@event4u/agent-config 9.22.0 → 9.23.0

package/dist/agent-src/contexts/execution/mandated-lines.md

@@ -0,0 +1,180 @@
+# Mandated Lines — the forced artifact at the decision point
+
+Shared contract for the small closed set of **verbatim lines the run must emit
+at a decision point**, and for the pre-send sweep that catches an owed line that
+went missing. Routed from the rule that owns each decision point rather than
+restated in each.
+
+**Routing status, stated because a claimed edge that does not exist is worse
+than a missing one.** Two rules link here today:
+[`think-before-action`](../../rules/think-before-action.md) (the intent line)
+and [`downstream-changes`](../../rules/downstream-changes.md) (the sibling
+search). The authorization and commit lines belong to
+[`non-destructive-by-default`](../../rules/non-destructive-by-default.md) and
+[`commit-policy`](../../rules/commit-policy.md) — both **kernel** rules, whose
+edits require their own pull request and a 24-hour soak under
+[`scope-control`](../../rules/scope-control.md). Those two edges are therefore
+deliberately absent from this change rather than smuggled into it, and until
+they land those two lines are carried by this contract alone.
+
+## Why a line and not a rule
+
+An external source published the A/B of one obligation in three forms. Absent:
+**0 of 4** runs surfaced a planted contradiction. Added as mid-list prose:
+**1 of 4**, scoring *below* the no-instruction control. Converted into a
+mandated verbatim line the run must emit *before* the behaviour-changing edit,
+paired with a mechanical sweep for owed-but-missing lines: **4 of 4**. The rule
+text did not change. Only its form did.
+
+This suite has three recorded honest nulls on *reminder-shaped* interventions —
+a decay-triggered restate, a reminder-injection experiment measuring zero delta,
+a recursive-verification null. Those stand. This is a different mechanism: an
+artifact the run must **produce**, not a reminder it must **receive**, with an
+opposite measured result and its failing baseline published first. That is the
+mechanism-match test in [`decision-revisit-gate`](../../rules/decision-revisit-gate.md),
+passed rather than dodged.
+
+```
+A MANDATED LINE IS EMITTED AT THE DECISION POINT, BEFORE THE ACTION —
+NEVER AS A TRAILING CHECKLIST THAT PROVES THE ACTION HAPPENED.
+A LINE THAT IS OWED AND MISSING IS AN INCOMPLETE REPLY.
+A LINE THAT IS NOT OWED IS NOT EMITTED. SILENCE IS THE DEFAULT.
+```
+
+## The five lines
+
+Each is bound to a **decision point**, not to a topic. One sentence each.
+
+### 1. Intent — before a behaviour-changing edit
+
+Three slots: **what the code does · what the failing check expects · what the
+specification says.**
+
+> Intent: `parseDate` returns null on an empty string · the failing test expects
+> a thrown `RangeError` · the spec says empty input is a caller error.
+
+The load-bearing consequence, and the whole reason the line has three slots
+rather than one: **when the three disagree, the disagreement is the finding and
+the edit does not proceed.** A line that reads the same three ways is a line
+that was written after deciding.
+
+### 2. Authorization — before an irreversible outward action
+
+Carries **the user's own words**, quoted. Two denials are explicit:
+
+- **Documentation is not authorization.** A roadmap step, a command file, or a
+  prior turn's plan describing the action is not the user asking for it.
+- **Completing the task is not authorization.** Reaching the point where the
+  action would be natural is not permission to take it.
+
+> Authorization: "push it and open the PR" (this turn) — covers this push and
+> this PR, not the follow-up fix.
+
+Fires for the [`non-destructive-by-default`](../../rules/non-destructive-by-default.md)
+Hard-Floor set: push, deploy, prod-trunk merge, prod data or infra, bulk
+destructive, and any irreversible external action (send · publish · post ·
+purchase · submit).
+
+### 3. Commit — before a commit
+
+Three slots: **the authorization and its exact scope · that the staged set
+matches the intended edit · that nothing unintended is staged.**
+
+> Commit: authorized "commit this now" (this turn), scope = the parser fix ·
+> staged set is the 2 files that fix names · nothing else staged.
+
+This is the mandated-artifact form of an obligation
+[`commit-policy`](../../rules/commit-policy.md) already carries as prose, and it
+is the fifth line rather than a variant of the authorization line because its
+failure mode is different: the authorization line asks *may I*, the commit line
+asks *is what I am about to record what I meant to record*. A commit with a
+stray file is authorized and still wrong.
+
