@event4u/agent-config 12.1.0 → 14.0.0

package/dist/agent-src/contexts/execution/subagent-routing.md

@@ -8,8 +8,10 @@ provider's model or billing rule.
 
 ## Inputs
 
-- The sub-task's declared `model_tier` (`lite | medium | high | inherit`,
-  per [`model-recommendations`](../model-recommendations.md)).
+- The sub-task's declared `model_tier` (`lite | medium | high | frontier |
+  inherit`, per [`model-recommendations`](../model-recommendations.md)).
+  `frontier` (ADR-232) is declarable and opt-in; it is never the resolution of
+  `inherit` — see the top-band invariant below.
 - `subagents.downshift`, `subagents.quota_arbitrage`, `subagents.model_map`
   (see [`auto-orchestration-activation`](auto-orchestration-activation.md)).
 - The host-capability manifest's `separate_quota_pool`
@@ -27,43 +29,154 @@ THE SAME MINUS THE QUOTA WIN.
 1. **Downshift off** (`downshift: false`) → every sub-task runs on the session
    tier. No routing change.
 2. **Downshift on** → a sub-task runs on its declared tier; an `inherit` task
-   runs on the session tier. The tier resolves to a model alias via
-   `model_map`; an empty entry means "use the tier's runtime default" — never a
-   baked-in provider model name.
+   runs on the session tier, **bounded by the top-band invariant below**. The
+   tier resolves to a model alias via `model_map`; an empty entry means "use
+   the tier's runtime default" — never a baked-in provider model name.
 3. **Quota arbitrage** → prefer the **separate** quota pool for the sub-task
    **only when** `subagents.quota_arbitrage == true` **and**
    `manifest.separate_quota_pool == true`. Otherwise the shared pool is used and
    the tier/model choice is unchanged. This is the only place the
    "Sonnet-has-its-own-allowance" idea lives, and it lives as a runtime-detected
    flag, never as portable prose.
-4. **Budget routing** (design:
-   [`budget-routing` contract](../../../../docs/contracts/budget-routing.md)) →
-   AFTER the tier resolves per 1–3, the budget relation via `pickTier`
-   (`src/scripts/_lib/tier_budget_routing.ts`) would apply: cheapest
-   classifier-adequate tier WITH available budget; that tier exhausted or
-   cooling → next tier up with budget; all unavailable → session model +
-   surfaced one-line notice. Work is never blocked to save money. Before
-   the dispatch is created, acquire the atomic reserve
-   (`acquireBudgetPermit`; check state via `node src/scripts/cost/budget.mjs
-   tier <t>`); a 429/quota error trips `tripCooldown` for that tier and
-   falls back per the relation — never a retry loop.
-   `subagents.budget_routing` was removed as a settings key (always-on
-   orchestration, road-to-always-on-orchestration Phase 1: no per-layer
-   on/off switch survives) — `pickTier` has NO production caller today, so
-   this point documents the DESIGNED relation, not a currently wired one;
-   wiring it is a later phase of that roadmap (council-side
-   `cli_call_budget`/`cost_budget` are the caps that replace the settings
-   gate). Every budget-routed dispatch, once wired, would emit one
-   `orchestration_record` line (tier + provenance-tagged token delta) so
-   realized savings are measured, not asserted.
+4. **Budget routing — ARCHIVED 2026-08-16, there is no fourth step.** This
+   position used to describe a budget relation applied after the tier resolves
+   per 1–3: cheapest classifier-adequate tier WITH available budget, an atomic
+   pre-dispatch reserve, a cool-down on quota errors. None of it exists any
+   more. A converged AI-council verdict (anthropic + openai, 2 of 2) archived
+   `pickTier` and the permit lifecycle, because the `routing_switch` they
+   required lost its only source when `subagents.budget_routing` was deliberately
+   deleted by always-on orchestration — so wiring meant inventing a replacement
+   for a removed category — and because `session_tier` sits non-null in 0 of 327
+   records, leaving the saving unmeasurable in principle. Migration record and
+   the union revisit-if:
+   [`budget-routing` contract](../../../../docs/contracts/budget-routing.md).
+   **Tier resolution therefore ends at step 3.** What survives of the module is
+   `TIER_ORDER` and `readCooldowns`, read by `routing:doctor` as a diagnostic —
+   monitoring, not routing, and note that nothing writes the cool-down file any
+   more, which is why the doctor reports that state as *unavailable, no
+   producer* rather than as a measured "not cooling".
+
+### The top-band invariant (binding)
+
+```
+UNDER A TOP-BAND SESSION, `inherit` RESOLVES TO AT MOST `high`.
+A SLICE THAT GENUINELY NEEDS THE SESSION'S OWN BAND DECLARES IT.
+ONE TOP-BAND CONTEXT PER TASK — THE ORCHESTRATOR'S. NEVER A SECOND BY DEFAULT.
+```
+
+Read as one line: an undeclared slice under a top-band session runs at most
+`high`, never the session's own band.
+
+`inherit` means *model-agnostic*, not *whatever the session happens to cost*.
+Left unbounded it is the one declaration that silently buys the most expensive
+band available, for exactly the slices whose authors judged the model choice
+not to matter — the weakest possible reason to spend the most.
+
+**The clamp is `high`, not the top mapped tier, and the distinction is not
+cosmetic.** ADR-232 added `frontier` to the tier→model map, so the top *mapped*
+rung is now `frontier`; clamping there would clamp nothing. The bound is the
+top **generally-recommended** band, which is what
+[`model-recommendations`](../model-recommendations.md) already states from the
+other side — its `frontier` row reads *"Never the resolution of `inherit`"*.
+This clause is that same rule written where the resolution actually happens.
+
+Consequences, stated so the cost stays visible rather than removed:
+
+- A slice that needs `frontier` **declares `model_tier: frontier`** — a value
+  § Inputs above lists as declarable, precisely so this escape hatch is legal
+  rather than instructed-but-forbidden. The declaration is the whole point:
+  the spend becomes an authored decision with a name on it instead of a
+  default nobody chose.
+- The clamp changes only the **undeclared** case. Every explicit
+  `model_tier:` is honoured verbatim, upward included.
+- A session running *below* `high` is untouched — `inherit` still resolves to
+  the session tier. "At most" is a ceiling, never a floor, and this clause
+  never promotes a slice.
+- A **declared `frontier` implementer** keeps its band, and its judge is
+  governed by [`subagent-configuration`](../subagent-configuration.md)
+  § The judge cap — which handles that case explicitly rather than leaving
+  the reviewer weaker than the author.
+
+**Honest scope.** This is a policy clause in a context file, so it binds the
+agent that reads it and nothing else; no gate re-derives an `inherit`
+resolution at dispatch time. `enforced_by: none`, deliberately — the same
+boundary the safety-floor rules state for their own obligations.
+
+### The non-escalation floor (binding)
+
+```
+A SLICE WHOSE DISPATCH OVERHEAD EXCEEDS THE SAVING FROM DOWNSHIFTING
+STAYS IN-SESSION. SPLITTING WORK WHOSE OVERHEAD EATS ITS OWN SAVING
+IS THE ANTI-GOAL, NOT THE MECHANISM WORKING.
+```
+
+Every dispatch pays a fixed cost the in-session path does not: the slice's
+prompt is re-sent to a fresh context, the return is read back, and the
+orchestrator verifies it. Below some slice size that overhead exceeds
+whatever the cheaper tier saved, and the delegation is a net loss dressed as
+an optimisation.
+
+**The floor is a rule, not a number — and the reason is measured, not
+assumed.** The step that authored this clause expected the same-band spawn
+distribution to supply the number. It cannot, and the corpus says so
+precisely. Over the full 327-record `orchestration` corpus (2026-07 plus
+2026-08):
+
+| Field the saving model needs | Non-null records |
+|---|---:|
+| `dispatch_tokens` | 40 |
+| `tier_chosen` | 1 |
+| `session_tier` | **0** |
+
+The three must co-occur on one dispatch to model a reduction, so the usable
+intersection is **zero**. This is not a small sample — it is an empty one, and
+`orchestration_savings_report.ts` already prints exactly that conclusion
+(`MODELED cost reduction: n/a (needs dispatch_tokens + session_tier +
+tier_chosen on a dispatch)`). `token_delta` does not rescue it: the hook
+writes it as a constant `0` with provenance `estimated`, deliberately, because
+no in-session counterfactual exists on disk to difference against.
+
+So the floor binds as a judgement with a named direction rather than a
+threshold:
+
+- **Default to in-session** when the slice is small enough that stating it
+  costs about as much as doing it — a single-file edit, one grep, one
+  question with a known answer.
+- **Delegate** when the slice carries its own reading (a file set to sweep, an
+  independent verification, a search whose output you do not want in context)
+  — there the returned conclusion is the saving, and it is not in tokens.
+- **Never delegate to hit a target.** A dispatch count is not an outcome.
+
+*Revisit-if:* a single dispatch record carries `dispatch_tokens`,
+`session_tier` and `tier_chosen` together. At that point the floor is
+computable and this clause should be replaced by the number, not amended
+toward it. Filling `session_tier` is the blocking gap — it exists in the
+schema and on the manual `orchestration_record` CLI path (`--session-tier`),
+and the hook that produced all 327 records never sets it.
 
