@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.10 → 0.1.26

package/packages/repo-controls/src/config.ts

@@ -35,9 +35,15 @@ export interface StaticCheck {
  * repository whose trees are named anything else was graded against
  * enact-m5's, which is why this moved into config.
  */
-export interface CoverageConfig {
+interface CoverageConfig {
   summary: string
   produce: string
+  // The push-phase twin of `produce`: the command pre-push runs when
+  // `pre_push.coverage_produce` is armed. Kept separate because a commit-phase
+  // producer may mutate the index; the push-phase one must not (a check-mode
+  // run is the shape). Empty means "not declared", which is only a problem
+  // once the gate itself is armed.
+  producePush: string
   sourceRoots: string[]
   srcTestRatioGlobs: string[]
 }
@@ -77,6 +83,7 @@ export interface RepoControlsConfig {
   postCommit: { staticChecks: StaticCheck[] }
   prePush: {
     coverageRatchet: boolean
+    coverageProduce: boolean
     findingsRatchet: boolean
     staticChecks: StaticCheck[]
     exportLinks: string[]
@@ -132,7 +139,7 @@ branches = { protected = ["main", "integration"], prefixes = ["feat", "fix", "do
 #
 # Every gate is OFF until its key is added here: installing wires the hooks and arms
 # nothing. Opt in by adding pre_commit (static_checks, staged_coverage, doc_freshness) or the
-# remaining pre_push keys (coverage_ratchet, findings_ratchet, static_checks). README,
+# remaining pre_push keys (coverage_ratchet, coverage_produce, findings_ratchet, static_checks). README,
 # "Configuration", lists each one. Deliberately no example assignments in this comment — commented TOML
 # is indistinguishable from a real setting to find-and-replace, in an editor or a script.
 pre_push = { remote = "origin" }
@@ -162,19 +169,37 @@ const escapeRegExp = (text: string): string => text.replace(/[.*+?^${}()|[\]\\]/
  * the one root key it already owns, which needs no coordination with the other two
  * tools — the same "no tool parses another tool's table" rule the file is built on.
  */
-export const OWNED_TABLES = ['controls', 'controls.compliance'] as const
+const OWNED_TABLES = ['controls', 'controls.compliance'] as const
 
 /**
- * Locates a table's exact byte span in a shared `adl-config.toml`: from the line
- * matching `^\[<tableName>\]\s*$` to the next line starting with `[` at column 0
- * that is neither `[<tableName>]` nor a dotted sub-table `[<tableName>.*]` of it
- * (so `[controls.compliance]` through `[controls.compliance.trees]` splice as one
- * span) — except that a sub-table listed in `OWNED_TABLES` terminates the span
- * instead, so parent and child stay independently spliceable. Known limitation: a
- * hand-edited block containing a multi-line string whose content starts a line with
- * `[` would confuse this — this tool never writes such content itself.
+ * Locates the byte ranges that make up one table in a shared `adl-config.toml`.
+ *
+ * A table's ranges are every run of consecutive sections whose header is the table's
+ * own `[<tableName>]`, a dotted sub-table `[<tableName>.*]`, or an array table nested
+ * under it `[[<tableName>.*]]` (so `[controls.pre_push]` followed by
+ * `[[controls.pre_push.static_checks]]` is one range, never split). A range runs to the
+ * next line starting with `[` at column 0 that is none of those — except that a
+ * sub-table listed in `OWNED_TABLES` terminates it instead, so parent and child stay
+ * independently spliceable (`[controls.compliance]` through
+ * `[controls.compliance.trees]` is `controls.compliance`'s, not `controls`').
+ *
+ * More than one range, and no `[<tableName>]` header at all, are both normal: a file
+ * written by `adl migrate` carries `[controls.branches]` / `[[controls.pre_push.static_checks]]`
+ * and never a bare `[controls]`, and TOML lets a table's descendants be scattered
+ * around other tables. Known limitation: a hand-edited block containing a multi-line
+ * string whose content starts a line with `[` would confuse this — this tool never
+ * writes such content itself.
  */
-function findTableSpan(text: string, tableName: string): { start: number; end: number } | null {
+interface TableRanges {
+  text: string
+  lines: string[]
+  starts: number[]
+  ranges: { startLine: number; endLine: number; start: number; end: number }[]
+  /** The line index of the exact `[<tableName>]` header, or -1 when the table is only implied by descendants. */
+  headerLine: number
+}
+
+function findTableRanges(text: string, tableName: string): TableRanges {
   const starts: number[] = [0]
   for (let i = 0; i < text.length; i++) if (text[i] === '\n') starts.push(i + 1)
   const lines = text.split('\n').slice(0, starts.length)
@@ -182,7 +207,7 @@ function findTableSpan(text: string, tableName: string): { start: number; end: n
 
