gm-skill 2.0.1639 → 2.0.1641

package/AGENTS.md

@@ -22,11 +22,11 @@ Skills encode environment-specific constraints that override general knowledge.
 
 # Architecture & Philosophy
 
-This repo IS the published `gm-skill` npm package: repo root = package root, no factory, no build step generating a separate output dir. `skills/gm/SKILL.md` is the entry point; orchestration logic lives in rs-plugkit, served on demand via the `instruction` verb. Agent-facing prose (phase instruction + gate/residual text) is externalized to an editable `gm-plugkit/instructions/` bundle, so editing prose is a gm-plugkit republish with no Rust rebuild. Mechanism (prose.rs per-key fallback to compiled const; sync-instruction-consts.mjs byte-aligns the .md and the rs-plugkit consts) in rs-learn (`recall: string-externalization project`).
+Repo root = package root = published `gm-skill` npm package; no factory, no separate build-output dir. Entry: `skills/gm/SKILL.md`. Orchestration lives in rs-plugkit, served on-demand via `instruction`. Agent-facing prose (phase instruction, gate/residual text) externalizes to editable `gm-plugkit/instructions/`: prose edits = gm-plugkit republish, zero Rust rebuild. Mechanism (prose.rs per-key fallback to compiled const; sync-instruction-consts.mjs byte-aligns .md<->rs-plugkit consts) in rs-learn (`recall: string-externalization project`).
 
 ## WASM-only
 
-The plugkit stack runs as a wasm cdylib loaded by `plugkit-wasm-wrapper.js` under Node/bun -- no native binaries built, downloaded, or published. The shipped `plugkit.wasm` is fetched at bootstrap from `plugkit-wasm` npm / `plugkit-bin` gh-releases, sha256-pinned. Size + embedded-model (offline in-wasm embeddings) mechanics in rs-learn (`recall: WASM-only plugkit size mechanics`).
+Plugkit = wasm cdylib, loaded by `plugkit-wasm-wrapper.js` under Node/bun; zero native binaries built/downloaded/published. `plugkit.wasm` fetched at bootstrap from `plugkit-wasm` npm / `plugkit-bin` gh-releases, sha256-pinned. Size + embedded-model (offline in-wasm embeddings) mechanics: rs-learn (`recall: WASM-only plugkit size mechanics`).
 
 Wasm host-import link-module rule (`#[link(wasm_import_module="env")]` on every host-import extern block, every dep crate): rs-learn (`recall: wasm host-import link-module trap`).
 
@@ -36,7 +36,7 @@ Wasm host-import link-module rule (`#[link(wasm_import_module="env")]` on every
 
 ## Spool dispatch ABI
 
-Agents dispatch verbs by writing `.gm/exec-spool/in/<verb>/<N>.txt` and reading `.gm/exec-spool/out/<verb>-<N>.json` (nested) or `out/<N>.json` (root). The wasm orchestrator services every verb; the harness never executes side effects directly.
+Dispatch = Write `.gm/exec-spool/in/<verb>/<N>.txt`, Read `.gm/exec-spool/out/<verb>-<N>.json` (nested) or `out/<N>.json` (root). Wasm orchestrator services every verb; harness never executes side effects directly.
 
 - **Orchestrator verbs**: `instruction`, `transition`, `phase-status`, `mutable-resolve`, `memorize-fire`, `residual-scan`, `auto-recall`.
 - **Wasm-direct verbs**: fs/kv/exec/fetch/env, recall, codesearch, memorize(+prune), health, filter, full git verb family. Enumeration in rs-learn (`recall: wasm-direct plugkit verbs full list`).
@@ -46,15 +46,15 @@ Agents dispatch verbs by writing `.gm/exec-spool/in/<verb>/<N>.txt` and reading
 
 ## Documentation Policy
 
-Record only non-obvious technical caveats that cost multiple runs to discover; remove what no longer applies; never document what is obvious from the code.
+Record only non-obvious multi-run-cost caveats; prune stale; never document the code-obvious.
 
 **No changelog history in AGENTS.md.** Every entry is a present-tense rule about what must/must-not be the case in code now. Forbidden: `(FIXED)` markers, commit hashes, dated audit entries, `## Learning audit` sections, "(added 2026-...)" annotations, "we used to X, now Y". History belongs in `git log` and `CHANGELOG.md`.
 
-**Detail-heavy caveats live in rs-learn (`.gm/rs-learn.db`), not here.** Per-crate runtime quirks, Windows process-spawn mechanics, hook details, ocw/site/workflow specifics, and similar fact-base material are exfiltrated to rs-learn (`exec:recall`); AGENTS.md keeps only top-level rules governing gm-the-repo. In doubt: cross-cutting policy stays here, single-crate/single-platform mechanism goes to rs-learn.
+**Detail-heavy caveats live in rs-learn (`.gm/rs-learn.db`), not here.** Per-crate/OS/hook/workflow fact-base -> rs-learn (`exec:recall`); AGENTS.md keeps top-level gm-repo-governing rules only. Cross-cutting policy stays; single-crate/single-platform mechanism drains.
 
-**gm's recall store (`.gm/rs-learn.db` default namespace) holds gm/rs-* method, tooling, and invariants ONLY -- never specifics of other projects gm is merely used ON.** A finding ABOUT a target project (its file paths, line numbers, `.gm/prd.yml`/`mutables.yml` contents, app/shader/UI internals, version numbers) is that project's knowledge and belongs in THAT project's own `.gm` store, not gm's -- memorizing it here pollutes every gm session's recall with foreign context. We work USING gm, not ON those projects: when a fix or lesson surfaces while gm drives another repo, memorize only the generalizable gm-method/tooling lesson, scrubbed of the project's names, paths, and state. This binds the `mutable-resolve`/`prd-resolve` auto-memo too: a witness_evidence string is durable recall, so witness in gm-method terms, not by quoting another project's tree. (A code-side classifier reject was judged too brittle -- it would false-reject legit gm memos that cite `.gm/prd.yml`/`mutables.yml` mechanisms -- so this discipline + on-sight `memorize-prune` of foreign-specific memos is the enforcement.)
+**gm's recall store (`.gm/rs-learn.db` default namespace) holds gm/rs-* method/tooling/invariants ONLY -- never target-project specifics.** A finding ABOUT a project gm merely drives ON (its paths, line numbers, `.gm/prd.yml`/`mutables.yml` contents, app internals, versions) belongs in THAT project's own `.gm` store -- pollutes every gm session's recall otherwise. Using gm != working on the driven project: scrub names/paths/state, keep only the generalizable gm-method lesson. Binds `mutable-resolve`/`prd-resolve` auto-memo too -- witness in gm-method terms, never by quoting foreign tree. (Code-side classifier reject rejected as too brittle -- false-rejects legit `.gm/prd.yml` mechanism citations -- so discipline + on-sight `memorize-prune` of foreign-specific memos is the enforcement.)
 
-**Every memorize run also drains AGENTS.md -- migration is bidirectional, deflation is the back-pressure.** AGENTS.md bloats past the budget it protects if flow is only inward, so every session firing `memorize-fire` for new facts ALSO exfiltrates a few existing detail-heavy/single-crate/single-platform entries: fire the substance to the default namespace, then delete or compress the paragraph to a one-line pointer in the same commit. Witnessed by the store gaining the fact AND the byte-count dropping. A few entries per run, never a wholesale rewrite; top-level rules stay, everything recall-reachable drains. `test.js checkAgentsMdBudget()` is the structural byte-ceiling backstop so the drain cannot silently lapse (`recall: AGENTS.md byte-ceiling guard looper bloat`).
+**Every memorize run also drains AGENTS.md -- bidirectional migration, deflation is the back-pressure.** Inward-only flow bloats past budget: every `memorize-fire` session ALSO exfiltrates a few detail-heavy/single-crate/single-platform entries -- fire substance to default namespace, compress paragraph to one-line pointer, same commit. Witness: store gains fact, byte-count drops. Few per run, never wholesale; top-level rules stay, recall-reachable detail drains. `test.js checkAgentsMdBudget()` = structural byte-ceiling backstop (`recall: AGENTS.md byte-ceiling guard looper bloat`).
 
 ## Coding Style
 
@@ -66,111 +66,111 @@ Record only non-obvious technical caveats that cost multiple runs to discover; r
 
 **Skill SKILL.md files:** strip explanatory prose; keep ONLY invocation syntax, transition markers (`->`), gate conditions, constraint lists, exact-usage code examples.
 
-**Implicit, not explicit, in skill prose.** Skill files (and prompt-submit.txt) elicit behavior, they do not describe it: terse imperative principles that trigger already-learned dispositions, not numbered procedures. A passage describes when the agent could re-derive it from the goal (a recipe, a do-X-then-Y sequence, a trigger-instance list, over-explained rationale, restated code-mechanism); it elicits when it constructs a predicament where the wrong move is structurally incoherent or self-evidently loses. Convert the former to the latter, but the boot-edge ABI a wrong guess breaks -- exact spool paths, JSON field names, verb names, file globs, deviation identifiers, gate names -- is non-derivable mechanism that stays explicit; only derivable procedure converts. Forbidden: step-by-step recipes, "see paper section X", citations to the site/papers, multi-step manuals. A skill that reads like a manual gets imitated as a script and breaks at the first edge case. The papers and site are outputs of the discipline, not inputs; never link from a skill into the docs. Cross-cutting rules needing a citation belong here, not in skills.
+**Implicit, not explicit, in skill prose.** Skill files (and prompt-submit.txt) elicit, never describe: terse imperatives triggering already-learned dispositions, not numbered procedures. Describes = agent could re-derive from the goal (recipe, do-X-then-Y, trigger-instance list, over-explained rationale, restated mechanism) -- convert. Elicits = constructs a predicament where the wrong move is structurally incoherent -- keep. Exception: boot-edge ABI (exact spool paths, JSON fields, verb names, globs, deviation ids, gate names) is non-derivable, stays explicit regardless. Forbidden: step-by-step recipes, "see paper section X", site/paper citations, multi-step manuals -- manual-shaped skill gets imitated as script, breaks at first edge case. Papers/site are discipline OUTPUTS, never link from a skill into docs. Cross-cutting rules needing citation belong here, not in skills.
 
 ## Build
 
-No build step; the repo root is the published artifact. `npm publish` from root publishes `gm-skill` (npm package id is permanent; only the skill DIRECTORY is `skills/gm`, so the command is `/gm`). `package.json` `files:` pins the shipped paths. `AnEntrypoint/gm-skill` is a back-compat mirror receiving only `skills/gm/SKILL.md` per release.
+No build step; repo root = published artifact. `npm publish` from root ships `gm-skill` (permanent npm id; skill DIR is `skills/gm`, command is `/gm`). `package.json` `files:` pins shipped paths. `AnEntrypoint/gm-skill` = back-compat mirror, receives only `skills/gm/SKILL.md` per release.
 
-`bin/install.js` is the canonical installer (no npx `skills` library, no marketplace); the dir name it lands IS the `/command`, and `test.js checkRenameAndInstaller()` is the structural guard. Copy-target, the four Claude Code settings it sets non-interactively, the reasoning-in-code framing, and the guard assertions in rs-learn (`recall: gm installer detail`).
+`bin/install.js` = canonical installer (no npx `skills` lib, no marketplace); landed dir name IS the `/command`; `test.js checkRenameAndInstaller()` = structural guard. Copy-target, four non-interactive Claude Code settings, reasoning-in-code framing, guard assertions: rs-learn (`recall: gm installer detail`).
 
 ## The agent is the orchestrator; plugkit is the brain it drives
 
-Plugkit is the stateful library the agent drives by dispatching verbs -- it does not act autonomously, advance phases in the background, or validate transitions while the agent waits. Every state change is a verb the agent writes into `.gm/exec-spool/in/<verb>/<N>.txt`; the dispatch ledger is ground truth, so zero dispatches with a narrated PLAN->COMPLETE walk = a fabricated walk. The PLAN -> EXECUTE -> EMIT -> VERIFY -> CONSOLIDATE -> COMPLETE state machine lives natively in rs-plugkit (phase/mutables/memorize/transition-legality as data + gate checks), but the agent triggers every operation; plugkit is synchronous from the agent's view, so polling the output dir instead of reading the response file is the canonical misuse. CONSOLIDATE owns git-push + CI/CD validation, split off the COMPLETE gate so COMPLETE checks only the consolidated result. File paths + verb enumeration in rs-learn (`recall: rs-plugkit state-machine internals`).
+Plugkit = stateful library the agent drives by verb dispatch -- never autonomous, never background-advances phases, never validates while agent waits. State change = verb written to `.gm/exec-spool/in/<verb>/<N>.txt`; dispatch ledger is ground truth, so zero-dispatch narrated PLAN->COMPLETE = fabricated. PLAN -> EXECUTE -> EMIT -> VERIFY -> CONSOLIDATE -> COMPLETE lives natively in rs-plugkit (phase/mutables/memorize/transition-legality as data + gate checks); agent triggers every op, plugkit synchronous from agent's view -- polling output dir instead of reading response = canonical misuse. CONSOLIDATE owns git-push + CI/CD validation, split off COMPLETE gate so COMPLETE checks only the consolidated result. File paths + verb enumeration: rs-learn (`recall: rs-plugkit state-machine internals`).
 
 ## gm is the canonical universal harness
 
-`skills/gm/SKILL.md` is the single source of truth; one skill shipped, legacy 15-platform fanout retired+archived. Canonical install: `bun x skills add AnEntrypoint/gm`. Detail in rs-learn (`recall: legacy gm-skill variants retired`).
+`skills/gm/SKILL.md` = single source of truth; one skill shipped, legacy 15-platform fanout retired. Install: `bun x skills add AnEntrypoint/gm`. Detail: rs-learn (`recall: legacy gm-skill variants retired`).
 
