diff --git a/scripts/check-phase11.sh b/scripts/check-phase11.sh
new file mode 100755
index 0000000..855f077
--- /dev/null
+++ b/scripts/check-phase11.sh
@@ -0,0 +1,736 @@
+#!/usr/bin/env bash
+# Phase 11 fail-closed gate (jobs, scheduler, realtime, push and search:
+# JOBS-01, CLI-04, CLI-06, RT-01, RT-02, RT-03, SRCH-01).
+#
+# Every stage exits non-zero on a failing command, a go test run that fails,
+# skips, matches zero tests or prints "no tests to run", a named test that
+# did not pass, a hygiene violation or an evidence gap. The only accepted
+# skips are the two broadcast goldens that Phase 12 turns into assertions,
+# and they must skip with their pending text. --self-test proves the
+# detector, each hygiene rule and the removal harness fail closed.
+#
+# --removal is the anchor-exact mutation harness behind the RC rows of
+# 11-SECURITY-REVIEW.md: it removes one protection at a time, requires its
+# named test to fail on an assertion, and restores the file byte for byte.
+# It edits tracked source while it runs, so it is not part of --all.
+#
+# Allow-list: KNOWN_APP_FAILURES names accepted fonoteka.go failures as
+# "package:Test" with a reason; it is empty.
+set -euo pipefail
+
+ROOT="${PHASE11_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
+APP="${PHASE11_APP:-$(cd "$ROOT/../fonoteka.go" && pwd)}"
+PHASE_DIR="$ROOT/.planning/phases/11-jobs-realtime-and-search-infrastructure"
+REVIEW="$PHASE_DIR/11-SECURITY-REVIEW.md"
+VALIDATION="$PHASE_DIR/11-VALIDATION.md"
+APP_PLUGINS=(./plugins/golem15/fonoteka/... ./plugins/golem15/user/...)
+KNOWN_APP_FAILURES=""
+# The broadcast goldens recorded from PHP but asserted only in Phase 12.
+GOLDEN_SKIPS="TestBroadcastGoldens/created TestBroadcastGoldens/updated"
+GOLDEN_SKIP_TEXT="pending: Phase 12"
+RIVER_VERSION="v0.47.0"
+
+usage() {
+	cat >&2 <<'EOF'
+usage:
+  check-phase11.sh --self-test
+  check-phase11.sh --hygiene
+  check-phase11.sh --go
+  check-phase11.sh --postgres
+  check-phase11.sh --named
+  check-phase11.sh --evidence
+  check-phase11.sh --removal
+  check-phase11.sh --all
+EOF
+	exit 2
+}
+
+# phase11_detect reads go test -json. Exit 1 fail, 2 skip, 3 zero tests or
+# "no tests to run", 4 non-JSON, 5 a required test did not pass, 6 an
+# allow-listed failure now passes, 7 an expected skip did not skip with its
+# pending text. PHASE11_REQUIRE lists tests that must pass; PHASE11_ALLOW
+# lists accepted "package:Test" failures; PHASE11_EXPECT_SKIP lists tests
+# that must skip with PHASE11_SKIP_TEXT in their output.
+phase11_detect() {
+	python3 - "$1" <<'PY'
+import json, os, sys
+path = sys.argv[1]
+allow = set(os.environ.get("PHASE11_ALLOW", "").split())
+require = set(os.environ.get("PHASE11_REQUIRE", "").split())
+expect_skip = set(os.environ.get("PHASE11_EXPECT_SKIP", "").split())
+skip_text = os.environ.get("PHASE11_SKIP_TEXT", "")
+passed, skipped = set(), set()
+output = {}
+failed_tests, failed_pkgs = {}, []
+build_failed = False
+with open(path, encoding="utf-8", errors="replace") as fh:
+    for raw in fh:
+        line = raw.strip()
+        if not line.startswith("{"):
+            continue
+        try:
+            ev = json.loads(line)
+        except json.JSONDecodeError:
+            print("refuse: non-json test output", file=sys.stderr)
+            sys.exit(4)
+        action = ev.get("Action")
+        test = ev.get("Test") or ""
+        pkg = ev.get("Package") or ""
+        if action == "build-fail":
+            build_failed = True
+        if action == "output":
+            text = ev.get("Output") or ""
+            if "no tests to run" in text:
+                print(f"refuse: no tests to run in {pkg}", file=sys.stderr)
+                sys.exit(3)
+            if test:
+                output.setdefault(test, []).append(text)
+        if action == "skip" and test:
+            if test not in expect_skip:
+                print(f"refuse: skipped {pkg} {test}", file=sys.stderr)
+                sys.exit(2)
+            skipped.add(test)
+        if action == "fail":
+            if ev.get("FailedBuild"):
+                build_failed = True
+            if test:
+                failed_tests.setdefault(pkg, []).append(test)
+            else:
+                failed_pkgs.append(pkg)
+        if action == "pass" and test:
+            passed.add(test)
+            if f"{pkg}:{test}" in allow:
+                print(f"refuse: allow-listed failure {pkg} {test} now passes; remove it from the gate", file=sys.stderr)
+                sys.exit(6)
+if build_failed:
+    print("refuse: build failed", file=sys.stderr)
+    sys.exit(1)
+accepted = []
+for pkg, tests in failed_tests.items():
+    for test in tests:
+        top = test.split("/", 1)[0]
+        if f"{pkg}:{top}" in allow:
+            accepted.append(f"{pkg} {test}")
+            continue
+        print(f"refuse: failed {pkg} {test}", file=sys.stderr)
+        sys.exit(1)
+for pkg in failed_pkgs:
+    if not failed_tests.get(pkg):
+        print(f"refuse: failed {pkg or 'unknown package'}", file=sys.stderr)
+        sys.exit(1)
+for item in sorted(set(accepted)):
+    print(f"known failure (KNOWN_APP_FAILURES): {item}", file=sys.stderr)
+for name in sorted(expect_skip):
+    if name in passed:
+        print(f"refuse: expected skip {name} now passes; move it out of the pending list", file=sys.stderr)
+        sys.exit(7)
+    if name not in skipped:
+        print(f"refuse: expected skip {name} did not run", file=sys.stderr)
+        sys.exit(7)
+    if skip_text and not any(skip_text in o for o in output.get(name, [])):
+        print(f"refuse: {name} skipped without {skip_text!r}", file=sys.stderr)
+        sys.exit(7)
+missing = sorted(name for name in require if name not in passed)
+if missing:
+    print("refuse: required tests did not pass: " + ", ".join(missing), file=sys.stderr)
+    sys.exit(5)
+if not passed:
+    print("refuse: zero tests", file=sys.stderr)
+    sys.exit(3)
+PY
+}
+
+# phase11_go DIR ARGS... runs go test -json -count=1 ARGS through the
+# detector. The go test exit status is trusted only when no failure was
+# allow-listed.
