@@ -102,7 +102,7 @@ The current source-built CLI's `codeguard grammar status --format=json` reports
 
 In a source build with `--features wasm-precheck`, `codeguard grammar probe <language> <file> --format=json` can explicitly run any of the 32 pinned candidates in an isolated worker. It always exits 3 with `status=incomplete`, `native.status=not_run`, and `delivery_decision=not_evaluated`; a completed parse also has `precheck.status=incomplete`. Input or worker failures use the same [closed JSON schema](schemas/grammar-probe-v0.1.schema.json). Recovery anchors are suspected observations only. This diagnostic command does not yet connect all grammars to native-first `lint/check` or to the published npm package.
 
-The same source build now runs a bounded candidate pass from `codeguard check all . --format=json` after existing native checks. Its `syntax_candidates` field in [check feedback 0.32.0](schemas/check-feedback.schema.json) distinguishes TSX, JavaScript, CFScript and explicitly embedded CFQuery, preserving native blockers and skipped work. Four bounded integration fixtures collectively invoked all 32 pinned grammars through this command. Every observation remains unqualified and the command exits 3; 64 files/64 fragments/90 seconds bound the candidate pass. This is not yet a language-qualified native fallback or part of published npm `0.1.2`. See [acceptance evidence](tests/acceptance/check-all-32-grammar-candidates.md).
+The same source build now runs a bounded candidate pass from `codeguard check all . --format=json` after existing native checks. Its `syntax_candidates` field in [check feedback 0.33.0](schemas/check-feedback.schema.json) distinguishes TSX, JavaScript, CFScript and explicitly embedded CFQuery, preserving native blockers and skipped work. Python files covered by a completed Ruff scan of identical source bytes skip duplicate WASM and count under `native_preferred_count`; files without matching native syntax evidence retain candidate prechecks. Four bounded integration fixtures collectively invoked all 32 pinned grammars through this command. Every observation remains unqualified and the command exits 3; 64 files/64 fragments/90 seconds bound the candidate pass. This is not yet a language-qualified native fallback or part of published npm `0.1.2`. See [acceptance evidence](tests/acceptance/check-all-32-grammar-candidates.md).
 
 The source-built Unix CLI also has a narrow Zig route: `codeguard lint zig FILE --zig-tool /absolute/path/to/zig --format=json`. An explicitly supplied tool reporting Zig 0.16.0 and retaining the same byte digest runs native `ast-check` first; its source positions are retained without exposing source snippets. Without an explicit tool, the pinned Zig WASM provides an unqualified observation. Both paths remain incomplete because `ast-check` covers only local AST errors, not full lint, build or tests. See the [Zig feedback schema](schemas/zig-lint-feedback-v0.1.schema.json).
 
 
@@ -102,7 +102,7 @@ cargo build --locked -p codeguard-cli
 
 源码以 `--features wasm-precheck` 构建后，可显式运行 `codeguard grammar probe <language> <file> --format=json`，由隔离 worker 调用 32 份固定候选中的任意一份。命令始终以退出码 3 返回，并标记 `status=incomplete`、`native.status=not_run`、`delivery_decision=not_evaluated`；解析完成时还标记 `precheck.status=incomplete`。输入或 worker 失败也遵守同一份[封闭 JSON Schema](schemas/grammar-probe-v0.1.schema.json)。恢复锚点只是疑似观察。此诊断入口尚未把全部语种接入原生优先的 `lint/check`，也尚未进入已发布 npm 包。
 
