v2.0.0 — the duck asks why

BREAKING: /duck-pingpong is deleted with no alias. Its capability survives as duck-race rally mode; the command does not.

duck-race now has two modes

Race — two families attempt the problem in parallel, independently, and executed evidence picks the winner. Rally — they alternate, one writing a failing test and the other satisfying it. The eight machinery blocks the two skills each carried now have one home. Fixes a prose/code mismatch where the text said "dispatch in the background" while the block captured the diff synchronously, recording empty attempts as forfeits.

duck-why is new

Names the cause of a failure and hands the fix on, holding the same doer/judge separation as duck-break. Of eighteen skill descriptions, exactly one mentioned a bug or a failing test — so "fix the layout bug" matched nothing. It does now.

Every gate corrected

Each from a finding with executed evidence behind it:

• duck-review: an outage on a required reviewer now bars APPROVE. Measured — a v1.0.0 release gate approved on a single family because the other outaged for the third time that gate and nothing stopped it.
• duck-review: inputs by path, never inlined. The same pinned model disagreed on 28 of 41 verdicts between an inlined corpus and one read from disk, every flip toward the finding standing. Prompt delivery is a verdict-integrity control, not a performance note.
• duck-review: prove the model pin. Send a deliberately invalid --model and require the harness to reject it with a roster. A model's self-report is unfalsifiable; a harness rejection is not.
• duck-break: a dirty candidate does not survive git worktree add. Measured — an uncommitted marker was present in the source and absent from the copy, so every attack passed against the base commit.
• duck-land + duck-sweep share one evidence chain. Landing records the SHA; the sweep reads it instead of routing every squash-merge to a decision it can never resolve.
• duck-run references its stages by name. Numbers went stale twice in one session while renumbering.
• duck-land no longer spells out branch-protection bypass mechanics — the rule they taught survives without the recipe.
• The README states which rules are mechanically checked and which are discipline. A rule that reads like a guarantee and isn't is worse than no rule.

Validator: 631 → 290 lines

Structure only. It checks what exists, what links to what, what shape a file has, and whether generated files match their source — never content. The skill set is discovered from disk instead of enumerated, so adding duck-why required no validator edit.

Removed with it: version agreement across the manifests, and the description YAML-safety guard. A malformed description now fails silently in a host; all eighteen were verified by hand for this release.

How this shipped

Under two written owner waivers. The review gate returned NOTE, not APPROVE — one of two required reviewers outaged, and the new bar refused to approve its own release. The merge then bypassed the ruleset's last-push-approval rule via admin. Both recorded before the push; the decorrelated review is deferred, not passed.