+### 4. Pending — when a prescribed follow-up was deliberately not taken
+
+> Pending: the negative test for the tenant path is not written — the fixture
+> needs a second tenant and I did not create one.
+
+Unlike the other four this line gates nothing. It is a **disclosure**
+obligation: it makes a deliberate skip visible to the human who reviews the
+work, and it exists because this suite's work lands through reviewed pull
+requests, so the line has a recipient. A skip nobody was told about is
+indistinguishable from a step that was forgotten.
+
+### 5. Sibling search — after a defect fix
+
+Names **the exact wrong construct searched for, and the count found.**
+
+> Sibling search: grepped `JSON.parse(` without a try — 3 sites, 2 fixed, 1 in
+> a test fixture and left.
+
+A defect found in one place is presumed to recur until searched. The count is
+part of the line because "I checked" is not a finding and zero is a real answer.
+
+## The pre-send sweep
+
+Before a reply that claims completion, check each line above against what the
+run **actually did**, and add any that is owed and missing.
+
+- Fire only when something is owed. A reply owing nothing passes untouched, and
+  no line is emitted to prove the sweep ran.
+- This is the same shape as the existing
+  [`roadmap-progress-sync`](../../rules/roadmap-progress-sync.md) and
+  [`no-cheap-questions`](../../rules/no-cheap-questions.md) pre-send checks — a
+  step in an existing sequence, not a new mechanism.
+- The sweep is a backstop for a line that should already have been emitted at
+  its decision point. A reply where every owed line first appears in the sweep
+  is a reply that took the actions before thinking about them, and the sweep
+  cannot repair that — it can only surface it.
+
+## Brevity — how these avoid becoming ceremony
+
+This suite's [`direct-answers`](../../rules/direct-answers.md) Iron Law 3 treats
+long replies as a failure mode, and its anti-ceremony discipline says not to
+invent receipts solely to prove execution. Five mandated lines are in real
+tension with both. Three constraints resolve it, and they are part of the
+contract:
+
+1. **One sentence per line.** A line that needs a paragraph is a line whose
+   decision was not made.
+2. **Emitted at the decision point, never as a trailing checklist.** The
+   measured 4-of-4 result came from a line emitted *before* the action. A
+   checklist at the end of a reply is the ceremony shape, and it also loses the
+   only property that made the mechanism work — that writing it can still stop
+   the action.
+3. **Two or more owed lines merge into one block, in execution order**, with
+   minimal labels — one interruption rather than five.
+
+```
+Intent (parser.ts): returns null on empty · test expects RangeError · spec says caller error
+Sibling search: grepped `JSON.parse(` without a try — 3 sites, 2 fixed, 1 test fixture left
+Commit: authorized "commit this" (this turn), scope = parser fix · 2 files staged · nothing else
+```
+
+## Honest scope — what this does not claim
+
+**Enforced by:** partially. `src/scripts/lint_mandated_lines.ts` is the
+deterministic half and it checks only what a **run report** can be checked for:
+a report claiming a behaviour change carries an intent line, and a report
+describing an outward action carries an authorization line. It cannot check that
+the line was emitted *before* the action rather than reconstructed after, and it
+cannot check that the three intent slots were honestly filled. Those are
+model-carried, and saying so here is cheaper than discovering it later.
+
+**The transfer risk, stated.** The 4-of-4 measurement came from one source on
+one task family — contradiction detection. This suite's work is largely
+construction, where there may be no planted contradiction to surface, and the
+mechanism could reduce to ceremony without anyone noticing.
+
+**The cheap observation that would detect it:** track how often an emitted
+intent line has its three slots **disagree**. If disagreements are effectively
+never found, the line is decorating decisions already made and the set should
+shrink. If disagreements are found and the edit is then revised or stopped, the
+mechanism is doing the thing it was adopted for. That observation costs one
+counter and is the first thing to look at before adding a sixth line.
+
+## See also
+
+- [`docs/contracts/settings-classes.md`](../../../docs/contracts/settings-classes.md) — a sibling contract in the same shape: prose that a gate reads.
+- [`verify-before-complete`](../../rules/verify-before-complete.md) — the evidence gate the pre-send sweep runs beside.
+- `src/scripts/lint_mandated_lines.ts` — the deterministic half.