 **Cache trade-off (road-to-cache-economy Phase 4).** A tier downshift changes
-the sub-task's model, and the prompt cache is keyed by `(model, prefix)` — so
-a downshifted leg forfeits its model-scoped cache reads AND splits a cohort's
-shared prefix into two caches (downshifted legs vs. session-tier legs). The
-per-call model saving and the forfeited cache-read saving pull in opposite
-directions; which wins is a measured question, not a default this policy
-resolves — see
+the sub-task's model, and the prompt cache is keyed by `(model, prefix)`. The
+concern was that a downshifted leg forfeits its model-scoped cache reads AND
+splits a cohort's shared prefix into two caches (downshifted legs vs.
+session-tier legs).
+
+**Measured 2026-08-16 —
+[`downshift-vs-cache.md`](../../../../agents/evidence/analysis/downshift-vs-cache.md),
+611 subagent legs / 16,612 calls.** The first half does not hold: a subagent
+leg's **first call realizes 2.8 % cache read**, so it starts cold and does not
+inherit the session's cache — a downshift forfeits a cache the leg never had.
+The cache is not lost, it is created on the other model and then read for the
+rest of the leg (median 18 calls per leg, ~96.9 % read share). The second half
+is **not measured** — nothing sizes cohort prefix sharing — but it is bounded
+above: prefix splitting is a write-side cost, and writes are **3.1 %** of
+subagent billable input against a 96.9 % read surface. Even attributing every
+write to splitting, the two sit about an order of magnitude apart, in favour of
+the downshift, so the direction does not depend on the unmeasured fraction.
+
+This resolves the direction; it does not license downshifting as a target. The
+cold start is paid per leg regardless of tier, which is precisely what the
+non-escalation floor above bounds. Analogous downgrade/cache coupling on the
+council side: see
 [`docs/contracts/ai-council-config.md`](../../../../docs/contracts/ai-council-config.md)
 § `model_downgrade` for the analogous downgrade/cache coupling this suite
 already ships on the council side.
@@ -80,8 +193,10 @@ rule, or context asserts "model X is free".
 [`src/scripts/_lib/subagent_routing.ts`](../../../../src/scripts/_lib/subagent_routing.ts)
 (`resolveSubagentRouting`), covered by
 [`tests/scripts/_lib_subagent_routing.test.ts`](../../../../tests/scripts/_lib_subagent_routing.test.ts).
-Budget layer: [`src/scripts/_lib/tier_budget_routing.ts`](../../../../src/scripts/_lib/tier_budget_routing.ts)
-(`pickTier`, `acquireBudgetPermit`, cool-downs), covered by
+Tier vocabulary + cool-down state:
+[`src/scripts/_lib/tier_budget_routing.ts`](../../../../src/scripts/_lib/tier_budget_routing.ts)
+(`TIER_ORDER`, `readCooldowns` — the budget decision layer that used to live
+there is archived, see step 4), covered by
 [`tests/scripts/tier_budget_routing.test.ts`](../../../../tests/scripts/tier_budget_routing.test.ts);
 live state: `agent-config routing:doctor` (orchestration section).
 

