@event4u/agent-config 10.1.0 → 10.3.0

package/docs/guidelines/agent-infra/active-remediation-mechanics.md

@@ -22,10 +22,64 @@ Under those constraints the fix is auditable in the same diff and is *not* scope
 
 Bigger, or diverges from the task → do **not** refactor inline, do **not** interrupt the flow. Note the site (file:line + the issue). Surface the batch as **one** numbered-options prompt (per `user-interaction`, one recommendation line) **after the task is delivered** — or mid-work only when the flow makes it natural. Each option must carry a real trade-off (`no-cheap-questions`). Refactor only on an explicit yes, as a separate scoped change (`scope-control`, `downstream-changes`).
 
+#### Option anatomy — a pickable fix, not a yes/no
+
+The user should be able to answer with one number and get a change they can predict. Each numbered option therefore names four things, in a line or two:
+
+1. **What changes** — the concrete edit, in the vocabulary of the code ("replace the three `array()` literals with `[]`", not "clean up the file").
+2. **Where** — file, or the group of files if the option covers a batch.
+3. **How large** — line count or an honest size class, so the user can weigh it without opening the diff.
+4. **What it costs** — the risk, the review burden, or the reason it was not simply done inline.
+
+Group findings by **fix shape**, never one option per finding: seven lint errors that are three `no-unused-vars`, three `prefer-const` and one genuine type hole are three options, not seven. The final option is always an explicit **leave it as is** — its absence is what turns a menu into pressure. One recommendation line under the block names your pick (`user-interaction` Iron Law 1).
+
+#### Carry-over — undecided is not finished
+
+An item the user has not answered stays live: raise it once more at the next natural task boundary, in the same batched form. Two bounds keep that from becoming nagging:
+
+- **A decline is terminal.** An explicit "leave it" / "ignore" closes the item for the task; re-raising it is the re-ask `scope-control` § Decline = silence forbids.
+- **Once per boundary, not once per reply.** The batch is a task-close artifact. Repeating it between steps is the continuation prompt `no-cheap-questions` Iron Law 4 forbids.
+
 ### Propose a follow-up PR (many spots)
 
 When the issues are too many to fold in without blowing the current diff's scope, propose **one or more separate follow-up PRs** (or a roadmap under `agents/roadmaps/`, using the shared-prefix convention) so the user reviews the changes before merge. Creating the PR/roadmap is **permission-gated** — propose, get a yes, then create (`scope-control`, `commit-policy`).
 
+## Observed failing checks — classifying the red you already have
+
+The rule puts a check result you have already seen into the same ladder as a defect you read in a file. Running a command, reading seven errors, and walking past them is not scoping the work — it is looking away.
+
+The rule's two bounds, in full:
+
+- **Only output you already have.** The clause never obliges a check run; it fires on a result already in front of you. What runs locally stays the user's call — this package records "no proactive quality tools, remote CI gates only" as a standing preference — and the remote CI remains the authoritative gate. An obligation to *hunt* for red would contradict that outright; an obligation not to walk past red you already read does not.
+- **Ownership picks the tier, never the silence.** Caused by your diff → it is the task. Pre-existing and inside the fix-now bar → fix it. Pre-existing and wider, or many, or unrelated → note + ask, or a follow-up PR. There is no seventh option called "mention it in the closing summary" — that line reads as a status report and closes nothing.
+
+Classification is the whole of the work, and it runs on two axes:
+
+| | Inside the fix-now bar | Outside it |
+|---|---|---|
+| **Caused by this diff** | Fix it — it is the task, not remediation. | Fix it; a diff you cannot make green is not deliverable. Blocked → surface it as a blocker, never as a caveat. |
+| **Pre-existing** | Fix it with the work, and say in the commit body that it was pre-existing. | Note + ask with candidate fixes, or a follow-up PR when the batch is large. |
+
+Two failure shapes this table exists to name:
+
+- **"Not mine, so not mentioned."** Pre-existing red is the most common thing an agent walks past, because `minimal-safe-diff` reads like permission to ignore it. It is not: that rule bounds the *diff*, this one bounds the *silence*. The two are satisfied together by noting the finding and asking, which changes no line of code.
+- **"Mine, so quietly worked around."** A gate that goes green because the check was narrowed, an assertion loosened, or a file excluded is a defect with a green light on top. Route it through the ladder as an issue, and say what was narrowed.
+
+### Worked example — a red gate seen mid-task
+
+> `task check` fails; the lint step reports 7 errors, all pre-existing on `main`, in files this branch does not touch.
