@am_shork/attest 1.0.0 → 1.1.1

package/CHANGELOG.md

@@ -90,6 +90,391 @@ above and 110 stale lines on this one.
 security hole takes a major, on whatever schedule a hole is found. That price is
 now stated rather than unknown, which is what made the line decidable at all.
 
+## [1.1.1] - 2026-09-03
+
+### Documentation
+
+- **`docs/{en,zh}/intent-quality.md` gains a seventh finding: a param no
+  statement interpolates changes with nothing outside the line to show it.**
+  `render --check` gives a review surface for the 92.1% of this repository's
+  params that a statement does interpolate — editing one moves `SPEC.md`. It
+  cannot help with the rest: five are structurally uninterpolatable (a
+  kind-to-payload table or a list, which `non-scalar-interpolation` refuses in
+  a statement) and two are scalars nobody interpolated. For those, every gate
+  treats the edit as fine — `check` sees a schema-valid literal,
+  `possible-drift` is satisfied by any covering scenario reading the param at
+  all, and `verify` stays green wherever the assertion derives its expectation
+  from the same value — so a human reading the registry diff is the only thing
+  that catches an unintended move. Split out of the *Under consideration* entry
+  on changing an existing param's value, as the cheap half it named while the
+  WARNING it also considered stays undecided for want of a second corpus.
+
+### Added
+
+- **`pre-commit-check` gained §9, a hand sweep for a dependency bump.** Closes
+  the *Considered and rejected* entry on a standing `no-deprecated` gate: three
+  deprecated call sites across a Zod 3→4, Vitest 3→4 and typescript-eslint
+  8.2→8.65 walk was too small a denominator to carry a third tsconfig or an
+  `allowJs` admission into the wider typed project, so the check stays a manual
+  step — run `@typescript-eslint/no-deprecated` against a throwaway project that
+  also covers the five files no tsconfig in this tree includes
+  (`eslint.config.js`, `bin/attest.js`, the three `vitest*.config.ts`) — rather
+  than a permanent gate.
+
+- **A gate on which files inside this tree may name the package by the name it
+  publishes under.** A built `dist/` makes this package resolve *itself*:
+  `package.json` names the subpaths in `exports`, so `@am_shork/attest/define`
+  resolves to `dist/core/registry.js` on any machine that has run a build. CI's
+  lint, test and typecheck jobs run before one, and there it resolves nowhere.
+  Measured once, on an archived `requirements.delta.ts` written with the
+  specifier the workflow document hands *adopters*: it passed `eslint`, both
+  typechecks, the whole suite, `check self`, `verify self` and `archive --apply`
+  locally — **six gates** — then failed **three CI jobs** on that one line. This
+  is the sibling of the `bin/attest.js` loads `dist/` gotcha and the more
+  dangerous half of it: there a stale build runs old code, here the build
+  vouches for an import that has no other resolution.
+
+  `tests/import-boundary.spec.ts` now reads the whole checked tree through the
+  same AST walk the runner-boundary tests use, and asserts the set of published
+  specifiers against a one-entry allowlist. The single legitimate namer is
+  `examples/judgement-table/judgement.spec.ts` at `@am_shork/attest/inspect`,
+  and it is legitimate for exactly the reason the rule exists: `./inspect` is
+  the only subpath with somewhere to resolve *to* inside this tree, via
+  `resolve.alias` in `vitest.config.ts` and the matching `paths` entry in
+  `tsconfig.typecheck.json`.
+
+  *Two things about the walk are load-bearing and neither is obvious.* It does
+  not use `findFiles`, because `SKIP_DIRS` excludes `changes/` and `archive/` —
+  correctly, for a normal scan — while `tsc` and `eslint` are handed `self/**`
+  and walk straight into both, and the import this exists for was in an
+  *archived* delta; the engine's own scanner would have produced a gate that
+  passes over the only file it was written about, which is what the first draft
+  of it did. And it covers the repo root as well as the four directories
+  `tsconfig.typecheck.json` includes, because `vitest.config.ts`,
+  `vitest.self.config.ts` and `vitest.consumer.config.ts` are named by no
+  `include` in the tree yet Vitest resolves them **first**, before it can
+  collect a single test — a published specifier there fails CI earlier and
+  harder than one under `self/`, and the directory-shaped version of this gate
+  would not have looked. Each half is pinned by an instrument guard, so a walk
+  that quietly stops reading `examples/` or the root fails on the guard rather
+  than passing empty.
+
+- **A product identity, as delivery artifacts.** `assets/brand/` carries the
+  mark, four icon sizes and four lockups as SVG, with `assets/brand/README.md`
+  as the guide: the geometry grid, the mortise-and-tenon overlap that must not
+  become clearance, the scaling rules, the type stack and the palette. The
+  README header and `package.json`'s keywords are the rest of it.
+
+  **Nothing in `src/` reads any of it, and that is the shape of the change
+  rather than a stage it has not reached yet.** A CLI half was built and dropped
+  in the same session — a palette module plus a `--help` banner — and the
+  argument that closed it is filed under *Considered and rejected*.
+
+### Changed
+
+- **Three deprecated call sites retired, found by turning
+  `@typescript-eslint/no-deprecated` on the whole typed tree rather than by
+  reading the diff.** Neither was reachable by the repo's standing gates: both
+  compiled, linted and ran green, because a deprecation is a JSDoc tag and
+  nothing in `eslint.config.js` was asking for it.
+
+  `src/core/schema.ts` passed `{ message: … }` to the `statement` refinement.
+  Zod 4 deprecated that parameter in favour of `error`, and the rest of the file
+  had already moved — `paramValue`, `RegistryRecord` and `RegistrySchema` all
+  spell it `error` — so this was the one survivor of an incomplete migration,
+  not a considered exception. The wording is unchanged, and by the
+  `Issue.message` rule it is prose either way, so nothing observable moved:
+  parsed against the built schema, the refusal still comes back with the same
+  `message` under the same `custom` code. Design §5.1 quotes this schema in both
+  languages and carries the same edit.
+
+  `tests/registry-types.spec-d.ts` used `expectTypeOf(…).toMatchTypeOf<…>()`,
+  deprecated in expect-type 1.2.0 and split into two successors. Both sites
+  assert *assignability to a supertype* — `Registry` for the whole registry,
+  `Requirement` for one entry — which is `toExtend`, the successor that keeps
+  the `extends` relation. `toMatchObjectType` is the other one and would have
+  been the wrong reading: it checks a strict subset of keys, which is a
+  different claim than the one these two tests were making.
+
+  `eslint.config.js` called `tseslint.config()`, deprecated in
+  typescript-eslint 8.65 now that ESLint core provides the same `extends`
+  flattening via `defineConfig()`. Swapped for `defineConfig` + `globalIgnores`
+  from `eslint/config`. Because both spellings lint clean, *clean was not
+  evidence*: equivalence was established by diffing `eslint --print-config` for
+  a file in each of the five trees across the swap — byte-identical — plus the
+  linted file set and problem count, 166 and 0 on both sides.
+
+  **The third one is the interesting one, because the first sweep structurally
+  could not see it.** `no-deprecated` is type-aware, so it only reaches files
+  some project includes — and `tsconfig.typecheck.json` includes `src`, `tests`,
+  `self` and `examples`, which leaves `eslint.config.js`, `bin/attest.js` and
+  the three `vitest*.config.ts` named by no `include` in the tree. This is the
+  same blind spot `tests/import-boundary.spec.ts` was written about from the
+  other direction: the root config files are read *first* by the tooling and
+  belong to no project last. Re-run against a throwaway project that includes
+  them, the remaining four are clean — and that result was itself checked
+  against the failure shape this repo keeps meeting, by re-running the scan on
+  the pre-fix `eslint.config.js` and confirming it goes red, since a scan
+  matching no files is also silent.
+
+  With that gap closed — and the installed dependency tree carrying no registry
+  deprecation, the adopter-facing samples inside `skill.ts` and every code fence
+  in `docs/` and the README checked against the deprecated identifiers harvested
+  from the dependency typings, `fixtures/**` scanned under a throwaway project,
+  and the suite run under `--pending-deprecation` surfacing no runtime `DEP`
+  warning — this is the whole inventory as of Zod 4.4, expect-type 1.4,
+  typescript-eslint 8.65, Vitest 4.1, TypeScript 5.9 and Node 24.
+
+  **Two halves of that are unmeasured rather than clean, and are named here
+  rather than left to be inferred from the version list.** `package.json`
