@event4u/agent-config 12.1.0 → 13.0.0

package/src/agent-src/scripts/archive_completed_roadmaps.ts

@@ -403,6 +403,38 @@ function _regen_dashboard(root: string, dry_run: boolean): void {
     }
 }
 
+/**
+ * Rebuild the archive index after a move, when the builder is present.
+ *
+ * The sweep is the one operation that changes what `agents/roadmaps/archive/`
+ * contains, so it is the one operation that can leave the generated index
+ * stale — and the drift gate on that index runs in the same PR the sweep runs
+ * in. Regenerating here keeps the two from disagreeing by construction rather
+ * than by remembering.
+ *
+ * `build_archive_index` is package-internal (`src/scripts/`), while this sweep
+ * is projected into consumer installs that carry no such script. Absent
+ * builder → nothing to regenerate, and that is a normal consumer state, not a
+ * failure. The spawn is best-effort for the same reason `_regen_dashboard` is:
+ * a sweep that archived correctly must not report failure because a
+ * regeneration could not run.
+ */
+function _regen_archive_index(root: string, dry_run: boolean): void {
+    if (dry_run) {
+        return;
+    }
+    const script = path.join(root, 'src', 'scripts', 'build_archive_index.ts');
+    if (!_isFile(script)) {
+        return;
+    }
+    _runTwin(root, script);
+    for (const rel of ['agents/roadmaps/archive/INDEX.md', 'agents/roadmaps/archive/index.json']) {
+        if (_isFile(path.join(root, rel))) {
+            _run(['git', 'add', '--', rel], root);
+        }
+    }
+}
+
 /** Spawn the dashboard generator twin (tsx) with cwd=root, mirroring `[sys.executable, script]`. */
 function _runTwin(root: string, script: string): void {
     // Python uses `sys.executable` — the interpreter already running this
@@ -491,6 +523,7 @@ function main(argv?: readonly string[]): number {
         return 0;
     }
     _regen_dashboard(root, ns.dry_run);
+    _regen_archive_index(root, ns.dry_run);
     const verb = ns.dry_run ? 'Would archive' : 'Archived';
     for (const rec of archived) {
         process.stdout.write(

package/src/agent-src/scripts/update_roadmap_progress.ts

@@ -380,8 +380,23 @@ function _stripFencedCode(text: string): string {
     return text.replace(FENCED_CODE_RE, (m) => '\n'.repeat(_splitlines(m).length));
 }
 
-const BLOCKER_FIELD_RE =
-    /^-[ \t]*\*\*(Status|Owner|Blocks|Resolved when|What to do|Recommendation|If you do nothing|Question):\*\*/i;
+/**
+ * Terminator for a blocker field's continuation lines — ANY `- **Label:**`
+ * bullet, not a closed list of known labels.
+ *
+ * It used to enumerate eight names, which silently diverged from the contract
+ * the two call sites below already document ("up to the next `- **Field:**`
+ * marker"): a bullet whose label was not on the list did not terminate, so the
+ * PREVIOUS field kept absorbing it and the dashboard rendered the two as one
+ * run-on sentence. Measured when `- **Options:**` and `- **Side finding:**`
+ * first appeared in a blocker — a reader saw the side finding as part of
+ * `Resolved when`, i.e. the generator changed what a field meant.
+ *
+ * A closed list is the wrong shape for a terminator: every future field name
+ * would have to be added here to avoid corrupting the field above it, and the
+ * failure is silent in generated output nobody edits by hand.
+ */
+const BLOCKER_FIELD_RE = /^-[ \t]*\*\*[^*]+:\*\*/;
 
 /** Strip an inline `<!-- comment -->` and trim. */
 function _stripComment(s: string): string {

