@erclx/aitk 1.4.0 → 1.6.0

package/claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "aitk",
   "description": "Automated governance, versioning, and discovery tools for Claude Code.",
-  "version": "1.4.0",
+  "version": "1.6.0",
   "author": {
     "name": "Eric Le",
     "url": "https://github.com/erclx"

package/claude/skills/claude-docs/REQUIREMENT.md

@@ -13,6 +13,8 @@ A decision's verification anchor has the same shape of gap in the other directio
 
 A handoff file has the same shape of gap as an unmarked outcome. A page a learning workspace produced and an operator already picked a destination for sits in gitignored scratch until something lands it, and the session that produced it is gone by the time a branch exists to carry the write. Left unfolded it reads as promoted while the destination holds nothing.
 
+The receipt half of that sweep was missing entirely. A review receipt is deleted per shipped branch and a memory-review receipt was skipped, because the exclusion protecting the checklist and audit prefixes caught a third by accident. Nothing but an operator asking collected it, and a collection that waits on someone remembering to ask is one a folder outgrows, so the skipped population grew per shipped branch and never shrank until it was most of the folder.
+
 The trigger side carries a gap of its own. "Sync the docs" names either corpus to the person saying it, so a description leaving its corpus to the opening clause alone competes with its public-facing sibling on nothing the routing field states, and the planning surface the request was about goes untouched.
 
 ## Must
@@ -26,6 +28,9 @@ The trigger side carries a gap of its own. "Sync the docs" names either corpus t
 - Retarget a closed task at the archived plan, so the reasoning behind finished work stays reachable
 - Anchor a decision entry this run writes or amends whose reasoning cites a measured number, re-reading the number against the tree before writing the marker
 - Report an anchored decision whose cited path the diff touched, since the number was read before the branch moved what it counted
+- Scan every memory-review receipt rather than the one matching this slug, since the skill that writes them runs after this one in the ship chain and a slug is unique per feature
+- Collect a memory-review receipt whose items are all decided, folding each skip into its memory entry first, since a declined item is recorded nowhere else and a promoted one is already in git
+- Leave a memory-review receipt holding a pending item, and report the count. A branch shipping is not an operator deciding what the receipt proposed.
 - Land each block of a promotion handoff at the destination its heading names, then delete the file so a later run does not fold it twice
 - Take a promotion destination as already decided, since the operator confirmed it where the page was produced
 

package/claude/skills/claude-docs/SKILL.md

@@ -215,7 +215,9 @@ Sweep reviews this session consumed, and sweep plans across the whole board. Res
 
 Every move and delete below is a shell operation, so send each as a plain single `Bash` command rather than joining a `mkdir -p` to the `mv` with `&&`, which is refused as compound from a linked worktree. The one edit inside an existing file is the `Plan:` retarget, and no verb covers it: read the task file and write it back whole with a heredoc, which the file-editing tools refuse from a linked worktree and no shell stream editor may do.
 
-**Plans.** Scan every file in `.claude/tasks/`, not only the ones this session touched. For each task file whose outcomes are now all `[x]`, check for a `Plan:` line directly under the title and parse the target.
+### Plans
+
+Scan every file in `.claude/tasks/`, not only the ones this session touched. For each task file whose outcomes are now all `[x]`, check for a `Plan:` line directly under the title and parse the target.
 
 The line carries a markdown link, so read the target out of the parentheses rather than taking the rest of the line. A task still carrying the older bare-path form parses the same way once the link is absent, so accept both. Resolve the target against `.claude/tasks/` before routing on it, which lands `../plans/x.md` and `.claude/plans/x.md` on the same file.
 
@@ -242,17 +244,30 @@ A plan can serve more than one task, and archiving on the first task to close st
 
 Write the retarget as a markdown link, `Plan: [feature-<slug>](../plans-archive/feature-<slug>.md)`, updating both halves so the text and the target stay in step. This branch is the only writer that produces a `Plan:` line nobody authored by hand, so a retarget that emits a bare path converts every task to the old form as it closes and drifts the board back to two shapes on its own.
 
-**Reviews.** Derive `<slug>` per `${CLAUDE_SKILL_DIR}/../../standards/slug.md`. Fall back to `latest` on an empty result.
+### Reviews
+
+Derive `<slug>` per `${CLAUDE_SKILL_DIR}/../../standards/slug.md`. Fall back to `latest` on an empty result.
+
+If `.claude/review/review-<slug>.md` exists, delete it. `claude-review` writes with this convention.
+
+Memory receipts sweep board-wide, like plans above and unlike the review receipt. Scan every `.claude/review/memory-review-*.md`, not only the one matching this slug. `claude-memory-review` writes its receipt after this skill has run in every ship chain, so a sweep keyed on the current slug looks for a file that does not exist yet, and no later branch looks for it either because a slug is unique per feature. Scanning the folder is what makes the sweep fire at all.
+
+For each receipt, count the H2 items still marked 📝 pending:
+
+- No pending item: fold it per the collection rule in `${CLAUDE_SKILL_DIR}/../../standards/memory.md`, then delete the receipt.
+- Any pending item: leave it and report the count. Pending items are decision state, and a branch shipping is not an operator deciding them.
 
-If `.claude/review/review-<slug>.md` exists, delete it. `claude-review` writes with this convention. Do not sweep any other `review-*.md` file.
+That standard owns what a fold writes and which entry types take one. `claude-memory-review` collects a receipt on the same rule, so neither body restates it.
 
-Do not sweep `ui-checklist-*.md` (pending human verification), `ux-audit-*.md`, or `ux-measure-*.md` (standalone deliverables).
+Do not sweep `ui-checklist-*.md` (pending human verification), `ux-audit-*.md`, or `ux-measure-*.md` (standalone deliverables), or any other `review-*.md` file.
 
 Output one line per file swept:
 
 - `📦 Archived: <path>` for a plan moved into `.claude/plans-archive/`
 - `⏭ Kept: <path>, still cited by <task-file>` for a plan another live task shares
 - `🧹 Deleted: <path>` for a swept review
+- `🧹 Deleted: <path>, folded <n> skips` for a swept memory receipt
+- `⏭ Kept: <path>, <n> items pending` for a memory receipt still holding decisions
 
 If nothing qualifies, skip this step silently.
 

package/claude/skills/claude-memory-review/REQUIREMENT.md

@@ -21,7 +21,10 @@ A pen the caller cannot face is the same gap wearing a different shape. Routing
 - Write the proposal to a receipt on disk and take no action until the user decides per item
 - Route every decision channel through the receipt, writing a decision given in chat into its item's slot before the parse reads the file, so a channel the skill advertises drains the pen rather than passing over it
 - Keep a promotion on its own commit, since a change to how the agent operates should not ride inside a feature a reviewer is vetting for something else
-- Confine the pass that runs after application to the one receipt it tested, so tidying up removes a file whose decisions are known to be resolved and leaves the pen and every untested receipt alone
+- Collect a receipt as soon as its last item resolves, rather than waiting for an operator to ask, since a collection nobody triggers is a folder that only grows
+- Fold each declined item into its memory entry before the receipt goes, because a promoted item survives in its target and in git while a decline is recorded nowhere else
+- Record that decline by rewriting the entry rather than appending to it, so the file states one current claim
+- Confine the pass that runs after application to the one receipt it tested, so tidying up removes a file whose decisions are known to be resolved and leaves every untested receipt alone
 
 ## Must not
 

package/claude/skills/claude-memory-review/SKILL.md

@@ -15,7 +15,7 @@ What an entry looks like and why a retired one is moved rather than deleted are
 | "challenge the promotes" (receipt exists)                              | Challenge | review file only             |
 | "discuss", "respond to questions"                                      | Discuss   | review file only             |
 | "apply decisions", "commit", "ship the review"                         | Apply     | tracked files + memory files |
-| "cleanup", "delete the receipt"                                        | Cleanup   | one review file              |
+| "cleanup", "delete the receipt"                                        | Cleanup   | one receipt + its skips      |
 
 If the user re-pings the skill with no new phrase and a receipt exists, default to Discuss when any `Decision:` contains `?`, otherwise Apply.
 
