Record what it takes to import a protocol written for humans

D-63: line endings are normalised on import, and duplicate rule codes stay
refused. The second half was the maintainer's call, put to them with both
options costed. Documents give way rather than the importer, because the
alternative, reading only the shallowest numbered heading level as rules,
would let a later document silently demote a family of real rules to prose by
adding one shallow numbered heading.

The runbook gains the edit a real protocol actually needs: de-number
checklist headings, because anything numbered at level three or deeper is
read as a citable rule. Windows endings need no edit anymore.

Author: Poolchaos

docs/DECISIONS.md

@@ -1538,3 +1538,18 @@ verified evidence, in writing, here.
   heavier changes carried their proof when they landed: two mutation proofs
   on the S4 routing and the state-machine tests, and two full
   `./verify.sh --build --e2e` runs at exit 0.
+- 2026-08-04 D-63: a protocol document is normalised for line endings on
+  import, and duplicate rule codes stay refused. The maintainer's real
+  2,774-line protocol imported as zero rules because it was saved with CRLF
+  endings and JavaScript's `.` does not match a carriage return, so not one of
+  its 129 headings matched the heading pattern. Normalisation happens once, at
+  the top of `importProtocol`, so nothing downstream and nothing stored
+  carries a stray return.
+  Fixing that exposed a second refusal: the document numbered five checklist
+  items under a level-4 heading, colliding with real rules 1 to 5. Two ways
+  out were put to the maintainer, and the decision is that documents give way
+  rather than the importer: the five checklist headings were de-numbered in
+  the source document. The alternative, treating only the shallowest numbered
+  heading level as rules, was rejected because a later document adding one
+  shallow numbered heading would silently demote a whole family of real rules
+  to prose, which is the exact failure this module exists to prevent.

docs/RUNBOOK.md

@@ -174,6 +174,14 @@ against a fake CLI committed to the repository.
   cleanly, so sharing `.next` between the two is not the cause.
 - **Port 3000 in use is not an error.** Dev falls back to 3001 and prints the
   URL it actually took. Read the line rather than assuming 3000.
+- **A real protocol document usually needs one edit before it imports:
+  numbered checklist items.** Any heading at level three or deeper that starts
+  with a number and a dot is read as a rule, so a "1. Type Verification" step
+  inside a checklist collides with rule 1 of the catalogue and the import is
+  refused for a duplicate code. Drop the numbers from the checklist headings;
+  they are process guidance the reviewer still reads as a directive, and they
+  were never codes a finding could cite. Windows line endings need no edit:
+  they are normalised on import (D-63).
 
 ## Where things are