@nurix/etna 0.20.36 → 0.20.38

package/data/harnesses/etna/skills/brainstorm/SKILL.md

@@ -9,166 +9,184 @@ Help the user think correctly about a large-scale change, in a record that reads
 pause, and end with a harvest so complete the session folder is useless. You are the
 **facilitator** — the conversation seat of a capability split across two seats:
 
-- **You (this skill, main loop)** hold the conversation. Your only writes: append to
-  `ops/capture.md` every turn, write sync-log dispatch lines, and freeze the basis at intake.
-- **The twin (the `brainstorm` agent, pinned strong tier)** owns the paper: it distills ops into
-  the working surface, recomposes the thesis whole, audits, and drives the harvest. You dispatch
-  it at gates and relay its reports. You never write the working surface yourself — prose
-  obligations decay in the conversing seat; that is the whole architecture.
-- **The detector** (`scripts/detector.mjs`) owns mechanical integrity; the twin runs it.
-
-References — load at the named moments, and read the routed file in full (no skimming to save
-context; this skill is sized by completeness):
-
-- `references/doctrine.md` — when judging what a turn's substance *is* (force, fork, commitment)
-  or how to word what you capture.
-- `references/session-schema.md` — when bootstrapping a session or interpreting detector/twin
-  output.
-- `references/harvest.md` — at `stop`, before orchestrating the pipeline.
+| Seat | Owns | Writes |
+| --- | --- | --- |
+| **You** (this skill, main loop) | the conversation; dispatching the twin at gates and relaying its reports | `ops/capture.md` every turn, the sync-log dispatch lines, the basis at intake — **nothing else** |
+| **The twin** (the `brainstorm` agent, pinned strong tier) | the paper: distilling ops into the working surface, recomposing the thesis whole, audits, the harvest | every other file in the folder |
+| **The detector** (`scripts/detector.mjs`, run by the twin) | mechanical integrity | — |
+
+**Never write the working surface yourself** — prose obligations decay in the conversing seat, and
+the split exists to keep them out of it.
+
+Load each reference at its moment and read it in full — **never skim to save context**; this skill
+is sized by completeness:
+
+| Reference | Load when |
+| --- | --- |
+| `references/doctrine.md` | judging what a turn's substance *is* (force, fork, commitment), or how to word what you capture |
+| `references/session-schema.md` | bootstrapping a session, or interpreting detector or twin output |
+| `references/harvest.md` | at `stop`, before orchestrating the pipeline |
 
 ## The one habit that is yours: capture
 
-Append to `ops/capture.md` **every turn**, both sides, lowest bar — raw notes, not prose:
-what the user said that matters, and your own substance (causal diagnoses, informed rejections of
-options you presented, definitions, reasoning chains behind recommendations), plus residue you
-judge not worth filing. Turn-stamped per the schema (`### T# · <ISO datetime>`). Never distill
-here — distillation is the twin's. If a piece of your reasoning lives only in the chat when the
-twin next dispatches, you leaked it. This habit is also what makes every re-entry cheap: the
-folder plus ops is the session's whole memory.
+Append to `ops/capture.md` **every turn**, both sides, at the lowest bar — raw notes, not prose:
+
+- what the user said that matters;
+- your own substance — causal diagnoses, informed rejections of options you presented,
+  definitions, reasoning chains behind recommendations;
+- residue you judge not worth filing.
+
+Stamp each turn per the schema (`### T# · <ISO datetime>`). **Never distill here** — distillation is
+the twin's. Reasoning that lives only in the chat when the twin next dispatches has leaked. The
+folder plus ops is the session's whole memory, which is what makes every re-entry cheap.
 
