Handoff: record overfit-handler boundary (taint/comparison/type still handler-side)

ober

e9cd05701139a219818aae93b26b5e2e6625d2cb

diff --git a/HANDOFF_OPUS_4_8.md b/HANDOFF_OPUS_4_8.md
index 35311fc..22a7bdc 100644
--- a/HANDOFF_OPUS_4_8.md
+++ b/HANDOFF_OPUS_4_8.md
@@ -151,6 +151,18 @@ languages, so closing them is the tip of the larger work:
    - **C / C++** (cpp 23 fixtures) — handled via `c-like-language?` (reachability
      filter etc.); migrating loses that the way Dart lost dead-catch. Hardest.
 
+   **Overfit-handler boundary (measured).** The per-language
+   `scan-{lang}-patterns-rule` / `scan-{lang}-taint-rule` handlers still fire and
+   still carry real work. With java's handlers disabled, only 16/42 java fixtures
+   pass via pure structural; the other 26 need the handlers and are almost all
+   taint (`taint_*`), metavariable-comparison (`metavar_comparison_*`), or
+   type-resolution (`metavar_type_*`, `metavariable_name_resolution`) cases. So
+   `wrapper-root-type?` made *pattern* matching real, but taint /
+   metavariable-comparison / type-resolution remain handler-side. Removing the
+   overfit handlers (and finishing dart/c/cpp) means porting those three feature
+   families onto the structural path — the substantial, well-scoped next project.
+   The same gap blocked the dart taint smoke cases.
+
    The original concern below (regex matcher limitations) still applies only to
    the languages still on `generic-language?`: `generic-language?`
    (scan.ss ~809) and use the regex-based `scan-generic-pattern`. That matcher