Accept M1 follow-ups; add implementer lessons and promote four rules to AGENTS.md

Tasks 08 and 09 pass the checklist and the reviewer's probes, so M1 is
complete. docs/implementer-lessons.md turns the review findings into
tips for the implementer and for task writing, each tied to its
evidence, with a column to record whether the defect comes back.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/implementer-log.md

@@ -59,3 +59,29 @@ by a later task, and all were found by reading the branch and probing it from ou
 easy case, though: types pinned by byte-exact fixtures. M2 has behaviour that fixtures cannot pin
 as tightly (a streaming HTTP client, the turn loop), so an early mistake there is more likely to
 be built on.
+
+### M1, tasks 08 and 09 — reviewed 2026-09-17 by the design model (Claude)
+
+**Verdict: accepted. M1 is complete.** Both tasks passed the gate on the first run.
+
+| Check | Result |
+|---|---|
+| Two commits with the trailer; only the listed paths staged; copied files identical to the plan; protected files untouched | pass |
+| `make gate` | `gate: ok`, 50 tests |
+| Reviewer's probes from the first review, run again | unknown fields rejected in `AuditRecord` and `ToolCall`; out-of-range timestamps are `Err`, no panic |
+| No `2>/dev/null` left in the scripts; each fails when `crates/` is missing | pass |
+
+Task 08 was the smallest correct change: one attribute on each struct, `Timestamp::MAX`, a fallible
+`from_unix_millis`, `parse` routed through it, `now()` clamped.
+
+Task 09 generalised beyond its self-test. The reviewer tried forms the self-test does not contain
+and the scripts handled them: a `[target.'cfg(unix)'.dependencies]` section, a table-form
+dependency under it, `[build-dependencies]`, a table header with spaces, a multi-line inline table,
+and a commented-out dependency.
+
+Remaining, recorded and not worth a task:
+
+| # | Severity | Finding |
+|---|---|---|
+| 8 | low | `check-lines.sh` stops at the first file that is too long, so a second one is only reported after the first is fixed. |
+| 9 | low | A quoted key (`"brokerd" = { path = "…" }`) is not seen by either dependency script. The task did not list that form and the reference scripts miss it too. It does not happen by accident. The robust fix is to ask `cargo metadata`, which needs a JSON parser the gate does not have. |