 ## `start`
 
-Find sessions by their folders — no index keeps a row per session: `docs/research/*-brainstorm/`
-(active) and `docs/history/brainstorms/*/` (harvested), the folder name being the topic and each
-`thesis.md` heading its subject. Topic matches an active session → resume it
-(re-entry, below). Harvested or prior-generation match → offer it **as a basis** for a fresh
-session. No match → new session.
-
-**1 · The entry gate.** A session needs substance: ask for a **basis** — a reference document
-(path or URL), a prior session folder of *any* format or generation, or a one-shot brain dump in
-prose, now. Information is information: an old v2 brainstorm folder is ingested exactly like a
-PRD — copied into `basis/`, frozen, distilled; never operated on in place, never migrated.
-Drip-sized input (a bug fix, one button) → say this skill is the wrong tool and don't open the
+Find sessions by their folders — **no index keeps a row per session**. Active sessions are
+`docs/research/*-brainstorm/`, harvested ones `docs/history/brainstorms/*/`; the folder name is the
+topic and each `thesis.md` heading its subject.
+
+| Topic matches | Do |
+| --- | --- |
+| an active session | resume it (Re-entry, below) |
+| a harvested session, or a session folder in another format | offer it **as a basis** for a fresh session |
+| nothing | open a new session |
+
+**1 · The entry gate.** A session needs substance. Ask for a **basis**, now:
+
+- a reference document (path or URL);
+- a prior session folder, in any format — ingested exactly like a PRD: copied into `basis/`,
+  frozen, distilled; **never** operated on in place, **never** migrated;
+- a one-shot brain dump in prose.
+
+Drip-sized input (a bug fix, one button): say this skill is the wrong tool, and do not open the
 session unless the user explicitly overrides. No basis, no session.
 
-**2 · Bootstrap.** Folder `docs/research/{topic}-brainstorm/` (kebab slug, confirm in one line).
-Create `ops/` with a `.gitignore` containing `*`, `ops/capture.md`, `ops/sync-log.md`; copy the
-basis into `basis/`. No index row: the folder is the session's entry. Then write the sync-log dispatch
-line and dispatch the twin (gate: start) to write the initial surface — you don't scaffold
-`state.md`/`thesis.md`/`forks.md`/`ledger.md` yourself.
-
-**3 · Calibrate + frame.** Distill the basis first — it seeds everything. Calibrate from the
-living docs (the ownership index, recent decision records, any open-questions doc) so your
-questions match this repo, not a template. Then one `AskUserQuestion` batch: **sitting** (single
-sprint — the default and the shape that succeeds — or explicitly multi), **execution reality**
-(greenfield / brownfield / hybrid — migration gotchas discovered at plan time are discovered too
-late), and **where the idea is right now** (fully in their head → dump; half-formed → interview).
-Propose the **aspect map** — the thinking dimensions for *this* idea, derived from the basis,
-no fixed list; the user edits it; it lives in `state.md`.
-
-**4 · Orient.** 3–4 lines, assuming a first-time user: how the session works (you talk, the
+**2 · Bootstrap.**
+
+1. Name the folder `docs/research/{topic}-brainstorm/` (kebab slug); confirm it in one line.
+2. Create `ops/` holding a `.gitignore` containing `*`, `ops/capture.md`, and `ops/sync-log.md`.
+3. Copy the basis into `basis/`. Add no index row — the folder is the session's entry.
+4. Write the sync-log dispatch line and dispatch the twin (gate: start) to write the initial
+   surface. **Never scaffold** `state.md`, `thesis.md`, `forks.md`, or `ledger.md` yourself.
+
+**3 · Calibrate and frame.**
+
+1. Distill the basis first — it seeds everything.
+2. Calibrate from the living docs (the ownership index, recent decision records, any
+   open-questions doc), so your questions match this repo, not a template.
+3. Ask one `AskUserQuestion` batch:
+   - **sitting** — single sprint (the default, and the shape that succeeds) or explicitly multi;
+   - **execution reality** — greenfield, brownfield, or hybrid; a migration gotcha found at plan
+     time is found too late;
+   - **where the idea is now** — fully in their head → dump; half-formed → interview.
+4. Propose the **aspect map** — the thinking dimensions for *this* idea, derived from the basis,
+   from no fixed list. The user edits it; it lives in `state.md`.
+
+**4 · Orient.** In 3–4 lines, written for a first-time user: how the session works (you talk, the
 folder keeps everything), the steering verbs in plain words, "let me read" (pause and read the
 thesis anytime), and what `stop` does (converge → your approval → harvest → the folder moves and
-you choose delete or commit). Then begin — **always in dump or interview**; probe and converge
-are mid-session moves, never starting postures.
+you choose delete or commit). Then begin — **always in dump or interview**; probe and converge are
+mid-session moves, never starting postures.
 
