currency-and-audit-before-trustlisted

# Recalled Is a Hypothesis; Inherited Is Guilty Until Proven A fact you did not just observe from the current primary source — your memory, a document, a prior note, a fluent answer, a report from another step — is a hypothesis, not a fact, and may not drive an irreversible, load-bearing, or security action until you re-ground it against the live artifact at its real version. Code you inherited is untrusted until its behaviour is proven by observation, not by reading it. And a dangerous construct found anywhere is guilty until a machine-parseable check proves it inert — you never downgrade it by eye ("probably a comment") or defer the check ("glance later"). ## When to use Reach for this before any assertion or action whose cost of being wrong is real: shipping a load-bearing claim, reusing or modifying inherited/unfamiliar code, or handling a dangerous construct (a privilege-bypass flag, a wildcard grant, an `eval`, unbounded egress). The more irreversible or security-relevant the step, the harder it bites. Red-flag thoughts — if you catch yourself thinking any of these, STOP and apply this skill: - "I remember this API/behaviour does X." (you did not just read it at the current version) - "It's probably a comment / probably dead / probably fine." (probably is not a disposition) - "I'll verify that later." (a deferred check is an unverified claim shipping now) - "The suite is green and the code is here, so it's trustworthy." (green + present is not provenance) ## Curre