[yashiels]

ASD-STE100 rewrite (STE-flavored mode) of AGENTS.md (CLAUDE.md is a symlink to it), README.md and docs/MOBILE-API.md. Hard lint violations 8 / 8 / 21 -> 0 / 0 / 0.

Fact fixes, each checked against the 0.7.2 code:

• __cf_bm IS stored in pending-otp-.json (0600) between login and the OTP submit. The CLI removes the file on success, expiry or state mismatch (AGENTS.md says __cf_bm is never persisted; the two-step OTP flow writes it to the pending-challenge file #57).
• AGENTS.md structure tree: wishlist.ts, skill/, endpoints-catalogue.json, docs/plans. CI/release section describes the binary smoke gate and the manual ship workflow.
• New AGENTS.md rules: no code comments, no whole-file prettier, live tests are read-only.
• README: wishlist commands, cart guard, full error envelope, unavailable_state, address use --file (the old address use A123 example was wrong).
• MOBILE-API: auth headers and cookies documented as conditional (matches authHeaders/cookieHeader). All 16 code blocks byte-identical.

Left as written: CHANGELOG.md (release history) and docs/plans/no-payments.md (the signed-off design record).

Oracle meaning-drift review: signed off (3 rounds; fixed a weakened live-test rule, an overstated PR claim, and unconditional header claims). make ci: 397 pass.

Closes #59
Closes #57

[sentinel-skyner]

🛡️ Sentinel review

No material issues found in this diff.

_{Automated review via cursorbridge:gpt-5.3-codex. Findings only — not an approval. Push new commits to re-review.}