 ## The moves
 
-Five named, user-steerable interlocution moves — who drives, how much gets asked. No `MODE:`
-field, no switch ceremony, no sanctioned trigger words: **any phrasing that implies a move
-triggers it** ("I want to poke holes" → probe; "what am I missing?" → blindspot; "let's decide"
-→ converge). The first time each
-move fires, name in one line what you're doing. Offer a switch when the signals say so (the user
-monologues mid-interview; every probe answer is "haven't thought about it") — one offer, never
-seized.
-
-- **dump** — user drives. No questions mid-stream. Reflect back the shape, contradictions, and
-  implications as they land — that reflection *is* active listening; never sit silent.
-- **interview** — you drive. `AskUserQuestion` batches of 2–3, scoped to one aspect at a time.
-  Questions derive from the basis and the current surface — never from a template inventory;
-  never interview to fill empty files.
-- **probe** — you challenge: flaws, edge cases, conflicts with the tech fragment or domain
-  fragment. Each finding is noted in ops and moves on — don't demand resolution mid-probe.
-- **blindspot** — hunt unknown unknowns. This move is dispatched, not conversed: you co-built
-  the frame, so the outside view is structurally the twin's — dispatch it (gate: on demand,
-  scope: blindspot) to cold-read the whole surface against the thesis's stated goal. Candidates
-  die at the twin's quality gate (grounded in this folder, material to the design, new,
-  answerable) so the user never over-replies to noise; at most five survivors arrive, each
-  already filed as a fork. Relay them in prose — finding → why it's material here → what
-  answering it would change — never as a question barrage: the user engages what matters and
-  converge burns the rest down later. Don't wait to be asked — a user-only trigger makes
-  coverage depend on the user remembering to ask: self-initiate a pass occasionally, at the
-  moments the frame settles (an aspect closes, a converge burst lands, the thesis materially
-  recomposes), by widening a reconcile dispatch's scope. Self-initiation needs no offer — it
-  seizes nothing; survivors land as forks either way, and zero survivors is one relay line,
-  never manufactured findings.
-- **converge** — burn forks down to commitments or explicit parks. `AskUserQuestion` for picks.
-  Each resolution carries Why + How to apply (the twin files it; you capture it).
+Five user-steerable moves set who drives and how much gets asked. There is no `MODE:` field, no
+switch ceremony, and no sanctioned trigger word: **any phrasing that implies a move triggers it**
+("I want to poke holes" → probe; "what am I missing?" → blindspot; "let's decide" → converge). The
+first time each move fires, name what you are doing in one line. When the signals call for a
+switch (the user monologues mid-interview; every probe answer is "haven't thought about it"), offer
+it once — never seize it.
+
+- **dump** — the user drives. Ask no questions mid-stream. Reflect back the shape, contradictions,
+  and implications as they land — that reflection is the active listening; **never sit silent**.
+- **interview** — you drive. `AskUserQuestion` batches of 2–3, one aspect at a time. Derive the
+  questions from the basis and the current surface — **never** from a template inventory, and
+  **never** interview to fill empty files.
+- **probe** — you challenge: flaws, edge cases, conflicts with the tech or domain fragment. Note
+  each finding in ops and move on; **never** demand resolution mid-probe.
+- **blindspot** — the hunt for unknown unknowns, **dispatched, never conversed**: you co-built the
+  frame, so the outside view belongs to the twin.
+  1. Dispatch the twin (gate: on demand, scope: blindspot) to cold-read the whole surface against
+     the thesis's stated goal. Its quality gate kills any candidate not grounded in this folder,
+     material to the design, new, and answerable; at most five survivors return, each already
+     filed as a fork.
+  2. Relay survivors in prose — finding → why it is material here → what answering it would
+     change — **never** as a question barrage: the user engages what matters, and converge burns
+     the rest down later. Zero survivors is one relay line; **never** manufacture findings.
+  3. Self-initiate a pass, without offering, whenever the frame settles — an aspect closes, a
+     converge burst lands, the thesis materially recomposes — by widening a reconcile dispatch's
+     scope. A user-only trigger makes coverage depend on the user remembering to ask.
+- **converge** — burn forks down to commitments or explicit parks, with `AskUserQuestion` for
+  picks. Each resolution carries Why and How to apply; you capture it, the twin files it.
 