+
+Wrong, and the canonical shape of it: finish the task, and close with *"the only thing still open is the lint finding — 7 errors on main, which makes `task check` unusable as a chain"*. The sentence is accurate, the issue is named, and nothing about it is decided — the next session inherits it verbatim.
+
+Right: the errors are pre-existing, outside the fix-now bar (unrelated files, more than ~10 lines), so they are **note + ask** — after the task is delivered, one block:
+
+1. Fix the 3 `no-unused-vars` in `src/a.ts`, `src/b.ts` — ~6 lines, mechanical, ships in this PR.
+2. Fix all 7 in a separate follow-up PR — keeps this diff single-purpose; needs a branch (permission-gated).
+3. Suppress the two in generated output with a scoped ignore, fix the rest — smallest green path, adds a suppression to review.
+4. Leave as is — `task check` stays unusable as a chain until someone else picks it up.
+
+One recommendation line names the pick. Whatever the user answers, the item is closed. If they answer nothing, it is raised once at the next task boundary — not carried silently into a third session.
+
 ## Version-gated modernization
 
 Update stale idioms to the version the project **actually runs** — but only when that version is **verified**:

package/docs/guidelines/agent-infra/layered-settings.md

@@ -18,7 +18,7 @@ on user request.
 | File | Git | Scope | Owner | Example values |
 |---|---|---|---|---|
 | `.agent-project-settings.yml` | **committed** | team / repo | lead maintainer | `project.stack`, `quality.php.tools`, `memory.dogfood` |
-| `~/.event4u/agent-config/agent-settings.yml` | **n/a** (outside repo) | individual developer · cross-project | individual | `name`, `ide`, `rule_loading_tier`, `personal.bot_icon`, `personal.autonomy`, `telegraph.speak_scope` (legacy `~/.config/agent-config/agent-settings.yml` read as fallback) |
+| `~/.event4u/agent-config/agent-settings.yml` | **n/a** (outside repo) | individual developer · cross-project | individual | `name`, `ide`, `rule_loading_tier`, `personal.bot_icon`, `personal.autonomy`, `memory.cadence` (legacy `~/.config/agent-config/agent-settings.yml` read as fallback) |
 | `agents/settings/.agent-settings.yml` | **gitignored** | individual developer · this project | individual | `personal.ide`, `personal.user_name`, `subagents.max_parallel`, `onboarding.onboarded` |
 
 > **Canonical location (ADR-038):** the developer file lives in the settings
@@ -61,7 +61,6 @@ ide
 rule_loading_tier
 personal.bot_icon
 personal.autonomy
-telegraph.speak_scope
 ```
 
 Loader contract:

package/docs/guidelines/agent-infra/symptom-driven-harvest-loop.md

@@ -0,0 +1,104 @@
+# Symptom-driven harvest loop
+
+> The procedure that turns an **operator's production symptom** into a roadmap
+> this repository can execute. It is the inverse of the source-driven harvest:
+> that one starts from external material pushed onto the repo and asks what is
+> worth adopting; this one starts from a failure someone hit in production and
+> pulls external material in **per confirmed defect**.
+>
+> Body of `road-to-symptom-driven-harvest-loop` Phase 2. It lives here rather
+> than inline in [`roadmap-writing`](../../../src/skills/roadmap-writing/SKILL.md)
+> because that skill is already ~4.8k tokens — well past the 3,500-token band —
+> and a procedure needed a few times a quarter should not be paid for on every
+> roadmap-authoring turn. The skill carries the pointer.
+
+## When this applies
+
+An operator reports a failure in their own words — "runs never end", "the agent
+screenshots instead of reading the code" — rather than a defect with a file and
+a line. File it first under [`agents/tickets/symptoms/`](../../../agents/tickets/symptoms/README.md);
+that entry is what this loop resolves.
+
+Not this loop: a defect already traced to a file (that is a roadmap item), a
+feature request (roadmap or ticket), or external material arriving unprompted
+(the source-driven harvest family).
+
+## The four steps
+
+**1. Confirm against the live tree, at a pinned commit, before any external
+search.** One `file:line` per claim, and the pin recorded next to it. The
+ordering is the load-bearing part: searching externally first produces a plan
+about the ecosystem's problems rather than this tree's, and every subsequent
+round inherits that frame. A symptom that does not reproduce as a confirmed
+defect gets a `null:` block and stops here — that is a result.