package/dist/agent-src/contexts/execution/subagent-spawn-contract.md

@@ -170,6 +170,35 @@ contingency.
   subagent's output is never auto-persisted into memory — promotion is
   always the human-gated flow (ADR-098 floor). Auto-surface, never
   auto-write.
+- **(f) Return shape — text-only final message, disk copy written first.** Two
+  clauses, and they ride **here**, at spawn, rather than in a reusable agent
+  definition: a delivery duty stated in an agent definition measured 0/2 against
+  1/1 for the identical duty carried in the dispatch prompt (practitioner
+  report, n small), which is the same verbatim-at-spawn discipline as (a)–(e).
+  - **The final message is a single text-only envelope — never end on a tool
+    call.** Measured on host 2.1.229 with a matched control dispatched in the
+    same turn: the arm told to emit its report and then make one final
+    `echo done` call returned **`(no output)`** to its parent after 3 tool uses
+    and 18,242 tokens, while the control ending on assistant text returned the
+    complete report. The work was paid for in full and discarded in full
+    ([`subagent-lifecycle-phase0-return-channel.md`](../../../../agents/evidence/investigations/subagent-lifecycle-phase0-return-channel.md)
+    § F1).
+  - **Write the envelope to the runtime artifact dir before emitting it.** Disk
+    is the durable channel, the message the fast one — same envelope, so the
+    orchestrator still ingests exactly one shape
+    ([response contract § Durable copy](subagent-response-contract.md#durable-copy--the-envelope-on-disk-before-the-message)).
+
+  **No carve-out for verifier dispatches.** An async verifier — a subagent that
+  screenshots, grades, and reports back — rides this identical return channel,
+  and one that grades and never delivers is two operator symptoms in a single
+  run: work that looks endless from the orchestrator's side, and work that
+  finished without returning. Rule (f) binds it like any other worker.
+
+  **Honest scope.** Nothing enforces (f). It is prompt-carried text, so a worker
+  that ignores it fails exactly as before — the clause buys a stated duty and a
+  known-good path to look in, not a guarantee. The deterministic half needs a
+  `subagent_stop` concern that reads the disk copy, which is planned and not
+  shipped.
 
 ## Hand-off worked examples — step N output feeds step N+1
 

package/dist/agent-src/contexts/subagent-configuration.md

@@ -15,21 +15,83 @@ Loaded by the `subagent-orchestration` skill and the `/do-and-judge`,
 ## Model tier ladder
 
 The "one tier up" fallback walks this ladder. Session model is the
-starting point; judge picks the tier above.
+starting point; judge picks the tier above. The ladder is written in
+**bands**, not vendor models — the package keeps exactly one tier→model
+mapping and it lives in
+[`model-recommendations`](model-recommendations.md) (ADR-035 § 3). A
+second per-vendor ladder here would be the two-clocks drift ADR-232 was
+careful not to create.
 
 ```
-haiku  →  sonnet  →  opus
+lite  →  medium  →  high
 ```
 