 ## Tool surface is plugkit-only
 
-Every skill's `allowed-tools:` is reduced to `Skill, Read, Write` (plus the SKILL.md boot commands `Bash(bun *)`/`Bash(npx *)`); `Write` is permitted exclusively for spool dispatch. Every other side effect -- code execution, git, browser, recall, memorize, codesearch -- routes through the spool and is serviced by plugkit. The harness never reaches around plugkit; a missing capability is a new plugkit verb, not a skill-side tool.
+Every skill's `allowed-tools:` reduced to `Skill, Read, Write` (plus SKILL.md boot `Bash(bun *)`/`Bash(npx *)`); `Write` exclusively for spool dispatch. Every other side effect -- exec, git, browser, recall, memorize, codesearch -- routes spool -> plugkit. Never reach around plugkit; missing capability = new plugkit verb, not skill-side tool.
 
 ## Core Rules
 
-**Shared memory & search index are tracked, never ignored**: `.gm/rs-learn.db` and `.gm/code-search/` are committed so state shares across machines, sessions, CI runs. Never add `.gm/`, `.gm/rs-learn.db`, `.gm/code-search/`, or legacy `.code-search/` to ignore rules; transient `.gm/*` entries are listed one-by-one between the managed markers (parent-re-include caveat). Entry list + `ensureGitignored` mechanics in rs-learn (`recall: gm managed-gitignore mechanics`). Project-local persistent state writes under `.gm/<name>/`, never a top-level dotfile/dotdir.
+**Shared memory & search index are tracked, never ignored**: `.gm/rs-learn.db`, `.gm/code-search/` committed -- state shares cross-machine/session/CI. Never gitignore `.gm/`, `.gm/rs-learn.db`, `.gm/code-search/`, legacy `.code-search/`; transient `.gm/*` entries listed one-by-one between managed markers (parent-re-include caveat). Entry list + `ensureGitignored` mechanics: rs-learn (`recall: gm managed-gitignore mechanics`). Project-local persistent state -> `.gm/<name>/`, never top-level dotfile/dotdir.
 
-**Disciplines are isolated knowledge stores**: per-project at `<project>/.gm/disciplines/<name>/{rs-learn.db, code-search/}`, each owning its own DB + index. A `@<name>` sigil makes isolation strict (cross-discipline reads forbidden). Without a sigil, reads (recall/codesearch) fan across `default` plus every enabled discipline (one per line in `enabled.txt`), merge-ranked with `[discipline:<name>]` prefixes; writes without a sigil go to `default` only. Disciplines are tracked, never ignored (`ensureGitignored` must not list `.gm/disciplines` or any subpath). The harness and every spool verb propagate the `@<name>` sigil verbatim.
+**Disciplines are isolated knowledge stores**: per-project `<project>/.gm/disciplines/<name>/{rs-learn.db, code-search/}`, own DB+index each. `@<name>` sigil = strict isolation (cross-discipline reads forbidden). Sigil-less reads (recall/codesearch) fan across `default` + every `enabled.txt` line, merge-ranked `[discipline:<name>]`-prefixed; sigil-less writes -> `default` only. Tracked, never ignored (`ensureGitignored` excludes `.gm/disciplines`). Harness + every spool verb propagate `@<name>` verbatim.
 
-**Nothing fake in source the user runs**: every stub, mock, placeholder return, fixture-only path, demo-mode short-circuit, and "TODO: implement" body is forbidden in shipped code. Scaffolds/shims are permitted only when they delegate to real behavior (real upstream API, subprocess, disk); before adding a shim, check whether a published library already provides the surface. Detection is behavioral: code that always succeeds, returns the same value regardless of input, or short-circuits a real call to satisfy a type signature is a stub. Acceptance is real input through real code into real output, witnessed.
+**Nothing fake in source the user runs**: stub/mock/placeholder-return/fixture-only-path/demo-mode-short-circuit/"TODO: implement" forbidden in shipped code. Scaffolds/shims permitted only delegating to real behavior (upstream API, subprocess, disk); check for an existing library before adding a shim. Detection = behavioral: always-succeeds, input-invariant, or type-signature-satisfying short-circuit = stub. Acceptance = real input through real code into real output, witnessed.
 
-**Spool dispatch gates**: gate denials surface the reason as imperative instruction, never mutate args. Implementation + marker semantics in rs-learn (`recall: spool dispatch gates marker files`).
+**Spool dispatch gates**: denials surface reason as imperative instruction, never mutate args. Implementation + marker semantics: rs-learn (`recall: spool dispatch gates marker files`).
 
-**Done is plugkit's pronouncement, never the agent's claim**: the chain is COMPLETE only when `transition to=COMPLETE` returns COMPLETE phase and the on-disk state file reflects it. The COMPLETE gate (gates.rs) is the single arbiter -- it refuses on PRD-open, mutables-unresolved, dirty worktree, or missing residual-scan marker. The agent drives the chain into a gate-allowing state, dispatches the verb, reads the response; every alternative is narration.
+**Done is plugkit's pronouncement, never the agent's claim**: COMPLETE only when `transition to=COMPLETE` returns COMPLETE phase, on-disk state reflects it. COMPLETE gate (gates.rs) = sole arbiter -- refuses on PRD-open, mutables-unresolved, dirty worktree, missing residual-scan marker. Agent drives into gate-allowing state, dispatches, reads response; every alternative is narration.
 
-**Every residual is triaged this turn, never named-and-deferred**: every `git status --porcelain` entry at residual-scan or COMPLETE-attempt is triaged now -- (a) commit (real session/upstream work), (b) add to the managed gitignore block (transient runtime emission like `.gm/witness/`, `.gm/exec-spool/.*-stale.json`), or (c) revert (junk). "Pre-existing residual" is the outcome of triage (a)/(c), never a stop excuse. `blockedBy: external` is admissible only when triage needs authority this session cannot reach; for local-tree files the agent always has authority. Disciplines are tracked; new memorize-fire `mem-*.json` are committed. The managed block (between `# >>> plugkit managed` markers) carries only runtime artifacts with no future read value.
+**Every residual is triaged this turn, never named-and-deferred**: every `git status --porcelain` entry at residual-scan/COMPLETE-attempt triaged now -- (a) commit (real work), (b) managed-gitignore-block (transient runtime emission, e.g. `.gm/witness/`, `.gm/exec-spool/.*-stale.json`), (c) revert (junk). "Pre-existing" = the (a)/(c) outcome, never a stop excuse. `blockedBy: external` admissible only when triage needs unreachable authority; local-tree files always agent-authoritative. Disciplines + new memorize-fire `mem-*.json` committed. Managed block (`# >>> plugkit managed` markers) carries only zero-future-read-value runtime artifacts.
 
-**"Every possible" is the load-bearing test, applied to every noun the request names**: PLAN-phase PRD construction is exhaustive, not minimal -- "every possible" task/validation/mutable/corner-case/caveat/failure-mode/interaction/empty-overflow-reentry/degenerate-input produces rows. A non-trivial request yielding a single-digit PRD has not finished enumerating. After the first pass, the list feeds a second transform: for each row, what every possible corner case looks like becomes more rows; closed when applying "every possible" yields nothing new, not when the agent feels done. Validations, edge cases, anticipated mutables are first-class rows. Long-horizon requests routinely produce high-tens-to-hundreds; the row count is the resolution of the cover, which is what the user asked for. Sparse PRDs orphan the work; dense PRDs make completion observable.
+**"Every possible" is the load-bearing test, applied to every noun the request names**: PLAN-phase PRD = exhaustive, not minimal -- "every possible" task/validation/mutable/corner-case/caveat/failure-mode/interaction/empty-overflow-reentry/degenerate-input -> rows. Single-digit PRD on non-trivial request = enumeration unfinished. Second-pass transform: each row's every-possible-corner-case -> new rows; close only when the transform yields nothing new. Validations/edge-cases/anticipated-mutables = first-class rows. High-tens-to-hundreds is the expected long-horizon shape -- row count IS the cover's resolution. Sparse PRDs orphan work; dense PRDs make completion observable.
 
-**Every possible aspect that can be checked for jank is a PRD row; the architecture is pliable**: at PLAN, for every surface the prompt concerns, enumerate every aspect checkable for `jank` -- every immaturity, unfinished edge, half-wired path -- across gui/ux/ui/client-state/server-state/the boundary and any surface reached, each its own row including a profiling row and a security row per surface. `jank` is load-bearing: hunt the rough/unpolished/almost-done, not only outright bugs. Scoped to the prompt's concern + its reachable closure, exhaustive within it. Every issue found opens its own debug-and-repair plan spooled the same turn; every quick improvement is spooled too. `pliable`: every architectural change that clearly improves or reduces maintenance burden is a spooled plan -- replacing bespoke code with native functionality or a popular well-maintained library is encouraged ONLY when it nets a smaller maintained surface (a heavy dep for a few lines is the guarded failure mode). Fan-out is the spool-native shape (parallel `prd-add`/`codesearch`/`exec_js`, plugkit task-spawn), never the platform's Task/Explore subagent. One tell-tale AI design element (boilerplate flourish, over-hedged comment, generic scaffold name, machine-authored shape) spawns a full-codebase sweep plan -- scan/per-cluster/fix-and-verify rows, exhaustive over every file, never a one-off fix.
+**Every possible aspect checkable for jank is a PRD row; architecture is pliable**: at PLAN, every prompt-concerned surface -> enumerate every `jank` (immaturity/unfinished-edge/half-wired-path) across gui/ux/ui/client-state/server-state/boundary + reached surfaces, each its own row plus a per-surface profiling row and security row. `jank` = rough/unpolished/almost-done, not just bugs. Scoped to prompt's reachable closure, exhaustive within it. Every found issue spawns its own debug-repair plan same turn; every quick win spooled too. `pliable`: architectural change clearly reducing maintenance burden = spooled plan -- swap bespoke code for native/well-maintained-library ONLY when it nets a SMALLER maintained surface (heavy dep for a few lines = guarded failure mode). Fan-out = spool-native (parallel `prd-add`/`codesearch`/`exec_js`, plugkit task-spawn), never platform Task/Explore. One AI-tell design element (boilerplate flourish, over-hedged comment, generic scaffold name) spawns full-codebase sweep -- scan/per-cluster/fix-verify rows, exhaustive, never one-off.
 
-**Client-side debugging exposes globals and evaluates in-browser, never blind-restarts**: the live page is the debugger (rs-learn: `recall: client-side-debug-globals-live-page`).
+**Client-side debugging exposes globals and evaluates in-browser, never blind-restarts**: live page = the debugger (rs-learn: `recall: client-side-debug-globals-live-page`).
 
-**Mundane user-facing output is suppressed or stripped to the bone**: drop articles, preamble, play-by-play; boot-probe narration, dispatch echoes, restating prose just read, status recaps do not ship. What survives is substantive: a real finding, a decision + one-line reason, a blocker, the single-line PRD-read declaration. Terse = fewer/shorter words, NEVER zero tool calls and NEVER silent work -- the turn still ends in the chain-advancing tool call.
+**Mundane user-facing output is suppressed or stripped to the bone**: drop articles/preamble/play-by-play/boot-probe narration/dispatch echoes/restated-prose/status recaps. Survives: real finding, decision+one-line-reason, blocker, single-line PRD-read declaration. Terse = fewer words, NEVER zero tool calls, never silent work -- turn still ends chain-advancing.
 
-**Noticing is a planning event, at every phase, in every dispatch window**: any observation -- anything outstanding, unfinished, improvable, misaligned with user preferences, or that the work surfaces about what else it touches -- is a `prd-add` this turn. Observations carried in the response body without conversion evaporate when the turn ends; only the PRD store survives. Density grows along the walk, not just at PLAN-time; a chain exiting PLAN with N rows and reaching COMPLETE with N rows has lost its discoveries. Structural noticing ("no test coverage on X", "docs miss Y", "commit Z violates a rule") and preference-aware noticing (state diverging from dense-PRDs/residual-triage/no-name-and-defer/every-possible-expansion/browser-witness/push-on-clean) each become a row with the witness that motivated it.
+**Noticing is a planning event, at every phase, in every dispatch window**: any observation (outstanding/unfinished/improvable/preference-misaligned/adjacent-surface) -> `prd-add` this turn. Response-body-only observations evaporate; only PRD store survives. Density grows along the walk, not just PLAN -- exiting PLAN with N rows and reaching COMPLETE with N rows = lost discoveries. Structural noticing (missing coverage/docs, rule-violating commit) and preference-aware noticing (drift from dense-PRDs/residual-triage/no-defer/every-possible/browser-witness/push-on-clean) each -> a row with its witness.
 
-**A turn without a tool call is a stop; summary is a stop; both are forbidden until plugkit pronounces COMPLETE**: every programming agent reads only tool calls and their outputs, so a prose-only message ends the turn and halts the session -- the mechanical root of "agent did one piece and stopped". Deferred intent is the same stop facing forward (a turn-final sentence naming the next move instead of making it strands the chain where the prose pointed). Absolute and tool-agnostic: while in-flight (phase != COMPLETE OR prd_pending_count > 0) the agent NEVER ends a turn in prose -- every turn ends in a chain-advancing tool call (`instruction`, the next named verb, `transition`, `phase-status`). Surface a decision through `AskUserQuestion` or `prd-add`, never a prose-only "confirming direction." Only `phase=COMPLETE` AND `prd_pending_count=0` authorizes a prose-only turn; the agent's sense that "the work feels done" authorizes nothing. Before any apparent stop, dispatch `phase-status` and recheck. Depends only on the verb spool, so it holds on every agent with no hook.
+**A turn without a tool call is a stop; summary is a stop; both forbidden until plugkit pronounces COMPLETE**: agents read only tool calls+outputs, so prose-only ends the turn -- mechanical root of "did one piece and stopped." Deferred intent = same stop facing forward (naming the next move instead of taking it strands the chain). Absolute, tool-agnostic: in-flight (phase!=COMPLETE OR prd_pending_count>0) -> every turn ends in chain-advancing dispatch (`instruction`, next verb, `transition`, `phase-status`). Decisions surface via `AskUserQuestion`/`prd-add`, never prose. Only `phase=COMPLETE AND prd_pending_count=0` authorizes prose-only; "feels done" authorizes nothing. Apparent stop -> dispatch `phase-status`, recheck.
 
-**Always seek the next state transition**: not-COMPLETE means a next move exists; idle mid-chain is a deviation. `phase-status` tells you where you are, `instruction` what's next. No "I'll wait for the user" mid-chain -- the user authorized closure at request time, not phase-by-phase.
+**Always seek the next state transition**: not-COMPLETE = next move exists; idle mid-chain = deviation. `phase-status` = where; `instruction` = what's next. No "wait for user" mid-chain -- closure was authorized at request time.
 