@@ -168,25 +168,34 @@ Apply promotion edits one at a time via `Edit`. Claude Code's tool permission di
 
 This governs the tracked surfaces a promote lands in, which sit at `pwd` and take `Edit` from anywhere. The receipt and the memory entries are main-root scratch and follow the guard instead.
 
-As each item resolves, update its status in the review file: flip the H2 emoji from 📝 to ✅ for applied, ⏭ for skipped, 📦 for retired, or 🤝 for handed off. Refresh the summary block counts at the top. Do not delete the review file. It stays as a receipt until Cleanup runs or the next Propose pass overwrites it.
+As each item resolves, update its status in the review file: flip the H2 emoji from 📝 to ✅ for applied, ⏭ for skipped, 📦 for retired, or 🤝 for handed off. Refresh the summary block counts at the top. Do not delete the file here. The sweep below decides whether it goes.
 
 **Chat shortcut:** the user replies with `all`, `none`, a comma-separated list of numbers, or `skip <nums>`. Write the matching verb into the `Decision:` slot of every item the reply names, `apply` for `all` or a bare list and `skip` for a `skip` reply, then run the parse above against the file. A reply of `none` writes nothing. A slot the reply does not name keeps its own value, so the receipt stays the source of truth and an empty slot still means take no action.
 
+### Sweep the receipt
+
+Count the items still 📝 pending once the parse above has run. Apply leaves one pending on `defer`, on empty, and on any unrecognized verb, so a receipt reaching this point may still be holding decisions.
+
+Leave the receipt in place when any remain. When none do, collect it per the collection rule in `${CLAUDE_SKILL_DIR}/../../standards/memory.md`, which owns what a fold writes and which entry types take one.
+
+`claude-docs` Step 10 sweeps the same folder on the same rule once per shipped branch, and either may reach a receipt first. Whichever does, the other finds no file and moves on.
+
 End with: `✅ Applied: <nums> | ⏭ Skipped: <nums> | 📝 Pending: <nums>`. Omit empty buckets. If anything is pending, remind the user they can refine `Decision:` lines and re-ping, run "discuss" for question items, or commit a skip with `skip <nums>` in chat.
 
 ## Cleanup phase
 
 Trigger: user says "cleanup" or "delete the receipt" after Apply has run.
 
-Cleanup removes one receipt and nothing else. Apply is the only phase that moves a memory entry out of the pen, and it does so per approved item into `.claude/.tmp/memory-archive/`. A user asking to sweep stale memories wants Propose, which classifies entries and writes a decision slot per entry.
+Cleanup folds one receipt's skips and removes that receipt, and does nothing else. It is the fallback route now that Apply and `claude-docs` Step 10 each collect a resolved receipt on their own, so it reaches a file those two left behind rather than being the only collector. Apply is still the only phase that moves a memory entry out of the pen, and it does so per approved item into `.claude/.tmp/memory-archive/`. A user asking to sweep stale memories wants Propose, which classifies entries and writes a decision slot per entry.
 
 If no `.claude/review/memory-review-*.md` exists at the main root, stop: `✅ No review receipt to clean up.` Every other refusal in this skill carries a message, and the phase reads a receipt before it does anything else.
 
 1. Read the latest `.claude/review/memory-review-*.md` at the main root and confirm Apply has run against it. If any item is still 📝 pending, stop and name the pending numbers.
-2. Delete that one file. Leave every other receipt beside it in place, because the pending test above covers the file it read and nothing has tested the rest.
-3. Leave every memory entry in place. A `Skip` decision is terminal, and applied promotions, governance handoffs, and user-type memories each stay as the review left them.
+2. Collect it per the collection rule in `${CLAUDE_SKILL_DIR}/../../standards/memory.md`, folding each ⏭ skipped item before the file goes. The fold happens wherever a receipt is collected, so this phase runs the same rule the Apply sweep does.
+3. Delete that one file. Leave every other receipt beside it in place, because the pending test above covers the file it read and nothing has tested the rest.
+4. Leave every memory entry in the pen. A skip records the decline on the entry and keeps the file, and applied promotions, governance handoffs, and user-type memories each stay as the review left them.
 
-Do not promote, rewrite, or archive a memory entry. Receipts only.
+Do not promote or archive a memory entry. The skip fold is the one rewrite this phase makes, and it records a decline on an entry that stays in the pen.
 
 ## After completion
 
@@ -195,6 +204,7 @@ Output one line per action taken in the most recent phase:
 - `✅ Promoted: .claude/memory/<memory-file> → <target>`
 - `✅ Handed off: .claude/memory/<memory-file> → governance`
 - `📦 Retired: .claude/memory/<memory-file> → .claude/.tmp/memory-archive/`
-- `🗑  Swept: .claude/review/<review-file>`
+- `🗑  Swept: .claude/review/<review-file>, folded <n> skips`
+- `⏭ Kept: .claude/review/<review-file>, <n> items pending`
 
 If the user accepted nothing, output: `✅ No changes applied.`

package/docs/agents/context-audit-checks.md

@@ -1,11 +1,11 @@
 ---
 title: Context audit checks
-description: What each non-gating check reports, the unit each checkpoint is measured in, which folders each check reaches, and what moved to the attribute tier
+description: What each non-gating check reports, the unit each checkpoint is measured in, the architecture record's length gate and claim coverage, which folders each check reaches, and what moved to the attribute tier
 ---
 
 # Context audit checks
 
-What each finding from `aitk context audit` means. The command surface, its flags, and the one gating check are in `context-audit.md`.
+What each finding from `aitk context audit` means. The command surface, its flags, and the two gating checks are in `context-audit.md`.
 
 ## Required sections
 
@@ -87,6 +87,22 @@ A rejected alternative is a back-reference in the past tense by construction, an
 
 The JSON record carries the findings per entry as `entries[].narration` and the sets as `checkpoints.narration`, which is absent under `--citations-only` where the run never loads them and null where no rule publishes both.
 