   const escaped = escapeRegExp(tableName)
   const headerRe = new RegExp(`^\\[${escaped}\\]\\s*$`)
-  const subTableRe = new RegExp(`^\\[${escaped}\\.`)
+  const subTableRe = new RegExp(`^\\[\\[?${escaped}\\.`)
   // A dotted sub-table that this package manages as its own independent span
   // (`[controls.compliance]` living inside `[controls]`) must TERMINATE the parent's
   // span rather than be swallowed by it. Without this, appending compliance to a repo
@@ -190,49 +215,85 @@ function findTableSpan(text: string, tableName: string): { start: number; end: n
   // the next install would read that as drift and refuse — an upgrade path that fails
   // on every already-installed repo.
   const nestedRes = OWNED_TABLES.filter((name) => name !== tableName && name.startsWith(`${tableName}.`)).map(
-    (name) => new RegExp(`^\\[${escapeRegExp(name)}\\]\\s*$|^\\[${escapeRegExp(name)}\\.`),
+    (name) => new RegExp(`^\\[\\[?${escapeRegExp(name)}(?:\\]|\\.)`),
   )
   const isSeparatelyOwned = (line: string): boolean => nestedRes.some((re) => re.test(line))
   const isSameTableLine = (line: string): boolean => (headerRe.test(line) || subTableRe.test(line)) && !isSeparatelyOwned(line)
 
-  const startLine = lines.findIndex((line) => headerRe.test(line))
-  if (startLine === -1) return null
-
-  let endLine = starts.length
-  for (let index = startLine + 1; index < starts.length; index++) {
+  const ranges: TableRanges['ranges'] = []
+  let headerLine = -1
+  const close = (startLine: number, endLine: number): void => {
+    // Trim blank lines immediately before the boundary: they separate this table from
+    // whatever follows (or end-of-file), not content the table itself owns — so appending
+    // another table afterwards never retroactively changes this table's own byte span.
+    let contentEnd = endLine
+    while (contentEnd > startLine + 1 && (lines[contentEnd - 1] ?? '').trim() === '') contentEnd--
+    ranges.push({ startLine, endLine: contentEnd, start: lineStart(startLine), end: contentEnd < starts.length ? lineStart(contentEnd) : text.length })
+  }
+  let open = -1
+  for (let index = 0; index < starts.length; index++) {
     const line = lines[index] ?? ''
-    if (/^\[/.test(line) && !isSameTableLine(line)) {
-      endLine = index
-      break
+    if (!/^\[/.test(line)) continue
+    const same = isSameTableLine(line)
+    if (same && open === -1) open = index
+    if (same && headerLine === -1 && headerRe.test(line)) headerLine = index
+    if (!same && open !== -1) {
+      close(open, index)
+      open = -1
     }
   }
-  // Trim blank lines immediately before the boundary: they separate this table from
-  // whatever follows (or end-of-file), not content the table itself owns — so appending
-  // another table afterwards never retroactively changes this table's own byte span.
-  let contentEnd = endLine
-  while (contentEnd > startLine + 1 && (lines[contentEnd - 1] ?? '').trim() === '') contentEnd--
-  return { start: lineStart(startLine), end: contentEnd < starts.length ? lineStart(contentEnd) : text.length }
+  if (open !== -1) close(open, starts.length)
+  return { text, lines, starts, ranges, headerLine }
 }
 
-/** The exact bytes of a table's span (header through its last line, including dotted sub-tables), or `null` if absent. */
+/** The exact bytes of a table's ranges (header through its last line, including dotted and array sub-tables), or `null` if absent. */
 export function extractTableSpan(text: string, tableName: string): string | null {
-  const span = findTableSpan(text, tableName)
-  return span === null ? null : text.slice(span.start, span.end)
+  const { ranges } = findTableRanges(text, tableName)
+  if (ranges.length === 0) return null
+  return ranges.map((range) => text.slice(range.start, range.end)).reduce((joined, piece) => (joined === '' || joined.endsWith('\n') ? joined + piece : `${joined}\n${piece}`), '')
 }
 