-If the session runs on **opus**, judge stays on opus (no higher tier
-available). If the session runs on **sonnet**, judge defaults to opus.
-If the session runs on **haiku**, judge defaults to sonnet.
+If the session runs at **`high`**, judge stays at `high`. If the session
+runs at **`medium`**, judge defaults to `high`. If the session runs at
+**`lite`**, judge defaults to `medium`.
+
+### The judge cap (binding)
+
+```
+THE ONE-TIER-UP ESCALATION STOPS AT `high` — IT NEVER CLIMBS INTO `frontier`.
+A JUDGE IS NEVER BELOW ITS OWN IMPLEMENTER: A DECLARED `frontier`
+IMPLEMENTER KEEPS A `frontier` JUDGE.
+A SATURATED LADDER ESCALATES CROSS-VENDOR VIA THE COUNCIL —
+NEVER INTO A SECOND SAME-VENDOR TOP-BAND AGENT.
+```
+
+Two clauses that are easy to collapse into one and must not be. The cap
+binds the **escalation**, not the floor:
+
+| Implementer band | Judge band | Why |
+|---|---|---|
+| `lite` | `medium` | one tier up |
+| `medium` | `high` | one tier up |
+| `high` | `high` | escalation capped — never climbs into `frontier` |
+| `frontier` | **`frontier`** | the floor wins: a judge is never below its author |
+
+`frontier` (ADR-232) sits above `high` in the vocabulary, so a naive
+"one tier up" would resolve a `high` implementer's judge to `frontier`
+and buy the most expensive band available for every verification pass.
+The cap forecloses that — `frontier` is opt-in by declaration only.
+
+**But the cap must not invert the ladder it protects.** Reading it as a
+flat ceiling would give a declared `frontier` implementer a `high`
+judge, i.e. a reviewer strictly *weaker* than the author — worse than
+the same-band case the one-tier-up rule exists to avoid, and a direct
+contradiction of "never downshifts its judge below what the verify
+contract requires" below. So `frontier` reaches the judge only where
+the implementer already declared it, never by escalation from `high`.
+
+**What to do when the ladder saturates.** At `high` and at `frontier`
+the judge is same-band — the reviewer is no stronger than the author,
+which is the condition the one-tier-up rule existed to avoid. The
+answer is *different vendor*, not *bigger model*:
+
+- Route the saturation case through
+  [`ai-council`](../skills/ai-council/SKILL.md), which polls models
+  outside the host session (Anthropic + OpenAI) and is therefore
+  genuinely independent of the implementer's framing.
+- This is the escalation **instead of** a second top-band context, not
+  in addition to one. Two same-vendor top-band agents on one task cost
+  twice and correlate their blind spots; a second vendor costs less and
+  disagrees for real reasons.
+- Cost boundary unchanged: the council is a network call and is
+  therefore never automatic. It is what the saturation case escalates
+  *to* when a second opinion is wanted, not a step every `high` task
+  takes ([`ai-council`](../skills/ai-council/SKILL.md) § Do NOT use).
+
+**Honest scope.** This is policy prose in a context file — it binds the
+agent that reads it and no gate re-derives a judge tier at dispatch
+time. `enforced_by: none`, stated rather than implied.
 
 **Downshift never touches the judge.** When cost-aware routing runs an
 implementer on a downshifted tier (per the category → tier defaults in
 [`model-recommendations § Subagent Category → Tier Defaults`](model-recommendations.md)),
-the judge still resolves one tier above the IMPLEMENTER's resolved tier —
-so a `lite` implementer gets at least a `medium` judge. Downshifting an
+the judge still resolves one tier above the IMPLEMENTER's resolved tier,
+**with the escalation capped at `high` per the judge cap above** — so a
+`lite` implementer gets at least a `medium` judge, and no *downshifted*
+implementer escalates its judge into `frontier`. Downshifting an
 implementer never downshifts its judge below what the verify contract
 requires, and a judge is never `lite`.
 