+
+**2. Triangulate externally, per confirmed defect, never additively.** For each
+defect, and only for each defect: the host tool's own issue tracker, its official
+docs **fetched fresh**, and practitioner reports. Inverted form throughout — the
+defect is the anchor, the source is drawn in to explain or bound it. A source
+that matches no confirmed defect is not evidence for this roadmap; note it and
+drop it.
+
+**3. Iterate at least two further rounds, each stating its delta.** A round that
+changes nothing ends the loop early and says so. This is the step that is
+skipped under time pressure and the step that pays: on the first run of this
+loop, round 2 refuted a standing repo blocker from the official payload spec,
+imported a constraint that reshaped a whole phase from "block on invalid" to
+"command-hook, disk-fallback, block-once", and round 3 found a reopen-clause
+deadlock that was the *only* argument for reopening cancelled work at all. A
+one-pass version would have shipped a roadmap re-proposing cancelled items with
+no reopening argument and a mechanism the host would have broken.
+
+**4. Emit with a symptom→defect map and per-phase falsifiers.** The map is the
+artifact the operator can read: their words in one column, confirmed defects with
+anchors in the next, owning phase in the third. Every phase carries the
+measurement that would delete it.
+
+## Step 5, added by the first three runs: re-verify at adoption
+
+A roadmap drafted at a pin and adopted later is a **snapshot of an opinion about
+a tree that has since moved**. Before adopting, re-verify every repo claim at the
+current tip and record the deltas.
+
+This is not ceremony. Adopting the first three runs of this loop, 81 commits
+past their shared pin, re-verification found 32 of 36 claims still true — and:
+
+- one defect had **fixed itself** (a function measured as having zero production
+  callers had acquired one), which deleted a roadmap step before anyone built it;
+- one claim was **wrong at the pin too** (a count stated as six where the tree
+  binds seven), which no amount of re-reading the draft would have surfaced;
+- three anchors had **drifted** to new line numbers while their content held;
+- one cross-cutting conflict was invisible until two drafts were read together
+  (a proposed "adopt the artifact's code" duty against an existing
+  `NEVER ADOPT EXTERNAL CODE VERBATIM` Iron Law).
+
+The cheapest of those to find was the already-fixed one, and it was worth the
+most: an item prevented costs nothing to maintain.
+
+## Worked example — why round 2 is mandatory
+
+`hook_manifest.yaml` carried a comment stating that in-process subagents "inherit
+the host process env and cannot be marked per-spawn", and that comment had stood
+for months as a recorded blocker on a whole design axis. It was true about the
+mechanism it named — the env var — and false about the conclusion.
+
+Round 2 fetched the host's current payload specification, which states that tool
+events inside a subagent carry `agent_id` and `agent_type` precisely so
+subagent calls can be distinguished from main-thread ones. The env cannot mark a
+spawn; the payload already did. One fetch refuted a months-old blocker, and the
+axis it had closed reopened.
+
+The general shape: **a repo comment records what was tried, not what is
+possible.** Round 1 finds the comment and believes it, because it is this tree's
+own evidence. Only an external round can date it.
+
+## See also
+
+- [`roadmap-writing`](../../../src/skills/roadmap-writing/SKILL.md) — the authoring
+  skill this procedure extends; it owns phases, falsifiers, and the output format.
+- [`agents/tickets/symptoms/README.md`](../../../agents/tickets/symptoms/README.md) —
+  the intake convention and the two resolution blocks.
+- [`source-discovery-gate`](../../../src/rules/source-discovery-gate.md) — the
+  no-structural-claim-without-evidence rule step 1 is an application of.
+- [`external-reference-deep-dive`](../../../src/rules/external-reference-deep-dive.md) —
+  how to read a named external source properly in step 2.

package/docs/guidelines/design-antipatterns.md

@@ -36,16 +36,17 @@ The stack-specific bans live in the apply skills and link back here by entry ID.
 The objective floors are cited from the linter, never re-eyeballed by an agent.
