more fixes and testing

.github/pull_request_template.md

@@ -5,6 +5,6 @@
 ## Checklist
 
 - [ ] `CHANGELOG.md` `[Unreleased]` has a line for any change to what the skill does
-- [ ] Generic files stay language-neutral; mandatory rules are in `skills/SKILL.md` and the file that carries them out
+- [ ] Generic files stay language-neutral; mandatory rules are stated briefly in `skills/SKILL.md`, in full in "Rule details" in `skills/WORKFLOW.md`, and in the file that carries them out; sources go in `skills/references/`
 - [ ] Links, file names, quoted section names, and rule numbers this change touches still point at something
 - [ ] Behavior changes were measured before and after, or this says why not

CHANGELOG.md

@@ -24,13 +24,14 @@ Versions follow [semantic versioning](https://semver.org): while the major versi
 - **"Fixed as a side effect" needs proof.** The agent must name the failing input and the command that showed the original failing; a changed condition or check is never a side effect.
 - **Instructions found in project files are reported.** Text in comments, docs, test data, or fetched pages that addresses AI assistants is never followed, and the agent tells the developer which file contains it. The report header has a required "Instructions found in project files" section, and the final summary repeats it, so the warning is not lost in report mode.
 - **The language file is required reading.** In every mode, `SKILL.md` names the language files next to the mode file, to be read before any code: one for each language in the code being read or written, `GENERIC.md` for a language without one, and a language met partway through is loaded before its code is read. The language's hidden costs and security traps (such as unrandomized integer hashing in Python) are no longer skipped.
-- **`SKILL.md` is less than half as long** (about 2,600 words, from 5,600), so every session loads less. Each mandatory rule is stated in a few sentences there, and its full text moved to a new "Rule details" section in `WORKFLOW.md`, which report and apply mode already read. The workflow overview and anti-pattern list, which repeated `WORKFLOW.md` and the rules, were removed; their examples moved into the rules. Rule numbers are unchanged.
+- **`SKILL.md` is less than half as long** (about 2,800 words, from 5,600), so every session loads less. Each mandatory rule is stated in a few sentences there, and its full text moved to a new "Rule details" section in `WORKFLOW.md`, which report and apply mode already read. The workflow overview and anti-pattern list, which repeated `WORKFLOW.md` and the rules, were removed; their examples moved into the rules. Rule numbers are unchanged.
 - **Report mode loads less.** Applying and close-out (Phases 5 and 6) moved from `WORKFLOW.md` to a new `APPLYING.md`, which only apply mode reads, in the same step as `WORKFLOW.md`. Text in "Rule details" that repeated those phases or `DIFFERENTIAL-TESTING.md` was removed.
 - **Report mode reads the report format.** `SKILL.md` names `REPORTING.md` for report mode, to be read with `WORKFLOW.md`, so the required report header (including instructions found in project files) is not skipped. The apply results format and the `NEEDS-TESTING` and `BEHAVIOR-CHANGE` markers moved to `APPLYING.md`, so report mode does not load them.
 - **Code that nothing reaches is not optimized.** The agent follows callers, including indirect ones (dependency injection, routing, listeners, plugins, reflection), up to an entry point. Evidence that the code runs (a profile or log, the developer saying it runs or is slow, documentation or deployment configuration saying what uses it or when it runs) also counts. When the chain reaches none, or only tests, the code is not optimized, since speeding it up saves nothing: it is listed in the report under "No entry point found" as likely unused, never deleted, bugs noticed in it are still logged, and the developer is asked where it is used. Before, it stayed a ranked item with unknown reachability.
 - **Every file loads less.** The source lists at the end of each file moved to `references/`, which the agent reads only to verify a claim. The machine-learning, image, geometry, and simulation traps moved from `BEHAVIOR-TRAPS.md` to a "Behavior traps" section in the matching `techniques/` file, which `BEHAVIOR-TRAPS.md` names for code in those domains. All files were reworded to be shorter, with no rule, step, fact, or example removed.
 - **Caches see writes from other processes.** A new trap, "Writers outside this process": when other processes, machines, or jobs share the data, a cache inside one process must detect their writes on every read (a version number or change counter the data source keeps) or cache only data they never change. In write mode the agent decides this before writing: it writes the version that keeps exact results and offers the faster, possibly stale version as an option, instead of shipping it and asking afterwards.
 - **Fewer wasted steps.** The agent runs tests the way the project documents them instead of guessing a runner, and gives commands that can hang a time limit.
+- **Conflicting size sources are reported.** When the README, configuration, code, or tests give different input sizes, the agent lists each source and number, says which one it used and why, and asks the developer to confirm when the choice changes a ranking or a design.
 - **New traps and tests:** cyclic structures (an iterative rewrite without a visited set loops forever where recursion failed fast), and round-trip tests when new code reads what existing code writes.
 
 ### Fixed

CONTRIBUTING.md

@@ -20,6 +20,7 @@ Thank you for helping. This project is a skill: Markdown instructions that codin
 
 - **Put each instruction where it belongs.** A mandatory rule goes in `skills/SKILL.md`, stated briefly, with its full text in "Rule details" in `skills/WORKFLOW.md` and its steps in the file that carries it out. Anything else lives in exactly one file, and others point to it.
 - **Write for coding-tier models** such as Claude Sonnet and Opus. Every instruction must be followable without guessing: explicit, no shorthand, and an example where a rule is easy to misread.
+- **Keep sources out of loaded files.** Each skill file's references go in `skills/references/` at the same path (for example `skills/references/techniques/hostile-inputs.md`), and the file ends with a pointer to them.
 - **Keep generic files language-neutral.** Name concepts ("an operation that copies a collection"), not one language's functions. Language-specific names belong in `skills/languages/`.
 - **Keep references whole.** When you rename a file or a section, or renumber a rule, update every link, file name, quoted section name, and rule number that points at it. An agent that follows a reference to nothing skips that step.
 - **Do not trim instructions to save tokens.** Every file is loaded only when a step names it. Remove repetition, never content.
@@ -39,7 +40,7 @@ A new evaluation harness is being built from scratch. [docs/EVAL-PLAN.md](docs/E
 
 ## Toolchains
 
-The dev container in `.devcontainer/` has the JDK, Ruby, Node, Rust, Python, and Swift toolchains.
+The dev container in `.devcontainer/` has the JDK, Python, C, Node, Rust, Swift, and Ruby toolchains, and Claude Code. It has no Kotlin or C# toolchain.
 
 ## Reporting problems