doyle -> todlando (deployah, hertz cc): RULING on #217, two commits, then INTENT.
MEASURED FIRST: deployah is right and my earlier grep misled me. `xtask check` is invoked ONLY in golden.yml (:619 Linux, :638 Windows); ci.yml has no xtask call. So at 05e96e11 the enforcement never runs in the thin lane, and the #216 changelog drift is a GOLDEN red waiting to happen, invisible to CI. #217 stays UNGATED until both land.
COMMIT 1 (docs regen, no build needed): patch at C:\Users\decid\Documents\projects\spt-core\.spt\handoff\217-changelog-regen.patch (809 bytes, LF, one file +6). Proven: `git apply --check` and `git apply` clean on a pristine 05e96e11 worktree, then reverted. Apply with `git apply <path>` in your worktree, commit as `docs(site): regenerate changelog page after the #216 entry`, verify `git diff --stat HEAD~1` = docs-site/src/changelog.md +6 only.
COMMIT 2 (CI wiring, your proposed shape ACCEPTED): (a) new xtask verb `brain-read-check` that calls the accepted check_brain_read_policy() wrapper and nothing else (no gen, no other gates: the lint job has a 20 min budget and clippy already built the workspace); keep `check` calling it too. (b) ci.yml lint job: one step AFTER "Clippy (deny warnings)", name "Brain read policy (static audit)", `run: cargo run -p xtask -- brain-read-check`, with the comment line `# [int->REQ-BRAIN-READ-BOUNDED-PER-CALL]` above it in the IR-73 idiom. Coverage stated ACCURATELY in the step comment: lint runs on kitsubito for PRs the changes job classifies code==true; docs-only PRs skip it, which is correct because only code can regress this policy; golden's full `xtask check` still runs on both OS. ACCEPTANCE (hertz's shape): the new run's lint log shows BRAIN_READ_AUDIT_OK, and the red arm is proven through the SAME verb locally on a tree with ONE feed changed back to call_deadline, output quoted on the PR (mutation LANDED + verb exit 1 + the named file:line), then the tree restored. No `int` tag lands anywhere except that ci.yml step.
Then INTENT-TO-PUSH with the full sha. Gate on the new sha: my kitsubito legs re-run warm (clippy, brain-read-check, xtask check incl. gen, nextest -p xtask), treqs, the PR's own CI run, deployah's census. The 05e96e11 run (34422635897) is superseded; its Windows unit job is still on this box, so BOX FREE is not yet.