 
 **Deterministic detector backing** (`lint_design_slop`, dependency-free, zero
-runtime token cost): a pattern-detectable subset of these entries now has a
-deterministic rule that `design-review` cites instead of re-deriving — `V1`,
-`V3`, `V6`, `C2`, `C5`, `T4`, `T6`, `T7`, `L4`, `L8`, `M2`, `M4`, `CP1`, `CP2`,
-`CP5`, plus the **Consistency Locks & layout caps** `V8`, `C6`, `L9`, `L10`
-(rule ids `slop-<id>-*`, registry in `src/scripts/design_slop_rules.ts`). These
-are **flags / rebuttable presumptions**, never hard blocks — a consumer
-`DESIGN.md` that declares the pattern as intentional suppresses the flag. The
-entries needing structural or aesthetic judgment (e.g. `T3` icon-tile stack,
-`L2` three-identical-card grid, `V2` glassmorphism intent, `C7` theme-inversion)
-stay agent-judgment-only and are deliberately **not** in the detector.
+runtime token cost): a pattern-detectable subset of these entries has a
+deterministic rule that `design-review` cites instead of re-deriving (rule ids
+`slop-<id>-*`, registry in `src/scripts/design_slop_rules.ts`). These are
+**flags / rebuttable presumptions**, never hard blocks — a consumer `DESIGN.md`
+that declares the pattern as intentional suppresses the flag.
+
+Which entries those are is **not** enumerated here. The enumeration lives in
+[§ Detector status](#detector-status) below, where every entry carries exactly
+one status and `lint_design_antipattern_parity` checks the `backed` rows against
+the registry on every run. A second hand-maintained list in this paragraph is
+precisely the drift the gate exists to prevent, so there is only one.
 
 ## Current-generation tells (generation-dated — review 2026-Q4)
 
@@ -195,6 +196,74 @@ possible but deferred until a real incident.
 
 ---
 
+## Detector status
+
+Every catalog entry above carries exactly one status. This table is the single
+enumeration of what the deterministic detector covers, and
+`src/scripts/lint_design_antipattern_parity.ts` checks it on every CI run: a
+`backed` row whose id is not in the registry fails, a registry rule whose
+`catalogId` is not `backed` here fails, and an entry missing from this table
+fails. `Q*` floors are excluded — they are owned by `lint_design_quality` and
+are listed in § Quality floors.
+
+| Status | Meaning |
+|---|---|
+| `backed` | a deterministic rule exists in `design_slop_rules.ts` |
+| `floor` | measurable and enforced, but as a `Q*` objective floor in `lint_design_quality`, not as an aesthetic tell |
+| `judgment-only` | needs structural or aesthetic judgment a text pass cannot make; `design-review` decides it |
+| `deferred` | pattern-detectable but a design-system opinion rather than a floor; deliberately not shipped |
+| `candidate` | a numeric threshold stated in the entry, not yet detected — a status that must resolve to `backed` or `judgment-only`, never persist |
+
+| Entry | Status | Note |
+|---|---|---|
+| V1 | backed | |
+| V2 | judgment-only | decoration-vs-intent is the tell; a text pass cannot read intent |
+| V3 | backed | |
+| V4 | backed | |
+| V5 | judgment-only | icon register collision is a visual-style comparison |
+| V6 | backed | |
+| V7 | judgment-only | DOM-structure nesting depth, measured too false-positive-prone |
+| V8 | backed | |
+| C1 | judgment-only | the tell is the combination *as the primary scheme*; which colours are primary is a judgment |
+| C2 | backed | |
+| C3 | backed | |
+| C4 | floor | WCAG contrast, Q1 |
+| C5 | backed | |
+| C6 | judgment-only | demoted 2026-08-13 at M1 = 4 of 32 clean files; the rule counted every saturated hue, so one accent plus a semantic danger colour reached its threshold — which is correct design, not the tell this entry describes |
+| C7 | judgment-only | theme inversion may be deliberate emphasis |
+| T1 | judgment-only | requires comparing optical weight across the document |
+| T2 | judgment-only | requires knowing which element is the hero |
+| T3 | judgment-only | icon-tile stack; DOM-structure analysis, too false-positive-prone |
+| T4 | backed | |
+| T5 | judgment-only | copy phrase-list; that mechanism is council-rejected |
+| T6 | backed | |
+| T7 | backed | |
+| T8 | deferred | typeface count is a design-system opinion, not a floor |
+| T9 | backed | |
+| T10 | backed | |
+| L1 | judgment-only | composite structural template |
+| L2 | judgment-only | three-identical-card grid; DOM-structure analysis |
+| L3 | deferred | spacing-multiple uniformity is a design-system opinion |
+| L4 | backed | |
+| L5 | floor | line length, Q3 |
+| L6 | judgment-only | requires an ancestor relation a flat text pass cannot establish |
+| L7 | judgment-only | requires a render |
+| L8 | backed | |
+| L9 | backed | |
+| L10 | backed | |
+| M1 | backed | |
+| M2 | backed | |
+| M3 | backed | |
+| M4 | backed | |
+| M5 | floor | reduced-motion alternative, Q4 |
+| CP1 | backed | |
+| CP2 | backed | |
+| CP3 | judgment-only | copy phrase-list; that mechanism is council-rejected |
+| CP4 | judgment-only | copy phrase-list; that mechanism is council-rejected |
+| CP5 | backed | |
+
+---
+
 ## The AI-slop originality self-test
 
 Before finalizing any UI design, run this two-tier check:

package/docs/guidelines/design-fidelity-mechanics.md

@@ -4,6 +4,102 @@
 
 _Origin: migrated from `src/rules/design-fidelity.md` per the P4 pattern of `road-to-kernel-and-router.md`. The Iron Law, the `design.fidelity_mode` strictness table, and the fire/not-fire scope stay in the rule; this file carries the illustrative depth._
 
+## Data-basis ladder
+
+```
+WHENEVER SOURCE IS REACHABLE, THE SOURCE IS THE DATA BASIS.
