Derive the pass floor from the cited story's profile

.gitignore

@@ -12,3 +12,10 @@ _unrelated-seo-work/
 # passCount hands every fresh clone a pre-counted Gate-B pass.
 .context/*
 !.context/codex-gate.on
+
+# Local drafts and reading notes — working material, not repo content. `docs/field-reports/`
+# is deliberately NOT here: field reports are tracked, because a field-intake round cites
+# them as its evidence. These two replace a per-clone `.git/info/exclude`, so the policy
+# travels with the repo instead of living in one checkout.
+docs/ideas/
+docs/research/

README.md

@@ -127,7 +127,7 @@ plugin is installed once per machine; every other repo you open hears nothing fr
 
 Per-workspace knobs, all files under `.context/`:
 
-| `codex-gate.floor` | a positive integer; moves the 3-passes-per-gate floor. |
+| `codex-gate.floor` | a positive integer; moves the hook's reminder threshold. It does not change the floor §5 obliges, which is derived from the cited story's profile. |
 | `codex-gate.off` | silences the reminders; classification and state tracking keep running, so re-enabling lands on counters carrying the same semantics as gate-on — which is not the same as evidence that a review happened. |
 | `codex-gate.tools` | `execTool=<name>` and/or `reviewTool=<name>` — counts a Codex server whose tools aren't named `exec`/`review`, and only worth it if that server really does separate text-review from diff-review; aiming both gates at one general-purpose tool moves the counters while neither gate means what it says. Each mapped name must itself lie in `mcp__codex__*`: the hook's `hooks.json` matcher is `^(Bash\|Skill\|mcp__codex__.*)$`, so an out-of-namespace name is either never delivered (the mapping looks applied and does nothing) or, for the reserved names `Bash`/`Skill`, hijacks a lifecycle event; the hook refuses both — register the server as `codex` to place its tools there. Unparseable, out-of-namespace and reserved (`Bash`/`Skill`) lines are ignored, and the gate keeps its default `exec`/`review` name. A typo **inside** the namespace — `mcp__codex__exce` — is still honoured: the hook does not check that a mapped tool exists, so the gate now counts that name and nothing else. Whether it ever counts depends on whether a tool by that name is actually invoked; for a typo, normally never. |
 

docs/coding-workflow.md

@@ -76,8 +76,9 @@ story that captures *what* and defers *how*: the problem, the desired outcome, t
 acceptance criteria, which core invariants the change touches, the open questions,
 a rough size, and a **profile** — risk and security relevance, confirmed by the human,
 with a validation mode derived from the two. The two axes **add** review lenses at the
-gates for a risky or security-relevant change (they never subtract any: Gate A's floor and
-the baseline questions are the same at every level), while the derived mode calibrates
+gates for a risky or security-relevant change (they never subtract a baseline question; the
+floor itself derives from the profile, so it is not the same at every level), while the derived
+mode calibrates
 what evidence the author owes before Gate B. The design ("how") is deliberately left out —
 it belongs to the next stage. The value here is a shared, reviewable definition of done before
 anyone argues about approach.
@@ -127,8 +128,9 @@ prior review. Trivial changes may skip it, on terms that depend on the story: an
 unprofiled one keeps the judgement call, while a profiled one qualifies only at
 effective level 0 — trivial risk *and* no security relevance — so a trivial-looking
 change on security-relevant surface is not eligible. A skip removes the review, never
-the evidence: the battery still runs, the reason is recorded in the commit body, and
-so is one evidence entry per cited profiled story. **Explanatory**
+the evidence: the battery still runs, and the commit body carries the reason, the battery
+result, the cycle's provenance line, a skip record in place of the curve, and one evidence
+entry per cited profiled story. **Explanatory**
 documentation carries no gate at all — a wrong sentence there costs a confused reader
 rather than broken behaviour. Prompt artifacts are not explanatory prose: in a project
 whose product is prompts, the text *is* the behaviour, so the review policy requires Gate
@@ -276,8 +278,9 @@ top-level field alone is the wrong answer precisely where the override documente
 use, since `CODEX_DEV_REVIEW_MODEL` is stored at `tools.review.model`. If neither level names a
 model the probe establishes nothing — the CLI then picks its own default, and the only honest
 record is to set an explicit model or record the model as undetermined. Record the result beside
-the finding count in the pass record: the commit body's evidence entry, or the slot's
-dispositions file. This is
+the finding count in **the cycle's per-pass curve**, which pins a field for it — not the
+evidence entry and not the dispositions file, neither of which is keyed to a pass. The health
+probe above is how the value is established; the curve is where it goes. This is
 bookkeeping, not enforcement: nothing checks it, and a wrong entry looks exactly like a right
 one.
 