 ## Twin dispatches — the gates
 
-Dispatch at: **start** (bootstrap), **on demand** (below), **pause**, **stop**. One dispatch in
-flight at a time. For every dispatch *you* write the dispatch line to `ops/sync-log.md`
-(`S# | gate: <g> | dispatched: <ts> | scope: <s>`) — the twin appends the result; the pairing is
-how reconciliation stays observable instead of asserted. Relay the twin's one-line report at the
-next turn break ("4 edits · 2 new forks · 6 open · untouched: risks") — the only ambient
-convergence pressure this skill applies — plus what the recompose changed, so a rewrite of the
-user's thinking is never silent. A `failed` result: tell the user plainly and re-dispatch at the
-next gate.
-
-**On demand** means: the user asks ("let me read", "sync up", "what's open?"), or you judge the
-capture has accumulated enough that the surface has fallen meaningfully behind. **"Let me read"**
-is a recognized pause act: dispatch a compose (say honestly that it takes a couple of minutes),
-then point them at `thesis.md` — mandated shape, claim → argument → what changed, stamped — and
-pick the conversation back up when they return. Reading one's own thinking mid-session is a
-designed-for act, not an interruption.
+Dispatch at **start** (bootstrap), **on demand** (below), **pause**, and **stop** — **one dispatch in
+flight at a time**.
+
+1. Before each dispatch, write its line to `ops/sync-log.md`
+   (`S# | gate: <g> | dispatched: <ts> | scope: <s>`). The twin appends the result; the pairing
+   keeps reconciliation observable instead of asserted.
+2. At the next turn break, relay the twin's one-line report ("4 edits · 2 new forks · 6 open ·
+   untouched: risks") plus what the recompose changed — a rewrite of the user's thinking is
+   **never** silent. The report is the only ambient convergence pressure this skill applies.
+3. On a `failed` result, tell the user plainly and re-dispatch at the next gate.
+
+**On demand** means the user asks ("let me read", "sync up", "what's open?"), or you judge the
+capture has outrun the surface meaningfully. **"Let me read"** is a designed-for pause, not an
+interruption: dispatch a compose (say honestly it takes a couple of minutes), point the user at
+`thesis.md` — claim → argument → what changed, stamped — and resume when they return.
 
 ## Re-entry — resume, or context loss
 
-Re-entry is a read, not a reconstruction: re-read this skill's hub, `state.md` (posture line
-first), and the tail of `ops/capture.md`; then dispatch the twin (gate: on demand) for a
-re-brief + freshness audit. This covers three triggers identically: resuming a parked session,
-a new sitting, and **loss of conversational context mid-session (compaction)** — if you find
-yourself mid-session without memory of it, this is the procedure; the folder was built so that
-nothing you "remembered" matters. While a session folder exists, read `state.md` at the start of
-every turn.
+Re-entry is a read, not a reconstruction. It covers three triggers identically: resuming a parked
+session, a new sitting, and **losing conversational context mid-session (compaction)** — finding
+yourself mid-session without memory of it means running this procedure; nothing you "remembered"
+matters.
+
+1. Re-read this hub, `state.md` (posture line first), and the tail of `ops/capture.md`.
+2. Dispatch the twin (gate: on demand) for a re-brief and freshness audit.
+
+While a session folder exists, read `state.md` at the start of every turn.
 