+phase11_go() {
+	local dir="$1"
+	shift
+	local log err
+	log="$(mktemp)"
+	err="$(mktemp)"
+	set +e
+	(cd "$dir" && go test -json -count=1 "$@") >"$log" 2>"$err"
+	local rc=$?
+	set -e
+	local dc=0
+	phase11_detect "$log" || dc=$?
+	if [[ "$dc" -ne 0 || ("$rc" -ne 0 && -z "${PHASE11_ALLOW:-}") ]]; then
+		cat "$err" >&2 || true
+		tail -n 40 "$log" >&2 || true
+		rm -f "$log" "$err"
+		echo "refuse: go test $* in $dir (test=$rc detect=$dc)" >&2
+		exit 1
+	fi
+	rm -f "$log" "$err"
+}
+
+# phase11_tests DIR PKG TEST... requires every named test to run and pass.
+phase11_tests() {
+	local dir="$1" pkg="$2"
+	shift 2
+	local names="$*"
+	local regex="^($(tr ' ' '|' <<<"$names"))\$"
+	PHASE11_REQUIRE="$names" phase11_go "$dir" "$pkg" -run "$regex"
+}
+
+expect_detect() {
+	local name="$1" want="$2" payload="$3"
+	local log dc=0
+	log="$(mktemp)"
+	printf '%s\n' "$payload" >"$log"
+	phase11_detect "$log" 2>/dev/null || dc=$?
+	rm -f "$log"
+	if [[ "$dc" -ne "$want" ]]; then
+		echo "refuse: self-test $name: detector exit $dc, want $want" >&2
+		exit 1
+	fi
+}
+
+# The hygiene_11 refusal reasons; the self-test checks each plant is refused
+# for its own reason only.
+REASON_APPNAME="application name in a Phase 11 framework file"
+REASON_CLIENT="excluded client library in the module graph"
+REASON_CRON="direct cron dependency in go.mod"
+REASON_RIVER="River is not pinned at $RIVER_VERSION"
+REASON_README="Phase 11 module without a README or a root README row"
+
+APPNAME_RE='pl[yý]tarium|fonoteka|albumy|kolekcj|winyl|p[lł]yt[aęy]'
+# The Centrifugo and Typesense Go clients and Web Push libraries (D-12,
+# D-15, D-19: all hand-rolled on net/http and stdlib crypto).
+CLIENT_RE='^github\.com/centrifugal/(gocent|centrifuge-go)|^github\.com/typesense/typesense-go|webpush|web-push'
+CRON_RE='cron'
+PHASE11_MODULES=(conga lighthouse flare beachcomber)
+
+# phase11_files TREE: the Phase 11 framework files the application-name
+# rule reads (tracked files when TREE is a git work tree).
+phase11_files() {
+	local tree="$1" m
+	if git -C "$tree" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+		(cd "$tree" && git ls-files -- modules/conga modules/lighthouse modules/flare modules/beachcomber 'modules/tide/centrifugo*.go')
+		return
+	fi
+	(
+		cd "$tree"
+		for m in "${PHASE11_MODULES[@]}"; do
+			[[ -d "modules/$m" ]] && find "modules/$m" -type f
+		done
+		find modules/tide -maxdepth 1 -type f -name 'centrifugo*.go' 2>/dev/null
+	) | sort
+}
+
+# hygiene_11 TREE MODLIST GOMOD...: the Phase 11 hygiene rules. MODLIST is
+# `go list -m all` of both repositories; GOMOD are the go.mod files whose
+# direct requirements are checked. Each rule returns on its first violation.
+hygiene_11() {
+	local tree="$1" modlist="$2"
+	shift 2
+	local hits file m
+	# Framework modules never name the application (CLAUDE.md).
