make context a budget the harness enforces

Adopts ideas/token-conservation.md, parked 2026-07-28, plus the disciplines
the human added: read the compressed form first, discover by mechanism,
shrink output at the source, never pay twice for the same bytes.

docs/context-economy.md owns all of it and leads with a floor, because
every cheap failure mode is also a token saving — skipping the owning doc,
guessing a signature, reporting from a diff, thinning a test — and each has
already cost this repo a defect. Frugality is for presentation and
discovery, never for the artifact or the evidence.

Mechanical, not remembered:

- scripts/surface.sh generates docs/surface.md — every top-level
  declaration with its line, 261 lines standing for 3757 of source. The
  pre-commit hook regenerates and stages it, so it cannot be stale, and
  verify.sh compares independently for a clone that never set
  core.hooksPath. The hook refuses a commit with unstaged .go changes,
  since what it generated describes the working tree, not the commit.
- verify.sh --quiet: 48 lines of gate output become 1. The hook uses it.
- CLAUDE_LOC_MAX=150, the only budget billed per turn rather than per read.

Both new gates were watched failing before being kept: a doctored
surface.md, and CLAUDE_LOC_MAX temporarily set to 5.

state.md's inventory loses its LOC column. It had already drifted on six
files (content.go 381→450, render.go 447→454, web.go 206→217, check
216→223, watch 129→137, chrome 105→110) which is what a number written in
two places does; the generated file owns sizes now, the table owns purpose.
The subagent question is recorded there as the one open decision, with the
case for and against written out in the idea file.

CLAUDE.md

@@ -24,6 +24,12 @@ disagree, the code wins — say so, fix the doc in Document.
 writing. Before stating a rule, contract, threshold, or gate, read its owning doc; if it already
 says it, amend there instead of restating elsewhere.
 
+**Read the compressed form first.** `docs/surface.md` (generated, gated) says where every declaration
+lives; `go doc ./internal/<pkg>` gives a package's surface; a test states a contract in a fifth of the
+lines that implement it. Locate with `grep -n`, then read that range — a whole file is for the doc that
+owns a rule you are asserting, or code you are about to rewrite. Every discipline, and the floor none of
+them may cross: `docs/context-economy.md`. A saving that buys a guess is not a saving.
+
 `ideas/` and `reference/` are out of context by default, indexes included. Open one only when the
 human names it. Never sweep, never list, never cite unasked. Storage, not background.
 
@@ -86,7 +92,7 @@ Procedure: `.claude/skills/khosra-feature-loop/SKILL.md`. The three gates people
 batched, up front, each with a **bold** default so silence answers. Never about naming, formatting,
 or anything `docs/conventions.md` decides. None to ask? State assumptions in one line and move on.
 
-**Verify.** `./scripts/verify.sh` green, plus one piece of feature-specific evidence you actually
+**Verify.** `./scripts/verify.sh --quiet` green, plus one piece of feature-specific evidence you actually
 ran (golden file, `curl`, test name, benchmark). Never report success from reading your own diff.
 "Should work" is not a result.