+  declares `typescript` as `^5.5.0 || ^6.0.0` while 5.9.3 is what is installed,
+  so anything TypeScript 6 deprecates has not been looked at; and `engines`
+  allows Node 20.19 while the sweep ran on 24, so a `DEP` warning that fires
+  only on an older runtime would not have appeared. Nothing gates any of it
+  going forward — see *Under consideration*.
+
+## [1.1.0] - 2026-09-02
+
+### Added
+
+- **`ATX-89`, `ATX-90`, `ATX-91`: `check` reports a workflow document the
+  installed version no longer writes (`stale-workflow-doc`, INFO).** The
+  document `attest init` writes is a pure function of the installed version, and
+  the adopter's tree records nothing about which version wrote it —
+  `skillContent()` and `workflowBody()` take no argument, deliberately, because
+  that is what makes re-running `init` safe. So the file carries no version
+  stamp and a diff against the installed build is the only detector its own
+  design permits. Measured on a 0.9.1 → 0.11.0 upgrade report: **110 changed
+  lines across 9 hunks**, 403 lines against 458, found only because the reporter
+  wrote a script importing `workflowBody()` out of `dist/`, with `check`,
+  `cover`, `verify` and `render --check` all green.
+  *The level is an asymmetry of obligation rather than a severity judgement, and
+  that is the whole argument for it.* Keeping the document current is Attest's
+  obligation, because Attest is what changes it; taking the update is nobody
+  else's, because an adopter is free to run an older workflow, a modified one, or
+  none. A finding whose subject the reader owes nothing about is exactly the
+  finding that may only inform — so `ok`, the exit code and every gate are
+  untouched, and a reader who ignores this forever pays what they pay today.
+  *This is not `init --check`*, which stays rejected below. That gate turns red
+  on a diff the person who must commit it has no way to review: a regenerated
+  `SPEC.md` shows what **you** changed about your promises, and a regenerated
+  `SKILL.md` shows what Attest's authors changed. It also fires in CI, where
+  nobody can run `init`, blocking whoever pushes next for an upgrade somebody
+  else made.
+  *Three requirements because there are three ways to be wrong, and this file
+  already carves the identical problem up this way for renderings.* `ATX-89` is
+  the report; `ATX-90` is that an **absent** document draws nothing, which is the
+  one the obvious implementation breaks — `staleIssue` reports a rendering that
+  was never generated under its own code, and copying that here would fire on two
+  of this repository's own three targets and on the majority of adopters, since
+  `init` writes one target by default and nothing obliges a project to run it;
+  `ATX-91` is that the comparison is of the document rather than the bytes, which
+  is deliberately the **opposite** of `ATX-84` and could not be had by widening
+  `ATX-29`. `ATX-84` compares this repository's copy byte-for-byte and may,
+  because `.gitattributes` here is committed and pins `eol=lf` — that file is
+  Attest's here and nobody's in an adopter's tree, so one rule cannot cover both.
+  *What it costs, measured before it was built:* 0.234 ms for all three target
+  comparisons, plus 4.19 ms to import `targets.ts` and the 26 KB template behind
+  it, against a `check self --json` of 814–1,183 ms — **~0.5%**. No
+  `SCHEMA_VERSION` bump: the field exists, the value is new, and `ok` is
+  untouched because INFO is below `hasError`.
+  *Two things the build found that the proposal did not contain.* The fix hint
+  had to name what `init` does to the file and not only the command — `runInit`
+  writes with `writeAtomic`, no merge and no backup, so an adopter who edited
+  these instructions is being pointed at something destructive. `targets.ts`
+  rule 1 makes that defensible, Attest owning the path being the whole reason it
+  may overwrite, and it was nowhere stated to the reader. And the two negative
+  scenarios had to be **paired with the case that must fire**, in the same
+  scenario, because an absence assertion alone is green in a tree where nothing
+  is implemented — which is the defect `never-red` exists to name, arriving in
+  the scenarios written to attest a rule about not firing.
+  *One cost that is not paid and is stated rather than left to be discovered:*
+  this repository cannot dogfood it. `check` reads the project root, which here
+  is `self/`, while the document sits at the repository root — so `check self`
+  finds it absent and is correctly silent. `ATX-84`'s scenario reaches two
+  directories up because it is a test; a command cannot. All three scenarios
+  build a temporary project, and `self/` gives this rule none of the continuous
+  exercise `ATX-84` gets.
+  *What the judgement tables did with the three ids, since that is the
+  counter-pressure earning its place rather than a chore paid to it.* All four
+  demanded rows and got them. `compound-requirement` **missed `ATX-89`** — two
+  obligations, "reports it" and "at that level", and the keyword heuristic sees
+  one — which is the "never wrong, nearly blind" reading holding at 18 of 42
+  rather than a new finding. `divergent-param` produced a **new false positive
+  and re-keyed an old one**: `level` joins `code`, `file`, `flag` and `field` as
+  a fifth natural word for a kind of constant, and `level:ATX-60,ATX-89` is the
+  second key where the two requirements genuinely *are* related — both about the
+  severity ladder and the `hasError` predicate — while the rule relates them for
+  a reason that is not that. The echo detector flagged both of `ATX-89`'s params
+  and both were measured `independent` by mutation, one `verify self` each,
+  taking it to 4 true positives of 11.
+- **`ATX-88`: `tests-red` names the timeout the run applied and how many
+  scenarios reached it, so a suite that went red on the clock can be told from
+  one that went red on its code.** Filed from a 0.9.1 → 0.11.0 upgrade report
+  where `npx vitest run` was 170/170 green on the same tree on which `verify`
+  was red two runs in three. The standing answer — run the suite yourself under
+  your own reporter — is circular in exactly that case, because the
+  disagreement between the two runs *is* the failure; what the reporter did
+  instead was time every scenario by hand and cross-reference which of eleven
+  over four seconds declared no `timeoutMs`. **This is deliberately not the
+  pass-through**, which stays open at the foot of this file: carrying the
+  child's failures means new fields, a `SCHEMA_VERSION` question and a third
+  party's assertion wording in the field consumers are told not to branch on.
+  It is the narrow half that is not blocked — the isolated child run drops the
+  config that would have raised the timeout, so *did anything run out the clock*
+  is the one question a green direct run cannot answer and this one can, and it
+  needs nothing the report does not already carry. A count and never a list, for
+  the same reason.
+  *The number is read from the resolved child config rather than written down,
+  and that is the half a constant would have got wrong.* It is the one value
+  here Attest does not choose: Vitest's own default when the run is isolated,
+  the supplied config's value when `--vitest-config` raised it. `ATX-88.params`
+  pins the isolated default at 5000 because two documents quote it in prose —
+  the workflow document `init` writes and the troubleshooting page — and until
+  now nothing would have failed if a Vitest release moved it.
+  *Detected by duration and never by the child's error text.* Vitest does say
+  "Test timed out in 5000ms." and matching that would be shorter; it is also the
+  category error this project refuses in its own diagnostics, since a message is
+  prose in somebody else's package too. Measured rather than assumed: a scenario
+  that reaches the ceiling ends `fail` a hair past it — 5015 ms against 5000 —
+  while an assertion failure ends `fail` in under a millisecond, so `>=` needs no
+  tolerance and a tolerance would start claiming timeouts for slow assertions
+  that failed honestly. A missing duration reads as *not* a timeout, which is the
+  direction that fails quietly; the other reports every red as a timeout, which
+  is a wrong diagnosis printed with confidence.
+  *Stated over the run rather than over the two commands that render it*, unlike
+  `ATX-51` beside it, and by this project's own rule rather than by preference:
+  what `verify` and `archive` add is a sentence in `Issue.message`, which is
+  prose and never API, so a scenario asserting it would be asserting wording.
+  Additive to `--json` only in the sense that nothing there moved at all — no
+  field, no code, no `schemaVersion` question.
+
+- **`examples/judgement-table/` states the counting rule, which is the one piece
+  of content that decides nothing and without which two tables cannot be
