@event4u/agent-config 14.1.0 → 14.4.0

package/src/scripts/hooks/tool_result_bytes_hook.ts

@@ -38,6 +38,15 @@
  * The result is measured, never read: `_resultBytes` computes a length and
  * discards the value in the same expression.
  *
+ * payload-bodies-waiver: result — measured, never read. This concern
+ * deliberately declares NO `needs_payload_bodies` in `hook_manifest.yaml`: the
+ * dispatcher omits the body and passes its exact UTF-8 byte length in the stub,
+ * which is the only thing this file ever wanted. Declaring `result` here would
+ * silently restore the 2 MB payload for the one concern the omission was built
+ * for (`road-to-per-turn-hook-economy` step 2.2), and the census would look
+ * identical while the cost came back. The `RESULT_KEYS` literals below are the
+ * key NAMES this concern looks under, not a read of the body.
+ *
  * ── Always exit 0 ─────────────────────────────────────────────────────
  *
  * A `warn` (exit 2) is read as a hard BLOCK on this host, and this concern
@@ -62,6 +71,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import { is_replay_mode } from './state_io.js';
 import { readHookStdin } from './hook_stdin.js';
+import { stubbedBytes } from './payload_stub.js';
 
 const EXIT_ALLOW = 0;
 
@@ -98,11 +108,28 @@ const RESULT_KEYS = ['tool_response', 'toolResponse', 'tool_result', 'toolUseRes
  *
  * Bytes, not characters: a multibyte result costs what it costs on the
  * wire, and `String.length` would under-report it.
+ *
+ * ## The dispatcher may omit the body, and then it passes the length instead
+ *
+ * `road-to-per-turn-hook-economy` step 2.2. This concern declares no
+ * `needs_payload_bodies` in `hook_manifest.yaml` — its own header says the
+ * result is "measured, never read", and that is exactly the concern the
+ * payload opt-in exists for. So the dispatcher replaces the body with a stub
+ * carrying its UTF-8 byte length, computed the same way this function
+ * computes it, and this function reads it back.
+ *
+ * Without the stub branch the census would keep filling — with the ~120-byte
+ * length of the STUB, silently, forever. An instrument that reports a wrong
+ * number is worse than one that reports none, which is why the branch is
+ * first and why `stubbedBytes` distinguishes "omitted, this many bytes" from
+ * "present, measure it".
  */
 export function _resultBytes(payload: JsonObject): number | null {
     for (const key of RESULT_KEYS) {
         const v = payload[key];
         if (v === undefined || v === null) continue;
+        const omitted = stubbedBytes(v);
+        if (omitted !== undefined) return omitted;
         if (typeof v === 'string') return Buffer.byteLength(v, 'utf8');
         try {
             return Buffer.byteLength(JSON.stringify(v), 'utf8');

