revert: restore four lane-3 skill cuts that failed negative controls

.changes/attribution/revert-6599-setup-gotchas-e1f4a8b3.md

@@ -0,0 +1,7 @@
+---
+bump: patch
+---
+
+### Changed
+
+- The `setup` skill's Gotchas again warn against regenerating the whole config to change one key, and against moving the eval-fixture exclusion into the script. Their removal shipped on an eval that a negative control showed cannot tell the body from one with its procedure sections emptied, so the cut was never measured.

.changes/domain-driven-design/revert-6604-curate-language-description-c3d9e5f2.md

@@ -0,0 +1,7 @@
+---
+bump: patch
+---
+
+### Changed
+
+- The `curate-language` description is back to its earlier text. The shorter one shipped on an eval that a negative control showed cannot tell it from a one-line generic description, so the cut was never measured.

.changes/dometrain/revert-6605-sync-body-f2a6c9d4.md

@@ -0,0 +1,7 @@
+---
+bump: patch
+---
+
+### Changed
+
+- The `sync` skill body is back to its earlier text. The shorter one shipped on an eval that a negative control showed cannot tell it from a body with its check and Output sections emptied, so the cut was never measured.

.changes/kindle-dedrm/revert-6609-manage-body-a7d3e1c5.md

@@ -0,0 +1,7 @@
+---
+bump: patch
+---
+
+### Changed
+
+- The `manage` skill body is back to its earlier text. The shorter one shipped on an eval that a negative control showed cannot tell it from a copy with its procedure sections emptied, so the cut was never measured. The shorter description and the `setup` body stay: their controls passed.

plugins/attribution/skills/setup/SKILL.md

@@ -204,6 +204,12 @@ wording the check does not recognize, the same conclusion follows. Leave it off
 - **Gates do not quiet a report.** Raising `fix_precision_bar` changes what may be auto-fixed and
   shows exactly the same findings. If someone asks for a shorter report, the honest lever is
   `excluded_paths` for a class of surface that should not be scanned at all.
+- **Writing a whole config to change one key is a silent decision.** Merge is per-key override,
+  so regenerating the file from the default schema converts every key the user never mentioned
+  into a choice they did not make. Edit in place.
+- **The fixture exclusion belongs in config, and moving it into the script breaks the harness.**
+  An unconditional exclusion would decline the fixtures under the eval harness's own config
+  isolation, leaving the eval author reading prose instead of results.
 
 ## What this skill does NOT do
 

plugins/domain-driven-design/skills/curate-language/SKILL.md

@@ -1,5 +1,5 @@
 ---
-description: "Ubiquitous-language glossary maintenance: resolve ambiguous or overloaded terms, choose canonical language, record rejected synonyms, sharpen definitions, and route terms to a known bounded context. Use when 'update the domain glossary', 'define this domain term', 'standardize this vocabulary', 'these names conflict', domain modeling resolves vocabulary, or planning resolves domain language worth preserving. Not for passive glossary lookup, general dictionary definitions, or bounded-context discovery."
+description: "Actively maintain a consuming project's ubiquitous-language glossary as domain understanding changes: resolve ambiguous or overloaded terms, choose canonical language, record rejected synonyms, sharpen what-it-IS definitions, and route terms to an already-known bounded context. Use when: 'update the domain glossary', 'define this domain term', 'standardize this vocabulary', 'these names conflict', domain modeling resolves vocabulary, or planning resolves domain language worth preserving. Not for passive glossary lookup, general dictionary definitions, or bounded-context discovery."
 argument-hint: "[term, ambiguity, or resolved vocabulary]"
 user-invocable: true
 disable-model-invocation: false

plugins/dometrain/skills/sync/SKILL.md

@@ -9,11 +9,15 @@ disable-model-invocation: true
 
 Report-only drift check between this plugin's vendored `dometrain-grounding` baseline
 (`vendor/SKILL.md`) and Dometrain's current upstream skill content
-(`github.com/Dometrain/mcp`, `skills/dometrain-grounding/SKILL.md`).
-
-**Consumer vs maintainer role split:** `check` (the only action) is report-only. The
-`--refresh-baseline` flag is not skill-exposed; `context/update.md` documents it for a maintainer
-to type as a raw bash command in a working clone.
+(`github.com/Dometrain/mcp`, `skills/dometrain-grounding/SKILL.md`). There is one upstream
+dependency and no CLI to upgrade, only vendored prose to diff.
+
+**Consumer vs maintainer role split:** this skill runs only when a person types `/dometrain:sync`,
+so its frontmatter sets `disable-model-invocation` (what the flag does:
+<https://code.claude.com/docs/en/skills#control-who-invokes-a-skill>, as of 2026-11-02; recheck
+when that section changes). `check` (the only action) is report-only. The `--refresh-baseline` flag is not
+skill-exposed; `context/update.md` documents it for a maintainer to type as a raw bash command in a
+working clone.
 