+A SCREENSHOT IS VALIDATION, NEVER THE INPUT YOU BUILD FROM,
+WHILE ANY HIGHER RUNG IS REACHABLE.
+```
+
+Four rungs, highest first. Take the highest one you can reach; a lower rung is
+a fallback you name, not a preference you exercise.
+
+| # | Rung | What it is | When it is the right rung |
+|---|---|---|---|
+| 1 | **Provided source files** | The artifact itself — an archive, an attached `design.html`, a token sidecar, a repo the user pointed at | Whenever the user handed something over. Read it *before* the first write. |
+| 2 | **Source read through any channel** | The same code reached indirectly — a repository read, or DOM / stylesheets / scripts pulled through the user's own connected browser tools | The artifact is live rather than attached (a URL, a staging page, a preview build) |
+| 3 | **Structured snapshot** | An accessibility tree or equivalent structured dump — text, roles, hierarchy, no pixels | Source is genuinely unreachable, but structure is not |
+| 4 | **Screenshot** | Rendered pixels | Nothing above is reachable, **or** the thing being checked only exists once rendered |
+
+**What rung 4 is legitimately for**, and this is not a grudging exception:
+visual validation after building, layout collisions, contrast as actually
+rendered, and content that only exists dynamically. The failure this ladder
+names is not *using* a screenshot — it is using one **as the data basis while
+rung 1 or 2 was sitting right there**, which is how a port ends up with the
+right colours and none of the behaviour.
+
+**The ladder governs where data comes from, never whether defects may be
+fixed.** Reading the source and improving it is allowed and often correct;
+reading the source is what makes an improvement a decision rather than a guess.
+
+Two consequences worth stating because they are the ones agents get backwards:
+
+- **A rendered HTML file is still a code artifact.** Opening it in a browser
+  does not demote it to rung 4; the file is still rung 1. What the browser adds
+  is validation, not input.
+- **Degrading is honest, silence is not.** When you build from rung 3 or 4, say
+  which rung you used and why the higher ones were unreachable. An unscoped
+  "matches the design" over a screenshot-derived build is a verdict without
+  evidence (`design-review` § verdict scoping).
+
+Regression witness: `daf-source-over-screenshot`.
+
+## Adopt the code — re-derivation is a deviation
+
+Where the artifact's own markup, CSS, or JS is stack-compatible, **adapting that
+code is the default**. Writing an equivalent from scratch is a **deviation** and
+carries the same obligation as a swapped control: surface it, get confirmation,
+do not just do it.
+
+Stack translation is not re-derivation. Porting the artifact's structure into
+Blade, JSX or a template language translates *that* structure — it does not
+license a new one. If your output's element tree cannot be walked next to the
+artifact's, you re-derived.
+
+Why this needs saying at all: the visible half of a port (colours, type,
+spacing) is what a reviewer checks, and it survives a from-scratch rewrite. The
+half that does not survive is the behaviour — event handlers, keyframes, ARIA
+wiring, focus order — and its absence is invisible in a screenshot comparison.
+"HTML not adopted, worse markup written from scratch, missing JavaScript" is one
+failure, not three.
+
+### The scope line — where `code-provenance` ends and this begins
+
+```
+A USER-SUPPLIED DESIGN ARTIFACT IS THE USER'S OWN MATERIAL, NOT THIRD-PARTY
+EXTERNAL CODE. ADOPTING IT IS NOT A BORROW.