package/src/config/evaluator-budgets.json

@@ -65,10 +65,11 @@
       "baseline_note": "80 → 81 on 2026-08-03 (release 9.15.0 gate). This RECORDS growth that already shipped through its own reviewed PR; it does not authorize new surface. The +1 is f02db54c2 (fix(cli): register routing:doctor in the CLI registry) — the command existed, only its registry entry was missing, and the registering PR did not move this budget. The gate did its job again: breach WARNS on main and BLOCKS on release, which is the conscious-decision point rather than a silently raised cap. Re-measured 2026-08-03 via the pinned method: 81. Headroom stays zero by design — the next registry addition must move this number in its own PR. 81 → 82 on 2026-08-04: the `handoff` subcommand (road-to-agent-handoff-resume Phase 4) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 82. 82 → 84 on 2026-08-04: the `route:explain` + `route:audit` verbs (routing-correctness validation surface) register in the same PR that adds the surface. Re-measured via the pinned method: 84. 84 → 85 on 2026-08-05: the `settings:set` verb (road-to-zero-ceremony-settings Phase 2 — the one agent-reachable settings writer) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 85. 85 → 86 on 2026-08-06: the `conformance:behavior` verb (road-to-agent-behavior-conformance Phase 5 — replays the local transcript store through the four mechanised conformance checks) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 86. 86 → 88 on 2026-08-07: the `sessions:list` + `sessions:claim` verbs (road-to-parallel-session-coordination — the shell surface of the shared session register, needed because /roadmap:next is command markdown and can only reach the register through a shell call) register in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 88. 88 → 89 on 2026-08-08: the `council:status` verb registers in the same PR that adds the surface, per this record's own contract. It exists because an agent in a consumer project announced \"kein Council konfiguriert (keine .agent-settings.yml)\" and substituted a weaker path while the council was configured user-globally the whole time — there was no verb that answered availability, so the only route was an inference from a filename, and the intuitive filename is the one location ADR-104 guarantees is never consulted. Re-measured via the pinned method: 89. 89 → 91 on 2026-08-08: the `self-repair:status` + `self-repair:release` verbs (the queued-defect reader and the single Hard-Floor-gated outward step of the self-repair loop — the loop is deliberately unable to publish unless a human runs the release command) register in the same PR that adds the surface, per this record's own contract. Landed alongside the +1 council:status move in the same branch. Re-measured via the pinned method: 91. 91 → 94 on 2026-08-08: the `packs:active`, `settings:get` and `mcp:available` verbs (road-to-capability-answerability Phase 2 — the three capability probes for the gaps that had none) register in the same PR that adds the surface, per this record's own contract. Each answers a question that was previously only inferable from a filename: which packs are active and from which file, what a setting resolves to and which file set it, and what is declared in mcp.json versus what can actually launch. 94 -> 95 in the same PR: `brand:status` (Phase 2.4 — brand-layer presence, which the rule depended on and no surface could answer). Re-measured twice via the pinned method on the unchanged tree: 95/95. 95 → 96 on 2026-08-10: the `session:recycle` verb (road-to-token-economy-recycling Phase 2.2 — the deterministic producer of the main-session recycle envelope; the recycle advisory names this exact verb, so it must exist as a shell surface) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 96. 96 -> 97 on 2026-08-10: the `gates` verb registers in the same PR that adds the surface, per this record's own contract. It exists because the blocker fields the dashboard already parses (Owner, What to do, Resolved when — CI-enforced by lint_roadmap_blockers) had no owner-filtered reader: the dashboard counts the open blockers across a 600-line file and links each to a per-roadmap anchor, so \"which of these are mine\" was a manual read of every anchor. The same inference-from-a-filename shape as the council:status entry above, one layer up. This branch and the session:recycle branch each measured 96 independently and landed on the same number for different verbs; the merge makes it 97, re-measured twice via the pinned method on the merged tree: 97/97. 97 -> 98 on 2026-08-15: the `workspace:doctor` verb (road-to-inbox-harvest-2026-08-c-workspace-identity Phase 3 — the read-only report over the new `workspaceIdentity()` resolver) registers in the same PR that adds the surface, per this record's own contract. It exists for the same inference-from-a-filename shape as the council:status and gates entries above, one layer down: the tree answered \"where am I\" in eight ad-hoc places across six files, and the 12.0.0 span shipped the same worktree misclassification twice, so no verb could be asked which checkout is the main one. Read-only by construction — the roadmap's Non-goals put worktree disposal out of scope and its Risk 3 names \"the pressure read becomes a disposal path by accident\" as the failure to design against, so the command carries no --fix and no --prune. Re-measured twice via the pinned method on the unchanged tree: 98/98."
     },
     "mcp_public_tool_count": {
-      "max": 19,
-      "last_measured": 19,
-      "last_measured_at": "2026-08-02",
-      "method": "tools/list length on the stdio server (post-ADR-132: implemented tools only)"
+      "max": 20,
+      "last_measured": 20,
+      "last_measured_at": "2026-08-17",
+      "method": "tools/list length on the stdio server (post-ADR-132: implemented tools only)",
+      "baseline_note": "19 → 20 on 2026-08-17 (release 13.0.0 gate). The +1 is 866bd9861 (feat(mcp): recover what the host dropped — real ranker tool + a route to it, road-to-inbox-harvest-2026-08-d-runtime-skill-routing Phase 4): `suggest_skill_for_task` was promoted from a discovery STUB to a real ALLOWLIST entry and removed from STUB_TOOLS. Worth stating precisely, because the consumer-visible NAME did not grow — the stub already published that name and its `task` + `limit` input schema, which the promotion carried over verbatim. What grew is the count of tools tools/list actually returns, which is exactly what this metric measures post-ADR-132: implemented tools only. Same shape as the cli_help_command_count history above — this RECORDS growth that already shipped through its own reviewed PR (866bd9861 is on main), it does not authorize new surface. The registering PR did not move this budget, so the gate did its job: the breach warned on main and blocked on the release ref, which is the conscious-decision point rather than a silently raised cap. Re-measured twice via the pinned method on a freshly built dist/mcp/server.mjs: 20/20. Headroom stays zero by design — the next tool that leaves STUB_TOOLS must move this number in its own PR."
     }
   }
 }