+  compared.** Decided under `Planned` on 2026-08-31 on the first table built from
+  that example, which distrusted its own obligation column above all its others
+  and said why: two tables that count differently are not a second measurement of
+  the same thing, they are a second vocabulary. The rule is not a column and
+  answers nothing — what a requirement carries is still the adopter's judgement —
+  so it sits on the same side of the split as the two mechanical properties, and
+  was being withheld along with the answers, which was the wrong side. It fixes
+  the test (two clauses are two obligations when an implementation can satisfy
+  one completely and fail the other), the six kinds of clause that read as a
+  second obligation and are not (scope, criterion, purpose, the other side, a
+  consequence, and the states a scenario happens to construct), the
+  one-promise-per-emitted-artifact case, and the tiebreak — perturb one half and
+  see whether the other half's scenario stays green. Extracted from the labels in
+  `tests/intent-rule-candidates.spec.ts` rather than invented, which is why it is
+  a description of a rule already in use and not a proposal. It also names what it
+  does **not** ask: whether the obligations belong under one id is a different
+  question, and keeping the two apart is what lets the count stay a measurement.
+
+### Changed
+
+- **The example's anchor is no longer a field to be typed, because the first
+  table built from that file filled it in for all 80 of its rows mechanically.**
+  `Judgement` shipped with an optional `pin`, documented as not a judgement
+  column and nevertheless the only concrete field in the interface — and a field
+  gets populated. Copying 80 scenario names out of the AST and back into the
+  table is not judgement, and it is exactly the form-filling the empty frame
+  exists to prevent. `pin` is now out of `Judgement` entirely and sits in a
+  sibling `PINS` map, and an anchor on an id declaring fewer than two scenarios is
+  **refused**: with one scenario the anchor is a function of the project,
+  `inspectProject` already computes it, and the line naming it is transcription
+  wearing a judgement's clothes. What survives is the case where the anchor is a
+  real choice, which is the case a machine cannot make. *The cost is named rather
+  than hidden:* a sole scenario deleted and replaced under a different name is a
+  revisit `PINS` will not force. That is what not asking anyone to transcribe
+  costs, and it is paid where a rename cannot change which scenario the row meant.
+- **The frame's emptiness is now typed, which the obvious implementation of this
+  fix would have left unenforced.** Deleting `pin` leaves `interface Judgement {}`,
+  and an empty interface is not an empty row type — it admits `0` and `""`, so
+  every row could quietly acquire anything at all while the file claimed to ship
+  no fields. `Record<string, never>` is the type that means what the sentence
+  says. Caught by `eslint` rather than by reasoning, which is `How an entry is
+  re-measured`'s question about what a repair makes reachable arriving one step to
+  the side of where it was expected. Measured both directions: a row carrying an
+  undeclared field does not compile, and replacing the line with an interface
+  holding one **required** column errors on every existing row.
+- **The example's own subject gained a second scenario**, so `EX-1`'s anchor is a
+  choice among several rather than a value the machine could have derived — the
+  refusal above has nothing to demonstrate on a project where every id declares
+  one scenario. It is also the counting rule standing on its own subject: two
+  scenarios, one obligation, because "before it is stored" is the criterion for
+  "rejected" and not a second promise. All three assertions in the anchor test
+  were shown to fail before this was called done — a derivable anchor, a renamed
+  scenario, and an anchor with no row.
+
+### Documentation
+
+- **Three places carried a backstop claim that is now false — `ATX-84`'s
+  rationale, `skill.ts`'s header, and design §9 in both languages — and all
+  three withdraw it.** The claim is that every mistake a stale workflow
+  document can cause is a diagnostic carrying a fix hint the agent corrects
+  itself from, and it is one of the two arguments for shipping no freshness gate
+  to adopters. An upgrade report measured the counterexample: a
+  copy six weeks and one upgrade behind still described `never-red`'s ordering
+  rule, which `[0.10.0]` archived as `evidence-not-ordering` because the
+  ordering was never in the engine. An agent reading it does something the
+  engine does not require — more conservative, not wrong-shaped — so **no issue
+  fires at any severity** and there is nothing to correct itself from. The
+  backstop covers a stale document producing bad input; it does not cover one
+  producing unnecessary work, and the second is what the drift produced.
+  *All three, because they are one argument stored three times and this
+  repository's whole subject is what happens when those disagree.* Two were
+  known from the entry that priced this; the third was found by grepping for the
+  claim rather than for the files that discuss it, and design §9 is the copy
+  with the widest audience. `ATX-84`'s rationale cites "the decision in
+  `skill.ts`", which cites the design — so correcting any one of them alone
+  leaves a citation pointing at a document that says something else. The
+  workflow document's own bytes are untouched — the claim lives in the module
+  header, above `BODY` — so no `init` re-run is owed and `ATX-84` stays green
+  byte-for-byte.
+  *What does not change is the requirement.* `ATX-84` gates this repository's
+  copy and is not adopter-facing, and the surviving objection — that a gate
+  charges every adopter a diff they did not ask for — carries it alone. What the
+  withdrawal reopens is the adopter-facing question, which is priced under
+  `Under consideration` rather than restated in a rationale, since a second copy
+  of an argument that is still moving is the failure this entry is about.
+- **The workflow document named one of the two things the isolated child run
+  withholds, and the troubleshooting page named both.** Re-measuring this before
+  building it is what found that: the ask was filed as "have the workflow
+  document say that a scenario near the default needs an explicit `timeoutMs`",
+  and that sentence already existed — in `tests-red`'s troubleshooting section,
+  worked example included. What did not exist was the pointer. The workflow
+  document's own bullet on why a green direct run does not predict the gate lists
+  aliases, transforms and a DOM, and stops there; an agent reading it was told
+  about the environment and not about the clock, while the section it links to
+  covers both. So what was owed was a second bullet rather than a new
+  explanation, which is cheaper than the entry priced it.
+- **`tests-red`'s troubleshooting section stops saying the report carries
+  nothing about the failure**, in both languages, because it now carries exactly
+  one thing. The sentence that had to change is the one that reads as a general
+  promise — "not from this report, because it does not carry them" — and the
+  worked example beside it says which half crossed and why the other half is a
+  decision rather than an omission. History rows on `verify` and `archive` in
+  both references, since a reader on 1.0.0 gets the older report.
+- **`CLAUDE.md`'s "it will not tell you why" gotcha gains its exception.** The
+  gotcha is still true of the file, the scenario and the assertion; it is no
+  longer true of the clock, and a gotcha that overstates itself is how somebody
+  stops reading the report.
+
+- **`intent-quality.md` step 2 points at the counting rule, and says why that
+  one pointer does not contradict the page's own sequencing.** The page asks a
+  reader to do step 2 before reading our table, because a table built by someone
+  who read ours first is an echo of ours. A rule that fixes the *unit* is the
+  opposite case — sharing it is what makes a second table comparable, where
+  sharing an answer is what makes it a copy — and a page that withheld both
+  without distinguishing them would have been asking for an incomparable
+  measurement on principle. Both languages, and a line added to *Read our table
+  after step 2, not before* so the exemption is stated where the rule it excepts
+  is. The History row is owed for the second reason rather than the first: step 4
+  tells a reader to **copy** `examples/judgement-table/`, and that file changed
+  under this version, so a copy taken at `[1.0.0]` is no longer the file this
+  page describes — which is exactly what that table is for and the kind of row
+  easiest to miss, because nothing on the page announces that it hands out a
+  file.
+
 ## [1.0.0] - 2026-09-01
 
