fix(rules): review and harden rule-history editing

docs/TODO.md

@@ -8,7 +8,7 @@ decisions behind it are in `docs/specs/` — one spec per sub-project,
 each recording the alternatives that were rejected. Rules that outlived their
 task moved to `AGENTS.md`.
 
-**Current state:** merged to `main`. 583 tests passing,
+**Current state:** merged to `main`. 661 tests passing,
 `bunx tsc --noEmit` clean, `bun run build` succeeds on both the live-fetch and
 offline paths.
 
@@ -93,27 +93,7 @@ reason.
   Fine for one "$" currency; if the owner adds two, typing the code
   disambiguates and nothing warns them. Tested, documented, not solved.
 
-## 4. Nobody has independently reviewed the rule-history editing surfaces
-
-Tasks 3-6 of the versioned-allocation-rules work — `setRuleFrom` /
-`removeRuleFrom`, the JSON import validation, the Settings rule-history editor,
-and the month view's "change from here" — were executed by hand rather than
-dispatched, and no second pair of eyes has been over the diff.
-
-Worth reading first: the four commit messages, `de128e3`, `1cb91d3`, `e3023d0`
-and `f94e458`. They record why each surface works the way it does, including
-three of the four places the original briefs were wrong — a number field that
-could not be cleared, a component that kept the previous post's rule because it
-was not keyed, and missing validation that let a NaN allocation into the fold.
-
-(The fuller task log lived in a tool-managed ledger under `.superpowers/`, which
-ignores its own contents and was never part of the repository. This file used to
-send readers there, which worked only on the machine that wrote it.)
-
-Both surfaces have since been seen working in a browser. What is missing is
-review, not verification.
-
-## 5. Still needs a human
+## 4. Still needs a human
 
 `scripts/screenshot.ts` drives headless Chrome, so this list is much shorter
 than it was. Already seen and confirmed working: the carry meter (including red