package/src/config/gate-coverage.yml

@@ -40,21 +40,24 @@
 #                visible, or it repeats the sin it exists to catch.
 #   canary       optional mutation recipe (Phase 7) — see CANARY below
 #
-# COVERAGE — THE HONEST DENOMINATOR (re-measured 2026-08-13)
+# COVERAGE — THE HONEST DENOMINATOR (re-measured 2026-08-16)
 # ----------------------------------------------------------
-# 259 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`
+# 260 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`
 # (the count is computed, not asserted — `check_gate_coverage.count_gate_scripts`).
-# **36 of them emit the machine-readable `scanned: <N>` line under their
-# CI-identical argv, and all 36 are listed below.** The manifest is therefore
+# **37 of them emit the machine-readable `scanned: <N>` line under their
+# CI-identical argv, and all 37 are listed below.** The manifest is therefore
 # complete with respect to its own contract, and covers ~14 % of the population.
-# (The 2026-08-05 reading said "32 … and all 31 are listed"; the 2026-08-10
-# reading said "33 … and all 33" while 34 entries were listed; the 2026-08-13
-# reading said "257 … 35 of them" and both halves were correct at the time.
-# Both halves are RECOUNTED here on 2026-08-15: 259 is what
-# `count_gate_scripts()` returns on the tree that carries this change — the
-# reading was 258 with `lint_scheduled_deprecations` absent — and 36 is
+# (The 2026-08-05 reading said "32 … and all 31 are listed" and the 2026-08-10
+# reading said "33 … and all 33" while 34 entries were listed — those two are
+# the MISCOUNTS this paragraph exists to warn about, and they are listed here
+# precisely because they were wrong, not correct-at-the-time. The 2026-08-13
+# reading ("257 … 35 of them") and the 2026-08-15 reading ("259 … 36 of them")
+# were both correct when written.
+# Both halves are RECOUNTED here on 2026-08-16: 260 is what
+# `count_gate_scripts()` returns on the tree that carries this change, and 37 is
 # `grep -c '^  - id:'` on this file. Neither number was derived by adding one to
-# the previous prose, which is the move the note below forbids.)
+# the previous prose, which is the move the note below forbids — and the
+# temptation was live, because this change does add exactly one of each.)
 #
 # A 2026-08-13 revision of this paragraph first wrote 256, derived as "255 before
 # this change plus the one it adds" — inside the sentence claiming to have
@@ -799,3 +802,22 @@ gates:
       `tests/scripts/lint_scheduled_deprecations.test.ts`, verified by mutation:
       widening the overdue threshold fails the overdue-by-construction case, and
       granting `allowEmpty` fails the zero-row case.
+
+  - id: check_source_size_budget
+    argv: []
+    min_scanned: 900
+    corpus: "TypeScript sources — src/**/*.ts excluding *.d.ts and *.test.ts, the same two kinds _lib/gate_population excludes (1,063 at baseline)"
+    status: enforced
+    # No `canary:` recipe, and the reason is the canary contract's own shape
+    # rather than a gap. The violation this gate detects is a file OVER 1,500
+    # lines, so a create-only recipe would have to inline 1,501 lines of content
+    # into this manifest — a plant larger than the manifest it lives in. It
+    # reports UNPROVEN rather than green, which is the honest state.
+    #
+    # Discrimination is proven instead by the gate's own `--self-test`, and it is
+    # stronger here than a single plant would be: six cases, three rejecting,
+    # covering a file one line over the ceiling, one line under, exactly at it
+    # (inclusive), a dead scan root, AND — the case a canary could not express —
+    # an already-listed file that GREW while the file COUNT stayed at one. That
+    # last case is what pins the metric as excess lines rather than a file count;
+    # a count-based ratchet passes it, and this gate must not.