-**Return to plugkit on every possible drift**: `instruction` is the recovery primitive -- against every stall, gate-denial, error, or uncertainty, dispatch `instruction` and read the prose, never improvise. Synchronous, cheap, idempotent; over-dispatching has no cost, under-dispatching is the canonical drift mechanism. Every gate denial names the next verb in its `reason` field; read it and dispatch that verb, never argue around the denial.
+**Return to plugkit on every possible drift**: `instruction` = sole recovery primitive -- stall/gate-denial/error/uncertainty -> dispatch, read, never improvise. Synchronous, cheap, idempotent; over-dispatch free, under-dispatch = canonical drift. Gate denial names next verb in `reason`; dispatch that, never argue around it.
 
-**Push is part of COMPLETE, never optional, never asked**: every session that mutates tracked files ends with commit + push to origin. Asking "do you want me to push?" is a deviation -- the push IS the validation dispatch (`verify.rs`). The chain is not COMPLETE until the remote reflects HEAD. ccsniff `--git-discipline` and `deviation.complete-without-push` flag sessions closing without pushing.
+**Push is part of COMPLETE, never optional, never asked**: tracked-file-mutating session ends commit+push to origin. "Want me to push?" = deviation -- push IS the validation dispatch (`verify.rs`). Not-COMPLETE until remote reflects HEAD. ccsniff `--git-discipline` + `deviation.complete-without-push` flag unpushed closes.
 
-**Direct-push to main, never a branch, never a PR**: every gm/rs-* change commits straight to `main` and pushes; the git verbs (`git_finalize`/`git_push`) already target `main`, and the cascade ships from `main`. A feature branch, PR, or fork is a deviation -- the workflow has no review-gate, the push IS the validation dispatch. For a sibling repo with an open PR, merge to `main`, push, delete the branch. The only admissible remote refs are `main` and `gh-pages`; holds for siblings via `git_push {repo, branch:"main"}` as for gm.
+**Direct-push to main, never a branch, never a PR**: every gm/rs-* change -> straight `main` commit+push; git verbs (`git_finalize`/`git_push`) already target `main`, cascade ships from `main`. Branch/PR/fork = deviation, no review-gate exists. Sibling repo with open PR: merge to `main`, push, delete branch. Only admissible remote refs: `main`, `gh-pages` -- `git_push {repo, branch:"main"}` for siblings too.
 
-**Push requires clean worktree witnessed in its own tool-use event**: `git push` only when `git status --porcelain` is empty, the probe its own Bash event before the push (never `&&`-chained). Prefer `git_push`/`git_finalize` (gate internally). Enforcement locations in rs-learn (`recall: push clean worktree enforcement locations`).
+**Push requires clean worktree witnessed in its own tool-use event**: `git push` only on empty `git status --porcelain`, probed its OWN Bash event before push (never `&&`-chained). Prefer `git_push`/`git_finalize` (internal gate). Enforcement locations: rs-learn (`recall: push clean worktree enforcement locations`).
 
-**AGENTS.md / CLAUDE.md are inline-edited AND dual-written to the store**: edit them inline for structural rules (the only doc surviving context summarization), AND `memorize-fire` the same rule so `recall`/`auto_recall` surface it later -- complementary, not alternatives. Never `namespace:"AGENTS.md"`; load-bearing rules go to the default namespace. Mechanics in rs-learn (`recall: memorize-fire ingestion classifier`).
+**AGENTS.md / CLAUDE.md are inline-edited AND dual-written to the store**: inline-edit for structural rules (only doc surviving context summarization), AND `memorize-fire` the same rule for `recall`/`auto_recall` surfacing -- complementary, not either/or. Never `namespace:"AGENTS.md"`; load-bearing rules -> default namespace. Mechanics: rs-learn (`recall: memorize-fire ingestion classifier`).
 
-**A memorized workaround is a tool defect; transform it, never accumulate it**: we work USING gm, not ON it, so a `recall` memo framed as a workaround, known-limitation, or internal-advice is tribal knowledge a fresh user/LLM lacks -- the tool then surprises them, and surprises are never allowed; everything must be abundantly predictable at face value. Resolve: (a) already in standing prose -> prune recall; (b) prose-worthy but absent -> add to prose then prune; (c) genuinely surprising behavior -> fix code so it is predictable then prune.
+**A memorized workaround is a tool defect; transform it, never accumulate it**: using gm != working on gm, so a workaround/known-limitation-framed `recall` memo is tribal knowledge that surprises a fresh user/LLM -- surprises forbidden, everything must be predictable at face value. Resolve: (a) already in standing prose -> prune; (b) prose-worthy, absent -> add then prune; (c) genuinely surprising -> fix code predictable then prune.
 
-**Behavioral discipline lives in plugkit's `instruction` verb**: dispatch `instruction` for the live phase-specific prose (Three-Layer Admission Filter, maturity-first emit, closure anti-shapes, code invariants); do not duplicate it here. Enumeration in rs-learn (`recall: instruction-verb behavioral discipline invariants`).
+**Behavioral discipline lives in plugkit's `instruction` verb**: dispatch `instruction` for live phase-specific prose (Three-Layer Admission Filter, maturity-first emit, closure anti-shapes, code invariants); not duplicated here. Enumeration: rs-learn (`recall: instruction-verb behavioral discipline invariants`).
 
-**The agent IS the LLM rs-learn calls**: no separate judge model; all decisions are inline via spool. Internals in rs-learn (`recall: rs-learn self-report core internals`).
+**The agent IS the LLM rs-learn calls**: no separate judge model; decisions inline via spool. Internals: rs-learn (`recall: rs-learn self-report core internals`).
 
-**Idempotency contract (f∘f≡f)**: the spool dispatch layer is at-least-once by design (the in-memory processed-Map guards only concurrent double-pickup, not cross-time replay or restart), so correctness rests on every state-mutating verb being individually convergent: `memorize`/`memorize-fire` content-hash key + dedup, `git_finalize`/`git_commit` nothing-to-commit/already-pushed, `insert_edge` kv-overwrite-by-id + dedup-guarded index, `invalidate_edge` early-return, `ensure_managed_gitignore` strip-rebuild-changed-gate, codeinsight digest-gate, publish.yml already-published-skip + porcelain-gated version-commit-back. Read-only verbs (recall/codesearch/git_status/instruction/health/filter) recompute every dispatch, never cache. `exec_js`/`browser` re-run on replay (at-most-once-by-nature); a persistent dedup ledger was rejected as net-additive. Detail in rs-learn (`recall: idempotency contract per-verb convergence`).
+**Idempotency contract (f∘f≡f)**: spool dispatch = at-least-once by design (in-memory processed-Map guards only concurrent double-pickup, not cross-time replay/restart), so correctness rests on per-verb convergence: `memorize`/`memorize-fire` content-hash-key+dedup, `git_finalize`/`git_commit` nothing-to-commit/already-pushed, `insert_edge` kv-overwrite-by-id+dedup-guarded-index, `invalidate_edge` early-return, `ensure_managed_gitignore` strip-rebuild-changed-gate, codeinsight digest-gate, publish.yml already-published-skip+porcelain-gated-version-commit-back. Read-only verbs (recall/codesearch/git_status/instruction/health/filter) recompute every dispatch, never cache. `exec_js`/`browser` re-run on replay (at-most-once-by-nature); persistent dedup ledger rejected as net-additive. Detail: rs-learn (`recall: idempotency contract per-verb convergence`).
 
-**host_exec_js is synchronous**: pass a real per-call `timeoutMs` (zero/missing is a hard error). Detail in rs-learn (`recall: host_exec_js synchronous`).
+**host_exec_js is synchronous**: real per-call `timeoutMs` required (zero/missing = hard error). Detail: rs-learn (`recall: host_exec_js synchronous`).
 
-**Sync-before-emit (codeinsight + search)**: output must come from a freshly-synced index this invocation (cache serves only on digest match). Mechanics in rs-learn (`recall: sync-before-emit codeinsight search`).
+**Sync-before-emit (codeinsight + search)**: output must come from this-invocation freshly-synced index (cache serves only on digest match). Mechanics: rs-learn (`recall: sync-before-emit codeinsight search`).
 
-**Auto-recall on turn entry**: `instruction` attaches an `auto_recall` pack on the first dispatch after a >30s idle gap or session-start. Detail in rs-learn (`recall: auto-recall on turn entry`).
+**Auto-recall on turn entry**: `instruction` attaches `auto_recall` pack on first dispatch after >30s idle gap / session-start. Detail: rs-learn (`recall: auto-recall on turn entry`).
 
-**Skill SKILL.md frontmatter `allowed-tools:` is harness-enforced**: a skill must list `Skill` (and `Read`/`Write`, Write only for spool dispatch) or it loses downstream-skill invocation that turn. Detail in rs-learn (`recall: SKILL.md frontmatter allowed-tools`).
+**Skill SKILL.md frontmatter `allowed-tools:` is harness-enforced**: must list `Skill` (+`Read`/`Write`, Write only for spool dispatch) or loses downstream-skill invocation that turn. Detail: rs-learn (`recall: SKILL.md frontmatter allowed-tools`).
 
-**rs-learn observability**: learning-pipeline state changes emit `evt:` lines to `.gm/exec-spool/.watcher.log` + gm-log; recall replies carry per-hit scoring fields. Surface + taxonomy + flags in rs-learn (`recall: rs-learn observability taxonomy`).
+**rs-learn observability**: pipeline state changes emit `evt:` lines to `.gm/exec-spool/.watcher.log` + gm-log; recall replies carry per-hit scoring fields. Taxonomy: rs-learn (`recall: rs-learn observability taxonomy`).
 
-**Bootstrap contract**: `ensureReady` initializes wasm hook-free, sha256-rewrites a stale installed SKILL.md, and seeds per-project `CLAUDE.md`/`.gm/next-step.md`. Detail in rs-learn (`recall: skill-initiated bootstrap contract`, `recall: SKILL.md auto-refresh`).
+**Bootstrap contract**: `ensureReady` inits wasm hook-free, sha256-rewrites stale installed SKILL.md, seeds per-project `CLAUDE.md`/`.gm/next-step.md`. Detail: rs-learn (`recall: skill-initiated bootstrap contract`, `recall: SKILL.md auto-refresh`).
 
 ## Cascade pipeline
 
-Push to any rs-* sibling triggers `cascade.yml` -> rs-plugkit `release.yml` -> single `plugkit.wasm` (npm `plugkit-wasm` + `plugkit-bin` Releases) -> auto-bump `gm.json::plugkitVersion` -> `publish.yml` ships gm-skill + gm-plugkit + the SKILL.md mirror. Step sequence + PUBLISHER_TOKEN setup in rs-learn (`recall: cascade pipeline`).
+Push to any rs-* sibling -> `cascade.yml` -> rs-plugkit `release.yml` -> single `plugkit.wasm` (npm `plugkit-wasm` + `plugkit-bin` Releases) -> auto-bump `gm.json::plugkitVersion` -> `publish.yml` ships gm-skill+gm-plugkit+SKILL.md mirror. Step sequence + PUBLISHER_TOKEN: rs-learn (`recall: cascade pipeline`).
 
-**Repos involved (push to any triggers cascade):** `AnEntrypoint/{rs-exec, rs-codeinsight, rs-search, rs-plugkit, rs-learn, gm}` -- rs-plugkit Cargo.toml is the version source-of-truth, gm.json holds plugkitVersion. Three npm packages ship: `gm-skill`, `gm-plugkit`, `plugkit-wasm`. Per-repo roles + legacy-retirement detail in rs-learn (`recall: cascade repos involved roles`, `recall: legacy gm-skill variants retired`).
+**Repos involved (push to any triggers cascade):** `AnEntrypoint/{rs-exec, rs-codeinsight, rs-search, rs-plugkit, rs-learn, gm}` -- rs-plugkit Cargo.toml = version source-of-truth, gm.json holds plugkitVersion. Three npm packages ship: `gm-skill`, `gm-plugkit`, `plugkit-wasm`. Per-repo roles + legacy-retirement: rs-learn (`recall: cascade repos involved roles`, `recall: legacy gm-skill variants retired`).
 
-**To update every possible thing**: push to the relevant repo. No manual version bumps, no local cargo builds -- never run `cargo update`/`cargo build` locally, push and let CI build.
+**To update every possible thing**: push to the relevant repo. No manual version bumps, no local `cargo update`/`cargo build` -- push, let CI build.
 
 ## Spool-dispatch architecture replaces hooks
 
-Orchestration state is tracked via `.gm/` marker files, not hook events; the CLI layer calls `checkDispatchGates()` before tool execution to gate Write/Edit/git. Marker set (`prd.yml, mutables.yml, needs-gm, gm-fired-<sessionId>, residual-check-fired`) + SpoolDispatcher mechanism in rs-learn (`recall: gate enforcement layer`, `recall: spool dispatch gates marker files`).
+Orchestration state tracked via `.gm/` marker files, not hook events; CLI's `checkDispatchGates()` gates Write/Edit/git pre-execution. Marker set (`prd.yml, mutables.yml, needs-gm, gm-fired-<sessionId>, residual-check-fired`) + SpoolDispatcher mechanism: rs-learn (`recall: gate enforcement layer`, `recall: spool dispatch gates marker files`).
 
-**gm tool-use sequencing**: `Skill(skill="gm")` clears the needs-gm gate. One shipped skill, no subagent variant. Marker mechanics in rs-learn (`recall: gm-skill tool-use sequencing mechanics`).
+**gm tool-use sequencing**: `Skill(skill="gm")` clears needs-gm gate. One shipped skill, no subagent variant. Marker mechanics: rs-learn (`recall: gm-skill tool-use sequencing mechanics`).
 
