Three commits, shipped together because the last one only becomes safe once the first two are true.

The fleet migration in commit 1 already ran against production on 2026-09-01. Commits 2 and 3 are the code that makes it whole.

1. 5406a058d , port each account's own drafting rules into its gate

The ref step no longer appends a seeded default. It reads each account's <cross-cutting> and refuses unless that account's ported prose is supplied.

The first fleet pass showed why: it wanted to write "do not draft" onto 5 of 8 accounts that draft constantly, hardest on the highest-volume ones , zach@ would have been silenced at 193 drafts/30d, jihoon@ at 174. Three defects behind that, each regression-tested against the real prose that exposed it:

• Positives were scanned far more narrowly than prohibitions, so an account forbidding drafting in SOME case read as forbidding it in ALL cases.
• A NEVER DRAFT section was treated as evidence drafting is off. Nearly every account forbids drafting somewhere.
• NEVER[ _-]?DRAFT had no leading \b, so it matched inside "whenever drafting" , turning seven LABEL RULES lines into seven prohibitions.

DRAFTER_GATE_PROSE also no longer permits inbound reply drafting. Of 73 inbound-email-notifier documents, 66 only notify, 4 opt in, 2 forbid it , so permitting it by default contradicted every account the default reaches.

New: --aop-id (three users have two AOPs needing different gates), and --replace-gate for an account wired by the very run that appended a default over its own rules. stage4-plan.ts has no write path at all , no --apply, no writePlaybookXml import.

2. 537d2f2d4 , restore review-conversation to the automation agent

review-conversation has not been callable since 2026-08-24, and the review path went dark with it:

4d8fb3437 moved the daily agenda into an automation-only skill for a good reason , its prose ends in a notify-user call and was being spliced into every tasks load. But reviewConversationTool moved with it, and getAllSkillTools() iterates skills only. The agent kept reading "call review-conversation, never spawn-subagent" and substituted the tool it could actually reach.

reviewConversationTool is the only caller of triggerType: 'conversation_review', so routeDrafter, runDrafterRef and the review-path tool strip have executed zero times since 08-26. The substitute is worse than a missing tool: a spawn-subagent child runs on createOrchestratorAgent, which hardwires save-draft and carries no drafter document , 428 such runs made 458 draft calls across 48 users in 7 days.

Tools and instructions are separate concerns, so they get separate gates. getAutomationSkillTools() = chat catalog + automation-only skills' tools. The skill stays unadvertised to chat.

3. 7fcb859b2 , Stage 5: the ref is the only route

run-post-event-executor leaves orchestratorTools; drafting goes through run-subagent(@subagents/drafter). The seed gets the ref back, last in <trigger type="any">.

Gate, measured rather than assumed: of 60 playbooks that can actually draft , excluding no-op AOPs and users whose agent_settings.agentExecutionEnabled is false , 59 carry a drafter ref. The one that does not has had no <trigger> element since 2026-06-18 and dispatches nothing.

I got that denominator wrong twice before landing on it: getActiveUsers() gave 59 playbooks and missed 28 live ones; every live playbook gave 27 missing refs and would have blocked this outright. Neither is right , a playbook whose owner has execution off cannot lose drafting to this change.

Production state as of this PR

• 57/59 migrated playbooks compile, carry the ref, and hold their intended gate
• 185 drafts on 09-01, 124 through the drafter , against zero on every pr