package/src/config/gate-violation-baselines.json

@@ -23,9 +23,9 @@
       "note": "All 18 are `handoff_tier_mismatch`: a senior-tier skill links to a peer whose frontmatter carries no `tier` (reported as tier='unset') — e.g. build-buy-partner → adr-create, customer-research → po-discovery, gated-reach → threat-modeling. This is a tier-metadata backfill backlog on the LINKED-TO skills, not a broken link. The one genuinely dangling link revealed by the same repair (competitive-positioning → a non-existent ../analyze-reference-repo/SKILL.md; it is a command, not a skill) was FIXED in the repairing commit rather than baselined. Clearing this entry means backfilling `tier` on the linked-to skills, or deciding that `tier: unset` on a link target is not a violation and narrowing the rule."
     },
     "lint_roadmap_blockers:decidability": {
-      "count": 34,
-      "landed": "2026-08-15",
-      "note": "Open blocker entries that are not yet DECIDABLE by the person who owns them — missing `Recommendation:` (which option and why), missing `If you do nothing:` (the cost of the non-decision), or a `What to do:` carrying no command, path or enumerated option set. Revealed by adding the decidability half to lint_roadmap_blockers, not created by it: the five original fields describe a situation and never made it actionable, so a blocker could pass the contract while handing the analysis back to the person least equipped to redo it. Measured at introduction: 36 open entries, ALL 36 undecidable, and 14 of the 46 total entries carry no command/path/option at all in `What to do`. Baselined rather than hard-failed because 36 findings nobody can clear in the change that reveals them is the gate-that-lands-as-N-instant-blockers failure this repository has refused before — the same reasoning as ci-parity:local-only above. First measured at 34 rather than 36 because the two blockers on the branch that introduced this (`ac3-false-positive-reading`, `publish-side-marker-invariant`) were rewritten to the new standard and then closed in the same change; a baseline above the truth silently permits new violations. Re-measured at 38 when the branch was re-pointed at current main, and the +4 is population growth rather than a loosening: main gained the four `road-to-inbox-harvest-2026-08-d-*` roadmaps (context-ledger, runtime-skill-routing, scheduled-deprecation, top-band-model-economy), each carrying one open blocker authored before this requirement existed. That is the honest number for the population this gate now scans — recording 34 against a 38-entry tree would have failed the gate on its own introducing commit and taught the next reader to distrust it. Lowering happens one blocker at a time, and every roadmap touched for other reasons is a chance to lower it. Lowered 38→37 by the scheduled-deprecation PR, which is exactly that shape: code-graph-removal-authorisation was rewritten to the new standard because the roadmap was being touched anyway. Its `If you do nothing:` was one of the few that was not the common no-cost answer — the release gate that PR ships would have refused the next major cut while the blocker stayed open. Recorded in the past tense because the maintainer then RESOLVED that blocker on the trunk by withdrawing the commitment, so nothing refuses a cut today. The lowering stands on the rewrite, not on the consequence, and the sentence is corrected rather than deleted because a baseline note arguing from a retracted state is how a ratchet's rationale rots. The 56-day expiry is the point, not a hazard: if this number has not moved in two months, the fields are not being written and the gate should fail until someone decides whether the requirement is real. Lowered 37→34 when the scheduled-deprecation branch merged current main: three blockers were resolved or rewritten on the trunk in the meantime, so the drop is a genuine drain plus a merge, not a loosening. Re-tightened here rather than left loose because a ratchet that lags its own tree permits violations back in silently.",
+      "count": 26,
+      "landed": "2026-08-16",
+      "note": "Open blocker entries that are not yet DECIDABLE by the person who owns them — missing `Recommendation:` (which option and why), missing `If you do nothing:` (the cost of the non-decision), or a `What to do:` carrying no command, path or enumerated option set. Revealed by adding the decidability half to lint_roadmap_blockers, not created by it: the five original fields describe a situation and never made it actionable, so a blocker could pass the contract while handing the analysis back to the person least equipped to redo it. Measured at introduction: 36 open entries, ALL 36 undecidable, and 14 of the 46 total entries carry no command/path/option at all in `What to do`. Baselined rather than hard-failed because 36 findings nobody can clear in the change that reveals them is the gate-that-lands-as-N-instant-blockers failure this repository has refused before — the same reasoning as ci-parity:local-only above. First measured at 34 rather than 36 because the two blockers on the branch that introduced this (`ac3-false-positive-reading`, `publish-side-marker-invariant`) were