Answer prose round 1: 0 🔴, 3 🟡 (0 misread); trim the header comment and AGENTS.md rule, list the guard in the file map

AGENTS.md

@@ -435,10 +435,8 @@ one-time setup. A file-map or table row gets a clause, not a paragraph.
   URL shape, ignores the router's params, and has to re-handle HEAD. Factor shared per-request setup
   into a small `withX` wrapper — see `examples/plugins/admin/`.
 - **A function stays within 50 lines and complexity 20** (ESLint's defaults, measured by
-  `src/function-limits.test.ts`). Split one that outgrows them; never add it to the grandfathered
-  list or raise its ceiling there. The largest entry, `handleRequest`, is orchestration whose pure
-  parts are already extracted; it splits along the seams it tracks (canonical host, static, locale,
-  session, CSRF, hooks, routing, error mapping).
+  `src/function-limits.test.ts`). Split one that outgrows them; never add it to the test's
+  `grandfathered` list or raise a ceiling there.
 - Reviews are maintainer-triggered (e.g. via the larv-review skill) — never auto-run reviewer agents.
 - **A user-visible string belongs in a catalog, not in the code or a view.** Core strings go in
   `src/i18n/locales/en-US.ts` (then every other locale, or the boot fails); a plugin's go in its own

README.md

@@ -1813,7 +1813,7 @@ unnecessary here — the signature itself is already invalid.
 ```
 src/                 The app — strict tsc, no build step. *.test.ts sit beside their module.
   server.ts          Entry point; config.ts env loader; logger.ts structured log + trace span + tracedFetch
-  *.test.ts          Topology guards with no source counterpart (compose/kratos/keto/hydra/postgres/ci-gate)
+  *.test.ts          Guards with no source counterpart (compose/kratos/keto/hydra/postgres/ci-gate/function-limits)
   http/              Request pipeline: app.ts (createApp), builtin-routes, context, body, cookie,
                      static, safe-url (safeUrl + localPath), security-headers
   auth/              Identity + the session-JWT hot path: jwt · jwt-middleware · jwks · gen-jwks (CLI) ·