package/dist/agent-src/rules/context-hygiene.md

@@ -56,6 +56,8 @@ When **3 consecutive attempts** at the same task fail (code fix, test fix, confi
 
 Calling the **same tool** more than **2 times in a row** with similar parameters = loop.
 **Immediate action:** 1. STOP all tool calls. 2. Do the task directly. 3. Can't proceed → ask the user.
+
+**"Similar parameters" is the load-bearing word — an enumerated set is not a loop.** Walking N *declared, distinct* targets (a downstream-caller sweep per [`downstream-changes`](downstream-changes.md), an override chain, the members of a grep result) is one operation whose parameters differ every call. Counting it as N repetitions makes `downstream-changes`' "find **ALL** callers, tests, imports" unsatisfiable — it cannot be done in two calls. The loop this detects is *repetition without new information*: same target, same parameters, hoping for a different answer. Mirrors the same carve-out in [`token-efficiency`](token-efficiency.md).
 `sequentialthinking` is especially prone to loops: at most **once** per task, NEVER for simple file operations, command execution, or straightforward edits.
 
 ## Read-Loop Detection — the 15 / 25 rule
@@ -72,6 +74,21 @@ EVERY TURN MUST EDIT, RUN, OR ASK.
 
 **25-min abort (5 read-only turns) — STOP and ask** with the abort block (template in the mechanics guideline). Non-bypassable: an autonomous mandate does **not** lift the abort — it is the safety net that protects autonomy from becoming a token sink.
 
+### Declared read protocol — the cap goes UP, never off
+
+A mandated analysis/audit/review protocol is exactly the case that legitimately needs *more* reads, not fewer — an 8-turn evidence sweep is the protocol working, not a loop. Capping a declared protocol tighter than an undeclared one is backwards. So:
+
+- **Undeclared reading keeps 3-warn / 5-abort.** Unchanged.
+- **A declared protocol raises the abort to 8 read-only turns** — and never suspends it. "Non-bypassable" narrows to **no *silent* bypass**: a declared protocol is not silent.
+
+A declaration is only valid when it states, before the reading starts, all three of:
+
+1. **the analysis goal**, falsifiably ("map every call chain that writes to the audit table" — not "understand the code");
+2. **the expected read count**;
+3. **the output shape** the reads feed (a table, an evidence report, a decision).
+
+Free-text intent is not a declaration — the three fields exist so that "declared protocol: I need to read things" cannot buy the higher cap. Exceeding the declared count by more than 2 is itself the violation: stop, surface what the extra reads were for, and ask.
+
 Body migrated to [`guideline:agent-infra/context-hygiene-mechanics`](../docs/guidelines/agent-infra/context-hygiene-mechanics.md) (per P4 of `road-to-kernel-and-router.md`) — the freshness-suggestion template, the read-loop self-check + abort block, the state-dump format + `/agent-handoff` pointer, the Augment ignored-skills recovery flow, and the Copilot no-hook fallback (manual `context_hygiene_hook` refresh).
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).
 

package/dist/agent-src/rules/downstream-changes.md

@@ -47,6 +47,32 @@ After editing any file, search for **all** of these:
 | **Routes** | Search `routes/` for controller references | Update after controller rename/move |
 | **Documentation** | Search `agents/`, `docs/`, `README`, examples for references | Update the doc that **describes** the changed surface — see Doc-Impact below |
 
