docs(workspace): return CLAUDE.md to the entry file, and split the reviewers' effort

[protonspy]

What changed

CLAUDE.md was 96.8KB and preloaded into every request of every session. Almost all of it was a third copy of what .claude/rules/ and docs/ already own, and in one place it contradicted them outright: ## Commands told a session to run make check, while .claude/rules/project.md says make is absent on Windows and gives go build ./....

The binary's own entry template says the methodology lives in rules/ and is never inlined, and TestScaffoldedEntryFileStaysShort holds every workspace scc scaffolds to 60 lines. This workspace was breaking the contract its own product enforces.

CLAUDE.md is now that template as rendered for Claude Code, plus the two spliced usage blocks — 95 lines, 4.9KB. The standing cost of entry file + unscoped rules goes from 131.3KB to 39.4KB per request, roughly 23k tokens.

Each concern went to the one place that owns it:

Concern	Home
Methodology	.claude/rules/* — untouched, it already owned this
This project's commands, conventions, boundaries	.claude/rules/project.md — untouched, already filled
Why it is like this	docs/wiki/pages/, docs/codewiki/, docs/adr/

Extended rather than restated: delivery-gate (the grouped check object, and why flat put build on line 2 with its siblings on line 170), integration-boundary (the Windows dev container as the weaker boundary, one graph per scoped tree), managed-files (CarryOver, and the silent deletion it prevents), artifact-addressing (the reading surface, BM25 over regions rather than a search engine, the seal), spec-or-plan (the spec's delivery record, and why merged is not "is an ancestor of the base").

New: wiki pages note-log and release, docs/codewiki/packages.md, and the first two ADRs — stdlib-only dependencies, and the narrowing from csdd with the dev container recorded as the one item since reversed.

The reviewers' effort, and why it ended up split

Asked for as "both at medium". It landed as one commit doing that, and then a second undoing half of it — the trail is deliberate, not churn.

scc-security-review reviewed the commit that lowered its own reasoning budget and returned changes-requested at medium severity: effort is not verbosity there, it is the resource the job runs on — a traced path from attacker-controlled input to effect, with no checklist to fall back on — and the change had no measurement behind it. That was correct.

The cost argument is still real (both reviewers are dispatched on every PR, not on the risky-looking ones), but it is about running both at the maximum and does not divide equally between them. So the budget moved out of one shared constant into each agent's own template: scc-code-review medium, scc-security-review high. It is required rather than defaulted — a third reviewer added without one fails to render instead of inheriting a number nobody chose.

assets.Version 35 → 37.

Verification

scc validate --checks — 11 validators, 0 findings, 1002 tests, 86.2% coverage (floor 86). golangci-lint run — 0 issues. No Go behavior changed beyond the effort rendering.

Review verdicts

Both reviewers ran on both halves. Four reports, all recorded here:

Diff	scc-code-review	scc-security-review
The docs fold	changes-requested — 2 major, 1 minor. All fixed.	clean
The effort change	clean — 1 minor. Fixed.	changes-requested — 1 medium. Addressed by the split above.

What the code reviewer found on the fold, and what was done:

• major — the Headroom counter-case had no home. The old CLAUDE.md named it and nothing else did. docs/wiki/pages/managed-files.md now carries it: rtk.ForeignBlock detects a headroom:rtk-instructions block, reports it, and names headroom unwrap <agent> — reported and never touched, because that block belongs to Headroom.
• major — .claude/skills/gauntlet-loop/SKILL.md told the agent twice to check four invariants in CLAUDE.md. This branch is what moved all four; the pointers now name where each lives.
• minor — four codewiki citations did not evidence the prose attached to them: os.SameFile is not in cli_test.go, decode sat outside the cited range, command outside the hooks range, and an ears.go range carried a claim about mdscan. scc validate only checks that a range resolves, which is exactly the gap. Fixed.
• gate — the plan's task 2.3 asked for six ADRs and two were written. The task now says what was decided: the other four already resolve to a wiki page, and a second copy is the duplication this work removes.

The security reviewer confirmed on the fold that ~/.ssh is not mounted into the dev container, that both spliced blocks are byte-identical, and that no safety instruction was lost — the attribution rule still lives in .claude/rules/delivery.md, untouched.

Its one standing caveat, not fixed and recorded rather than silently dropped: scc-code-review at medium has no measurement behind it either. The argument for it is that its job is checklist-shaped — a task list, a test run, a linter — against the security reviewer's, which is not. That is reasoning, not evidence. A before/after on past PRs with known findings is what would settle it.

Plan

plans/claude-md-dedup.md, all ten tasks ticked.