package/src/scripts/hooks/turn_end_gate_hook.ts

@@ -9,7 +9,7 @@
  * is deliberately not another reminder. It is a check at the point of
  * delivery that can say no.
  *
- * Three detectors ride on one guard, because building the unsafe part twice
+ * FOUR detectors ride on one guard, because building the unsafe part twice
  * is how a second detector becomes a second outage:
  *
  *   A — promissory closing  (FC-5, 20 measured occurrences)
@@ -20,6 +20,33 @@
  *                            prose, which is why `readTranscriptTail` collects
  *                            them: `_messageText` keeps `type === 'text'` blocks
  *                            only, so tool activity is invisible to A and B.)
+ *   D — completion claim    (a claim of done carrying no fresh evidence; landed
+ *                            under conformance round 7 § Phase 1.)
+ *
+ * TWO of the four are CONDITIONAL, and saying "unconditional" here would be the
+ * same stale-header defect this block corrects below. A and D are the
+ * completion-adjacent pair an open subagent dispatch excuses, so `main()` runs
+ * them only when `dispatchOpen` is false; B and C run on every turn-end. That
+ * narrowing is deliberate (Phase 3 Step 2, narrowed again by R2 round 2) and is
+ * the third allow path, alongside the two re-entrancy layers — see the
+ * per-detector list in `main()`.
+ *
+ * This block said "Three" and listed A/B/C until 2026-08-18, while `DetectorId`
+ * below has carried four since round 7. `DETECTOR_IDS` in
+ * `_lib/turn_end_refusals.ts` is read off that union rather than off this
+ * comment for exactly that reason, and the count is corrected here rather than
+ * left as a stale header the next reader has to disbelieve.
+ *
+ * ## Removal condition
+ *
+ * This is a BLOCKING concern, so it owes one — see
+ * `docs/contracts/turn-end-detector-demotion.md` for the pre-registered
+ * per-detector bars, their sample floors, and the reason a crossed bar
+ * authorises a staged study rather than a demotion. Two things that contract
+ * says about the guard below are worth meeting here: the re-entrancy layers cap
+ * a turn at ONE refusal, which makes a re-refusal share unobservable and the
+ * three-strikes non-termination valve unreachable. Both are properties of this
+ * design, not gaps in the counters.
  *
  * ## Re-entrancy — the shape, stated before registration
  *
@@ -997,10 +1024,18 @@ export function main(): number {
     );
     if (alreadyRefusedTurn(workspaceRoot, sessionKey, turnOrdinal)) return EXIT_ALLOW;
 
-    // Every detector runs on every turn-end. The gating is INSIDE each one —
-    // no promise, no pin mismatch, no unverified edit ⇒ no finding ⇒ the turn
-    // ends. That is the whole of "fires when it is warranted"; there is no
-    // second, configurable notion of warranted layered on top of it.
+    // B and C run on every turn-end; A and D run only when no dispatch is open
+    // (the ternaries below). For the detectors that DO run, the gating is INSIDE
+    // each one — no promise, no pin mismatch, no unverified edit, no unsettled
+    // completion claim ⇒ no finding ⇒ the turn ends. That is the whole of "fires
+    // when it is warranted"; there is no second, configurable notion of warranted
+    // layered on top of it.
+    //
+    // This said "Every detector runs on every turn-end" and enumerated three of
+    // four, three lines above the two `dispatchOpen` ternaries that refute it.
+    // Corrected 2026-08-19 with the header block at the top of this file: a reader
+    // arriving here met the false claim first, and the D comment below deferred to
+    // "the note at the top of this loop" — which was this sentence.
     const findings: Finding[] = [];
     for (const f of [
         // A and D are the completion-adjacent pair a pending dispatch excuses
@@ -1009,8 +1044,11 @@ export function main(): number {
         dispatchOpen ? null : detectPromissory(lastAssistant),
         detectLanguage(lastAssistant, readLanguagePin(workspaceRoot)),
         detectUnverifiedEdit(toolCalls),
-        // Round 7 § Phase 1 — detector D, in the same unconditional list as the
-        // other three. It shipped with its own settings flag one commit earlier
+        // Round 7 § Phase 1 — detector D. It is NOT unconditional, and this
+        // comment said it was while sitting one line above the `dispatchOpen`
+        // ternary that conditions it: A and D are both excused by an open
+        // dispatch, per the note at the top of this loop. Corrected 2026-08-18.
+        // It shipped with its own settings flag one commit earlier
         // and that flag is gone: `hooks.turn_end_gate.*` was deleted on
         // 2026-08-12 because a default-off safety gate is an absent one. Its
         // gating is where the comment above says gating belongs — inside the

package/src/scripts/hooks_doctor.ts

@@ -31,7 +31,10 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
-import { read_dispatch_issues } from "./hooks/dispatch_issues.js";
+import {
+  POLICY_OUTCOME_ISSUES,
+  read_dispatch_issues,
+} from "./hooks/dispatch_issues.js";
 import { type JsonObject, type JsonValue, _load_yaml } from "./hooks/dispatch_hook.js";
 import * as hooks_status from "./hooks_status.js";
 import {
@@ -240,9 +243,20 @@ export function collect(
 
