, SEEN/TESTED/VALIDATED/PROVEN ladder.
• muse-router-fast.json: fast-path candidate draft (dispatcher:true + sidecar note, plan-implement-review-fix-ship).
• handoff.schema.json + handoff.sample.json: typed-handoff schema and sample.
• evidence.md: per-improvement evidence log.
• implement.md, review.md, fix.md, review2.md: stage reports.

What the stages proved:

• plan: read-only + copy-only rules (no live config/src edit, no restart, no model load, no VM250, no secrets).
• implement: embed dims 768/768 (nomic/gemma), copy-DB reindex 273 files / 2334 chunks; live DB has only homelab (oh-my-pocket unindexed, gap found); copy server booted clean x2; batteries loader names 1/1; unit tests 33/33 (loop-guard+pruner+read-economy) and 32/32 (app.test.ts).
• review: 5 findings (dispatcher object dropped by loader, fast-id block keyed on model id router-fast, handoff line refs off, embed2 Q1 self-hit, batteries rating overstated). Safety clean, tests rerun green.
• fix: all 5 addressed in run folder only (dispatcher:true, CONFIRMED CONSTRAINT wording, line refs reload.ts:44 / loop-guard.ts:2, Q1 CONTAMINATED note, batteries TESTED+unit-VALIDATED).
• review2: all 5 fixed, no remaining issues. Tests rerun 33/33 + 32/32 green, git diff empty.

Ratings: embed2 VALIDATED-on-copy (Q1 re-query with .router/ excluded required before cutover) - coverage TESTED (gap) - batteries TESTED + unit-VALIDATED - fast-path TESTED (block needs model router-fast or code change) - skills TESTED - handoffs TESTED - gemma4 SEEN + prior TESTED.

Never merge from this stage. Review only.