How a re-check is born
You confirm a finding. Re-checks mints a standing check from it (the same surface, the same selector, the same assertion) and from then on runs it with the rest of the suite. The moment a bug you already fixed comes back, it files a ship-blocker.
Green on arrival proves nothing
A check that has never failed might be watching the wrong thing. It might have a typo in its selector and pass forever by matching nothing. So a re-check is not counted as protection until it has been observed going red against the unfixed page.
This is the same rule the project applies to its own test suite, and it is the reason the console has a state called Nothing guards against a repeat rather than just a green tick.
Running it
node cli.cjs guard # the whole suite
node cli.cjs contracts list # the individual checks
node cli.cjs contracts new <findingId>
node cli.cjs contracts run <id>guard is the suite; contracts is the storage layer under it, for
when you want to mint, run or drop one at a time.
Free, and deterministic
No model calls. A re-check either reproduces or it does not, and that answer is the same every time, which is what lets it sit in CI without a bill or a flake.