 ## `stop` — the fixed pipeline
 
-Read `references/harvest.md` first. The pipeline always runs — a stop *is* convergence plus
-harvest; you orchestrate, the twin executes each leg:
+Read `references/harvest.md` first. The pipeline **always** runs — a stop *is* convergence plus
+harvest. You orchestrate; the twin executes each leg.
 
-1. **Converge** — every open fork resolved now or explicitly parked with a destination
-   (mini-converge in conversation; the scope-guard trio in `harvest.md` disambiguates parks).
-   If no blindspot round has run this session, offer one first (one offer, never seized) — an
-   unknown unknown found after commitments freeze is the expensive kind.
-2. **Final sync + manifest** — dispatch the twin (gate: stop). It builds the manifest only when
+1. **Converge** — resolve every open fork now, or park it explicitly with a destination
+   (mini-converge in conversation; the scope-guard trio in `harvest.md` disambiguates parks). If no
+   blindspot round has run this session, offer one first, once — an unknown unknown found after
+   commitments freeze is the expensive kind.
+2. **Final sync and manifest** — dispatch the twin (gate: stop). It builds the manifest only when
    the detector's manifest gate is clean; relay anything blocking.
-3. **One approval** — present the manifest via `AskUserQuestion`. Gap rounds later re-enter here:
-   every write to canonical docs is user-approved, no exceptions.
-4. **Apply → uselessness test → move** — the twin's legs; relay results. Harvest fails loud:
-   a partial apply leaves the folder visibly unfinished in `docs/research/` and the user restarts
-   the stop — never resume silently.
-5. **The offer** — after the move to `docs/history/brainstorms/{topic}/`: **delete the folder, or
-   commit it** — the user decides; the design assumes deletion. Relay via `AskUserQuestion`.
+3. **One approval** — present the manifest via `AskUserQuestion`. Gap rounds re-enter here: every
+   write to canonical docs is user-approved, **no exceptions**.
+4. **Apply → uselessness test → move** — the twin's legs; relay the results. Harvest fails loud: a
+   partial apply leaves the folder visibly unfinished in `docs/research/` and the user restarts the
+   stop — **never** resume silently.
+5. **The offer** — after the move to `docs/history/brainstorms/{topic}/`, ask via
+   `AskUserQuestion`: **delete the folder, or commit it**. The user decides; the design assumes
+   deletion.
 
 ## Conduct — holds for the whole session
 
-1. **Speak plain English; codes live in files.** Name every item by what it is; append the code
-   in parentheses only when traceability needs it ("…the timeout question (F2)"). Never lead
-   with a bare `F3`/`D7`.
-2. **No production code outside the session folder while open.** Illustrative snippets live in
-   the folder. Asked for production code: offer a sketch inside the folder, or `/brainstorm stop`
+1. **Speak plain English; codes live in files.** Name every item by what it is, with the code in
+   parentheses only where traceability needs it ("…the timeout question (F2)"). **Never** lead with
+   a bare `F3`/`D7`.
+2. **No production code outside the session folder while it is open.** Illustrative snippets live
+   in the folder. Asked for production code, offer a sketch inside the folder, or `/brainstorm stop`
    first.
-3. **`AskUserQuestion` at exactly four sites:** the intake frame batch, interview batches,
-   converge picks, and the stop approvals (manifest; delete-or-commit). Everywhere else, prose.
+3. **`AskUserQuestion` at exactly four sites:** the intake frame batch, interview batches, converge
+   picks, and the stop approvals (manifest; delete-or-commit). Everywhere else, prose.
 4. **Suggested, never seized.** Moves, abstractions, probes — one offer each; accept refusal
-   without re-litigating. Exemption: a self-initiated blindspot dispatch — it takes no
-   conversational control; its findings arrive as forks the user may simply ignore.
-5. **Nothing lives only in the transcript.** Ops is the floor: if it isn't in the folder or in
-   ops, it doesn't exist. Flaws, gaps, and contradictions surface to the twin as capture — the
-   twin turns them into forks; forks are the only convergence currency.
-6. **The user decides when to converge and when to stop.** Distance-to-coherent is visible in
-   every relayed twin report; you never say "let's decide now."
+   without re-litigating. The one exemption is a self-initiated blindspot dispatch: it takes no
+   conversational control, and its findings arrive as forks the user may ignore.
+5. **Nothing lives only in the transcript.** What is not in the folder or in ops does not exist.
+   Flaws, gaps, and contradictions reach the twin as capture; the twin turns them into forks, the
+   only convergence currency.
+6. **The user decides when to converge and when to stop.** Distance-to-coherent is visible in every
+   relayed twin report; **never** say "let's decide now."
 7. **Only `/brainstorm start` and `/brainstorm stop` enter or leave a session.** No
    auto-invocation, ever.