 /**
- * `text` with `addition` inserted at the END of a table's span — after its last line,
- * before whatever follows. Used to scaffold a single missing attribute into a table
- * this package did not create: every existing byte, including comments, ordering and
- * formatting, is preserved exactly, because nothing is parsed and re-serialized.
- * Returns `text` unchanged when the table is absent.
+ * The end of the `[<tableName>]` section's OWN keys: the first sub-table header after
+ * it, or the end of its range. A key appended after a sub-table header would belong to
+ * that sub-table, so scaffolding must land before it. Comment lines sitting directly on
+ * a sub-table header stay with it, and blank separator lines stay in front of it.
+ */
+function ownKeysEnd(found: TableRanges): { offset: number; atRangeEnd: boolean } | null {
+  if (found.headerLine === -1) return null
+  const range = found.ranges.find((candidate) => candidate.startLine === found.headerLine)
+  if (range === undefined) return null
+  let sub = range.startLine + 1
+  while (sub < range.endLine && !/^\[/.test(found.lines[sub] ?? '')) sub++
+  if (sub >= range.endLine) return { offset: range.end, atRangeEnd: true }
+  let at = sub
+  while (at - 1 > range.startLine && (found.lines[at - 1] ?? '').trim().startsWith('#')) at--
+  while (at - 1 > range.startLine && (found.lines[at - 1] ?? '').trim() === '') at--
+  return { offset: found.starts[at] ?? found.text.length, atRangeEnd: false }
+}
+
+/**
+ * `text` with `addition` inserted at the END of a table's own keys — after its last
+ * key line, before its first sub-table header (or whatever follows it). Used to scaffold
+ * a single missing attribute into a table this package did not create: every existing
+ * byte, including comments, ordering and formatting, is preserved exactly, because
+ * nothing is parsed and re-serialized. When the table exists only through its
+ * descendants (no `[<tableName>]` header — what `adl migrate` writes), the attribute
+ * goes under a new `[<tableName>]` header at the end of the file, which TOML allows
+ * after the descendants. Returns `text` unchanged when the table is absent.
  */
 export function appendToTableSpan(text: string, tableName: string, addition: string): string {
-  const span = findTableSpan(text, tableName)
-  if (span === null) return text
-  const before = text.slice(0, span.end)
+  const found = findTableRanges(text, tableName)
+  if (found.ranges.length === 0) return text
+  const lead = addition.startsWith('\n') ? '' : '\n'
+  const where = ownKeysEnd(found)
+  if (where === null) {
+    const base = text.endsWith('\n') ? text : `${text}\n`
+    return `${base}\n[${tableName}]${lead}${addition}`
+  }
+  const before = text.slice(0, where.offset)
   const separator = before.endsWith('\n') ? '' : '\n'
-  return `${before}${separator}${addition}${text.slice(span.end)}`
+  return `${before}${separator}${addition}${text.slice(where.offset)}`
 }
 
 /**
@@ -244,27 +305,33 @@ export function appendToTableSpan(text: string, tableName: string, addition: str
 export const RETIRED_ATTRIBUTES = ['version'] as const
 
 /**
- * `text` with `key`'s assignment line removed from inside a table's span, along with a
- * blank line left immediately after it. Every other byte is untouched — nothing is
- * parsed and re-serialized. Returns `text` unchanged when the table or key is absent.
+ * `text` with `key`'s assignment line removed from the table's own keys (never from a
+ * sub-table or array table under it), along with a blank line left immediately after
+ * it. Every other byte is untouched — nothing is parsed and re-serialized. Returns
+ * `text` unchanged when the table or key is absent.
  */
 export function removeFromTableSpan(text: string, tableName: string, key: string): string {
-  const span = findTableSpan(text, tableName)
-  if (span === null) return text
-  const body = text.slice(span.start, span.end)
+  const found = findTableRanges(text, tableName)
+  const where = ownKeysEnd(found)
+  const range = found.ranges.find((candidate) => candidate.startLine === found.headerLine)
+  if (where === null || range === undefined) return text
+  const body = text.slice(range.start, where.offset)
   const assignment = new RegExp(`^${escapeRegExp(key)}\\s*=.*\\n(\\n)?`, 'm')
   if (!assignment.test(body)) return text
-  return text.slice(0, span.start) + body.replace(assignment, '') + text.slice(span.end)
+  return text.slice(0, range.start) + body.replace(assignment, '') + text.slice(where.offset)
 }
 
