@event4u/agent-config 14.10.0 → 14.11.0

package/src/config/hook-token-budget.json

@@ -1,126 +1,138 @@
 {
-    "_comment": "Pre-registered hook-INJECTION byte budget (road-to-token-economy-cache Phase 3) — the latency file's twin: same discipline, different unit. Committed BEFORE any trimming lands; the budget is the acceptance bar, not a post-hoc fit. Bytes, not tokens, as the deterministic CI unit (no tokenizer dependency — roadmap non-goal 7.6); token-exact numbers appear only in ledger-based telemetry. Consumed by scripts/bench_hook_injection and its CI gate: a concern whose measured emission (reason + additional_context + context bytes) exceeds its row fails the build, and an EMITTING concern with no row fails the build — a new injector cannot ship without a budget row.",
-    "schema_version": 1,
-    "registered_at": "2026-08-10",
-    "owner": "maintainer",
-    "review_by": "2026-11-10",
-    "unit": "bytes of concern stdout payload fields (reason + additional_context + context) per fire",
-    "default_cap_bytes": 1024,
-    "per_concern_caps_bytes": {
-        "_comment": "Named exceptions above the default, each with its reason. Absent concern = default_cap_bytes.",
-        "hot-context": 4096,
-        "hot-context_reason": "400-word working-memory restore, session_start only — one-shot, not per-turn",
-        "handoff-context": 8192,
-        "handoff-context_reason": "consume-once handoff injection, deleted after delivery — the one legitimately large one-shot",
-        "session-canary": 2048,
-        "session-canary_reason": "full canary contract once at session_start; the per-turn beat is one line",
-        "language-mirror": 2048,
-        "language-mirror_reason": "the measured 626-wrong-turn failure class justifies a full-paragraph pin per turn",
-        "council-availability": 1536,
-        "council-availability_reason": "session_start availability block incl. resolved path + member list",
-        "session-register": 2048,
-        "session-register_reason": "collision listing scales with live sessions; capped, not unbounded",
-        "chat-history": 4096,
-        "chat-history_reason": "session_start restore block",
-        "edit-shape": 1024,
-        "edit-shape_reason": "one advisory line naming the cheaper edit primitive (roadmap 5.2: budget row from day one - the economy nudge must not itself become an economy problem)",
-        "reread-guard": 1024,
-        "reread-guard_reason": "one advisory line naming the earlier read / ranged alternative (roadmap 6.1)",
-        "session-eol": 1024,
-        "session-eol_reason": "one recycle-advisory line, once per session past the committed threshold (road-to-token-economy-recycling 3.2); recording itself emits nothing",
-        "skill-route": 512,
-        "skill-route_reason": "road-to-inbox-harvest-2026-08-d-runtime-skill-routing 2.1: one line carrying at most three skill ids and their scores - pointers, never bodies. Registered BELOW the 1024 default deliberately: this row is the ceiling that keeps it a pointer line, so a later change that starts injecting descriptions fails the build instead of quietly doubling a per-turn slot that already carries nine other concerns under a 4096-byte sum cap"
-    },
-    "per_slot_sum_caps_bytes": {
-        "_comment": "Cross-concern per-fire sum per slot (roadmap 3.1). session_start is one-time and may carry the restore payloads; per-turn slots stay tight.",
-        "session_start": 16384,
-        "user_prompt_submit": 4096,
-        "pre_tool_use": 2048,
-        "post_tool_use": 2048,
-        "stop": 2048,
-        "session_end": 1024,
-        "pre_compact": 2048,
-        "agent_error": 1024
-    },
-    "per_turn_aggregate_bytes": {
-        "_comment": "road-to-standing-context-40k Phase 4 step 4.1 — the sum the USER feels, which no row above could see. The per-slot caps bound ONE fire; a turn fires user_prompt_submit once, pre_tool_use and post_tool_use once per tool call, and stop once, so the number a turn actually injects is a multiple of them and was unregistered. This row is the injection twin of `per_turn_composite` in hook-latency-budget.json: same definition shape, same tool_calls, different unit. bench_hook_injection derives and prints it on every run; the DISPATCHER enforces `ceiling_bytes` at runtime by dropping lowest-severity advisories first (src/scripts/hooks/injection_budget.ts), exempting severity:blocking and fail_closed concerns by construction so the policy can never hide a safety-relevant warning.",
-        "owner": "maintainer",
-        "review_by": "2026-11-10",
-        "definition": "(pre_tool_use + post_tool_use) x tool_calls + user_prompt_submit + stop",
-        "tool_calls": 10,
-        "tool_calls_rationale": "Taken verbatim from hook-latency-budget.json's per_turn_composite rather than re-derived. Two definitions of 'a representative turn' in one repo is how two people compute two different composites and both call their row green.",
-        "slots_counted": ["user_prompt_submit", "pre_tool_use", "post_tool_use", "stop"],
-        "excluded_slots": ["session_start", "session_end", "pre_compact", "agent_error"],
-        "excluded_slots_rationale": "session_start is excluded BY THE STEP: it is the one-shot restore slot that legitimately carries hot-context, handoff-context and the canary contract, and capping it against a per-turn number would evict exactly the payloads it exists to deliver. The other three are not per-turn events at all.",
-        "ceiling_bytes": 47104,
-        "ceiling_derivation": "NOT a fresh number, and deliberately so: it is the arithmetic consequence of the per_slot_sum_caps_bytes rows already registered above — 4096 + (2048 + 2048) x 10 + 2048. A tighter per-turn ceiling would contradict per-slot rows that are already the committed decision, and a looser one would let the composition exceed what every part was capped at. Tightening it is a decision about those rows, taken there, in a PR.",
-        "gate_on_ceiling": false,
-        "gate_on_ceiling_rationale": "The bench REPORTS the aggregate but does not red the build on it yet — the first-reading discipline the latency twin's observe_only flag encodes. Measured 2026-08-19 under the committed fixtures: ~1,142 B against a 47,104 B ceiling, i.e. the row is registered roughly forty times above any reading that exists. The reading MOVES between runs — 922, 1,140 and 1,142 B observed within one hour — and the mechanism is worth naming precisely rather than as 'flaky': the stop-slot end-review-nudge sizes its line from the branch's own mutation volume, and replay skips its writes but not its reads, so the number grows as the working branch grows. That is a pre-existing bench non-determinism this row surfaces rather than introduces, and it is the strongest single reason not to arm the ceiling against it. Arming a ceiling nobody has ever approached would gate on an untested inequality. Runtime enforcement is NOT gated by this flag and is always on: this flag governs CI, the ceiling governs the live session.",
-        "honest_null_consequence": "If the census shows real turns sitting near the ceiling, the per-slot rows move first and this row follows from them. If real turns never approach it, the row is a bound that costs nothing and the finding is published at review date either way."