+## The architecture record
+
+Two findings read `.claude/ARCHITECTURE.md` rather than a folder, and only the first is a fact.
+
+The length check compares the record against the ceiling it derives for itself, and only a record that states its own allowances has one. No standard sets a length rule for this document, so the numbers belong to whichever record declares them. The check reads a frame allowance and an allowance per decision out of the record's own prose and puts the ceiling at the frame plus the allowance times the decision count. The JSON record carries what it read as `architecture.allowances` and the reading as `architecture.lines` against `architecture.ceiling`.
+
+A record stating no such rule is measured and reported and never gated, which is the ordinary shape of a project that wrote an architecture record and no convention about its length. Holding a pair of numbers in the toolkit and gating every project against them would fail a record on a ceiling that project never agreed to, and the framed line would credit the rule to a file that does not state it.
+
+What the derivation costs where it does apply is that the ceiling rises when a decision is added and falls for nothing, so the check passes exactly when the file grew. It gates anyway, because a record that states a limit for itself and makes it computable from a count has turned it into a fact, which is what separates it from every judgment below. A rewrite of the declaring sentence past the clauses the check reads falls back to reporting rather than to a stale ceiling, so the failure shows up in the run's own output.
+
+The coverage report classifies each decision as carrying a countable claim, a structural invariant, or neither, then reports each testable entry against whether it names a check that exists. A countable claim carries a figure a run could recompute, and an invariant quantifies over a named tree closely enough that a walk could falsify it. A check is a `scripts/**.sh` path the entry spells that is on disk, or an `aitk` invocation matching a registered audit, so coverage reads the entry rather than the tree and a claim some check happens to cover without the entry saying so reads as unchecked.
+
+Three limits are stated on every run rather than hidden. The countable signal reads digits alone, so a measured claim written in words reads as uncounted. Entries are counted by heading, and one heading holding several decisions counts once. Nothing is stored, so an entry rewritten tomorrow is classified afresh the next time the verb runs and no verdict goes stale.
+
+The report gates nothing. Deciding whether a sentence states a claim is a judgment no parser settles, so the output names candidates for a reader. This answers a different question from the verification anchors `.claude/standards/architecture.md` describes, which record that one cited number was re-read. That mechanism says whether a marked figure held, and this one says how much of the record could be checked at all.
+
 ## Which folders each check reaches
 
 The provenance, required-section, and narration checks cover `.claude/context/` alone, the reference-form check covers the split folders inside it, and length and the table finding reach every audited folder.

package/docs/agents/context-audit.md

@@ -5,7 +5,7 @@ description: Running the audit, its flags and folder scope, the exit codes, the
 
 # Context audit
 
-`aitk context audit [path]` reports the structural state of the folders following the index-plus-entry contract, meaning a generated `index.md` beside entries carrying frontmatter. It reads and reports. Fixing what it finds is separate work. What each finding means is in `context-audit-checks.md`.
+`aitk context audit [path]` reports the structural state of the folders following the index-plus-entry contract, meaning a generated `index.md` beside entries carrying frontmatter, and it measures `.claude/ARCHITECTURE.md` beside them. It reads and reports. Fixing what it finds is separate work. What each finding means is in `context-audit-checks.md`.
 
 Findings stated over every markdown file rather than over a context entry are measured by `aitk markdown audit`, described in `markdown-audit.md`. That command resolves no folder, so it reaches trees this one refuses.
 
@@ -37,7 +37,7 @@ A run where no requested name resolves refuses, whichever list it read. Naming t
 
 ## Exit codes
 
-Exit codes are `0` for a clean run, `1` for a refusal, and `2` for a gating finding. An unresolved citation gates under every mode. Length, reference form, table, provenance, and narration findings print and return `0` under every mode, because each is a judgment and failing a push on one would make the check something to route around. Narration is the weakest of the five, since whether two bullets share a subject is a call the measure approximates from structure alone, and one of the shapes it matches is the rejected alternative the standard asks an entry to keep.
+Exit codes are `0` for a clean run, `1` for a refusal, and `2` for a gating finding. An unresolved citation gates under every mode. An architecture record that states its own line allowances gates when it is past the ceiling those derive, on any run that measures it, which is every mode except `--citations-only`, and a record stating none is reported and never gated. Entry length, reference form, table, provenance, narration, and the record's claim classification print and return `0` under every mode, because each is a judgment and failing a push on one would make the check something to route around. Narration is the weakest of the five, since whether two bullets share a subject is a call the measure approximates from structure alone, and one of the shapes it matches is the rejected alternative the standard asks an entry to keep.
 
 Required-section and index findings sit between the two. Both are answerable from the file rather than weighed, so `--gate` promotes them to failing codes while a bare run leaves them advisory. The toolkit runs the bare form against itself and the widened form against the seed tree, described below.
 
@@ -47,7 +47,7 @@ Required-section and index findings sit between the two. Both are answerable fro
 
 The widened gate is correct here and wrong at the project root. A seed is authored once and read by every target, while a context entry in a live project is edited under time pressure by the people who own it. A missing section in the first is a defect shipping outward, and in the second it is a threshold worth reporting and not worth blocking a push over.
 
-Coverage follows the index-plus-entry contract, so it reaches seeded entries and the indexes beside them. Seed files sitting directly under `.claude/`, currently `ARCHITECTURE.md`, `DESIGN.md`, and `REQUIREMENTS.md`, belong to no audited folder and stay outside it.
+Coverage follows the index-plus-entry contract, so it reaches seeded entries and the indexes beside them. `DESIGN.md` and `REQUIREMENTS.md` sitting directly under `.claude/` belong to no audited folder and stay outside it, while `ARCHITECTURE.md` is measured on its own path. The seed record states no line allowance, so it is reported rather than gated, which is what a seed template showing the shape of a record should be.
 
 The stage prints the entries it measured per root and warns on a root that measured none. A root can resolve an audited folder and hold no entry in it, which `tooling/claude/seeds` does today, so a single pass line over the set would report coverage of a tree nothing opened.
 

package/docs/agents/index.md

@@ -12,7 +12,7 @@ CLI catalog and invocation rules for agents, split by command domain. Start with
 - [Capture](capture.md): Rendering committed HTML sources to PNG, what the command asserts about fonts, and why it is toolkit-only
 - [Command catalog](commands.md): Every project-level command and every domain subcommand, plus the shape each domain exposes
 - [Comments](comments.md): Comment density by language and kind, the two structural exclusions, and how the degradation sweep finds its vocabulary
-- [Context audit checks](context-audit-checks.md): What each non-gating check reports, the unit each checkpoint is measured in, which folders each check reaches, and what moved to the attribute tier
+- [Context audit checks](context-audit-checks.md): What each non-gating check reports, the unit each checkpoint is measured in, the architecture record's length gate and claim coverage, which folders each check reaches, and what moved to the attribute tier
 - [Context audit](context-audit.md): Running the audit, its flags and folder scope, the exit codes, the citation gate, and the widened gate the seed stage runs
 - [Docs](docs.md): How aitk docs resolves the toolkit's own reference surface from an install root, and how a split domain is named
 - [Indexes](indexes.md): Flags, exit codes, and JSON shape for aitk indexes regen, plus when it auto-stages what it rewrote

package/docs/agents/records.md

@@ -74,7 +74,7 @@ For the shapes each check enforces, see `.claude/standards/plan.md`, `.claude/st
 