-**The skill is the driver, not a post-hoc witness**: when a request carries the standing instruction to use the gm skill (every `/loop` fire, any prompt naming `/gm`), the FIRST working action is `Skill(skill="gm")`, and the skill prose drives the chain PLAN->COMPLETE. Dispatching spool verbs directly without first entering the skill executes the work outside the skill the user asked to drive it; entering only at the end to confirm terminal state does NOT satisfy the instruction. The boot probe (`cat .gm/exec-spool/.status.json` ...) is prescribed by the skill and may precede invocation; everything that mutates state happens inside the skill-driven session.
+**The skill is the driver, not a post-hoc witness**: standing instruction to use gm skill (every `/loop` fire, any `/gm` prompt) -> FIRST action is `Skill(skill="gm")`, skill prose drives PLAN->COMPLETE. Direct spool verbs without entering the skill first = work executed outside the requested driver; end-only entry to confirm terminal state does NOT satisfy the instruction. Boot probe (`cat .gm/exec-spool/.status.json` ...) may precede invocation; every state mutation happens inside the skill-driven session.
 
-**Dead-watcher recovery uses `bun x gm-plugkit@latest spool`, never direct-node boot** (mechanism in rs-learn: `recall: dead-watcher recovery bun x not direct-node`).
+**Dead-watcher recovery uses `bun x gm-plugkit@latest spool`, never direct-node boot** (mechanism: rs-learn `recall: dead-watcher recovery bun x not direct-node`).
 
-**Starting the spool is one atomic blocking call -- `bun x gm-plugkit@latest spool` daemonizes the watcher AND blocks until `.status.json` heartbeats fresh, returning exit 0 only when serving (loud non-zero on timeout).** No `& + sleep + re-cat` boot dance; the agent writes to `instruction/` the moment the call returns. The wait lives in `gm-plugkit/cli.js` (`waitForWatcherHeartbeat`, `Atomics.wait` sync-sleep), cli-side because `startSpoolDaemon` is sync and shared by non-blocking callers. rs-plugkit carries no server-boot logic -- the daemonize lifecycle is entirely gm-plugkit JS, so this change needs no Rust/cascade rebuild.
+**Starting the spool is one atomic blocking call -- `bun x gm-plugkit@latest spool` daemonizes the watcher AND blocks until `.status.json` heartbeats fresh, returning exit 0 only when serving (loud non-zero on timeout).** No `& + sleep + re-cat` dance; agent writes to `instruction/` the moment the call returns. Wait lives in `gm-plugkit/cli.js` (`waitForWatcherHeartbeat`, `Atomics.wait` sync-sleep), cli-side since `startSpoolDaemon` is sync + shared by non-blocking callers. rs-plugkit carries no server-boot logic -- daemonize lifecycle is entirely gm-plugkit JS, no Rust/cascade rebuild needed.
 
-**Apparent tooling failure is mechanical self-recovery, NEVER a question for the user and never an a/b-test/blind-restart.** A missing spool response / stale watcher is the agent's own job: honor a future `busy_until` else boot the watcher and re-dispatch -- the spooler is sound by construction, so asking the user to do what a verb can do is a paper-spirit violation. Recovery mechanics (atomic `.status.json`, `FailedToOpenSocket` retry, debug-via-`window.*`-globals) in rs-learn (`recall: spooler self-recovery mechanics`).
+**Apparent tooling failure is mechanical self-recovery, NEVER a question for the user and never an a/b-test/blind-restart.** Missing spool response / stale watcher = agent's own job: honor future `busy_until` else boot+re-dispatch -- spooler is sound by construction, asking the user to do what a verb can do is a paper-spirit violation. Recovery mechanics (atomic `.status.json`, `FailedToOpenSocket` retry, debug-via-`window.*`-globals): rs-learn (`recall: spooler self-recovery mechanics`).
 
-**Process-of-elimination is the debugging paradigm EVERYWHERE, and manual real-services witness is the verification paradigm EVERYWHERE** -- both stated in `instructions/execute.md` (served EXECUTE prose). Detail in rs-learn (`recall: process-of-elimination manual-real-services-witness paradigm`).
+**Process-of-elimination is the debugging paradigm EVERYWHERE, and manual real-services witness is the verification paradigm EVERYWHERE** -- both stated in `instructions/execute.md` (served EXECUTE prose). Detail: rs-learn (`recall: process-of-elimination manual-real-services-witness paradigm`).
 
-**The first verb after a genuine multi-minute IDLE is `instruction`, to reset the long-gap clock**: only spool verbs reset it, so a long investigation in platform tools trips a false stall -- interleave `instruction`/`prd-add` to stay warm, and dispatch `instruction` BEFORE any predictable blocking wait. Threshold + platform-tool exception in rs-learn (`recall: first verb after multi-minute wait instruction long-gap`).
+**The first verb after a genuine multi-minute IDLE is `instruction`, to reset the long-gap clock**: only spool verbs reset it, so long platform-tool investigation trips false stall -- interleave `instruction`/`prd-add` to stay warm, dispatch `instruction` BEFORE any predictable blocking wait. Threshold + exception: rs-learn (`recall: first verb after multi-minute wait instruction long-gap`).
 
-**A stop-hook firing on a terminal chain does not authorize re-polling**: when a stop-hook fires while already at `phase=COMPLETE` AND `prd_pending_count=0`, re-dispatching `instruction`/`phase-status` to "re-confirm" is a deviation (`deviation.complete-chain-poll`, `instructions/mod.rs`). Two admissible responses: (a) a prose-only turn (COMPLETE is in hand), or (b) genuinely new planned work opened with a FRESH `{"prompt":...}` body (resets phase to PLAN, driven through the skill). Repeatedly answering the same hook is a loop; state the terminal facts once and stop, or open new work.
+**A stop-hook firing on a terminal chain does not authorize re-polling**: stop-hook at `phase=COMPLETE AND prd_pending_count=0` -> re-dispatching `instruction`/`phase-status` to "re-confirm" = deviation (`deviation.complete-chain-poll`, `instructions/mod.rs`). Two admissible responses: (a) prose-only turn (COMPLETE in hand), (b) genuinely new work via FRESH `{"prompt":...}` body (resets to PLAN, skill-driven). Repeated same-hook answering = loop; state terminal facts once and stop, or open new work.
 
 Session lifecycle (task/browser persistence across turn-stops, residual-scan trigger conditions): rs-learn (`recall: session lifecycle killSessionTasks residual-scan`).
 
@@ -180,13 +180,13 @@ Browser session state roots at the git common dir, never `process.cwd()` (worktr
 
 ## Spool observability surface
 
-One-shot system-state probe: dispatch `plugkit health` via the file-spool before assuming any component is broken; the runtime diagnostic files at `.gm/exec-spool/` root are readable directly via Read (runtime-data exception). File list + health fields in rs-learn (`recall: spool runtime diagnostic files`, `recall: plugkit health verb fields`).
+One-shot system-state probe: dispatch `plugkit health` before assuming any component broken; runtime diagnostic files at `.gm/exec-spool/` root readable directly via Read (runtime-data exception). File list + health fields: rs-learn (`recall: spool runtime diagnostic files`, `recall: plugkit health verb fields`).
 
 ## Site Build & Documentation
 
-Site build + landing render is single-surface detail, fully drained to rs-learn (`recall: gm site build details`).
+Site build + landing render: single-surface detail, drained to rs-learn (`recall: gm site build details`).
 
-**The site consumes the `anentrypoint-design` SDK pro-rata, never overriding it.** `site/theme.mjs` loads the SDK at runtime (`unpkg.com/anentrypoint-design@latest`) and the local `<style>` carries ONLY render-mode plumbing (flatspace html-class toggles `article-flow`/`landing-cap`, the crumb media query) plus site article-layout rhythm that is not an SDK component -- never a themed visual component. Every graphic-design change (a token, a component's look, TOC/cli/panel/card/callout styling) is made IN the SDK repo (`../anentrypoint-design`, GitHub `AnEntrypoint/design`, npm `anentrypoint-design`) as a token-only sheet and published; the site picks it up via `@latest`. A new local CSS rule that styles a visual component is a deviation -- it belongs in the SDK. SDK component sheets are lint-gated literal-free (every color a `var(--token)`); the SDK build prefixes all selectors with the `.ds-247420` scope. Mechanism in rs-learn (`recall: design SDK pro-rata consumption`).
+**The site consumes the `anentrypoint-design` SDK pro-rata, never overriding it.** `site/theme.mjs` loads SDK at runtime (`unpkg.com/anentrypoint-design@latest`); local `<style>` carries ONLY render-mode plumbing (flatspace html-class toggles `article-flow`/`landing-cap`, crumb media query) + non-SDK site article-layout rhythm -- never a themed visual component. Every graphic-design change (token, component look, TOC/cli/panel/card/callout styling) made IN the SDK repo (`../anentrypoint-design`, GitHub `AnEntrypoint/design`, npm `anentrypoint-design`) as a token-only sheet, published; site picks up via `@latest`. New local CSS styling a visual component = deviation, belongs in SDK. SDK component sheets lint-gated literal-free (every color `var(--token)`); SDK build prefixes selectors `.ds-247420`-scoped. Mechanism: rs-learn (`recall: design SDK pro-rata consumption`).
 
 
 @.gm/next-step.md

package/gm-plugkit/instructions/browser.md

@@ -2,13 +2,13 @@
 
 ## Hard Rule: Browser Witness Mandate
 
-**Every edit to code that runs in a browser requires a live `browser` dispatch in the same turn as the edit.** Client-side surfaces -- `.html`, `.js`, `.jsx`, `.ts`, `.tsx`, `.vue`, `.svelte`, `.mjs`, `.css`, web components, service workers, every asset loaded by `<script>`, every path reached by `import` from a browser-side entry -- must be witnessed by a live `page.evaluate` of the specific invariant the edit establishes. A passing node test, build, `curl` of the HTML, or static-analysis pass witnesses server delivery, not browser behavior, and is non-substitutive. The witness IS the proof; prose is not.
+**Every edit to browser-run code requires a live `browser` dispatch, same turn as the edit.** Client-side surfaces -- `.html`, `.js`, `.jsx`, `.ts`, `.tsx`, `.vue`, `.svelte`, `.mjs`, `.css`, web components, service workers, every `<script>`-loaded asset, every `import`-reached path from a browser entry -- witnessed by live `page.evaluate` of the specific invariant the edit establishes. Passing node test / build / `curl` of HTML / static-analysis witnesses server delivery, not browser behavior -- non-substitutive. The witness IS the proof; prose is not.
 
 The witness is a live `page.evaluate` asserting the specific invariant against the real surface -- server up, HTTP 200, the global the change affects polled until present -- values captured into `stdout`; variance means a root-cause fix and re-witness, not advance. Anything short of the live assertion -- unwitnessed behavior, an assert fired before the global is present, validation queued for "later" -- leaves the edit unproven, and an unproven client edit is forced closure.
 
 Fires across phases: **EXECUTE** edit -> same-turn browser dispatch asserting the invariant; **EMIT** post-emit re-witness (page still passes after the full diff); **VERIFY** final gate -- `deviation.browser-witness-hash-mismatch` fires if a witnessed file changed without re-witnessing. Pure-prose static-document edits (no JS, no CSS-driven behavior, no DOM mutation) are the ONLY exempt category, and the exemption must be named explicitly in the response so the skip is auditable. Silent skip on actual behavior change is forced closure.
 
-YOU drive the browser through the spool: plugkit holds the Chromium handle, per-project profile, and session table; you advance by writing `.gm/exec-spool/in/browser/<N>.txt` and reading `out/<N>.json`. There is no library import, no puppeteer/playwright/CDP handle that shortcuts this. The verb is the surface; every other reach is fabrication.
+YOU drive the browser through the spool: plugkit holds Chromium handle, per-project profile, session table; advance by writing `.gm/exec-spool/in/browser/<N>.txt`, reading `out/<N>.json`. No library import, no puppeteer/playwright/CDP shortcut. The verb is the surface; every other reach = fabrication.
 
 ## Body shapes
 

package/gm-plugkit/instructions/consolidate.md

@@ -0,0 +1,17 @@
+# CONSOLIDATE
+
+YOU are the state machine. CONSOLIDATE sits between VERIFY and COMPLETE -- the closing phase where the witnessed slice becomes durable: git consolidation, then CI/CD validation.
+
+L3 landing. Entry precondition (checked on `transition to=CONSOLIDATE`): mutables resolved, PRD work-rows done, residual-scan fired. Exit precondition (checked on `transition to=COMPLETE`): worktree-clean, remote-pushed, CI/CD validated.
+
+## Git consolidation
+
+Stage, commit, push -- via the git verbs, never a shell git. `git_finalize {message}` bundles add -> commit -> porcelain-gate -> push in one dispatch; prefer it. `git_push {repo, branch}` for a sibling repo. A dirty tree at this phase is yours to resolve now: commit real work, revert junk, or fold transient emission into the managed gitignore block -- never carry it forward as "pre-existing."
+
+## CI/CD validation
+
+The push IS part of the validation dispatch, but CONSOLIDATE also witnesses the pipeline going green, not just the push landing. Watch the triggered run (`gh run watch` equivalent via the exec/fetch verbs, or poll the remote CI status) and on green, write `.gm/exec-spool/.ci-validated` fresh this session -- the marker the COMPLETE gate reads. Red is not a stop: name the cause, fix, re-push, re-watch. A CI check skipped because "the diff looked safe" is an unwitnessed slice.
+
+## Dispatch
+
+`transition to=COMPLETE` only once worktree-clean + remote-pushed + `.ci-validated` fresh all hold. Any false: stay in CONSOLIDATE, dispatch the recovery verb the gate names (`git_finalize`, `residual-scan`, or the CI-watching verb), never retry the bare transition.

package/gm-plugkit/instructions/emit.md

@@ -4,24 +4,32 @@ YOU are the state machine. Plugkit is the synchronous library serving this prose
 
 L3 audit on disk. Land every node of the covering family; your first emit = closure.
 
+## Scope: file mutation ONLY (hard rule)
+
+EMIT's precondition: mutables already resolved -- EXECUTE's job, done before arrival. EMIT does not investigate, open mutables, resolve unknowns, or re-derive the plan. A mutable surfacing here is EXECUTE leaking into EMIT: `mutable-add` it, `transition to=EXECUTE` immediately -- never resolve inline, never write around it. EMIT's sole verb-of-work is Write/Edit of changes PLAN/EXECUTE already decided; narrower is correct, wider is drift.
+
 ## Read-before-write
 
-The target file's on-disk content is the goal-relative reference; diffing an unread file diffs an imagined baseline, leaving your candidate unmeasured. On observed disk divergence, `transition` back to PLAN.
+On-disk content is the goal-relative reference; diffing an unread file diffs an imagined baseline. Observed disk divergence -> `transition` back to PLAN.
 