-    },
-    "injection_load_metric": {
-        "definition": "Roadmap 3.4: total injected bytes per session and per turn, hook-carried. The census mode of bench_hook_injection (--record) appends counts-only lines to agents/runtime/state/injection-census.jsonl; the caps above are the thresholds; breach trend at review date decides tighten vs relax — by evidence, in a PR. The census is also the repeat-injection-census blocker's instrument (one instrumented week ranks the repeaters for the 3.3 idempotency gate).",
-        "privacy": "census lines carry {ts, slot, concern, bytes} — counts and ids only, never content"
-    },
-    "honest_null_consequence": "If real-session census data shows the caps are systematically wrong (either direction), the caps move by evidence in a PR at review date — never silently. A budget nobody benches is the fossilization failure this file's latency twin avoided via its CI harness; bench_hook_injection is wired into the same pipeline in the same phase.",
-    "advisory_adoption_metrics": {
-        "_comment": "Roadmap 5.3 + 6.4 registrations. These are BEHAVIOUR metrics (advisory adoption), not injection bytes - registered here because this file already carries the owner/review discipline for the same concerns.",
-        "owner": "maintainer",
-        "review_by": "2026-11-10",
-        "skill_route_pointer_rate": {
-            "definition": "road-to-inbox-harvest-2026-08-d-runtime-skill-routing 2.2: skill-route fires / user_prompt_submit events per session - the share of prompts where the deterministic ranker cleared its measured p90 floor and injected pointers. NO THRESHOLD IS COMMITTED, deliberately and by the house baseline-first rule: the TRIGGER is calibrated (top-1 >= 30/100, the p90 of 496 routing-matrix prompt lines, expected to fire on ~13.9%), the OUTCOME is not. Kill standard as for the sibling nudges: a nudge whose pointers are measurably ignored over the review window gets its floor raised or its line removed. Expected fire rate is the falsifier for the trigger half - a live rate far from 13.9% means the corpus is not representative of real prompts, which is a finding about the corpus and is published either way.",
-            "instrument": "rule-trips.json warn counters for the skill-route concern (fires) + conformance audits for whether the pointed-at skill was opened (adoption); HONEST GAP: no deterministic counter exists for 'the agent acted on the pointer' - the numerator is audit-carried and registered as such rather than implied to be automatic",
-            "threshold": "none committed before data - baseline first, threshold at review date (2026-11-10)"
-        },
-        "skill_route_bare_suppression_rate": {
-            "definition": "road-to-catalogue-host-fit Phase 3 step 3.2: of the prompts where skill-route FIRES, the share whose warn reason carries `N suppressed as host-bare` - i.e. how often a skill the ranker wanted to POINT AT is one the current host is KNOWN to have delivered without its description. `N` counts the pointer window (TOP_K of the unfiltered ranking), never the whole ranked list: `rank` returns every non-zero-scoring skill, so counting the tail would let a bare name at rank 40 - never pointable, never a loss - bump the count on nearly every fire (R2 finding 1). Registered beside skill_route_pointer_rate because it measures the same concern's behaviour under the same owner and review date. NO THRESHOLD IS COMMITTED, and the refusal is inherited from the sibling rather than restated: the FILTER is derived from a measurement (all 16 bare entries in the 2026-08-12 claude observation are in the ranker's catalogue, `capture_skill_catalogue --pointable-bare`), the OUTCOME - whether suppressing them changes what the agent does - is not.",
-            "instrument": "the dispatcher's warn reason string for the skill-route concern (`, N suppressed as host-bare`, appended only when non-zero) + agents/evidence/metrics/skill-catalogue.jsonl for the population; TWO HONEST GAPS, both registered as gaps rather than implied to be automatic. (1) rule-trips.json counts fires per concern and does NOT retain the reason, so the numerator is log-carried, not counter-carried - the same posture the sibling metric takes for its own audit-carried numerator. (2) TOTAL suppression is INVISIBLE here by construction (R2 finding 4): when the filter empties the pointer set the concern returns before writing stdout, so no reason line exists for the one case the roadmap calls load-bearing. `RouteDecision.suppressed` carries it at the API boundary and nothing reads that in production.",
-            "threshold": "none committed before data - baseline first, threshold at the shared review date (2026-11-10)",
-            "falsifiers": "For the FILTER half only, never for the outcome. UPPER: a live rate far above the share of the pointer window the host degrades means the ranker preferentially ranks exactly what the host drops - a finding about the projection, which belongs to Phase 2. Name the populations rather than a bare ratio, because three different denominators are in play and an earlier draft of this row conflated them (R2 finding 11): the 2026-08-12 claude observation carries `entries_total` 336, of which only 35 were enumerated at all (16 bare + 19 described), against a ranker catalogue of 338 entries at probe time. The comparable share is 16 of the 35 ENUMERATED entries; 16/336 and 16/338 describe different things and neither is this metric's denominator. LOWER: a rate of 0 does NOT establish that the ranker and the host's bare set fail to intersect - gap (2) above makes complete suppression indistinguishable from no suppression in this instrument. `capture_skill_catalogue --pointable-bare` is the instrument that separates them, and it must be read before any zero here is interpreted."