package/data/harnesses/etna/skills/brainstorm/references/doctrine.md

@@ -3,56 +3,54 @@
 Load when: composing or auditing any working-surface file; deciding what a turn's substance *is*
 (a force, a fork, a commitment); judging whether a record is complete enough to harvest.
 
-The session's product is a defensible design position. Five elements carry it — thesis, forces,
-forks, commitments, consequences. They are ADR epistemics with the ceremony removed: everything
-that made a decision record *citable* survives; everything that made it *bureaucratic* is dropped.
+The session's product is a defensible design position, carried by five elements — thesis, forces,
+forks, commitments, consequences. They are ADR epistemics without the ceremony: what makes a
+decision record *citable* stays; what makes it *bureaucratic* is out.
 
 ## The five elements
 
 **Thesis** — the claim under construction. One composed document (`thesis.md`) in a mandated
 readable shape: the **claim** (what we are building and the position taken), the **argument** (the
 forces bearing on it and the reasoning chain from forces to claim), then **what most recently
-changed and why**. Composed prose from turn one, rewritten whole at every compose — a document
-maintained by appending can never read well. Every compose carries a `Current as of:` stamp so
-staleness is visible instead of trusted.
+changed and why**. Composed prose from turn one, rewritten whole at every compose — **never**
+appended, because an appended document never reads well. Every compose carries a `Current as of:`
+stamp, so staleness is visible instead of trusted.
 
 **Forces** — the pressures that shape the design: user constraints stated in the conversation,
-evidence from the repo or the field, platform realities, costs, prior doctrine. Forces are not a
-file; they are the argument's raw material. A force lives wherever the reasoning that uses it
-lives — the thesis argument, a commitment's Why — and is stated concretely enough to be checked
-("the CLI gates consumer refresh", never "deployment concerns").
+evidence from the repo or the field, platform realities, costs, prior doctrine. Forces have no file;
+each lives wherever the reasoning that uses it lives — the thesis argument, a commitment's Why — and
+is stated concretely enough to check ("the CLI gates consumer refresh", never "deployment
+concerns").
 
-**Forks** — the open questions. A fork is the session's only convergence currency: flaws, gaps,
-contradictions, uncovered aspects all funnel into `forks.md` or they don't exist. Every fork
-carries a **close condition** — what resolution looks like: a pick, a confirmed fact, an accepted
-risk. A fork with no close condition is not askable and gets rewritten until it is.
+**Forks** — the open questions, and the session's only convergence currency: flaws, gaps,
+contradictions, and uncovered aspects funnel into `forks.md` or do not exist. Every fork carries a
+**close condition** — what resolution looks like: a pick, a confirmed fact, an accepted risk. A
+fork without one is not askable; rewrite it until it is.
 
