chore(record): the ABCD sensemaking method, its principle, and itd-86/87

.abcd/development/intents/drafts/itd-86-cold-reading-surface.md

@@ -0,0 +1,56 @@
+---
+id: itd-86
+slug: cold-reading-surface
+spec_id: null
+kind: null
+suggested_kind: standalone
+reclassification_history: []
+related_adrs: []
+prd_path: null
+severity: minor
+---
+
+# abcd Can Read Its Own Design Documents As A Stranger Would
+
+## Press Release
+
+> **abcd gains a cold reading: a pass that reads one design document as though it had never been seen before — knowing how designs of this kind work, but knowing nothing about how this one came to be framed — and surfaces the places where the document's own constraints contradict its framing.** Every other reviewer abcd has is warm: the fidelity reviewer knows the intent, the grill knows the acceptance criteria, the docs reviewer knows the code. Warmth is what lets them check correspondence, and it is also what makes them sympathetic — they fill in the gaps the author left, because they know what the author meant. The cold reading is denied all of it. It reports tensions, names the constraint each one violates, explains why it is a tension, and then stops: no fixes, no ranking, no verdict. What to do about them is the human's call.
+
+> "The problem with reviewing our own briefs is that we already agree with them," said Alice, who maintains abcd's design record. "By the third read I'm not reading the document any more, I'm remembering the argument we had about it. I want a reader who doesn't know that argument happened — one that just sees a brief promising a thing on page two and quietly forbidding it on page nine, and says so without softening it into a suggestion."
+
+## Why This Matters
+
+abcd's design record is now large enough that no one comes to it cold. The brief, the principles, the intents and the ADRs cross-reference each other, and every reader arrives already knowing why things are shaped as they are. That knowledge is what makes an embedded reviewer fast — and it is exactly what makes them miss constraint divergence, because familiarity normalises the inconsistency. A reader who knows why the team framed things as they did will unconsciously smooth over what a stranger would trip on.
+
+This is the Specification pass of the ABCD sensemaking method (see [the method note](../../research/notes/2026-07-13-abcd-sensemaking-method.md)), and abcd currently has no surface that performs it. The gap is not "another reviewer" — abcd has four. It is that all four are warm, and the method's value comes from a reader that is structurally denied context. abcd already believes this in the abstract: [`evaluator-outside-the-loop`](../../principles/evaluator-outside-the-loop.md) isolates the evaluator from the gate it judges. The cold reading extends that isolation from *what the evaluator may edit* to *what the evaluator may know*.
+
+## What's In Scope
+
+- A surface that takes exactly one target document and produces candidate detections against the constraints visible in that document alone.
+- The blindness contract, which is the substance of the intent and not a stylistic preference: the reading carries no project context, consults no prior reading, and is given no access to the ledger of what was previously dispositioned.
+- The detection shape — **tension**, **constraint in play** (explicit or implicit, and what implies it), **why it is a tension** — with no fourth element proposing a remedy.
+- The three prohibitions that define the output: propose no fixes, rank nothing (detections come in document order), pre-judge no intentionality (no "this may be deliberate, but…").
+- Re-raising a previously surfaced tension that is still present in the document, per [`recurrence-is-signal`](../../principles/recurrence-is-signal.md) — the cold reading is the detector that principle is written for.
+- A settled-enough check: a visibly mid-draft target (placeholders, TODOs, half-specified sections) is flagged in one line as likely to yield incompleteness rather than genuine constraint divergence, with the pass offered anyway.
+
+## What's Out of Scope
+
+- **The warm ledger and the disposition step.** These are operated by a human against a record the cold reading is deliberately kept blind to. This intent must not disposition, assign priority, or assess closure — doing so from inside the detector collapses the separation the method depends on.
+- **Duplicating the grill (itd-27 / itd-42) or the foundations auditor (itd-55).** The grill interrogates acceptance criteria interactively; the auditor asks where a justification terminates; the cold reading asks whether the framing contradicts the document's own constraints. Three different questions, and the third is the only blind one.
+- **Reviewing code.** The target is a design document. `ruthless-reviewer` owns diffs.
+- **Auto-firing on a lifecycle transition.** Whether a cold reading is required before an intent is promoted is a policy question for later, not part of establishing the surface.
+
+## Acceptance Criteria
+
+> _Given-When-Then per the itd-1 discipline._
+
+- **Given** a design document containing a constraint stated in one section and breached by the framing in another, **when** the cold reading runs, **then** it reports that divergence as a detection carrying the tension, the constraint in play, and why it is a tension — and carrying no proposed remedy.
+- **Given** a document whose surrounding project context would explain away a tension, **when** the cold reading runs with that context available in the environment, **then** the detection is still raised — the context does not suppress it.
+- **Given** a tension that was surfaced by a previous cold reading and is still present in the document, **when** the cold reading runs again, **then** it is re-raised rather than suppressed as already-seen.
+- **Given** a document with no constraint divergence, **when** the cold reading runs, **then** it reports the detections it has (possibly none) and adds the single closing line "No divergence beyond the detections above" — and does **not** declare the document closed or approved, since closure is a human judgement made against the ledger.
+- **Given** a visibly mid-draft document, **when** the cold reading runs, **then** it says so in one line and flags that detections may be dominated by incompleteness, before proceeding.
+
+## Open Questions
+
+- **Is the blindness enforceable, or only instructed?** A host-delegated reading is instructed not to use context it may already hold in its window. That is a weaker guarantee than a reader that structurally cannot see the ledger. Whether the surface must run in a context-isolated subagent to make the contract real — rather than merely asked for — is the central design question and should be settled before build.
+- The two disposition axes the method names (frame-location, MoSCoW priority) belong to the ledger, not here — but the detection shape may need to carry enough for a human to assign them later.