rewritten to the new standard and then closed in the same change; a baseline above the truth silently permits new violations. Re-measured at 38 when the branch was re-pointed at current main, and the +4 is population growth rather than a loosening: main gained the four `road-to-inbox-harvest-2026-08-d-*` roadmaps (context-ledger, runtime-skill-routing, scheduled-deprecation, top-band-model-economy), each carrying one open blocker authored before this requirement existed. That is the honest number for the population this gate now scans — recording 34 against a 38-entry tree would have failed the gate on its own introducing commit and taught the next reader to distrust it. Lowering happens one blocker at a time, and every roadmap touched for other reasons is a chance to lower it. Lowered 38→37 by the scheduled-deprecation PR, which is exactly that shape: code-graph-removal-authorisation was rewritten to the new standard because the roadmap was being touched anyway. Its `If you do nothing:` was one of the few that was not the common no-cost answer — the release gate that PR ships would have refused the next major cut while the blocker stayed open. Recorded in the past tense because the maintainer then RESOLVED that blocker on the trunk by withdrawing the commitment, so nothing refuses a cut today. The lowering stands on the rewrite, not on the consequence, and the sentence is corrected rather than deleted because a baseline note arguing from a retracted state is how a ratchet's rationale rots. The 56-day expiry is the point, not a hazard: if this number has not moved in two months, the fields are not being written and the gate should fail until someone decides whether the requirement is real. Lowered 37→34 when the scheduled-deprecation branch merged current main: three blockers were resolved or rewritten on the trunk in the meantime, so the drop is a genuine drain plus a merge, not a loosening. Re-tightened here rather than left loose because a ratchet that lags its own tree permits violations back in silently. Lowered 34→29 on 2026-08-16 by rewriting six entries to the new standard (raw-capture-needs-host-env, telemetry-sample-size, repo-admin-and-usage, benchmark-spend, measurement-a-no-per-arm-builder-tier, measurement-b-no-renderable-lane-pair) in a PR whose only purpose was the drain — the first lowering not taken on the back of another change, which the note above says is the usual shape. Two findings from that pass are worth keeping. The tree measured 35 against a baseline of 34 BEFORE the drain, i.e. the ratchet was already red on main and nobody knew: this gate runs in `task ci`, no workflow invokes `task ci`, and the local run that would have shown it was read through a `tail`, which hid every row above the last six. And four of the six `If you do nothing:` answers are honestly that nothing degrades — that is the true answer for a held measurement, and writing it is what makes the entry decidable, so the field earns its place by being cheap to answer truthfully rather than by always carrying a cost. Lowered 29 → 27 on 2026-08-16 by the merge of this branch and the trunk drain above, and the arithmetic matters more than the delta: both sides rewrote entries from the same tree of 35 independently — the trunk six (recorded above), this branch two (deferred-finding-decision-reopen, spent-inbox-artifacts-await-deletion, rewritten because road-to-inbox-harvest-residuals was being touched anyway). The sets are disjoint, so the merged tree measures 27 and the gate itself reported the slack. Tightened rather than banked: 29 against a 27-entry tree would absorb the next two undecidable blockers without anything noticing, which is the lag this note has now corrected twice. Lowered 27 → 26 on 2026-08-16 by rewriting `picktier-wire-or-archive` (road-to-inbox-harvest-2026-08-d-top-band-model-economy), and this one is the usual shape the note describes rather than the dedicated-drain shape: the roadmap was being worked for its own Step 4.1 and the entry was rewritten because it was open on the desk. Worth recording for what writing the two fields SURFACED, which is the argument for the requirement: `Recommendation:` forced the question 'which option, and why' and the honest answer turned out not to be one of the three options at all — the entry defers to a converged council verdict, and the council cannot reach quorum (re-measured 0 of 2 the same day), so the actionable next step is a one-line fix to a user-global config file outside this repository. Five fields had described that situation accurately for two weeks without anyone noticing that the named blocker was infrastructure rather than judgement.",
       "falsifier": "./scripts-run src/scripts/lint_roadmap_blockers --quiet"
     },
     "lint_pack_boundaries": {
@@ -55,6 +55,12 @@
       "landed": "2026-08-12",
