docs(todo-format): warn against double-counting rarity in the bug matrix

Grading a bug's severity by how rare it is to enter the failure state double-counts the frequency axis, which already carries that rarity. It buries the compounding bugs, the ones where a rare trigger produces unbounded harm. Three rules added to the severity × frequency section: grade severity by the rate of harm once the failure state is entered, record the band, row, and arithmetic in the task body so a misgrade can be re-checked against the source, and disagree with a grade by fixing an input rather than overriding the letter.

A chime watchdog bug graded [#D] moved to [#C] an hour later, once the read was written down and re-checked.

1 files changed, 23 insertions, 0 deletions

diff --git a/claude-rules/todo-format.md b/claude-rules/todo-format.md
index 5e9ca32..2cdc76c 100644
--- a/claude-rules/todo-format.md
+++ b/claude-rules/todo-format.md
@@ -110,6 +110,29 @@ the letter mapping are fixed.
 and safety issues are graded on severity alone — one occurrence with the right
 consequences is a showstopper no matter how rarely it would be hit.
 
+**Don't double-count rarity.** Grade severity by the rate of harm once the
+failure state is entered, not by how rare it is to enter. Frequency already
+carries the rarity; letting it discount severity too grades the same fact twice,
+and that buries exactly the bugs that compound — the ones where a rare trigger
+produces unbounded harm. A leak that repeats every timeout period until the
+process restarts is Major even when reaching that state is a rare edge case
+("accumulates slowly" describes a bounded trickle, not a fixed-rate leak with no
+workaround). Grade the *being-in-it*, and let the frequency row carry the
+*getting-into-it*.
+
+**Record the grading in the task body.** State the severity band, the frequency
+row, and the arithmetic (e.g. "Major severity × rare edge case = P3 = [#C]"). A
+bare priority cookie can't be argued with; a stated read can be re-checked
+against the source and corrected. This is what lets a misgrade move — a chime
+watchdog bug went [#D] → [#C] an hour after grading precisely because the read
+was written down and re-checked.
+
+**Disagreeing with a grade means fixing an input.** If a letter looks wrong,
+don't override the letter — re-read the severity band and the frequency row
+against the source and correct whichever input is wrong. Overriding the cookie
+directly turns the matrix into a formality and puts you back to grading by
+instinct, which is the thing it exists to replace.
+
 ## The Rule
 
 A todo entry has two parts: