feat(pipeline): consolidate cycle recon, add fieldtest probe tier, enforce assumption economy

Implements the three efficiency findings from the #310 pipeline
measurement (refs #35): ~691k subagent tokens / ~3.5 h for a
deliberately small cycle, with recon duplication as the single
biggest obligatory per-cycle cost.

1. Cycle recon (pipeline.md § Cycle recon; specify, planner,
   brainstorm, boss, plan-recon): recon fan-out is budgeted per
   cycle, not per phase. One full plan-recon dispatch — normally
   specify Step 1, in a new pre-spec sources/recon_scope carrier
   form — serves both the spec's concrete code shapes and the
   plan's file-map. planner Step 2 becomes reuse-first (freshness /
   quotability / coverage conditions) with narrowly-bounded delta
   dispatches (new Delta dispatch contract in plan-recon.md);
   broad Explore-type grounding sweeps are banned in every mode.
   Field evidence: 151k (Explore) + 99k (plan-recon) with ~40 %
   overlap in one bounded cycle.

2. Fieldtest probe tier (fieldtest, fieldtester, pipeline.md,
   agent-template.md § model rule 2): a cycle whose user-visible
   delta is a single narrow axis dispatches the per-cycle
   fieldtest at tier: probe — 1-2 examples on exactly that axis,
   ~200-word report, explicit model:sonnet dispatch override (no
   dispatch-level effort override exists; frontmatter effort
   applies). Probe is a tier, not a skip; the milestone fieldtest
   always runs full tier on the frontmatter model, keeping the
   milestone-close gate's >=2-example floor unconditional.

3. Assumption economy (specify Step 3 + self-review item 6):
   grounding-check cost scales with the spec's assumption count,
   so specs state current-behaviour claims only where the change
   relies on them (the gate's own falsity test), demote
   context-only mentions to ledger citations, and keep iteration
   scope tight — fewer restatements, never fewer reliances. The
   gate itself is unchanged.

Design reviewed pre-implementation (opus plan review); diff
adversarially verified by a 3-lens review workflow (consistency,
operability, cross-reference), confirmed findings folded in.

refs #35

docs/agent-template.md

@@ -136,7 +136,16 @@ Assignment rule, in priority order:
    gating a cycle (adversarial lenses, plan recon, field/bench
    evidence, the in-loop quality review) — run `opus`. Opus is
    the documented strength for code review, debugging, and deep
-   reasoning.
+   reasoning. One conditioned exception (issue #35): the
+   per-cycle fieldtest's **probe tier** — the cycle's
+   user-visible delta is a single narrow axis — is dispatched by
+   the `fieldtest` skill with an explicit `model: sonnet`
+   dispatch override; the one-axis scope bounds the judgement
+   surface and the orchestrator triages every finding anyway.
+   The frontmatter keeps the opus default, which the milestone
+   fieldtest always runs. (The direct agent-dispatch surface has
+   no per-dispatch *effort* override, so the frontmatter effort
+   applies unchanged on a probe.)
 3. **Mechanical scope** — tightly-scoped execution of a pre-made
    plan, recon, extraction, compliance-diffing run `sonnet`
    (near-opus coding quality at lower latency and cost).

docs/pipeline.md

@@ -92,7 +92,10 @@ hold:
    `bug` findings; `friction` / `spec_gap` findings resolved or
    ratified into the design ledger. A `clean` roll-up is honoured
    only with positive evidence the test actually ran — at least
-   2 examples in the working tree (`examples_added`). A `clean`
+   2 examples in the working tree (`examples_added`). A milestone
+   fieldtest always runs **full tier** (the probe tier is
+   per-cycle only — `../fieldtest/SKILL.md` § Two tiers: probe
+   and full), so this floor is unconditional. A `clean`
    with fewer, over a milestone that touched user-visible surface,
    is itself a `spec_gap`, not a clean close (the agent owes the
    same floor — `fieldtest/agents/fieldtester.md` "What you DO NOT
@@ -151,6 +154,74 @@ judgement call like the `fieldtest` / `docwriter` dispatches,
 not an arm of the selector cascade; the trigger is observed
 accumulation of settled single-issue items.
 