-/** `text` with a table's span removed (a no-op if there is none); other tables are untouched. */
+/** `text` with every range of a table removed (a no-op if there are none); other tables are untouched. */
 export function removeTableSpan(text: string, tableName: string): string {
-  const span = findTableSpan(text, tableName)
-  if (span === null) return text
-  let before = text.slice(0, span.start)
-  const after = text.slice(span.end)
-  if (before.endsWith('\n\n')) before = before.slice(0, -1)
-  return before + after
+  const { ranges } = findTableRanges(text, tableName)
+  let result = text
+  for (const range of [...ranges].reverse()) {
+    let before = result.slice(0, range.start)
+    const after = result.slice(range.end)
+    if (before.endsWith('\n\n')) before = before.slice(0, -1)
+    result = before + after
+  }
+  return result
 }
 
 /** The exact bytes of the `[controls]` table, or `null` if absent. */
@@ -417,7 +484,7 @@ export function parseConfig(text: string): RepoControlsConfig {
   // so "no branch policy" cannot be spelled as an empty list. Everything else is
   // optional and defaults to off.
   const preCommit = problems.optionalTable(controls, 'pre_commit', ['static_checks', 'staged_coverage', 'doc_freshness', 'compliance'])
-  const prePush = problems.table(controls, 'pre_push', ['coverage_ratchet', 'findings_ratchet', 'static_checks', 'export_links', 'remote'])
+  const prePush = problems.table(controls, 'pre_push', ['coverage_ratchet', 'coverage_produce', 'findings_ratchet', 'static_checks', 'export_links', 'remote'])
   // Optional, and every field defaults, so a repository that never writes this
   // table behaves exactly as before. `pre_push.coverage_ratchet` stays where it
   // is: that key says WHETHER the gate is armed, this table says WHAT it grades.
@@ -435,6 +502,7 @@ export function parseConfig(text: string): RepoControlsConfig {
   const coverage = problems.optionalTable(controls, 'coverage', [
     'summary',
     'produce',
+    'produce_push',
     'source_roots',
     'src_test_ratio_globs',
   ])
@@ -468,13 +536,17 @@ export function parseConfig(text: string): RepoControlsConfig {
       // Same shape as `pre_push.static_checks`; this package never interprets
       // the command and names no tool.
       staticChecks: preCommit.static_checks === undefined ? [] : parseStaticChecks(preCommit.static_checks, problems, 'pre_commit.static_checks'),
-      stagedCoverage: problems.optionalBool(preCommit, 'staged_coverage', 'pre_commit.staged_coverage', false),
-      docFreshness: problems.optionalBool(preCommit, 'doc_freshness', 'pre_commit.doc_freshness', false),
-      compliance: problems.optionalBool(preCommit, 'compliance', 'pre_commit.compliance', false),
+      stagedCoverage: problems.optionalBool(preCommit, 'staged_coverage', 'pre_commit.staged_coverage', true),
+      docFreshness: problems.optionalBool(preCommit, 'doc_freshness', 'pre_commit.doc_freshness', true),
+      compliance: problems.optionalBool(preCommit, 'compliance', 'pre_commit.compliance', true),
     },
     prePush: {
-      coverageRatchet: problems.optionalBool(prePush, 'coverage_ratchet', 'pre_push.coverage_ratchet', false),
-      findingsRatchet: problems.optionalBool(prePush, 'findings_ratchet', 'pre_push.findings_ratchet', false),
+      coverageRatchet: problems.optionalBool(prePush, 'coverage_ratchet', 'pre_push.coverage_ratchet', true),
+      // New gates opt in: the coverage measurement moved to pre-push, so a
+      // repository that never writes this key keeps measuring (or not) exactly
+      // where it did before.
+      coverageProduce: problems.optionalBool(prePush, 'coverage_produce', 'pre_push.coverage_produce', false),
+      findingsRatchet: problems.optionalBool(prePush, 'findings_ratchet', 'pre_push.findings_ratchet', true),
       staticChecks: prePush.static_checks === undefined ? [] : parseStaticChecks(prePush.static_checks, problems, 'pre_push.static_checks'),
       // Untracked paths the HEAD export needs, e.g. a dependency directory.
       // The hook used to hardcode `node_modules`, which assumed JavaScript in a
@@ -486,6 +558,7 @@ export function parseConfig(text: string): RepoControlsConfig {
     coverage: {
       summary: problems.optionalString(coverage, 'summary', 'coverage.summary', DEFAULT_COVERAGE_SUMMARY),
       produce: problems.optionalString(coverage, 'produce', 'coverage.produce', ''),
+      producePush: problems.optionalString(coverage, 'produce_push', 'coverage.produce_push', ''),
       sourceRoots: problems.optionalNames(coverage, 'source_roots', 'coverage.source_roots', []),
       srcTestRatioGlobs: problems.optionalNames(
         coverage,