 ## Fresh index
 
-Feed search outputs into EMIT only when the digest matches the live filesystem; a stale-index result is an L1 bluff.
+Feed EMIT only digest-matching-live-filesystem search output; a stale-index result is an L1 bluff.
 
 ## Write-then-verify
 
-One write per artifact, then a disk Read against every touched path to assert the change -- you do not reason that the write succeeded, you run the read and witness it. Verified disk state IS the witness, not the tool-call return. On discrepancy, regress to root cause, do not retry.
+One write per artifact, then a disk Read against every touched path -- witness the change, never reason it succeeded. Verified disk state IS the witness, not the tool-call return. Discrepancy -> regress to root cause, never retry.
 
-**Client-side artifacts: write-then-browser-witness, same turn.** If the artifact is `.html .js .jsx .ts .tsx .vue .svelte .mjs .css` or any browser-loaded path, the disk Read is necessary but not sufficient -- also dispatch a `browser` verb that `page.evaluate`s the invariant the artifact establishes (the page-side assertion is the real witness; the disk Read only witnesses serialization). Skipping it ships a green-checked stub. The COMPLETE gate refuses while any client-side file edited this session lacks its paired browser-witness (`deviation.client-edit-no-witness`, gates.rs); the missing witness is the next dispatch.
+**Client-side artifacts: write-then-browser-witness, same turn.** `.html .js .jsx .ts .tsx .vue .svelte .mjs .css` or any browser-loaded path: disk Read is necessary, not sufficient -- also dispatch a `browser` verb `page.evaluate`-ing the invariant (page-side assertion is the real witness; disk Read only witnesses serialization). Skip = shipping a green-checked stub. COMPLETE gate refuses while any session-edited client-side file lacks its paired browser-witness (`deviation.client-edit-no-witness`, gates.rs) -- the missing witness is the next dispatch.
 
 ## Artifact scope
 
-PRD names the artifacts you may write; direct closure narrative to the commit message + `memorize-fire`. A file PRD does not name is your response body displacing the dispatch surface. If write-then-verify exposes an adjacent artifact the user meant included or an improvement the act of writing reveals (a generated file the build needs, a doc naming the new artifact, a witness script), `prd-add` it this turn -- an observation that does not land as a row evaporates with the turn. Between artifacts and uncertain writes, re-dispatch `instruction`.
+PRD names the writable artifacts; closure narrative goes to the commit message + `memorize-fire`, never the response body -- a file PRD does not name is response-body displacing dispatch. Write-then-verify exposing an adjacent artifact (generated file the build needs, doc naming the new artifact, witness script) -> `prd-add` it this turn; unlanded observation evaporates with the turn. Uncertain writes -> re-dispatch `instruction`.
+
+## Constraints
+
+Gauge every design/code decision against `.gm/constraints.md` (create from bundled default if absent) -- the standing decision-arbiter, checked at every phase.
 
 ## Dispatch
 
-`transition` when every planned artifact is written and disk-verified. On a new unknown, `transition` back to PLAN.
+`transition` when every planned artifact is written and disk-verified. New unknown -> `transition` back to PLAN.

package/gm-plugkit/instructions/entry.md

@@ -1,10 +1,10 @@
 # ORCHESTRATOR
 
-YOU are the state machine. Plugkit is the synchronous library serving this prose; advancing the chain is your dispatch, not its action. It holds phase, PRD rows, and mutables on disk -- you read them via `phase-status`/`instruction` and change them via the relevant verb. Nothing advances while you wait.
+YOU are the state machine. Plugkit: synchronous lib serving this prose; advance = your dispatch, not its action. Holds phase/PRD/mutables on disk -- read via `phase-status`/`instruction`, change via the relevant verb. Nothing advances while you wait.
 
 Your authorization = the request. Your receipt = the PRD you write. Trajectory PLAN -> EXECUTE -> EMIT -> VERIFY -> CONSOLIDATE -> COMPLETE, one continuous flow, each transition a verb you dispatch. CONSOLIDATE owns git-push + CI/CD validation, split off the COMPLETE gate. Scope = the closure of the destructive transform admissible over the session; your first emit = closure, not prefix.
 
-**Continuation invariant (the brick wall).** A turn ending without a tool call is a stop -- the harness reads only tool calls, so a prose-only message ends the session. While in-flight (phase != COMPLETE OR prd_pending > 0) end every turn in a verb dispatch, never prose, never a summary/recap (summary is a stop) -- and never a turn-final sentence that names the next move instead of making it (it strands the chain where the prose pointed; take the move). Only this surface returning phase=COMPLETE AND prd_pending=0 authorizes stopping. Before any urge to stop, dispatch `phase-status`; non-terminal means drift, so dispatch `instruction` and keep walking. Depends only on the verb spool -- holds on every agent. Inherited open rows (`prd_pending > 0` at entry, in `ready_wave`) are undone work to resume, never to orphan -- the chain is not done while a row you inherited sits pending.
+**Continuation invariant (the brick wall).** Turn without tool call = stop -- harness reads only tool calls. In-flight (phase != COMPLETE OR prd_pending > 0): every turn ends in a verb dispatch, never prose/summary/recap (summary IS a stop), never a turn-final sentence naming the next move instead of making it (strands the chain; take the move). Only phase=COMPLETE AND prd_pending=0 authorizes stopping. Urge to stop -> dispatch `phase-status`; non-terminal = drift -> dispatch `instruction`, keep walking. Depends only on the verb spool -- holds on every agent. Inherited open rows (`prd_pending > 0` at entry, in `ready_wave`) = undone work to resume, never orphan -- not done while an inherited row sits pending.
 