 ### Added
@@ -6506,211 +6891,6 @@ re-measuring an entry before building it is at the foot of the file, under
 `How an entry is re-measured` — it applies to all three, and was filed here only
 because the first of it was written here.
 
-- **An outward-facing form of the judgement tables, so an adopter can run this
-  counter-pressure on their own registry.**
-  `tests/intent-rule-candidates.spec.ts` maintains four hand-judged tables over
-  this repo's registry and enforces their completeness. Design §11 records the
-  properties they defend and that nothing enforces any of them; what the tables
-  add is a counter-pressure holding for **one** registry whose authors agreed to
-  maintain it. An adopter got none of it, and the reason was sharper
-  than "nobody wrote it for them": the package exported `requirement`,
-  `scenario`, `defineRequirements`, `delta` and types, and nothing else.
-  `parseSpecs`, `findFiles` and `readRegistrySource` were internal, so an
-  adopter **could not enumerate their own scenario names** — the table's central
-  rot check, that a claimed scenario is one a spec really declares, was not
-  merely unwritten downstream but unreachable. **That half shipped under
-  `[0.9.2]` as `@am_shork/attest/inspect`** and is recorded at the foot of
-  this entry; what stays here is the schema built on top of it, and the three
-  blockers below are untouched by the export.
-  *The shape that makes it shippable at all is a split, not a feature.* The
-  engine can compute which ids exist, which statements match the universal
-  quantifier regex, which params are list-valued, and whether a named scenario
-  is declared — all four already, all statically. It cannot compute how many
-  obligations a requirement carries, what a quantifier ranges over, or whether a
-  scenario iterates a param. So the shippable object is **the enforcement, never
-  the judgement**: an opt-in `*.judge.ts` read by the same static reader and
-  under the same literal-only rule the registry is (it is metadata about
-  requirements under review, so `check` must execute nothing to read it), whose
-  contents are entirely the adopter's. Opting in is creating the file; once it
-  exists, `requirement-unjudged`, `orphan-judgement`, `unbound-site` and
-  `quantifier-unjudged` make it complete and keep it from rotting. The
-  asymmetry is the only way this can exist without Attest asserting a ground
-  truth it refuses to compute (§0), and it is the same asymmetry `never-red`
-  already runs on: the archive gate would owe judgement only for ids a change
-  ADDs, so a brownfield adoption is not blocked wholesale.
-  *One part of the existing table cannot ship in any form.* `DOMAINS.pin` comes
-  in two kinds — a scenario name, checkable against the AST, and a **source-text
-  fragment** grepped out of the spec file. The second is asserting on the
-  wording of somebody's test, which is the `Issue.message` category error under
-  another name. Only the scenario-name kind is exportable, and what that costs
-  is real: the grep is what caught a deleted pin that `toContain` had passed.
-  *Why no detector ships with it, and this is the part that is already
-  measured.* Three rule families were built and scored against the whole corpus
-  (86 entries, counting a fixture id once per registry file) before any was
-  written into the engine, which is the order `divergent-param` was originally
-  designed in the wrong way round. Every figure below is a quotation of the
-  suite's inline snapshots; the snapshot is the fresh copy, and this paragraph
-  is only ever as fresh as its last edit.
-  **(1) `compound-requirement`** — 34 requirements carry more than one
-  obligation, it flags 16, is **wrong about none**, and misses 18. Never wrong
-  and nearly blind, and the 18 are the form the coverage incentive actually
-  rewards: extra clauses under a single keyword. **(2) The widened variant** —
-  29 correct, but 14 wrong and still 5 missed, and it is silenced by deleting an
-  "and". A rule whose cheapest fix degrades the artifact it protects does not
-  ship, and its precision falls as the registry grows. **(3) `divergent-param`**
-  — 5 divergences on this repo, **all 5 judged wrong**, zero true positives ever
-  recorded. The `code` group now spans 19 ids, and the failure is structural
-  rather than a matter of naming: the key is built by discarding the evidence of
-  relatedness, so the one genuinely paired divergence in the group is the one it
-  cannot show, and the key has churned three times under `flag` on additions
-  that changed no verdict. A fourth candidate — the echo detector, scored at
-  half precision — belongs to the tautology-detector entry now under
-  *Considered and rejected* and is not re-quoted here, because a figure stated in two places goes stale in one. Taken together
-  these are the measured range of what a token or single-body detector over
-  prose can do here, and they are why the proposal is enforcement-only.
-  *What blocks the decision — three things.* **(1) One adapter.** This
-  repository's table is the only one that exists, and its author wrote both the
-  schema and every answer in it. By this project's own rule a second table is
-  what makes the seam real, and freezing a `Judgement` type now is deciding for
-  everyone from 34 requirements written by one person. **(2) The breaking form
-  of this was already rejected** — see *Countable obligations* below — and one
-  of its three reasons survives the separate-file shape intact: **nothing can
-  force the count to be true.** The other two do not survive, which is what is
-  new here: a separate artifact touches no `--json` field, no delta apply and no
-  `render` output, and completeness *across ids* is computable in a way
-  completeness *within* an obligation array never was. So this is a re-proposal
-  with one of three objections answered and the sharpest one standing.
-  **(3) `quantifier-unjudged` reuses a rejected detector as its trigger.**
-  Firing on the quantifier token was rejected below at 43% reach and 70% wrong;
-  the claim here is that the same regex is acceptable when it asks a question an
-  author discharges in one line (`over: 'values'`) rather than issuing a
-  verdict. That claim is untested on anyone who did not also write the regex.
-  *The half that is not blocked has shipped, under `[0.9.2]`.*
-  `@am_shork/attest/inspect` is one function answering what a project declares —
-  AST-only, no runner peer, landing on the existing static/executing boundary.
-  It ships no schema and decides nothing, which is why it could go ahead of the
-  three blockers rather than waiting on them. What it changes about this entry
-  is the *kind* of thing that is now missing: the mechanism is no longer
-  unreachable, only unwritten, so a second table is something an adopter can
-  build rather than something only this repository could.
-  *What would decide it:* one judgement table maintained by someone who did not
-  design it. If it comes back the same shape, the seam is real and the schema
-  follows; if it comes back different, `inspect` was the whole answer and the
-  schema never needs to exist. *(One came back on 2026-08-31, and the disjunction
-  above is too clean to survive it: partly the same shape, partly not, and the
-  same half is the contaminated half. The close of this entry is where that is
-  read.)*
-  **Nothing currently makes that table arrive, which is a separate problem from
-  the three blockers and the one that gates all of them.** Raised in a product
-  review of `[0.9.1]`–`[0.9.3]` on 2026-08-19. The deciding evidence is an
-  artifact only an adopter can produce, and the path to producing it is: a row in
-  the README's document table, then a 214-line page, then a hand pass over four
-  questions, then writing the two mechanical properties from a prose
-  description, then choosing to report back. Five voluntary steps with no
-  scaffold at any of them, against a decision this entry has been waiting on
-  since `[0.9.2]`. An entry blocked on evidence that no shipped surface asks for
-  is blocked indefinitely, and the wait is not itself evidence of anything.
-  *The proposal is scaffolding the mechanism while still withholding the answer,*
-  which is the same split `[0.9.2]` already made and not a retreat from it: an
-  `examples/` directory holding the completeness and rot-binding assertions with
-  **no columns** — the enumeration that forces a row, and the check that a named
-  scenario is one `inspectProject` really declares — and the judgement columns
-  left for the adopter to add. What the page withholds is this repository's four
-  columns, and that stays withheld; what it currently also withholds is the two
-  properties it names as *mechanical*, and those are the half where a copy is not
-  an echo, because their content is fixed and the fourth finding does not apply
-  to them.
-  *What blocks it.* Whether a skeleton with no columns is still a shape that
-  comes back as a copy — the page's argument is that a template makes the answer
-  return its own question, and it is untested whether an adopter reads an empty
-  frame as an invitation or as a form to fill in. And it is a second artifact
-  claiming to be runnable consumer usage of the public API, which `pre-commit-check`
-  §6 already records as the category no gate reaches: the page's three samples
-  are unasserted today, and a fourth in a directory that looks executable would
-  be worse than a fenced block, not better, unless something runs it.
-  **Built under `[0.11.0]`, and the second of those two blockers was the
-  buildable one.** `examples/judgement-table/` is in the default suite, the
-  specifier is aliased rather than relativised so the file stays copyable
-  verbatim, and both assertions were shown to fail before it was called done.
-  So the category `pre-commit-check` §6 names now has exactly one member that a
-  gate reaches, and the page's three prose samples are still not it.
-  *Two things the build found that the proposal did not contain.* A third
-  assertion — `issues` empty, before either of the other two — which is not a
-  refinement but a hole: an unread registry file and a smaller project are the
-  same value, and the two completeness directions pass over both. It was found
-  by an invalid mutation during the bite test rather than by reasoning, which is
-  `How an entry is re-measured`'s question about what a repair makes reachable,
-  arriving from the other end. And a **type-level** forcing move the runtime
-  assertion cannot make: a required field added to `Judgement` fails every
-  existing row at compile time, so the schema-shaped half of "a row cannot
-  arrive unjudged" costs one line and no engine rule. That is worth noting
-  against blocker **(1)** above, which is about freezing a `Judgement` type:
-  what shipped freezes nothing, because the type is in the adopter's copy.
-  **What is untouched is the first blocker, and it is now the only thing between
-  this entry and its evidence.** Whether an empty frame reads as an invitation
-  or as a form to fill in is still untested, and cannot be tested here — the
-  people who would answer it are the ones who have not arrived. What the build
-  changes is only that the five voluntary steps are now four, and the one
-  removed was the one with a fixed answer. If the next report is still nobody,
-  the scaffold was not what was missing, and that is worth knowing too.
-  **Decided 2026-08-31: build the counting rule, and not the schema.** The
-  blocker was whether an empty frame reads as an invitation or as a form to fill
-  in, it could not be tested here, and a 0.9.1 → 0.11.0 upgrade report from
-  `mine-capablanca` tested it. The answer is **invitation**, and the report names
-  the sentence that did it: not the empty `interface Judgement`, which reads as a
-  stub and sent the reporter looking for what belonged in it, but the comment
-  above it — *"It ships with no columns, and that is the finished state of this
-  file rather than a gap in it."* Declaring the absence finished is what turns a
-  blank into a question, and it is the cheapest sentence in the example.
-  *The forcing move was one the build found rather than one it proposed.* The
-  instruction to add the first column as a **required** field made all 80 rows
-  stop compiling at once, and there was then no path back to green that did not
-  go through having an opinion about all 80 — *"a form gets partially filled in;
-  a type does not"*. That is the type-level forcing move described above,
-  working on somebody who did not write it.
-  *And the frame leaks in one place, which is a defect in the example rather
-  than in the idea.* `pin` is documented as not a judgement column and is the
-  only concrete field in the interface, so the reporter's first act was to
-  populate it for all 80 rows mechanically — *"there is a field, populate it"*.
-  Defensible, since it makes rot-binding bite for 80 rows instead of none, and
-  exactly the form-filling behaviour the frame exists to prevent. Generating
-  `pin` from `inspectProject` rather than leaving a field to be typed is the fix,
-  and it belongs in the example.
-  *What does **not** follow, and the report is why it does not.* Two of the three
-  columns that came back are the same shape as two of this repository's —
-  `clauses` is `OBLIGATIONS`, `quantifier` is a flattened `QUANTIFIED` — and it
-  is tempting to read that as the seam being real. It cannot be read that way:
-  the reporter names the `attest init` workflow document as prior influence, and
-  that document discusses quantifiers and param pinning at length. So the
-  convergence says **something** transmits those two ideas, and the document is
-  at least as likely a channel as the frame. What is uncontaminated is the third
-  column, `venue`, which has no counterpart here: nine of its rows record a
-  promise held by a Playwright suite Attest's scope does not reach. A column this
-  repository could not have written came back, which is a seam behaving like one.
-  *What to build is smaller than a schema, and the three things the reporter
-  wanted and did not get are its specification.* **(1) A counting rule for
-  "obligation" precise enough that two people count the same.** The report
-  distrusts its own `clauses` column above all the others and says why: two
-  tables that count differently are not comparable, which defeats the point of
-  there being a second one. A counting rule is content that does **not** depend
-  on the adopter — the same category as the two mechanical assertions — and it is
-  currently withheld along with the columns, which is the wrong side of the
-  split. **(2) A way to bind a clause to a scenario rather than a row.**
-  Rot-binding binds a row to *a* scenario; nothing binds the sixth obligation of
-  a six-clause requirement to anything, so a six-clauses-three-scenarios row is a
-  number a reader has to notice instead of an assertion that fails. **(3)
-  Somewhere for a row to say the promise is held where Attest cannot see it.**
-  Nine `ui-node` rows and a 902-line Playwright suite, citable only in prose.
-  *So what is planned is (1) and the `pin` fix, and (2) and (3) explicitly are
-  not.* (1) is a paragraph in the example, costs no engine surface, and is the
-  one thing that makes a second table comparable to the first — without it two
-  tables are two vocabularies and the seam cannot be read either way. (2) and (3)
-  are both new schema, and blocker **(1)** of the proposal above — one adapter —
-  is not answered by a report that is the second adapter's first hour. Two hours
-  of one agent is not two adapters. **The `*.judge.ts` schema stays undecided**,
-  and when it moves it will move on a second table that somebody has maintained
-  rather than built, which is a different measurement from the one that arrived.
-
 ## Under consideration
 
 Candidates with **no decision yet**, between the two sections either side of it
@@ -6939,6 +7119,31 @@ have to gather again.
   *What would move it:* a red `verify` on an adopter's tree whose cause is not a
   timeout. Every instance anybody has is this one.
 
