loop: baseline

NOTES.md

@@ -29,7 +29,6 @@ simple, and correct beats ambitious and broken.
    They take data in and return data out, so they can be unit tested.
 9. **Never store plaintext passwords.** Never log passwords or session secrets.
 10. **Don't touch what isn't in the current step.** No drive-by refactors.
-11. **Re-read NOTES.md and STATUS.md after each phase.** Keep your context fresh.
 
 ## 3. How to work (summary — details in docs/WORKFLOW.md)
 1. Open `STATUS.md`. Find the first unchecked step in the lowest-numbered phase.
@@ -62,3 +61,9 @@ A new visitor can: register → log in → create a hero → see stats/energy
 hunt monsters → gain XP/gold/loot → level up → equip items → buy/sell in the
 shop → start and claim an expedition → see the leaderboard → log out → log back
 in and find everything exactly as left (plus offline energy regen).
+
+## 8. Automated loop mode
+This project may be driven by `scripts/run-agent-loop.sh`, which starts a fresh agent session per step.
+In that mode: do exactly the one target step named in the prompt, never run commands that block forever,
+never run `git commit`/`git reset` (the loop commits after it verifies `npm test`, and rolls back on failure),
+and never delete or weaken tests (the loop rejects runs where the passing-test count drops).