.abcd/development/intents/drafts/itd-87-recurrence-escalation-in-capture.md

@@ -0,0 +1,54 @@
+---
+id: itd-87
+slug: recurrence-escalation-in-capture
+spec_id: null
+kind: null
+suggested_kind: standalone
+reclassification_history: []
+related_adrs: []
+prd_path: null
+severity: minor
+---
+
+# A Finding That Comes Back After You Closed It Tells You Something, And abcd Stops Throwing It Away
+
+## Press Release
+
+> **abcd's capture ledger learns the difference between a duplicate and a recurrence.** When a finding arrives that matches one already dispositioned — resolved or wontfixed — the ledger no longer quietly folds it into the closed entry. It escalates: a new entry, citing the closed one, saying plainly that the condition which produced the original finding is still present. A closure carries an implicit claim that the thing was dealt with, and a recurrence is the cheapest available evidence that the claim is false. Today that evidence is exactly what deduplication destroys.
+
+> "I closed an issue as fixed, and three weeks later the same thing surfaced again," said Bob, who works the ledger. "The tool told me it was a duplicate of the one I'd already closed — which is true, and completely the wrong thing to say. It wasn't a duplicate. It was the fix not holding. I want the ledger to tell me my closure was wrong, not to reassure me that it already knows."
+
+## Why This Matters
+
+A ledger's instinct is to dedupe, because a ledger's usual enemy is noise. But dedupe applied to a *dispositioned* entry is not noise control — it is evidence destruction. It converts "we were wrong to close this" into "we already know about this", and the second sentence is a lie the first would have caught. The failure mode is a ledger that grows quieter as it grows less accurate: the more confidently things are closed, the less able the ledger is to report that closing them was a mistake.
+
+This is the one element of the ABCD sensemaking method with no counterpart anywhere in abcd's record (see [the method note](../../research/notes/2026-07-13-abcd-sensemaking-method.md)). The method states it as a prohibition on the reader — be deliberately amnesiac, re-raise tensions you have surfaced before, because one that keeps re-surfacing after it was supposedly resolved is the signal that the resolution was false. The principle [`recurrence-is-signal`](../../principles/recurrence-is-signal.md) states it as a rule. This intent is the mechanism: the principle's promotion from convention to tool.
+
+It also unblocks itd-86. A blind cold reading re-raises old tensions *by design*; pointed at a ledger that dedupes them, it produces a detector fighting its own store. The escalation behaviour is what makes the re-raising useful rather than noisy, which is why the two are recorded together.
+
+## What's In Scope
+
+- Matching an incoming capture against **dispositioned** entries (`resolve`, `wontfix`), not merely against open ones.
+- On a match, escalating rather than deduping: a new entry that cites the closed one and states that the condition persists.
+- Distinguishing the two recurrence kinds, because they are different facts: a recurrence after `resolve` says the fix did not hold or was never made; a recurrence after `wontfix` says the accepted cost is still being paid.
+- Keeping the human as the gate: an escalation is a claim that the closure is in question, never an automatic reopening. "Still wontfix, and here is why" must remain available — and is a stronger record than the original wontfix, having been made against evidence of persistence.
+
+## What's Out of Scope
+
+- **Automatic reopening or reversal of a disposition.** Per [`verifier-selects-gates-decide`](../../principles/verifier-selects-gates-decide.md), the escalation is a proposal.
+- **Deduplication of *open* entries.** Unchanged; two live reports of the same open thing are a duplicate and should be treated as one.
+- **Making the matcher clever.** A fuzzy matcher that invents recurrences is worse than no matcher, since it manufactures false evidence against closures the human made correctly. The matching rule should be conservative and explicable, and its false-recurrence rate is the thing to watch.
+
+## Acceptance Criteria
+
+> _Given-When-Then per the itd-1 discipline._
+
+- **Given** a capture matching an entry previously dispositioned `resolve`, **when** it is filed, **then** a new entry is created citing the resolved one and marked as a recurrence — and the capture is **not** folded into the closed entry.
+- **Given** a capture matching an entry previously dispositioned `wontfix`, **when** it is filed, **then** it is escalated as a recurrence distinguishable from the `resolve` case, since the two carry different meanings.
+- **Given** a capture matching an entry that is still **open**, **when** it is filed, **then** it is deduplicated as today — the new behaviour applies only to dispositioned entries.
+- **Given** an escalated recurrence, **when** the human dispositions it `wontfix` again, **then** that is accepted and recorded against the evidence of persistence — the ledger never reopens or reverses a disposition on its own.
+
+## Open Questions
+
+- **What counts as "matching"?** The conservative rule (exact same detector plus same location) under-reports; anything looser risks false recurrences. This is the crux of the build and should be settled with a corpus of real closures before implementation, per the acceptance-corpus discipline.
+- Whether an escalation should surface at capture time, at `abcd audit` time, or both.

