docs: describe the write gate the code actually implements

The previous wording claimed speed must be readable and exactly 0 km/h and that
park never overrides a refusal. VehicleWriteGate does neither: allowUpToKmh lets
a caller open the gate up to 50 km/h, and an unreadable speed is rescued to
ALLOWED when the gear reads park.

A safety invariant documented as already held is worse than one documented as
owed — the next change reads this file, believes the gate is closed, and builds
on top of it. Both widenings are named here as debt, with the target the rest of
the suite already describes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: malys

AGENTS.md

@@ -16,10 +16,16 @@ The apps are thin; the vehicle lives here.
 
 ## Non-negotiables
 
-- **The 0 km/h gate is here.** `VehicleWriteGate` permits a vehicle-setting write only when
-  speed is readable and exactly 0 km/h, inside the low-level write primitives. Every setter
-  carries `@RequiresStandstill`; coverage keeps the set honest. Unknown/negative speed
-  fails closed, and park state does not override that refusal.
+- **The 0 km/h gate is here.** `VehicleWriteGate` decides every vehicle-setting write inside
+  the low-level write primitives. Every setter carries `@RequiresStandstill`; coverage keeps
+  the set honest. Unknown or negative speed fails closed, and a moving reading is never
+  rescued by anything.
+  Two widenings of that rule are still in the code and are **safety debt to remove, not a
+  pattern to extend**: `allowUpToKmh`, a caller-settable threshold of up to 50 km/h, and the
+  park rescue, which turns an unreadable speed into ALLOWED when the gear reads park. The
+  target the suite documents (`MG4Tasker/AGENTS.md`, `MG4Control/AGENTS.md`) is a fixed gate
+  at a *readable* 0 km/h with no threshold and no rescue. Do not describe the gate as already
+  being that until this file says so.
 - **Per-firmware routing, never universal.** SWI68/69/131/132/133/165 differ; dispatch
   through `FirmwareInfo`. Any new vehicle call must branch per generation.
 - **Unreadable ≠ a value.** Getters return null / -1 when the layer is not ready or the