The audit's original framing was that every built-in plugin must be re-implementable through documented Obsidian public API. After 23 issues closed, an adversarial verification pass found that ~38% of recently- RESOLVED issues left tail leakage or perpetuated the patterns the audit was supposed to fix. Root cause: dogfooding is structurally impossible without inventing a parallel Reams API wider than Obsidian's, and implementers were doing exactly that — tightening the obvious sham then bolting on whatever Reams-side mechanism they needed alongside, unprefixed and undocumented. Reframed scope: tightening for Obsidian-compat + code-health discipline. Built-ins are allowed to be privileged (they're not external plugins). Every public-API addition is Obsidian-shape, in the Reams namespace and documented, OR @internal-with-justification. No fourth bucket. Reams namespace itself moves to a separate epic; honest framing in docs that it's a labeling system + CI-enforced gate, not a containment boundary. CJS plugins are silently un-gated; documented. Audit-flow skill changes: - Reframed opening section - New Step 4.5: API-surface enumeration before merge (every addition must be classified Obsidian-shape / Reams-namespace / @internal-with- justification or it doesn't merge) - Strengthened adversary prompt to require API-surface accounting - Mutation gate moved to on-request only (was routine; the 25-40min Stryker runs were slowing well-scoped tightening work without much marginal value) floor-map.json marked DEPRECATED as a gate; preserved as historical record.