the rule stated once

replaced the recurring forensic build GC with a mechanical one, on a task branch rather than main
- the decision logic left build_gc.rs for build_gc_mechanical.rs, 401 lines, so the rule is stated once instead of re-derived from evidence on every run
- the lease gained its own checks and the sgit pin-quarantine hook changed with it, under a separate axiom because the existing one did not bound that file
- the axiom gate rejected three drafts before any of it could be committed: promoting beside the task that already covered it instead of consolidating into it, a sibling file the axiom left unbounded, and a rule written in the wrong shape

rebuilt the hourly mono precheck after it spent a full hour producing nothing
- subprocess.run(timeout=) re-enters communicate() and blocks forever while a grandchild still holds stdout, and the self CLI spawns plenty of them, so the run before the fix sat 3600s with no probe able to finish
- children are killed by process group now, probes run in a thread pool, and a watchdog prints a partial census at a hard deadline, so a cron kill leaves evidence instead of destroying it
- a truncated or failed probe reports unknown rather than clean, and the caller keeps waking the agent
- the untracked-file walk measured 188s of 397s of probe time across 44 trees and changed the dirty verdict on none of them, so it is skipped unless asked for
- trees under the folders macOS denies this agent are skipped too, because git dies there with an operation-not-permitted error and spends the whole timeout finding out
wrote the day's corrections into the voice rules: lead with the finding, a why-question asks for a cause and is not a work order, and a correction needs the artifact behind it