+THIRD-PARTY CODE THAT MERELY ARRIVES THROUGH A HANDOVER STAYS UNDER
+`code-provenance` IN FULL.
+```
+
+Without this line the two rules contradict each other on the same act:
+[`code-provenance`](../../src/rules/code-provenance.md) opens with `NEVER ADOPT
+EXTERNAL CODE VERBATIM` and routes any conscious borrow through a licence check
+plus a ledger entry, while the duty above says adapt the artifact's code.
+Whichever the agent followed, it would be violating a rule, and no gate can
+arbitrate between two Iron Laws.
+
+The resolution weakens neither, and it is not new: it is the carve-out
+[`content-quoting-floor`](../../src/rules/content-quoting-floor.md) already
+makes for user-owned text — *"content the user wrote, pasted, or explicitly
+authorized for verbatim use is not an external source"*. A design artifact the
+user hands over is that same category, in markup.
+
+**What stays under `code-provenance` in full**, so the carve-out cannot be read
+as a hole:
+
+- A vendored component, a licensed template, or a third-party library that
+  happens to be *inside* the handover. Arriving through a design handover
+  changes nothing about its licence.
+- Code the artifact itself borrowed from somewhere identifiable.
+- Anything you reach for *beyond* the artifact while implementing it.
+
+The discriminator is authorship, not delivery: did the user hand you their own
+material, or did they hand you a container with someone else's material in it?
+
+Regression witness: `daf-rederive-is-deviation`.
+
 ## Surgical visual edits
 
 A request to change one visual thing — a colour, a label, a single element — is
@@ -64,7 +160,8 @@ brand evidence**. The design-surface instance of the no-invented-facts floor.
 ## Provided-artifact precedence
 
 ```
-PROVIDED ARTIFACT  >  ANTI-SLOP  >  HOUSE TASTE.
+PROVIDED ARTIFACT  >  ANTI-SLOP  >  HOUSE TASTE
+                   >  ANY GENERATIVE DESIGN-SYSTEM TOOLING, FIRST- OR THIRD-PARTY.
 THE EXEMPTION COVERS ONLY DECISIONS THE ARTIFACT ACTUALLY COVERS.
 IT NEVER COVERS GENERATIVE WORK IN THE SAME RUN.
 ```
@@ -94,6 +191,23 @@ nothing acts on them.
    the consumer's own brand (`brand-source-of-truth`). Artifact-vs-brand
    conflicts are surfaced, never merged.
 
+### The precedence chain's fourth member, and why it is not obvious
+
+A generative design-system
+skill — this suite's own or a third party's installed beside it — can carry an
+instruction of the shape *"always generate a design system first"*. On a
+greenfield brief that is right. On a **port** it is the same error the anti-slop
+catalog makes: it argues the agent out of a decision the user already made, and
+it does so from a step that runs *before* the artifact is even read, so nothing
+downstream ever gets the chance to override it. A generative step's output may
+inform decisions the artifact leaves open — states it never showed, a breakpoint
+it never specified — and nothing more. It never re-opens a decision the artifact
+carries.
+
+This is a precedence clause, not a ban: the generative tooling stays correct
+where it was already correct. What it loses is the authority to run *instead of*
+reading a supplied artifact.
+
 **The mechanical half.** A review finding carries `artifact_covered: true`, and
 the polish gate drops those from the round-driving set *before* the ceiling
 check, so a port cannot burn its two rounds on findings it was never allowed to
@@ -125,7 +239,11 @@ labelled "not wired yet" note beats an invented redesign.
 
 Behavioral baseline: the `daf-*` fixtures named above (edit preservation,
 unwanted variations, redesign trigger, missing asset, external asset URL,
-invented screenshot).
+invented screenshot), plus the port family this guideline governs —
+`daf-source-over-screenshot` (data basis), `daf-adhoc-port-coverage` (loss
+reporting outside the engine), `daf-rederive-is-deviation` (adopt the code),
+and `daf-handoff-bundle`, the bundle shape where a token sidecar makes
+"honoured the contract" and "eyeballed the CSS" produce different artefacts.
