docs: the standard says where it stops, and row 10 is what is left

[JulienMartel]

What

docs/cli-presentation.md's order of work ended at step 9 and read as finished. Four files disagreed. This adds row 10 (haus's three remaining painters) and a new final section, Where the standard stops, that records four scope decisions rather than leaving them as an unstated backlog:

• trill's trill CLI — plain, for now. It is Swift, so it cannot import snug's package and would have to drive snug run over the record protocol as a coprocess — a feature, not a sweep — and its hausfold.co tab is still positioning-undecided.
• pounce's command scripts — permanently out. A command's stdout is the launcher's input; there is no terminal on the far end and an escape there is a bug, not a style.
• The installers — bootstrap.sh, haus-activate.sh — exempt because they run before the machine has snug.
• The maintenance and probe scripts — build-golden-vm.sh, trill's dev-install.sh, this repo's script/issue-labels.sh and script/probes/*.sh — out for a different and weaker reason, kept separate on purpose.

AGENTS.md's routing row follows. bench:213 called step 7 "the last open line" in the order of work, which this makes two rows stale; corrected.

Why

A scope that is merely unstated reads as a sweep nobody finished — the next person either re-does the analysis or converts a file that was deliberately left alone. Writing the decisions down makes re-opening one an edit to a named section instead of a quiet commit.

Splitting the installer class from the maintenance class matters more than it looks: build-golden-vm.sh wants tart on PATH and runs on a fully provisioned Mac, so it could source a painter perfectly well. Calling it an installer is how an exemption list becomes a place to hide things.

Verify

• bats test/bench.bats — 186/186.
• ./bench overlap — clean against every lane and origin/main.
• Read the new final section, docs/cli-presentation.md → Where the standard stops, and check the four bullets match what you want the boundary to be. That is the whole reviewable surface here; the rest is corrections.

Watch out

• The second commit is the interesting one. A clean-context assurance pass found five ways the first was wrong, three of them introduced by it: the runtime section still listed pounce's commands as snug callers fifty lines above the section calling them out; "the last hardcoded indices in anything the family draws" was false (this repo's own script/ holds theirs); build-golden-vm.sh did not fit the installer justification; the trill docs-tree rule was misattributed (it is hausfold.co's AGENTS.md, and it is about the SITE tree — trill/docs/ grows freely); and the new section, as an ### inside ## Order of work, was nesting ~200 lines of "What N shipped" notes under a heading about exclusions.
• AGENTS.md was rebased through a conflict. main rewrote the same routing row while this branch was open. Resolved by taking main's newer prose as the base and re-applying this branch's four changes onto it — not by keeping either side whole.
• Row numbering in the order-of-work table is append-only; docs/drift.md is untouched.
• Pairs with hausfold/haus#568 — row 10 itself. That PR closes the row this one opens. Either order is fine; this one is honest whether or not it has landed, because row 10 says "⏳ open".

🤖 Generated with Claude Code

https://claude.ai/code/session_0164KPhMYmPNYCLjvqqNuSAX