 ## Size
 
-`aitk records size` reports what each record folder holds and how much of it is recent. It reads the nine backed folders named under Push and pull, plus `.claude/.tmp`, and it gates nothing.
+`aitk records size` reports what each record folder holds and how much of it is recent. It reads the ten backed folders named under Push and pull, plus `.claude/.tmp`, and it gates nothing.
 
 ```bash
 aitk records size
@@ -110,9 +110,9 @@ aitk records push --json
 aitk records pull
 ```
 
-The backed folders are `groundwork`, `intake`, `memory`, `plans`, `plans-archive`, `review`, `task-archive`, `tasks`, and `teach`, all under `.claude/`. They are the gitignored Claude group minus `.claude/.tmp`, which is deletable without loss, and `.claude/worktrees/`, whose contents belong to the project repository already. The list is a constant rather than configuration, matching the four folder names `validate` hardcodes.
+The backed folders are `groundwork`, `intake`, `memory`, `plans`, `plans-archive`, `review`, `review-archive`, `task-archive`, `tasks`, and `teach`, all under `.claude/`. They are the gitignored Claude group minus `.claude/.tmp`, which is deletable without loss, and `.claude/worktrees/`, whose contents belong to the project repository already. The list is a constant rather than configuration, matching the four folder names `validate` hardcodes.
 
-Records are gitignored by design, so the history lives in a second git directory at `.claude/.records.git` with `.claude/` as its work tree. Every path stays where it is, which is what a separate checkout could not do. The verbs stage the nine folders by explicit pathspec with `--force`, so nothing outside them can enter the index however the ignore rules read, and the project working tree and its index are never touched.
+Records are gitignored by design, so the history lives in a second git directory at `.claude/.records.git` with `.claude/` as its work tree. Every path stays where it is, which is what a separate checkout could not do. The verbs stage the ten folders by explicit pathspec with `--force`, so nothing outside them can enter the index however the ignore rules read, and the project working tree and its index are never touched.
 
 ### Setup
 
@@ -141,7 +141,7 @@ Point it at a private repository, and at one that is not a remote of the project
 | `local-ahead`       | `pull` found local commits that never reached the origin                             |
 | `git-failed`        | A git call failed, with its stderr in the message                                    |
 
-The two `pull` refusals exist because the directions are not symmetric. A push only adds, while a pull onto a machine holding work that never left it would discard that work. Resolve either by running `push` first, or by moving the local folders aside. A machine holding none of the nine has nothing to lose, so a restore onto a fresh checkout runs straight through.
+The two `pull` refusals exist because the directions are not symmetric. A push only adds, while a pull onto a machine holding work that never left it would discard that work. Resolve either by running `push` first, or by moving the local folders aside. A machine holding none of the ten has nothing to lose, so a restore onto a fresh checkout runs straight through.
 
 ### When it runs
 

package/docs/ai-workflow.md

@@ -93,7 +93,7 @@ An execution that picks other than the suggestion rewrites the `- Suggested:` li
 
 `aitk records validate plans` reports where a plan and that standard disagree: a filename that is not `feature-<slug>.md`, a missing required section, a files-to-touch entry naming no file, and a question carrying a suggestion with no answer slot. The same verb takes `groundwork`, `intake`, `memory`, and `teach`, which are governed the same way and were unreachable for the same reason. Nothing fires it automatically, because all five folders are gitignored and every check the repository runs reads changed files from git. It reports and never writes, since the folders are per-machine scratch with no history to recover a wrong repair from.
 
-`aitk records push` carries these folders off the disk they live on, and `aitk records pull` brings them back. Nine of them are backed: `groundwork`, `intake`, `memory`, `plans`, `plans-archive`, `review`, `task-archive`, `tasks`, and `teach`. The history lives in a second git directory at `.claude/.records.git` with `.claude/` as its work tree, so every path a task file cites stays where it is.
+`aitk records push` carries these folders off the disk they live on, and `aitk records pull` brings them back. Ten of them are backed: `groundwork`, `intake`, `memory`, `plans`, `plans-archive`, `review`, `review-archive`, `task-archive`, `tasks`, and `teach`. The history lives in a second git directory at `.claude/.records.git` with `.claude/` as its work tree, so every path a task file cites stays where it is.
 
 A person points it at a private repository once and both verbs refuse until they have, and `push` refuses when that origin is also a remote of the project, since the payload is the memory pen and the groundwork trails. `.husky/post-merge` runs the push after its archive loop, on every merge rather than only on one that closed a task. See [records](agents/records.md) for the refusal table.
 
@@ -150,6 +150,8 @@ If capture wrote at least one memory file, `claude-memory-review` then proposes
 
 Run `claude-memory-review` standalone to curate the whole pen. An entry it retires moves to `.claude/.tmp/memory-archive/` rather than being deleted, since the folder is gitignored and a bulk pass has no undo.
 
+The receipt is collected once every item on it has been decided, and it survives untouched while any item is still pending. Whichever runs first takes it: Apply collects the receipt it has resolved, and `claude-docs` scans the folder on every shipped branch for one an earlier session left behind. Before the file goes, each declined item is folded into the entry it was about, since a promotion survives in its target and in git while a decline is recorded nowhere else. `aitk standards memory` states what a fold writes and which entry types take one.
+
 ### UI polish
 
 Verify the change manually in the browser. Invoke `aitk:claude-ui-test` if you need e2e tests and a visual verification checklist for the session. For the fix itself, describe the change in Claude Code directly.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@erclx/aitk",
   "type": "module",
-  "version": "1.4.0",
+  "version": "1.6.0",
   "description": "Infrastructure and quality tooling for developer workflows",
   "license": "MIT",
   "bin": {

package/src/audits/catalog.ts

@@ -103,6 +103,61 @@ function allOf(
   return counts
 }
 
+/**
+ * Reads the architecture record's three measures, or nothing when the project
+ * carries no record.
+ *
+ * Three states rather than two, matching what the verb publishes. The key
+ * absent is a run that never opened the record, which the aggregate never asks
+ * for and so reads as a shape that moved. Null is a project entitled to carry
+ * no record, whose other context counts still stand, so it contributes no key
+ * rather than a zero that would read as a conforming record.
+ */
+function architectureCounts(
+  root: Record<string, unknown>,
+): Record<string, number> | undefined | 'absent' {
+  if (!('architecture' in root)) return undefined
+  if (root.architecture === null) return 'absent'
+
+  const record = asObject(root.architecture)
+  const decisions = record?.decisions
+  if (
+    record === undefined ||
+    !Array.isArray(decisions) ||
+    typeof record.lines !== 'number'
+  ) {
+    return undefined
+  }
+
+  // A record stating no length rule has no ceiling to be past, and reporting
+  // zero there would read as one measured and found conforming.
+  const ceiling =
+    typeof record.ceiling === 'number' ? record.ceiling : undefined
+
+  let unverifiable = 0
+  let unchecked = 0
+  for (const raw of decisions) {
+    const entry = asObject(raw)
+    const claim = entry?.claim
+    const checks = lengthOf(entry?.checks)
+    if (typeof claim !== 'string' || checks === undefined) return undefined
+
+    if (claim === 'neither') unverifiable += 1
+    else if (checks === 0) unchecked += 1
+  }
+
+  return {
+    // A boolean, counted so the aggregate reads it the way it reads every
+    // other measure. The verb gates on it separately, and the key is absent
+    // rather than zero on a record that declared no ceiling.
+    ...(ceiling !== undefined && {
+      recordOverLength: record.lines > ceiling ? 1 : 0,
+    }),
+    recordUnverifiable: unverifiable,
+    recordUnchecked: unchecked,
+  }
+}
+
 function contextCounts(record: unknown): Record<string, number> | undefined {
   const root = asObject(record)
   if (root === undefined) return undefined
@@ -117,13 +172,19 @@ function contextCounts(record: unknown): Record<string, number> | undefined {
     bareReferences += bare
   }
 
