- Add repo.record_blocklist(): grow-only, never auto-removes (mirrors router cumulative model; preserves entries that leave the NPM log window). - scan.py uses it on the scan path and derives the report's complete set from the ledger (_db_complete_blocklist), falling back to git history only if the DB is unavailable.