package/dist/agent-src/rules/autonomous-execution.md

@@ -67,7 +67,7 @@ ALLOWLIST > 20 ENTRIES IN ONE SESSION = THE LINTER IS WRONG.
 STOP. PROPOSE LINTER REDESIGN OR REMOVAL. DO NOT EXPAND THE ALLOWLIST FURTHER.
 ```
 
-Crossing 20 entries counts as the 3rd validation-target failure — fix the tool shape, not the list. Enforced at tool-call time by the `block-config-weakening` PreToolUse guard (`src/scripts/hooks/block_config_weakening.ts`) **on the three hosts that have a `pre_tool_use` slot at all** — augment, claude, cowork: it counts allowlist entries added per session, warns from 5, and blocks past 20. On cursor, cline, windsurf, gemini and copilot the guard has nowhere to bind, so there the cap is model-carried and "enforced at tool-call time" is not a claim this rule can make. Run `agent-config hooks:status` to see which slots are bound on the host you are actually on — the sibling rules `git-history-discipline` and `evaluator-independence` qualify the identical slot, and an unqualified claim here would read as a guarantee the manifest does not give. Baselines and budget thresholds warn only — a rising count there may be a legitimate ratchet reset, which the edit alone cannot distinguish. Verify with the narrowest tool that proves the target green (a single `curl` / Playwright spec for HTTP/UI, the test runner with a `--filter`, an `xdebug` step-through) — never a meta-pipeline as per-iteration probe. Failed-attempt detail, suppression-sweep equivalents, probe-efficiency detail, and adaptive effort & stop (RDP): [`autonomy-mechanics § Validation-loop budget`](../contexts/execution/autonomy-mechanics.md).
+Crossing 20 entries counts as the 3rd validation-target failure — fix the tool shape, not the list. Enforced at tool-call time by the `block-config-weakening` PreToolUse guard (`src/scripts/hooks/block_config_weakening.ts`) **on `claude`, the one host that both binds `pre_tool_use` and honours a deny**: it counts allowlist entries added per session, warns from 5, and blocks past 20. It is *bound* on augment and cowork as well, and ignored there — `host_semantics.ts` verifies claude alone, and both trampolines discard dispatcher output and `exit 0` unconditionally. Everywhere else the cap is model-carried and "enforced at tool-call time" is not a claim this rule can make. **Corrected 2026-08-17 in both directions:** this sentence used to certify augment, claude and cowork as the enforcing set (an over-claim of two hosts) and to explain the rest with "the guard has nowhere to bind" (false for cursor, cline and gemini, whose native pre-tool events `native_event_aliases` already maps onto `pre_tool_use` — unbound, not unbindable; only windsurf and copilot have no pre-tool surface). The four states are tabulated once in [`hook-architecture-v1 § Which hosts carry pre_tool_use`](../docs/contracts/hook-architecture-v1.md). Run `agent-config hooks:status` to see which slots are bound on the host you are actually on — the sibling rules `git-history-discipline` and `evaluator-independence` qualify the identical slot, and an unqualified claim here would read as a guarantee the manifest does not give. Baselines and budget thresholds warn only — a rising count there may be a legitimate ratchet reset, which the edit alone cannot distinguish. Verify with the narrowest tool that proves the target green (a single `curl` / Playwright spec for HTTP/UI, the test runner with a `--filter`, an `xdebug` step-through) — never a meta-pipeline as per-iteration probe. Failed-attempt detail, suppression-sweep equivalents, probe-efficiency detail, and adaptive effort & stop (RDP): [`autonomy-mechanics § Validation-loop budget`](../contexts/execution/autonomy-mechanics.md).
 
 Body migrated to `contexts/execution/autonomy-mechanics.md` (per P4 of `road-to-kernel-and-router.md`) — opt-in detection summary, task-scope shapes table, N=3 mechanics, allowlist-antipattern detail, probe efficiency, adaptive effort (RDP).
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).

package/dist/agent-src/rules/command-suggestion-policy.md

@@ -32,6 +32,39 @@ A suggestion block emits options. It does **not** start a command flow.
 The "run as-is" option is **always present**, **always last**, never
 removed.
 
+### The single HIGH-tier carve-out — a duplicate confirmation, never a skipped one
+
+```
+HIGH TIER REMOVES A SECOND CONFIRMATION. IT NEVER REMOVES THE FIRST.
+A COMMAND THAT WOULD BEGIN ACTING ON ARRIVAL IS NEVER HIGH TIER.
+TWO CANDIDATES ABOVE THE FLOOR IS MEDIUM. A SUBSTRING HIT IS MEDIUM.
+NO DETERMINISTIC UNIQUE SIGNAL → THE BLOCK, ALWAYS.
+```
+
+Added by road-to-user-out-of-the-loop Phase 1. It is narrow on purpose, and the
+narrowness is the argument: the law above exists so the user is never carried
+somewhere they did not choose, and a routed command whose **own** contract
+screen is the next thing they see has not carried them anywhere — it has
+replaced one options block with one basis line and left the real decision
+exactly where it was.
+
+All three conditions in
+[`command-suggestion-flow § Tier matrix`](../contexts/contracts/command-suggestion-flow.md)
+must hold: a deterministic unique signal, no second candidate above the floor,
+and a routed command that shows its own confirmation. Condition 3 is the
+load-bearing one — without it this clause would authorise auto-execution, which
+is the thing the Iron Law forbids and this carve-out does not touch.
+
+Everything else on this page is unchanged. MEDIUM and LOW still emit the block
+with "run as-is" always present and always last; the subordination list below
