mod: Ext 6 — strictest-wins decision strategy + action severity, 204/204

mod/decide-strictest collects every proven rule (pl-query-all) and applies the
harshest action by mod/action-severity (keep<escalate<hide<remove<ban), an
alternative to the engine's first-match precedence. Diverges from first-match
exactly when rule order and severity disagree. Same decision shape + :strategy;
engine untouched. Own suite. +14 tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/mod-on-sx.md

@@ -16,7 +16,7 @@ federation extension.
 
 ## Status (rolling)
 
-`bash lib/mod/conformance.sh` → **190/190** (roadmap + 5 extensions complete)
+`bash lib/mod/conformance.sh` → **204/204** (roadmap + 6 extensions complete)
 
 ## Ground rules
 
@@ -147,6 +147,11 @@ lib/mod/fed.sx
   derivation goal-by-goal with `[proved]`/`[unproved]` marks and unification
   bindings. E.g. `Report rc: escalate (rule: repeated-escalate)` … `[proved]
   report(rc, B, S), report_count(S, N), N >= 3  {B=ann, N=3, S=dave}`.
+- [x] **Ext 6 — strictest-wins strategy** (`lib/mod/severity.sx`, +14). Alternative
+  to first-match: `mod/decide-strictest` collects every proven rule (`pl-query-all`)
+  and picks the highest-`mod/action-severity` action (keep<escalate<hide<remove<ban).
+  Diverges from the default engine when rule order and severity disagree. Same
+  decision shape + `:strategy`; engine untouched.
 - [x] **Ext 5 — policy lint** (`lib/mod/lint.sx`, +14). Static analysis of a rule
   set: `mod/unreachable-rules` flags rules placed after an unconditional (always-
   matching) rule — structurally dead under first-match precedence;
@@ -160,6 +165,11 @@ lib/mod/fed.sx
 
 ## Progress log
 
+- **Ext 6 — strictest-wins strategy, 204/204** (+14). A second decision strategy
+  alongside first-match: collect all proven rules and apply the harshest sanction.
+  Shows the substrate supports more than one precedence policy over the same rule
+  facts — `pl-query-all` for the full match set, severity ranking in SX. Verified
+  it diverges from first-match exactly when rule order and severity disagree.
 - **Ext 5 — policy lint, 190/190** (+14). Static analysis of the rule set itself,
   catching the failure modes first-match precedence makes easy: dead rules after a
   catch-all, missing catch-all (undecided reports), duplicate names. `mod/rules-ok?`