Implement `design_docs/002-throughput-and-the-self-written-backlog.md` nf-dm4w ← Beads

Twinned from https://github.com/cfsh/ninefold/issues/516 by tools/beads/import_github.py's reconcile pass.

Filed unclaimed and unlabelled from the /design round in PR #515. Backlog, for the next triage round.

Doc: [design_docs/002-throughput-and-the-self-written-backlog.md](https://github.com/cfsh/ninefold/blob/claude/multi-agent-parallel-dev-ujkcml/design_docs/002-throughput-and-the-self-written-backlog.md)

The recommendation, in two lines

The dev team is not the constraint — bots authored 78% of new issues in the last 7 days (up from 48%), driven by two explicit instructions that say to. Cut arrival at both sources, make the reviewer's sandbox real (it isn't — --allowedTools restricts nothing under bypassPermissions), then activate the Tier 1 merge authority reviewer/DESIGN.md §6 already designed and whose calibration gate had never been run — it passes at ~3%.

Shape of the work

12 pieces in five phases — §8.1 of the doc, which reconciles aedanpope's own six-item hardening program ("harden the reviewer infra and then allow T1") with the doc's pieces. Roughly 7–8 PRs.

| Phase | What | Note | |---|---|---| | A — clear the decks | residual contract (CHARTER.md:116-122 → fold-or-drop), filing rules (CLAUDE.md:138, :501), ledger covers closed issues, dispose the 27 follow-ups, finish #485 + #494 | all independent, all cheap, none blocked | | B — harden | reviewer permission boundary, per-review worktree + presubmit on head, PRINCIPLES.md into the prompt, manual PRINCIPLES pass, STYLE_GUIDE.md | this is the hardening | | C — enforce | path-derived perimeter, PASS\|CONVERGED trigger, scripts catching principle/style violations | must follow A | | D — allow | Tier 1 activation | must follow B; blocked on aedanpope's ruleset grant | | E — check | re-measure at +2 weeks | the falsification step | | *separate* | WSL migration | a spike, not a task — §8.3 |

Two orderings that are not negotiable, and the reasoning is in §8.1:

• A before C. Scripts that catch violations add a finding class. Under the current residual contract that is ~1 new backlog issue per PR; under fold-or-drop it is a suggestion on the PR that caused it. Same change, opposite sign.
• B before D. Tier 1 hands a merge key to an agent whose "never merge, never push" is currently prose with no mechanism behind it (§2.6).

Notes for whoever takes it

• Start with the ledger piece (12) if anything slips — cheapest thing here, linked_refs and is_advisory already exist, and it has a live incident behind it (#503 → #505 auto-closed it with an unactioned aedanpope comment inside → recovered by hand as #518).
• §8.2: a hook cannot establish that a presubmit *was* run — only an independent re-run can. The dispatcher is already cron-driven with an App identity and already executes tests, so Phase B's worktree work gives you that for free and answers #417 without standing up a runner.
• §8.3: do not start the WSL move without the spike. probe.sh runs windowed deliberately and the probe baseline is rendered PNGs on the screenshots branch — a different GL path under WSLg plausibly invalidates every baseline and takes out #389's gate mid-hardening.
• §8.4: STYLE_GUIDE.md is sourced from aedanpope's real PR corrections, not invented. That corpus was extracted during the round.
• §5.4 pre-empts the objection that a path-derived perimeter reintroduces what #458 deleted. It doesn't — routing had a safe fallback ("run everything") which is what made it useless; a merge perimeter's safe fallback is "a human approves", which makes it conservative.
• Two open questions ship their defaults (§7) — the residual contract and dev-session filing. They are the two the doc argues matter most, and the two aedanpope has not weighed in on.
• The ⚠-marked numbers in §2 are single-sourced and worth re-measuring before anything expensive is built on them.

Supersedes nothing. Absorbs or answers: #381 (directly), and bears on #484, #481, #450, #420, #417, #503.