   // Phase 1 of road-to-hooks-actually-fire-in-consumers: surface
   // the dispatch-issues log so users see hooks that tried and failed.
+  //
+  // POLICY OUTCOMES ARE FILTERED OUT, and the filter is the point: this view
+  // means "a hook tried to fire and couldn't", and its CTA is a reinstall. The
+  // two emission-shaping codes mean the opposite — the concern ran correctly and
+  // the dispatcher chose not to emit it — so they are neither a failure nor
+  // fixable by reinstalling. They fire as a routine per-dispatch outcome, so
+  // leaving them in would let normal traffic push a real `script_not_found` out
+  // of the last-20 window. They stay in the log, which is where the "why did
+  // that advisory not appear" question is answered. (R2 review, 2026-08-19.)
   let issues: JsonObject[] = [];
   try {
-    issues = read_dispatch_issues(REPO_ROOT).slice(-20) as unknown as JsonObject[];
+    issues = read_dispatch_issues(REPO_ROOT)
+      .filter((e) => !POLICY_OUTCOME_ISSUES.has(String(e["issue"])))
+      .slice(-20) as unknown as JsonObject[];
   } catch {
     issues = [];
   }

package/src/scripts/install-hooks.sh

@@ -35,6 +35,32 @@ cat > "$HOOKS_DIR/pre-push" << 'EOF'
 # so any derived-output drift blocks the push here. Runtime ~15-40s (it
 # regenerates the tool trees) — cheaper than a red CI run and a fixup re-push.
 
+# A delete-only push has no content to gate, so every check below is answering
+# a question nobody asked. Measured 2026-08-18 during the 14.0.0 release:
+# `git push origin --delete release/14.0.0` was refused by the branch-freshness
+# gate because the CHECKED-OUT branch was behind main — a fact with no bearing
+# on removing a remote ref. The deletion had to go through the GitHub API to
+# happen at all, which routes around the whole hook rather than around one gate.
+#
+# Git feeds pre-push one line per ref on stdin:
+#   <local ref> <local sha> <remote ref> <remote sha>
+# and a deletion carries the all-zero local sha. Reading stdin is safe here:
+# nothing below consumes it.
+delete_only=1
+saw_ref=0
+while read -r _local_ref local_sha _remote_ref _remote_sha; do
+    [ -z "${local_sha:-}" ] && continue
+    saw_ref=1
+    # Any non-zero character means a real object is being pushed.
+    case "$local_sha" in
+        *[!0]*) delete_only=0 ;;
+    esac
+done
+if [ "$saw_ref" = "1" ] && [ "$delete_only" = "1" ]; then
+    echo "🗑️  Delete-only push — no ref advances, so the content gates have nothing to check. Skipping."
+    exit 0
+fi
+
 fail=0
 
 if ! command -v task >/dev/null 2>&1; then

package/src/scripts/interruption_report.ts

@@ -49,6 +49,8 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
+import { SESSION_ID_LEN, derive_session_tag } from './chat_history.js';
+
 export const DEFAULT_WINDOW = 30;
 
