Embed the 2026-09-26 review principles in product, process and agent docs

[Jacksondr5]

Problem

The 2026-09-26 review of Bryant's Crews and Captains PRs settled several principles that no doc states, so agents and contributors keep rediscovering them in review. Examples: the Captains stack (#302–#304) extended upstream adapters for a J5 feature; the Inbox pair (#308/#309) routed Captain prompts that the person already sees; several PRs added machinery for edge cases that should simply error.

Principles to embed (Jackson, 2026-09-26)

1. Don't extend upstream provider adapters for J5 features. When a harness is less capable than Codex or Claude, that's upstream's job. "Not supported on this harness" is an acceptable answer. Codex's existing J5 pre-approval is grandfathered. General fixes go to the upstream give-back backlog (Upstream give-back backlog (hold until V2 merges upstream) #276). Ruling: State the Captain decision per provider adapter #233.
2. The Captain is the thread the person watches. The Captain's native approvals and questions stay inline. Seats ask their Captain, not the person (Crew seats ask their Captain, not the person: no native question tools on seats #325). Only seat approvals reach the Inbox (slimmed feat(crews): a Crew thread's provider approvals and questions reach the Inbox API #308/feat(crews): answer a Crew thread's provider approvals and questions from the Inbox #309). Custom seats default to Full access (Custom Crew seats default to Full access, and the roster warns about seats with limited access #326).
3. YAGNI over edge-case machinery. Prefer erroring and letting the person fix things over guards, retries, reconciliation sweeps, or extra states for rare or near-impossible cases.
4. Every upstream-file change is logged in FORK.md (already a rule; it keeps being missed, so reinforce it where agents look first).

Where

• FORK.md, off-limits areas: name provider adapters explicitly for (1).
• docs/j5/product/principles.md: (2), and (1) as a product stance.
• AGENTS.md / docs/j5/process/working-in-the-repo.md: (3) and (4), as short defaults that agents read before building.
• Crews definition (docs/j5/product/features/crews.md): (2), where it isn't already covered by the refactor(server): one J5 tool pre-approval list, and every adapter can be a Captain #301, Crew seats ask their Captain, not the person: no native question tools on seats #325 and Custom Crew seats default to Full access, and the roster warns about seats with limited access #326 changes.

Follow docs/j5/process/docs.md: rewrite in place, don't append, and keep each principle citable as written.

[Jacksondr5]

Adding a fifth principle from the Crews decisions the same day: after a server restart, expect manual repair. Don't build restart or crash recovery (boot sweeps, reconciliation, resume-mid-operation) for work caught in flight. The person was warned that restarting stops in-progress work. Covering a short, visible window during normal operation (e.g. #300's unknown seats) is fine.

[Jacksondr5]

A lean to record alongside principle 5 (Jackson, 2026-09-26): for edge cases, give the person and agents tools to repair things rather than making the platform recover automatically. Example, not decided: a Captain tool to un-retire a Crew whose restore stopped partway (#315).