v0.18.3 — Flywheel honesty

An adversarial review of the self-evolution flywheel — the project's differentiator — found four ways the "measured, never self-reported" learning signal could be credited outside the honesty gates. All fixed and regression-tested; the flywheel's statistics (paired McNemar/Wilson, Newcombe anytime CIs, continuous-degradation CI, diff-gate, GEPA) reviewed clean — the bugs were all in the crediting, not the math.

Fixed

• Unverified fan-out no longer credits skill promotion. The hierarchy fan-out recorded a card "success" for any non-empty output (no verify-or-revert), and that success rate is the input to the auto promote/demote policy — a self-reported signal masquerading as measured. The fan-out now records only an advisory experience lesson; card telemetry comes only from verified paths.
• Hollow success no longer credits skill promotion. A hollow success (verifier passed, empty diff) was diff-gated out of minting a skill/memory, but still raised the retrieved cards' win rate. The card credit is now gated on the same diff verdict.
• Memory consolidation no longer launders taint. Merging a cluster wrote the summary as provenance="clean", erasing a tainted member's provenance. It now propagates the strongest provenance of the cluster.
• Transfer gate rejects an empty holdout. An empty (not just None) holdout fell through to a zero-task paired comparison and reported "generalizes, transfer measured" — a fail-open that disabled the negative-transfer guard. An empty holdout now takes the honest "not measured" path.

Gate: ruff + mypy clean, 1381 passed / 3 skipped. pip install -U chimera-agent