-  return allOf({
+  const architecture = architectureCounts(root)
+  if (architecture === undefined) return undefined
+
+  const counts = allOf({
     unresolvedCitations: lengthOf(asObject(root.citations)?.unresolved),
     longEntries: lengthOf(root.length),
     missingSections: lengthOf(root.missingSections),
     indexDrift: lengthOf(root.indexDrift),
     bareReferences,
   })
+
+  if (counts === undefined) return undefined
+  return architecture === 'absent' ? counts : { ...counts, ...architecture }
 }
 
 function markdownCounts(record: unknown): Record<string, number> | undefined {

package/src/commands/context.ts

@@ -15,6 +15,14 @@ import {
   REQUIRED_SECTIONS,
   type SectionFinding,
 } from '@/context/audit'
+import {
+  type ArchitectureReport,
+  coveredCount,
+  isOverLength,
+  measureArchitecture,
+  RECORD_REL,
+  testableCount,
+} from '@/context/architecture'
 import { auditCitations, type CitationReport } from '@/context/citations'
 import {
   type AuditedFolder,
@@ -65,7 +73,7 @@ export function register(program: Command): void {
   context
     .command('audit')
     .description(
-      'Report required sections, entry length, citations, reference form, catalog tables, provenance, superseded-decision narration, and index drift',
+      'Report required sections, entry length, citations, reference form, catalog tables, provenance, superseded-decision narration, index drift, and the architecture record against its own ceiling',
     )
     .argument('[path]', 'Project root, defaulting to the current directory')
     .helpOption('-h, --help', 'Show this help message')
@@ -88,11 +96,14 @@ export function register(program: Command): void {
         '  1  refused, with the reason on stderr',
         '  2  a gating finding is present',
         '',
-        'An unresolved citation always gates. --gate widens the gate to the',
-        'other two findings that are facts rather than judgments: a missing',
-        'required section and index drift. Length, reference form, table,',
-        'provenance, and narration findings are judgments and stay advisory',
-        'under both.',
+        'An unresolved citation always gates. An architecture record that',
+        'states its own line allowances gates when it is past the ceiling',
+        'those derive, on any run except --citations-only, which never',
+        'measures it. A record stating no allowance is reported and never',
+        'gated. --gate widens the gate to the other two findings that are',
+        'facts rather than judgments: a missing required section and index',
+        'drift. Entry length, reference form, table, provenance, narration,',
+        'and the record claim classification are judgments under both.',
         '',
         'Depth and bullet weight are stated over every markdown file rather',
         'than over a context entry, so `aitk markdown audit` measures them.',
@@ -205,6 +216,12 @@ async function runAudit(
   const drift = gateOnly ? [] : await auditIndexes(folders)
   const sections = gateOnly ? [] : missingSections(root, folders, entries)
   const length = gateOnly ? undefined : lengthFindings(entries)
+  // Absent under `--citations-only` and null when the project carries no
+  // record, for the reason `checkpoints.narration` states about its own two
+  // absences. A run that never looked and a project with nothing to look at
+  // are different answers, and one value for both reports the second as the
+  // first.
+  const record = gateOnly ? undefined : await measureArchitecture(root)
 
   if (gateOnly) {
     reportGate(citations)
@@ -219,6 +236,7 @@ async function runAudit(
     reportProvenance(entries, folders)
     reportNarration(entries, folders, narration)
     reportDrift(drift)
+    reportRecord(record)
     outro()
   }
 
@@ -251,6 +269,10 @@ async function runAudit(
         length,
         missingSections: sections,
         indexDrift: drift,
+        // Null says the run opened the project and found no record, which a
+        // target that never wrote one is entitled to. Absent says the run
+        // never looked, which is `--citations-only`.
+        architecture: gateOnly ? undefined : (record ?? null),
         checkpoints: {
           lines: LENGTH_CHECKPOINT,
           renderWidth: RENDER_WIDTH,
@@ -277,6 +299,7 @@ async function runAudit(
 
   const gating = isGating({
     unresolvedCitations: citations.unresolved.length,
+    recordOverLength: record !== undefined && isOverLength(record),
     sections,
     drift,
     widened,
@@ -696,6 +719,101 @@ function reportNarration(
   )
 }
 
+/** How each classification reads in the report. */
+const CLAIM_LABEL: Record<string, string> = {
+  countable: 'countable claim',
+  invariant: 'structural invariant',
+  neither: 'reasoning only',
+}
+
+/**
+ * Reports the architecture record against the ceiling it states for itself and
+ * against what a machine could test in it.
+ *
+ * The length reading is a fact and gates. Everything below it names candidates
+ * a reader adjudicates, because deciding whether a sentence states a claim is a
+ * judgment no parser settles, and a stored verdict would age the way the
+ * anchors it sits beside already do. Nothing is stored: every run reclassifies,
+ * so an entry rewritten tomorrow is read as it stands then.
+ */
+function reportRecord(report: ArchitectureReport | undefined): void {
+  logStep('Architecture record')
+
+  if (report === undefined) {
+    logInfo(
+      `Out of scope. The project carries no ${RECORD_REL}, so there was no record to measure.`,
+    )
+    return
+  }
+
+  const decisions = report.decisions.length
+  const { allowances } = report
+
+  if (allowances === undefined) {
+    logInfo(
+      `Covers ${report.rel} alone. No standard sets a length rule for it and this record states none, so its ${plural(report.lines, 'line')} across ${plural(decisions, 'decision')} are reported and nothing is gated.`,
+    )
+    logInfo(
+      'A record declaring an allowance for its frame and one a decision is measured against the ceiling those two derive. That rule belongs to whichever record writes it, never to the toolkit.',
+    )
+  } else {
+    logInfo(
+      `Covers ${report.rel} alone, which states its own allowance of ${plural(allowances.frame, 'line')} for the frame and ${allowances.perDecision} a decision.`,
+    )
+    if (isOverLength(report)) {
+      logError(
+        `${report.lines} lines against a ceiling of ${report.ceiling} from ${plural(decisions, 'decision')}`,
+      )
+    } else {
+      logInfo(
+        `${report.lines} lines against a ceiling of ${report.ceiling} from ${plural(decisions, 'decision')}.`,
+      )
+    }
+    logInfo(
+      `The ceiling rises with the decision count, so adding a decision buys ${allowances.perDecision} lines and the check passes exactly when the file grew.`,
+    )
+  }
+
+  if (decisions === 0) {
+    logWarn('The record declares no decision, so nothing was classified.')
+    return
+  }
+
+  const testable = testableCount(report)
+  const covered = coveredCount(report)
+
+  logInfo(
+    'A countable claim carries a figure a run could recompute and an invariant quantifies over a named tree a walk could falsify. Both are candidates a reader settles, and neither gates.',
+  )
+  logInfo(
+    'A figure spelled in words reads as uncounted, since a cardinal in prose is pronominal more often than measured. Entries are counted by heading, so a heading carrying several decisions counts once and the total reads low by however many it holds.',
+  )
+  const line = `${testable} of ${decisions} carry a claim a machine could test, ${covered} of which name a check that exists`
+  // A record whose every testable claim names a check has nothing to act on,
+  // and so does one carrying no testable claim at all. Warning on both is how
+  // a section becomes one nobody reads after the second run.
+  if (testable > covered) logWarn(line)
+  else logInfo(`${line}.`)
+  logInfo(
+    'Coverage reads the entry rather than the tree, so a claim some check happens to cover without the entry naming it reads as unchecked.',
+  )
+
+  pipeOutput(
+    report.decisions
+      .map((entry) => {
+        const kind = CLAIM_LABEL[entry.claim] ?? entry.claim
+        const evidence =
+          entry.figures.length > 0 ? `  ${entry.figures.join(' ')}` : ''
+        const checks =
+          entry.checks.length > 0
+            ? `\n  checked by ${entry.checks.join(', ')}`
+            : ''
+        return `${report.rel}:${entry.line}  ${kind}${evidence}\n  ${entry.heading}${checks}`
+      })
+      .join('\n'),
+  )
+}
+
 function reportDrift(drift: readonly FolderDrift[]): void {
   logStep('Index drift')
 

