--- /tmp/REVIEW_RULES.md.before-2026-09-23	2026-09-23 12:02:05.112422843 +0000
+++ docs/self-improvement/REVIEW_RULES.md	2026-09-23 12:02:27.279397660 +0000
@@ -2,7 +2,7 @@
 
 Living rules produced by nightly retrospectives. These are operational QA rules, not private chain-of-thought. Keep them concrete, testable, and tied to observed mistakes.
 
-Last nightly update: 2026-09-22 12:00 UTC.
+Last nightly update: 2026-09-23 12:00 UTC.
 
 ## Core release rules
 
@@ -149,6 +149,7 @@
 23. For web search calls, only use provider-specific options after confirming the active provider supports them; if a freshness/domain filter is rejected, retry with a supported query strategy and record the limitation instead of letting the source-gathering step silently narrow or fail.
 24. If an official-source monitor surfaces a high-signal item with mismatched title/URL/summary, treat it as suspect: fetch or independently verify the canonical article URL before alerting, and if verification fails, suppress or mark it as parser-risk instead of sending a confident summary. Fix the parser/state before the next run, because “manual recheck later” is not enough for recurring official-source monitors.
 25. Official-news monitor state must pair each canonical URL with the title extracted from that same card/article. Add a regression gate that samples stored `seen` entries against the current source page and flags title/url drift, adjacent-card bleed, image-srcset summaries, or cache-buster-only text before any alert is sent.
+25a. The cron/wrapper boundary must reject malformed official-news candidates even when `new_high_signal` is non-empty: require a semantic title, canonical URL, date or explicit date-unknown state, and fetched article evidence; any image/srcset/path-fragment summary is parser failure, not an alert. Quarantine delivery until a scheduled-style regression run passes.
 26. Heartbeat replies during active user work may include useful progress for that work, but must not append unrelated all-clear safety/no-exposure summaries; quiet-success safety checks stay silent unless there is a real exposure, blocker, or action-needed risk.
 27. Authenticated monitor scripts should not dump raw account/profile/API payloads into chat or cron logs by default; tool stdout/stderr is a cron log. Emit sanitized summaries for routine runs and keep raw payloads in intended internal files only; redact owner phone/email, private calendar/invite tokens, order/payment ids, credentials, and account ids from stdout/tool results unless explicitly needed for debugging. If a script does not support redacted output, add a sanitizer/wrapper before using it in cron rather than exposing raw JSON in the tool result.
 28. Luma/Financial Club/Gmail/Calendar monitor stdout must be redacted by default: no authenticated `user` object, phone, email, account id, attendee private ids, invite tokens, order/payment ids, or raw message bodies. Keep those in internal files only when needed; chat/cron summaries should show counts, titles, URLs, statuses, and safe names/roles.