 ## `check` (report-only, the only action)
 

plugins/kindle-dedrm/skills/manage/SKILL.md

@@ -7,13 +7,13 @@ disable-model-invocation: false
 
 ## Purpose
 
-Personal-use Kindle DRM removal is a fragile multi-tool workflow whose forgotten state mutations leave the machine broken (silent auto-update, stuck firewall rules, half-installed Calibre plugins). Each lifecycle step is a reversible action, and every upstream source that drifts independently is tracked (Amazon's Kindle for PC release cadence, Satsuoni's DeDRM_tools fork, Kindle_Key_Finder zip with rolling date in URL, techy-notes.com tutorial article).
+Personal-use Kindle DRM removal is a fragile multi-tool workflow with state mutations that, if forgotten, leave the user's machine in an awkward state (silent auto-update, stuck firewall rules, half-installed Calibre plugins). This skill captures the lifecycle as discrete reversible actions and tracks every upstream source that drifts independently (Amazon's Kindle for PC release cadence, Satsuoni's DeDRM_tools fork, Kindle_Key_Finder zip with rolling date in URL, techy-notes.com tutorial article).
 
 Scope: Windows-only (Kindle for PC + KFXKeyExtractor are Windows binaries). Single-user. Books the user owns.
 
 ## First step: probe current state
 
-On every invocation, run scripts/status.sh and read its JSON before deciding which action applies.
+Probe current state on every invocation. Run scripts/status.sh and read the JSON output before deciding which action applies.
 
 ```bash
 bash "${CLAUDE_PLUGIN_ROOT}/skills/manage/scripts/status.sh"
@@ -26,13 +26,13 @@ Output reports: Kindle for PC version, firewall rule presence, ICACLS deny prese
 | Action | When | What it does |
 |---|---|---|
 | (empty) | Default. Auto-detect from status | If pristine → recommend `/kindle-dedrm:setup`. If state OK + user mentioned new books → recommend `sync`. Otherwise emit status report |
-| `setup` | First-time install | Delegates to **`/kindle-dedrm:setup`**: provisioning walkthrough: download, install Kindle for PC 2.8.0, sign-in checkpoint, sync books, install Calibre plugins, run keyfinder, apply firewall + ICACLS lockdown |
+| `setup` | First-time install | Delegates to the dedicated **`/kindle-dedrm:setup`** skill (uniform check/apply contract): provisioning walkthrough: download, install Kindle for PC 2.8.0, sign-in checkpoint, sync books, install Calibre plugins, run keyfinder, apply firewall + ICACLS lockdown |
 | `sync` | New books purchased after initial setup | Disable firewall, prompt user to sync in Kindle, delete cached installer, re-enable firewall, re-run keyfinder |
 | `update` | Periodic drift check | WebFetch tutorial URLs + gh API for upstream releases, diff against captured baselines in `reference/sources.md`, emit drift report. No mutations |
 | `cleanup` | Decommission | Walk through every reversible mutation with per-item Y/N. Default (confirm-each) offers the firewall rule, ICACLS deny, keyfinder, and downloads; `--soft` limits to tools + downloads (keeps the firewall/ICACLS lock and Kindle for PC); `--full` also offers to uninstall Kindle for PC and remove Calibre plugins. The Calibre Library is never offered |
 | `status` | Diagnostic | Same as default empty action |
 
-When the action is empty, read the pre-computed context, classify state, and recommend the most-fitting action, or emit status if classification is ambiguous. When ambiguous, never commit to setup/sync/cleanup without user confirmation.
+Smart auto-detect when action is empty: read pre-computed context, classify state, recommend the most-fitting action OR emit status if classification is ambiguous. Never commit to setup/sync/cleanup without user confirmation when ambiguous.
 
 ## Hard safety rules
 
@@ -46,10 +46,12 @@ Apply across every action. Violating any risks losing the working 2.8.0 setup or
 
 ## Action: setup
 
-First-time provisioning lives in **`/kindle-dedrm:setup`**: `check` probes prerequisites and current
-state read-only, `apply` runs the full provisioning walkthrough (`reference/workflow.md`): the gated
-artifact download, install, firewall block, ICACLS lock, Calibre plugins, and keyfinder. When
-auto-detect finds a pristine machine, recommend `/kindle-dedrm:setup` rather than provisioning inline.
+First-time provisioning lives in the dedicated **`/kindle-dedrm:setup`** skill, which conforms to the
+uniform check/apply contract: `check` probes prerequisites and current state read-only, `apply` runs the
+full provisioning walkthrough (`reference/workflow.md`). The gated artifact download, install,
+firewall block, ICACLS lock, Calibre plugins, and keyfinder. When this router's smart auto-detect finds
+a pristine machine, recommend `/kindle-dedrm:setup` rather than provisioning inline; the sequence has a
+single owner (`/kindle-dedrm:setup` → `reference/workflow.md`).
 
 ## Action: sync
 
@@ -74,7 +76,7 @@ If user reports a cached installer popped up during step 3, that's expected. Ama
 
 ## Action: update
 
-No mutations. Diffs upstream sources against captured baselines in `reference/sources.md` + `reference/versions.md`.
+Drift check. No mutations. Diffs upstream sources against captured baselines in `reference/sources.md` + `reference/versions.md`.
 