+## Cycle recon
+
+Recon fan-out is budgeted **per cycle, not per phase**. The field
+evidence behind the budget (issue #35, one bounded cycle): a broad
+Explore-type sweep grounding `specify` (151k tokens) plus the
+`plan-recon` dispatch grounding `planner` (99k tokens) overlapped
+~40 % — two full recon passes over the same territory, the single
+biggest obligatory per-cycle cost. This section is the single
+source of the budget, reuse, and delta rules; the skills point
+here and add only their own dispatch mechanics.
+
+- **At most ONE full recon dispatch while a valid cycle recon
+  exists** — the **cycle recon**. It is a `plan-recon` dispatch
+  (`../planner/agents/plan-recon.md`) in the pre-spec carrier
+  form, normally fired at `specify` Step 1 when the work enters
+  code territory the orchestrator has not recently read; an
+  ad-hoc dispatch `brainstorm` fired earlier in the same cycle is
+  the cycle recon instead (subject to the coverage condition
+  below). One report serves every downstream consumer: the spec's
+  concrete code shapes and the plan's file-map. Normally that is
+  one full dispatch per cycle; a further full dispatch is
+  legitimate only via the fallback below.
+- **Broad exploration sweeps are not recon.** No Explore-type
+  fan-out for spec, plan, or pre-dispatch grounding — grounding
+  fan-out goes through the one cycle-recon dispatch. This binds
+  the orchestrator in every mode, `/boss` included.
+- **Reuse over re-dispatch.** A downstream phase reuses the
+  cycle-recon report while ALL of these hold:
+  - *Freshness* — no commit since the dispatch has touched the
+    paths the report maps (`git log <since-recon> -- <mapped
+    paths>` is empty; commits elsewhere — fixtures, tracker
+    side-effects — do not invalidate it). In a multi-iteration
+    cycle, iteration 1's commits to mapped paths invalidate the
+    report for iteration 2's planning.
+  - *Quotability* — the orchestrator can still quote the report's
+    Modify entries verbatim. A summarized memory of the report is
+    not the report. (The designed reuse window is the standard
+    same-session `specify` → `planner` handoff; across a session
+    break the fallback below applies.)
+  - *Coverage* (brainstorm-fired recons only) — the ratified
+    design's territory appears in the report's file-map or
+    existence-table rows, not merely as a one-line out-of-scope
+    acknowledgement. Missing territory is a delta below; a design
+    that pivoted wholly outside the mapped territory voids the
+    dispatch as cycle recon, and `specify` fires the cycle recon
+    afresh.
+- **Delta dispatches do not count against the budget.** A delta
+  is a narrow re-dispatch whose `focus_hint` names the gap; its
+  bounded contract is **Delta dispatch** in
+  `../planner/agents/plan-recon.md`. Triggers:
+  - the spec names a path or symbol that appears in neither the
+    cycle recon's file-map nor its existence table;
+  - MANDATORY: the iteration scope is a signature / variant /
+    removal or content-pin-perturbing scope and the cycle recon
+    carries no compile-driven site set for it — `planner` MUST
+    delta-dispatch before planning that scope. (`specify` avoids
+    this delta by naming the anticipated change shape in
+    `recon_scope`, arming the compile-driven enumeration inside
+    the cycle recon itself.)
+
+  Two deltas in one planner run is the smell that the iteration
+  scope is too broad — re-read the spec.
+- **A full re-dispatch is the bounded fallback, not a failure**:
+  no cycle recon exists (a direct tidy dispatch that skipped
+  `specify`; a session break), or a reuse condition failed. The
+  cost regression is capped at the pre-consolidation status quo —
+  one full dispatch.
+
 ## Phase descriptions
 
 ### brainstorm
@@ -184,7 +255,9 @@ the `grounding-check` gate, and takes sign-off — with review but no
 interview. Under the bold stance it decides every load-bearing fork it
 can *derive* an answer for and records the decision in the run's
 reference issue; it bounces to `brainstorm` only when a fork hangs on a
-pure user preference no source settles. A core node — the spec-production
+pure user preference no source settles. Its code grounding comes from
+the single cycle-recon dispatch (§ Cycle recon), never a broad
+exploration sweep. A core node — the spec-production
 gate before `planner` on every design path.
 
 Outside `/boss` the sign-off is the user's. Under `/boss` the autonomous
@@ -210,8 +283,10 @@ Hard-gate before implement. Produces a placeholder-free,
 bite-sized implementation plan in `docs/plans` (an ephemeral,
 git-ignored working file, shell-`rm`'d alongside the spec at cycle
 close — see `conventions.md` § Lifecycle) that the implement skill can
-execute task-by-task. Dispatches
-the plan-recon agent for read-only file-structure mapping.
+execute task-by-task. Its file-map normally comes from reusing the
+cycle-recon report (§ Cycle recon); it dispatches `plan-recon` only
+for that section's delta triggers, or in full when no valid cycle
+recon exists.
 
 ### implement
 
@@ -282,7 +357,9 @@ practices inside `implement`.
 
 Optional. Orchestrator-dispatched after the audit closes clean
 on a cycle that touched user-visible surface. Picks 2-4 real-
-world tasks within the cycle's scope, implements them using
+world tasks within the cycle's scope (probe tier, for a
+single-axis surface delta: 1-2 tasks on that axis — see
+`../fieldtest/SKILL.md` § Two tiers: probe and full), implements them using
 only the design ledger and public examples (never the language's
 own implementation), runs the results, and writes a friction-
 and-bug spec.