+	while IFS= read -r file; do
+		[[ -n "$file" ]] || continue
+		hits="$(grep -niE "$APPNAME_RE" "$tree/$file" | head -n1 || true)"
+		if [[ -n "$hits" ]]; then
+			echo "refuse: hygiene: $REASON_APPNAME: $file: $hits" >&2
+			return 1
+		fi
+	done < <(phase11_files "$tree")
+	# No Centrifugo, Typesense or Web Push client library (T-11-SC).
+	hits="$(grep -iE "$CLIENT_RE" "$modlist" | head -n1 || true)"
+	if [[ -n "$hits" ]]; then
+		echo "refuse: hygiene: $REASON_CLIENT: $hits" >&2
+		return 1
+	fi
+	# No direct cron dependency: Daily/Every cover the cadences (11-02).
+	for file in "$@"; do
+		hits="$(awk '/^require[[:space:]]*\(/{inblock=1; next} inblock && /^\)/{inblock=0; next} (inblock || /^require[[:space:]]/) && !/\/\/[[:space:]]*indirect/' "$file" | grep -iE "$CRON_RE" | head -n1 || true)"
+		if [[ -n "$hits" ]]; then
+			echo "refuse: hygiene: $REASON_CRON: $file: $hits" >&2
+			return 1
+		fi
+	done
+	# River stays pinned at the audited version.
+	hits="$(grep -E '^github\.com/riverqueue/river ' "$modlist" | sort -u || true)"
+	if [[ -z "$hits" ]] || grep -vqE "^github\.com/riverqueue/river $RIVER_VERSION\$" <<<"$hits"; then
+		echo "refuse: hygiene: $REASON_RIVER: ${hits:-<absent>}" >&2
+		return 1
+	fi
+	# Every new module ships a README and a root modules-table row.
+	for m in "${PHASE11_MODULES[@]}"; do
+		if [[ ! -f "$tree/modules/$m/README.md" ]] || ! grep -qF "| [$m](modules/$m/README.md) |" "$tree/README.md"; then
+			echo "refuse: hygiene: $REASON_README: $m" >&2
+			return 1
+		fi
+	done
+	return 0
+}
+
+module_list() {
+	local out="$1"
+	(cd "$ROOT" && go list -m all) >"$out"
+	(cd "$APP" && go list -m all) >>"$out"
+}
+
+run_hygiene() {
+	local modlist
+	modlist="$(mktemp)"
+	module_list "$modlist"
+	local gomods=("$ROOT/go.mod" "$APP/go.mod")
+	local f
+	for f in "$APP"/plugins/*/*/go.mod; do
+		[[ -f "$f" ]] && gomods+=("$f")
+	done
+	if ! hygiene_11 "$ROOT" "$modlist" "${gomods[@]}"; then
+		rm -f "$modlist"
+		exit 1
+	fi
+	rm -f "$modlist"
+	echo "phase11 hygiene passed"
+}
+
+# removal_checks TABLE_MODE: the RC table, run by removal_harness.
+# Fields: id, threat, repo (root|app|script), file, anchor, replacement,
+# package, test regex. Anchors must occur exactly once.
+removal_table() {
+	cat <<'EOF'
+[
+ ["RC-01", "T-11-01", "root", "modules/lighthouse/centrifugo/handlers.go",
+  "if cfg.ProxySecret == \"\" || subtle.ConstantTimeCompare([]byte(cfg.ProxySecret), []byte(provided)) != 1 {",
+  "if subtle.ConstantTimeCompare([]byte(cfg.ProxySecret), []byte(provided)) == 2 {", "./modules/lighthouse/centrifugo", "^TestProxy$"],
+ ["RC-02", "T-11-02", "root", "modules/lighthouse/channel.go",
+  "if strings.HasPrefix(channel, presencePrefix+presencePrefix) {",
+  "if false {", "./modules/lighthouse", "^TestParseChannel$"],
+ ["RC-03", "T-11-02", "root", "modules/lighthouse/channel.go",
+  "if len(parts) > 3 {",
+  "if false {", "./modules/lighthouse", "^TestParseChannel$"],
+ ["RC-04", "T-11-02", "app", "plugins/golem15/fonoteka/classes/ws/collection_authorizer.go",
+  "\t\tWhere(\"golem15_fonoteka_collections.kind = ?\", \"collection\").\n",
+  "", "./plugins/golem15/fonoteka", "^TestWsAuthorizer$"],
+ ["RC-05", "T-11-05", "root", "modules/lighthouse/broadcast.go",
+  "cb.Create().After(\"gorm:after_create\").Before(commitCallback).Register(",
+  "cb.Create().After(\"gorm:after_create\").Register(", "./modules/lighthouse", "^TestBroadcastTx$"],
+ ["RC-06", "T-11-05", "app", "plugins/golem15/fonoteka/realtime.go",
+  "if c.Kind != \"collection\" {",
+  "if false {", "./plugins/golem15/fonoteka", "^TestAlbumBroadcastBinding$"],
+ ["RC-07", "T-11-07", "app", "plugins/golem15/fonoteka/models/album_search.go",
+  "if a == nil || a.CollectionID == 0 {",
+  "if a == nil {", "./plugins/golem15/fonoteka", "^TestAlbumSearchable$"],
+ ["RC-08", "T-11-09", "root", "modules/conga/scheduler.go",