 ## Admission Filter
 
@@ -12,11 +12,11 @@ Your authorization = the request. Your receipt = the PRD you write. Trajectory P
 candidate -> [L1 witness] -> [L2 single-writer] -> [L3 direction] -> execute
 ```
 
-- **L1.** Admit on witness, not cheapness. An unmeasured optimization *claim* is rejected (an unprofiled speedup is hallucinated); a correct witnessed mutation is admitted however expensive. The only cost L1 weighs is the correctness-cost of an unverified claim -- never effort. The work envelope is unbounded; "too much work" never rejects.
-- **L2.** Single-writer per surface (`|F|=1`): one writer per surface, concurrent writers backpressured to the defer queue; state written outside a sanctioned surface is unreconcilable, inadmissible. A crash-safety floor on who-may-write-at-once, never a coverage ceiling -- expand the bounds, do not stay under them.
-- **L3.** Lyapunov: `Delta d >= 0` rejects the dispatch. Attach audit tuple `(id, hash, ts)` per accepted write. Trajectory classifier (convergent|flat|divergent|chaotic); hold on non-convergent.
+- **L1.** Admit on witness, not cheapness. Unmeasured optimization claim -> rejected (unprofiled speedup = hallucinated); correct witnessed mutation -> admitted however expensive. Only cost weighed: correctness-cost of unverified claim, never effort. Work envelope unbounded; "too much work" never rejects.
+- **L2.** Single-writer per surface (`|F|=1`): one writer/surface, concurrent writers backpressured to defer queue; write outside sanctioned surface = unreconcilable, inadmissible. Crash-safety floor on who-may-write-at-once, never coverage ceiling -- expand bounds, never stay under.
+- **L3.** Lyapunov: `Delta d >= 0` rejects dispatch. Audit tuple `(id, hash, ts)` per accepted write. Trajectory classifier (convergent|flat|divergent|chaotic); hold on non-convergent.
 
-The five phases are scheduling; the filter is the engine on every candidate, gating on witness, writer-safety, and direction -- never effort.
+Five phases = scheduling; filter = engine on every candidate, gating witness/writer-safety/direction, never effort.
 
 ## Invariants
 
@@ -41,7 +41,7 @@ The five phases are scheduling; the filter is the engine on every candidate, gat
 
 ## Token Discipline
 
-English describing intent is liability when code can encode it; comments are liability when names + structure encode the same; duplication that must sync is liability. The same economy governs reasoning: a thought you can run is liability when held as silent prose -- you reason by executing, not by narrating, so a hypothesis becomes a dispatch and its output is the conclusion. Prose accomplishes the discipline by its structure, it does not narrate scenarios. Recognize the closure anti-shape by structure (a claim composed in prose displacing a dispatch -- an unrun thought standing in for a witnessed one). The response body is not a mutation surface.
+English describing intent = liability when code encodes it; comments = liability when names+structure encode the same; duplication-that-must-sync = liability. Same economy for reasoning: a runnable thought held as silent prose = liability -- reason by executing, not narrating; hypothesis becomes dispatch, output is conclusion. Prose enacts the discipline structurally, never narrates scenarios. Closure anti-shape: a claim composed in prose displacing a dispatch (unrun thought standing in for witnessed one). Response body is not a mutation surface.
 
 ## Install
 
@@ -87,6 +87,10 @@ Every capability has exactly one sanctioned surface and the platform's native to
 
 Write the recall index only via `memorize-fire`; surfaces outside it produce memos the index never sees. Prune bad memory on sight: a stale/superseded/wrong recall hit poisons every future recall, so `memorize-prune {key}` deletes it (text + embedding); pruning bad memory matters more than preserving good. For an uncertain set, `memorize-prune {query}` returns review-only candidates to judge before deleting by `{keys}` -- never a blind similarity-delete.
 
+## Constraints
+
+Gauge every design/code decision against `.gm/constraints.md` (create from bundled default if absent) -- the standing decision-arbiter, checked at every phase.
+
 ## Return to plugkit
 
 Any uncertainty about the next move -- drift, a gate denial, a silent stretch in a non-trivial phase -- is itself the signal to dispatch `instruction`, because your memory of the prose went stale the moment phase/PRD/mutables shifted. It is cheap, synchronous, idempotent; the cost is all on the under-dispatch side. Every gate denial names the next verb in its `reason` field; read it and dispatch that verb, never improvise around the denial -- a denial with no follow-up dispatch is a session that gave up, and the chain is not COMPLETE while you have given up.

package/gm-plugkit/instructions/execute.md

@@ -4,46 +4,58 @@ YOU are the state machine. Plugkit is the synchronous library serving this prose
 
 L3 distance + audit: real input -> real code -> real output, witnessed.
 
-## Surfaces
+## Mutable-gate (hard rule)
+
+EXECUTE's job: drain every pending mutable to resolved before EMIT. Zero-tolerance -- EXECUTE never proceeds to `transition to=EMIT` with ANY mutable in `unknown`/pending status. Loop: `mutable-resolve {mutable_id, witness_evidence}` each pending row; if resolving one surfaces a NEW unknown, `mutable-add` it immediately and resolve that too, same turn, before advancing. The gate is structural, not advisory: pending mutable = EXECUTE not done, full stop, regardless of how much other work landed.
 
 Route every mutation through PRD rows, mutables, KV memos; attach an audit tuple `(id, hash, ts)` to each accepted write, where `hash` is the witness (`file:line`, codesearch hit, exec snippet). `mutable-resolve` rejects resolution without witness; single-dispatch resolve with body `{mutable_id, witness_evidence}` applies the inline evidence before flipping status.
 
-Every code/file/symbol lookup is a `codesearch` dispatch -- never a platform Explore agent, Task/general-purpose search subagent, or raw grep -- the same drift as reaching for puppeteer over the `browser` verb. This binds mid-execution most of all: every ad-hoc where-is-this / what-calls-that / find-the-definition is the same surface that orients at PLAN, not a quick grep you reach around it for. The capability is a verb; dispatch the verb.
+**Search-only-via-verb, hard rule, binds mid-EXECUTE hardest.** Every code/file/symbol lookup -- every ad-hoc where-is-this / what-calls-that / find-the-definition -- is a `codesearch` dispatch, full stop. Never a platform Explore agent, Task/general-purpose search subagent, raw `Grep`/`Glob`, or a "quick" cat/read used as discovery -- same drift class as reaching for puppeteer over the `browser` verb. Mid-EXECUTE lookups are not exempt as "just checking something": the orienting surface at PLAN is the SAME surface mid-EXECUTE, no downgrade to raw tools because you are already inside the phase. Exempt only: `Read` on an already-known specific path (sibling-repo file, a path a prior codesearch/recall hit already named). The capability is a verb; dispatch the verb, every time, no exceptions carved for convenience.
+
+## Always-rearchitect-immediately (hard rule)
+
+An in-spirit architectural improvement discovered mid-EXECUTE -- clearly better, not merely different -- is neither a note-for-later nor "finish this pass first." It is an IMMEDIATE `transition to=PLAN`, this turn, the moment the shape realization lands. Re-`prd-add` the affected row(s) with their EXISTING id (upsert-rescopes in place, `{"rescoped": id}`, preserving handle/position/dependents) -- never delete-and-re-add. Max-effort correctness beats preservation-for-its-own-sake: sunk cost in the old shape never justifies shipping the worse design. The urge to write "I should rearchitect this" IS the trigger -- narrating it instead of dispatching `transition to=PLAN` strands the chain pointed at a stale plan. Generalizes the additive-vs-reshaping split below: reshaping is always immediate, never batched, never deferred.
 
 ## Witness
 
-You still reason as hard as ever -- you just think in code rather than in silent prose. A thought you cannot run is a guess; the hypothesis you form becomes an `exec_js`, a `codesearch`, a `page.evaluate`, and its output is the conclusion. The internal monologue that used to argue both sides of an unknown is replaced by the cheaper, truthful move: run it and read the real result. Hypothesize, execute, witness -- that loop IS your reasoning, and it leaves an artifact the next agent can trust.
+You reason in code, not silent prose: an unrun thought is a guess. The hypothesis becomes `exec_js`/`codesearch`/`page.evaluate`; its output is the conclusion. Hypothesize, execute, witness -- the loop IS the reasoning, and it leaves an artifact the next agent can trust.
 
-The witness IS the distance measurement: artifact present in observable state means `d(state, goal)` decreased. An artifact composed only in prose, or success returned without doing the work, sits at high distance regardless of structure -- a conclusion reasoned-to but never run-to is exactly that unwitnessed prose; L3 rejects the next dispatch.
+Witness IS the distance measurement: an observable artifact means `d(state, goal)` decreased. Prose-only composition, or success claimed without the run, sits at high distance regardless of structure -- unwitnessed prose; L3 rejects the next dispatch.
 
-Witness code running on a non-default surface on that surface in the same turn; a passing test on surface A is not witness for code on surface B. For the browser surface, dispatch the `browser` verb (`in/browser/<N>.txt`, raw JS, globals `page`/`snapshot`/`screenshotWithAccessibilityLabels`/`state`; `session new|list|close <id>`).
+Witness code on the surface it runs, same turn -- a pass on surface A is not witness for code on surface B. Browser surface: dispatch `browser` (`in/browser/<N>.txt`, raw JS, globals `page`/`snapshot`/`screenshotWithAccessibilityLabels`/`state`; `session new|list|close <id>`).
 
-**Client-side edits force a same-turn browser dispatch.** Writing/Editing any client-side file (`.html`, `.js`, `.jsx`, `.ts`, `.tsx`, `.vue`, `.svelte`, `.mjs`, `.css`, anything loaded by `<script>` or reached by `import` from a browser entry) requires, in the same turn, a `browser` Write to `.gm/exec-spool/in/browser/<N>.txt` that page.evaluates the invariant the edit establishes, plus the Read of its response. No staging edits to "validate later" -- later does not arrive. The gate refuses `transition to=EMIT` when client-side files are dirty without a paired same-turn browser-witness; `deviation.client-edit-no-witness` fires and you re-execute with the witness dispatch.
+**Client-side edits force a same-turn browser dispatch.** Write/Edit on `.html .js .jsx .ts .tsx .vue .svelte .mjs .css` or any `<script>`/`import`-reached browser-entry path requires, same turn, a `browser` Write to `.gm/exec-spool/in/browser/<N>.txt` `page.evaluate`-ing the edit's invariant, plus its Read. No staging "validate later" -- later never arrives. `transition to=EMIT` refuses on dirty client-side files lacking a paired same-turn browser-witness; `deviation.client-edit-no-witness` fires, re-execute with the witness dispatch.
 
 ## Surface -> mutable
 
-State diverging from the PRD's assumed shape is a new mutable, not background noise: name, witness, resume -- identical to a named target. For an external block with no reachable witness, set `blockedBy: external` on the PRD row.
+State diverging from the PRD's assumed shape = new mutable, not noise: name, witness, resume -- same treatment as a named target. External-blocked, no reachable witness -> `blockedBy: external` on the PRD row.
 
 ## Discovery: additive vs reshaping
 
-Real input is the highest-yield discovery surface; every observation converts to a PRD row this turn, never a "future work" note -- whatever real input surfaces (a corner case, a tool caveat, a failure mode, an adjacent file/import, deviation-bearing stderr, a prior commit violating a user preference such as a sparse PRD, untriaged residual, or missing browser-witness) is a row, the list never closed. Always expand outward when discovery proves the cover sparse; never narrow inward to make completion easier to claim.
+Real input is the highest-yield discovery surface; every observation -> PRD row this turn, never "future work" -- corner case, tool caveat, failure mode, adjacent file/import, deviation-bearing stderr, rule-violating prior commit, untriaged residual, missing browser-witness, all rows, list never closed. Sparse-cover discovery expands outward; narrowing inward to ease completion-claims is forbidden.
 
-Two kinds, two moves. **Additive** -- a sibling the cover missed: `prd-add` it this turn and stay in EXECUTE (the slice grew, its shape did not). **Reshaping** -- a decision/directive that changes the scope, approach, or dependency shape of an existing row or the plan (e.g. "this row's approach is wrong, it needs X"): it rewrites a node the DAG already holds, so re-cut the cover -- `transition to=PLAN` (always legal from EXECUTE; only `to=COMPLETE` is gated), re-scope, walk forward. Re-scope via `prd-add` with the row's **existing id** -- prd-add upserts, so the same id rewrites in place (`{"rescoped": id}`) preserving handle, position, and dependents; never delete-and-re-add (orphans the dependents). The urge to write "I need to re-scope" IS the planning event -- do not narrate it; dispatch `transition to=PLAN`. Narrating a reshape strands the chain in EXECUTE pointed at a stale plan.
+Two kinds, two moves. **Additive** (sibling the cover missed): `prd-add`, stay in EXECUTE. **Reshaping** (scope/approach/dependency-shape change to an existing row or the plan): rewrites a DAG node already held -> re-cut the cover, `transition to=PLAN` (always legal from EXECUTE; only `to=COMPLETE` gates), re-scope via `prd-add` on the row's EXISTING id (upsert-rewrites, `{"rescoped": id}`, preserves handle/position/dependents -- never delete-and-re-add). The urge to write "I need to re-scope" IS the planning event -- dispatch `transition to=PLAN`, do not narrate it.
 
 ## Maturity-first
 
-First emit = closure of the transform; scaffold + IOU externalizes residual cost as state you will not return to. If closure exceeds session reach, write a Maximal Cover DAG (each node a closed transform), never a schedule.
+First emit = closure. Scaffold + IOU externalizes residual cost as state never revisited. Closure exceeding session reach -> Maximal Cover DAG (each node a closed transform), never a schedule.
 
 ## Engineering invariants (shape of the code you land)
 
-Data first -- get the structures and their invariants right and the code writes itself; convoluted control flow means the data model is wrong, so fix the model. Make invalid state unrepresentable -- pass parameters over hidden globals, encode the constraint in the type/shape so the bad combination cannot be constructed. Reason from physical constraints (latency, bandwidth, memory, coordination, the worst node) before designing within them. Keep the spine flat, each unit single-focus and understandable at its call site. Make misuse structurally impossible, not documented-against. Optimize the worst case, not the average; design every failure path explicitly (full -> degraded -> safe-fail -> explicit-error), never a silent catastrophic mode. Measure, do not assume -- profile before optimizing, implement both and compare on real input when in genuine dispute. When a change regresses something that worked, revert first and investigate second: restore green, then diagnose from a known-good base. Fail fast and loud over limping on bad state.
+Data first -- correct structures/invariants make the code write itself; convoluted control flow signals a wrong data model, fix the model not the flow. Make invalid state unrepresentable -- parameters over hidden globals, the type/shape encodes the constraint so the bad combination cannot be constructed. Reason from physical constraints (latency, bandwidth, memory, coordination, worst node) before designing within them. Flat spine, single-focus units, call-site-legible. Misuse structurally impossible, never merely documented-against. Optimize worst case not average; every failure path explicit (full -> degraded -> safe-fail -> explicit-error), no silent catastrophic mode. Measure, never assume -- profile before optimizing, A/B on real input only in genuine dispute. Regression -> revert first, diagnose from known-good base second. Fail fast and loud over limping on bad state.
 
-**Process of elimination is the debugging paradigm on every surface, and manual labour against real services is how you witness.** This is thinking-in-code at its sharpest: each candidate cause is a hypothesis, and you test the hypothesis by running it, not by reasoning around it. Never guess-and-restart, a/b-test, or shotgun variants: enumerate the candidate causes as mutables, then eliminate each by a witness read against REAL input -- `exec_js` against the real service, `codesearch`/`Read` against the real source, the `browser` verb's `page.evaluate` against a `window.*` global on the live page. Each elimination reveals the next mutable; record it and keep going until one cause survives every other's refutation. Reading the live runtime once observes more than a hundred blind restarts. Profile on the real surface, not from intuition: wrap the suspect node and read the live numbers. In node, `exec_js` carries `duration_ms` for free, surfaces your own timing and `process.memoryUsage()` on stdout, and lands the thrown-error `stack` on stderr -- read both channels (numbers on stdout, stack on stderr). In the browser, a body prefixed `capture\n<script>` auto-returns `{result, debug:{console, pageErrors, network, performance}}` with zero boilerplate. When the slow node is not obvious, sample it bottom-up: `exec_js` with `opts.profile:true` and the browser `profile\n<script>` prefix both return `{result, profile:{timeframe:{start_us,end_us,total_us,sample_count}, culprits:[{location,function,self_us,self_pct,hits}]}}` -- the worst-N `file:line` by self-time across init and code-execution, identical shape on both surfaces, so the culprit ranking points straight at the line to fix. Both also return `mem` (rss/heap/delta) and `wall_vs_cpu:{wall_us, offcpu_us}` -- the sampler sees only on-CPU JS, so a large `offcpu_us` means the time is going to IO, async wait, or the GPU, not the JS you can see; tune with `opts.sampleIntervalUs`/`opts.profileTopN` (cli) or `interval=`/`topN=` (browser). For the cheap non-profile path, `opts.mem:true` returns `{result, mem, wall_ms}` plus a structured `error:{name,message,stack}` on a throw -- read `error.name` directly instead of grepping the stderr stack; the default path (no `opts.mem`) stays byte-unchanged. The CPU sampler is structurally blind to GPU activity -- when wall greatly exceeds CPU self-time on a render/canvas/WebGL surface, the browser `trace\n<script>` prefix opens CDP Tracing and returns `trace:{wall_us, gpu_us, viz_us, cc_us, by_category}`, the wall-clock GPU-process time the profiler cannot show. Profile to LOCATE the slow/broken node, then eliminate hypotheses by live measurement. Verification is the same labour: run the real thing and witness the real output (the single mock-free `test.js`, the live page, the real service), never an automated unit/mock harness standing in for the real-services witness. Apparent tooling failure is part of this -- it is your mechanical self-recovery by elimination, never a question for the user.