-        },
-        "full_rewrite_small_diff_rate": {
-            "definition": "edit-shape fires / Write calls per session (the full-rewrite-with-small-diff rate). Kill criterion per the shipped nudge standard: a nudge whose verdicts are measurably ignored (adoption near zero over the review window, from conformance audits) gets its trigger tightened or the injected line removed.",
-            "instrument": "rule-trips.json warn counters (the dispatcher already counts every warn per concern) + conformance audits for adoption"
-        },
-        "duplicate_read_rate": {
-            "definition": "reread-guard fires / Read calls per session; re-read advisory adoption via conformance audits. Same kill standard.",
-            "instrument": "rule-trips.json warn counters per concern"
-        },
-        "unbounded_output_advisory_rate": {
-            "definition": "Roadmap 4.3 + 4.4 registration (advisory-degraded per the resolved pretooluse-rewrite-semantics blocker: no updatedInput in the v1 contract, so nothing caps and nothing can be bypassed - the demand signal is the fire count itself). rtk-wrap cap-advisory fires per session from the OUTPUT_CAP_TABLE branch; adoption (did the next run use a bounded form) via conformance audits. GAP CLOSED 2026-08-15 (road-to-inbox-harvest-2026-08-d-context-ledger Step 1.1): the tool-result byte counter now exists and its stream is registered below as `tool_result_bytes`. The pre/post bytes half of roadmap 4.4 is measurable from that census once it carries data; it stays unread, not unmeasurable, until a baseline is published.",
-            "instrument": "rule-trips.json warn counters for the rtk-wrap concern + conformance audits",
-            "threshold": "none committed before data - baseline first, threshold at review date"
-        },
-        "tool_result_bytes": {
-            "definition": "road-to-inbox-harvest-2026-08-d-context-ledger 1.1: UTF-8 bytes of every tool RESULT entering context, per call, keyed by tool name. Closes the gap `unbounded_output_advisory_rate` registered above - the injection census measures what this suite puts into context, this measures what the host's tools do, and the second is the larger term. CAPTURE ONLY: the concern emits zero bytes to the model, so it carries no per-concern injection cap; it is registered here because this file already owns the owner/review discipline for context-cost instruments.",
-            "instrument": "the `tool-result-bytes` concern (src/scripts/hooks/tool_result_bytes_hook.ts) on post_tool_use, appending {ts, tool, bytes, measurable} to agents/runtime/state/tool-result-census.jsonl",
-            "privacy": "census lines carry a tool NAME, a byte COUNT and a timestamp - the record type has no field able to hold file contents, command output or any free text, so there is no scrubber that can fail",
-            "threshold": "none committed before data - baseline first, threshold at review date. A `measurable: false` line means the host's payload carried no readable result; that absence is itself a coverage finding and is never counted as zero bytes"
-        },
-        "turns_per_task": {
-            "definition": "user_prompt_submit count keyed to the task envelope - the invisible multiplier (every turn re-pays the accumulated context at read rates).",
-            "instrument": "session-register / chat-history turn counters; HONEST GAP: no task-envelope key exists yet in those counters - the number is per-SESSION until a task key ships; registered with that stated limitation rather than silently redefined",
-            "threshold": "none committed before data - baseline first, threshold at review date"
-        },
-        "recycle_advisory_adoption": {
-            "definition": "road-to-token-economy-recycling 3.4: of the sessions where the session-eol recycle advisory fired, the share that actually recycled (a recycle-envelope.consumed.json produced by a successor session start). Kill standard as for the sibling nudges: adoption near zero over the review window means the advisory line is dead weight - tighten the trigger or remove the line.",
-            "instrument": "rule-trips.json warn counters for the session-eol concern (fires) + presence/turnover of agents/runtime/state/recycle-envelope.consumed.json and session-eol per-session state (recycles); conformance audits for the denominator detail",
-            "threshold": "none committed before data - baseline first, threshold at review date (2026-11-10)"
-        },
-        "auto_compact_incidence": {
-            "definition": "road-to-token-economy-recycling 3.4: sessions with >=1 auto compact_boundary event / all sessions, from the session-eol per-session counters (baseline: 11.2%, 23/205 sessions - agents/evidence/analysis/token-economy-recycling-phase1.md). TARGET DIRECTION: trends toward zero as recycle adoption rises; a flat or rising incidence with rising adoption falsifies the mechanism.",
-            "instrument": "session-eol state files (compactions[] counters) aggregated by session_eol_report; the marker-drift alarm in the same report guards the detector against silent host shape changes",
-            "threshold": "baseline 11.2%; direction-only target (down) until the review date"
-        },
-        "envelope_resume_success": {
-            "definition": "road-to-token-economy-recycling 3.4: successor sessions that completed the recycled task WITHOUT re-asking for state the envelope should have carried - i.e. the 2.1 not_carried_forward list staying honest (everything else was carried; the successor re-derived only what the list named).",
-            "instrument": "conformance audits over successor-session transcripts (the consumed envelope names the task; the audit checks the successor's first turns for state re-asks); HONEST GAP: no deterministic counter exists for 'had to re-ask' - this is audit-carried and registered as such",
-            "threshold": "none committed before data - baseline first, threshold at review date"
-        },
-        "post_recycle_verify_fail_vs_baseline": {
-            "definition": "road-to-token-economy-recycling 3.4, the falsifiable core: verify-fail rate of recycled successor sessions vs the long-session baseline. PUBLISH-IF-WORSE COMMITMENT, pre-registered before data exists: if recycled sessions verify WORSE, the result is published and the threshold (recycle-threshold-budget.json) or the envelope schema revises in a PR citing the numbers - the claim never survives on vibes.",
-            "instrument": "session-eol per-session state (recycled or not) joined with verify outcomes from conformance audits / review_skipped telemetry; HONEST GAP: transcripts carry no verify-outcome field, so the join is audit-carried until a verify-outcome counter ships",
-            "threshold": "comparison metric - no absolute threshold; verdict recorded at review date whichever way it went"
-        }
-    }
-}
+ "_comment": "Pre-registered hook-INJECTION byte budget (road-to-token-economy-cache Phase 3) — the latency file's twin: same discipline, different unit. Committed BEFORE any trimming lands; the budget is the acceptance bar, not a post-hoc fit. Bytes, not tokens, as the deterministic CI unit (no tokenizer dependency — roadmap non-goal 7.6); token-exact numbers appear only in ledger-based telemetry. Consumed by scripts/bench_hook_injection and its CI gate: a concern whose measured emission (reason + additional_context + context bytes) exceeds its row fails the build, and an EMITTING concern with no row fails the build — a new injector cannot ship without a budget row.",
