[John-Cusack]

Rewrites docs/UPSTREAM_PRS.md around the two recent rejections: kjd/idna#286 ("highly complicated for what is a trivial small optimization ... looks like it was AI generated") and JoshData/python-email-validator#182 ("But why?").

The process is now: write the why first (who calls this, how often), keep only hunks that carry measured gain, measure import time and every documented setting along with the hot path, keep the body short, then run three fresh review agents on a packet that holds only the diff, the evidence, and the draft. A person signs off before anything is posted. Replies and comments on upstream threads go through the same panel.

New files:

• prompts/upstream_pr/review_maintainer.md, review_ai_tells.md, review_facts.md: the three reviewer prompts, each with a fixed PASS/FAIL (plus SHRINK/HOLD for the maintainer) output block.
• prompts/upstream_pr/writer.md, pr_body_template.md, reply_template.md.
• scripts/upstream_pr_check.sh: model-free check (visible word count, internal terms, dashes, title taglines, new module-level imports/regexes/globals in the diff).
• scripts/upstream_pr_packet.sh: builds the review packet, hashes it into a packet id, runs the check.

First real use

Both pending replies went through the pipeline (not posted):

• idna#286: round 1 failed on facts. "The same win" overstated #287 (it recovers 89% of #286's time saving on the mixed workload), and kjd had already closed #286 and merged #287 after our thread snapshot, so "Closing this" was stale. Round 2 passed all three.
• email-validator#182: round 1 failed all three; round 2 failed on facts (an unscoped number, no word on fixing the title and changelog, no test or differential evidence for the cut-down version). After adding that evidence, round 3 passed all three. Both final texts are in the doc under "First use"; the email-validator one promises the cut-down push, so that change goes through the PR pipeline before the reply is posted.

Found while doing this

email-validator#182 (still open) has a real behavior regression. The _DEFAULTS cache freezes module defaults on the first call, so email_validator.CHECK_DELIVERABILITY = False (documented in the README) and the other settings are ignored after the first validation; a reassigned SPECIAL_USE_DOMAIN_NAMES is ignored too. The new regexes also add about 11 ms to import email_validator (23.1 to 33.9 ms median). Change 1 alone (+9 lines) gives 1.63x on the mixed workload with no import cost; changes 2 to 4 give 1.47x. The PR was not touched (out of scope).

Checks

• shellcheck clean on both scripts; usage and error paths exercised (exit 2).
• upstream_pr_check.sh on our past PRs: idna#286 FAIL (4), email-validator#182 FAIL (12), arrow#1398 FAIL, fastjsonschema#233 FAIL; kjd's idna#287 PASS.
• Docs, prompts, and two shell scripts only; no crate changes, so cargo build/test/clippy and the acceptance scripts are unaffected and were not rerun.
• Doc and prompts run through the humanizer skill; no em dashes in prose, no internal paths.