docs: split Rules of Engagement into limits and record The engagement is two unrelated things, and the wiki described it as one. Rules-of-Engagement.md is rewritten around the split: the LIMITS are ordinary settings, reachable from the form and the API alike and enforced at scan start, and the RECORD is the contract a person writes and no token can touch. The "set once at creation, read-only afterwards" claim is gone; only the record is creation-time. Also updated: - Recon-Presets: a preset never carries the engagement, at capture or at apply, and the exclusion is a registry query rather than a name-prefix match - MCP-Server: update_recon_settings reaches the limits in either direction, and what keeps that safe is enforcement at scan start, not a write-time rule - Creating-a-Project: tab 1 is the Engagement Record; the limits live elsewhere and stay editable - Origin-Discovery: the mechanism is unchanged, the field classification is not - AI-Gauntlet: its RoE checkbox is a per-launch confirmation, distinct from the project's engagement limits - Project-Settings-Reference: an Engagement Limits section, and two checked counts instead of one wrong one. "714 configurable parameters" overstated the surface exactly as the "245+" it replaced understated it - Project-Settings-Registry and MCP-API-Reference: regenerated A test fails any page that still names tighten_engagement_roe, the tighten_only disposition, or a roe* field as MCP-settable.
docs(origin-discovery): add Origin Discovery wiki page New Origin-Discovery.md documenting the CDN/WAF origin-unmasking module: fingerprint sources, the weighted-similarity validator, fail-closed candidate filtering, search budget/cache, graph schema, settings reference, partial recon, presets, and unwaf provenance. Cross-link it from the VHost & SNI page as a sibling GROUP 6 Phase A scanner.