save per-eval deploy-adapter ckpts (rescore w/o retrain) + CLAUDE.md test lesson

save_eval_ckpts (default on): write the deploy adapter (δS only, ~2.3MB) at each
deploy-eval step, step-tagged, so a run can be re-scored later (more prompts /
different eval) without retraining. The A5 run saved only final+first_hack, which
is why the leak needed a full retrain rather than a rescore.

AGENTS.md: every load-bearing invariant gets a verify_*.py gate. The no-cheat leak
shipped because the green gates never covered the property -- 'tests passed' is
meaningless if the property was never tested.

Co-Authored-By: Claudypoo <288921227+claudypoo@users.noreply.github.com>

AGENTS.md

@@ -46,7 +46,14 @@ Inherit global rules from `~/.claude/CLAUDE.md`.
 - `just smoke` before any real run (~1-2 min, beartype on, real pipeline on tiny inputs).
 - Real runs go through `pueue` on the 96GB GPU box. Label each job with `why:` and `resolve:`.
 - Head [docs/RESEARCH_JOURNAL.md](docs/RESEARCH_JOURNAL.md) for latest results.
-- No `tests/` dir; `smoke` is the correctness gate.
+- No `tests/` dir; `smoke` is the correctness gate. Unit checks are `scripts/verify_*.py`
+  (assert + exit nonzero), wired into the `smoke` recipe so every smoke runs them.
+- Every load-bearing invariant gets a `verify_*.py` gate. The no-cheat leak (held-out
+  modes received <=1.1% detector labels via the route2 gate, 2026-06-05) shipped because
+  nothing asserted it: the existing gates were green but none covered the property. If a
+  claim is load-bearing, write the assertion test in the same commit -- "the tests passed"
+  means nothing if the property was never tested. This one was found by hand-counting, not
+  by a gate; now `scripts/verify_gate_anchor.py` covers it.
 
 On persona pairs
 - ./docs/personas/how_to_rewrite_pairs.md