Teach the plan-mode guard once, keep it everywhere

Context

The story behind this plan — what prompted the work and why it matters now.

Measured across kit/plugins/: 52 files mention ExitPlanMode, and the lines
containing it total about 2,750 words. The same four-line block — exit plan
mode, here is why mutations cannot proceed inside it, ExitPlanMode is
deferred, call ToolSearch with select:ExitPlanMode first — is repeated
verbatim 19 times in one phrasing and 7 more in a near-identical variant.

Distribution: social-media-tools 16 files, plan-agent 12, git-agent 11,
artifact-tools 4, product-plans 3, skill-reviewer 2, and one each in
team-defaults, content-tools, code-testing-agent, and code-review.

Two of the Claude 5 context-engineering rules apply at once. Rule 4 says state
a thing once rather than repeating it across layers. Rule 1 says prefer
judgment over rules — a current model asked to commit while in plan mode does
not need forty words explaining that writes are mutations.

This plan reduces the guard, it does not remove it. A skill that starts
writing files inside plan mode violates a standing user preference, and that
failure is silent — the write either fails confusingly or escapes a mode the
user deliberately entered. The distinction Step 2 draws is between the guard
(one line, keep in every write-heavy skill) and the tutorial (the deferred
tool mechanics and rationale, delete everywhere). Read-only skills that carry
the block at all should lose it entirely, since they never mutate.

Eight plugins change, so eight marketplace.json version bumps land in this
work. That wide blast radius is the reason this is its own plan rather than
part of a larger sweep: it must be revertible as one unit. The per-file change
is mechanical and repetitive across eight directories, so workflow: true is set
to allow parallel per-plugin execution with a final verification pass.

Corrections made during execution. Three of the numbers above were
measured against the wrong scope. They were corrected rather than worked
around, and each correction is recorded here so the diff can be read against
the spec.

Fifty-two files, but forty-three carry boilerplate. The 52 came from
grep -rl ExitPlanMode kit/plugins, which also matches nine files where the
mention is legitimate: five CHANGELOG.md histories, plan-agent/README.md,
plan-agent/hooks.json (a PostToolUse matcher), code-review/commands/fix-branch.md
(a lint rule asserting that any body mentioning ExitPlanMode also declares
ToolSearch), and team-defaults/skills/sync-rules/rules/plan-mode.md (the
shipped copy of the user's global plan-mode rule). None is duplication. The
real target was the 43 files matching select:ExitPlanMode in a body.

Eight plugins, not ten. The two dropped are code-review and
team-defaults, whose only mentions are the two legitimate files above.
Bumping them to reach ten would have been a fabricated change.

The under-600 word budget needed a scope, not a smaller number. Measured
with the plan's own command, grep -rh 'ExitPlanMode' kit/plugins | wc -w,
600 is unreachable: 449 words are allowed-tools: frontmatter (the permission
declaration — deleting it breaks the tool rather than saving context), 512 are
CHANGELOG history, and 161 are the legitimate content above. The floor is 1,122
before a single guard line exists. The budget now measures what it meant to
measure — the bodies of skills/*/SKILL.md, commands/*.md, and agents/*.md,
frontmatter excluded — where the sweep took 1,678 words down to 553, of which
only 73 is prose other than the canonical guard itself.