+still makes suggestion junior to every rule on it; and a Hard-Floor action stays
+gated by [`non-destructive-by-default`](non-destructive-by-default.md) however
+it was reached.
+
+**Honest status:** the kill criterion (>5 % mis-routes over 50 auto-routes
+reverts to block-always) has **no instrument yet**. The rate is unmeasured, not
+low. A mis-route is a reportable defect until it can be counted.
+
 ## Subordination — when to stay silent
 
 The suggestion rule is **junior** to:

package/dist/agent-src/rules/design-fidelity.md

@@ -171,7 +171,7 @@ introduced. The row that would have caught it is
 and it exists only because a review asked for it after the trigger had already
 shipped. Write that row first next time; it is the cheap half.
 
-Body migrated to [`guideline:design-fidelity-mechanics`](../docs/guidelines/design-fidelity-mechanics.md) (per P4 of `road-to-kernel-and-router.md`) — surgical visual edits (targeted-edit vs redesign-trigger discipline, stable anchors), asset & imagery discipline (owned-asset path, third-party delivery is self-hosted by default, real-imagery-as-proof, iconography floor, no unrequested filler), deviation-surfacing shape, failure-mode catalog, `daf-*` fixtures.
+Body migrated to [`guideline:design-fidelity-mechanics`](../docs/guidelines/design-fidelity-mechanics.md) (per P4 of `road-to-kernel-and-router.md`) — URL / live-page handover (extraction into the `design-system.json` contract before the first UI write, the retrieval order, the lock boundary), surgical visual edits (targeted-edit vs redesign-trigger discipline, stable anchors), asset & imagery discipline (owned-asset path, third-party delivery is self-hosted by default, real-imagery-as-proof, iconography floor, no unrequested filler), deviation-surfacing shape, failure-mode catalog, `daf-*` fixtures.
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).
 
 ## See also

package/dist/agent-src/rules/design-review-after-ui-write.md

@@ -14,8 +14,13 @@ triggers:
   - file_pattern: "*.tsx"
   - file_pattern: "*.jsx"
   - file_pattern: "*.blade.php"
-  - keyword: "component"
-  - keyword: "design token"
+  # `keyword: "component"` and `keyword: "design token"` removed 2026-08-17 as an
+  # AUTHORING decision — road-to-mixed-trigger-activation-cost Phase 2, amendment
+  # option (b), narrowed to the two path-dominant per-edit rules. This is the
+  # escape the mixed-triggers guard's own comment names: with no non-path trigger
+  # left the emitter restores `paths:`, so the rule loads on UI file contact
+  # instead of in every session. The obligation is unchanged — it binds when a UI
+  # file is touched, which is the only place a UI edit can happen.
 routes_to:
   - "skill:design-review"
   - "skill:accessibility-auditor"
@@ -24,8 +29,12 @@ packs: [frontend-design]
 enforced_by:
   - "none"
 collision_ok:
-  "component": "a written component is reviewed before it is called done — the write-side half"
-  "design token": "same surface, opposite side: ui-audit-gate inventories tokens before the write, this reviews what the write emitted"
+  # The "component" and "design token" entries were removed with their triggers
+  # (2026-08-17): a collision note for a trigger that no longer exists is an
+  # own-orphan, and `minimal-safe-diff` § Own-orphan cleanup requires the diff that
+  # stopped referencing them to remove them too. The path-keyed notes below are
+  # unchanged, and they still carry the real point: both halves of the UI loop fire
+  # on the same paths.
   "resources/views/": "both halves of one UI loop fire on the same path — audit before, review after; neither substitutes for the other"
   "resources/js/": "both halves of one UI loop fire on the same path — audit before, review after; neither substitutes for the other"
   "components/": "both halves of one UI loop fire on the same path — audit before, review after; neither substitutes for the other"
@@ -109,16 +118,29 @@ design consultation latched this session.
 
 It runs **parallel** to this rule rather than consuming it. Nothing in the tree
 reads this frontmatter at session time; the concern decides what counts as a UI
-surface from `src/scripts/_lib/ui_surface.ts`, and the `keyword:` triggers here
-still have no runtime consumer. A test — not a code path — keeps the two from
-drifting: `ui_rule_triggers.test.ts` asserts every `file_pattern` declared here
-is accepted by that predicate.
-
-Warn-only, capped at two nudges per session, default-OFF, bound only on hosts
-carrying a `pre_tool_use` slot. A nudge that can be ignored is not enforcement,
-so `enforced_by:` stays `none` — it moves the day a mechanism can refuse, not
-the day a reminder appears. `agent-config hooks:status` answers whether the
-concern is bound on the host you are actually on.
+surface from `src/scripts/_lib/ui_surface.ts`. A test — not a code path — keeps
+the two from drifting: `ui_rule_triggers.test.ts` asserts every `file_pattern`
+declared here is accepted by that predicate.
+
+**This rule carries no `keyword:` trigger any more (2026-08-17).** It used to,
+and the observation those keywords had no runtime consumer is what made removing
+them cheap: no host activation surface reads a keyword — Cursor and Windsurf
+activate on `globs` plus the description, Claude on `paths:`. What the keywords
+did do was expensive, and only on Claude: one non-path trigger makes the emitter
+write **no** `paths:` at all, which is why this rule's pre-inventory-and-review
+obligation stood in every session from 12.1.0 until the removal. It is
+path-scoped again — see `road-to-mixed-trigger-activation-cost` Phase 2.
