feat(taskless): record measurements in comments, do not forecast

The most repeated finding in the merged-PR review threads: a comment that
cites a version or a claim the code moved out from under it. On #161 alone,
five threads — "we pin 3.17.1" left behind after VALE_VERSION went to
3.18.0, a comment naming .rmd as plaintext after the diff moved it to
markup, a block still framing 3.18.0 as "the known incoming bump" after it
shipped. Same shape on #155 and #157.

The rule flags the construction rather than the stale number, which is the
half a static check can see. Vale reads .ts in its comments-only tier, so it
lints the comment text and never the code.

Zero findings on packages/cli/src today, because #161 fixed them all. Reach
verified separately by planting a forecast comment in a real source file:
fixtures run under an isolating config, so a passing test does not prove the
matcher glob reaches anything.

Also ignores .taskless/ in eslint and prettier. A rule about source comments
needs .ts fixtures, Vale decides its comments-only tier by extension, and
those files belong to no tsconfig — so lint-staged failed the commit on
"not found by the project service". Rule fixtures are inputs written to be
flagged; verify and test are what keep them honest.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017cEN93Acyp4zBwP3oDnyy1

Author: theCodeDrift

.prettierignore

@@ -13,3 +13,6 @@ worktrees/
 
 # The demo project: deliberately-wrong source and prose fixtures.
 example/
+
+# Taskless rule fixtures: deliberately-wrong prose and source.
+.taskless/

.taskless/rules/vale/comments-record-not-forecast/.tests/fail/probe.ts

@@ -0,0 +1,6 @@
+// The docs describe the current Vale, and 3.18.0 is the known incoming bump.
+export const VALE_VERSION = "3.17.1";
+
+// None of these is reachable today, though once we upgrade the second tier
+// will start routing differently.
+export const TIERS = [];

.taskless/rules/vale/comments-record-not-forecast/.tests/pass/probe.ts

@@ -0,0 +1,7 @@
+// Measured on the pinned 3.18.0 binary: a bare non-comment line in bare.pyi
+// yields no finding, so the file is plaintext rather than markup.
+export const VALE_VERSION = "3.18.0";
+
+// Re-probed after the bump rather than renumbered. The claim is the binary's,
+// not the release notes'.
+export const TIERS = [];

.taskless/rules/vale/comments-record-not-forecast/.vale.ini

@@ -0,0 +1,6 @@
+# Vale reads .ts in its comments-only tier: the comment text is linted and the
+# code body is invisible, so this rule can never fire on an identifier.
+[packages/cli/src/**/*.ts]
+tskl) rule = comments-record-not-forecast
+BasedOnStyles =
+comments-record-not-forecast.comments-record-not-forecast = YES

.taskless/rules/vale/comments-record-not-forecast/comments-record-not-forecast.yml

@@ -0,0 +1,15 @@
+extends: existence
+message: "'%s' forecasts. Record what was measured, and date the claim."
+level: warning
+ignorecase: true
+tokens:
+  - 'the known incoming'
+  - 'the incoming bump'
+  - 'the upcoming release'
+  - 'in a future release'
+  - 'when we bump'
+  - 'once we upgrade'
+  - 'once we bump'
+  - 'we anticipate'
+  - 'is expected to become'
+  - 'will likely become'

.taskless/taskless.json

@@ -3,16 +3,25 @@
   "install": {
     "targets": {
       ".taskless": {
-        "skills": ["taskless"],
-        "commands": ["tskl.md"],
+        "skills": [
+          "taskless"
+        ],
+        "commands": [
+          "tskl.md"
+        ],
         "mode": "canonical"
       },
       ".claude": {
-        "skills": ["taskless"],
-        "commands": ["tskl.md"],
+        "skills": [
+          "taskless"
+        ],
+        "commands": [
+          "tskl.md"
+        ],
         "mode": "reference"
       }
     },
-    "cliVersion": "0.11.0-20260824213902xf26a7b0"
+    "cliVersion": "0.11.0-20260824213902xf26a7b0",
+    "onboarded": true
   }
 }

eslint.config.js

@@ -28,6 +28,12 @@ export default tseslint.config(
       // Zero-dependency CommonJS workflow scripts (covered by their own
       // node:test suite); the app's TS/ESM-oriented rules don't apply.
       ".github/scripts/",
+      // Taskless rule fixtures. A rule's `.tests/` holds inputs written to be
+      // flagged, and a rule about source comments needs `.ts` fixtures
+      // specifically — Vale picks its comments-only tier by extension. They are
+      // not part of any tsconfig, so the type-aware rules fail to parse them.
+      // `taskless verify` and `taskless test` are what keep them honest.
+      ".taskless/",
       // The demo project. Its source is deliberately wrong — `example.cjs`
       // calls `eval` so a rule has something to find — and its fixtures are
       // prose written to be flagged. Linting it fails on content nobody wrote