+## Defect-pattern search — one instance is a sample, not the population
+
+```
+A DEFECT FOUND IN ONE PLACE IS PRESUMED TO RECUR UNTIL SEARCHED.
+NAME THE EXACT WRONG CONSTRUCT. SEARCH THE TREE. REPORT THE COUNT AND THE FILES.
+"I FIXED IT" WITHOUT A COUNT IS A FIX OF ONE INSTANCE, NOT OF THE DEFECT.
+```
+
+After fixing a defect, before claiming the fix is complete: write down the
+**exact wrong construct** — the literal pattern, not a description of it — grep
+the tree for it, and report **how many sites matched and which**. Zero is a real
+answer and is worth reporting; it is the difference between "this was unique"
+and "I did not look".
+
+The own-orphan sweep above greps identifiers your diff *stopped referencing*.
+This greps for the **defect itself**, which nothing else does — the two run over
+different sets and neither substitutes for the other.
+
+Emit the finding as the sibling-search mandated line
+([`mandated-lines`](../contexts/execution/mandated-lines.md) § 5), which is
+where its shape and the reason it carries a count are specified.
+
+**When NOT to fire:** the defect is in code the diff created this turn (there is
+no population to search), or the construct is one the language makes impossible
+to express twice.
+
 ## Doc-Impact — docs follow code (same change)
 
 ```

package/dist/agent-src/rules/think-before-action.md

@@ -45,6 +45,31 @@ NO BLIND TRIAL-AND-ERROR. MAX 2 RETRIES PER APPROACH.
 - Do NOT modify code you do not fully understand — read it, trace the flow, then change it.
 - Multiple valid frameworks/patterns coexist (Tailwind + Flux, multiple form libs, competing state stores) → do NOT pick one silently — ask. See [`no blind implementation`](../docs/guidelines/agent-infra/agent-interaction-and-decision-quality.md#2-no-blind-implementation).
 
+## The intent line, before a behaviour-changing edit
+
+Before an edit that changes behaviour, emit the **intent line**: what the code
+does · what the failing check expects · what the specification says. When the
+three disagree, the disagreement is the finding and the edit does not proceed.
+Shape, the other four mandated lines, and the pre-send sweep:
+[`mandated-lines`](../contexts/execution/mandated-lines.md).
+
+## Where the answer lives — and saying so when it lives nowhere
+
+Route by **where the answer actually is**: the code, a config, a live probe, a
+doc, the user. When the answer exists only in your own inference — nothing to
+open, nothing to run, nobody to ask — **say that**, in the report, in one clause.
+
+```
+AN INFERENCE DRESSED IN PROCESS IS INDISTINGUISHABLE FROM A LOOKUP.
+NAME THE DETOUR. A SILENT DETOUR READS AS A SKIPPED STEP.
+```
+
+This rule and its neighbours say *be rigorous* often enough that the costume
+version — narrating a thorough-sounding procedure over a guess — is a live risk
+here specifically. The cost of naming it is one clause; the cost of not naming
+it is that a reader cannot tell a verified fact from a confident one, which is
+the property the whole evidence discipline exists to protect.
+
 ## Mechanics — workflow, minimum read set, verify-with-real-tools, no blind retries
 
 The five-step Understand → Analyze → Plan → Implement → Verify workflow, the minimum read set (symbol, callers, tests, abstractions, data), the memory-consult step, the verification matrix, the output-reduction patterns, the no-blind-retries protocol, and the "open files are context, not intent" clause all live in [`contexts/communication/rules-auto/think-before-action-mechanics.md`](../contexts/communication/rules-auto/think-before-action-mechanics.md). The rule above is the obligation surface; the mechanics file is the lookup material.

package/dist/agent-src/rules/token-budget-discipline.md

@@ -28,7 +28,7 @@ TO THE FULL FRUGALITY CANON (telegraph-speak, thin-projector).
 |---|---|---|---|---|
 | `lean` | No explicit key = lean | Full condensation | May be trimmed | < 500 tokens |
 | `standard` | — | Balanced condensation | Not trimmed if priority ≥ 60 | 500–2000 tokens |
-| `rich` | Must be declared + justified | **Exempt** | **Never trimmed** | 2000–5000 tokens |
+| `rich` | Must be declared + justified | **Exempt** | **Never trimmed** | 2000–3500 tokens |
 
 Read `tokens.rich_skills` from `.agent-settings.yml` (default `on`) to determine
 whether rich skills may load in full. If `off`, treat them as
@@ -82,7 +82,7 @@ THE BUDGET LINE IS AN INPUT TO THE DECISION, NEVER THE DECISION ITSELF.
 The 15 % rich-skill cap, the lean/standard/rich size targets, and every
 telegraph-speak / thin-projector trim point are cost controls, not
 capability ceilings. When a proposed change is blocked *purely* because
-it would cross one of these lines — a skill needs more than 5000 tokens
+it would cross one of these lines — a skill needs more than 3500 tokens
 to stay useful, a rule's condensed form loses a worked example the
 frugality canon would otherwise trim — do not silently reject it.
 Surface the trade-off instead: the estimated token delta, and the
@@ -107,10 +107,53 @@ These skills are approved `rich` by this roadmap's council:
 | `accessibility-auditor` | WCAG criteria are non-negotiable detail; every criterion has a testable condition + failure mode; compression loses the test procedures |
 | `design-system-capture` (Phase 6) | Writes + maintains DESIGN.md + PRODUCT.md; needs full templates + worked examples to generate useful artifacts |
 
+## Rich artifacts lead with a non-negotiable band
+
+```
+A RICH-CLASS ARTIFACT OPENS WITH THE SECTION THAT OUTRANKS THE REST OF ITS
+OWN DOCUMENT, THEN THE REASONING LAYER.
+A LONG REFERENCE READ PARTIALLY MUST LOSE THE REASONING, NEVER THE OBLIGATION.
+```
+
+The `rich` exemption buys length, and length buys the risk that a reader stops
+early. Ordering is the mitigation available at authoring time: put the
+load-bearing fraction first, so a partial read loses the part that was
+explanation rather than the part that was binding.
+
+This is a **precedence claim inside one document**, not a claim over other
+artifacts — a rich skill's leading band outranks that skill's own later
+sections and nothing else. Cross-artifact precedence is the authority index's
+job.
+
+It mitigates partial reading. It does **not** answer whether the artifact should
+be shorter — that is the ceiling, gated below, and the two controls are
+independent: an artifact can sit comfortably under the ceiling and still bury
+its obligation on line 300.
+
+## The size band is measured, and only its ceiling is gated
+
+The `rich` band is **2,000–3,500 tokens** ([ADR-217](../docs/decisions/ADR-217-rich-class-band-measured-and-enforced.md)).
+It was 2,000–5,000 and enforced by nothing until that record: measured with the
+exact BPE tokenizer, the largest rich artifact in the tree is 3,331 tokens, so
+the old ceiling described no artifact that existed. An unused permission costs
+nothing until someone uses it.
+
+`lint_token_budget_discipline.ts` gates the **ceiling** and publishes every rich
+artifact's size on the green path. It does **not** gate the floor, and that is a
+finding rather than an omission: running the check once surfaced a 1,931-token
+skill legitimately holding the class, because `rich` buys exemption from
+condensation — a claim about what compression would *lose*, not about file size.
+The published study supplies a degradation threshold, which is a ceiling.
+Nothing measures a minimum.
+
+Measurement is exact where `js-tiktoken` resolves and the character proxy where
+it does not; the gate says which, and a proxy reading within its own error
+margin of the ceiling is reported **unresolved** rather than classified.
+
 ## Governed by
 
 - `tokens.rich_skills` setting in `.agent-settings.yml` (consumer override)
-- `lint_token_budget_discipline.ts` (cap + justification CI check)
+- `lint_token_budget_discipline.ts` (cap + justification + ceiling CI check)
 - the telegraph-speak rule, where enabled (amended to except rich-tagged skills)
 
 ## See also

package/dist/agent-src/rules/token-efficiency.md

@@ -26,6 +26,19 @@ NEVER CALL THE SAME TOOL >2 TIMES IN A ROW WITH SIMILAR PARAMETERS.
 IF YOU CATCH YOURSELF REPEATING → STOP, RETHINK, ASK.
 ```
 