       "note": "Anti-regrowth ratchet for the settings disposition axis. 83 of 134 template leaves are classified `derivable` — the mechanism can decide from the situation, so the key should not exist — and each names the replacement that would decide instead (`lint_settings_classes` rejects the bare label, which is what keeps the class from becoming a synonym for \"inconvenient to keep\"). This is a DELETION QUEUE, not 83 deletions: a row stays until the mechanism it names actually exists, and deleting a key ahead of its mechanism is a silently-changed default rather than a simplification. Shrink-only from here, which is the anti-regrowth half — a NEW key classified `derivable` raises the number and reds, so a key whose answer the situation already carries cannot be added at all. The 56-day non-stagnation clause is the other half and is wanted here rather than tolerated: a queue that never drains is a stated direction nobody is walking. The queue opened at 88 of 140 on 2026-08-12 and drained to 83 of 134 the same day: six keys had no reader whatsoever (telegraph.speak_scope, chat_history.max_size_kb, chat_history.on_overflow, quality.wait_for_remote_ci, screenshots.data_bearing_gate, legal_review_prep.consented_at), five of them `derivable` and one a `consent` row reclassified because a published-egress confirmation is a Hard Floor no setting may lift. An unread key is the only deletion that cannot silently change a default, which is why that batch went first. The classification itself is docs/contracts/settings-classes.md.",
       "falsifier": "./scripts-run src/scripts/lint_settings_classes"
+    },
+    "check_source_size_budget": {
+      "count": 19725,
+      "landed": "2026-08-17",
+      "note": "Lowered 19,763 → 19,725 on 2026-08-17 by the T4/T5 endpoint branch, and it is a lowering rather than a re-anchor: that branch grew two already-over-ceiling files (bench_ab_v2_run.ts, bench_ab_v2_stats.ts) by 89 lines and paid it back by EXTRACTION — the workspace/transcript lifecycle and the T5 report adapters moved into `_lib/`, which is exactly what this entry means by lowering happening through splitting a god-file. Trimming comments was tried first and reached 5 of the 89; the extraction went 38 past the baseline, which is the difference between the two moves. Total lines above the 1,500-line source ceiling, summed across the 1,063 hand-written `.ts` files under `src/` — `*.d.ts` and `*.test.ts` are excluded, the same two kinds `_lib/gate_population` excludes and for the same stated reasons (a declaration has no runtime behaviour; a test file is not the reviewable code this ceiling bounds). Latent rather than cosmetic: a GENERATED `.d.ts` over the ceiling would otherwise red a ratchet aimed at hand-written code. Revealed by introducing check_source_size_budget, not created by it: every other size budget in this suite guards prose (rules by char cap, skills by token class, the depth layer by check_depth_budget), and the TypeScript the package actually ships carried none — which is where the largest artefacts in the tree sit. Fifteen files are over the ceiling; the worst three are install.ts (5,461), skill_linter.ts (4,742) and council_cli.ts (4,058). THE METRIC IS EXCESS LINES, NOT A FILE COUNT, and that is the load-bearing choice: a file count would read 15 whether install.ts sits at 5,461 or at 9,000, so the gate would stay green while the exact defect it exists for got worse. Summing the excess costs the same one integer and fails on growth inside an already-listed file — pinned by a self-test case that holds the file count at 1 and moves only the size. Baselined rather than hard-failed because 15 god-files nobody can split in the change that reveals them is the gate-that-lands-as-N-instant-blockers failure this repository has refused before; shrink-only keeps the property that matters, namely that a NEW file over 1,500 lines reds immediately. The ceiling is a growth ratchet, never a quality threshold: 1,500 was chosen by measuring this tree (15 files over 1,500, versus 44 over 1,000 and 75 over 800) as the tightest ceiling whose ledger stays signal rather than becoming the 20-plus-entry allowlist this repository's own rules call evidence that the linter is wrong. Lowering happens by splitting a god-file, and the ordering is deliberate: ratchet BEFORE split, so every later split is a lowering commit whose gain is visible in one integer, instead of a large diff with nothing asserting it improved anything. The 56-day expiry is the point, not a hazard — a ceiling with no forcing function would leave these fifteen files at these fifteen sizes indefinitely with the gate green the whole time. Re-anchored 19,676 → 19,763 on 2026-08-16 when this branch merged current main, and the +87 is population growth rather than a loosening — the same shape the blocker ratchet above records for its own +4. Every one of the 87 lines is `src/scripts/mcp_server/tools.ts` growing on the trunk between this branch's base (8edeae39) and the merge; no file in this branch's own diff is over the ceiling at all, which is checkable in one command: `git diff --stat <base> origin/main -- <the fifteen listed files>`. Recording 19,676 against a 19,763-line tree is the failure this entry's own test asserts against — a baseline below the truth fails the gate on arrival, and one above it silently sells a free regression.",
+      "falsifier": "./scripts-run src/scripts/check_source_size_budget --quiet"
     }
   }
 }