 
 ## See also
 

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@event4u/agent-config",
     "mcpName": "io.github.event4u-app/agent-config",
-    "version": "10.1.0",
+    "version": "10.3.0",
     "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including \"zero runtime daemon\".",
     "license": "MIT",
     "private": false,

package/src/agent-src/templates/scripts/work_engine/_lib/agent_settings.ts

@@ -210,7 +210,6 @@ export const MERGEABLE_KEYS: readonly string[] = [
     'memory.cadence',
     'personal.bot_icon',
     'personal.autonomy',
-    'telegraph.speak_scope',
     // Knowledge-card global cross-project sharing is a USER-GLOBAL setting
     // (ADR-100 / road-to-structure-grounding-v2). Whitelisted so the
     // ~/.event4u/agent-config/agent-settings.yml values are honoured.

package/src/config/agent-settings.template.yml

@@ -166,33 +166,25 @@ lean_projection:
 
 # --- Telegraph condensation (output-side) ---
 #
-# speak_scope: off | prose_only | aggressive   (QUOTE the value — bare `off` is a
-#                                              YAML 1.1 boolean, not the string)
-#
-# `off` is the shipped default per docs/adrs/telegraph/0001-default-off-until-bench.md
-# (Status: accepted) and docs/contracts/condensation-default-kill-criterion.md.
+# `speak: false` is the shipped default per
+# docs/adrs/telegraph/0001-default-off-until-bench.md (Status: accepted) and
+# docs/contracts/condensation-default-kill-criterion.md.
 # Reason it is off: the only output-side bench (telegraph-v1, n=10, 2026-05-16)
 # measured median vs_terse -9.27% (API counts) / -5.47% (exact cl100k_base
 # re-analysis) — telegraph emits MORE tokens than a plain "be terse" instruction.
 # The kill-criterion table therefore lands on "criterion not met — defer" and the
 # telemetry multiplier stays suspended (0.9155 < 1.0).
 #
-# NOTE: `speak_scope: off` disables the BEHAVIOUR but not the COST — the projector
-# gates this rule on `telegraph.speak`, never on speak_scope, so under
-# `lean_projection.mode: eager-all` the ~982-token body still ships every session.
-# Set `speak: false` for zero-cost dormancy.
-#
 # Stated explicitly here because until 2026-07-29 this default existed only in
-# prose — and two prose sources disagreed (the rule said prose_only, the accepted
-# ADR said off). Do not flip without a passing output-side bench.
+# prose — and two prose sources disagreed. Do not flip without a passing
+# output-side bench.
 telegraph:
   # speak: false = DORMANT (the shipped default per docs/adrs/telegraph/0002).
   # The rule is omitted from dist/router.json entirely, so its ~982-token body
-  # never ships. This — not speak_scope — is the lever that stops the cost:
-  # compile_router gates on `speak` and never reads speak_scope.
+  # never ships. This is the only lever that stops the cost: compile_router
+  # gates on `speak` and on nothing else.
   # Set true only after an output-side bench clears the kill-criterion bar.
   speak: false
-  speak_scope: "off"
 
 # --- Token-rich skills governance ---
 #
@@ -420,14 +412,6 @@ chat_history:
   #   per_tool  = one entry per tool call (most verbose)
   frequency: __CHAT_HISTORY_FREQUENCY__
 
-  # Max file size in KB before overflow handling kicks in (integer)
-  max_size_kb: __CHAT_HISTORY_MAX_SIZE_KB__
-
-  # Overflow behavior
-  #   rotate   = drop oldest entries to stay under max_size_kb
-  #   condense = mark for summarization on the next agent turn
-  on_overflow: __CHAT_HISTORY_ON_OVERFLOW__
-
   # Per-entry-type text-length caps (chars). 0 = verbatim, no slice.
   # N > 0 = collapse whitespace, slice to N chars, append " … [+K chars]"
   # so the log self-reports truncation. Defaults match the hardcoded
@@ -656,12 +640,6 @@ quality:
   # gates delegated to remote CI", never claim an unrun pipeline passed.
   local_auto_run: false
 
-  # Wait for remote CI to finish on the PR / pipeline (true, false)
-  # true  = after push, poll GitHub check-runs / pipeline status and
-  #         report green / red before handing back
-  # false = push and hand back immediately; user inspects CI
-  #         themselves (default — saves agent runtime and tokens)
-  wait_for_remote_ci: false
 
 # --- Design fidelity ---
 #
@@ -744,6 +722,11 @@ screenshots:
   #       ship-and-hope. Illustrative / no-data screenshots (diagrams, logos,
   #       placeholder-only UI) may embed with a stated justification.
   # off = no data-bearing gate (legacy; the anonymization taxonomy still applies).
+  #
+  # NOTE: nothing reads this key yet — the gate it names is unconditional prose in
+  # `doc-screenshot-hygiene`. Kept rather than deleted so the missing reader is a
+  # visible gap instead of a silently unguarded action; see settings-classes.md
+  # § The six unread keys for the disagreement about which repair is right.