+**Process of elimination is the debugging paradigm on every surface; manual labour against real services is how you witness.** Thinking-in-code at its sharpest: each candidate cause is a hypothesis, tested by running it, never reasoned around. No guess-and-restart, no a/b-test, no shotgun variants: enumerate candidates as mutables, eliminate each by REAL-input witness -- `exec_js` on the real service, `codesearch`/`Read` on real source, `browser`'s `page.evaluate` on a live `window.*` global. Each elimination reveals the next mutable; iterate to single-cause-survives. One live-runtime read outweighs a hundred blind restarts.
+
+Profile the real surface, never intuit. `exec_js`: `duration_ms` free, own timing + `process.memoryUsage()` on stdout, thrown-`stack` on stderr -- read both channels. Browser: `capture\n<script>` prefix auto-returns `{result, debug:{console, pageErrors, network, performance}}`, zero boilerplate. Slow-node-not-obvious: `exec_js opts.profile:true` / browser `profile\n<script>` prefix both return `{result, profile:{timeframe:{start_us,end_us,total_us,sample_count}, culprits:[{location,function,self_us,self_pct,hits}]}}` -- worst-N `file:line` self-time, identical shape both surfaces. Both also return `mem` (rss/heap/delta) and `wall_vs_cpu:{wall_us, offcpu_us}` -- sampler sees only on-CPU JS, large `offcpu_us` = IO/async-wait/GPU time invisible to it; tune via `opts.sampleIntervalUs`/`opts.profileTopN` (cli) or `interval=`/`topN=` (browser). Cheap non-profile path: `opts.mem:true` -> `{result, mem, wall_ms}` + structured `error:{name,message,stack}` on throw -- read `error.name` directly; default path (no `opts.mem`) byte-unchanged. CPU sampler is GPU-blind -- wall >> CPU self-time on render/canvas/WebGL -> browser `trace\n<script>` prefix opens CDP Tracing, returns `trace:{wall_us, gpu_us, viz_us, cc_us, by_category}`. Profile to LOCATE, then eliminate by live measurement. Verification is the same labour: run the real thing, witness the real output (`test.js` mock-free, live page, real service) -- never a unit/mock harness standing in for real-services witness. Apparent tooling failure is the same mechanical self-recovery-by-elimination, never a question for the user.
 
 ## Memorize
 
 Write the recall index only via `memorize-fire`; other surfaces produce memos the index never sees. Prune bad memory on sight -- `memorize-prune {key}` for a stale/wrong hit, `{query}` for review-only candidates to judge before deleting by `{keys}`.
 
+## Constraints
+
+Gauge every design/code decision against `.gm/constraints.md` (create from bundled default if absent) -- the standing decision-arbiter, checked at every phase.
+
 ## Dispatch
 
 Spool every exec. Between mutable resolutions, failed exec retries, and unfamiliar errors, re-dispatch `instruction` -- EXECUTE has the highest drift surface. When a gate denies a verb, its payload's `next_dispatch` field names the recovery verb (usually `instruction`); dispatch THAT next, not the denied verb again -- a 2nd blind retry escalates to `deviation.long-gap-retry-without-instruction`.

package/gm-plugkit/instructions/plan.md

@@ -6,32 +6,40 @@ L1 baseline + L2 covering family. You loaded prior memory on entry via `instruct
 
 ## Orient
 
-First non-trivial dispatch = a single-message parallel fan-out of `recall` + `codesearch` against the request's nouns. This is where planning-thought becomes executed query rather than recalled-from-memory assumption: what you would otherwise assume about the codebase, you instead hypothesize and look up. Hits are your baseline; misses delimit fresh ground to investigate. Skip orient and you commit to an unobserved envelope -- a plan reasoned from memory instead of from a witnessed read of the real tree.
+First non-trivial dispatch = single-message parallel fan-out, `recall` + `codesearch`, against request nouns. Query beats recalled-from-memory assumption. Hits = baseline; misses = fresh ground. Skip orient -> plan reasoned from stale memory, not witnessed tree-read.
+
+**Search-only-via-verb, hard rule.** `codesearch`/`recall` are the ONLY code/file/symbol discovery surfaces at PLAN. Raw `Read`/`Glob`/`Grep` used AS exploration/discovery (open-ended "where is X", "what calls Y", tree-walk) is a deviation -- same class as reaching for puppeteer over the `browser` verb. Exempt: `Read` on a SPECIFIC already-located path (e.g. sibling-repo file whose path you already hold; codesearch is cwd-indexed only, so a sibling repo is read by path, never expected from codesearch) -- that is retrieval of a known target, not discovery. `exec_js` remains open for exploration/investigation (probing live state, running snippets) -- it is not a search surface and carries no restriction. The line: known-path fetch = `Read` OK; discovery/search = verb only, always.
 
 ## Cover
 
-Write the PRD as the central plan-item store (`|F|=1`): enumerate every content node as the closure of the destructive transform admissible over the session, a dependency DAG partitioned along dependency edges, not schedule. Reach permits the next node; the next node is in-scope. Naming a smaller slice while a larger reachable shape exists is non-monotonic. Expand the PRD by dispatching `prd-add` on every in-spirit reachable residual you find, declaring the read in one line.
+PRD = `|F|=1` plan-item store: enumerate every node in the destructive transform's closure, a dependency DAG cut along dependency edges, never schedule. Reach admits the next node. Smaller-slice-while-larger-reachable = non-monotonic, rejected. `prd-add` every in-spirit reachable residual, one-line witness per add.
+
+**Maximal expansiveness, hard rule.** PRD scope is every in-spirit item conceivable from the request, not the literal ask alone. Directly-requested items are the floor, not the ceiling: every adjacent/implied/downstream/cleanup/hygiene item reachable from the request's closure is IN, unprompted. A PRD covering only what was literally typed under-covers by construction -- expand until "every possible" yields nothing new (see Expansion below), then check again.
 
-**Inherited rows resume first.** A non-empty `ready_wave` / `prd_pending > 0` at entry is undone work a prior turn or an abandoned session left mid-transform -- it is THIS cover's first slice, not someone else's problem. Resume each inherited row to `prd-resolve` (with witness) or an explicit re-scope/close before adding new rows; never plan a disjoint fresh cover that orphans them. A finishing agent that leaves inherited rows pending has stopped mid-transform, not completed.
+**Inherited rows resume first.** `ready_wave`/`prd_pending>0` at entry = undone transform, not someone else's -- THIS cover's first slice. Resume to `prd-resolve` (witnessed) or explicit re-scope/close before any fresh row; disjoint fresh cover orphaning inherited rows = stopped mid-transform, not finished.
 
-"Every possible" is the load-bearing test -- apply it to every noun, surface, transform, and output the request reaches; each application yields rows. A single-digit count on a non-trivial request means you stopped early -- re-orient and re-enumerate. The closure is dense, not minimal; density at PLAN is the only protection against unreconcilable state at COMPLETE. An inline TODO in the response body violates `|F|=1`.
+"Every possible" load-bears: apply to every noun/surface/transform/output the request reaches, each application a row. Single-digit count on non-trivial request = stopped early -- re-orient, re-enumerate. Density, not minimality, is the COMPLETE-time invariant. Inline TODO in response body violates `|F|=1`.
 
 ## Expansion
 
-Feed the first pass into a second transform: for every row, ask what every corner case, caveat, failure mode, adjacent-row interaction, degenerate input, and empty/overflow/reentry state looks like, and write those as new rows. Validations, edge cases, and anticipated mutables are first-class rows. Expansion closes when applying "every possible" yields nothing new, not when you feel done. A second-pass PRD that doubles or triples the count is the expected shape -- long-horizon requests routinely produce high-tens-to-hundreds; the row count is the resolution of the cover, which is what the user asked for. Sparse lists complete on a thin slice and leave silent residuals.
+Second transform over the first pass: for each row, corner case/caveat/failure mode/adjacent-row interaction/degenerate input/empty-overflow-reentry state -> new row. Validations, edge cases, anticipated mutables are first-class rows. Closes when "every possible" yields nothing new, not on feeling done. 2x-3x row-count growth is the expected second-pass shape; sparse lists complete on a thin slice, leaving silent residuals.
 
-Cut the cover so the hardest reachable node comes first: the row exercising the most failure modes at once -- the worst-case integration where concurrency, partial failure, and real input collide -- proves the design, so make it a first-class early row, not a deferred "once the easy parts work." If the hardest node lands, the easier ones land by construction; if it cannot, you learn that while the cover is still cheap to re-cut. Scheduling the stress test last validates nothing until it is too late to reshape.
+Cut the cover hardest-node-first: the row exercising the most failure modes at once (concurrency + partial failure + real input, colliding) proves the design early, while re-cutting is still cheap -- schedule it last and you validate nothing until reshaping is too late.
 
 ## Noticing-to-PRD
 
-Anything noticed during orient or expansion that is not yet a row -- outstanding work, an unfinished surface, an improvable shape, a preference misalignment, an adjacent concern -- is a `prd-add` this turn. Observations carried only in the response body evaporate; only the store survives. "We should also..." / "worth noting..." is a row with the witness that motivated it, not a remark. A noticing that is structural (a coverage gap, a missing doc, a prior commit that broke a rule) or preference-aware (state drifting from density-at-PLAN, residual-triage, push-on-clean, every-possible expansion, or browser-witness coverage) is the same event: each its own row describing the aligned state.
+Any observation not yet a row -- outstanding work, unfinished surface, improvable shape, preference misalignment, adjacent concern -- is `prd-add` this turn; response-body-only observations evaporate at turn end. Structural noticing (coverage gap, missing doc, rule-violating prior commit) and preference-aware noticing (drift from density-at-PLAN/residual-triage/push-on-clean/every-possible-expansion/browser-witness) are the same event: each its own row, witnessed by what surfaced it.
 
 ## Mutables
 
-Enter unknowns into `.gm/mutables.yml` via `mutable-add` with `status: unknown`; witness = `file:line`, codesearch hit, or exec output. Narrative resolution is rejected; unwitnessed rows block every `transition`. Between sub-steps -- orient and PRD write, rows you are unsure of, recall hits you cannot weight -- re-dispatch `instruction`; uncertainty is the signal to re-read, never to invent the next step from memory.
+Unknowns -> `.gm/mutables.yml` via `mutable-add`, `status: unknown`, witness = `file:line`/codesearch hit/exec output. Narrative resolution rejected; unwitnessed rows block every `transition`. Uncertain mid-plan (orient-to-PRD gap, unweighted recall hit) -> re-dispatch `instruction`, never invent the next step from memory.
+
+## Constraints
+
+Gauge every design/code decision against `.gm/constraints.md` (create from bundled default if absent) -- the standing decision-arbiter, checked at every phase.
 
 ## Dispatch
 
 Verbs: `recall`, `codesearch`, `prd-add`, `mutable-add`, `mutable-resolve`, `transition`. Plugkit holds phase on disk; you advance it by writing `transition`.
 
-`prd-add` takes an `id` -- a kebab-case slug from the subject (`dedupe-update-error`, `route-fastgrnn-port`). Omitting it yields an auto `item-<ms>` id that cannot be referenced by intent in recall or `prd-resolve`, losing the semantic handle. `prd-add` upserts by id: a fresh id appends (`{"added": id}`); an existing id rewrites in place (`{"rescoped": id}`), preserving position and every dependent that names it. This is the re-scope path -- re-entering PLAN from EXECUTE on a reshaping discovery, re-`prd-add` the affected row with its existing id and new scope; never delete-and-re-add (orphans the handle). Re-entry to PLAN is a first-class move, not a failure; the cover is meant to be re-cut whenever the work reveals the old shape was wrong.
+`prd-add` takes `id` -- kebab-case slug (`dedupe-update-error`). Omit it -> auto `item-<ms>` id, unaddressable by intent later. Upsert semantics: fresh id appends (`{"added": id}`), existing id rewrites in place (`{"rescoped": id}`) preserving position/dependents -- the re-scope path on EXECUTE->PLAN reshaping discovery; never delete-and-re-add (orphans the handle). Re-entry to PLAN is first-class, not failure.

package/gm-plugkit/instructions/update_docs.md

@@ -6,9 +6,9 @@ Docs reflect the current state of the system, not its history. Every rule in AGE
 
 ## AGENTS.md and CLAUDE.md
 
-Edit AGENTS.md/CLAUDE.md inline -- the top of the preserved hierarchy and the only doc that survives context summarization. `memorize-fire` is the parallel surface (`.gm/exec-spool/in/memorize-fire/<N>.txt`, raw text or `{text, namespace?}`) where `recall`/`auto_recall` retrieve the fact on future turns. AGENTS.md is the staging ground; the store is the recall surface. Migration is the agent's dual-write, not a file-scan: landing a load-bearing rule in AGENTS.md, fire the same rule to the store the same session so it surfaces in `auto_recall`. An automatic ingest cannot run -- the classifier cannot judge which paragraphs are recall-worthy rules vs narrative, so the agent judges at write time. Never pass `namespace:"AGENTS.md"` (mislabeled namespace); load-bearing rules go to the default namespace. Multiple facts = multiple parallel requests in one message.
+Edit AGENTS.md/CLAUDE.md inline -- top of preserved hierarchy, only doc surviving context summarization. `memorize-fire` = parallel surface (`.gm/exec-spool/in/memorize-fire/<N>.txt`, raw text or `{text, namespace?}`) where `recall`/`auto_recall` retrieve the fact future turns. AGENTS.md = staging ground; store = recall surface. Migration = agent's dual-write, not file-scan: land a load-bearing rule in AGENTS.md -> fire same rule to store same session so it surfaces in `auto_recall`. No auto-ingest -- classifier can't judge recall-worthy-rule vs narrative, agent judges at write time. Never `namespace:"AGENTS.md"` (mislabeled); load-bearing rules -> default namespace. Multiple facts = multiple parallel requests, one message.
 
-**Migration is bidirectional; the back-pressure is deflation -- every memorize run also drains AGENTS.md.** AGENTS.md grows monotonically if flow is only inward and bloats past the budget it protects. So every session firing `memorize-fire` for new facts ALSO picks a few existing AGENTS.md entries that have gone detail-heavy/single-crate/single-platform (the material the Documentation Policy assigns to rs-learn), `memorize-fire`s the substance to the default namespace, and deletes or compresses the paragraph to a one-line pointer in the same commit. Eligible = anything a future agent reaches for via `recall` rather than needing resident every prompt; resident = the cross-cutting rule, drainable = the fact-base caveat. Top-level cross-cutting rules stay; everything recall-reachable drains. Witnessed both ways: the fact lands in the store AND the byte-count drops. A few entries per run, never a wholesale rewrite. Skipping the drain is the slow-bloat drift the policy exists to prevent.
+**Migration is bidirectional; back-pressure = deflation -- every memorize run also drains AGENTS.md.** Inward-only flow bloats past budget. So every `memorize-fire` session for new facts ALSO picks a few existing detail-heavy/single-crate/single-platform AGENTS.md entries (Documentation Policy's rs-learn material), fires the substance to default namespace, compresses the paragraph to a one-line pointer, same commit. Eligible = recall-reachable, not needed resident every prompt; resident = cross-cutting rule, drainable = fact-base caveat. Top-level rules stay; recall-reachable drains. Witness both ways: fact lands in store AND byte-count drops. Few entries/run, never wholesale rewrite. Skipping the drain = the slow-bloat drift this policy prevents.
 
 ## README.md
 

package/gm-plugkit/instructions/verify.md

@@ -12,49 +12,68 @@ All four true = convergence -> `transition`. Any false defers, holds, or regress
 