package/packages/repo-controls/src/constants.ts

@@ -3,19 +3,19 @@ import { join, resolve } from 'node:path'
 
 export const TOOL = 'adl-repo-controls'
 /**
- * Never published (adl-m3-finish item 1, 2026-09-27): kept only as this
+ * Never published (2026-09-27): kept only as this
  * package's own internal identity (USAGE text, error messages, the lock
  * file's `tool` field) — none of that is a claim that `adl-repo-controls`
  * is installable. NPM_INSTALL/PACKAGE_NAME describe a registry package that
  * does not exist; do not point a user-facing "how do I get this on PATH"
  * message at them (see ADL_NPM_INSTALL below for the one that is real).
  */
-export const PACKAGE_NAME = '@amsterdamdatalabs/adl-repo-controls'
-export const NPM_INSTALL = `npm i -g ${PACKAGE_NAME}`
+const PACKAGE_NAME = '@amsterdamdatalabs/adl-repo-controls'
+const NPM_INSTALL = `npm i -g ${PACKAGE_NAME}`
 /**
  * How a repository's committed git-hook stubs actually get `adl` onto
  * PATH: this package is folded into the `adl` binary's `repo controls`
- * namespace (docs/architecture/cli-design.md §6, STATUS.md item 10) and is never itself
+ * namespace (docs/architecture/cli-design.md §6) and is never itself
  * a standalone global command. `adl` is either fleet-installed
  * (bin/reconcile's `bun-compile` manager) or, for a machine not yet pinned
  * to the fleet, this published wrapper — see
@@ -23,7 +23,7 @@ export const NPM_INSTALL = `npm i -g ${PACKAGE_NAME}`
  * packaging/npm/wrapper-bin.js.
  */
 export const ADL_NPM_INSTALL = 'npm install -g @amsterdamdatalabs/adl-agent-control'
-export const PACKAGE_ROOT = resolve(import.meta.dir, '..')
+const PACKAGE_ROOT = resolve(import.meta.dir, '..')
 export const VERSION: string = JSON.parse(readFileSync(join(PACKAGE_ROOT, 'package.json'), 'utf8')).version
 
 /** Package-owned hook implementations, flattened in commit 20ec790. */
@@ -37,16 +37,21 @@ export const BUNDLE_ROOT = join(PACKAGE_ROOT, 'scripts')
 /** Bundled Python compliance engine (a `uv`-managed project), installed alongside this package. */
 export const COMPLIANCE_ROOT = join(PACKAGE_ROOT, 'package', 'adl-compliance')
 
-// `post-checkout` added 2026-09-27 (adl-m3-items item 2): the only backstop
+// `post-checkout` added 2026-09-27: the only backstop
 // for the repo's worktree-count limit (see `MAX_WORKTREES` below and
 // `worktree-guard.ts`) that runs regardless of which agent host or shell path
 // created the worktree — see that file's header for why git has no
 // pre-worktree hook and `post-checkout` is the earliest hook a `git worktree
 // add` actually triggers.
-export const HOOK_NAMES = ['pre-commit', 'commit-msg', 'pre-push', 'post-commit', 'post-checkout'] as const
+//
+// `post-merge` added 2026-10-01 with Git LFS chaining: git-lfs installs
+// pre-push, post-checkout, post-commit and post-merge, and none of them runs under
+// `core.hooksPath=.workflows/hooks` unless the projected hook calls it
+// (scripts/hooks/lib/lfs.sh). post-merge has no other job.
+export const HOOK_NAMES = ['pre-commit', 'commit-msg', 'pre-push', 'post-commit', 'post-checkout', 'post-merge'] as const
 export type HookName = (typeof HOOK_NAMES)[number]
 
-export { MAX_WORKTREES } from './worktree-limit.ts'
+
 
 // Repository-relative paths written into target repositories.
 export const HOOKS_PATH = '.workflows/hooks'
@@ -59,8 +64,6 @@ export const WORKFLOWS_ROOT = '.workflows'
 