-同一源码构建现在会在既有原生检查之后，从 `codeguard check all . --format=json` 执行有界候选初检。[检查反馈 0.32.0](schemas/check-feedback.schema.json)中的 `syntax_candidates` 区分 TSX、JavaScript、CFScript 和明确嵌入的 CFQuery，同时保留原生阻塞与未执行范围。四个有界集成样例经此入口合计调用了 32 种固定 grammar。观察仍未验收，命令保持退出码 3；候选阶段限 64 文件、64 片段、90 秒。这尚非逐语言验收的原生兜底，也未进入已发布 npm `0.1.2`；见[验收记录](tests/acceptance/check-all-32-grammar-candidates.md)。
+同一源码构建现在会在既有原生检查之后，从 `codeguard check all . --format=json` 执行有界候选初检。[检查反馈 0.33.0](schemas/check-feedback.schema.json)中的 `syntax_candidates` 区分 TSX、JavaScript、CFScript 和明确嵌入的 CFQuery，同时保留原生阻塞与未执行范围。Ruff 已对相同源码完成原生扫描的 Python 文件跳过重复 WASM，并计入 `native_preferred_count`；其余未确认语法能力的文件仍运行候选初检。四个有界集成样例经此入口合计调用了 32 种固定 grammar。观察仍未验收，命令保持退出码 3；候选阶段限 64 文件、64 片段、90 秒。这尚非逐语言验收的原生兜底，也未进入已发布 npm `0.1.2`；见[验收记录](tests/acceptance/check-all-32-grammar-candidates.md)。
 
 源码构建的 Unix CLI 还提供局部 Zig 入口：`codeguard lint zig FILE --zig-tool /absolute/path/to/zig --format=json`。显式提供且报告 Zig 0.16.0、执行前后字节摘要一致的工具优先运行原生 `ast-check`，仅输出诊断位置，不回显源码；未显式提供工具时，固定 Zig WASM 给出未验收候选观察。两条路径都保持未完成，因为 `ast-check` 仅覆盖局部 AST 错误，不等于完整 lint、构建或测试。见 [Zig 报告 Schema](schemas/zig-lint-feedback-v0.1.schema.json)。
 
 
@@ -1455,6 +1455,7 @@ pub fn run(args: &[String]) -> ExitCode {
     let syntax_candidates = crate::check_syntax_candidates::observe(
         &root,
         &discovery,
+        &python_lint,
         parsed.selection == Selection::Java,
         deadline,
         if request_cancelled {
@@ -1470,11 +1471,11 @@ pub fn run(args: &[String]) -> ExitCode {
         "status":"not_run","reason":"binary_without_wasm_precheck","execution_phase":"after_native",
         "authority":"candidate_unqualified","delivery_decision":"incomplete",
         "source_file_count":discovery.languages.values().map(|item| item.source_files.len()).sum::<usize>(),
-        "skipped_count":0,"unrouted_count":0,"observations":[],
+        "skipped_count":0,"unrouted_count":0,"native_preferred_count":0,"observations":[],
         "next_action":"使用包含固定语法资产的发行包运行候选初检，并完成适用原生检查"
     });
     let report = json!({
-        "schema_version":"0.32.0", "report_type":"check_feedback",
+        "schema_version":"0.33.0", "report_type":"check_feedback",
         "operation":"check", "selection":parsed.selection.as_str(), "command_status":if request_cancelled { "cancelled" } else { "incomplete" },
         "exit_code":if request_cancelled { 130 } else { 3 }, "delivery_decision":if parsed.selection == Selection::All { "incomplete" } else { "not_evaluated" }, "authority":"local_unverified",
         "reason":if request_cancelled { "request_cancelled" } else if parsed.selection == Selection::All { "full_project_obligations_and_trusted_policy_unavailable" } else { "java_selection_obligations_and_trusted_policy_unavailable" },
@@ -1854,10 +1855,17 @@ pub fn run(args: &[String]) -> ExitCode {
         }
         if let Some(observations) = report["syntax_candidates"]["observations"].as_array() {
             if report["syntax_candidates"]["status"] == "not_run" {
-                println!(
-                    "候选语法初检未运行：{}；仍需适用原生检查。",
-                    report["syntax_candidates"]["reason"]
-                );
+                if report["syntax_candidates"]["reason"] == "native_preferred" {
+                    println!(
+                        "候选语法初检未运行：{} 个文件已由本轮原生工具检查；其余交付义务仍待核验。",
+                        report["syntax_candidates"]["native_preferred_count"]
+                    );
+                } else {
+                    println!(
+                        "候选语法初检未运行：{}；仍需适用原生检查。",
+                        report["syntax_candidates"]["reason"]
+                    );
+                }
             } else {
                 let suspected = observations
                     .iter()
@@ -1868,12 +1876,13 @@ pub fn run(args: &[String]) -> ExitCode {
                     })
                     .count();
                 println!(
-                    "候选语法初检：{} 个片段已观察，{} 个存在待原生确认的恢复节点，{} 个范围未执行；仍未完成完整检查。",
+                    "候选语法初检：{} 个片段已观察，{} 个存在待原生确认的恢复节点，{} 个文件由原生检查覆盖，{} 个范围未执行；仍未完成完整检查。",
                     observations
                         .iter()
                         .filter(|item| item["status"] == "candidate_observed")
                         .count(),
                     suspected,
+                    report["syntax_candidates"]["native_preferred_count"],
                     report["syntax_candidates"]["skipped_count"]
                 );
                 for item in observations
 
