docs: guidance audit — refusals up front, version anchors, failure modes, resolution order, drift guards

Apply 7 proposed edits from guidance improver audit:
- CLAUDE.md: refusal rails up front, version anchor, resolution order
- BOOCHAT.md: resolution order section
- BOOCODER.md: tool reliability callouts
- data/AGENTS.md: tool list drift guard, failure modes preamble

BOOCHAT.md

@@ -1,4 +1,4 @@
-# BooChat
+# BooChat — v2.7.17 (2026-06-08)
 
 ## Capabilities
 
@@ -9,6 +9,9 @@
 - `ask_user_input` (interactive option chips)
 - Opt-in per chat: `web_search`, `web_fetch` (SearXNG-backed, SSRF-guarded)
 
+## Guidance resolution order
+When multiple sources conflict: inline file guidance (this file) → per-session `system_prompt` → agent definition → model default. Last wins on samplers, first wins on refusals.
+
 ## You cannot
 
 - Write, edit, or delete files
@@ -44,6 +47,11 @@
 
 Always-true rules (process discipline, refusals, behavior contracts) live here in `BOOCHAT.md` — and in `BOOCODER.md` / `CLAUDE.md` per their scopes — where they are 100% present in every turn. On-demand recipes (specific procedures, scaffolds, checklists) live in `/data/skills/` and invoke roughly 6% of the time in clean multi-turn flow (Codeminer42 measurement, 2026). Don't file workflow rules as skills — they silently misfire. See Anthropic agent-skills best-practices (platform.claude.com/docs/en/agents-and-tools/agent-skills/best-practices) for the canonical conventions.
 
+## Cross-file invariants
+
+- **Tool capability lists**: `BOOCHAT.md:5-10` (read-only tools) must stay in sync with `apps/server/src/services/tools/registry.ts` `ALL_TOOLS`. If a tool is added to the registry but not listed here, models won't know to reach for it.
+- **Capability refusals**: `BOOCHAT.md:12-17` ("You cannot") mirrors the path/secret/url guards in `apps/server/src/services/{path_guard,secret_guard,url_guard}.ts`. Adding a new guard type should update this refusal list.
+
 ## Verification discipline
 
 - When assessing implementation status, verify against the running container (`curl /api/health`) and latest git commit (`git log --oneline -3`), not just source file contents. Source files can be mid-edit. The deployed state is the truth.