PATCHLOOP
A model may propose a cure.
It may never certify its own.
An exploit lands on a live service. A model writes the repair. A verifier it cannot influence decides whether it ships.
Exploit → Repair → Verify → Ship or reject
Runs live, in about seven seconds. Fake canary only.