+  "if !ok || entry.Command != a.Command || !slices.Equal(entry.Args, a.Args) {",
+  "if !ok {", "./modules/conga", "^TestScheduledEntryMismatchSkipped$"],
+ ["RC-09", "T-11-12", "root", "modules/conga/conga.go",
+  "res, err := client.InsertTx(ctx, sqlTx, args, opts)",
+  "_ = sqlTx\n\t\tres, err := client.Insert(ctx, args, opts)", "./modules/conga", "^TestDispatchTransactional$"],
+ ["RC-10", "T-11-19", "root", "modules/lighthouse/route.go",
+  "if len(s.UserAuth) == 0 {",
+  "if false {", "./modules/lighthouse", "^TestMountSurfaces$"],
+ ["RC-11", "T-11-22", "root", "modules/flare/flare.go",
+  "if !HostAllowed(host, p.cfg.AllowedHosts) {",
+  "if false {", "./modules/flare", "^(TestSendAllowlist|TestSendRefusesDisallowedEndpoint)$"],
+ ["RC-12", "T-11-28", "app", "parity/check_corpus.go",
+  "if strings.Contains(text, v) {\n\t\t\t\thits = append(hits, rel+\": centrifugo test value\")",
+  "if false && strings.Contains(text, v) {\n\t\t\t\thits = append(hits, rel+\": centrifugo test value\")", "./parity", "^TestUniqueAndSecretScan$"],
+ ["RC-13", "T-11-SC", "script", "scripts/check-phase11.sh",
+  "hits=\"$(grep -iE \"$CLIENT_RE\" \"$modlist\" | head -n1 || true)\"",
+  "hits=\"\"", "", "--self-test"]
+]
+EOF
+}
+
+# removal_harness TABLE_FILE: for each row, save the file, apply the
+# anchor-exact mutation, run the named test (or, for the gate script, its
+# --self-test on a mutated copy) and require it to fail on an assertion,
+# then restore the file and require cmp to match the saved copy.
+removal_harness() {
+	python3 - "$1" "$ROOT" "$APP" <<'PY'
+import json, os, shutil, subprocess, sys, tempfile
+table = json.load(open(sys.argv[1]))
+root, app = sys.argv[2], sys.argv[3]
+only = set(os.environ.get("PHASE11_RC", "").split())
+failures = 0
+for rc, threat, repo, rel, anchor, repl, pkg, run in table:
+    if only and rc not in only:
+        continue
+    base = {"root": root, "app": app, "script": root}[repo]
+    path = os.path.join(base, rel)
+    original = open(path, "rb").read()
+    text = original.decode()
+    n = text.count(anchor)
+    if n != 1:
+        print(f"refuse: {rc} {threat}: anchor occurs {n} times in {rel}", file=sys.stderr)
+        sys.exit(1)
+    mutated = text.replace(anchor, repl, 1)
+    scratch = tempfile.mkdtemp(prefix="phase11-rc-")
+    saved = os.path.join(scratch, "saved")
+    shutil.copyfile(path, saved)
+    try:
+        if repo == "script":
+            copy = os.path.join(scratch, os.path.basename(rel))
+            open(copy, "w").write(mutated)
+            env = dict(os.environ, PHASE11_ROOT=root, PHASE11_APP=app)
+            proc = subprocess.run(["bash", copy, run], cwd=root, env=env, capture_output=True, text=True, timeout=600)
+            out = proc.stdout + proc.stderr
+            ok = proc.returncode != 0 and "refuse:" in out
+            evidence = next((l for l in out.splitlines() if l.startswith("refuse:")), "")
+        else:
+            with open(path, "w") as fh:
+                fh.write(mutated)
+            proc = subprocess.run(["go", "test", pkg, "-run", run, "-count=1"], cwd=base, capture_output=True, text=True, timeout=900)
+            out = proc.stdout + proc.stderr
+            build = "[build failed]" in out or "[setup failed]" in out
+            ok = proc.returncode != 0 and "--- FAIL" in out and not build
+            fails = [l.strip() for l in out.splitlines() if l.strip().startswith("--- FAIL")]
+            names = [l.split()[2] for l in fails if len(l.split()) > 2]
+            evidence = ", ".join(names[:5]) + (f" (+{len(names) - 5} more)" if len(names) > 5 else "") if names else ("build failed" if build else "no failure")
+    finally:
+        with open(path, "wb") as fh:
+            fh.write(original)
+    same = subprocess.run(["cmp", "-s", saved, path]).returncode == 0