 export interface LedgerRow {
@@ -70,25 +72,79 @@ export interface HistoryTurn {
 export interface RunReport {
     run_id: string;
     roadmap: string | null;
-    asks: number;
-    handbacks: number;
-    contacts: number;
-    halts: number;
+    /**
+     * Contact counts, or `null` when this run has NO interruption-ledger
+     * entry — a session predating the ledger, or one whose stop hook never
+     * fired.
+     *
+     * R2 round 6, finding 8. These were built unconditionally from the ledger
+     * rows, so an absent run emitted `asks: 0, contacts: 0, halts: 0` — while
+     * this report's own note tells the reader such a run is "reported with the
+     * missing axis null". The aggregate median already excluded them; the ROWS
+     * did not, and a reader consuming rows would score an unmeasured run as
+     * zero contacts. That is precisely the arithmetic falsification criterion
+     * (3) of the pre-registered `user-out-of-loop-baseline` claim forbids —
+     * "scoring an unmeasured run as zero contacts is the arithmetic that would
+     * manufacture the result".
+     */
+    asks: number | null;
+    handbacks: number | null;
+    contacts: number | null;
+    halts: number | null;
     elapsed_minutes: number | null;
     waiting_minutes: number | null;
     working_minutes: number | null;
+    /** `engage` events for this run in `run-continuation.jsonl`. */
+    reengagements: number;
+    /** `halt-stall` events — the anti-stall rung firing, not the loop working. */
+    stall_halts: number;
+    /** Relaunches the supervisor has spent on this run. */
+    relaunches: number;
+    /** Decision memos this run wrote instead of contacting the user. */
+    memos: number;
 }
 
+/**
+ * Runs required before either pre-registered claim may be compared.
+ *
+ * Fixed BEFORE any data by `user-out-of-loop-baseline` and
+ * `roadmap-wall-clock-baseline` in `docs/CLAIMS.md`, both falsification
+ * criterion (3): "≥ 20 recorded runs before any comparison, else
+ * UNDERPOWERED". Named here so the report states the floor it is judging
+ * itself against rather than leaving a reader to look it up.
+ */
+export const POWER_FLOOR_RUNS = 20;
+
 export interface Report {
     window_requested: number;
     sessions_found: number;
     window_short: boolean;
     synthetic_user_turns_excluded: number;
+    /** Runs carrying a contact count — the CONTACT axis's own denominator. */
+    contact_axis_runs: number;
+    /** Runs carrying timing — the WALL-CLOCK axis's own, much smaller, denominator. */
+    wall_clock_axis_runs: number;
+    /**
+     * Agent→user turnarounds behind `median_user_wait_minutes`.
+     *
+     * A THIRD denominator, and it is neither axis's: one run contributes as
+     * many waits as it had turnarounds, so this count is in gaps where the two
+     * above are in runs. Kept separate rather than folded into either.
+     */
+    user_wait_gaps: number;
+    /** The pre-registered floor both claims fix before any comparison. */
+    power_floor_runs: number;
     runs: RunReport[];
     median_contacts_per_run: number | null;
     median_user_wait_minutes: number | null;
     median_elapsed_minutes: number | null;
     median_working_minutes: number | null;
+    /** Phase 5.0 — the autonomy axis. */
+    median_reengagements_per_run: number | null;
+    /** Share of runs whose loop hit the stall rung. `null` with no runs. */
+    stall_halt_rate: number | null;
+    median_relaunches_per_run: number | null;
+    median_memos_per_run: number | null;
     notes: string[];
 }
 
@@ -107,6 +163,140 @@ export function isSyntheticUserText(text: string): boolean {
     return SYNTHETIC_MARKERS.some((m) => text.includes(m));
 }
 