+ "schema_version": 1,
+ "registered_at": "2026-08-10",
+ "owner": "maintainer",
+ "review_by": "2026-11-10",
+ "unit": "bytes of concern stdout payload fields (reason + additional_context + context) per fire",
+ "default_cap_bytes": 1024,
+ "per_concern_caps_bytes": {
+  "_comment": "Named exceptions above the default, each with its reason. Absent concern = default_cap_bytes.",
+  "hot-context": 4096,
+  "hot-context_reason": "400-word working-memory restore, session_start only — one-shot, not per-turn",
+  "handoff-context": 8192,
+  "handoff-context_reason": "consume-once handoff injection, deleted after delivery — the one legitimately large one-shot",
+  "session-canary": 2048,
+  "session-canary_reason": "full canary contract once at session_start; the per-turn beat is one line",
+  "language-mirror": 2048,
+  "language-mirror_reason": "the measured 626-wrong-turn failure class justifies a full-paragraph pin per turn",
+  "council-availability": 1536,
+  "council-availability_reason": "session_start availability block incl. resolved path + member list",
+  "session-register": 2048,
+  "session-register_reason": "collision listing scales with live sessions; capped, not unbounded",
+  "chat-history": 4096,
+  "chat-history_reason": "session_start restore block",
+  "edit-shape": 1024,
+  "edit-shape_reason": "one advisory line naming the cheaper edit primitive (roadmap 5.2: budget row from day one - the economy nudge must not itself become an economy problem)",
+  "reread-guard": 1024,
+  "reread-guard_reason": "one advisory line naming the earlier read / ranged alternative (roadmap 6.1)",
+  "session-eol": 1024,
+  "session-eol_reason": "one recycle-advisory line, once per session past the committed threshold (road-to-token-economy-recycling 3.2); recording itself emits nothing",
+  "skill-route": 512,
+  "skill-route_reason": "road-to-inbox-harvest-2026-08-d-runtime-skill-routing 2.1: one line carrying at most three skill ids and their scores - pointers, never bodies. Registered BELOW the 1024 default deliberately: this row is the ceiling that keeps it a pointer line, so a later change that starts injecting descriptions fails the build instead of quietly doubling a per-turn slot that already carries nine other concerns under a 4096-byte sum cap",
+  "rule-inject": 20480,
+  "rule-inject_reason": "road-to-trigger-delivered-rule-bodies 1.1: this concern delivers rule BODIES, not a pointer line, so its ceiling is the per-prompt token cap converted to bytes rather than a measured emission - 5,000 exact-BPE tokens (the p90 of the matched-body-token distribution over tests/eval/routing-matrix, rounded up to 500, reproduced by `model_rule_injection --corpus tests/eval/routing-matrix`) at ~4 bytes/token. Registered ABOVE the 4,096-byte user_prompt_submit and 2,048-byte pre_tool_use slot sums ON PURPOSE, and the mismatch is the finding rather than an oversight: the concern is default-OFF and emits ZERO bytes under every shipped setting, so no slot sum is breached today. The run that flips `lean_projection.mode: delivery` is the run that must move those two slot rows - that is the activation charge step 1.7 defers, and it is recorded here so the flip cannot be taken without meeting it."
+ },
+ "per_slot_sum_caps_bytes": {
+  "_comment": "Cross-concern per-fire sum per slot (roadmap 3.1). session_start is one-time and may carry the restore payloads; per-turn slots stay tight.",
+  "session_start": 16384,
+  "user_prompt_submit": 4096,
+  "pre_tool_use": 2048,
+  "post_tool_use": 2048,
+  "stop": 2048,
+  "session_end": 1024,
+  "pre_compact": 2048,
+  "agent_error": 1024
+ },
+ "per_turn_aggregate_bytes": {
+  "_comment": "road-to-standing-context-40k Phase 4 step 4.1 — the sum the USER feels, which no row above could see. The per-slot caps bound ONE fire; a turn fires user_prompt_submit once, pre_tool_use and post_tool_use once per tool call, and stop once, so the number a turn actually injects is a multiple of them and was unregistered. This row is the injection twin of `per_turn_composite` in hook-latency-budget.json: same definition shape, same tool_calls, different unit. bench_hook_injection derives and prints it on every run; the DISPATCHER enforces `ceiling_bytes` at runtime by dropping lowest-severity advisories first (src/scripts/hooks/injection_budget.ts), exempting severity:blocking and fail_closed concerns by construction so the policy can never hide a safety-relevant warning.",
+  "owner": "maintainer",
+  "review_by": "2026-11-10",
+  "definition": "(pre_tool_use + post_tool_use) x tool_calls + user_prompt_submit + stop",
+  "tool_calls": 10,
+  "tool_calls_rationale": "Taken verbatim from hook-latency-budget.json's per_turn_composite rather than re-derived. Two definitions of 'a representative turn' in one repo is how two people compute two different composites and both call their row green.",
+  "slots_counted": [
+   "user_prompt_submit",
+   "pre_tool_use",
+   "post_tool_use",
+   "stop"
+  ],
+  "excluded_slots": [
+   "session_start",
+   "session_end",
+   "pre_compact",
+   "agent_error"
+  ],
+  "excluded_slots_rationale": "session_start is excluded BY THE STEP: it is the one-shot restore slot that legitimately carries hot-context, handoff-context and the canary contract, and capping it against a per-turn number would evict exactly the payloads it exists to deliver. The other three are not per-turn events at all.",
+  "ceiling_bytes": 47104,
+  "ceiling_derivation": "NOT a fresh number, and deliberately so: it is the arithmetic consequence of the per_slot_sum_caps_bytes rows already registered above — 4096 + (2048 + 2048) x 10 + 2048. A tighter per-turn ceiling would contradict per-slot rows that are already the committed decision, and a looser one would let the composition exceed what every part was capped at. Tightening it is a decision about those rows, taken there, in a PR.",
+  "gate_on_ceiling": false,
+  "gate_on_ceiling_rationale": "The bench REPORTS the aggregate but does not red the build on it yet — the first-reading discipline the latency twin's observe_only flag encodes. Measured 2026-08-19 under the committed fixtures: ~1,142 B against a 47,104 B ceiling, i.e. the row is registered roughly forty times above any reading that exists. The reading MOVES between runs — 922, 1,140 and 1,142 B observed within one hour — and the mechanism is worth naming precisely rather than as 'flaky': the stop-slot end-review-nudge sizes its line from the branch's own mutation volume, and replay skips its writes but not its reads, so the number grows as the working branch grows. That is a pre-existing bench non-determinism this row surfaces rather than introduces, and it is the strongest single reason not to arm the ceiling against it. Arming a ceiling nobody has ever approached would gate on an untested inequality. Runtime enforcement is NOT gated by this flag and is always on: this flag governs CI, the ceiling governs the live session.",
+  "honest_null_consequence": "If the census shows real turns sitting near the ceiling, the per-slot rows move first and this row follows from them. If real turns never approach it, the row is a bound that costs nothing and the finding is published at review date either way."