package/src/config/hook-token-budget.json

@@ -27,7 +27,9 @@
         "reread-guard": 1024,
         "reread-guard_reason": "one advisory line naming the earlier read / ranged alternative (roadmap 6.1)",
         "session-eol": 1024,
-        "session-eol_reason": "one recycle-advisory line, once per session past the committed threshold (road-to-token-economy-recycling 3.2); recording itself emits nothing"
+        "session-eol_reason": "one recycle-advisory line, once per session past the committed threshold (road-to-token-economy-recycling 3.2); recording itself emits nothing",
+        "skill-route": 512,
+        "skill-route_reason": "road-to-inbox-harvest-2026-08-d-runtime-skill-routing 2.1: one line carrying at most three skill ids and their scores - pointers, never bodies. Registered BELOW the 1024 default deliberately: this row is the ceiling that keeps it a pointer line, so a later change that starts injecting descriptions fails the build instead of quietly doubling a per-turn slot that already carries nine other concerns under a 4096-byte sum cap"
     },
     "per_slot_sum_caps_bytes": {
         "_comment": "Cross-concern per-fire sum per slot (roadmap 3.1). session_start is one-time and may carry the restore payloads; per-turn slots stay tight.",
@@ -49,6 +51,11 @@
         "_comment": "Roadmap 5.3 + 6.4 registrations. These are BEHAVIOUR metrics (advisory adoption), not injection bytes - registered here because this file already carries the owner/review discipline for the same concerns.",
         "owner": "maintainer",
         "review_by": "2026-11-10",
+        "skill_route_pointer_rate": {
+            "definition": "road-to-inbox-harvest-2026-08-d-runtime-skill-routing 2.2: skill-route fires / user_prompt_submit events per session - the share of prompts where the deterministic ranker cleared its measured p90 floor and injected pointers. NO THRESHOLD IS COMMITTED, deliberately and by the house baseline-first rule: the TRIGGER is calibrated (top-1 >= 30/100, the p90 of 496 routing-matrix prompt lines, expected to fire on ~13.9%), the OUTCOME is not. Kill standard as for the sibling nudges: a nudge whose pointers are measurably ignored over the review window gets its floor raised or its line removed. Expected fire rate is the falsifier for the trigger half - a live rate far from 13.9% means the corpus is not representative of real prompts, which is a finding about the corpus and is published either way.",
+            "instrument": "rule-trips.json warn counters for the skill-route concern (fires) + conformance audits for whether the pointed-at skill was opened (adoption); HONEST GAP: no deterministic counter exists for 'the agent acted on the pointer' - the numerator is audit-carried and registered as such rather than implied to be automatic",
+            "threshold": "none committed before data - baseline first, threshold at review date (2026-11-10)"
+        },
         "full_rewrite_small_diff_rate": {
             "definition": "edit-shape fires / Write calls per session (the full-rewrite-with-small-diff rate). Kill criterion per the shipped nudge standard: a nudge whose verdicts are measurably ignored (adoption near zero over the review window, from conformance audits) gets its trigger tightened or the injected line removed.",
             "instrument": "rule-trips.json warn counters (the dispatcher already counts every warn per concern) + conformance audits for adoption"