+    shutil.rmtree(scratch, ignore_errors=True)
+    if not same:
+        print(f"refuse: {rc}: {rel} was not restored byte for byte", file=sys.stderr)
+        sys.exit(1)
+    status = "fails as required" if ok else "SURVIVED"
+    print(f"{rc} {threat} {rel}: {status}: {evidence}")
+    if not ok:
+        failures += 1
+if failures:
+    print(f"refuse: {failures} removal check(s) survived", file=sys.stderr)
+    sys.exit(1)
+PY
+}
+
+run_removal() {
+	local table
+	table="$(mktemp)"
+	removal_table >"$table"
+	if ! removal_harness "$table"; then
+		rm -f "$table"
+		exit 1
+	fi
+	rm -f "$table"
+	echo "phase11 removal passed"
+}
+
+run_self_test() {
+	bash -n "${BASH_SOURCE[0]}"
+	expect_detect pass 0 '{"Action":"pass","Package":"p","Test":"TestSuppression"}'
+	expect_detect fail 1 '{"Action":"pass","Package":"p","Test":"TestA"}
+{"Action":"fail","Package":"p","Test":"TestProxy"}'
+	expect_detect skip 2 '{"Action":"skip","Package":"p","Test":"TestSyncGates"}'
+	expect_detect zero 3 '{"Action":"pass","Package":"git.golem15.com/golem15/summercms/modules/conga"}'
+	expect_detect no-tests-to-run 3 '{"Action":"pass","Package":"p","Test":"TestA"}
+{"Action":"output","Package":"q","Output":"testing: warning: no tests to run\n"}'
+	expect_detect nonjson 4 '{"Action":"pass",'
+	expect_detect build 1 '{"Action":"build-fail","ImportPath":"p"}
+{"Action":"pass","Package":"q","Test":"TestA"}'
+	expect_detect build-flag 1 '{"Action":"pass","Package":"q","Test":"TestA"}
+{"Action":"fail","Package":"p","FailedBuild":"p"}'
+	expect_detect package 1 '{"Action":"pass","Package":"p","Test":"TestA"}
+{"Action":"fail","Package":"p"}'
+	PHASE11_REQUIRE="TestProxy TestWsAuthorizer" expect_detect required 5 \
+		'{"Action":"pass","Package":"p","Test":"TestProxy"}'
+	PHASE11_ALLOW="p:TestKnown" expect_detect allowed 0 '{"Action":"pass","Package":"p","Test":"TestA"}
+{"Action":"fail","Package":"p","Test":"TestKnown"}
+{"Action":"fail","Package":"p"}'
+	PHASE11_ALLOW="p:TestKnown" expect_detect allowed-other 1 '{"Action":"fail","Package":"p","Test":"TestKnown"}
+{"Action":"fail","Package":"p","Test":"TestOther"}'
+	PHASE11_ALLOW="p:TestKnown" expect_detect allowed-now-passes 6 '{"Action":"pass","Package":"p","Test":"TestKnown"}'
+	local golden='{"Action":"output","Package":"p","Test":"TestBroadcastGoldens/created","Output":"    pending: Phase 12 asserts the album subtree\n"}
+{"Action":"skip","Package":"p","Test":"TestBroadcastGoldens/created"}
+{"Action":"pass","Package":"p","Test":"TestBroadcastGoldens"}'
+	PHASE11_EXPECT_SKIP="TestBroadcastGoldens/created" PHASE11_SKIP_TEXT="$GOLDEN_SKIP_TEXT" expect_detect expected-skip 0 "$golden"
+	PHASE11_EXPECT_SKIP="TestBroadcastGoldens/created" PHASE11_SKIP_TEXT="$GOLDEN_SKIP_TEXT" expect_detect expected-skip-wrong-text 7 \
+		'{"Action":"skip","Package":"p","Test":"TestBroadcastGoldens/created"}
+{"Action":"pass","Package":"p","Test":"TestBroadcastGoldens"}'
+	PHASE11_EXPECT_SKIP="TestBroadcastGoldens/created" PHASE11_SKIP_TEXT="$GOLDEN_SKIP_TEXT" expect_detect expected-skip-passes 7 \
+		'{"Action":"pass","Package":"p","Test":"TestBroadcastGoldens/created"}'
+	PHASE11_EXPECT_SKIP="TestBroadcastGoldens/created" PHASE11_SKIP_TEXT="$GOLDEN_SKIP_TEXT" expect_detect expected-skip-missing 7 \
+		'{"Action":"pass","Package":"p","Test":"TestA"}'
+	PHASE11_EXPECT_SKIP="TestBroadcastGoldens/created" PHASE11_SKIP_TEXT="$GOLDEN_SKIP_TEXT" expect_detect other-skip 2 \
+		"$golden
+{\"Action\":\"skip\",\"Package\":\"p\",\"Test\":\"TestBroadcastGoldens/deleted\"}"
+	local flag
+	for flag in --self-test --hygiene --go --postgres --named --evidence --removal --all; do
+		grep -q -- "^$flag)" "${BASH_SOURCE[0]}" || {
+			echo "refuse: missing mode $flag" >&2
+			exit 1
+		}
+	done
+
+	# hygiene_11 passes on scratch copies, then refuses each plant for its
+	# own reason and no other.