+ },
+ "injection_load_metric": {
+  "definition": "Roadmap 3.4: total injected bytes per session and per turn, hook-carried. The census mode of bench_hook_injection (--record) appends counts-only lines to agents/runtime/state/injection-census.jsonl; the caps above are the thresholds; breach trend at review date decides tighten vs relax — by evidence, in a PR. The census is also the repeat-injection-census blocker's instrument (one instrumented week ranks the repeaters for the 3.3 idempotency gate).",
+  "privacy": "census lines carry {ts, slot, concern, bytes} — counts and ids only, never content"
+ },
+ "honest_null_consequence": "If real-session census data shows the caps are systematically wrong (either direction), the caps move by evidence in a PR at review date — never silently. A budget nobody benches is the fossilization failure this file's latency twin avoided via its CI harness; bench_hook_injection is wired into the same pipeline in the same phase.",
+ "advisory_adoption_metrics": {
+  "_comment": "Roadmap 5.3 + 6.4 registrations. These are BEHAVIOUR metrics (advisory adoption), not injection bytes - registered here because this file already carries the owner/review discipline for the same concerns.",
+  "owner": "maintainer",
+  "review_by": "2026-11-10",
+  "skill_route_pointer_rate": {
+   "definition": "road-to-inbox-harvest-2026-08-d-runtime-skill-routing 2.2: skill-route fires / user_prompt_submit events per session - the share of prompts where the deterministic ranker cleared its measured p90 floor and injected pointers. NO THRESHOLD IS COMMITTED, deliberately and by the house baseline-first rule: the TRIGGER is calibrated (top-1 >= 30/100, the p90 of 496 routing-matrix prompt lines, expected to fire on ~13.9%), the OUTCOME is not. Kill standard as for the sibling nudges: a nudge whose pointers are measurably ignored over the review window gets its floor raised or its line removed. Expected fire rate is the falsifier for the trigger half - a live rate far from 13.9% means the corpus is not representative of real prompts, which is a finding about the corpus and is published either way.",
+   "instrument": "rule-trips.json warn counters for the skill-route concern (fires) + conformance audits for whether the pointed-at skill was opened (adoption); HONEST GAP: no deterministic counter exists for 'the agent acted on the pointer' - the numerator is audit-carried and registered as such rather than implied to be automatic",
+   "threshold": "none committed before data - baseline first, threshold at review date (2026-11-10)"
+  },
+  "skill_route_bare_suppression_rate": {
+   "definition": "road-to-catalogue-host-fit Phase 3 step 3.2: of the prompts where skill-route FIRES, the share whose warn reason carries `N suppressed as host-bare` - i.e. how often a skill the ranker wanted to POINT AT is one the current host is KNOWN to have delivered without its description. `N` counts the pointer window (TOP_K of the unfiltered ranking), never the whole ranked list: `rank` returns every non-zero-scoring skill, so counting the tail would let a bare name at rank 40 - never pointable, never a loss - bump the count on nearly every fire (R2 finding 1). Registered beside skill_route_pointer_rate because it measures the same concern's behaviour under the same owner and review date. NO THRESHOLD IS COMMITTED, and the refusal is inherited from the sibling rather than restated: the FILTER is derived from a measurement (all 16 bare entries in the 2026-08-12 claude observation are in the ranker's catalogue, `capture_skill_catalogue --pointable-bare`), the OUTCOME - whether suppressing them changes what the agent does - is not.",
+   "instrument": "the dispatcher's warn reason string for the skill-route concern (`, N suppressed as host-bare`, appended only when non-zero) + agents/evidence/metrics/skill-catalogue.jsonl for the population; TWO HONEST GAPS, both registered as gaps rather than implied to be automatic. (1) rule-trips.json counts fires per concern and does NOT retain the reason, so the numerator is log-carried, not counter-carried - the same posture the sibling metric takes for its own audit-carried numerator. (2) TOTAL suppression is INVISIBLE here by construction (R2 finding 4): when the filter empties the pointer set the concern returns before writing stdout, so no reason line exists for the one case the roadmap calls load-bearing. `RouteDecision.suppressed` carries it at the API boundary and nothing reads that in production.",
+   "threshold": "none committed before data - baseline first, threshold at the shared review date (2026-11-10)",
+   "falsifiers": "For the FILTER half only, never for the outcome. UPPER: a live rate far above the share of the pointer window the host degrades means the ranker preferentially ranks exactly what the host drops - a finding about the projection, which belongs to Phase 2. Name the populations rather than a bare ratio, because three different denominators are in play and an earlier draft of this row conflated them (R2 finding 11): the 2026-08-12 claude observation carries `entries_total` 336, of which only 35 were enumerated at all (16 bare + 19 described), against a ranker catalogue of 338 entries at probe time. The comparable share is 16 of the 35 ENUMERATED entries; 16/336 and 16/338 describe different things and neither is this metric's denominator. LOWER: a rate of 0 does NOT establish that the ranker and the host's bare set fail to intersect - gap (2) above makes complete suppression indistinguishable from no suppression in this instrument. `capture_skill_catalogue --pointable-bare` is the instrument that separates them, and it must be read before any zero here is interpreted."