 ```bash
 bash "${CLAUDE_PLUGIN_ROOT}/skills/manage/scripts/check-drift.sh"
@@ -93,20 +95,22 @@ Two further sources are tracked in `reference/sources.md` but have no automated
 companion article, and the supported-version list in Kindle_Key_Finder's `code/modules/utils.py`.
 Check those by hand when a drift report leaves a question open.
 
-Output: drift report listing each source's status (`current` / `stale` / `unreachable`) and recommended action (`re-download` / `update version pin` / `manual review`). The user decides what to act on.
+Output: drift report listing each source's status (`current` / `stale` / `unreachable`) and recommended action (`re-download` / `update version pin` / `manual review`). User decides what to act on; update action itself does not apply changes.
 
-When the user accepts a drift recommendation, the re-pin edit is **maintainer work**: apply
-it only when `${CLAUDE_PLUGIN_ROOT}` is inside a git working tree (`git -C "${CLAUDE_PLUGIN_ROOT}" rev-parse --is-inside-work-tree`
+When the user accepts a drift recommendation, the re-pin edit is **maintainer work, gated
+on a working-tree checkout**: applying it requires `${CLAUDE_PLUGIN_ROOT}` to be inside a
+git working tree (`git -C "${CLAUDE_PLUGIN_ROOT}" rev-parse --is-inside-work-tree`
 succeeds, a marketplace clone or a `--plugin-dir` load). In installed form
 `${CLAUDE_PLUGIN_ROOT}` is the read-only plugin cache: **stop** after the drift report and
 direct the change to the plugin's source repository (file an issue or PR there); never
 edit bundled files in the cache. Consumers then receive the re-pin through
 `/plugin marketplace update`.
 
-In a checkout:
+In a checkout, when the user accepts a drift recommendation:
 
-1. Apply the change to `reference/versions.md` (update pin, refresh page summary).
-   `check-drift.sh` parses its pins from that file, so no second copy needs editing.
+1. Apply the change to `reference/versions.md` (update pin, refresh page summary). The
+   single source of truth; `check-drift.sh` parses its pins from that file, so no second
+   copy needs editing.
 2. Run the affected portion of `setup` (e.g., re-download DeDRM_tools if a new pre-release is selected).
 3. Verify the workflow still works end-to-end on at least one book (run `sync` mode against a single test book).
 
@@ -120,7 +124,7 @@ bash "${CLAUDE_PLUGIN_ROOT}/skills/manage/scripts/cleanup.sh --soft"    # tools
 bash "${CLAUDE_PLUGIN_ROOT}/skills/manage/scripts/cleanup.sh --full"    # everything including Kindle for PC + Calibre plugins
 ```
 
-Reversal matrix (each setup/sync mutation and its compensating reversal):
+Reversal matrix (every row maps a mutation made by setup/sync to its compensating reversal):
 
 | Mutation | Compensating reversal | Confirm by default? |
 |---|---|---|