+/**
+ * Look one run's value up in a source keyed differently from the ledger.
+ *
+ * R2 review, finding 2. Three producers write three key spaces for the same
+ * run and the report joined them with exact lookups, so `reengagements`,
+ * `stall_halts`, `stall_halt_rate` and `relaunches` read 0 / 0 % for every
+ * real run while the data sat on disk:
+ *
+ *   - the interruption ledger  `derive_session_tag(id)`  = 16 hex
+ *   - run-continuation.jsonl   `deriveSessionKey(id)`    = 32 hex
+ *   - supervise-relaunches     the RAW `session_id`
+ *
+ * A zero meaning "no instrument" and a zero meaning "the key did not match"
+ * are indistinguishable in the output, and this report prints an explicit
+ * NO INSTRUMENT for two other axes precisely to avoid the first — so a silent
+ * second kind was the worse failure.
+ *
+ * Resolution is EXACT-FIRST and lives here rather than in the readers: a
+ * reader that rewrote its own keys would have to guess what an unrecognised
+ * string means, and guessing "hash it" turns a would-have-matched key into a
+ * guaranteed miss. The readers keep reporting what is on disk; the join owns
+ * the reconciliation, because only the join knows the ledger id it is
+ * looking for.
+ *
+ * The 32-hex key is a prefix-extension of the 16-hex tag ONLY because a
+ * session id carries no whitespace for `fingerprint` to normalise away.
+ * `interruption_report.test.ts` pins that equivalence rather than assuming it.
+ */
+export function lookupByRunId<T>(
+    source: ReadonlyMap<string, T> | Readonly<Record<string, T>>,
+    runId: string,
+): T | undefined {
+    const get = (k: string): T | undefined =>
+        source instanceof Map ? source.get(k) : (source as Record<string, T>)[k];
+    // 1. The key as the ledger spells it. Covers a source that already agrees,
+    //    and every fixture that writes one id everywhere.
+    const exact = get(runId);
+    if (exact !== undefined) return exact;
+    // 2. A 32-hex continuation key whose first SESSION_ID_LEN chars are this tag.
+    const keys: string[] = source instanceof Map ? [...source.keys()] : Object.keys(source);
+    for (const k of keys) {
+        if (k.length === 32 && /^[0-9a-f]+$/.test(k) && k.slice(0, SESSION_ID_LEN) === runId) {
+            return get(k);
+        }
+    }
+    // 3. A raw session id that hashes to this tag.
+    for (const k of keys) {
+        if (derive_session_tag(k) === runId) return get(k);
+    }
+    return undefined;
+}
+
+/**
+ * Phase 5.0 — the autonomy axis, from three runtime sources.
+ *
+ * Each reader is best-effort and returns an empty map on any failure. That is
+ * correct rather than lenient: a run that predates the mechanism genuinely had
+ * zero re-engagements, and refusing to report the other axes because one
+ * source is absent would make the whole report unavailable on a fresh install.
+ */
+export function readContinuationEvents(
+    root: string,
+): Map<string, { engage: number; stall: number }> {
+    const out = new Map<string, { engage: number; stall: number }>();
+    let text: string;
+    try {
+        text = fs.readFileSync(
+            path.join(root, 'agents', 'runtime', 'state', 'run-continuation.jsonl'),
+            'utf-8',
+        );
+    } catch {
+        return out;
+    }
+    for (const line of text.split('\n')) {
+        if (line.trim() === '') continue;
+        let rec: unknown;
+        try {
+            rec = JSON.parse(line);
+        } catch {
+            continue;
+        }
+        if (rec === null || typeof rec !== 'object' || Array.isArray(rec)) continue;
+        const o = rec as Record<string, unknown>;
+        const id = o['run_id'];
+        const ev = o['event'];
+        if (typeof id !== 'string' || typeof ev !== 'string') continue;
+        const cur = out.get(id) ?? { engage: 0, stall: 0 };
+        if (ev === 'engage') cur.engage += 1;
+        else if (ev === 'halt-stall') cur.stall += 1;
+        out.set(id, cur);
+    }
+    return out;
+}
+
+export function readRelaunchLedger(root: string): Record<string, number> {
+    try {
+        const raw: unknown = JSON.parse(
+            fs.readFileSync(
+                path.join(root, 'agents', 'runtime', 'state', 'supervise-relaunches.json'),
+                'utf-8',
+            ),
+        );
+        if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) return {};
+        const out: Record<string, number> = {};
+        for (const [k, v] of Object.entries(raw as Record<string, unknown>)) {
+            if (typeof v === 'number' && Number.isFinite(v) && v >= 0) out[k] = v;
+        }
+        return out;
+    } catch {
+        return {};
+    }
+}
+
+export function readMemoCounts(root: string): Record<string, number> {
+    const base = path.join(root, 'agents', 'runtime', 'state', 'decisions');
+    const out: Record<string, number> = {};
+    let runs: string[];
+    try {
+        runs = fs.readdirSync(base);
+    } catch {
+        return out;
+    }
+    for (const run of runs) {
+        try {
+            out[run] = fs
+                .readdirSync(path.join(base, run))
+                .filter((n) => /^\d{3}\.md$/.test(n)).length;
+        } catch {
+            // a file where a directory was expected — not a run
+        }
+    }
+    return out;
+}
+
 export function median(values: readonly number[]): number | null {
     if (values.length === 0) return null;
     const sorted = [...values].sort((a, b) => a - b);
@@ -237,6 +427,13 @@ export function buildReport(root: string, windowRequested: number): Report {
     // null wall clock rather than disappearing from the denominator.
     for (const id of ledgerRuns) if (!windowedIds.has(id)) runIds.add(id);
 
