Conciseness

The body is dense with AKS-specific, non-generic knowledge (SNAT exhaustion past a few hundred nodes, VM extension error codes 50/51/52, API-server IP change after stop/start, default max-surge of one node, kubectl version-skew rule) and avoids explaining concepts Claude already knows. Not 5 because a few sections could be tightened: the "Host capability gate" rule overlaps the "Tool preference" rule for several lines, and the symptom-map description is repeated in three places (route table row, dedicated paragraph, Scripts/Log discipline sections).

Actionability

Guidance is copy-paste executable throughout: exact commands with their queries ("az aks show -o json --query networkProfile.networkPlugin", "kubectl get pdb -A", "az network lb probe list", "kubectl auth can-i", "date -u"), concrete script invocations with argument lists ("scripts/cluster-snapshot.sh <resource-group> <cluster> <kube-context>"), and a pointer to a 17-section symptom map of exact commands in order. The common cases are covered with specific, runnable commands; this matches the fully executable anchor.

Workflow Clarity

The diagnostic sequence is clearly defined — bind subscription/cluster/context first, let the symptom select the first decisive read (workload-local vs control-plane branches), follow the causal branch, converge on 2-4 hypotheses with confirming/falsifying signals, stop at one supported cause or report the gap — with real validation checkpoints (host capability pre-check, script-side context-endpoint verification, re-test of the original signal after any remediation). Not 5 because the end-to-end procedure must be assembled from six separate prose sections rather than one coherent ordered walkthrough, and there are no checklists for the report/escalation stage.

Progressive Disclosure

The in-body structure itself is strong — a symptom routing table, one-level-deep clearly-signaled references, and pointers to scripts and a report template — but scored against the actual bundle, 8 of the routing-table targets (general-diagnostics.md, pod-failures.md, node-issues.md, networking.md, load-balancer-and-ingress.md, network-policy.md, upgrade-operations.md, spot-and-zone-issues.md) do not exist anywhere in the provided bundle, and references/symptom-map.md itself links to ../node-issues.md. More than half of the primary navigation routes are broken, which prevents the clear navigation the top anchors require; the well-organized existing structure is the only reason this is not 2.

Specificity

"Debug live Azure Kubernetes Service (AKS) incidents with a read-only, evidence-first investigation" names the domain and a concrete investigative mode, and the WHEN clause enumerates specific failure classes (CrashLoopBackOff, OOMKilled, ImagePullBackOff, node NotReady, SNAT exhaustion, QuotaExceeded/InsufficientVCPUQuota, upgrade stuck). Not 5 because it relies on a single action verb (debug/investigate) rather than naming multiple distinct operations (e.g., gather evidence, isolate root cause, produce an incident report); not 3 because coverage of the domain's concrete scenarios is far more comprehensive than 1-2 actions.

Completeness

Both questions are answered explicitly: WHAT — "Debug live AKS incidents with a read-only, evidence-first investigation"; WHEN — a literal "WHEN:" clause with concrete trigger phrases plus a quoted natural-language trigger ("investigate my AKS cluster"), and additionally a DO NOT USE FOR clause. This clearly matches the anchor for explicit what and when with concrete triggers; nothing is left implicit.

Trigger Term Quality

The description includes the exact natural terms an AKS operator would say — "pod crashes", "CrashLoopBackOff", "OOMKilled", "node NotReady", "DNS or ingress failure", "upgrade stuck", "investigate my AKS cluster" — plus precise error codes (QuotaExceeded, InsufficientVCPUQuota, VMExtensionProvisioningError, AllocationFailed), the AKS equivalent of file extensions in the anchor. This comprehensively covers natural phrasing, synonyms, and exact error identifiers; nothing common is missing.

Distinctiveness Conflict Risk

The DO NOT USE FOR clause disambiguates against every neighboring skill by name (aks-network-capture, aks-gpu-inference, azure-kubernetes, cost-analysis, aks-known-issues, azure-diagnostics) with precise boundary conditions ("a fully qualified documented AKS signature with every required nested qualifier", "Unqualified errors and open-ended incidents stay here only for AKS"). The niche (live AKS Day-2 incident investigation) is clear and conflict risk is minimal.