+	local scratch
+	scratch="$(mktemp -d)"
+	trap 'rm -rf "$scratch"' RETURN
+	mkdir -p "$scratch/tree/modules/tide"
+	local m
+	for m in "${PHASE11_MODULES[@]}"; do
+		cp -R "$ROOT/modules/$m" "$scratch/tree/modules/$m"
+	done
+	cp "$ROOT"/modules/tide/centrifugo*.go "$scratch/tree/modules/tide/"
+	cp "$ROOT/README.md" "$scratch/tree/README.md"
+	cp "$ROOT/go.mod" "$scratch/go.mod"
+	module_list "$scratch/modlist"
+	cp "$scratch/modlist" "$scratch/modlist.clean"
+	cp "$scratch/go.mod" "$scratch/go.mod.clean"
+	cp "$scratch/tree/README.md" "$scratch/README.clean"
+	(hygiene_11 "$scratch/tree" "$scratch/modlist" "$scratch/go.mod") >/dev/null 2>&1 || {
+		echo "refuse: self-test hygiene_11 rejected the clean scratch copy" >&2
+		exit 1
+	}
+	local plant want out reason
+	for plant in appname-go appname-readme client-gocent client-typesense client-webpush cron river-version river-absent readme-file readme-row; do
+		rm -f "$scratch/tree/modules/conga/zz_plant.go"
+		cp "$scratch/modlist.clean" "$scratch/modlist"
+		cp "$scratch/go.mod.clean" "$scratch/go.mod"
+		cp "$scratch/README.clean" "$scratch/tree/README.md"
+		cp "$ROOT/modules/lighthouse/README.md" "$scratch/tree/modules/lighthouse/README.md"
+		cp "$ROOT/modules/flare/README.md" "$scratch/tree/modules/flare/README.md"
+		case "$plant" in
+		appname-go)
+			printf 'package conga\n\n// Płytarium keeps its albums here.\n' >"$scratch/tree/modules/conga/zz_plant.go"
+			want="$REASON_APPNAME"
+			;;
+		appname-readme)
+			printf '\nThe fonoteka app uses this.\n' >>"$scratch/tree/modules/lighthouse/README.md"
+			want="$REASON_APPNAME"
+			;;
+		client-gocent)
+			printf 'github.com/centrifugal/gocent/v3 v3.3.0\n' >>"$scratch/modlist"
+			want="$REASON_CLIENT"
+			;;
+		client-typesense)
+			printf 'github.com/typesense/typesense-go/v3 v3.2.0\n' >>"$scratch/modlist"
+			want="$REASON_CLIENT"
+			;;
+		client-webpush)
+			printf 'github.com/SherClockHolmes/webpush-go v1.4.0\n' >>"$scratch/modlist"
+			want="$REASON_CLIENT"
+			;;
+		cron)
+			printf '\nrequire github.com/robfig/cron/v3 v3.0.1\n' >>"$scratch/go.mod"
+			want="$REASON_CRON"
+			;;
+		river-version)
+			sed -i 's|^github.com/riverqueue/river v0.47.0$|github.com/riverqueue/river v0.46.0|' "$scratch/modlist"
+			want="$REASON_RIVER"
+			;;
+		river-absent)
+			sed -i '/^github.com\/riverqueue\/river /d' "$scratch/modlist"
+			want="$REASON_RIVER"
+			;;
+		readme-file)
+			rm -f "$scratch/tree/modules/flare/README.md"
+			want="$REASON_README"
+			;;
+		readme-row)
+			sed -i '/^| \[beachcomber\](modules\/beachcomber\/README.md) |/d' "$scratch/tree/README.md"
+			want="$REASON_README"
+			;;
+		esac
+		if out="$( (hygiene_11 "$scratch/tree" "$scratch/modlist" "$scratch/go.mod") 2>&1)"; then
+			echo "refuse: self-test hygiene_11 accepted a planted $plant" >&2
+			exit 1
+		fi
+		if ! grep -qF "$want" <<<"$out"; then
+			echo "refuse: self-test hygiene_11 rejected the $plant plant without naming its rule: $out" >&2
+			exit 1
+		fi
+		for reason in "$REASON_APPNAME" "$REASON_CLIENT" "$REASON_CRON" "$REASON_RIVER" "$REASON_README"; do
+			if [[ "$reason" != "$want" ]] && grep -qF "$reason" <<<"$out"; then
+				echo "refuse: self-test hygiene_11 rejected the $plant plant for another rule: $out" >&2
+				exit 1
+			fi
+		done
+	done
+	# Look-alikes are accepted: English words near the application names,
+	# an indirect cron requirement and the pinned River line.
+	rm -f "$scratch/tree/modules/conga/zz_plant.go"
+	cp "$ROOT/modules/lighthouse/README.md" "$scratch/tree/modules/lighthouse/README.md"
+	cp "$ROOT/modules/flare/README.md" "$scratch/tree/modules/flare/README.md"
+	cp "$scratch/modlist.clean" "$scratch/modlist"
+	cp "$scratch/README.clean" "$scratch/tree/README.md"
+	cp "$scratch/go.mod.clean" "$scratch/go.mod"
+	printf 'package conga\n\n// A display tariff for the acme collection of vinyl albums and playlists.\n' >"$scratch/tree/modules/conga/zz_plant.go"
+	printf '\nrequire github.com/robfig/cron/v3 v3.0.1 // indirect\n' >>"$scratch/go.mod"
+	printf 'github.com/acme/webhooks v1.0.0\n' >>"$scratch/modlist"
+	(hygiene_11 "$scratch/tree" "$scratch/modlist" "$scratch/go.mod") >/dev/null 2>&1 || {
+		echo "refuse: self-test hygiene_11 rejected a clean look-alike" >&2
+		exit 1
+	}
+
+	# The removal harness refuses an anchor that is not unique, restores
+	# the file byte for byte, and reports a mutation whose test passes.
