mod: Ext 5 — policy rule-set lint (unreachable/catch-all/dups), 190/190

Static analysis of a policy without running the engine: mod/unreachable-rules
flags rules after an unconditional rule (dead under first-match precedence),
mod/has-catchall? checks total coverage, mod/duplicate-rule-names + mod/rules-ok?
give a well-formedness verdict policy authors can assert. Own suite. +14 tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/mod-on-sx.md

@@ -16,7 +16,7 @@ federation extension.
 
 ## Status (rolling)
 
-`bash lib/mod/conformance.sh` → **176/176** (roadmap + 4 extensions complete)
+`bash lib/mod/conformance.sh` → **190/190** (roadmap + 5 extensions complete)
 
 ## Ground rules
 
@@ -147,6 +147,11 @@ lib/mod/fed.sx
   derivation goal-by-goal with `[proved]`/`[unproved]` marks and unification
   bindings. E.g. `Report rc: escalate (rule: repeated-escalate)` … `[proved]
   report(rc, B, S), report_count(S, N), N >= 3  {B=ann, N=3, S=dave}`.
+- [x] **Ext 5 — policy lint** (`lib/mod/lint.sx`, +14). Static analysis of a rule
+  set: `mod/unreachable-rules` flags rules placed after an unconditional (always-
+  matching) rule — structurally dead under first-match precedence;
+  `mod/has-catchall?` checks every report gets a decision; `mod/duplicate-rule-names`
+  + `mod/rules-ok?` give a one-call well-formedness verdict. No engine run needed.
 - [x] **Ext 4 — report linking / dedup** (`lib/mod/link.sx`, +12). `mod/related-ids`
   and `mod/reporters-of` find reports about a subject via a Prolog relational query
   (`report(Id, _, 'subject')`) — the policy substrate reused for retrieval.
@@ -155,6 +160,10 @@ lib/mod/fed.sx
 
 ## Progress log
 
+- **Ext 5 — policy lint, 190/190** (+14). Static analysis of the rule set itself,
+  catching the failure modes first-match precedence makes easy: dead rules after a
+  catch-all, missing catch-all (undecided reports), duplicate names. `mod/rules-ok?`
+  is a single well-formedness gate a policy author can assert in their own tests.
 - **Ext 4 — report linking / dedup, 176/176** (+12). Relational retrieval
   (`related-ids`, `reporters-of`) reuses the Prolog substrate for *querying* report
   clusters, not just deciding them — `report(Id, _, 'subject')` by unification.