docs/field-reports/2026-08-16-canvas-a1-a5-dispositions.md

@@ -310,3 +310,69 @@ established neither whether the hash was computable at any given pass nor whethe
 failed to persist, and it did not read the hook at the site that computes it. Its one new lead — that the second
 shape's STOP arrived at a `git reset --soft`, which reaches the reset path only via `is_commit` —
 ties it to the item-2 row and is a lead, not a finding.
+
+---
+
+## Field note added 2026-08-28 — criteria that restate the design are a Blocker generator
+
+Observed across Gate-A passes 1–4 of the review-loop-economics cycle
+(`docs/superpowers/specs/2026-08-28-review-loop-economics-design.md`): **five Blocker-severity
+occurrences of one defect**, where the spec was revised and the story's acceptance criteria
+still described the superseded mechanism — criterion 8 demanding a floor a risk-`high` story
+cannot license; criterion 5 describing artifact-kind severity after a consequence-keyed test was
+settled; desired outcome 2 keeping a false-green-only carve-out; criterion 3 reversing the
+settled meanings of derived floor and hook knob; and criterion 4 requiring both shipped copies to
+describe a mechanism the design had deleted — where implementing the criterion would have
+recreated the rejected design in order to satisfy a criterion about it.
+
+The cause is structural rather than carelessness: those criteria embedded **mechanism detail**,
+so each had to track a design still in motion. A criterion that restates the design is a second
+copy of it, and this repo's ledger already records what a second copy does — "a restatement is a
+second copy that can drift".
+
+Remedy applied in that cycle: the criteria were rewritten to state **what must be observably
+true** rather than **how**, with the bound that a criterion which cannot be made observable
+without naming mechanism is one where the mechanism *is* the contract, and there it stays named.
+
+**Captured, not acted on beyond that cycle.** This is field evidence for whoever next touches
+`dev-workflow:intake`, whose story template says acceptance criteria "describe observable
+outcomes or constraints, never implementation steps" — the rule exists; what this record adds is
+five measured occurrences of the failure it is meant to prevent, and the observation that the
+drift shows up as *Blockers in a later gate* rather than as a bad-looking criterion at intake
+time.
+
+**Also observed, 2026-08-28, same cycle:** three occurrences of an agent ending a turn on an
+announcement — "writing the spec now", "running pass 6" — with the named tool call never issued.
+A fourth followed on 2026-08-29 ("running pass 10"), spotted by Daniel watching the terminal. Each cost a round-trip and one cost ~90 minutes of wall clock before a peer session noticed. No
+error, no timeout, nothing in flight: the announcement simply replaced the act. Remedy adopted for
+the remainder of that cycle: during an active gate cycle a turn ends with the tool call actually
+issued, a message sent, or an explicit statement that something is blocking — and noticing the
+turn ending with the call not in flight *is* that statement.
+
+**Prediction recorded 2026-08-28, before the pass that tests it.** Gate-A pass 7 of the
+review-loop-economics cycle found that the spec's own nineteen-row condition-inventory table (§6.2)
+had become the loop's largest finding source: **7 of 29 Blocker/Major, including 4 of 9 Blockers**,
+every one a row contradicting the design it existed to account for. The table was split out —
+method and passage list stay in the spec, the row-by-row dispositions move to an artifact produced
+once against frozen text and gated before implementation.
+
+Verbatim prediction, so it can be scored rather than remembered: **pass 8 should lose roughly 7 of
+29 Blocker/Major and 4 of 9 Blockers to the §6.2 removal. If pass 8 does not fall materially, the
+generator is elsewhere and the whole-artifact split becomes the live candidate.**
+
+Worth keeping either way: this is the third site of one defect class in a single cycle — a
+restatement that must track a moving original. It appeared in the story's acceptance criteria
+(five Blocker occurrences), then inside the spec's own accounting table (four more). The lesson is
+not "write the table more carefully"; it is that a second copy of a moving thing drifts, and the
+remedy is to produce it once against something that has stopped moving.
+
+
+**The loop's first wrong finding, 2026-08-29.** Gate-A pass 13 of the review-loop-economics cycle
+returned a BLOCKER claiming a spec sentence was "syntactically incomplete at *every and the curve
+duty treated as owed*". `grep 'every and'` on the reviewed file returns nothing — the break existed
+in revision 13 and revision 14 had replaced the sentence. **Dismissed with that evidence.**
+
+Worth recording because it is the **first outright wrong finding in thirteen passes** of that
+loop — roughly 380 findings. That ratio is the argument for validating before applying rather than
+against it: the discipline cost thirteen passes' worth of checking and caught one, and the one it
+caught would otherwise have driven an edit to text that was already correct.