 /** The standalone promoter, deployed so CI needs nothing on PATH. */
 export const PROMOTE_REL = '.workflows/promote.ts'
-/** The standalone integration PR auto-complete helper. */
-export const AUTO_COMPLETE_REL = '.workflows/scripts/enable-integration-auto-complete.mjs'
 /** The standalone immutable package-version allocator for integration CI. */
 export const VERSION_BUMP_REL = '.workflows/version-bump.sh'
 /** The standalone CI stage-2 guard: a PR branch must contain integration's tip and be at its version + 1 patch. */
@@ -68,12 +71,6 @@ export const RECONCILE_GUARD_REL = '.workflows/reconcile-guard.sh'
 
 export const MANAGED_ASSETS = [
   { rel: PROMOTE_REL, source: join(PACKAGE_ROOT, 'assets', 'promote.ts'), mode: 0o755, doctorId: 'promote' },
-  {
-    rel: AUTO_COMPLETE_REL,
-    source: join(PACKAGE_ROOT, 'assets', 'enable-integration-auto-complete.mjs'),
-    mode: 0o755,
-    doctorId: 'integration-auto-complete',
-  },
   {
     rel: VERSION_BUMP_REL,
     source: join(PACKAGE_ROOT, 'assets', 'version-bump.sh'),
@@ -91,15 +88,4 @@ export const MANAGED_ASSETS = [
 export const CONFIG_REL = 'adl-config.toml'
 export const LOCK_REL = '.workflows/repo-controls.lock.json'
 export const GITIGNORE_REL = '.gitignore'
-/**
- * Legacy, pre-hard-cut repository-local log root (owner-qualified filenames
- * prevented collisions there). Nothing writes here any more: git-hook logs
- * moved to the shared `.adl/logs/` JSON-Lines format (Tarun, 2026-09-27,
- * docs/architecture/cli-design.md §5a — see `hook-log.ts`). Kept only so existing evidence
- * in an already-installed repository can still be named and quarantined in
- * place (`install.ts`'s `LEGACY_LOG_QUARANTINES`, `gitignore-block.ts`);
- * never read or written by this package.
- */
-export const LOGS_ROOT_REL = '.enact/logs'
-
 export const INSTALL_HINT = `run: ${TOOL} install --repo .`

package/packages/repo-controls/src/coverage-ratchet.ts

@@ -24,17 +24,17 @@
  * was the package claiming a surface that is not its own.
  */
 
-export interface MetricSummary {
+interface MetricSummary {
   total: number
   covered: number
   skipped?: number
   pct: number
 }
 
-export type CoverageMetric = 'lines' | 'statements' | 'functions' | 'branches'
-export const COVERAGE_METRICS: readonly CoverageMetric[] = ['lines', 'statements', 'functions', 'branches']
+type CoverageMetric = 'lines' | 'statements' | 'functions' | 'branches'
+const COVERAGE_METRICS: readonly CoverageMetric[] = ['lines', 'statements', 'functions', 'branches']
 
-export type FileSummary = Record<CoverageMetric, MetricSummary>
+type FileSummary = Record<CoverageMetric, MetricSummary>
 
