Advisory-versus-authoritative guardrail design

A four-entry frozenset decides which of the LLM critic's blockers survive

Measured five times on the same plan, one safety critic returned five different verdicts and still never approved a seeded defect. It holds because the code downstream never reads the model's severity label.