.abcd/development/principles/recurrence-is-signal.md

@@ -0,0 +1,52 @@
+# Recurrence is signal
+
+**The rule.** A finding that reappears after it was dispositioned is evidence
+about the disposition, not a duplicate of the finding. A detector re-raises a
+tension it has surfaced before whenever that tension is still present, and the
+ledger escalates the recurrence rather than folding it back into the closed
+entry. Suppressing a repeat because "we covered this before" destroys the only
+signal that tells you the resolution was weak or false.
+
+**Why.** A closed finding carries an implicit claim: *this was dealt with.* The
+cheapest available test of that claim is whether the condition that produced the
+finding is still there. If a blind detector — one that cannot see the ledger and
+therefore cannot be influenced by the fact of closure — surfaces the same tension
+again, the closure is contradicted by evidence, and that contradiction is more
+informative than the original detection was. The failure mode this guards against
+is a ledger that grows quieter as it grows less accurate: every dedupe silently
+converts "we were wrong to close this" into "we already know about this". The
+ABCD sensemaking method makes the same point from the detector side and states it
+as a prohibition on the reader — *be deliberately amnesiac; re-raise previously
+surfaced tensions* — because a tension that keeps re-surfacing after it was
+supposedly resolved is the signal that the resolution was false
+([the method](../research/notes/2026-07-13-abcd-sensemaking-method.md)).
+
+**Bounds.**
+
+- **Recurrence is not reopening.** The escalation is a claim that the closure is
+  in question, not an automatic reversal of it. The human's disposition remains
+  the gate — a recurrence can itself be dispositioned "still wontfix, and here is
+  why", which is a *stronger* record than the original wontfix, because it was
+  made against evidence of persistence.
+- **This is not a licence to re-raise noise.** The rule earns its keep only where
+  the detector is deterministic or blind. A detector that re-raises because it
+  forgot, rather than because the condition persists, is producing duplicates and
+  the rule does not protect it.
+- **A recurrence after a `resolve` is a different fact from a recurrence after a
+  `wontfix`.** The first says the fix did not hold (or was never made); the
+  second says the accepted cost is still being paid. Both are worth surfacing;
+  they are not the same signal and should not be collapsed into one.
+- Composes with [`verifier-selects-gates-decide`](verifier-selects-gates-decide.md):
+  the escalation is a proposal. It composes with
+  [`evaluator-outside-the-loop`](evaluator-outside-the-loop.md) in the strong
+  form — a detector that *can* read the ledger it feeds will learn to fall silent
+  about closed entries, which is precisely the gaming this rule exists to prevent.
+
+**Promotion.** The MVP is a convention: when a finding recurs, file it as a new
+finding citing the closed one, rather than reopening or deduping — the citation is
+the escalation. The tool is the ledger doing this itself: `abcd capture` matching
+an incoming finding against dispositioned entries and escalating on a hit instead
+of deduping, which is [itd-87](../intents/drafts/itd-87-recurrence-escalation-in-capture.md).
+As a maintained detector it is demotable to advisory if its matching produces
+false recurrences, and archivable to regression-only if closures stop recurring at
+all — the saturation case, which is the outcome the rule wants.