fix(poteto-mode): surface how-skips, edit anchors, and todolist close rules

[hieusats]

Closes #12

What changed

• feature.md step 1 now carries the skip contract architect already had. A dropped subsystem mapping stays visible as how skipped: <reason> instead of vanishing from the todolist.
• The SKILL.md edit non-negotiable now pins edit anchoring. Edits ride the content-hash tag from the latest read or write response, a stale view forces a re-read, and :raw stays a read selector rather than an edit header.
• The SKILL.md todolist non-negotiable requires marking items done as they land and bans a fresh init that summarizes completed work as pending.
• check-playbooks.test.ts locks all three clauses. CHANGES.md records the second audit under the existing process-gates section. Version moves 2.1.3 to 2.1.4 across the manifest, the marketplace catalog, and UPSTREAM.md.

Why these three. A second audit, of the 2026-08-30 UI-refresh session on the 2.1.2 install, found the first gate set held for dispatch and commit gates and missed these. The audited session corrupted files eleven times, repeated the #raw edit-header rejection on three string resources, dropped the how step silently, and closed with a re-initialized todolist.

Tradeoffs. The edit-anchor rule is prose, not a runtime check. The omp edit tool already rejects stale tags loudly, so the rule targets the agent behavior of repeating the mistake, and the test locks the wording against drift.

Blast radius. Skill prose only, served to every poteto-mode session after upgrade. No script, manifest shape, or agent definition changes. Sessions that already follow the rules see no behavioral difference.

Verification

• Bun tests, strict typecheck, static invariants, and plugin validation pass.
• The exact candidate is installed in every affected harness.
• The changed behavior passes from each real user surface.
• The installed version, action, and observed result appear below.

Scripts suite 172 pass, repo invariants 18 pass, tsc strict clean, manifests parse, and skill-collision-repro.sh reports the 2.1.4 version row. The new assertions ran red against the pre-fix skill files with 3 failures, then green with 16 passes after the fix commit, so the branch lands failing-test-first.

Live evidence:

Installed the branch as marketplace pstack-candidate and installed pstack@pstack-candidate 2.1.4 from it. With the 2.1.3 install disabled, ran a one-shot omp v18.0.11 session in /tmp that read skill://poteto-mode/SKILL.md and skill://poteto-mode/playbooks/feature.md and quoted both targets. The session returned, verbatim, the extended Source-edits bullet with the anchor clause and Feature step 1 with how skipped: <reason>. Restored the machine afterwards. The 2.1.3 install is enabled again, the candidate is uninstalled, the temporary marketplace is removed, and the working tree is clean.

[hieusats]

Independent verdict: PASS

Verified by an agent that did not write the change. Worktree: /tmp/pstack-verdict-13 (removed after verification), created from origin/fix/second-audit-gates. Commit verified: 1e0b615c3393596b88b6fc9205918128afb5f4f2 (matches git ls-remote origin fix/second-audit-gates).

CI gates (all green)

Command (cwd)	Outcome
bun install --frozen-lockfile (plugins/pstack/skills/poteto-mode/scripts)	6 packages installed
bun run test (same)	172 pass, 0 fail across 12 files (incl. check-playbooks)
bun run typecheck (same)	clean; 3 strict tsc --noEmit projects
bun test tests/ (worktree root)	18 pass, 0 fail across 3 files
bash tests/skill-collision-repro.sh (worktree root)	all checks ok, incl. "omp-pstack version matches across UPSTREAM.md and the 2 manifests (2.1.4)"

Clause verification (verbatim in the worktree)

• playbooks/feature.md line 5: how skipped: <reason> — present in Feature step 1.
• SKILL.md line 29: content-hash tag from the latest \read` or `write` response— present in the edit non-negotiable, together with:rawis aread` selector, never an edit header.
• SKILL.md line 14: never re-init a fresh todolist to summarize completed work — present in the todolist non-negotiable.
• scripts/check-playbooks.test.ts pins all three (assertions at lines 62-75), and that suite is green.

Live surface probe

Temporarily edited .omp-plugin/marketplace.json name to pstack-verdict-13 (uncommitted), then:

1. omp plugin marketplace add /tmp/pstack-verdict-13 — added.
2. omp plugin install pstack@pstack-verdict-13 — installed pstack 2.1.4.
3. omp plugin disable pstack@omp-pstack — old 2.1.3 install disabled.
4. Real session from a neutral cwd: omp -p "Use the read tool on skill://poteto-mode/SKILL.md and skill://poteto-mode/playbooks/feature.md. ..." — reply contained exactly the two required lines with the new 2.1.4 prose: the full "Source edits go through" bullet (content-hash tag anchoring, stale-view re-read, :raw as a read selector) and Feature step 1 with how skipped: <reason>. No old text returned.

Restoration

1. omp plugin enable pstack@omp-pstack — re-enabled.
2. omp plugin uninstall pstack@pstack-verdict-13 — probe install removed.
3. omp plugin marketplace remove pstack-verdict-13 — probe marketplace removed.
4. git checkout -- .omp-plugin/marketplace.json in the worktree — probe edit reverted.
5. git worktree remove --force /tmp/pstack-verdict-13 from the main checkout — worktree gone (git worktree list shows only the main checkout; directory absent).
6. omp plugin list --json after restore shows only pstack@omp-pstack 2.1.3, enabled: true (plus the pre-existing disabled superpowers 6.3.0 and ponytail@ponytail 4.9.0, untouched).

No red gates, no missing clauses, probe returned the new text, restoration confirmed byte-identical to the pre-probe snapshot.