+## Enumerated file sets are ONE operation, not N repetitions
+
+The same-tool ceiling counts *repetition without new information* — the loop where the agent re-runs a tool because it did not learn from the last result. Reading N **declared, enumerated** files is the opposite: each read returns different content and the set was known before the first call. Counting it as N repetitions puts this rule in direct conflict with [`downstream-changes`](downstream-changes.md) ("find **ALL** callers, tests, imports") and with [`source-discovery-gate`](source-discovery-gate.md), which cannot be satisfied in two calls.
+
+Exempt — the file set is enumerated **before** the first read and each read is a distinct member:
+
+- an override / settings-resolution chain (project → user → global);
+- a downstream-caller sweep after a rename or signature change;
+- the members of a directory listing or grep result being opened in turn;
+- a declared read protocol under [`context-hygiene`](context-hygiene.md).
+
+Not exempt, and still the failure this rule exists to catch: re-reading the *same* file hoping for a different answer, re-running a failing command unchanged, or widening a grep by one word at a time instead of thinking. The discriminator is **did the previous call change what I know** — not the tool name.
+
 ## Fresh Output Over Memory
 
 When a tool returns a value (branch name, file path, PR number), use that EXACT value in subsequent API calls. NEVER substitute a value from earlier in the conversation. Context decay causes silent mismatches — fresh output is the only source of truth.

package/dist/agent-src/rules/ui-audit-gate.md

@@ -46,12 +46,43 @@ EXISTING-UI-AUDIT RUNS FIRST. ALWAYS.
 
 `null` or `{}` is **not** findings; empty dict is rejected on purpose.
 
