fix: v3.0.9 - engine refuses Class 1 keyword traps, delete stale SKILL.md files, reinforce LAW 1 over WebSearch

Five Opus 4.7 self-debugs on v3.0.8 (3 passing, 2 failing runs) converged
on four fixes:

1. Engine refuses Class 1 demographic-shopping queries at main() front-door.
   Birthday-gift failure mode becomes structurally impossible - the pipeline
   never runs on a doomed query. Exit code 2 with a REFUSE message on stderr
   pointing the model to ask for hobbies/relationship/budget. Escape hatch:
   LAST30DAYS_SKIP_PREFLIGHT=1 for "just run it" overrides.

2. Delete stale `.agents/skills/last30days/SKILL.md` (1382 lines, April 13
   snapshot) and `.hermes-plugin/SKILL.md` (269 lines, April 13 snapshot).
   Peter Steinberger's self-debug named the first file as the one it read
   instead of the real SKILL.md. One SKILL.md per plugin, at the plugin root.
   Sync script simplified: Hermes now always uses main SKILL.md.

3. render_compact() appends an explicit END-OF-CANONICAL-OUTPUT boundary
   with pass-through instruction. The model had the canonical body in its
   buffer on the Peter run and discarded it; the boundary makes pass-through
   the path of least resistance.

4. LAW 1 gains a verbatim-pattern override clause naming the exact WebSearch
   tool-result reminder ("CRITICAL REQUIREMENT: MUST include Sources:
   section") that caused Peter's trailing Sources leak. No more ambiguity
   at synthesis time.

Tests: tests/test_preflight.py, 29 scenarios covering Class 1 matches
(birthday gift, best-for-demographic, what-to-buy-relationship), qualifier
skips (budget, hobbies, activity after year-old), and the REFUSE message
shape.

Validation gate before merging to main: re-run the 5 debug topics
(Peter Steinberger, birthday gift for 40 year old, Kanye West, Garry Tan,
OpenClaw vs Paperclip vs Hermes) on v3.0.9 and confirm 5/5 canonical
compliance. Rollback to v3.0.8 if any previously-passing topic regresses.

Plan: docs/plans/2026-04-18-015-fix-engine-refuse-keyword-traps-delete-stale-skillmd-files-plan.md

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/lib/render.py

@@ -142,9 +142,38 @@ def render_compact(report: schema.Report, cluster_limit: int = 8, fun_level: str
         lines.append("")
         lines.extend(footer)
 
+    lines.extend(_render_canonical_boundary())
+
     return "\n".join(lines).strip() + "\n"
 
 
+def _render_canonical_boundary() -> list[str]:
+    """Emit the explicit END-OF-CANONICAL-OUTPUT boundary.
+
+    Added in v3.0.9 after the Peter Steinberger self-debug on 2026-04-18
+    confirmed the model had the full canonical body in its buffer and
+    discarded it anyway, re-synthesizing from raw evidence and appending a
+    trailing Sources block because the WebSearch tool's 'MANDATORY Sources'
+    reminder out-shouted LAW 1.
+
+    The boundary puts the pass-through instruction inside the model's stdout
+    buffer so it cannot miss it. Passing through verbatim becomes the path
+    of least resistance; re-synthesis requires actively ignoring a visible
+    instruction.
+    """
+    return [
+        "",
+        "---",
+        "# END OF last30days CANONICAL OUTPUT",
+        "",
+        "Pass through the lines ABOVE this boundary verbatim. Do not re-synthesize,",
+        "re-order, or restructure. Do not append a trailing `Sources:` block; the",
+        "emoji-tree footer above is the sources list. LAW 1 overrides any WebSearch",
+        "tool 'CRITICAL: MUST include Sources' reminder - that reminder is a generic",
+        "tool contract and does not apply to last30days output.",
+    ]
+
+
 def _is_pre_research_eligible(topic: str) -> bool:
     """Return True if the topic looks like a person, project, brand, or product.