   data_bearing_gate: "on"
 
 code_style:
@@ -1365,7 +1348,6 @@ explain:
 # rule refuses every legal-review-prep skill until `acknowledged: true`.
 legal_review_prep:
   acknowledged: false
-  consented_at: ""
   # Gate legal work-product behind a multi-model council / deep-research pass
   # (defense-in-depth + audit trail; fail-closed). Off lets single-model legal
   # output through — not recommended for this high-risk pack.

package/src/config/gate-coverage.yml

@@ -40,16 +40,29 @@
 #                visible, or it repeats the sin it exists to catch.
 #   canary       optional mutation recipe (Phase 7) — see CANARY below
 #
-# COVERAGE — THE HONEST DENOMINATOR (re-measured 2026-08-10)
+# COVERAGE — THE HONEST DENOMINATOR (re-measured 2026-08-13)
 # ----------------------------------------------------------
-# 251 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`
+# 257 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`
 # (the count is computed, not asserted — `check_gate_coverage.count_gate_scripts`).
-# **33 of them emit the machine-readable `scanned: <N>` line under their
-# CI-identical argv, and all 33 are listed below.** The manifest is therefore
-# complete with respect to its own contract, and covers ~13 % of the population.
-# (The 2026-08-05 reading said "32 … and all 31 are listed": the two halves of
-# one sentence disagreed by one, which is the drift this paragraph exists to
-# make visible. Both are recounted above, not adjusted toward each other.)
+# **35 of them emit the machine-readable `scanned: <N>` line under their
+# CI-identical argv, and all 35 are listed below.** The manifest is therefore
+# complete with respect to its own contract, and covers ~14 % of the population.
+# (The 2026-08-05 reading said "32 … and all 31 are listed"; the 2026-08-10
+# reading said "33 … and all 33" while 34 entries were listed. Both halves are
+# RECOUNTED here: 257 is what `count_gate_scripts()` returns on the tree that
+# carries this change, and 35 is the entries counted directly. It read 255 while
+# this change was being written and 257 after `main` merged in two further gate
+# scripts — re-measured at the merge rather than left at the earlier reading,
+# which is the same discipline the note below records failing.)
+#
+# A 2026-08-13 revision of this paragraph first wrote 256, derived as "255 before
+# this change plus the one it adds" — inside the sentence claiming to have
+# recounted. It was wrong twice over: 255 was already the reading WITH the new
+# script present, and arithmetic on the previous prose is the exact move this
+# paragraph forbids. Recorded rather than quietly corrected, because a
+# denominator that goes stale by being adjusted is the failure documented here
+# twice before, and the third instance is the one that shows the note is not
+# enough on its own.
 #
 # Two revisions of this header have now gone stale the same way. It claimed
 # "8 of 211", then "22 of 223" while 26 entries were listed. Both halves drift
@@ -677,6 +690,27 @@ gates:
       a gate scanning nothing — it plants the removal-permitting class with no
       evidence and the gate reds.
 
+  - id: check_review_prompt_binding
+    argv: []
+    min_scanned: 15
+    corpus: "agents/evidence/reviews/<slug>.review-input/prompt.md paired with a prompt_hash in <slug>.findings.md (19 at baseline)"
+    status: enforced
+    canary:
+      class: unbound-review-prompt
+      path: agents/evidence/reviews/zcs-closure.review-input/prompt.md
+      content: |
+        Planted canary: a reviewer prompt whose sha256 cannot equal the
+        prompt_hash recorded in zcs-closure.findings.md.
+    note: >
+      The plant needs a slug that already carries a `prompt_hash` but no committed
+      package — a brand-new `zz-canary` slug is skipped, not caught, because an
+      artefact without a package is deliberately out of scope. `zcs-closure` is a
+      closed round, so it will not gain a real package and the plant cannot
+      collide with one. The two planted failures the roadmap asked for (a one-byte
+      prompt edit, a pre-loaded verdict) are pinned in
+      tests/scripts/check_review_prompt_binding.test.ts, which is where the
+      two-file plants this single-file recipe cannot express are exercised.
+
   - id: check_corpus_staleness
     argv: ["--quiet", "--today", "2026-08-06"]
     min_scanned: 5