-## Allow-list — `ui-trivial`
+## Allow-list — `ui-trivial`, decidable from the diff alone
 
 Skip only when **all** hold:
 
-- `directive_set == "ui-trivial"`.
 - ≤ 1 file, ≤ 5 changed lines, no new component, no new state.
+- Inside the work engine, `directive_set == "ui-trivial"` — the dispatcher
+  states it directly. Outside it, the same four conditions are read **off the
+  diff**, which is observable without any dispatcher state.
+
+The `directive_set` check used to be an additional *requirement* rather than
+the dispatcher's way of stating the same fact. That made the escape hatch
+dispatcher-only, and with `state.ui_audit` also dispatcher-only the gate could
+be neither satisfied nor skipped in a plain chat session — the only
+rule-conform action left was "write no UI". A gate whose sole compliant path is
+inaction is not a gate.
+
+## Honest scope — what this rule does NOT enforce in a chat session
+
+```
+OUTSIDE THE WORK ENGINE, THE AUDIT OBLIGATION IS MODEL-CARRIED.
+NEVER CLAIM THE AUDIT RAN AS IF IT WERE VERIFIED.
+```
+
+`state.ui_audit` exists only inside the work-engine dispatcher, so only there
+is "the audit ran" a *checked* fact. A chat session cannot verify it: "I ran
+`existing-ui-audit` first" is self-report, and self-report is not enforcement —
+the same honesty boundary `security-sensitive-stop` and
+`untrusted-input-defense` state for their own obligations. So this rule ships
+`enforced_by: none` outside the dispatcher, deliberately, rather than pretending
+a satisfiable-by-assertion condition is a gate.
+
+What that leaves, and it is the useful part: run
+[`existing-ui-audit`](../skills/existing-ui-audit/SKILL.md) before adding a
+component because reuse beats duplication — not because a check will catch you.
+Full enforcement requires the dispatcher (or the `frontend-design` pack once
+pack-scoped rule projection is enabled; that flip is a maintainer decision,
+never an automated one).
 
 ## Failure modes
 

package/dist/agent-src/skills/adversarial-review/SKILL.md

@@ -37,7 +37,7 @@ sums ("attack the winner, using the losing options' strongest criteria")
 1. **Inspect the artifact** — Read the plan, diff, or draft you are about to critique; note its scope, assumptions, and the explicit asks before attacking.
 2. **Attack** — Run Step 1 below as the grumpy senior engineer.
 3. **Defend** — Run Step 2 as the balanced engineer; classify each criticism as must-fix / defer / reject.
-4. **Revise** — Run Step 3 to fold valid fixes back in and surface only the trade-offs the user needs to decide.
+4. **Revise** — Run Step 3 to fold valid fixes back in, then report every criticism with its disposition. Deciding which trade-offs matter is the user's pass, not this step's.
 
 ### Step 1: Attack (Grumpy Senior Engineer)
 
@@ -64,8 +64,19 @@ Counter the criticism fairly:
 - Move deferred concerns to "Open Questions" or "Known Limitations".
 - Present the improved version to the user.
 
-**Do this internally** — the user sees the improved result, not the raw debate.
-Only surface trade-offs or concerns that need the user's input.
+**Debate internally, report completely.** The user sees the improved result
+rather than the blow-by-blow — but every criticism raised reaches the report
+with its disposition (must-fix / deferred / rejected, each with one line of
+reason). Do not decide on the user's behalf which concerns were worth their
+attention.
+
+This clause used to read *"surface only the trade-offs that need the user's
+input"*, and that is the pre-filter defect: an instruction to report a subset is
+followed literally — the review finds the defects, then withholds the ones it
+judged unimportant, and the loss is invisible because the withheld set leaves no
+trace. It matters here more than anywhere: `self_review_gate.ts` loads this file
+as the system prompt for the package's own CI self-review, so a suppression
+clause here suppresses findings on every pull request.
 
 ## Context-specific attack questions
 
@@ -148,7 +159,10 @@ triggers it. See [`rdp-gate`](../../contexts/execution/rdp-gate.md) (L12).
 ## Output format
 
 1. Improved plan/code incorporating adversarial findings
-2. Risk summary — top concerns discovered and how they were addressed
+2. **Every criticism raised**, each with severity and disposition (must-fix /
+   deferred / rejected) and one line of reason. Not "top concerns" — a summary
+   that keeps only the highlights is the pre-filter defect wearing an
+   editor's hat.
 3. Remaining open risks (if any) with severity rating
 
 ## Gotcha

package/dist/agent-src/skills/decision-review/SKILL.md

@@ -173,6 +173,55 @@ strengthening evidence.
   `skipped` (stale — age > `review_after_days`), surface them to
   the user; do not silently use stale entries as if they were current.
 