 /**
  * A summary is a map of repo-relative path -> per-file metrics, plus two

package/packages/repo-controls/src/doctor.ts

@@ -112,8 +112,8 @@ export function doctor(repoArg: string, env: Env, options: string | DoctorOption
   const bun = which('bun', env)
   add('bun', bun ? null : 'bun not found on PATH (the bundled enact-m5 scripts run with bun)', `bun at ${bun}`)
   // Checks for `adl`, not TOOL ("adl-repo-controls"): the installed git-hook
-  // stubs exec `adl repo controls hook <name>` (adl-m3-finish item 1,
-  // 2026-09-27 — see install.ts's `stubText`), never a standalone
+  // stubs exec `adl repo controls hook <name>` (2026-09-27 —
+  // see install.ts's `stubText`), never a standalone
   // `adl-repo-controls` binary, which is not published and never on PATH by
   // design. TOOL stays this package's own internal identity (USAGE text,
   // the lock file's `tool` field) — a different thing from what a repo's
@@ -154,37 +154,64 @@ export function doctor(repoArg: string, env: Env, options: string | DoctorOption
     )
     // The path the pre-push ratchet grades, not a default: a repository that
     // declares `[controls.coverage].summary` elsewhere was probed at the wrong
-    // file and passed with its real summary missing.
+    // file and passed with its real summary missing. The gate has a safety
+    // gate: with no summary on either side of the index, the step is a no-op
+    // (see hook.ts), so this is informational rather than blocking.
     const coverageSummaryExists = existsSync(join(repo, config.coverage.summary))
     add(
       'coverage-summary',
       config.prePush.coverageRatchet && !coverageSummaryExists
-        ? `pre_push.coverage_ratchet is enabled but ${config.coverage.summary} does not exist — the first push will be rejected until it does; commit a baseline or set pre_push.coverage_ratchet = false`
+        ? `pre_push.coverage_ratchet is enabled but ${config.coverage.summary} does not exist — the gate is a no-op until a baseline lands; commit one or set pre_push.coverage_ratchet = false`
         : null,
       `${config.coverage.summary} is present or the ratchet is disabled`,
+      'warn',
+    )
+    // Same shape: `coverage_produce` defaults OFF, but armed with no declared
+    // `[controls.coverage].produce_push` it is NOT a no-op — the push gate
+    // fails loud (a step that measures nothing is not a pass), so doctor names
+    // the misconfiguration before the first push does.
+    add(
+      'coverage-produce',
+      config.prePush.coverageProduce && config.coverage.producePush.trim() === ''
+        ? 'pre_push.coverage_produce is enabled but [controls.coverage].produce_push declares no command — the push gate fails every push until one is declared; add produce_push or set pre_push.coverage_produce = false'
+        : null,
+      'pre_push.coverage_produce is disabled or [controls.coverage].produce_push is declared',
+      'warn',
     )
-    // Opt-in, like coverage_ratchet: silent when findings_ratchet is unset, so
-    // a repo with no lint tooling at all (enact-repo-controls-m5,
-    // enact-extensions, enact-vps-m5) is never asked for a floor it has no
-    // use for.
+    // Same shape: `findings_ratchet` defaults ON but is a no-op when the floor
+    // file is absent. A repo with no lint tooling at all is never asked for a
+    // floor it has no use for.
     const findingsFloorExists = existsSync(join(repo, config.findings.floor))
     add(
       'findings-floor',
       config.prePush.findingsRatchet && !findingsFloorExists
-        ? `pre_push.findings_ratchet is enabled but ${config.findings.floor} does not exist — the first push will be rejected until it does; commit a floor or set pre_push.findings_ratchet = false`
+        ? `pre_push.findings_ratchet is enabled but ${config.findings.floor} does not exist — the gate is a no-op until a floor lands; commit one or set pre_push.findings_ratchet = false`
         : null,
       `${config.findings.floor} is present or the ratchet is disabled`,
+      'warn',
     )
-    // A floor on its own measures nothing. The gate refuses to run with an
-    // empty counter list rather than passing every push, so say it here
-    // instead of letting someone find out when a push is rejected.
-    add(
-      'findings-counters',
-      config.prePush.findingsRatchet && Object.keys(config.findings.counters).length === 0
-        ? 'pre_push.findings_ratchet is enabled but [controls.findings.counters] declares none — a ratchet with nothing to measure grades nothing, so the push is rejected; declare at least one counter or set pre_push.findings_ratchet = false'
-        : null,
-      'at least one findings counter is declared, or the ratchet is disabled',
-    )
+    // A floor on its own measures nothing. With the safety gate in hook.ts
+    // (counters empty + no floor → no-op), this is informational when the
+    // floor is missing; it stays a hard error only when a floor IS committed
+    // but no counter is declared to drive it (the runtime hard-fails too:
+    // `findingsRatchetReport` returns 1 when counters is empty).
+    if (config.prePush.findingsRatchet && findingsFloorExists && Object.keys(config.findings.counters).length === 0) {
+      add(
+        'findings-counters',
+        'pre_push.findings_ratchet is enabled and a floor is committed but [controls.findings.counters] declares none — a ratchet with nothing to measure grades nothing, so the push is rejected; declare at least one counter or set pre_push.findings_ratchet = false',
+        '',
+        'fail',
+      )
+    } else if (config.prePush.findingsRatchet && Object.keys(config.findings.counters).length === 0) {
+      add(
+        'findings-counters',
+        'pre_push.findings_ratchet is enabled but [controls.findings.counters] declares none — the gate is a no-op until a counter is declared',
+        'at least one findings counter is declared, or the ratchet is disabled',
+        'warn',
+      )
+    } else {
+      add('findings-counters', null, 'at least one findings counter is declared, or the ratchet is disabled')
+    }
     // A release declaration is a claim that this repository promotes through a
     // PR. That claim is only armed when the remote branch policies are proved
     // here. Repositories with no release declaration remain outside this