+  **Blocker (3)'s two cheap answers are built under `[1.1.0]`, and the
+  entry stays open on the other two.** `ATX-88` has `tests-red` name the timeout
+  that applied and how many scenarios reached it, and the workflow document now
+  says the isolated run drops your `testTimeout` along with the rest of your
+  config. Neither touches (1) or (2): no field was added, no `SCHEMA_VERSION`
+  question was asked, and no assertion text from the child crossed into an
+  `Issue`. What the entry proposes — passing the child's failures through — is
+  unchanged and undecided.
+  *Two things the re-measure corrected, and one is the second cheap answer's
+  whole shape.* The workflow-document line was filed as content to write, and it
+  was already written: `tests-red`'s troubleshooting section carries it, worked
+  example included. What was missing was a pointer from the workflow document's
+  own bullet about why a green direct run does not predict the gate, which lists
+  aliases, transforms and a DOM and stops before the clock. And the first
+  answer's phrasing — "the timeout it **imposed**" — was wrong about who imposes
+  it: Attest sets no timeout, it inherits Vitest's default by isolating, so the
+  number has to be read off the resolved child config rather than stated. That
+  distinction is what makes the answer correct under `--vitest-config` too,
+  where the ceiling is the adopter's.
+  *What this does not do, stated so the entry is not read as smaller than it
+  is.* It answers whether the clock was involved. It does not name the scenario,
+  the file or the assertion, so a red `verify` whose cause is not a timeout is
+  exactly as opaque as it was — which is the case this entry is still waiting on
+  an instance of.
+
 - **Changing the value of an existing param passes no gate, and for seven of
   them there is no record either.** Split out of the tautology entry that
   headed this section on 2026-08-18, and which is now under *Considered and
@@ -7036,6 +7241,15 @@ have to gather again.
   `intent-quality.md`, the four things no gate is looking at already being that
   page's subject and this being a fifth of the same kind.
 
+  **The cheap half is written under `[Unreleased]`, and the decision above is
+  unchanged by it.** `docs/{en,zh}/intent-quality.md` now carries a seventh
+  finding: a param no statement interpolates changes with nothing outside the
+  line to show it, so the discipline that catches an unintended move there is a
+  human reading the registry diff. That costs no engine surface and settles
+  nothing this entry is still waiting on — the WARNING in blocker **(2)** is
+  still a rule with no measured population, and this is the fallback the entry
+  itself named for exactly that state, not a smaller version of the rule.
+
 - **The intent layer is separable from the repository it describes, and the
   verification layer is not — so a third party can audit intent and never
   obtain a verdict.** Filed 2026-08-22 from a design evaluation of using Attest
@@ -7138,6 +7352,124 @@ have to gather again.
   yet followed a stale instruction and paid for it, and the rejection below is
   entitled to that until somebody has.
 
+  **Priced on 2026-09-02, per `How an entry is re-measured`, and the three
+  questions have answers: `check`, `INFO`, and no — the chore is the exit code
+  rather than the line.**
+  *The re-measure corrected the entry's framing of the detector first.* "A diff
+  against the installed build is the only detector the file's own design
+  permits" reproduces exactly, and what it makes reachable is the opposite of
+  how it reads: the comparison needs no version stamp, because `skillContent()`
+  is already inside the process that would report. Measured against this
+  repository's own copy — byte-equal and document-equal at 26,584 bytes both
+  sides — and against the other two targets, which are **absent**, that being
+  the population the notice has to be right about. Cost is **0.234 ms** per run
+  for all three comparisons plus **4.19 ms** to import `targets.ts` and through
+  it the 26 KB template in `skill.ts`, which `check` does not import today;
+  `check self --json` is 814–1,183 ms over three runs, so the notice is **~0.5%**
+  of the command it rides on.
+  *Which command, and the objection to it is answered by precedent rather than
+  by argument.* `check` is the only command an adopter runs unconditionally and
+  is the one the workflow document tells the agent to run. `status` takes a
+  `<change>`, so it is silent during exactly the brownfield adoption whose
+  document is stalest; `cover` and `render` are narrower; `verify` and `archive`
+  are the expensive verdicts, where a non-verdict line is noise at the worst
+  available price. The objection is that this would be `check`'s first finding
+  that is not about the project's intent layer — and it would not be:
+  `compilerIssue()` is the first statement of `runCheck`, and
+  `compiler-unsupported` is a finding about the *installed environment*, at
+  ERROR. What ATX-16 scopes `check` to is executing nothing, never intent only.
+  *What level, and `WARNING` is wrong for a reason the roster states.* All three
+  existing WARNINGs — `rationale-placeholder`, `requirement-open`,
+  `orphan-from-failed-registry` — are defects in the reader's own intent layer
+  that the static half declines to fail on. A stale document is neither a defect
+  nor theirs. `INFO` has exactly one member, `possible-drift`, and it is this
+  shape precisely: something here may be drifting and nothing can prove it cost
+  you anything — which is also what this entry's own unmeasured half says.
+  `ERROR` is `init --check`, and that stays rejected.
+  *The chore question dissolves at that level, on a fact about when the drift
+  appears.* The rejection's standard is a gate that "turns red on a change the
+  user did not make". Drift appears only when the installed version moves, which
+  is a lockfile edit and is a change they made; a fresh clone at a pinned version
+  compares equal and is silent, so the failure mode that forced `render --check`
+  off byte comparison — calling a fresh clone stale — cannot occur here. What
+  makes a thing a chore is the exit code, not the line, and at INFO there is
+  nothing to clear: a reader who ignores it forever pays what they pay today.
+  *The repair makes one thing reachable that the entry does not contain, which
+  is the question the method exists to ask.* `runInit` writes with `writeAtomic`
+  unconditionally — no merge, no backup — and the notice cannot tell a stale file
+  from an edited one. Today that overwrite happens only when the user chooses to
+  run `init`; a notice prompts them into it on the tool's schedule, so the fix
+  hint has to say that `init` rewrites the file rather than merely naming the
+  command. `targets.ts` rule 1 makes that defensible — Attest owns the path, and
+  that is the whole reason it may overwrite — but defensible and unstated are
+  different things.
+  *And the obvious implementation is wrong twice, both times by copying
+  `staleIssue`, which is the reference implementation this entry points at and
+  therefore the one nobody re-reads.* **(a)** It emits `missing-spec-doc` for an
+  absent file. Here an absent file is a project that never ran `init` — two of
+  this repository's own three targets — and firing on it would be the tool
+  scattering findings about editors nobody uses, which is the argument
+  `DEFAULT_TARGET` already makes. Absent must be silent, so this takes one code
+  and not two. **(b)** `sameDocument` normalises CRLF and has to here, for the
+  reason `render --check` needs it: Attest does not own an adopter's
+  `.gitattributes`. That is the **opposite** of ATX-84, which compares this
+  repository's copy byte-for-byte, and whose rationale already argues why the two
+  must differ. The comparisons are deliberately not the same one.
+  *What the re-measure found that belongs to no proposal: ATX-84's rationale
+  carries the standing version of this argument, and one clause of it is now
+  false.* It records that a gate here does not reverse `skill.ts`'s decision
+  against shipping one, on the grounds that "every mistake an old document can
+  cause is a diagnostic carrying a fix hint the agent corrects itself from".
+  That is the clause the `mine-capablanca` report falsified — the withdrawn
+  `never-red` ordering produces unnecessary work rather than bad input, and
+  nothing fires at any severity. **Withdrawn under `[1.1.0]` on 2026-09-02,
+  in all three places that carried it**, since the correction was owed whether or not
+  the notice ships; what the withdrawal leaves standing is the diff-nobody-asked-for
+  objection alone, which is the argument this entry now has to beat.
+  *One cost the entry did not price: this repository cannot dogfood it.* `check`
+  reads the project root, which here is `self/`, and the document is at the repo
+  root — so `check self` would find the file absent and be correctly silent.
+  ATX-84's scenario reaches two directories up because it is a test; a command
+  cannot. The scenario would land on a fixture, and `self/` would give the notice
+  none of the continuous exercise ATX-84's rationale calls the only detector this
+  document has.
+  *What it does not need, priced because the entries around it spend most of
+  their length on exactly this:* no `SCHEMA_VERSION` bump — the field exists, the
+  value is new, and `ok` is untouched because INFO is below `hasError`, the same
+  reading that has held the version at 1 across all 41 codes. One roster entry
+  and one troubleshooting section per language, both made mandatory by
+  `docs-consistency.spec.ts` rather than by remembering.
+  *The one form still worth arguing is the cheapest one, and it loses on the
+  exposure's own shape.* A dim line after the report — `init`'s own "Re-run
+  `attest init` after upgrading", moved to where it is actionable — needs no
+  code, no roster entry and no section in two languages. It is also invisible
+  under `--json`, and the drift in that report was found by a reader writing a
+  script against `dist/`. A detector a machine cannot read reproduces the
+  invisibility it exists to remove.
+
+  **Built under `[1.1.0]` on 2026-09-02, and the entry stays here because
+  what was built is not what it names.** The priced form shipped exactly as
+  priced — `check`, INFO, one code, silent on an absent file, document rather
+  than bytes — as `ATX-89`, `ATX-90` and `ATX-91`. The re-measure corrected none
+  of the three answers, which is worth recording against the two cases in `How
+  an entry is re-measured` where it corrected an entry outright.
+  *What the build added that the pricing did not have is the argument the
+  approver gave, and it is better than the one written here.* This entry argues
+  the level from the negative — a gate is a chore, so do not gate. The reason
+  actually adopted is positive and is an **asymmetry of obligation**: keeping
+  this document current is Attest's obligation, because Attest is what changes
+  it, and taking the update is nobody else's. A finding whose subject the reader
+  owes nothing about is exactly the finding that may only inform. That reaches
+  the same level by a route that does not depend on calling anything a chore,
+  and it is what `ATX-89`'s rationale carries.
+  *What is left of this entry is the gate alone, and it is unchanged.* A notice
+  is not a weaker gate, it is a different artifact: it can be ignored, and by a
+  CI-only adopter who never reads `check` output it certainly will be. That is
+  the cost of the choice rather than an oversight — the trade taken was "never
+  blocks anyone" against "guaranteed to be seen". The thing that would move the
+  gate is what it always was, and the notice does not supply it: an adopter who
+  followed a stale instruction and paid for it. Nobody has.
+
   The rejection, kept as it was written:
 