 **Commitments** — the resolved calls, in `ledger.md`. Field set per entry:
 
 - **Decision** — the call, one sentence, present tense.
-- **Why** — the forces and reasoning that produced it. This is where declined options live:
-  a **Declined:** line inside the commitment names the option, the evidence it was declined
-  against *at decline time*, and a **re-evaluate condition** where one exists — the condition
-  under which the rejection deserves another look. A deliberate call must never read later as an
-  unexamined one; the re-evaluate condition is what turns a past-tense rejection into a standing
-  tripwire.
+- **Why** — the forces and reasoning that produced it, including declined options: a
+  **Declined:** line names the option, the evidence it was declined against *at decline time*, and
+  a **re-evaluate condition** where one exists — the condition under which the rejection deserves
+  another look. The line keeps a deliberate call from reading later as an unexamined one, and the
+  re-evaluate condition turns a past rejection into a standing tripwire.
 - **How to apply** — what acting on the decision looks like in this repo.
 - **Resolves** — the fork(s) this closes.
 
 The ledger is **append-only with amendment-by-annotation**: a decision is real the moment it
-lands; reversing it is a new entry that names what it reverses, plus a one-line annotation on the
-old entry ("Reversed by …"). There is no tentative/committed/rescinded state machine — the fleet's
-best sessions all proved append-plus-annotation carries the same information with none of the
-ceremony.
+lands; reversing it is a new entry naming what it reverses, plus a one-line annotation on the old
+entry ("Reversed by …"). **Never** add a tentative/committed/rescinded state machine —
+append-plus-annotation carries the same information with none of the ceremony.
 
-**Consequences** — what a commitment obligates beyond itself: follow-on work, constraints it
-places on future decisions, and where its knowledge must land at harvest. Consequences surface as
-new forks ("committing to X opens the question of Y"), backlog candidates, or fragment content —
-they are the element that keeps a ledger from being a list of verdicts with no forward pressure.
+**Consequences** — what a commitment obligates beyond itself: follow-on work, constraints on
+future decisions, and where its knowledge must land at harvest. They surface as new forks
+("committing to X opens the question of Y"), backlog candidates, or fragment content, and keep the
+ledger from being a list of verdicts with no forward pressure.
 
 ## What ADR epistemics keep
 
-The parts that made decision records worth citing in shipped source:
+The parts that make a decision record worth citing in shipped source:
 
 - A decision is **addressable** — it can be named, cited, amended, and reversed by reference.
 - The **reasoning travels with the verdict** — Why is mandatory, and declined alternatives ride
@@ -62,7 +60,7 @@ The parts that made decision records worth citing in shipped source:
 
 ## What ceremony drops
 
-The parts that died in every real session, kept out deliberately:
+The parts real sessions abandon, kept out deliberately:
 
 - **Status lifecycles** (Proposed → Accepted → Deprecated) — a commitment is live when it lands;
   reversal is an entry, not a state transition.
@@ -76,10 +74,11 @@ The parts that died in every real session, kept out deliberately:
 
 ## Epistemic rules
 
-These bind every writer of the working surface — facilitator (ops), twin (everything else):
+Binding on every writer of the working surface — the facilitator (ops) and the twin (everything
+else):
 
 1. **Distilled, never verbatim.** Capture is interpretation: name the claim, the reasoning, and
-   the implication. The ban is on transcript-pasting, not on quoting — integrity copies (printed
+   the implication. The ban is on pasting transcript, not on quoting — integrity copies (printed
    enumerations, cited excerpts) are self-containment, not stenography.
 2. **Examples are examples.** Record the general claim and cite the user's phrase as an instance
    of it. Never promote one phrasing into the frame — a thesis that reads beautifully but no
@@ -91,22 +90,23 @@ These bind every writer of the working surface — facilitator (ops), twin (ever
    checks it there.
 4. **Both sides are session knowledge.** The facilitator's own substance — causal diagnoses,
    informed rejections of options it presented, definitions of terms the surface cites, reasoning
-   chains behind recommendations — is captured with the same discipline as the user's words. This
-   is the historically leaked knowledge class; the ops ledger exists so it lands at zero cost.
+   chains behind recommendations — is captured with the same discipline as the user's words. It is
+   the knowledge class that leaks; the ops ledger exists so it lands at zero cost.
 5. **Directional steering is not feature truth.** A harvested principle informs many decisions
    and changes slowly; a feature fact belongs to its feature doc and changes at code speed. The
    harvest links between the two layers, never duplicates prose across them.
 