package/src/context/architecture.ts

@@ -0,0 +1,364 @@
+import { access, readFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { AUDITS } from '@/audits/catalog'
+import { bodyLines } from '@/markdown/scan'
+
+/**
+ * The record this measures, relative to the project root.
+ *
+ * One fixed path rather than a folder walk, because the standard governing it
+ * names one document, and the length rule this measures is stated by whichever
+ * record sits there rather than by the standard or by this file.
+ */
+export const RECORD_REL = '.claude/ARCHITECTURE.md'
+
+/**
+ * The line allowances a record states for itself, absent when it states none.
+ *
+ * No standard sets a length rule for this document, so the numbers belong to
+ * whichever record declares them rather than to the toolkit. Holding a pair in
+ * code and gating every project against it audits a target against a rule it
+ * never adopted, which is the failure `canResolveAtRoot` already answers on the
+ * folder side. A record stating no rule is measured and never gated.
+ */
+export interface Allowances {
+  readonly frame: number
+  readonly perDecision: number
+}
+
+/**
+ * What a machine could do with the entry's reasoning, which is a candidate
+ * rather than a verdict.
+ *
+ * - `countable`: carries a figure over a tree, so a run could recompute it.
+ * - `invariant`: quantifies over a named tree, so a walk could falsify it.
+ * - `neither`: says why a choice was made, which nothing tests.
+ */
+export type ClaimKind = 'countable' | 'invariant' | 'neither'
+
+export interface DecisionReport {
+  readonly heading: string
+  /** Line of the `###` heading, so a report line opens at the entry. */
+  readonly line: number
+  readonly claim: ClaimKind
+  /** The digit-spelled figures behind a `countable` reading, in order. */
+  readonly figures: readonly string[]
+  /** The first sentence behind an `invariant` reading, absent otherwise. */
+  readonly quantified?: string
+  /**
+   * Executable checks the entry names, which is the only coverage signal the
+   * record carries. Empty on an entry that names none, including one whose
+   * claim some check happens to cover without the entry saying so.
+   */
+  readonly checks: readonly string[]
+}
+
+export interface ArchitectureReport {
+  readonly rel: string
+  readonly lines: number
+  /** What the record declared, absent when it states no length rule. */
+  readonly allowances?: Allowances
+  /** The frame plus the per-decision allowance, absent alongside it. */
+  readonly ceiling?: number
+  readonly decisions: readonly DecisionReport[]
+}
+
+const DECISION_HEADING = /^###\s+(.+?)\s*$/
+const SECTION_HEADING = /^##\s+\S/
+const CODE_SPAN = /`[^`]*`/g
+/** Dropped ahead of the figure scan, since an anchor date is not a claim. */
+const ISO_DATE = /\b\d{4}-\d{2}-\d{2}\b/g
+const FIGURE = /\b\d+(?:,\d{3})*\b/g
+const SENTENCE_SPLIT = /(?<=[.])\s+/
+
+/** A code span naming a path, which is what a quantifier has to govern. */
+const PATH_SPAN = String.raw`\`[^\`]*(?:/|\.md|\.ts|\.sh|\.json)[^\`]*\``
+const QUANTIFIER = String.raw`\b(?:every|each|no|nothing|any|all|never|only)\b`
+/** Six words is the widest gap the corpus puts between the two. */
+const WINDOW = String.raw`(?:\s+\S+){0,6}?\s+`
+
+const QUANTIFIES_PATH = new RegExp(
+  `${QUANTIFIER}${WINDOW}${PATH_SPAN}|${PATH_SPAN}${WINDOW}${QUANTIFIER}`,
+  'i',
+)
+
+/** A code span naming a shell check this repository could run. */
+const SCRIPT_SPAN = /^scripts\/[\w./-]+\.sh$/
+/** A code span invoking the CLI, which may or may not name a registered audit. */
+const AITK_SPAN = /^aitk\s+(.+)$/
+
+/**
+ * The audit invocations a decision could name, spelled as a reader writes them.
+ *
+ * Read off the catalog rather than listed, so a verb renamed at its source
+ * stops matching here instead of going on matching a string nobody maintains.
+ */
+const AUDIT_INVOCATIONS: readonly string[] = AUDITS.map((audit) =>
+  audit.argv.filter((arg) => arg !== '--json').join(' '),
+)
+
+function codeSpans(text: string): string[] {
+  return (text.match(CODE_SPAN) ?? []).map((span) => span.slice(1, -1))
+}
+
+/**
+ * Names the executable checks an entry spells.
+ *
+ * A script has to exist on disk and an `aitk` invocation has to match a
+ * registered audit, because an entry naming a check that was removed is an
+ * uncovered claim wearing a covered one's words.
+ */
+async function namedChecks(root: string, body: string): Promise<string[]> {
+  const spans = [...new Set(codeSpans(body))]
+
+  const verbs = spans.filter((span) => {
+    const invocation = span.match(AITK_SPAN)?.[1]
+    return invocation !== undefined && AUDIT_INVOCATIONS.includes(invocation)
+  })
+
+  const scripts = spans.filter((span) => SCRIPT_SPAN.test(span))
+  const present = await Promise.all(
+    scripts.map((span) =>
+      access(join(root, span)).then(
+        () => true,
+        () => false,
+      ),
+    ),
+  )
+
+  return [...verbs, ...scripts.filter((_, index) => present[index])]
+}
+
+/**
+ * Reads the figures a decision carries, which is the countable-claim signal.
+ *
+ * Digits alone. A cardinal spelled in words reads as pronominal far more often
+ * than as measured in this corpus, where "the alternative and it is one nobody
+ * passes" outnumbers "eleven copies", and admitting the spelled form classified
+ * 22 of 24 entries as countable, which distinguishes nothing. The cost is that
+ * a measured claim written in words reads as uncounted, which the report says.
+ */
+function figuresIn(body: string): string[] {
+  return body.replace(ISO_DATE, ' ').replace(CODE_SPAN, ' ').match(FIGURE) ?? []
+}
+
+/**
+ * The first sentence quantifying over a named tree, or undefined.
+ *
+ * The quantifier has to sit within a short window of the path so a sentence
+ * mentioning both without relating them does not read as a claim about the
+ * tree. Both orders are matched, since the corpus writes the property before
+ * the path as readily as after it.
+ */
+function quantifiedSentence(body: string): string | undefined {
+  return body
+    .replace(ISO_DATE, ' ')
+    .split(SENTENCE_SPLIT)
+    .map((sentence) => sentence.replace(/\n/g, ' ').trim())
+    .find((sentence) => QUANTIFIES_PATH.test(sentence))
+}
+
+/**
+ * Classifies one entry, with the countable reading taking precedence.
+ *
+ * An entry carrying both a figure and a quantified tree is recomputable, which
+ * is the stronger test, and the two readings are reported as one kind because
+ * the coverage split a reader wants is testable against unverifiable rather