   `render --check` is the obvious precedent and is the opposite case. A rendering
@@ -7219,46 +7551,230 @@ have to gather again.
   cost somebody a round trip. Without the first, this trades a derivable field for
   an underivable duplicate.
 
-- **A Stop hook that will not let an agent end a turn while `check self` is red.**
-  From the same read: `nostics` ships `hooks/consume-diagnostic.mjs`, a Claude
-  Code Stop hook that reads the log its dev-server collector writes and returns
-  `{"decision": "block"}` with the diagnostic as the reason, so the agent keeps
-  working rather than stopping on a red application. Three details there are the
-  design and not the plumbing, and are the transferable part: it guards on
-  `stop_hook_active` so a blocked stop cannot loop; it feeds back **one**
-  diagnostic per turn rather than the whole log; and when it consumes one it drops
-  every other entry sharing that code and file, so a fault at twenty call sites is
-  one round trip and not twenty.
-  *Why the shape fits this repository specifically.* `CLAUDE.md`'s "Before
-  committing" and the whole of `pre-commit-check` are discipline: nothing runs
-  `check self` unless a person or an agent remembers to, and the repeat-grouping
-  that hook does by hand is something `formatIssues` already computes. `.claude/`
-  here holds five skills, no hooks and no `settings.json`, so this would be the
-  first of its kind rather than an extension of anything.
-  *Measured cost, 2026-09-01.* `node bin/attest.js check self --json` runs in
-  **1.04–1.57 s** over three consecutive runs; `status self --json` in 0.78 s.
-  That is paid at the end of every turn, which is the number to weigh rather than
-  the wall clock of a single invocation.
-  *What blocks it is the stale-`dist/` trap, and a hook is the worst place to meet
-  it.* `bin/attest.js` loads `dist/`, not `src/` — the Gotcha this repository
-  already keeps — so a Stop hook reports on the last build. After a `src/` edit it
-  blocks on a diagnostic the working tree has already fixed, or clears while the
-  tree is broken, and in both directions it is a gate arguing about a state nobody
-  is in. Either the hook builds first, adding seconds to every turn, or it runs the
-  engine from source and stops being the thing an adopter could copy.
-  *And the larger question it sits in front of.* If this is right here it is right
-  for an adopter, which makes it a question about what `attest init` writes rather
-  than about `.claude/` in this repository. A hook that can block an agent's stop
-  is a much larger commitment than a document, and the rejection quoted in full
-  inside the `init --check` entry in this section — the gate on the installed
-  skill's freshness — turned on exactly the distinction it needs:
-  a signal about work the reader actually did, against a chore the tool imposes. A
-  block on `check` is the first kind, which is the argument for it, and that
-  argument should be made explicitly rather than arrived at by shipping.
-  *What would move it.* Running it here, unshipped and repo-local, for a few weeks,
-  and counting how often it blocks on something that would otherwise have been
-  committed. If that count is zero the discipline was already working and the hook
-  is overhead; if it is not, the number is the case for `init` writing one.
+- **An outward-facing form of the judgement tables, so an adopter can run this
+  counter-pressure on their own registry.**
+  `tests/intent-rule-candidates.spec.ts` maintains four hand-judged tables over
+  this repo's registry and enforces their completeness. Design §11 records the
+  properties they defend and that nothing enforces any of them; what the tables
+  add is a counter-pressure holding for **one** registry whose authors agreed to
+  maintain it. An adopter got none of it, and the reason was sharper
+  than "nobody wrote it for them": the package exported `requirement`,
+  `scenario`, `defineRequirements`, `delta` and types, and nothing else.
+  `parseSpecs`, `findFiles` and `readRegistrySource` were internal, so an
+  adopter **could not enumerate their own scenario names** — the table's central
+  rot check, that a claimed scenario is one a spec really declares, was not
+  merely unwritten downstream but unreachable. **That half shipped under
+  `[0.9.2]` as `@am_shork/attest/inspect`** and is recorded at the foot of
+  this entry; what stays here is the schema built on top of it, and the three
+  blockers below are untouched by the export.
+  *The shape that makes it shippable at all is a split, not a feature.* The
+  engine can compute which ids exist, which statements match the universal
+  quantifier regex, which params are list-valued, and whether a named scenario
+  is declared — all four already, all statically. It cannot compute how many
+  obligations a requirement carries, what a quantifier ranges over, or whether a
+  scenario iterates a param. So the shippable object is **the enforcement, never
+  the judgement**: an opt-in `*.judge.ts` read by the same static reader and
+  under the same literal-only rule the registry is (it is metadata about
+  requirements under review, so `check` must execute nothing to read it), whose
+  contents are entirely the adopter's. Opting in is creating the file; once it
+  exists, `requirement-unjudged`, `orphan-judgement`, `unbound-site` and
+  `quantifier-unjudged` make it complete and keep it from rotting. The
+  asymmetry is the only way this can exist without Attest asserting a ground
+  truth it refuses to compute (§0), and it is the same asymmetry `never-red`
+  already runs on: the archive gate would owe judgement only for ids a change
+  ADDs, so a brownfield adoption is not blocked wholesale.
+  *One part of the existing table cannot ship in any form.* `DOMAINS.pin` comes
+  in two kinds — a scenario name, checkable against the AST, and a **source-text
+  fragment** grepped out of the spec file. The second is asserting on the
+  wording of somebody's test, which is the `Issue.message` category error under
+  another name. Only the scenario-name kind is exportable, and what that costs
+  is real: the grep is what caught a deleted pin that `toContain` had passed.
+  *Why no detector ships with it, and this is the part that is already
+  measured.* Three rule families were built and scored against the whole corpus
+  (104 entries as of 1.1.0, counting a fixture id once per registry file) before any was
+  written into the engine, which is the order `divergent-param` was originally
+  designed in the wrong way round. Every figure below is a quotation of the
+  suite's inline snapshots; the snapshot is the fresh copy, and this paragraph
+  is only ever as fresh as its last edit.
+  **(1) `compound-requirement`** — 42 requirements carry more than one
+  obligation, it flags 18, is **wrong about none**, and misses 24. Never wrong
+  and nearly blind, and the 24 are the form the coverage incentive actually
+  rewards: extra clauses under a single keyword. **(2) The widened variant** —
+  36 correct, but 14 wrong and still 6 missed, and it is silenced by deleting an
+  "and". A rule whose cheapest fix degrades the artifact it protects does not
+  ship, and its precision falls as the registry grows. **(3) `divergent-param`**
+  — 9 divergences on this repo, **all 9 judged wrong**, zero true positives ever
+  recorded. The `code` group now spans 22 ids, and the failure is structural
+  rather than a matter of naming: the key is built by discarding the evidence of
+  relatedness, so the one genuinely paired divergence in the group is the one it
+  cannot show, and the key has churned three times under `flag` on additions
+  that changed no verdict, and once more under `code` at 1.1.0. `level` arriving
+  there as a fifth param name is the second key whose two requirements genuinely
+  *are* related — `ATX-60` and `ATX-89` are both about the severity ladder — and
+  the rule still relates them by the one thing that is not the relation. A fourth candidate — the echo detector, scored at
+  half precision — belongs to the tautology-detector entry now under
+  *Considered and rejected* and is not re-quoted here, because a figure stated in two places goes stale in one. Taken together
+  these are the measured range of what a token or single-body detector over
+  prose can do here, and they are why the proposal is enforcement-only.
+  *What blocks the decision — three things.* **(1) One adapter.** This
+  repository's table is the only one that exists, and its author wrote both the
+  schema and every answer in it. By this project's own rule a second table is
+  what makes the seam real, and freezing a `Judgement` type now is deciding for
+  everyone from 34 requirements written by one person. **(2) The breaking form
+  of this was already rejected** — see *Countable obligations* below — and one
+  of its three reasons survives the separate-file shape intact: **nothing can
+  force the count to be true.** The other two do not survive, which is what is
+  new here: a separate artifact touches no `--json` field, no delta apply and no
+  `render` output, and completeness *across ids* is computable in a way
+  completeness *within* an obligation array never was. So this is a re-proposal
+  with one of three objections answered and the sharpest one standing.
+  **(3) `quantifier-unjudged` reuses a rejected detector as its trigger.**
+  Firing on the quantifier token was rejected below at 43% reach and 70% wrong;
+  the claim here is that the same regex is acceptable when it asks a question an
+  author discharges in one line (`over: 'values'`) rather than issuing a
+  verdict. That claim is untested on anyone who did not also write the regex.
+  *The half that is not blocked has shipped, under `[0.9.2]`.*
+  `@am_shork/attest/inspect` is one function answering what a project declares —
+  AST-only, no runner peer, landing on the existing static/executing boundary.
+  It ships no schema and decides nothing, which is why it could go ahead of the
+  three blockers rather than waiting on them. What it changes about this entry
+  is the *kind* of thing that is now missing: the mechanism is no longer
+  unreachable, only unwritten, so a second table is something an adopter can
+  build rather than something only this repository could.