@@ -5,6 +5,7 @@ use crate::grammar_probe_command::read_plain_source;
 use crate::grammar_route::route_source;
 use crate::syntax_worker_runner::run_syntax_worker_candidate;
 use serde_json::{Value, json};
+use sha2::{Digest, Sha256};
 use std::collections::BTreeSet;
 use std::path::Path;
 use std::sync::atomic::AtomicBool;
@@ -19,6 +20,7 @@ const MAX_VISIBLE_RECOVERIES: usize = 8;
 pub fn observe(
     root: &Path,
     discovery: &DiscoveryReport,
+    python_lint: &Value,
     java_only: bool,
     deadline: Instant,
     skip_reason: Option<&str>,
@@ -33,13 +35,15 @@ pub fn observe(
     let mut observations = Vec::new();
     let mut skipped_count = 0;
     let mut unrouted_count = 0;
+    let mut native_preferred_count = 0;
     if let Some(reason) = skip_reason {
         return report(
             "not_run",
             reason,
             source_file_count,
             source_file_count,
             0,
+            0,
             observations,
         );
     }
@@ -52,6 +56,7 @@ pub fn observe(
                 source_file_count,
                 source_file_count,
                 0,
+                0,
                 observations,
             );
         }
@@ -78,6 +83,10 @@ pub fn observe(
                 continue;
             }
         };
+        if native_python_covers(python_lint, relative, &source) {
+            native_preferred_count += 1;
+            continue;
+        }
         let routes = route_source(relative, &source);
         if routes.is_empty() {
             unrouted_count += 1;
@@ -146,6 +155,8 @@ pub fn observe(
         "unrouted_source"
     } else if !observed && !observations.is_empty() {
         "candidate_unavailable"
+    } else if native_preferred_count > 0 && observations.is_empty() {
+        "native_preferred"
     } else {
         "candidate_unqualified"
     };
@@ -155,23 +166,71 @@ pub fn observe(
         source_file_count,
         skipped_count,
         unrouted_count,
+        native_preferred_count,
         observations,
     )
 }
 