package/packages/repo-controls/src/gitignore-block.ts

@@ -1,12 +1,11 @@
 // One marker-bounded block, written into a target repository's root
 // `.gitignore` by `install()`, listing every repository-local directory the
-// adl process (repo-controls itself, plus the sibling tools it enrolls a
-// repository into: agent-hooks' `lean-ctx` runtime, the `adl` CLI's own
-// logger, and the `.scratchpad/` convention every agent surface follows) is
+// adl process (repo-controls itself, the `adl` CLI's own logger, and the
+// `.scratchpad/` convention every agent surface follows) is
 // known to create there. Before this module the only programmatic coverage
 // was two individually-appended lines (`GITIGNORE_LINES`, retired) plus a
 // data-dependent legacy-quarantine reconciliation; everything else
-// (`.scratchpad/`, `.agents/lean-ctx/*`, `.adl/`) accumulated by hand into
+// (`.scratchpad/`, `.adl/`) accumulated by hand into
 // this monorepo's own root `.gitignore` over time and was never shipped to a
 // repository that only runs `install`. This is the single source of truth
 // for that list, and the one mechanism that writes or checks it — see
@@ -15,8 +14,7 @@
 //
 // Evidence for each entry, gathered 2026-09-27 by reading this monorepo's
 // own source (not guessed):
-//   - `/.enact/logs/`      — pre-hard-cut evidence only (constants.ts
-//                            `LOGS_ROOT_REL`). Neither repo-controls' git
+//   - `/.enact/logs/`      — pre-hard-cut evidence only. Neither repo-controls' git
 //                            hooks (`src/hook-log.ts`, 2026-09-27) nor
 //                            agent-hooks' own hook log write here any more —
 //                            both moved to `.adl/logs/` JSON-Lines files
@@ -40,23 +38,6 @@
 //                            root's session/tool-call log; docs/architecture/cli-design.md
 //                            §5a). Whole `.adl/` dir ignored, matching this
 //                            monorepo's own hand-authored line.
-//   - `/.agents/lean-ctx/{data,state,cache}/`
-//                          — packages/agent-hooks/src/lean-ctx/env.ts:
-//                            `leanCtxEnv` points the `lean-ctx` binary's
-//                            data/state/cache dirs under
-//                            `<repo>/<DEFAULT_LEAN_CTX_DIR>/{data,state,cache}`.
-//                            `config/` is deliberately NOT listed: this
-//                            monorepo's own `.agents/lean-ctx/config/lean-ctx/
-//                            *.toml` is git-tracked (confirmed via
-//                            `git ls-files .agents`), so it is committed
-//                            configuration, not generated state. A repository
-//                            whose `adl-config.toml` overrides
-//                            `[hooks] lean_ctx_dir` away from the default is
-//                            a known gap this static list does not cover —
-//                            repo-controls does not depend on agent-hooks, so
-//                            it cannot resolve that override at install time
-//                            without introducing a new cross-package
-//                            dependency nobody asked for.
 //   - `/.scratchpad/`, `packages/*/.scratchpad/`
 //                          — not created by any single tool's code, but
 //                            mandated by the global agent convention (every
@@ -112,11 +93,6 @@ export const GITIGNORE_BLOCK_LINES: readonly string[] = [
   "# adl CLI: repo-root session/tool-call logs (docs/architecture/cli-design.md §5a)",
   '/.adl/',
   '',
-  '# agent-hooks: lean-ctx per-repo runtime state (config/ subtree is committed)',
-  '/.agents/lean-ctx/data/',
-  '/.agents/lean-ctx/state/',
-  '/.agents/lean-ctx/cache/',
-  '',
   '# adl process convention: scratch and throwaway work, never committed',
   '/.scratchpad/',
   'packages/*/.scratchpad/',
@@ -224,7 +200,7 @@ export function removeGitignoreBlock(text: string): string {
   return joinText(next, nl)
 }
 
-export interface GitignoreBlockFinding {
+interface GitignoreBlockFinding {
   /** Same id `doctor()` uses for this surface (`gitignore`). */
   readonly id: string
   readonly message: string

package/packages/repo-controls/src/hook-log.ts

@@ -19,8 +19,7 @@
  * `.adl/logs/hooks-deny.log` (FAIL rows only — shared with agent-hooks' own
  * PreToolUse denies, so a human `git commit` denial and an agent's blocked
  * shell command land in one timeline). `.enact/logs/` is a hard cut: this
- * module never reads or writes it; whatever evidence is already there (see
- * `constants.ts`'s `LOGS_ROOT_REL`) is left exactly where it is.
+ * module never reads or writes it; whatever evidence is already there is left exactly where it is.
  *
  * Field mapping onto `LogEntryInput` (`../../agent-hooks/src/log/writer.ts`)
  * — the old CSV's single `git:<hook>` label now lands in the schema's real