Excuses (1) admitting a mistake comes with the fix in the same reply

corpus/skills/principle-flag-your-own-corrections/SKILL.md

@@ -46,5 +46,14 @@ What the trigger requires, in the same turn as the admission:
 3. Run `reflect`, and prefer a mechanical catch over a promise. If the wrong
    claim came from a command that can pass without exercising the change, fix
    the command.
+4. Name the action taken in that same reply: a revert, a check run, a fix, or
+   a task/issue id that now owns the fix. "Want me to fix it?" is allowed only
+   when the fix is out of scope or cannot be undone.
+
+This is the same operating shape as Toyota Production System jidoka: detect an
+abnormality, stop immediately, and keep defects from flowing forward
+(https://global.toyota/en/company/vision-and-philosophy/production-system/).
+An admission of fault is the detected abnormality; the same reply needs the
+stop-and-fix action, not just the signal.
 
 **Battle-tested, with a direct contrast in the same session:** a token-count audit was reported to the user as "71.4M total tokens... real, not guessed." Two phases later, a dedup bug was found in the counting script (one usage block was being summed once per content block instead of once per message) and fixed; the corrected number was 33.6M — about 2.1x lower. The fix landed, and every subsequent message correctly cited 33.6M — but the user was never explicitly told "the 71.4M I gave you earlier was wrong." Contrast: a second bug found later in the same session (a redundant-read false-positive) *was* disclosed as an explicit correction — "went from 67 flagged down to 3, confirmed against an independent count" — naming the old number, the new number, and the fact that one replaced the other. That second form is the standard; the first fell short of it.

corpus/skills/principle-flag-your-own-corrections/tests/fires_example.md

@@ -1,21 +1,16 @@
-Earlier in the session the agent told the user "the stacked slice is fully
-green, all gates pass." Checking properly now, the gate it cited had been run
-with its default scope and never compared the slice at all — so the green was
-vacuous. The agent is about to write the corrected status.
+The user points out that the agent ignored a direct instruction to undo a
+change. The agent replies, "You're right: I did not follow that instruction,"
+then marks the undo task done even though no revert, check run, fix, or task id
+exists and the original change is still present.
 
-This skill fires on the admission shape itself. It no longer carries
-`disable-model-invocation: true`, so its `description:` is loaded and the
-model can match it the moment a correction is forming — which is the only
-moment it helps. Waiting for an explicit invocation would mean the user has
-to notice the stale claim first, which defeats the purpose.
+This skill fires because the admission became the end of the turn. The agent
+named the fault but did not carry a same-reply action that would stop the
+bad state from moving forward.
 
-Once loaded it supplies the three obligations: name the old claim alongside
-the new one rather than switching silently, say what made the first claim
-unchecked (here, a default-scoped command standing in for a slice-scoped
-one), and treat the admission as a `reflect` trigger rather than a resolution
-to be more careful.
+Once loaded it supplies the obligations: name the old claim alongside the new
+one rather than switching silently, say what made the first claim unchecked,
+treat the admission as a `reflect` trigger, and name the action taken in the
+same reply.
 
-`engine/hooks/wrong-check-reflect` would also catch this particular wording,
-but the skill must fire on wordings the hook misses — it stayed silent on "a
-claim I made earlier was wrong" in a real session until a human pointed it
-out.
+A reply that says "I did not follow that instruction" and then only records
+"undo done" without doing the undo is still an unfinished correction.

corpus/skills/principle-flag-your-own-corrections/tests/stays_silent_example.md

@@ -1,13 +1,12 @@
-A user asks the agent to rename a function from `fetchRows` to `loadRows` and
-update its three call sites. The agent makes the edits, runs the module's
-tests, and reports them passing.
+The user points out that the agent dropped a requested fix while editing a
+nearby file. In the same reply, the agent says, "You're right; I left out the
+requested fix," reapplies the missing change, runs the relevant check, and
+reports the passing command.
 
-This skill stays silent. Nothing the agent previously told the user has turned
-out to be wrong: there is no earlier claim, no number that moved, no check
-that was skipped and later found hollow. Every obligation the skill carries
-presupposes a prior statement to correct, and there is none here.
+This skill stays silent because the admission is complete in the same reply:
+the fault is named, the corrective action is taken, and the verification is
+reported before the turn ends.
 
-Auto-firing is driven by a correction taking shape, not by the topic being
-technical or by tests being run. A turn that states a fresh, verified result
-for the first time is the ordinary case this principle is not about — firing
-here would ask the agent to retract something it never said.
+Auto-firing is driven by an admission that would otherwise stop at apology or
+permission-seeking. A same-reply fix plus check is the ordinary completed case
+this principle is trying to force.