+// 仅本轮 Ruff 已完整扫描同一份 Python 字节时跳过重复解析；配置发现不算执行。
+fn native_python_covers(python_lint: &Value, relative: &str, source: &[u8]) -> bool {
+    if !relative.ends_with(".py") {
+        return false;
+    }
+    let digest = format!("{:x}", Sha256::digest(source));
+    python_lint["files"].as_array().is_some_and(|files| {
+        files.iter().any(|file| {
+            file["path"] == relative
+                && matches!(
+                    file["run_status"].as_str(),
+                    Some("passed" | "findings" | "suppressed")
+                )
+                && file["source_sha256"] == digest
+                && file["tool_sha256"].as_str().is_some()
+                && file["config_sha256"].as_str().is_some()
+        })
+    })
+}
+
 fn report(
     status: &str,
     reason: &str,
     source_file_count: usize,
     skipped_count: usize,
     unrouted_count: usize,
+    native_preferred_count: usize,
     observations: Vec<Value>,
 ) -> Value {
     json!({
         "status":status,"reason":reason,"execution_phase":"after_native",
         "authority":"candidate_unqualified","delivery_decision":"incomplete",
         "source_file_count":source_file_count,"skipped_count":skipped_count,
-        "unrouted_count":unrouted_count,"observations":observations,
+        "unrouted_count":unrouted_count,"native_preferred_count":native_preferred_count,"observations":observations,
         "next_action":"核对适用语言版本与原生 lint/编译器；候选恢复节点不是已确认违规，零恢复也不表示完整通过"
     })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::native_python_covers;
+    use serde_json::json;
+    use sha2::{Digest, Sha256};
+
+    #[test]
+    fn only_completed_matching_native_python_scan_preempts_candidate() {
+        let source = b"import os\n";
+        let digest = format!("{:x}", Sha256::digest(source));
+        for status in ["passed", "findings", "suppressed"] {
+            let native = json!({"files":[{"path":"app.py","run_status":status,
+                "source_sha256":digest,"tool_sha256":"tool","config_sha256":"config"}]});
+            assert!(native_python_covers(&native, "app.py", source));
+            assert!(!native_python_covers(&native, "other.py", source));
+            assert!(!native_python_covers(&native, "app.rs", source));
+            assert!(!native_python_covers(&native, "app.py", b"changed\n"));
+        }
+        for status in ["incomplete", "not_run"] {
+            let native = json!({"files":[{"path":"app.py","run_status":status,
+                "source_sha256":digest,"tool_sha256":"tool","config_sha256":"config"}]});
+            assert!(!native_python_covers(&native, "app.py", source));
+        }
+    }
+}
@@ -72,7 +72,7 @@ fn main() -> ExitCode {
             );
             #[cfg(all(feature = "wasm-precheck", unix))]
             println!(
-                "check all 会在原生节点之后按源码方言有界执行 32 份固定 WASM 的候选初检；check_feedback 0.32.0 的 syntax_candidates 保留疑似位置和未执行范围，始终不能代替原生义务或放行交付。"
+                "check all 会在原生节点之后按源码方言有界执行 32 份固定 WASM 的候选初检；check_feedback 0.33.0 的 syntax_candidates 保留疑似位置、原生优先计数和未执行范围，始终不能代替原生义务或放行交付。"
             );
             #[cfg(all(feature = "wasm-precheck", unix))]
             println!(
 
@@ -4,6 +4,61 @@ use std::collections::BTreeSet;
 use std::fs;
 use std::process::Command;
 
