protocol-check: template furniture is read as populated data rows, so the template fails its own anchor gate

[cloudronin]

Importing a workbook derived from packs/vv40/templates/vv40-template.xlsx reports:

✗ anchor non-empty per populated row  2 row(s) unanchored:
      Assessment Summary row 6; Decision row 4

Neither row is encoder content:

• Assessment Summary row 6 is the sheet's legend — Legend: | Required (Minimal) | Required (Complete) | Optional.
• Decision row 4 is a stray cross-sheet formula, ='Assessment Summary'!….

Both sit below their sheet's single data row (row 3). The checker reads them as populated rows and raises an anchor obligation against text the encoder never wrote and cannot sensibly anchor.

Why it matters beyond the noise

An encoder who does everything right still gets a red gate, and the only way to clear it is to delete parts of the template — which looks like tampering with the supplied artifact. The likely responses are all bad: clear it and not say so, anchor the legend to some arbitrary passage, or stop trusting the gate.

Same family as #93 and #96

All three are the template putting non-data content in rows the tooling treats as data:

• import: the pack's own untouched template produces a package asserting outcome="Accepted" #93 — the Decision hint row normalises to outcome = "Accepted", with a zero exit.
• protocol-check's placeholder scan is blind at the template hint row: the one row where hint text actually leaks #96 — the placeholder scan is blind at the hint row.
• this — the legend and a formula row fail the anchor gate.

The shared root is that neither the importer nor the checker knows which rows a sheet's records occupy. excel_constants already encodes HEADER_ROW / DATA_START_ROW / FACTOR_START_ROW, but the single-record sheets (Assessment Summary, Decision) are laid out one row higher than the constants describe, and nothing states where their records end.

Suggested direction: give the single-record sheets an explicit data-row extent, and have both the importer and the checker read only that. Anything outside it is furniture by definition, which would close all three at once.

Context

Found while building Credenza against the published wheel. Credenza clears the furniture before importing — which A-6 arguably requires of an encoder anyway — so it is not blocked, and --protocol-check then passes clean on all eight gates.

Found against v0.12.0.