diff --git a/journal/2026-07-10.md b/journal/2026-07-10.md
index 663285a..cf29475 100644
--- a/journal/2026-07-10.md
+++ b/journal/2026-07-10.md
@@ -854,3 +854,10 @@ tags: [scope/global, type/log]
 /home/jared/Documents/SecondBrain/reference/claude-code-hook-lifecycle-injection-capability.md
 /home/jared/Documents/SecondBrain/reference/planka-backlog-routing-discoverability-gap.md
 /home/jared/Documents/SecondBrain/claude-md-budget-linter-plugin-concept.md
+
+## Session — 2026-07-10T20:32:59Z
+
+**Project:** /home/jared/dev/ruby-gems/planka
+**Reason:** clear
+**Vault notes touched:**
+(none)
diff --git a/rubocop-todo-exclude-masks-explicit-paths.md b/rubocop-todo-exclude-masks-explicit-paths.md
new file mode 100644
index 0000000..28f5954
--- /dev/null
+++ b/rubocop-todo-exclude-masks-explicit-paths.md
@@ -0,0 +1,40 @@
+---
+type: reference
+title: "RuboCop: per-cop Exclude lists mask offenses even for explicitly passed paths"
+summary: Why `rubocop <file>` can report "no offenses" on a todo-baselined file that is full of them, and how to verify real cleanliness during a .rubocop_todo.yml burn-down.
+tags:
+  - type/reference
+  - tool/rubocop
+  - domain/ruby
+scope: global
+last_updated: 2026-07-10
+date: 2026-07-10
+source: credvault
+---
+
+# RuboCop: per-cop Exclude masks explicit paths
+
+Passing a file path explicitly to RuboCop does **not** bypass per-cop `Exclude:` lists
+(the kind `.rubocop_todo.yml` generates). Only `AllCops: Exclude` globs are bypassed for
+explicitly named files; `--force-exclusion` relates to `AllCops: Exclude` too, not to
+per-cop excludes.
+
+Consequence: during a todo burn-down, `bundle exec rubocop path/to/file.rb` reports
+"no offenses detected" on a baselined file **even if it is full of offenses**. An agent
+verifying its refactor this way will falsely conclude the file was already clean and do
+nothing (this happened on the credvault Sandi Metz burn-down, 2026-07-10).
+
+## How to verify real cleanliness
+
+Either:
+
+1. Lint against a config with the todo stripped:
+   ```bash
+   grep -v "^inherit_from" .rubocop.yml > /tmp/rubocop-no-todo.yml
+   bundle exec rubocop -c /tmp/rubocop-no-todo.yml <files>
+   ```
+   (Works when `.rubocop.yml`'s only inherit is the todo; otherwise remove just that entry.)
+2. Or copy the file to a throwaway name not listed in any Exclude and lint the copy.
+
+The definitive end-state check is regenerating the todo
+(`rubocop --regenerate-todo --no-exclude-limit`) and confirming it comes out empty.