+  *What would decide it:* one judgement table maintained by someone who did not
+  design it. If it comes back the same shape, the seam is real and the schema
+  follows; if it comes back different, `inspect` was the whole answer and the
+  schema never needs to exist. *(One came back on 2026-08-31, and the disjunction
+  above is too clean to survive it: partly the same shape, partly not, and the
+  same half is the contaminated half. The close of this entry is where that is
+  read.)*
+  **Nothing currently makes that table arrive, which is a separate problem from
+  the three blockers and the one that gates all of them.** Raised in a product
+  review of `[0.9.1]`–`[0.9.3]` on 2026-08-19. The deciding evidence is an
+  artifact only an adopter can produce, and the path to producing it is: a row in
+  the README's document table, then a 214-line page, then a hand pass over four
+  questions, then writing the two mechanical properties from a prose
+  description, then choosing to report back. Five voluntary steps with no
+  scaffold at any of them, against a decision this entry has been waiting on
+  since `[0.9.2]`. An entry blocked on evidence that no shipped surface asks for
+  is blocked indefinitely, and the wait is not itself evidence of anything.
+  *The proposal is scaffolding the mechanism while still withholding the answer,*
+  which is the same split `[0.9.2]` already made and not a retreat from it: an
+  `examples/` directory holding the completeness and rot-binding assertions with
+  **no columns** — the enumeration that forces a row, and the check that a named
+  scenario is one `inspectProject` really declares — and the judgement columns
+  left for the adopter to add. What the page withholds is this repository's four
+  columns, and that stays withheld; what it currently also withholds is the two
+  properties it names as *mechanical*, and those are the half where a copy is not
+  an echo, because their content is fixed and the fourth finding does not apply
+  to them.
+  *What blocks it.* Whether a skeleton with no columns is still a shape that
+  comes back as a copy — the page's argument is that a template makes the answer
+  return its own question, and it is untested whether an adopter reads an empty
+  frame as an invitation or as a form to fill in. And it is a second artifact
+  claiming to be runnable consumer usage of the public API, which `pre-commit-check`
+  §6 already records as the category no gate reaches: the page's three samples
+  are unasserted today, and a fourth in a directory that looks executable would
+  be worse than a fenced block, not better, unless something runs it.
+  **Built under `[0.11.0]`, and the second of those two blockers was the
+  buildable one.** `examples/judgement-table/` is in the default suite, the
+  specifier is aliased rather than relativised so the file stays copyable
+  verbatim, and both assertions were shown to fail before it was called done.
+  So the category `pre-commit-check` §6 names now has exactly one member that a
+  gate reaches, and the page's three prose samples are still not it.
+  *Two things the build found that the proposal did not contain.* A third
+  assertion — `issues` empty, before either of the other two — which is not a
+  refinement but a hole: an unread registry file and a smaller project are the
+  same value, and the two completeness directions pass over both. It was found
+  by an invalid mutation during the bite test rather than by reasoning, which is
+  `How an entry is re-measured`'s question about what a repair makes reachable,
+  arriving from the other end. And a **type-level** forcing move the runtime
+  assertion cannot make: a required field added to `Judgement` fails every
+  existing row at compile time, so the schema-shaped half of "a row cannot
+  arrive unjudged" costs one line and no engine rule. That is worth noting
+  against blocker **(1)** above, which is about freezing a `Judgement` type:
+  what shipped freezes nothing, because the type is in the adopter's copy.
+  **What is untouched is the first blocker, and it is now the only thing between
+  this entry and its evidence.** Whether an empty frame reads as an invitation
+  or as a form to fill in is still untested, and cannot be tested here — the
+  people who would answer it are the ones who have not arrived. What the build
+  changes is only that the five voluntary steps are now four, and the one
+  removed was the one with a fixed answer. If the next report is still nobody,
+  the scaffold was not what was missing, and that is worth knowing too.
+  **Decided 2026-08-31: build the counting rule, and not the schema.** The
+  blocker was whether an empty frame reads as an invitation or as a form to fill
+  in, it could not be tested here, and a 0.9.1 → 0.11.0 upgrade report from
+  `mine-capablanca` tested it. The answer is **invitation**, and the report names
+  the sentence that did it: not the empty `interface Judgement`, which reads as a
+  stub and sent the reporter looking for what belonged in it, but the comment
+  above it — *"It ships with no columns, and that is the finished state of this
+  file rather than a gap in it."* Declaring the absence finished is what turns a
+  blank into a question, and it is the cheapest sentence in the example.
+  *The forcing move was one the build found rather than one it proposed.* The
+  instruction to add the first column as a **required** field made all 80 rows
+  stop compiling at once, and there was then no path back to green that did not
+  go through having an opinion about all 80 — *"a form gets partially filled in;
+  a type does not"*. That is the type-level forcing move described above,
+  working on somebody who did not write it.
+  *And the frame leaks in one place, which is a defect in the example rather
+  than in the idea.* `pin` is documented as not a judgement column and is the
+  only concrete field in the interface, so the reporter's first act was to
+  populate it for all 80 rows mechanically — *"there is a field, populate it"*.
+  Defensible, since it makes rot-binding bite for 80 rows instead of none, and
+  exactly the form-filling behaviour the frame exists to prevent. Generating
+  `pin` from `inspectProject` rather than leaving a field to be typed is the fix,
+  and it belongs in the example.
+  *What does **not** follow, and the report is why it does not.* Two of the three
+  columns that came back are the same shape as two of this repository's —
+  `clauses` is `OBLIGATIONS`, `quantifier` is a flattened `QUANTIFIED` — and it
+  is tempting to read that as the seam being real. It cannot be read that way:
+  the reporter names the `attest init` workflow document as prior influence, and
+  that document discusses quantifiers and param pinning at length. So the
+  convergence says **something** transmits those two ideas, and the document is
+  at least as likely a channel as the frame. What is uncontaminated is the third
+  column, `venue`, which has no counterpart here: nine of its rows record a
+  promise held by a Playwright suite Attest's scope does not reach. A column this
+  repository could not have written came back, which is a seam behaving like one.
+  *What to build is smaller than a schema, and the three things the reporter
+  wanted and did not get are its specification.* **(1) A counting rule for
+  "obligation" precise enough that two people count the same.** The report
+  distrusts its own `clauses` column above all the others and says why: two
+  tables that count differently are not comparable, which defeats the point of
+  there being a second one. A counting rule is content that does **not** depend
+  on the adopter — the same category as the two mechanical assertions — and it is
+  currently withheld along with the columns, which is the wrong side of the
+  split. **(2) A way to bind a clause to a scenario rather than a row.**
+  Rot-binding binds a row to *a* scenario; nothing binds the sixth obligation of
+  a six-clause requirement to anything, so a six-clauses-three-scenarios row is a
+  number a reader has to notice instead of an assertion that fails. **(3)
+  Somewhere for a row to say the promise is held where Attest cannot see it.**
+  Nine `ui-node` rows and a 902-line Playwright suite, citable only in prose.
+  *So what is planned is (1) and the `pin` fix, and (2) and (3) explicitly are
+  not.* (1) is a paragraph in the example, costs no engine surface, and is the
+  one thing that makes a second table comparable to the first — without it two
+  tables are two vocabularies and the seam cannot be read either way. (2) and (3)
+  are both new schema, and blocker **(1)** of the proposal above — one adapter —
+  is not answered by a report that is the second adapter's first hour. Two hours
+  of one agent is not two adapters. **The `*.judge.ts` schema stays undecided**,
+  and when it moves it will move on a second table that somebody has maintained
+  rather than built, which is a different measurement from the one that arrived.
+  **Both are built under `[1.1.0]`, and moving here on 2026-09-01 is what
+  follows from that.** The counting rule and the anchor fix are the whole of what
+  was decided on 2026-08-31, and they are recorded there. The re-measure before
+  building corrected nothing this entry claims — the report's three asks
+  reproduce as filed — and what it added is the finding the two cases in `How an
+  entry is re-measured` would predict: the obvious implementation of "ship no
+  fields" is an empty interface, and an empty interface admits `0` and `""`, so
+  the frame would have gone on claiming an emptiness its own type did not hold.
+  *The move is the entry's own state changing, not bookkeeping.* `Planned` means
+  decided and unbuilt, and nothing left here is that: the schema, the
+  clause-to-scenario binding and the out-of-scope `venue` column are all waiting
+  on a second table somebody has maintained, which is the definition of this
+  section rather than the one above. What it costs is that `Planned` is empty
+  again — the state that moved `How an entry is re-measured` out of it, so that
+  the method would not go unreachable whenever this happened — and that is the
+  honest reading of where the project stands rather than a gap in the file:
+  nothing is currently decided and unbuilt.
 
