milestone 16: behavioral fixes for silent failures, locks, counters and the query log

specs/milestone-16.md

@@ -318,6 +318,14 @@ from the rotating log.
 - Add `.tls_server` to `isDedupScope` (logging.zig:103-108) and to its
   membership test (:637-644).
 
+**Scope widened during implementation (orchestrator ruling):** the level
+choice also applies to the `ssl_read` and `ssl_write` report sites, not only
+the two named ones. Ruling 15's "cause stashed for logging" wording requires
+the read site to consume the level, and an unconditional warn on the write
+half would keep the same spam vector open through `close` → `flush` against
+a dead peer. Peer-class causes are decided by pure helpers (`isPeerCause`,
+`causeLevel`); `check` still passes warn.
+
 ### 17. The query log heals its own gaps
 
 `web/src/features/queries/QueryLogPage.tsx`: the hand-rolled accumulation

specs/milestone-5.md

@@ -1675,7 +1675,9 @@ and the session text disagree, this section wins.
 **S1 parsers + wildcard.** `validate` counts labels before the 253-byte length check, so
 `TooManyLabels` is reachable. A hosts line with a sink address and no name is `.unsupported`.
 `||example.com` without `^` is `.wildcard` with `covers_apex = true`. `detectFormat` treats `$` as a
-marker only on non-comment lines; `||`, `@@` and element-hiding separators are matched anchored.
+marker only on non-comment lines; `||` and `@@` are matched anchored. Element-hiding separators are
+matched positionally since milestone 16 ruling 5: at offset 0 a selector must follow the separator;
+past offset 0 a domain-list character must precede it — so a `## Title` banner is not element hiding.
 `looksLikeIpLiteral` lives in `parsers.zig` and is shared with `parser_hosts.zig`.
 `wildcard.matches` is total on unvalidated input: the label splitter returns null above `max_labels`
 and `matches` returns false — no assert, because `parsers.zig` is the S9.3 fuzz root.