+	local fake="$scratch/fake"
+	mkdir -p "$fake/modules/acme"
+	printf 'module example.test/acme\n\ngo 1.27\n' >"$fake/go.mod"
+	printf 'package acme\n\nfunc Guard(n int) bool {\n\tif n > 3 {\n\t\treturn false\n\t}\n\treturn true\n}\n' >"$fake/modules/acme/acme.go"
+	printf 'package acme\n\nimport "testing"\n\nfunc TestGuard(t *testing.T) {\n\tif Guard(4) {\n\t\tt.Fatal("guard removed")\n\t}\n}\n\nfunc TestOther(t *testing.T) {}\n' >"$fake/modules/acme/acme_test.go"
+	cp "$fake/modules/acme/acme.go" "$scratch/acme.go.saved"
+	local table="$scratch/table.json"
+	printf '[["RC-T1","T-X","root","modules/acme/acme.go","if n > 3 {","if false {","./modules/acme","^TestGuard$"]]' >"$table"
+	out="$(removal_harness_in "$fake" "$table" 2>&1)" || {
+		echo "refuse: self-test removal harness did not catch a guarded mutation: $out" >&2
+		exit 1
+	}
+	grep -q "RC-T1 T-X modules/acme/acme.go: fails as required" <<<"$out" || {
+		echo "refuse: self-test removal harness output: $out" >&2
+		exit 1
+	}
+	cmp -s "$fake/modules/acme/acme.go" "$scratch/acme.go.saved" || {
+		echo "refuse: self-test removal harness did not restore the file" >&2
+		exit 1
+	}
+	printf '[["RC-T2","T-X","root","modules/acme/acme.go","if n > 3 {","if false {","./modules/acme","^TestOther$"]]' >"$table"
+	if out="$(removal_harness_in "$fake" "$table" 2>&1)"; then
+		echo "refuse: self-test removal harness accepted a mutation whose test passes: $out" >&2
+		exit 1
+	fi
+	grep -q "RC-T2 T-X modules/acme/acme.go: SURVIVED" <<<"$out" || {
+		echo "refuse: self-test removal harness refused a surviving mutation for the wrong reason: $out" >&2
+		exit 1
+	}
+	printf '[["RC-T3","T-X","root","modules/acme/acme.go","return","x","./modules/acme","^TestGuard$"]]' >"$table"
+	if out="$(removal_harness_in "$fake" "$table" 2>&1)"; then
+		echo "refuse: self-test removal harness accepted a non-unique anchor" >&2
+		exit 1
+	fi
+	grep -q "anchor occurs 2 times" <<<"$out" || {
+		echo "refuse: self-test removal harness refused a non-unique anchor for the wrong reason: $out" >&2
+		exit 1
+	}
+	cmp -s "$fake/modules/acme/acme.go" "$scratch/acme.go.saved" || {
+		echo "refuse: self-test removal harness left a mutation behind" >&2
+		exit 1
+	}
+	echo "phase11 self-test passed"
+}
+
+# removal_harness_in ROOT TABLE runs the harness against another root.
+removal_harness_in() {
+	local root="$1" table="$2"
+	(
+		ROOT="$root"
+		APP="$root"
+		export GOWORK=off GOFLAGS=-mod=mod
+		removal_harness "$table"
+	)
+}
+
+run_go() {
+	(cd "$ROOT" && go vet ./...)
+	phase11_go "$ROOT" ./...
+	phase11_go "$ROOT" -race ./modules/lighthouse/... ./modules/beachcomber/... ./modules/flare
+	PHASE11_REQUIRE="TestListenPickupLatency" phase11_go "$ROOT" ./modules/conga -run '^TestListenPickupLatency$' -count=3
+	echo "phase11 go passed"
+}
+
+run_postgres() {
+	(cd "$APP" && go vet ./... "${APP_PLUGINS[@]}")
+	PHASE11_ALLOW="$KNOWN_APP_FAILURES" PHASE11_EXPECT_SKIP="$GOLDEN_SKIPS" PHASE11_SKIP_TEXT="$GOLDEN_SKIP_TEXT" \
+		phase11_go "$APP" ./... "${APP_PLUGINS[@]}"
+	echo "phase11 postgres passed"
+}
+
+# run_named runs every test named in 11-VALIDATION.md (and the plan's
+# per-requirement tests) by exact name, per package.