+## Removal is a disposition — a rule the agent keeps failing gets teeth or gets deleted
+
+```
+A RULE THE AGENT CONSISTENTLY FAILS TO FOLLOW GETS STRUCTURAL ENFORCEMENT
+OR DELETION. NEVER A LOUDER RESTATEMENT.
+ASK WHAT CAN BE REMOVED AS DELIBERATELY AS WHAT SHOULD BE ADDED.
+```
+
+Ratchets in this tree move one way. Counts go up, gates accumulate, and nothing
+retires an artifact — so the default response to non-adherence has been to say
+it again, harder. That is the one response the evidence rules out: an obligation
+that did not change behaviour as prose does not change it as louder prose. The
+fork is **enforcement or deletion**, and both are real options.
+
+**Non-adherence is the trigger, not low frequency.** A rule that rarely fires is
+not a rule that fails. A floor is working precisely when nothing crosses it, and
+deleting it because it has been quiet removes the thing that was holding.
+
+### The simplify signals
+
+Any of these is a reason to open the question. None of them is on its own a
+verdict:
+
+- a section that has not been relevant across many sessions;
+- a rule derived from a **single unvalidated observation**;
+- a workflow that is consistently shortcut in practice;
+- sections that are loaded every run and never acted on;
+- two rules that contradict each other;
+- complexity added for a case that has never triggered.
+
+Note that *never relevant*, *single unvalidated observation*, and *never acted
+on* are listed separately on purpose. They look alike and they are not: the
+first is about scope, the second about evidence, the third about attention.
+
+### Escalation, and its counterpart
+
+```
+A THIRD RECURRENCE OF THE SAME VIOLATION CLASS CONVERTS AN OBSERVATION
+INTO A DETERMINISTIC GATE.
+A REVIEW FINDING NEVER SILENTLY BECOMES A HARD GATE.
+ESCALATE AT A STATED THRESHOLD, NEVER SILENTLY.
+```
+
+Both halves are load-bearing and they come from sources that disagree. The
+threshold stops a recurring defect from being re-observed forever; the
+counterpart stops a single reviewer's opinion from quietly becoming law. Between
+them, the only legitimate path from *noticed* to *enforced* is a stated count
+reached in the open.
+
 ## Decision-revisit gate — mechanics (migrated from the `decision-revisit-gate` rule)
 
 Body of [`decision-revisit-gate`](../../rules/decision-revisit-gate.md)

package/dist/agent-src/skills/judge-artifact-completeness/SKILL.md

@@ -101,7 +101,11 @@ Before finalising:
 2. No dimension was penalised for length or word count.
 3. N/A credit was granted only where the schema allows it.
 4. The verdict follows the ratio thresholds above, not intuition.
-5. Top gaps are the highest-weight missing dimensions — not every minor gap.
+5. The **Dimensions block lists every dimension**, scored, with no omissions —
+   that is the complete emission and it is not optional. **Top gaps** is a
+   ranked summary layered over it, so it names the highest-weight misses rather
+   than repeating the block. Shortening the block itself is the pre-filter
+   defect; shortening the summary is what a summary is.
 