+#[test]
+fn completed_native_ruff_preempts_only_its_matching_python_file() {
+    use std::os::unix::fs::PermissionsExt;
+    let root = std::env::temp_dir()
+        .canonicalize()
+        .unwrap()
+        .join(format!("codeguard-native-preferred-{}", std::process::id()));
+    fs::create_dir_all(&root).unwrap();
+    fs::write(root.join("app.py"), "import os\n").unwrap();
+    fs::write(root.join("main.zig"), "const Empty = struct {};\n").unwrap();
+    fs::write(root.join("ruff.toml"), "[lint]\nselect = ['F401']\n").unwrap();
+    let tool = root.join("fake-ruff");
+    fs::write(&tool, "#!/bin/sh\nif [ \"$1\" = '--version' ]; then echo 'ruff 0.16.8'; exit 0; fi\nif [ \"$2\" = '--show-files' ]; then echo \"$3\"; exit 0; fi\nif [ \"$2\" = '--show-settings' ]; then printf 'linter.rules.enabled = [\\n\\tunused-import (F401),\\n]\\nlinter.per_file_ignores = {}\\n'; exit 0; fi\nif [ \"$2\" = '--no-cache' ]; then if [ \"$3\" = '--ignore-noqa' ]; then source=$6; else source=$5; fi; printf '[{\"code\":\"F401\",\"message\":\"unused\",\"filename\":\"%s\",\"location\":{\"row\":1,\"column\":1},\"severity\":\"error\"}]\\n' \"$source\"; exit 1; fi\nexit 2\n").unwrap();
+    fs::set_permissions(&tool, fs::Permissions::from_mode(0o700)).unwrap();
+    let output = Command::new(env!("CARGO_BIN_EXE_codeguard"))
+        .args(["check", "all"])
+        .arg(&root)
+        .args([
+            "--ruff-tool",
+            tool.to_str().unwrap(),
+            "--format=json",
+            "--timeout",
+            "40s",
+        ])
+        .output()
+        .unwrap();
+    fs::remove_dir_all(&root).unwrap();
+    assert_eq!(
+        output.status.code(),
+        Some(3),
+        "{}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    let report: serde_json::Value = serde_json::from_slice(&output.stdout).unwrap();
+    assert_eq!(
+        report["native_results"]["python_lint"]["files"][0]["run_status"], "findings",
+        "{report}"
+    );
+    assert_eq!(
+        report["native_results"]["python_lint"]["files"][0]["findings"][0]["rule_id"],
+        "F401"
+    );
+    assert_eq!(report["syntax_candidates"]["native_preferred_count"], 1);
+    let observations = report["syntax_candidates"]["observations"]
+        .as_array()
+        .unwrap();
+    assert!(!observations.iter().any(|row| row["path"] == "app.py"));
+    assert!(
+        observations
+            .iter()
+            .any(|row| row["path"] == "main.zig" && row["status"] == "candidate_observed")
+    );
+    assert_eq!(report["delivery_decision"], "incomplete");
+}
+
 #[test]
 fn check_all_routes_distinct_dialects_after_native_without_claiming_clean() {
     let root = std::env::temp_dir()
@@ -37,7 +92,7 @@ fn check_all_routes_distinct_dialects_after_native_without_claiming_clean() {
         String::from_utf8_lossy(&output.stderr)
     );
     let report: serde_json::Value = serde_json::from_slice(&output.stdout).unwrap();
-    assert_eq!(report["schema_version"], "0.32.0");
+    assert_eq!(report["schema_version"], "0.33.0");
     assert_eq!(report["delivery_decision"], "incomplete");
     let observations = report["syntax_candidates"]["observations"]
         .as_array()
 
@@ -219,7 +219,7 @@ fn missing_p3c_configuration_is_reported_without_running_maven() {
     fs::set_permissions(&tool, fs::Permissions::from_mode(0o700)).unwrap();
     let report = project.check(&["--maven-tool", tool.to_str().unwrap()]);
     assert!(!marker.exists());
-    assert_eq!(report["schema_version"], "0.32.0");
+    assert_eq!(report["schema_version"], "0.33.0");
     assert_eq!(report["execution_tasks"][0]["id"], "java.p3c");
     assert_eq!(report["execution_tasks"][0]["status"], "native_incomplete");
     let java = &report["native_results"]["java_p3c"];
 
@@ -411,7 +411,7 @@ fn real_npm_audit_enters_check_all_workbench() {
         String::from_utf8_lossy(&out.stderr)
     );
     let report: Value = serde_json::from_slice(&out.stdout).unwrap();
-    assert_eq!(report["schema_version"], "0.32.0");
+    assert_eq!(report["schema_version"], "0.33.0");
     assert_eq!(
         report["native_results"]["npm_cve"][0]["feedback"]["local_coherent"], true,
         "{report}"