+
+Warn-only, capped at two nudges per session, default-OFF, and bound only in the
+three `platforms:` rows that carry a `pre_tool_use` key — augment, claude,
+cowork (**clarified 2026-08-17**: "hosts carrying a slot" read as a host
+property and is a manifest one; three further hosts alias a native pre-tool
+event with no binding, and only claude honours a deny — see
+[`hook-architecture-v1 § Which hosts carry pre_tool_use`](../docs/contracts/hook-architecture-v1.md)).
+The verdict is unchanged either way: a nudge that can be ignored is not
+enforcement, so `enforced_by:` stays `none` — it moves the day a mechanism can
+refuse, not the day a reminder appears. `agent-config hooks:status` answers
+whether the concern is bound on the host you are actually on.
 
 What that leaves, and it is the useful part: the write side now has a named
 obligation and a route to the skill that discharges it, where before it had

package/dist/agent-src/rules/evaluator-independence.md

@@ -95,13 +95,35 @@ Three limits, stated because they were measured. The pre-loaded-verdict list is
 a **phrase list**, so a paraphrase evades it — it catches recurrences of known
 steering wording, not steering as such. The turn boundary is the
 authorization ledger's `detected_at` stamp, because the envelope carries no turn
-id; with no ledger yet, the counter falls back to session scope. And the slot
-itself is not universal: `pre_tool_use` exists on **three** hosts — augment,
-claude, cowork. On cursor, cline, windsurf, gemini and copilot this guard has
-nowhere to bind, so items 1 and 4 join 2 and 3 as model-carried there. The
-frequency join in `check_enforcement_coverage.ts` reports exactly that set, and
+id; with no ledger yet, the counter falls back to session scope. And the guard
+does not deny everywhere it exists: `pre_tool_use` is **bound** on three hosts —
+augment, claude, cowork — and only `claude` honours the deny. Everywhere else,
+augment and cowork included, items 1 and 4 join 2 and 3 as model-carried.
 `agent-config hooks:status` answers it for the host you are on right now.
 
+**Corrected 2026-08-17 — this paragraph was wrong on both sides of the line it
+drew.** It said `pre_tool_use` "exists on three hosts" and that the guard has
+"nowhere to bind" on the other five. Neither half survived a re-read of the
+tree. **Downward:** the manifest's own `native_event_aliases` table already maps
+`preToolUse` (cursor), `PreToolUse` (cline) and `BeforeTool` (gemini) onto
+`pre_tool_use`, so there the guard is **unbound, not unbindable**; only windsurf
+and copilot carry no pre-tool surface at all. **Upward, and worse:**
+`host_semantics.ts` certifies **claude alone**, and the augment and cowork
+trampolines discard dispatcher output and `exit 0` unconditionally — so on two
+of the three "enforcing" hosts this guard runs and is then ignored. Nor may the
+inverse be asserted downward: nothing records whether an unbound host's
+pre-tool event can *deny*, and `severity: blocking` is a property of the concern
+rather than of the host. The four states are tabulated once in
+[`hook-architecture-v1 § Which hosts carry pre_tool_use`](../docs/contracts/hook-architecture-v1.md).
+
+Stated at this length because this rule exists over a case where a process that
+*looked* followed produced fabricated evidence. An unbacked reason for a real
+gap and an unmeasured claim of enforcement are the same failure in a smaller
+font, and this paragraph had shipped one of each. Note also what the frequency
+join actually reports: `check_enforcement_coverage.ts` skips `fallback_only`
+platforms, so its gap set is **four** — cursor, cline, windsurf, gemini — never
+copilot, which is excluded by declaration rather than measured as a gap.
+
 Items 2 and 3 — an honestly chosen scope, and recording the prompt with the
 verdict — are **not** enforced by anything. A narrowed scope is not decidable
 from the prompt alone, and no validator reads the artefacts a verdict lands in.

package/dist/agent-src/rules/git-history-discipline.md

@@ -84,4 +84,8 @@ Trigger-set above activates this routing on demand, independent of the disciplin
 - [`commit-policy`](commit-policy.md) — commits are the user's call; rewriting them is a stronger version of the same restriction.
 - [`token-efficiency`](token-efficiency.md) — Iron Law on burning the user's tokens for cosmetic gain.
 - [`skill:git-workflow`](../skills/git-workflow/SKILL.md) — Safe Squash-After-Push protocol and Divergent-State Recovery decision tree.
-- `git … --no-verify` / `core.hooksPath` overrides — deterministically blocked by the `block-no-verify` PreToolUse guard (`src/scripts/hooks/block_no_verify.ts`, registered in `hook_manifest.yaml`) **on the three hosts that have a `pre_tool_use` slot at all** — augment, claude, cowork. On cursor, cline, windsurf, gemini and copilot the guard has nowhere to bind, so on those hosts the Iron Laws above are model-carried and "deterministically blocked" is not a claim this rule can make. Surfaced by the frequency join in `check_enforcement_coverage.ts`, which reports the per-commit obligation as uncovered on exactly those platforms. To check the host you are on rather than trusting this sentence, run `agent-config hooks:status`.
+- `git … --no-verify` / `core.hooksPath` overrides — deterministically blocked by the `block-no-verify` PreToolUse guard (`src/scripts/hooks/block_no_verify.ts`, registered in `hook_manifest.yaml`) **on `claude`, the one host that both binds `pre_tool_use` and honours a deny**. It is *bound* on augment and cowork too, and ignored there. Everywhere else the Iron Laws above are model-carried and "deterministically blocked" is not a claim this rule can make. To check the host you are on rather than trusting this sentence, run `agent-config hooks:status`.