+ * than a per-entry inventory of every claim in it.
+ */
+export function classifyDecision(body: string): {
+  claim: ClaimKind
+  figures: string[]
+  quantified?: string
+} {
+  const figures = figuresIn(body)
+  if (figures.length > 0) return { claim: 'countable', figures }
+
+  const quantified = quantifiedSentence(body)
+  if (quantified !== undefined) {
+    return { claim: 'invariant', figures: [], quantified }
+  }
+
+  return { claim: 'neither', figures: [] }
+}
+
+interface RawDecision {
+  readonly heading: string
+  readonly line: number
+  readonly body: string
+}
+
+/**
+ * Splits the record into its `###` entries.
+ *
+ * A heading inside a fenced block is skipped, since the seed template shows the
+ * shape it asks a project to write and a template entry is not a decision.
+ *
+ * A heading carrying several decisions counts once, so the total reads low by
+ * however many it holds. The report states that rather than parsing for it,
+ * because splitting a decision from its heading needs a marker the standard
+ * does not ask a record to carry.
+ */
+export function splitDecisions(source: string): RawDecision[] {
+  const lines = bodyLines(source)
+  const decisions: RawDecision[] = []
+  let open: { heading: string; line: number; body: string[] } | undefined
+
+  for (const line of lines) {
+    if (line.fenced) {
+      open?.body.push(line.text)
+      continue
+    }
+
+    const heading = line.text.match(DECISION_HEADING)?.[1]
+    if (heading !== undefined) {
+      if (open) decisions.push({ ...open, body: open.body.join('\n') })
+      open = { heading, line: line.number, body: [] }
+      continue
+    }
+
+    // A decision runs to the next `###` or to the section that follows the
+    // decision list, so the risks below never read as the last entry's body.
+    if (SECTION_HEADING.test(line.text)) {
+      if (open) decisions.push({ ...open, body: open.body.join('\n') })
+      open = undefined
+      continue
+    }
+
+    open?.body.push(line.text)
+  }
+
+  if (open) decisions.push({ ...open, body: open.body.join('\n') })
+  return decisions
+}
+
+/** Cardinals a record spells rather than writes, which the corpus does for both. */
+const SPELLED: Record<string, number> = {
+  one: 1,
+  two: 2,
+  three: 3,
+  four: 4,
+  five: 5,
+  six: 6,
+  seven: 7,
+  eight: 8,
+  nine: 9,
+  ten: 10,
+}
+
+const CARDINAL = String.raw`(\d+|${Object.keys(SPELLED).join('|')})`
+const FRAME_CLAUSE = new RegExp(String.raw`${CARDINAL}-line frame`, 'i')
+const PER_DECISION_CLAUSE = new RegExp(
+  String.raw`${CARDINAL}\s+lines?\s+a\s+decision`,
+  'i',
+)
+
+function readCardinal(token: string | undefined): number | undefined {
+  if (token === undefined) return undefined
+  const spelled = SPELLED[token.toLowerCase()]
+  if (spelled !== undefined) return spelled
+
+  const digits = Number.parseInt(token, 10)
+  return Number.isNaN(digits) ? undefined : digits
+}
+
+/**
+ * Reads the allowances a record declares for itself, or nothing.
+ *
+ * Both clauses have to be present, because half a formula is not one. A record
+ * whose wording drifts past these clauses falls back to reporting rather than
+ * to a stale ceiling held here, so the failure is visible in the run's own
+ * output instead of gating a project on a rule nobody can point at.
+ */
+export function readAllowances(source: string): Allowances | undefined {
+  const frame = readCardinal(source.match(FRAME_CLAUSE)?.[1])
+  const perDecision = readCardinal(source.match(PER_DECISION_CLAUSE)?.[1])
+
+  if (frame === undefined || perDecision === undefined) return undefined
+  return { frame, perDecision }
+}
+
+/** Whether a read failed because nothing sits at the path. */
+function isMissing(error: unknown): boolean {
+  const code = (error as { code?: unknown }).code
+  return code === 'ENOENT' || code === 'ENOTDIR'
+}
+
+/** The ceiling the record's own formula derives from its decision count. */
+export function ceilingFor(allowances: Allowances, decisions: number): number {
+  return allowances.frame + allowances.perDecision * decisions
+}
+
+/**
+ * Measures the record, or reports nothing when the project carries none.
+ *
+ * Absent rather than empty, for the reason the sibling checks state: a project
+ * with no record and one whose record holds no decision are different answers,
+ * and a zeroed report reads as the second.
+ */
+export async function measureArchitecture(
+  root: string,
+): Promise<ArchitectureReport | undefined> {
+  const path = join(root, RECORD_REL)
+
+  let source: string
+  try {
+    source = await readFile(path, 'utf8')
+  } catch (error) {
+    // Only a record that is not there reads as absent. A record present and
+    // unreadable propagates the way every sibling reader here lets one
+    // propagate, since swallowing it reports a project with no record and the
+    // length gate passes over a file nobody opened.
+    if (!isMissing(error)) throw error
+    return undefined
+  }
+
+  const allowances = readAllowances(source)
+  const raw = splitDecisions(source)
+  const decisions = await Promise.all(
+    raw.map(async (entry) => {
+      const { claim, figures, quantified } = classifyDecision(entry.body)
+      return {
+        heading: entry.heading,
+        line: entry.line,
+        claim,
+        figures,
+        ...(quantified !== undefined && { quantified }),
+        checks: await namedChecks(root, entry.body),
+      }
+    }),
+  )
+
+  return {
+    rel: RECORD_REL,
+    lines: source.replace(/\n$/, '').split('\n').length,
+    ...(allowances !== undefined && {
+      allowances,
+      ceiling: ceilingFor(allowances, raw.length),
+    }),
+    decisions,
+  }
+}
+
+/**
+ * Whether the record is longer than the ceiling it derives for itself.
+ *
+ * False for a record declaring no allowances, which has no ceiling to be past.
+ * That is the answer rather than a gap, since the length rule is the record's
+ * own and a project that never wrote one owes nothing to it.
+ */
+export function isOverLength(report: ArchitectureReport): boolean {
+  return report.ceiling !== undefined && report.lines > report.ceiling
+}
+
+/** How many entries carry a claim a machine could test. */
+export function testableCount(report: ArchitectureReport): number {
+  return report.decisions.filter((entry) => entry.claim !== 'neither').length
+}
+
+/** How many testable entries name a check that exists. */
+export function coveredCount(report: ArchitectureReport): number {
+  return report.decisions.filter(
+    (entry) => entry.claim !== 'neither' && entry.checks.length > 0,
+  ).length
+}

