Conciseness

The body is lean — short Quick Reference bullets and tight Check/Fix/Explain sections with no explanation of concepts Claude already knows. Below 5 only because of minor trims available: the opening disability-rationale paragraph and the trailing "Rule page" URL that duplicates the frontmatter link.

Actionability

Concrete, specific directives ("Add an accessible timeout warning, preserve drafts or submitted data across session expiry, and restore the user to the same step after re-authentication") and unambiguous verification items in Check. Not 5 because no executable example or code pattern is inline — all code lives one hop away in references/rule.md; not 3 since the guidance is specific and complete enough to act on without the reference.

Workflow Clarity

Quick Reference → Check → Fix → Explain → Code Review forms a natural review sequence, and this is a non-destructive review task so the missing-validation cap does not apply. Below 5 because the ordering between the multiple sub-tasks is implicit rather than stated, and there is no checkpoint for when to consult references/rule.md or how to close out findings.

Progressive Disclosure

A ~45-line overview body with a single, well-signaled, one-level-deep reference — "For full implementation details, code examples, and framework-specific guidance, see `references/rule.md`" — and the referenced file exists and is substantive. This matches the clear-overview-with-one-level-references anchor and the under-50-lines guideline.

Specificity

"Check both client and server behavior: warning timing, dialog accessibility, autosave frequency, timeout extension, and post-login state restoration" lists five concrete review actions, matching the several-specific-actions anchor. It stays below 5 because coverage is limited to checking — the fix, restore, and explain capabilities present in the body are omitted.

Completeness

The explicit clause "Use when reviewing authenticated user flows or long forms" answers when with concrete trigger phrases, and "Check both client and server behavior: warning timing, dialog accessibility, autosave frequency, timeout extension, and post-login state restoration" explicitly answers what with a concrete action list — matching the both-what-and-when anchor rather than the could-be-more-explicit anchor at 4.

Trigger Term Quality

Natural phrases like "authenticated user flows", "long forms", and "timeout extension" give good keyword coverage. Not 5: common variations users would say — "session expiry", "inactivity timeout", "auto-logout" — are missing; not 3: the terms are specific and varied, not merely domain-level.

Distinctiveness Conflict Risk

The timeout-recovery niche (autosave frequency, timeout extension, post-login state restoration) is clearly distinguishable, but "long forms" as a trigger overlaps with generic form-review skills. Mostly distinct with minor overlap risk, not the minimal-conflict clarity of anchor 5.