Banked: 2026-07-15, cycle359 (go-getter HCSEC-2026-04 = WALK, wrong class).
After finding consul-template's symlink-write incomplete-fix (lstat+O_NOFOLLOW vs os.Root, cycle358), I hypothesized a SYSTEMIC HashiCorp pattern: the same team making the same partial-symlink-fix mistake across tools. I checked go-getter (HCSEC-2026-04) expecting the same class. Gate-0 (a cheap advisory read, no clone) killed it: go-getter's bug is git-ARGUMENT-INJECTION (malicious URL injects extra git args during HEAD-check -> arbitrary read), NOT symlink-follow. Different class, no shared root. The "same vendor shipped several path-ish advisories" surface is NOT a systemic vein when the underlying bug CLASSES differ.
A "systemic incomplete-fix vein" (cycle241-254 multi-fix vein) requires a SHARED ROOT CAUSE / shared code-pattern (e.g. the same lstat+O_NOFOLLOW symlink-write idiom across tools), not just the same vendor + similar-sounding advisories. Before extending an incomplete-fix hypothesis from tool A to tool B, VERIFY B shares the exact vulnerable pattern (cheap: read the advisory's mechanism). Same-vendor + path-adjacent-topic is NOT enough - go-getter (arg-injection) and consul-template (symlink-follow) are unrelated despite both being "HashiCorp file/path 2026 CVEs." This is the sibling of the cycle324 lesson (port-lag needs shared CODE not just shared lineage): incomplete-fix veins need shared CLASS/PATTERN, not just shared vendor.