 ## Field lessons — capture and converge
 
-Measured on live sessions; each is the rule, distilled.
+Each is a rule measured on live sessions.
 
 - **Separate user voice from facilitator re-derivation before ledgering** when both arrive in one
-  turn. Only the user's half is ledgerable; a re-derivation that quietly re-reads an existing
-  commitment into a new shape is caught as a fork with a named amendment to the affected `D#`,
-  never as an edit — a commitment recorded in the user's words is amended only by the user.
-- **Stamp in UTC, always** — take the stamp from `date -u`, never from the runtime's injected
-  local date; the two disagree for part of every working day in some offsets, and a local-date
+  turn — say, the user states a segregation and the facilitator re-derives a whole architecture
+  from it. **Only** the user's half is ledgerable. A re-derivation that re-reads an existing
+  commitment into a new shape is a fork carrying a named amendment to the affected `D#`, **never**
+  an edit — a commitment recorded in the user's words is amended only by the user.
+- **Stamp in UTC, always** — take the stamp from `date -u`, **never** from the runtime's injected
+  local date; in some offsets the two disagree for part of every working day, and a local-date
   stamp runs the ledger a day ahead of capture.
 - **Run the blindspot pass immediately after a converge burst, before the manifest gate.** When
   several picks land in one sitting the strain migrates *between* them — collisions between
@@ -118,20 +118,17 @@ Measured on live sessions; each is the rule, distilled.
 - **When a ledger entry's `Why` contains "already", verify it before the manifest.** A commitment
   that declines to build something because it already exists rests on a fact, not a judgment, and
   the stop gate is the last place that fact is checkable — after the folder moves it is not.
-- **Verify a doctrine claim against disk before building an argument on it.** Truth docs outrun
-  package rebuilds: a guardrail can assert a guard path that exists nowhere, inside a suppression
-  wrapper naming packages already deleted. When a session's centre is a recorded prohibition, `ls`
-  the guard path, read the owning package's config, and confirm the package is still in the tree.
-- **Read the decision records before framing a session around a pillar contradiction.** An AD
-  accepted last week can already contradict the pillars; a session convened to *decide* a reversal
-  may be *ratifying* one that shipped — a materially different conversation.
+- **Verify a doctrine claim against disk before building an argument on it.** Truth docs drift
+  from package rebuilds: a guardrail can assert a guard path that exists nowhere, inside a
+  suppression wrapper naming packages absent from the tree. When a session's centre is a recorded
+  prohibition, `ls` the guard path, read the owning package's config, and confirm the package is in
+  the tree.
+- **Read the decision records before framing a session around a pillar contradiction.** A recently
+  accepted AD can already contradict the pillars; a session convened to *decide* a reversal may be
+  *ratifying* one that shipped — a materially different conversation.
 - **Give the opening map at least one aspect organised by seam.** A map organised by system layer
   owns none of the questions that land on the boundary between two planes or two phases, which is
   where the real design questions sit.
-- **Ledger only the user's half of a re-derivation turn.** When the user states a segregation and
-  the facilitator re-derives a whole architecture from it in the same entry, only the first half is
-  ledgerable; a re-derivation that re-reads an existing commitment into a new shape is a fork with a
-  named amendment, never an edit.
 - **Check the ledger prefix against the product's vocabulary.** `D#` reads two ways in a product
   whose state lives in a database called D1; add a disambiguation line to the ledger header and
   write the colliding term in full inside entries.