+run_named() {
+	phase11_tests "$ROOT" ./modules/conga TestListenPickupLatency TestDispatchTransactional \
+		TestOutcomeComplete TestOutcomeFailFinalAttemptOnly TestOutcomePanicBecomesError TestOutcomeSkipIsCompleteWithMetadata \
+		TestCancelQueuedNeverRuns TestCancelRunningCancelsCtx TestStopJobFromWorker TestManagerPHPSemantics \
+		TestQueueClear TestQueueWork TestScheduleNext TestScheduleEntries TestScheduleRunsCommand TestScheduleRunOnce \
+		TestScheduledEntryMismatchSkipped TestScheduleUniqueByPeriod TestScheduleRunForeground TestScheduleValidation \
+		TestScheduleOrdering TestScheduleMissingCatalog TestScheduleLogWriter TestScheduleDueAt
+	phase11_tests "$ROOT" ./modules/bonfire TestCall TestCallEdges
+	phase11_tests "$ROOT" ./modules/lagoon TestOnDatabaseAfterActivate TestQueueMigrationsUpDown TestTransactionAfterCommit
+	phase11_tests "$ROOT" ./modules/lighthouse TestBroadcastTx TestSuppression TestBulkEmitsOnce TestBroadcastEdges \
+		TestBroadcastSwallowedReadFailure TestMountSurfaces TestChannelIDMatchesPHP TestParseChannel TestRegistry
+	phase11_tests "$ROOT" ./modules/lighthouse/centrifugo TestTokenClaims TestTokenHandler TestClientRequests TestProxy TestHealthCommand
+	phase11_tests "$ROOT" ./modules/beachcomber TestSyncGates TestSyncAfterCommit TestSyncDeleteAndSoftDelete TestSyncFailuresNonFatal
+	phase11_tests "$ROOT" ./modules/beachcomber/typesense TestEngineWire TestSyncEngineRegistration
+	phase11_tests "$ROOT" ./modules/flare TestRFC8291AppendixA TestVAPIDHeader TestSendAllowlist TestSendStatuses
+	phase11_tests "$ROOT" ./modules/tide TestCentrifugoRecorder TestNormalizePublications TestDiffPublications
+	phase11_tests "$APP" ./plugins/golem15/fonoteka TestWsAuthorizer TestAlbumBroadcastBinding TestAlbumSearchable \
+		TestFonotekaScheduleSkipsUnregisteredPrune TestRealtimeSubscribeProxy TestAlbumBroadcastSmoke TestAlbumSearchSmoke
+	PHASE11_REQUIRE="TestBroadcastGoldens TestBroadcastGoldens/deleted TestBroadcastGoldens/bulk" \
+		PHASE11_EXPECT_SKIP="$GOLDEN_SKIPS" PHASE11_SKIP_TEXT="$GOLDEN_SKIP_TEXT" \
+		phase11_go "$APP" ./parity -run '^TestBroadcastGoldens$'
+	echo "phase11 named passed"
+}
+
+run_evidence() {
+	[[ -f "$REVIEW" && -f "$VALIDATION" ]] || {
+		echo "refuse: security review or validation file is missing" >&2
+		exit 1
+	}
+	python3 - "$REVIEW" "$VALIDATION" "$PHASE_DIR" <<'PY'
+import glob, os, re, sys
+review = open(sys.argv[1]).read()
+validation = open(sys.argv[2]).read()
+declared = {}
+for plan in sorted(glob.glob(os.path.join(sys.argv[3], "11-0*-PLAN.md"))):
+    for line in open(plan):
+        m = re.match(r"^\| (T-11-(?:\d\d|SC)) \|", line)
+        if m:
+            cells = [c.strip().lower() for c in line.strip().strip("|").split("|")]
+            declared.setdefault(m.group(1), cells)
+if "T-11-SC" not in declared:
+    print("refuse: no plan declares T-11-SC", file=sys.stderr)
+    sys.exit(1)
+lines = review.splitlines()
+removal = [l for l in lines if re.match(r"^\| RC-\d+ \| T-11-", l)]
+for tid, cells in sorted(declared.items()):
+    rows = [l for l in lines if l.startswith("| " + tid + " |")]
+    if len(rows) != 1:
+        print(f"refuse: review has {len(rows)} threat rows for {tid}, want 1", file=sys.stderr)
+        sys.exit(1)
+    row = [c.strip().lower() for c in rows[0].strip().strip("|").split("|")]
+    severity, disposition = cells[3], cells[4]
+    if severity not in row or disposition not in row:
+        print(f"refuse: review row {tid} does not copy severity {severity!r} and disposition {disposition!r}", file=sys.stderr)
+        sys.exit(1)
+    if severity == "high" and disposition == "mitigate":
+        if not re.search(r"Test[A-Z][A-Za-z0-9]+|check-phase11\.sh", rows[0]):
+            print(f"refuse: high threat {tid} names no failing-when-broken test or gate stage", file=sys.stderr)
+            sys.exit(1)
+        if not any(re.match(r"^\| RC-\d+ \| " + re.escape(tid) + r" \|", l) for l in removal):
+            print(f"refuse: high threat {tid} has no removal check row", file=sys.stderr)
+            sys.exit(1)
+if not re.search(r"^nyquist_compliant: true$", validation, re.M):
+    print("refuse: validation is not nyquist_compliant", file=sys.stderr)
+    sys.exit(1)
+if not re.search(r"^status: validated$", validation, re.M):
+    print("refuse: validation status is not validated", file=sys.stderr)
+    sys.exit(1)
+for line in validation.splitlines():
+    if line.startswith("|") and ("pending" in line.lower() or "| TBD |" in line):
+        print("refuse: validation row still pending: " + line, file=sys.stderr)
+        sys.exit(1)
+for req in ["JOBS-01", "CLI-04", "CLI-06", "RT-01", "RT-02", "RT-03", "SRCH-01"]:
+    if req not in validation:
+        print(f"refuse: validation does not name {req}", file=sys.stderr)
+        sys.exit(1)
+print("phase11 evidence passed")
+PY
+}
+
+case "${1:-}" in
+--self-test) run_self_test ;;
+--hygiene) run_hygiene ;;
+--go) run_go ;;
+--postgres) run_postgres ;;
+--named) run_named ;;
+--evidence) run_evidence ;;
+--removal) run_removal ;;
+--all)
+	run_self_test
+	run_hygiene
+	run_go
+	run_postgres
+	run_named
+	run_evidence
+	echo "phase11 all passed"
+	;;
+*) usage ;;
+esac