Promote 6 process improvements from the Socraates Ascent project

[syriley]

Six process improvements from the Ascent project (Socraates), each drawn from a named retro with a worked example. All six are already merged into Socraates-Technologies/ai-dlc-base (PRs #1–#6) and are offered here for the shared rule set.

Branched off current upstream/main and cherry-picked, so this is +40/-1 across 5 files and nothing else — no fork-specific history, no conflicts (including in setup-guide.md, which upstream also touched).

What each change adds

File	Change	Retro
skills/uat.md	A step's result is corroborated, not taken from the report — where the expected outcome leaves a readable trace (a row, a log line, an audit event), read it and record the result from that evidence alongside the verdict. If they contradict, record neither.	Company-Owner/MFA intent
skills/uat.md	Tooling-failure fallback — how to evidence UAT for a UI-heavy intent when browser automation is unreliable, with the method recorded in the script.	Bolt 16
setup-guide.md	Concurrent sessions — reserve numbers + serialise shared files — two agent sessions on one working tree collide on unit/bolt numbers and on shared cross-cutting files.	Bolt 20
skills/nfr-bolt.md	Scope the threshold to what the change CONTROLS — a threshold can be numeric, testable, traced, and still measuring someone else's bug.	Bolt 106
skills/knowledge-promotion.md	Step 1.5 — ask whether the improvement can be a CHECK rather than a sentence.	Bolt 106
skills/bolt-risk-assessment.md	A mechanical sweep's premise expires when the set grows — re-run the sweep's pre-checks, not just the sweep.	Bolt 106

The two worth reading properly

knowledge-promotion.md Step 1.5 is the one we'd most want in the shared set, because it addresses a failure mode of the ceremony itself. A retro recorded — accurately, in the right file — that a per-suite database migration "races on a fresh DB". Over the next ten days the test suite grew to 51 files carrying exactly that pattern, because a sentence stops nobody. The race then cost a real diagnosis: four consecutive gate runs red at 18/12/8/15 files, never the same set, zero assertion failures, and a genuine dependency regression had to be found by bisecting against main because the gate's reds no longer carried information.

The fixing bolt added a drift-guard test. While it was still being verified, a concurrent session merged a 52nd instance — and the guard named it in six seconds. The sentence had been true for ten days and changed nothing; the check was true immediately. Step 1.5 makes every improvement declare check landed / check possible, not landed / prose only — not mechanically decidable, so a mechanically-decidable invariant can't quietly ship as prose.

uat.md corroboration corrects an incentive rather than a rule: an agent that wrote the code has every reason to accept a reported Pass and move on. In the source case the final step of an MFA intent — an un-enrolled user on a policy-bound company cannot reach the app — was reported Pass while the database showed a pending credential, zero recovery codes and no enrolment log line. It turned out to be an unfinished step, not a fail-open defect, and passed on a re-run — but recording the reported Pass would have closed the intent with its most security-critical assertion untested.

Note for reviewers

Each change is one commit with its full reasoning in the message, so they can be taken individually if you'd rather not take all six. The bolt-risk-assessment.md paragraph was adapted from its original draft: that draft appended after call-site-enumeration guidance which exists in the source project but not here, so it was rewritten to stand alone — worth reading on its own terms rather than against the source project's version.