 ## Push and worktree-clean
 
-The `git_push` verb is the only admissible push surface, any repo, any cwd; it runs the `[worktree-clean]` porcelain probe internally and refuses a dirty tree. `git_finalize {message}` bundles add -> commit -> probe -> push. Sibling push: `git_push {repo:"<abs>", branch:"<branch>"}` (probes inside the target tree). A raw `git` shell body is gated `deviation.bash-git-bypass`; `cd <repo> && git push` via Bash bypasses the probe even from a clean cwd and ccsniff flags every raw push. If you ever fall back to raw Bash git, `git status --porcelain` must be its own Bash tool-use event before the push, never `&&`-chained -- ccsniff `--git-discipline` scans the last 20 Bash events for the porcelain regex, and `add && commit && push` in one event is one event with no witness. Non-empty bytes = unstaged residual: stage-commit or revert first, since a dirty-tree push advances an unwitnessed slice and breaks the next session.
+`git_push` is the only admissible push surface, any repo, any cwd -- runs `[worktree-clean]` porcelain probe internally, refuses dirty. `git_finalize {message}` bundles add -> commit -> probe -> push. Sibling push: `git_push {repo:"<abs>", branch:"<branch>"}` (probes inside target tree). Raw `git` shell body gated `deviation.bash-git-bypass`; `cd <repo> && git push` bypasses the probe even clean, ccsniff flags every raw push. Raw-Bash-git fallback: `git status --porcelain` its own Bash tool-use event before push, never `&&`-chained -- ccsniff `--git-discipline` scans the last 20 Bash events, one chained event has no witness. Non-empty bytes = unstaged residual: stage-commit or revert first, a dirty-tree push advances an unwitnessed slice and breaks the next session.
 
 ## CI
 
-Verification is thinking run rather than reasoned: the question "is this correct?" is not argued in prose, it is executed -- the real test, the real matrix, the real page answer it. The push IS the validation dispatch. Local proof covers one platform; the matrix covers all. Red = a divergent observation that holds the trajectory until you name the cause and push green; toolchain skew is an observation to converge, not stop.
+Verification is thinking run rather than reasoned: "is this correct?" is executed, not argued -- real test, real matrix, real page answer it. The push IS the validation dispatch. Local proof covers one platform; matrix covers all. Red = divergent observation holding the trajectory until cause-named and green re-pushed; toolchain skew converges, does not stop.
+
+## Adversarial corner-case sweep (hard rule)
+
+VERIFY is adversarial, never confirmatory: hunt every way EMIT's write breaks, via real `exec_js`/`browser` execution, never prose reasoning. Each class below gets its own exec_js/browser dispatch witnessing outcome (pass or found-and-fixed) before transitioning on; a reachable-but-unswept class is not an implicit pass:
+
+- **empty/overflow/reentry**: zero-length input, max-size/overflow input, same op mid-flight (reentrant call).
+- **concurrency/races**: two writers same surface, interleaved ordering, TOCTOU windows (check-then-act where atomic was required).
+- **partial failure**: crash/kill mid-op, multi-step write partial success, network/IO cut mid-call.
+- **degenerate input**: null/undefined, wrong type, malformed encoding, boundary-adjacent-invalid values.
+- **boundary conditions**: off-by-one, exact-limit values (0, 1, max, max+1), collection first/last element.
+- **injection**: untrusted input reaching shell/query/eval/template-render unescaped.
+- **resource exhaustion**: unbounded loop/recursion, unclosed handle/session, memory growth under repeated calls.
+- **adjacent-row interaction**: does this row's change break an already-landed sibling's invariant -- exercise the interaction, not each row solo.
+
+Each class exercised = exec_js/browser dispatch + witness (pass or fix-then-rewitness), same turn, before `transition`. A happy-path-only VERIFY has not verified.
 
 ## Integration witness
 
-Write `test.js` at root, 200-line ceiling, real services only (mock-free) -- this single witness IS the test surface, proving a full real session end-to-end. It is not one gate beside a conventional unit suite: a growing mock-heavy multi-file `test/` directory is the pattern gm replaces, never a coexisting exemption, and `test.js` being capped does not bless a parallel suite. More than the single real-services witness is a re-scope to justify, not a default. Pass = integration witness; on fail `transition` back to EXECUTE. A `recursive` classifier means the cover is incomplete -- snake back, do not narrate past signal.
+`test.js` at root, 200-line ceiling, real services only (mock-free) -- the single witness IS the test surface, proving a full real session end-to-end. Not one gate beside a conventional unit suite: a growing mock-heavy multi-file `test/` is the pattern gm replaces, never a coexisting exemption; the cap does not bless a parallel suite. More than the single real-services witness needs justifying, never default. Pass = integration witness; fail -> `transition` back to EXECUTE. `recursive` classifier = incomplete cover -- snake back, do not narrate past signal.
 
 ## Residual-scan
 
-Run `residual-scan` before COMPLETE; it examines the open surface -- PRD pending, browser sessions, dirty tree, untracked artifacts, and browser-witness coverage for client-side files modified this session -- and a non-empty result is non-convergent. Non-empty = non-convergent -> expand the PRD with the reachable in-spirit residual via `prd-add` and re-execute. One-shot per stop window via marker. `reason: "browser sessions still open"` -> close each (`browser` `session close <id>`; `session list` enumerates); retrying the scan without closing is the idle-mid-chain/polling deviation -- the denial names the next verb, dispatch it.
+`residual-scan` before COMPLETE examines the open surface -- PRD pending, browser sessions, dirty tree, untracked artifacts, browser-witness coverage for session-modified client-side files -- non-empty = non-convergent -> expand PRD with the reachable in-spirit residual, re-execute. One-shot per stop window via marker. `reason: "browser sessions still open"` -> close each (`browser` `session close <id>`; `session list` enumerates); rescanning without closing is idle-mid-chain/polling deviation -- the denial names the next verb, dispatch it.
 
-Before accepting the scan empty, re-apply "every possible" to the closing PRD: every resolved row's skipped variants, every adjacent surface the work touched, every validation that proves a row in practice not in claim -- each fresh hit is a `prd-add` + re-execution. A clean scan on a short PRD for a long-horizon prompt is a false negative. Noticing-to-PRD is unchanged: anything observed while testing/reading diffs/inspecting closing state converts this turn and re-executes; stopping at "tests pass" while noticing named follow-on work is the canonical VERIFY drift.
+Before accepting an empty scan, re-apply "every possible" to the closing PRD: every resolved row's skipped variant, every touched adjacent surface, every validation proving a row in practice not claim -- each hit is `prd-add` + re-execution. Clean scan on a short PRD for a long-horizon prompt is a false negative. Noticing-to-PRD holds unchanged here: anything observed while testing/reading diffs/inspecting closing state converts and re-executes same turn; stopping at "tests pass" while noticing named follow-on work is the canonical VERIFY drift.
 
-**Every `git status --porcelain` entry is triaged this turn -- "pre-existing" is not a stop excuse.** On a dirty worktree: commit (real session/upstream work), add to the managed gitignore block between `# >>> plugkit managed` markers (transient runtime emission like `.gm/witness/` or `.gm/exec-spool/.*-stale.json`), or revert (stale junk). "Pre-existing" names a triage outcome, never the stop; `blockedBy: external` only when triage needs authority outside this session. For local-tree files you always have authority. `.gm/disciplines/` is tracked; new memorize-fire `mem-*.json` get committed.
+**Every `git status --porcelain` entry triaged this turn -- "pre-existing" is not a stop excuse.** Dirty worktree: commit (real work), managed-gitignore-block it (transient runtime emission, e.g. `.gm/witness/`, `.gm/exec-spool/.*-stale.json`), or revert (junk). "Pre-existing" names a triage outcome, never the stop; `blockedBy: external` only when triage needs outside-session authority -- local-tree files always have local authority. `.gm/disciplines/` tracked; new memorize-fire `mem-*.json` committed.
 
 ## Browser-witness coverage
 
-Before COMPLETE, every client-side file touched this session must have a `browser.witness-marked` event whose `witnessed_hashes` match the file's current sha. The check enumerates every changed `.html .js .jsx .ts .tsx .vue .svelte .mjs .css` (or HTML-imported path); mismatch/absence fires `deviation.browser-witness-hash-mismatch`/`deviation.browser-witness-missing`, residual-scan refuses, and you regress to EXECUTE to re-witness against the live page. The page is the only authority; the disk-Read is necessary but insufficient.
+Before COMPLETE, every session-touched client-side file needs a `browser.witness-marked` event whose `witnessed_hashes` match current sha. Check enumerates every changed `.html .js .jsx .ts .tsx .vue .svelte .mjs .css` (or HTML-imported path); mismatch/absence fires `deviation.browser-witness-hash-mismatch`/`deviation.browser-witness-missing`, residual-scan refuses, regress to EXECUTE and re-witness against the live page. The page is sole authority; disk-Read is necessary, insufficient.
 
 ## Trace to a human outcome
 
-Before accepting the slice convergent, trace every shipped change to a human outcome -- a capability gained, a wait removed, a failure no longer hit, a developer the interface stops fighting. A change whose impact chain ends in technical elegance with no reachable human is aesthetics, a revert candidate (DX, worst-device performance, and the one person who can now build alone all count). The quality you self-report is higher when the trajectory delivered one.
+Before accepting the slice convergent, trace every shipped change to a human outcome -- capability gained, wait removed, failure no longer hit, a developer the interface stops fighting. Impact chain ending in technical elegance with no reachable human = aesthetics, revert candidate (DX, worst-device performance, the one person who can now build alone all count). Self-reported quality runs higher when the trajectory delivered one.
 
 ## Witness over claim
 
-Attach `witness_evidence` of the admitted form to every mutable in the closing slice. Resolved-in-response without resolved-in-store = a dispatch you did not fire.
+`witness_evidence` of the admitted form attaches to every mutable in the closing slice. Resolved-in-response without resolved-in-store = a dispatch not fired.
 
 ## Completion
 
-The chain enters COMPLETE only when your `transition` returns COMPLETE phase; the on-disk state file moves only on a `transition`. **Done is plugkit's pronouncement, not yours** -- even gate-allowance is not done; only a dispatched `transition` returning COMPLETE is, so a narrated PLAN->COMPLETE walk with the gate open or the verb un-dispatched is fabrication. Announcing "I'm finished" before the gate flips is narrating; the cure is `phase-status`. Not-COMPLETE means a next transition exists; idle and "waiting for the user" mid-chain are deviations (closure was authorized at request time). Between the four observations, between residual-scan and COMPLETE, between push and transition, re-dispatch `instruction` -- VERIFY is where premature COMPLETE happens.
+Chain enters COMPLETE only when your `transition` returns COMPLETE phase; on-disk state moves only on `transition`. **Done is plugkit's pronouncement, not yours** -- gate-allowance is not done, only a dispatched `transition` returning COMPLETE is; a narrated PLAN->COMPLETE walk with the gate open or the verb un-dispatched is fabrication. "I'm finished" before the gate flips is narrating; cure = `phase-status`. Not-COMPLETE means a next transition exists; idle/"waiting for the user" mid-chain are deviations (closure authorized at request time). Between the four observations, between residual-scan and COMPLETE, between push and transition, re-dispatch `instruction` -- VERIFY is where premature COMPLETE happens.
 
-**You close rs-learn's learning loop here -- you are the model in the loop and hold the one signal every core needs: how well this turn went.** Before COMPLETE, self-report turn quality 0.0-1.0 (1.0 = clean convergent walk, no deviations, pushed, gate-allowed; lower as deviations/rework accumulate). That number drives every core, none of which can observe it without you:
+**You close rs-learn's learning loop here -- you are the model in the loop, holding the one signal every core needs: how well this turn went.** Before COMPLETE, self-report turn quality 0.0-1.0 (1.0 = clean convergent walk, no deviations, pushed, gate-allowed; lower as deviations/rework accumulate). That number drives every core, none observable to it without you:
 
-- **Instant MicroLoRA adapter:** only with >=2 enabled disciplines (default-only = correct no-op, skip). Init once per session `learn {verb:init_instant, body:{targets:[<enabled namespaces>]}}`, then `learn {verb:feedback, body:{embedding:<bge embedding of this turn's task>, payload:{quality:<0-1>}}}` -- high quality shifts the helpful namespace's logit up so recall promotes it.
+- **Instant MicroLoRA adapter:** only >=2 enabled disciplines (default-only = correct no-op, skip). Init once/session `learn {verb:init_instant, body:{targets:[<enabled namespaces>]}}`, then `learn {verb:feedback, body:{embedding:<bge embedding of this turn's task>, payload:{quality:<0-1>}}}` -- high quality shifts the helpful namespace's logit up so recall promotes it.
 - **FastGRNN router:** `learn {verb:record_outcome, body:{target:"<your model id>", quality:<0-1>}}` so the next `route_hint` reflects learned outcomes.
-- **Deep EWC core** and **GAT attention relation weights:** the same quality as `record_loss` / `nudge_relation`.
+- **Deep EWC core** and **GAT attention relation weights:** same quality as `record_loss` / `nudge_relation`.
+
+rs-learn never calls a model; it emits the need, you supply the answer. Skipping the self-report leaves the cores untrained.
+
+**No summary, no prose-only turn here.** A summary, recap, announced-but-undispatched next move, or any tool-less message IS a stop -- VERIFY is where the temptation peaks. Until this surface returns phase=COMPLETE after `transition`, every turn ends in a verb (`phase-status`, `residual-scan`, the push verbs, `instruction`, `transition`). Catching yourself composing a summary IS the drift signal -> dispatch `phase-status` instead.
 
-rs-learn never calls a model; it emits the need and you supply the answer. Skipping the self-report leaves the cores untrained.
+## Constraints
 
-**No summary, no prose-only turn here.** A summary, recap, announced-but-undispatched next move, or any tool-less message IS a stop -- VERIFY is where the temptation peaks. Until this surface returns phase=COMPLETE after your `transition`, every turn ends in a verb (`phase-status`, `residual-scan`, the push verbs, `instruction`, `transition`). Catching yourself composing a summary IS the drift signal -> dispatch `phase-status` instead.
+Gauge every design/code decision against `.gm/constraints.md` (create from bundled default if absent) -- the standing decision-arbiter, checked at every phase.
 
 ## Dispatch
 

package/gm-plugkit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-plugkit",
-  "version": "2.0.1639",
+  "version": "2.0.1641",
   "description": "Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform binary, verifies SHA256, and starts the spool watcher daemon. Includes plugkit-wasm-wrapper for WASM-based spool watching.",
   "main": "index.js",
   "bin": {

package/gm.json

@@ -1,6 +1,6 @@
 {
   "name": "gm",
-  "version": "2.0.1639",
+  "version": "2.0.1641",
   "description": "Spool-dispatch orchestration engine with unified state machine, skills, and automated git enforcement",
   "author": "AnEntrypoint",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-skill",
-  "version": "2.0.1639",
+  "version": "2.0.1641",
   "description": "Canonical universal harness — AI-native software engineering via skill-driven orchestration; bootstraps plugkit for task execution and session isolation. Install in any AI coding agent host.",
   "author": "AnEntrypoint",
   "license": "MIT",

package/skills/gm/SKILL.md

@@ -30,6 +30,8 @@ Every turn: `instruction`, read, follow imperative, dispatch named verb. Re-disp
 
 **Class rule: platform-native capability with a plugkit verb -> forbidden, use the verb.** search -> `codesearch`; prior knowledge -> `recall`; URL/web -> `fetch`; run code -> `exec_js`; browser -> `browser`; persist memory -> `memorize-fire`; **any git op -> git verbs** (`git_status`/`git_log`/`git_diff`/`git_show`/`git_branch` inspect; `git_add`/`git_commit`/`git_finalize`/`git_push` stage-commit-push; `git_checkout`/`git_fetch`/`git_rm`/`git_revert`/`git_reset` mutate). `git_finalize {message}` bundles add->commit->porcelain-gate->push, one dispatch, CONSOLIDATE's push surface; `bash`/`sh`/`powershell` invoking git = gated (`deviation.bash-git-bypass`). Native tool bypasses ledger, index, portability. No verb exists = missing verb to add, not license to bypass.
 
+**gm is real infrastructure, not lore -- a missing `.gm/exec-spool` is an unbootstrapped repo, never grounds to declare the framework fictional.** First use in any repo: no `.gm/` directory yet is the NORMAL, EXPECTED state, identical in shape to a dead watcher -- the same one boot command below creates the directory tree, fetches the sha256-pinned `plugkit.wasm`, and starts serving, same as it does on the 1000th repo. Concluding "no spool dir = framework doesn't exist / isn't appropriate here" without running the boot command is asserting a claim you could witness in one dispatch and chose not to -- an unwitnessed prose conclusion, the exact anti-shape this file exists to prevent. If a request seems out of scope for gm (e.g. a manual read-only audit), that is a real judgment call to surface to the user -- but it is never grounds to skip booting and declare the tool imaginary; boot it, dispatch one `instruction`, and let the real response inform the judgment.
+
 **Boot before dispatching.** Writing `instruction/N.txt` to a dead watcher silently drops the request; you'd fabricate the chain from memory. Spool dir existing != watcher alive; `.status.json` `ts` within 15s does (stale leftover `.status.json` = common trap). First tool call, every session, the boot probe, one Bash call:
 
 ```bash