package/src/context/gate.ts

@@ -4,6 +4,15 @@ import type { FolderDrift } from '@/context/index-drift'
 export interface GateInput {
   /** Cited paths that resolved to nothing, which gate under either mode. */
   readonly unresolvedCitations: number
+  /**
+   * Whether the architecture record is longer than the ceiling it derives for
+   * itself, which gates under either mode for the reason a citation does.
+   *
+   * False when the project carries no record and false under
+   * `--citations-only`, which never measures it. That mode runs one check by
+   * construction, so widening it here would gate on a reading it never took.
+   */
+  readonly recordOverLength: boolean
   readonly sections: readonly SectionFinding[]
   readonly drift: readonly FolderDrift[]
   /**
@@ -24,19 +33,24 @@ export function hasDrift(drift: readonly FolderDrift[]): boolean {
 /**
  * Whether the audit found something that should fail the caller.
  *
- * An unresolved citation is a broken pointer and gates unconditionally. The two
- * findings `--gate` adds are the ones answerable from the file itself: a
- * required section it does not declare, and an index disagreeing with its
- * folder. Length, depth, bullet, table, and provenance findings are thresholds
- * a reader weighs, so they stay out under both modes.
+ * An unresolved citation is a broken pointer and gates unconditionally, and so
+ * does a record past its own ceiling: the record states the limit for itself
+ * and derives it from a count, which makes it the one measure here that is a
+ * fact rather than a threshold a reader weighs. The two findings `--gate` adds
+ * are the ones answerable from the file itself: a required section it does not
+ * declare, and an index disagreeing with its folder. Entry length, depth,
+ * bullet, table, provenance, and the record's claim coverage are judgments, so
+ * they stay out under both modes.
  */
 export function isGating({
   unresolvedCitations,
+  recordOverLength,
   sections,
   drift,
   widened,
 }: GateInput): boolean {
   if (unresolvedCitations > 0) return true
+  if (recordOverLength) return true
   if (!widened) return false
 
   return sections.length > 0 || hasDrift(drift)

package/src/records/backup.ts

@@ -22,6 +22,7 @@ export const BACKED_FOLDERS = [
   'plans',
   'plans-archive',
   'review',
+  'review-archive',
   'task-archive',
   'tasks',
   'teach',

package/standards/memory.md

@@ -103,6 +103,19 @@ Link a related entry as `[[name]]`, where `name` is the target's filename stem w
 
 The catalog is generated from sibling frontmatter rather than authored. Never hand-edit it, since the next regeneration discards whatever was added by hand.
 
+## Collecting a review receipt
+
+A review of the pen writes a receipt recording what it proposed per entry and what was decided. The receipt is collected once every item on it has resolved, and it is held while any item is still pending, since a pending item is decision state the next round reads back.
+
+Fold the declines before the receipt goes. A promoted entry survives in its target and in git and a retired one survives in the archive, so the one thing a receipt uniquely holds is the record that a rule was considered and turned down.
+
+- Fold into the entry the item was about, and only into that entry. A decline whose proposed target was another surface still lands here.
+- Fold a `feedback` or `project` entry alone. The decline belongs in the `**Why:**` line, which is what a later reader tests the rule against.
+- Fold nothing into a `user` or `reference` entry. Its body is one sentence carrying neither marker, and such an entry is declined for having no in-repo target, which its type already states. Writing that on the entry restates the type and breaks the body shape.
+- Record the decline by rewriting the entry, never by appending to it, per the lifecycle rule above.
+
+Which surface runs the collection is project policy. More than one may, so a collector finding no receipt has been beaten to it rather than misconfigured.
+
 ## Anti-patterns
 
 - **The domain fact filed as memory.** It reads as a capture and lands in the one folder no session opens while working that domain.

package/tooling/claude/manifest.toml

@@ -8,4 +8,4 @@ runtime = ""
 scaffold = ""
 
 [gitignore]
-"# Claude" = [".claude/.tmp/", ".claude/groundwork/", ".claude/intake/", ".claude/memory/", ".claude/plans/", ".claude/plans-archive/", ".claude/review/", ".claude/task-archive/", ".claude/worktrees/", ".claude/tasks/"]
+"# Claude" = [".claude/.tmp/", ".claude/groundwork/", ".claude/intake/", ".claude/memory/", ".claude/plans/", ".claude/plans-archive/", ".claude/review/", ".claude/review-archive/", ".claude/task-archive/", ".claude/worktrees/", ".claude/tasks/"]

package/tooling/claude/reference.md

@@ -19,6 +19,7 @@ The claude stack installs the `.claude/` workflow directory into a project. Stat
 ├── settings.json      ← seeded. Project-level Claude Code config (PreToolUse and PostToolUse hooks). User-level config installed separately via `aitk claude setup`.
 ├── plans/             ← execution detail for multi-step tasks, gitignored. `feature-*.md` entries swept by claude-docs.
 ├── review/            ← scratch for claude-review and claude-ui-test output, gitignored
+├── review-archive/    ← memory-review receipts a triage took out of review/, gitignored
 ├── .tmp/              ← ephemeral scratch space, gitignored
 └── memory/            ← session facts no context entry owns, gitignored. `index.md` regenerated by a hook.
 ```
@@ -49,7 +50,7 @@ A project installed before the diagram surface became a folder still holds `.cla
 
 ## Gitignore
 
-- `# Claude`: `.claude/.tmp/`, `.claude/groundwork/`, `.claude/intake/`, `.claude/memory/`, `.claude/plans/`, `.claude/plans-archive/`, `.claude/review/`, `.claude/task-archive/`, `.claude/worktrees/`, `.claude/tasks/`
+- `# Claude`: `.claude/.tmp/`, `.claude/groundwork/`, `.claude/intake/`, `.claude/memory/`, `.claude/plans/`, `.claude/plans-archive/`, `.claude/review/`, `.claude/review-archive/`, `.claude/task-archive/`, `.claude/worktrees/`, `.claude/tasks/`
 
 ## CLI