feat: plan-recon content-pin blast radius (issue #1 Fix 3)

plan-recon already had a Non-compile-checked sweep, but it was gated
behind signature/variant/removal scopes (omittable otherwise). The
raw-buf.2 failure was a module addition that shifted a workspace-listing
hash pinned in two test files — no signature change — so the sweep was
legitimately skipped and the twin pin was missed.

Adds "Content-pin-perturbing scopes" to Step 5: when the iteration
shifts a content-addressed/hashed/snapshot value a test pins, the
Non-compile-checked sweep is MANDATORY and must enumerate EVERY test
file that grep-matches the perturbed constant — not just the first.
Updates the omission clause accordingly, leans on the CLAUDE.md
lockstep-invariant pairs (no new profile slot), and adds a Common
Rationalisation plus two Red Flags. Embedded in the agent's own file
so the discipline does not depend on orchestrator memory.

refs #1

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

planner/agents/plan-recon.md

@@ -126,6 +126,22 @@ never to fix or write.
    missing the second is a known failure mode the project's
    past audits have flagged.
 
+   **Content-pin-perturbing scopes.** A change need not touch a
+   signature, variant, or symbol to break a test: if
+   `iteration_scope` adds, removes, or renames anything that
+   shifts a content-addressed or hashed value a test pins — a
+   workspace / package listing, a content digest, a generated
+   manifest, a snapshot — the Non-compile-checked sweep above is
+   MANDATORY for this scope too, independent of any compile-driven
+   set. Enumerate EVERY test file under the project's test roots
+   that grep-matches the load-bearing constant, fixture name, or
+   assertion shape the change perturbs — not just the first hit.
+   The recurring failure here is a hash pinned in two test files
+   where the recon found one and missed the twin; a module
+   addition that shifts a workspace listing is the canonical case.
+   Start from the lockstep-invariant pairs in the project's
+   `CLAUDE.md` — a content-pin is a lockstep invariant.
+
 6. **Spec-named-path existence table.** Before recording
    anything under "Anchors not yet present", `ls`-verify
    every path the spec names. `git ls-files <path>` or
@@ -210,9 +226,12 @@ answer.
 
 For iterations where `iteration_scope` does NOT involve a
 signature change / variant addition or removal / public-symbol
-removal, the "Compile-driven site set" and
-"Non-compile-checked sites" sections MAY be omitted; the
-"Spec-named-path existence table" is always required.
+removal AND does not perturb a content-addressed pin (see
+"Content-pin-perturbing scopes" above), the "Compile-driven site
+set" and "Non-compile-checked sites" sections MAY be omitted; the
+"Spec-named-path existence table" is always required. A
+content-pin-perturbing scope requires the "Non-compile-checked
+sites" section even when no compile-driven set applies.
 
 ## Status protocol
 
@@ -235,6 +254,7 @@ removal, the "Compile-driven site set" and
 | "Hand-listing every match arm gives me the site set — the compiler would say the same" | Multiple documented misses in this project's history say otherwise — each missed a different site type. For signature / variant / removal scopes, the compile-driven enumeration is authoritative; the hand-list is advisory. Run the type-checker after a stub, report the broken site set verbatim. |
 | "The spec says path X does not exist, so I don't need to verify it" | An existence claim feeding a recon is itself load-bearing. `git ls-files <X>` or `test -e <X>` is the authoritative check; an orchestrator-time grep of a sibling directory is not. The existence table makes this unmissable. |
 | "Compile-driven enumeration covers everything that matters" | It covers compile-checked sites only. Drift pins, fixtures, design-doc anchors, prose references — none of these break the build. Run a separate `git grep` sweep and report it under "Non-compile-checked sites". |
+| "The change only adds a module, it touches no signature — no blast radius" | A pure addition can still shift a content-addressed value (a workspace listing, a hash, a snapshot) that tests pin. Enumerate every test that grep-matches the perturbed constant; the canonical miss is a hash pinned in two files where one was found and the twin missed. |
 
 ## Red Flags — STOP
 
@@ -253,3 +273,8 @@ removal, the "Compile-driven site set" and
 - About to return only the compile-driven set without
   sweeping for non-compile-checked sites (drift pins,
   fixtures, doc references)
+- About to treat a content-pin-perturbing scope (module
+  add / remove / rename, listing or hash change) as having no
+  blast radius because it changes no signature
+- About to report one content-pin test site without grepping
+  for its twins under the project's test roots