+    // Phase 5.0 sources. All three are gitignored runtime state, all three are
+    // read best-effort, and an absent one yields zeros rather than an error —
+    // a run predating the mechanism genuinely had zero re-engagements.
+    const continuation = readContinuationEvents(root);
+    const relaunches = readRelaunchLedger(root);
+    const memosByRun = readMemoCounts(root);
+
     const allGaps: number[] = [];
     const runs: RunReport[] = [];
 
@@ -265,16 +462,31 @@ export function buildReport(root: string, windowRequested: number): Report {
             if (elapsed !== null) working = Math.max(0, elapsed - waiting);
         }
 
+        const cont = lookupByRunId(continuation, runId) ?? { engage: 0, stall: 0 };
+        const inLedger = ledgerRuns.has(runId);
         runs.push({
             run_id: runId,
             roadmap: rows.find((r) => r.roadmap !== null)?.roadmap ?? null,
-            asks,
-            handbacks,
-            contacts: contacts.length,
-            halts,
+            // `null`, not 0, when this run is absent from the ledger — see
+            // the field docs above and falsification criterion (3).
+            asks: inLedger ? asks : null,
+            handbacks: inLedger ? handbacks : null,
+            contacts: inLedger ? contacts.length : null,
+            halts: inLedger ? halts : null,
             elapsed_minutes: elapsed,
             waiting_minutes: waiting,
             working_minutes: working,
+            reengagements: cont.engage,
+            stall_halts: cont.stall,
+            // By ROADMAP, not by run id: the relaunch ledger is keyed on the
+            // roadmap slug so its per-run cap survives the new session id a
+            // relaunch produces (see `run_supervise.RelaunchLedger`). Joining
+            // it on the run id would read 0 for every run — the same
+            // permanent-zero shape finding 2 fixed one source over.
+            relaunches: (rows.find((r) => r.roadmap !== null)?.roadmap ?? null) === null
+                ? 0
+                : (relaunches[rows.find((r) => r.roadmap !== null)?.roadmap as string] ?? 0),
+            memos: lookupByRunId(memosByRun, runId) ?? 0,
         });
     }
 