 ## Output format
 

package/dist/agent-src/skills/judge-bug-hunter/SKILL.md

@@ -121,11 +121,24 @@ Issues (if revise/reject):
       Trigger: <concrete input/condition>
       Expected: <what should happen>
   🟡  ...
+
+Rejected candidates (if the devil's-advocate pass killed any):
+  🔴→drop  path/to/file.ext:LINE — <the finding> · refuted by: <guard clause
+           upstream | framework default | unreachable input | …>
 ```
 
 Severity: 🔴 crash or incorrect result / 🟡 edge case unhandled but
 graceful / 🟢 defensive-coding suggestion.
 
+**A killed 🔴 is demoted, never deleted.** This judge runs a refutation pass on
+every 🔴 and used to leave no trace of what it killed — the one judge with a
+refutation step and no demotion bucket, where `code-review`, `security-audit`,
+`bug-analyzer`, and the adversarial council all pair theirs with one. The
+asymmetry matters because refutation is a judgement: a reviewer who was wrong to
+refute leaves the reader no way to notice. Confidence is what the row carries;
+severity is what it keeps — a 🔴 refuted on a guess is still a 🔴 somebody should
+look at.
+
 Required fields (ordered):
 
 1. **Judge** and **Model** — skill name and resolved judge model
@@ -133,6 +146,9 @@ Required fields (ordered):
 3. **Verdict** — `apply`, `revise`, or `reject`
 4. **Issues** — every finding cites file:line and concrete trigger;
    omit only when verdict is `apply`
+5. **Rejected candidates** — every finding the refutation pass killed, with what
+   refuted it. Omit the section only when the pass killed nothing; never omit it
+   because the kills seemed obvious.
 
 If a finding needs runtime confirmation, note it as a follow-up for
 the implementer with the concrete probe — backend: `curl` or

package/dist/agent-src/skills/judge-synthesis/SKILL.md

@@ -63,6 +63,15 @@ finding count. Preserve each
 judge's own verdict word (do not normalise away `breached` into `reject`); add a
 severity tier (worst/mid/clean) only as a sort key.
 
+**A sort key, never a filter.** Severity orders the synthesis; it never decides
+what enters it. Dropping a judge's low-severity finding during synthesis
+reproduces the pre-filter defect one layer up — the finding was found, the
+reviewer reported it, and the aggregator withheld it. Filtering is the
+consumer's pass, after the ledger is whole. Output shape, the separate
+`Confidence` field, and the preserve-an-unverified-S0 rule are specified once in
+[`adversarial-review-protocol`](../../../docs/contracts/adversarial-review-protocol.md)
+§ 3.
+
 ### 2. Find consensus (highest confidence)
 
 A finding flagged by **≥2 judges** (same file:line / same dimension / same
@@ -85,7 +94,11 @@ contested.
 - **Must-fix** — every finding from a worst-tier verdict (`reject` / `incomplete`
   / `breached`) + every consensus finding at the highest severity.
 - **Should-fix** — mid-tier (`revise` / `partial`) findings.
-- **Advisory** — single-judge low-severity suggestions.
+- **Advisory** — single-judge low-severity suggestions. **Emitted in full,
+  never elided.** This is the tier with no downstream consumer, which makes it
+  the one where quiet dropping costs nothing visible — and that is exactly why
+  it is stated: a finding that reached a judge and not the reader was suppressed
+  by the aggregator, whatever the tier was called.
 
 Each entry carries **provenance**: which judge(s) raised it. Never merge two
 judges' findings into one unattributed line.

package/dist/agent-src/skills/rule-writing/SKILL.md

@@ -203,6 +203,39 @@ See § 3b above for the load-bearing distinction between `load_context:`
 (logical, rewritten), `triggers[].path_prefix:` (literal, verbatim),
 and body links (relative `../../docs/...`, rewriter handles depth).
 
+## Required: name the primary bias this rule overrides
+
+```
+EVERY RULE STATES, IN ONE SENTENCE, THE MODEL'S WRONG DEFAULT IT EXISTS TO
+OVERRIDE. NOT THE HISTORY. NOT THE RATIONALE. THE TENDENCY.
+A RULE THAT CANNOT NAME ONE IS A RULE WITH NO OBSERVED FAILURE BEHIND IT.
+```
+
+One sentence, near the top, in the shape *"left alone, the model
+<does the wrong thing>"*:
+
+- ✅ "Left alone, the model treats a question as an instruction and starts
+  building."
+- ✅ "Left alone, the model reports the happy path it just made pass and calls
+  the change finished."
+- ❌ "This rule exists because a session in June went badly." — backstory.
+- ❌ "Correctness matters." — a value, not a tendency.
+- ❌ "Agents sometimes make mistakes." — true of everything, discriminates
+  nothing.
+
+**Why this field and not a longer rationale.** It is the discriminator the
+mechanism-must-match-an-observed-failure-mode discipline wants at *authoring*
+time: a rule whose bias sentence is a plausible generality is a rule aimed at
+nothing in particular, and that is visible in one line where it is invisible in
+three paragraphs. The field is also the input to the removal question later —
+`decision-review` asks whether the agent still exhibits the named tendency, and
+that question cannot be asked of a rule that never named one.
+
+**Retrofit is opportunistic, never a sweep.** Add the sentence when you touch a
+rule for another reason. A batch edit across the rule set trips the
+kernel-prefix byte-stability gate, and that gate is right to fire — the kernel
+prefix is pinned deliberately.
+
 ## Output format
 
 1. Complete rule file at `src/rules/{name}.md`