auditor grounding — a prescribed, bounded exploration procedure + born-in find pointers

Observed live: the auditor looped find for a very long time, never touching
list_sessions/list_propositions. Root cause was the prompt: its only
procedure text was 'For each proposition, search the graph (its key words,
its synonyms, its phrasings)' — a per-proposition find loop with no
starting point, no sense of the space's extent, and no termination rule.
And find returned id+name+statement with no session pointer, so results
never composed with the listing tools (owner diagnosis, 2026-09-29).

- AUDITOR_INSTRUCTIONS now prescribes the process: (1) list_sessions ONCE —
  the graph is small and finite, this shows its entire extent; (2) read
  plausibly-related sessions with list_propositions (full text) — every
  realistic candidate seen in a few calls; (3) find as the targeted sweep;
  (4) SUBMIT once related sessions are read — never re-search seen ground
- find hits now carry 'born in: <session id>' — results point at sessions
  the auditor can read whole (legacy no-provenance nodes name none)
- identity doctrine untouched: equivalence bias, linkTo mechanics,
  verdicts-only deliverable

src/agent/subagents/extraction.ts

@@ -466,12 +466,22 @@ has read a source (a teaching session, or the author's personal notes) and repor
 follows/supports edges. You NEVER see the source itself — the extractor is fully trusted, and you do not re-check
 its work. Your job is IDENTITY: connecting those findings to the CURRENT knowledge graph, preparing the merge.
 
-You explore the graph through your tools: find (glob over names + statements + aliases), list_sessions, and
-list_propositions (full statement text, per session). The graph may be large — search, don't assume.
+You explore the graph through your tools: list_sessions, list_propositions, and find (glob over names +
+statements + aliases; each hit also says which session it was born in). The graph is SMALL and FINITE — a handful of
+sessions — and your job is done as soon as you have SEEN the plausible candidates. FOLLOW THIS PROCEDURE:
+
+1. GROUND yourself first: call list_sessions ONCE. This one call shows the entire space — every session that ever
+   contributed propositions, and how many. Now you know the extent of what you are searching; nothing is hidden.
+2. READ the plausibly-related sessions: for each session whose topic could overlap these findings, call
+   list_propositions — every proposition born there, with full statement text. A few calls and you have read
+   every realistic identity candidate in the graph.
+3. find is your targeted sweep: use it for phrasings, synonyms, and neighboring ideas the session reads made you
+   wonder about — its hits point back at sessions you can read whole.
+4. SUBMIT. Once every plausibly-related session has been read (and stray finds come back empty), you are DONE.
+   Do not re-search ground you have already seen; more patterns over the same nodes are wasted work.
 
 IDENTITY — links, per proposition:
-- For each proposition, search the graph (its key words, its synonyms, its phrasings). Does an EXISTING node already
-  state this same proposition?
+- For each proposition: does an EXISTING node — one you have now SEEN — already state this same proposition?
 - If yes: add { "id": <its proposition id>, "linkTo": <that node's id> } to "links". The session's phrasings join
   its aliases and its provenance; the node keeps its existing name.
 - If no: add nothing — a new node is created with the extractor's name as its label.