@@ -303,10 +515,40 @@ export function buildReport(root: string, windowRequested: number): Report {
         sessions_found: bySession.size,
         window_short: bySession.size < windowRequested,
         synthetic_user_turns_excluded: synthetic,
+        // Per-axis N against the pre-registered ≥ 20-run floor. The two axes
+        // read DIFFERENT sources — the ledger is a committed append-only file,
+        // the chat history is a rolling buffer — so their effective N diverges
+        // hard, and one banner over both cannot say which is underpowered.
+        //
+        // Measured 2026-08-19: **19** runs carried contacts and 4 carried
+        // timing, out of 21 runs in the window. NEITHER axis cleared the
+        // floor. The two runs in the gap carry timing and no ledger entry, so
+        // they raise the total and not the contact axis — which is the whole
+        // reason the total may not be read as either axis's N.
+        //
+        // R2 round 1, finding 1: this comment first said "21 runs carried
+        // contacts … the contact axis had cleared its own floor", i.e. it
+        // shipped the exact misreading this field exists to prevent, as a
+        // fact, inside the fix for it. The roadmap and CLAIMS.md in the same
+        // change said 19 and "it had not". Worth leaving on the record: the
+        // number is easy to get wrong even while writing the guard against
+        // getting it wrong, which is the argument for reading it off the
+        // field rather than off the total.
+        //
+        // `runsWithLedger` is reused rather than re-filtered (finding 4):
+        // `r.contacts` is null exactly when the run is absent from
+        // `ledgerRuns`, so a second predicate is a second thing to keep true.
+        contact_axis_runs: runsWithLedger,
+        wall_clock_axis_runs: runs.filter((r) => r.elapsed_minutes !== null).length,
+        user_wait_gaps: allGaps.length,
+        power_floor_runs: POWER_FLOOR_RUNS,
         runs,
         notes,
         median_contacts_per_run: median(
-            runs.filter((r) => ledgerRuns.has(r.run_id)).map((r) => r.contacts),
+            runs
+                .filter((r) => ledgerRuns.has(r.run_id))
+                .map((r) => r.contacts)
+                .filter((v): v is number => v !== null),
         ),
         median_user_wait_minutes: median(allGaps),
         median_elapsed_minutes: median(
@@ -315,6 +557,14 @@ export function buildReport(root: string, windowRequested: number): Report {
         median_working_minutes: median(
             runs.map((r) => r.working_minutes).filter((v): v is number => v !== null),
         ),
+        median_reengagements_per_run: median(runs.map((r) => r.reengagements)),
+        // A RATE, not a count: the question is what share of runs hit the
+        // anti-stall rung, and a raw count would rise with the window size and
+        // read as a regression when nothing changed.
+        stall_halt_rate:
+            runs.length === 0 ? null : runs.filter((r) => r.stall_halts > 0).length / runs.length,
+        median_relaunches_per_run: median(runs.map((r) => r.relaunches)),
+        median_memos_per_run: median(runs.map((r) => r.memos)),
     };
 }
 
@@ -322,6 +572,20 @@ function fmt(v: number | null, unit = ''): string {
     return v === null ? 'n/a' : `${Math.round(v * 10) / 10}${unit}`;
 }
 