 ## Considered and rejected
 
@@ -7270,6 +7786,68 @@ it sat between 0.2.0 and 0.1.7 for two releases, where standing still meant
 sinking one version deeper each time a release was cut above it, and a rejection
 filed under a version reads as belonging to it.
 
+### A brand palette and banner in the CLI
+
+Built, measured green on every gate, and dropped 2026-09-03 in the session that
+built it. Filed here rather than deleted, because the half that was wrong is not
+the half that looks wrong, and the next person to propose "let's put the brand
+colours in the CLI" should reach this before rebuilding it.
+
+**What it was.** `src/cli/brand.ts`: one module holding the palette behind a
+semantic interface — `pass`, `drift`, `muted`, `note`, `id`, plus the three
+marks — with `cli/report.ts` and `cli/index.ts` rewritten onto it so `chalk` was
+imported in exactly one place. Attest Green for a passing verdict, Drift Orange
+for a WARNING, Slate for every secondary line, and a four-row ASCII mark above
+`--help` on a TTY.
+
+**The deletion test passed, which is why this is worth recording.** Delete the
+module and the same seven colour decisions reappear across two files and thirty
+call sites, spelled slightly differently each time — that is not a pass-through,
+and it is the ordinary reason this repository consolidates something. The gates
+agreed: lint, both typechecks, the full suite, `check self`, `verify self` and
+`render --check` were all green, and `attest --help` through a pipe was
+byte-identical, so `self/cli-surface.spec.ts` saw nothing.
+
+**What it could not answer is who the interface is for.** A module earns its
+keep by having callers who vary across it, and this one had two callers that
+never will: there is no second theme, no `--color` flag, no second renderer, and
+nothing in the roadmap proposes one. *One adapter is a hypothetical seam.* The
+identity was consolidated at a place where nothing varies, which buys a
+re-tunability nobody has asked to use, and every colour in it is invisible to
+every test in the tree — they strip SGR before asserting, correctly, because
+`Issue.message` is prose and so is its colour. So the module's whole surface is
+unassertable: **the interface is the test surface, and this interface had none.**
+
+**Three findings survive the rejection, and they are the reason it is written
+out.** They cost a session to learn and none of them is recoverable from the
+diff, which no longer exists.
+
+- *Frost (`#E6EAF2`) can never be written by a CLI.* The guide defines it as
+  "text on Void", and a terminal's background belongs to the reader — Frost on a
+  light profile is invisible. The terminal's own foreground already plays that
+  role. The same argument retires Void, Surface and Paper: a CLI that paints its
+  own ground fights the profile the reader picked.
+- *Drift Orange cannot become the ERROR colour.* The palette has no failure
+  colour, and the guide makes Drift Orange's scarcity part of what the product
+  means — it appears when something is wrong. Spending it on every ERROR spends
+  the meaning. The terminal's red is not a placeholder for a brand colour; it is
+  the right answer.
+- *A monospace mark must be ASCII, and the reason is width, not encoding.*
+  `█`, `╱`, `╲` and `═` are all East Asian **ambiguous** width, so a CJK
+  terminal — which is where this repository is read — renders them two cells
+  wide, and mixing them with a one-cell `=` or space tears a multi-row figure
+  apart. The CLI's existing `✓`, `✗` and `●` are ambiguous too and survive it
+  only because each is alone on its line with nothing aligned under it. This
+  generalises past branding: it applies to any table, tree or rule the CLI ever
+  draws.
+
+*One thing found on the way is not a branding decision and does not belong to
+this rejection*: `chalk.dim` is SGR 2, which some profiles render at 40% opacity
+and others ignore outright, so the same secondary line is either unreadable or
+undifferentiated depending on the terminal. That is a legibility defect in
+output that ships today, and it survives this entry as a candidate on its own
+terms rather than as a reason to bring the palette back.
+
 ### A backlink index over `archive/`, recording which change introduced or renamed an id
 
 Proposed from OpenViking's `.relations.json`, restated twice on measurement, and
@@ -9002,6 +9580,47 @@ declared prefix ownership recorded above in this section — rejected on there
 being no adoption that needs it, which is the same condition this sentence
 supposes — which addresses, rather than a scorer, which ranks.
 
+### A standing gate on deprecated API usage
+
+Priced on 2026-09-02, on the sweep that retired three deprecated call sites
+under `[Unreleased]` — turning `@typescript-eslint/no-deprecated` on by hand
+over a dependency walk through Zod 3→4, Vitest 3→4 and typescript-eslint
+8.2→8.65, none of the three reachable by anything the repo runs on a commit.
+The obvious move was to promote the rule into `eslint.config.js` beside
+`no-unnecessary-condition`, itself promoted from `strictTypeChecked` on exactly
+this argument: it needs the checker, and it found real instances here.
+
+*What blocked it was not the rule, it was the reach.* `no-deprecated` is
+type-aware, so it only sees files a project includes, and the one deprecated
+site with the widest blast radius — `tseslint.config()` in `eslint.config.js`
+itself — sits in the set no project includes, along with `bin/attest.js` and
+the three `vitest*.config.ts`. Turning the rule on as-is buys a gate that
+covers `src`, `tests`, `self` and `examples` and silently *not* the files the
+tooling reads first, which is the shape this repo has been burned by twice
+already: `tests/import-boundary.spec.ts` deliberately does not use `findFiles`
+for the same reason, and its instrument guards exist because a walk that
+quietly stops reading a tree passes empty. A gate whose coverage is
+believed-wider-than-it-is is the failure this file keeps recording. Closing the
+gap meant either growing `tsconfig.typecheck.json` over the root config files —
+pulling `allowJs` into the wider project for `eslint.config.js` and
+`bin/attest.js` — or a second small project just for them, a third tsconfig in
+a repo that deliberately has two and has a comment in each explaining why.
+
+**Rejected on the denominator.** Three call sites across an entire dependency
+walk is too small to carry the cost of either tsconfig shape — permanent, on
+every file the wider project would newly admit — against a defect a hand sweep
+at upgrade time already catches. `pre-commit-check` §9 records that sweep: run
+`no-deprecated` against a throwaway project covering what
+`tsconfig.typecheck.json` does and the five files it does not, and confirm the
+scan is actually seeing them before trusting a clean result. The check still
+happens, on the cadence the defect actually arrives on, without a third
+tsconfig or `allowJs` admitted into a wider project.
+
+*Worth reopening if the count moves* — a dependency bump that turns up more
+than a handful of deprecated sites in one sweep is the signal that a hand pass
+is no longer keeping up, and it is measured the same way this entry was: read
+the `no-deprecated` output before deciding whether it needs a permanent home.
+
 ## How an entry is re-measured
 
 What the three sections above have learned about themselves, kept apart from all
@@ -9079,6 +9698,7 @@ path the repair makes reachable; it is about **everything the repair would make
 
 ## Releases
 
+[1.1.0]: https://gitlab.com/Pseudorca/attest/-/tags/v1.1.0
 [1.0.0]: https://gitlab.com/Pseudorca/attest/-/tags/v1.0.0
 [0.11.0]: https://gitlab.com/Pseudorca/attest/-/tags/v0.11.0
 [0.10.0]: https://gitlab.com/Pseudorca/attest/-/tags/v0.10.0