+
+  **Corrected 2026-08-17, in both directions, because this line was wrong on each side.** It read "the guard has nowhere to bind" on cursor, cline, windsurf, gemini and copilot — refuted for three of the five by the manifest's own `native_event_aliases` table, which already maps `preToolUse`, `PreToolUse` and `BeforeTool` onto `pre_tool_use`: there the guard is **unbound, not unbindable**, and only windsurf and copilot carry no pre-tool surface. And it certified augment, claude and cowork as the enforcing set — `host_semantics.ts` verifies **claude alone**, while the augment and cowork trampolines discard dispatcher output and `exit 0` unconditionally, so a guard bound there runs and is then ignored. Both halves are the same failure: a host-capability claim this tree never established. The four states are tabulated once in [`hook-architecture-v1 § Which hosts carry pre_tool_use`](../docs/contracts/hook-architecture-v1.md).
+
+  The frequency join in `check_enforcement_coverage.ts` reports this obligation uncovered on **four** platforms — cursor, cline, windsurf, gemini. It skips `fallback_only` platforms before computing, so copilot never appears in its output and must not be quoted as if it did; copilot is uncovered for the separate reason that it has no hook surface at all.

package/dist/agent-src/rules/missing-skill-recovery.md

@@ -0,0 +1,89 @@
+---
+type: "auto"
+tier: "2a"
+description: "A skill exists in the tree but not in the host's catalogue — ask for it by TASK via suggest_skill_for_task, never conclude it does not exist"
+triggers:
+  - phrase: "skill not found"
+  - phrase: "no such skill"
+  - phrase: "skill does not exist"
+  - phrase: "kein passendes skill"
+  - phrase: "which skill"
+  - phrase: "welches skill"
+applies_to_user_types:
+  - "developer"
+  - "maintainer"
+self_contained: true
+workspaces: [engineering]
+packs: [meta]
+# obligation: line 41
+obligation_frequency: "per-turn"
+---
+
+# Missing-Skill Recovery
+
+The catalogue a host shows you is not the catalogue that exists. Hosts truncate,
+and at least one truncates hard: measured 2026-08-16 on a default install, the
+host published its own budget event stating it had stripped every description
+and dropped **402 entries** from the model-visible skills list
+(`agents/evidence/analysis/scoped-projection-host-delivery.md`). Scoping the
+projection moved that to 330 and stripped the descriptions anyway.
+
+402 is the **host's own count against the host's own denominator**, which is not
+this package's: the same install projects 297 skills, so the figure is a
+magnitude, never a subtraction anyone can perform. What it establishes is that
+most of the catalogue is not model-visible — which is all this rule needs.
+
+So "I do not see a skill for this" is evidence about the **delivery**, never
+about the tree.
+
+## The Iron Law
+
+```
+A SKILL MISSING FROM THE HOST CATALOGUE IS NOT A SKILL THAT DOES NOT EXIST.
+NEVER CONCLUDE "NO SKILL COVERS THIS" FROM THE LIST YOU WERE SHOWN.
+ASK BY TASK — `suggest_skill_for_task` RANKS THE TREE, NOT THE CATALOGUE.
+NEVER REBUILD A CAPABILITY BECAUSE ITS SKILL WAS NOT DELIVERED.
+```
+
+## What to do
+
+1. **Ask by task, not by name.** A name you cannot see is a name you cannot
+   type; a task description always works. The `suggest_skill_for_task` MCP tool
+   ranks `SKILL.md` frontmatter over the source tree and returns names, scores
+   and personas — no bodies, so a wrong rank costs one read.
+2. **Open the winner and check it yourself.** The ranker is deterministic
+   keyword scoring, not judgement. A high score is a pointer, not a verdict.
+3. **Say which source answered.** "The catalogue had no entry, the ranker
+   found `X`" is a different claim from "there is no skill for this", and a
+   reader cannot reconstruct which one you meant from silence.
+4. **If nothing scores, say that** — and proceed without a skill rather than
+   inventing one. A ranked empty list and an unreachable catalogue are
+   different answers; the tool distinguishes them (`status: no_catalogue`) and
+   so should you.
+
+## When NOT to fire
+
+- The skill you need was delivered and is in front of you. This rule is for the
+  gap, not for routine skill selection.
+- The task genuinely has no skill and you already checked by task. Checking
+  twice is the loop, not the discipline.
+- A host that delivers its catalogue whole — the rule costs nothing there and
+  simply never has a gap to close.
+
+## Honest enforcement — `enforced_by: none`
+
+Nothing can observe an agent concluding "no skill exists". The `skill-route`
+concern injects ranked pointers on `user_prompt_submit` when its floor is
+cleared, which covers the prompts where the ranker is confident and by
+construction covers no others: it is silent on ~86 % of prompts by design. This
+rule is the model-carried half for the rest, and it is stated as such rather
+than implied to be caught by the concern.
+
+## See also
+
+- [`code-intelligence`](../skills/code-intelligence/SKILL.md) — the same
+  shape for source code: query the index first, fall back, name the source.
+- [`external-code-graph-interop`](external-code-graph-interop.md) — its rule-side
+  twin, and the model this rule's trigger set follows.
+- `src/scripts/skill_tools/score_skill_relevance.ts` — the ranker itself, and
+  the one place its scoring is defined.