+  },
+  "full_rewrite_small_diff_rate": {
+   "definition": "edit-shape fires / Write calls per session (the full-rewrite-with-small-diff rate). Kill criterion per the shipped nudge standard: a nudge whose verdicts are measurably ignored (adoption near zero over the review window, from conformance audits) gets its trigger tightened or the injected line removed.",
+   "instrument": "rule-trips.json warn counters (the dispatcher already counts every warn per concern) + conformance audits for adoption"
+  },
+  "duplicate_read_rate": {
+   "definition": "reread-guard fires / Read calls per session; re-read advisory adoption via conformance audits. Same kill standard.",
+   "instrument": "rule-trips.json warn counters per concern"
+  },
+  "unbounded_output_advisory_rate": {
+   "definition": "Roadmap 4.3 + 4.4 registration (advisory-degraded per the resolved pretooluse-rewrite-semantics blocker: CAUSE CORRECTED 2026-08-23: this said 'no updatedInput in the v1 contract', which is false for Claude Code 2.1.241 -- the host documents and schema-validates the field (agents/evidence/analysis/host-input-rewrite-probe-2026-08-23.md). The real cause is that THIS dispatcher emits no such field and carries no accepted composition policy for one across concerns, so nothing caps and nothing can be bypassed - the demand signal is the fire count itself). rtk-wrap cap-advisory fires per session from the OUTPUT_CAP_TABLE branch; adoption (did the next run use a bounded form) via conformance audits. GAP CLOSED 2026-08-15 (road-to-inbox-harvest-2026-08-d-context-ledger Step 1.1): the tool-result byte counter now exists and its stream is registered below as `tool_result_bytes`. The pre/post bytes half of roadmap 4.4 is measurable from that census once it carries data; it stays unread, not unmeasurable, until a baseline is published.",
+   "instrument": "rule-trips.json warn counters for the rtk-wrap concern + conformance audits",
+   "threshold": "none committed before data - baseline first, threshold at review date"
+  },
+  "tool_result_bytes": {
+   "definition": "road-to-inbox-harvest-2026-08-d-context-ledger 1.1: UTF-8 bytes of every tool RESULT entering context, per call, keyed by tool name. Closes the gap `unbounded_output_advisory_rate` registered above - the injection census measures what this suite puts into context, this measures what the host's tools do, and the second is the larger term. CAPTURE ONLY: the concern emits zero bytes to the model, so it carries no per-concern injection cap; it is registered here because this file already owns the owner/review discipline for context-cost instruments.",
+   "instrument": "the `tool-result-bytes` concern (src/scripts/hooks/tool_result_bytes_hook.ts) on post_tool_use, appending {ts, tool, bytes, measurable} to agents/runtime/state/tool-result-census.jsonl",
+   "privacy": "census lines carry a tool NAME, a byte COUNT and a timestamp - the record type has no field able to hold file contents, command output or any free text, so there is no scrubber that can fail",
+   "threshold": "none committed before data - baseline first, threshold at review date. A `measurable: false` line means the host's payload carried no readable result; that absence is itself a coverage finding and is never counted as zero bytes"
+  },
+  "turns_per_task": {
+   "definition": "user_prompt_submit count keyed to the task envelope - the invisible multiplier (every turn re-pays the accumulated context at read rates).",
+   "instrument": "session-register / chat-history turn counters; HONEST GAP: no task-envelope key exists yet in those counters - the number is per-SESSION until a task key ships; registered with that stated limitation rather than silently redefined",
+   "threshold": "none committed before data - baseline first, threshold at review date"
+  },
+  "recycle_advisory_adoption": {
+   "definition": "road-to-token-economy-recycling 3.4: of the sessions where the session-eol recycle advisory fired, the share that actually recycled (a recycle-envelope.consumed.json produced by a successor session start). Kill standard as for the sibling nudges: adoption near zero over the review window means the advisory line is dead weight - tighten the trigger or remove the line.",
+   "instrument": "rule-trips.json warn counters for the session-eol concern (fires) + presence/turnover of agents/runtime/state/recycle-envelope.consumed.json and session-eol per-session state (recycles); conformance audits for the denominator detail",
+   "threshold": "none committed before data - baseline first, threshold at review date (2026-11-10)"
+  },
+  "auto_compact_incidence": {
+   "definition": "road-to-token-economy-recycling 3.4: sessions with >=1 auto compact_boundary event / all sessions, from the session-eol per-session counters (baseline: 11.2%, 23/205 sessions - agents/evidence/analysis/token-economy-recycling-phase1.md). TARGET DIRECTION: trends toward zero as recycle adoption rises; a flat or rising incidence with rising adoption falsifies the mechanism.",
+   "instrument": "session-eol state files (compactions[] counters) aggregated by session_eol_report; the marker-drift alarm in the same report guards the detector against silent host shape changes",
+   "threshold": "baseline 11.2%; direction-only target (down) until the review date"
+  },
+  "envelope_resume_success": {
+   "definition": "road-to-token-economy-recycling 3.4: successor sessions that completed the recycled task WITHOUT re-asking for state the envelope should have carried - i.e. the 2.1 not_carried_forward list staying honest (everything else was carried; the successor re-derived only what the list named).",
+   "instrument": "conformance audits over successor-session transcripts (the consumed envelope names the task; the audit checks the successor's first turns for state re-asks); HONEST GAP: no deterministic counter exists for 'had to re-ask' - this is audit-carried and registered as such",
+   "threshold": "none committed before data - baseline first, threshold at review date"
+  },
+  "post_recycle_verify_fail_vs_baseline": {
