The generated SHELL rules domain recalls on the prose verb kill: the registry's kill-by-search entry contributes the bare head kill to the domain's recall terms, so an ordinary prompt such as 'kill the feature flag, we are not shipping it' injects the whole SHELL block (about 2k tokens, once per session per signature). rm, pkill, killall and git push are shell-only words; kill is an everyday English verb, the class the domain's own fixed aliases already keep out (push, commit, reset). A rules-side exclusion list would be the second source ruling J10 forbids.

The generated SHELL rules domain recalls on the prose verb kill: the registry's kill-by-search entry contributes the bare head kill to the domain's recall terms, so an ordinary prompt such as 'kill the feature flag, we are not shipping it' injects the whole SHELL block (about 2k tokens, once per session per signature). rm, pkill, killall and git push are shell-only words; kill is an everyday English verb, the class the domain's own fixed aliases already keep out (push, commit, reset). A rules-side exclusion list would be the second source ruling J10 forbids.

Grounds

• pursued: the bundled SHELL recall no longer contains the bare word kill, so a prose prompt using kill does not recall SHELL, while kill $(pgrep ...) and pgrep ... | xargs kill still do; it would be shown wrong by TestShellDomainRecallsShellHeavyPrompts recalling SHELL on 'kill the feature flag, we are not shipping it', or by the bundled RecallTerms listing kill bare