+/**
+ * The power verdict for ONE axis, printed on that axis's own header.
+ *
+ * `UNDERPOWERED` is the word the claims themselves use, so the reader meets
+ * the same term the falsification criterion is written in. The count is always
+ * shown, including when the floor is cleared — a bare "OK" would leave a
+ * reader unable to tell 20 from 200.
+ */
+function power(n: number, floor: number): string {
+    return n >= floor
+        ? `  ·  n=${n} runs (≥ ${floor} floor cleared)`
+        : `  ·  n=${n} runs — ⚠️  UNDERPOWERED, floor is ${floor}`;
+}
+
 export function renderText(report: Report): string {
     const lines: string[] = [];
     lines.push('interruption_report — road-to-user-out-of-the-loop Phase 0');
@@ -332,19 +596,72 @@ export function renderText(report: Report): string {
     );
     lines.push(`synthetic user turns excluded: ${report.synthetic_user_turns_excluded}`);
     lines.push('');
-    lines.push('CONTACT AXIS');
+    lines.push(`CONTACT AXIS${power(report.contact_axis_runs, report.power_floor_runs)}`);
     lines.push(`  median contacts per run:   ${fmt(report.median_contacts_per_run)}`);
-    lines.push(`  median user wait:          ${fmt(report.median_user_wait_minutes, ' min')}`);
     lines.push('');
-    lines.push('WALL-CLOCK AXIS');
+    lines.push(`WALL-CLOCK AXIS${power(report.wall_clock_axis_runs, report.power_floor_runs)}`);
     lines.push(`  median elapsed per run:    ${fmt(report.median_elapsed_minutes, ' min')}`);
     lines.push(`  median agent working time: ${fmt(report.median_working_minutes, ' min')}`);
+    // `user wait` sits HERE and not under the contact axis, and it carries a
+    // third denominator of its own.
+    //
+    // R2 round 2, finding 1. It used to print under CONTACT AXIS, directly
+    // beneath that axis's ledger-sourced n — so the per-axis fix reproduced
+    // the very conflation it was written to remove, one line further down.
+    // `roadmap-wall-clock-baseline` settles which axis owns it: WAITING is
+    // named as that claim's own instrument, derived from chat-history
+    // timestamps, i.e. the source whose N is the small one.
+    //
+    // And the unit is gaps, not runs: one run contributes as many waits as it
+    // had agent→user turnarounds. Printing a run-count next to it would be the
+    // second half of the same error, so it carries its own count.
+    lines.push(
+        `  median user wait:          ${fmt(report.median_user_wait_minutes, ' min')}` +
+            `  ·  n=${report.user_wait_gaps} gap(s), not runs`,
+    );
     lines.push('');
-    lines.push(`runs: ${report.runs.length}`);
+    lines.push('AUTONOMY AXIS (Phase 5.0)');
+    lines.push(`  median re-engagements:     ${fmt(report.median_reengagements_per_run)}`);
+    lines.push(
+        `  stall-halt rate:           ${
+            report.stall_halt_rate === null
+                ? 'n/a'
+                : `${Math.round(report.stall_halt_rate * 1000) / 10}%`
+        }`,
+    );
+    lines.push(`  median relaunches per run: ${fmt(report.median_relaunches_per_run)}`);
+    lines.push(`  median memos per run:      ${fmt(report.median_memos_per_run)}`);
+    // Two axes the roadmap names and this instrument CANNOT report. Stated as
+    // no-instrument rather than printed as 0, because a zero here would read
+    // as "measured, and it is zero" — the exact confusion between an absent
+    // record and an absent event that this suite records elsewhere.
+    // "cannot run YET" and "pre-registered" were both true when written and
+    // are both false now: the spawn is a published refusal
+    // (road-to-long-horizon-execution 4.0) and `unattended-demotion-gate` took
+    // its honest-null path in the same change-set that refused it. R2 round 2,
+    // finding 2 — `run_supervise.ts` had its identical wording rewritten and
+    // this sibling site in the same diff was missed, which is what the
+    // defect-pattern sweep exists to catch and did not.
+    lines.push('  unattended-vs-attended rework: NO INSTRUMENT, and permanently so — the');
+    lines.push('    unattended lane will not run: the spawn is a published REFUSAL, not an');
+    lines.push('    unbuilt feature (road-to-long-horizon-execution 4.0). `unattended-demotion-gate`');
+    lines.push('    took its honest-null path and is CLOSED — do not read it as a live threshold.');
+    lines.push('  memo revisit rate:            NO INSTRUMENT — a memo carries no revisit marker,');
+    lines.push('    so a revisited decision is indistinguishable from one nobody reopened.');
+    lines.push('');
+    // The total carries its caveat inline, because the roadmap blames THIS
+    // line for the live misreading and round 1 left it untouched (R2 round 2,
+    // finding 11): a per-axis n printed thirty lines earlier does not reach a
+    // reader who scrolled to the number that looks like the sample size.
+    lines.push(
+        `runs: ${report.runs.length}  ·  NOT either axis's N — see the per-axis n above ` +
+            `(contact ${report.contact_axis_runs}, wall-clock ${report.wall_clock_axis_runs})`,
+    );
     for (const run of report.runs) {
         lines.push(
             `  ${run.run_id}  asks=${run.asks} handbacks=${run.handbacks} halts=${run.halts}` +
                 `  elapsed=${fmt(run.elapsed_minutes)} working=${fmt(run.working_minutes)}` +
+                `  re=${run.reengagements} stall=${run.stall_halts} relaunch=${run.relaunches} memo=${run.memos}` +
                 `  roadmap=${run.roadmap ?? '-'}`,
         );
     }