+   "definition": "road-to-token-economy-recycling 3.4, the falsifiable core: verify-fail rate of recycled successor sessions vs the long-session baseline. PUBLISH-IF-WORSE COMMITMENT, pre-registered before data exists: if recycled sessions verify WORSE, the result is published and the threshold (recycle-threshold-budget.json) or the envelope schema revises in a PR citing the numbers - the claim never survives on vibes.",
+   "instrument": "session-eol per-session state (recycled or not) joined with verify outcomes from conformance audits / review_skipped telemetry; HONEST GAP: transcripts carry no verify-outcome field, so the join is audit-carried until a verify-outcome counter ships",
+   "threshold": "comparison metric - no absolute threshold; verdict recorded at review date whichever way it went"
+  }
+ }
+}

package/src/config/pack-size-budget.json

@@ -7,9 +7,11 @@
     "measurement_conditions": "npm pack --dry-run --json --ignore-scripts, run at the repo root on a clean checkout. `--ignore-scripts` means NO build runs, so dist/cli, dist/ui, dist/mcp and dist/hooks are absent and the figure covers only the TRACKED payload (src/scripts/, dist/agent-src/, dist/install/, docs/guidelines/, templates). That is deliberate: this gate is always-on for every PR, and the tracked content tree is exactly the surface that grows by accretion. The built artifact is ~5.4 MB larger and is gated separately, at release time, by evaluator-budgets.unpacked_size_mb.",
     "budgets": {
         "packed_size_mb": {
-            "max": 8.4,
-            "last_measured": 7.805,
+            "max": 9.2,
+            "last_measured": 8.416,
+            "baseline_note_2026_08_23": "8.4 → 9.2 re-baselined 2026-08-23. RATCHET RESET, not the config bent around a failing check: the cap was exhausted at TRUNK level before the tripping branch existed. MEASURED on clean clones under the documented conditions — origin/main at f16c7d9df reads 8.3911, i.e. 8.9 KB under its own cap; PR #1597 reads 8.4083 local / 8.416 CI, +17.2 KB across 4 new pack entries of functional source its roadmap deliberately adds. With 8.9 KB of headroom ANY commit reds this gate, which is the failure the 2026-08-20 note predicted in writing, arriving a second time three days later. Max = 8.4083 × 1.095, derived from this file's own regression_pct: 10 rather than from the tripping measurement; last_measured records CI's 8.416, the enforcing environment and the higher of the disagreeing pair. GIVEN UP: ~0.79 MB of unpoliced accretion — this gate catches a step change in payload, which regression_pct still catches at any cap, and it cannot police 17 KB increments. REJECTED, measured rather than argued: payload reduction inside the PR — the whitelist is already tight (docs/guidelines/ plus three named contracts), tests/ is 6 KB and agents/ 39 KB uncompressed, so excluding both saves ~13 KB compressed and does not clear even this one PR. The structural surface the 2026-08-20 note named (src/scripts/ at 14.9 MB unpacked, src/agent-src/ duplicating dist/agent-src/) is still unexamined and still the open debt this raise defers. Revisit-if: a single PR moves the figure by more than regression_pct, or the drain ends and the cap can ratchet DOWN from a re-measured trunk — never up again from a fresh trip. DECIDED BY: maintainer, numbered-options option 1, after the alternative above was measured and the exhaustion was reported rather than the cap raised silently.",
             "method": "npm pack --dry-run --json --ignore-scripts → dist.size / 1e6 (the compressed tarball a consumer actually downloads)",
+            "baseline_note_2026_08_24": "8.4 → 9.1 re-baselined 2026-08-24, and this is a RATCHET RESET rather than the config bent around a failing check. The discriminator this file demands, answered with a measurement rather than an argument: THE TRUNK WAS ALREADY AT THE CEILING BEFORE THE CHANGE THAT TRIPPED IT EXISTED. `origin/main` at f16c7d9df measures 8.3911 under the documented conditions — 8.9 KB of headroom against an 8.4 cap, i.e. 0.1 %. An addition of any size crosses it. That is verbatim the failure mode the 2026-08-20 note predicted in writing — 'a cap pinned just above the measurement reds on the next commit and teaches the reader to raise it again' — arriving on schedule for the SECOND time, which is why the correction here is the headroom and not the payload. TRIP CAUSE: merging `origin/main` into `drain/chained-clip-continuity` (PR #1598). The branch adds ~2,600 net lines inside packed paths — `src/scripts/lint_adapter_tier.ts` (662 lines; it is the gate that verifies the generated tier table in `docs/contracts/provider-lifecycle.md`, so it must ship), the ai-video adapter / seam-plan / stitch shell libraries, and the `model-capabilities/*.json` files read at runtime — landing 39 KB over the cap. NEITHER SIDE WAS OVER ALONE; together they cross, which is the shape a merge produces and no per-branch check can see. MEASURED, on two clean detached worktrees with unbuilt `dist/` per `measurement_conditions` (so dist/cli, dist/ui, dist/mcp and dist/hooks absent): main 8.3911 (2,746 entries) · branch 8.4305 (2,753 entries) · CI 8.439 (Consistency job 97266868959). `last_measured` records CI's 8.439 — the enforcing environment and the higher of the disagreeing pair, per the rule the 2026-08-10 and 2026-08-20 notes both applied to their own; the ~8 KB CI-over-local gap matches the pattern both recorded. The 10 % regression rule did NOT trip (threshold 8.586 against the prior `last_measured` 7.805); only the absolute cap did. Max set to 9.1, ~7.8 % headroom over 8.439, which is the ~8 % the 5.903/6.4, 7.238/7.8 and 7.805/8.4 pairs all carried: deliberately not a number that merely clears. ALTERNATIVE EXAMINED AND NOT TAKEN, measured rather than argued, and its verdict left HONESTLY OPEN: excluding `src/scripts/ai_council/` — the tree the 2026-08-20 note names as the one whose consumer need is 'unverified', 0.903 MB as measured here — saves 270 KB compressed (8.4305 → 8.1607, under the OLD cap with 239 KB to spare). It is not taken here because whether it is SAFE is still undecided, and this note deliberately does not decide it. `src/server/routes/wizard.ts:48` imports `apiOnQuotaView` from `scripts/ai_council/transport_resolver.js`, and `council:status` is a registered verb in `src/cli/registry.ts` — but the specifier