session 2026-07-22: PENDING-69 boundary-drop mechanism (drafted→ruled→BUILT, Q7 capstone passed, on branch 21e3499) + /model-handoff skill; REVIEWED-69 awaiting steward placement

claude/skills/model-handoff/SKILL.md

@@ -0,0 +1,59 @@
+---
+name: model-handoff
+description: >
+  Author a scope charter on the CHEAP model before switching to a premium/expensive model
+  (e.g. Fable 5, ~2× Opus rate) for a bounded, high-leverage phase — so the premium rate is
+  spent only on the content reasoning, inside tight rails, with the load-bearing context living
+  in files (not the chat that the switch discards). Use when you (or the steward) are about to
+  hand a focused phase — a data-model spec, a failure-derived design, a hard build slice — to a
+  premium model. Produces a work-order charter: operating discipline, settled decisions (don't
+  re-derive), already-read summaries (don't re-read), a bounded + path-verified reading list,
+  exact deliverables, and report-and-stop.
+---
+
+# Model Handoff — the scope charter before the premium switch
+
+A premium model burns its rate on **sprawl and re-derivation** — large unbounded reads, long sessions, re-deciding settled questions, re-reading what a prior session already digested. The charter does the *bounding and orientation* reasoning on the cheap model (where it is cheap) so the premium model spends its premium rate only on the **high-leverage content** — the data model, the failure-derived defenses, the hard slice — inside rails it cannot wander out of. It is also **"knowledge in files, not chat"**: the charter is an artifact, so it survives the model switch that throws the conversation away.
+
+The proven exemplar this generalizes: `~/_Dev/studium-engine/docs/stage-1-planning-brief-2026-06-12.md` (authored on Opus 4.8 to bound a `claude-fable-5[1m]` planning phase). Read it once before authoring your first charter — its §0–§5 is the skeleton below, worked.
+
+## When this is the right instrument
+
+- A **bounded, high-leverage phase** is about to run on a premium/expensive model: a spec whose blast radius must be got right, a failure-derived design, a hard vertical slice — work where the *content* reasoning genuinely wants the stronger model.
+- The phase is **document-heavy** (it will read specs, indices, forensics) — the class where an unbounded premium session re-reads and re-derives at premium rate.
+- You want the switch to be **clear + wake**, not switch-in-place: the premium model should never re-read the long prior chat at premium rate — the charter is the handoff, the chat is discarded.
+
+NOT this instrument: routine work that doesn't warrant a model switch (just do it); a phase with no settled context to protect and nothing bounded to read (there is nothing to charter); a switch made *to escape* a confused session (fix the confusion or wrap-and-resume-fresh — a charter can't launder a muddle). If the phase isn't bounded, you can't charter it — that inability is the finding: bound it first.
+
+## The core law
+
+- **The burn is sprawl + re-derivation.** Every clause of the charter exists to deny one of them: settled decisions so nothing is re-litigated; already-read summaries so nothing is re-read; a bounded reading list so nothing is scanned; exact deliverables + report-and-stop so nothing drifts.
+- **Artifacts are the handoff, never the chat.** Load-bearing context lives in the charter (and the artifacts it names), because the model switch discards the conversation. Corollary — **reject "query the graph/index instead of files"**: the files are the source of truth; a derived index as the handoff surface is the index-as-source-of-truth failure this practice exists to avoid.
+- **Clear + wake, don't switch in place.** So the premium model reads the charter cold and works from it — it never pays premium rate to re-read the long chat that produced the charter.
+- **Bound before you switch.** The cheap model does the cheap reasoning (what's settled, what's already read, exactly what to read, exactly what to produce). The premium model does only the expensive reasoning, in the rails.
+
+## The charter skeleton (roles, not rigid numbers — from the proven exemplar's §0–§5)
+
+Write it as a **work order**: "Read FIRST. Work strictly inside it. Produce §4, then STOP and hand back." The sections:
+
+0. **Operating discipline (read first).** The model/window to confirm (the largest-window variant for a document-heavy read — a small-window variant will compact constantly mid-read; verify the current variants/rates, they drift); the thinking level for a bounded high-leverage phase (high); the hard rails — *read only §3, do not scan the repos, do not re-read what §2 summarizes, verify against the substrate not this charter's summary, produce exactly §4 then stop*. Name the **compaction signal**: if the premium session starts re-deriving settled decisions or going dumb, that is the cue to **`/wrap-up` and resume fresh**, not to push the window.
+1. **Already settled — do NOT re-derive.** The decisions the phase must build *on*, stated flat. Each one the premium model re-opening is a premium-rate re-litigation the charter exists to stop. If the phase catches itself re-deriving one, that's the stop-and-flag signal, not an invitation to re-decide.
+2. **Already read — key points (do NOT re-read these).** For each source the cheap model has already digested, its load-bearing points — so the premium model inherits the conclusion without paying to re-read the source. (Caveat, carried from §0: where a source's *exact* content is load-bearing — a schema shape, a failure's actual mechanism — the premium model reads the source, not this summary. Summaries are for orientation, not for the bytes.)
+3. **Bounded reading list — read THESE, nothing else.** The exact files, grouped by role, each **path-verified to exist** (see the authoring rule below). Plus an explicit **OUT of scope — do NOT read** list (the sibling repos, the parallel-not-relevant audits) — naming what *not* to open is as load-bearing as naming what to.
+4. **Deliverables — produce exactly these, then STOP.** The artifacts, by exact path, each with its required shape/sections and the one test it must pass. "Keep it the minimum to pin the contract, not a treatise." Nothing outside this list.
+5. **On completion.** Summarize for the steward (each artifact in a few lines); name the **open choices that remain the steward's to rule**; recommend the first next step; hand back. The steward reviews and the next phase begins **from the artifacts** (clean handoff — the load-bearing context is in the files, not the chat).
+
+## Authoring disciplines (each earned)
+
+- **Path-verify the reading list before the charter ships.** Every path in §3 and every deliverable path in §4 — confirm it exists (and is the thing you think it is) *now*, on the cheap model. A premium session that hits a dead path re-derives or scans to recover — the exact burn the charter exists to prevent, now at premium rate. This is the one authoring rule the practice is named for.
+- **Summaries orient; the substrate decides.** §2 carries conclusions, not bytes. Anywhere the phase's output depends on exact content (a schema, a mechanism, a count), §0 must send the premium model to the source — records drift in both directions, and a charter summary is a record.
+- **Bound the OUT-of-scope explicitly.** The premium model's cheapest failure mode is "just one more read." Name the repos and audits it must not open; make the boundary a rule, not a hope.
+- **The charter is cheap-model work.** If you find yourself doing the *content* reasoning while authoring the charter, stop — that's the premium model's job; the charter only bounds it. Authoring drift into content is the tell you're chartering something that isn't actually bounded yet.
+- **Clear + wake is part of the handoff.** End the cheap session by writing the charter to a file and handing back; the premium phase starts fresh from the file, not by continuing the chat.
+
+## What this skill does NOT do
+
+- It does not do the phase's content reasoning — it bounds it. The premium model produces the deliverables.
+- It does not authorize the switch or the spend — the steward decides whether the phase warrants the premium model.
+- It does not replace `/wrap-up` — when a premium session degrades, the charter's §0 points at wrap-and-resume-fresh; it doesn't itself capture session state.
+- It does not carry live model rates/windows as fact — those drift; the charter's §0 tells the reader to confirm the current variant, and the skill teaches the discipline, not the numbers.