ends in `.js` and therefore cannot settle whether it resolves to the TS source under `src/scripts/` or to built output under `dist/` in a published install. An earlier draft of this note asserted that the exclusion 'breaks the wizard quota view in every consumer install'; that was an over-claim read off the specifier, and it is retracted here rather than quietly dropped. What IS established: `src/cli/python/workspace_hosts.ts:180-191` records a real `ERR_MODULE_NOT_FOUND` in a global install caused by a shipped module importing from a directory absent from `files[]`, and `src/server/routes/wizard.ts:136-137` invokes `bash src/scripts/install_anthropic_key.sh` BY PATH at runtime. So a blanket trim of `src/scripts/` is unsafe, while the ai_council-specific verdict needs a global-install smoke test rather than a reading of an import. THE DEBT IS NOW WRITTEN DOWN, which is the one thing the 2026-08-20 note promised and did not deliver: it said 'this raise buys the time to write one [a roadmap]', and no roadmap was ever written — a grep of `agents/roadmaps/` (active, `stubs/`, `later/`, `archive/`) finds no payload-reduction plan. `agents/roadmaps/road-to-npm-payload-reduction.md` lands in this same change and carries the measured split: `src/scripts/` is 16.384 MB of the 28.604 MB unpacked payload (57.3 %, 1,158 files) and is the actual growth surface; `dist/agent-src/` is 8.040 MB; `src/agent-src/` is 1.347 MB and partly duplicates it, unmeasured until that roadmap's Phase 1.3. Its Phase 2.3 lowers this cap again, so `max: 9.1` still standing later is the visible signal the plan did not finish. A raise that defers the same debt a fourth time with no plan is a formality, so this one carries the plan. DECIDED BY: maintainer, on the PR that tripped it, chosen from numbered options carrying the measurements above rather than applied to make a red go away — and the write itself was performed by the maintainer, because the block-config-weakening guard refused four agent attempts at this file. That is the standing this file's `owner: maintainer` requires, enforced rather than asserted. MET A SECOND, INDEPENDENT RESET IN A MERGE, 2026-08-24: the drain's council-evidence-integrity branch reached the same diagnosis from the same measurement (main at 8.3911, 8.9 KB of headroom) and set 9.2 instead of 9.1, landing on trunk first. The HIGHER cap prevails and BOTH derivations are kept, because two independent readings converging on one trip cause is the strongest evidence this entry has ever carried — and dropping one of them would leave the record looking like a single unreviewed judgement. `last_measured` is re-measured on the merged tree rather than taken from either side, per the method every prior entry here prescribes.",
             "baseline_note_2026_08_20": "7.8 → 8.4 re-baselined 2026-08-20, and this is a RATCHET RESET rather than the config bent around a failing check — the discriminator the 2026-08-10 note demands, answered here. TRIP CAUSE: nothing was added. `origin/main` at cfd8426d9 measures 7.7916 under the documented conditions, and CI reads ~7 KB above the local figure, so trunk itself already stood ~8 KB below a 7.8 cap before the release branch existed; the 14.6.0 CHANGELOG entry (6.3 KB — a file on the release-PR shape allowlist, i.e. the release's own permitted payload) is what crossed it, at 7.7979 local / 7.805 CI. That is precisely the failure mode the 2026-08-10 note predicted in writing — 'a cap pinned just above the measurement reds on the next commit and teaches the reader to raise it again' — arriving on schedule, which is why the correction here is the headroom and not the payload. MEASURED, on a clean clone of each tree with the method `measurement_conditions` documents (unbuilt dist/, so dist/cli, dist/ui, dist/mcp and dist/hooks absent): main 7.7916 · release/14.6.0 7.7979 · CI 7.805 (Consistency job 96239721013). `last_measured` records CI's 7.805 — the enforcing environment and the higher of the disagreeing pair, per the same rule the 2026-08-10 note applied to its own. Max set to 8.4, ~7.6 % headroom over 7.805, which is the ~8 % both the 5.903/6.4 and 7.238/7.8 pairs carried: deliberately not a number that merely clears. ALTERNATIVE EXAMINED AND REJECTED, measured rather than argued: forcing the CHANGELOG era split early — the one payload reduction that IS on the release-PR allowlist, so it could have landed without touching main at all — moves the 144-line 14.5.0 section (7,266 bytes) into `docs/archive/`, which sits outside `files[]`. It saves 1.0 KB compressed (7.7979 → 7.7969). Prose compresses; a ~7 KB deficit cannot be closed by relocating 7 KB of prose. Recorded so it is not re-proposed as the cheap fix it looks like. NOT EXAMINED HERE, and named as the open question this raise defers rather than answers: `src/scripts/` is 14.9 MB of the 26.0 MB unpacked payload and is the actual growth surface, `src/agent-src/` partly duplicates `dist/agent-src/`, and whether a consumer needs the 846 KB `src/scripts/ai_council/` tree at all is unverified. Each is a structural change with its own blast radius, not a release-time edit — that belongs in a roadmap, and this raise buys the time to write one. A debt this note records, not one it discharges. DECIDED BY: maintainer, on the release that tripped it, in its own PR against main — `src/config/pack-size-budget.json` is not on the release-PR shape allowlist, so this cannot ride the release branch and is not smuggled into one.",
             "baseline_note_2026_08_10": "6.9 → 7.8 re-baselined 2026-08-10. WHICH OF THE TWO THIS IS, stated because the guard asks: a RATCHET RESET, not the config bent around a failing check — and the discriminator is that the payload is real and needed rather than that the check was inconvenient. The 44 KB is two source files a shipped instruction depends on, the cheaper alternative was examined and rejected on that ground (below), the new cap carries ~8% headroom over the higher of two disagreeing measurements rather than clearing by a hair, and the raise was put to the maintainer as a decision instead of applied to make a red go away. A reader who disagrees has everything needed to reverse it: the measurement, its method, the trip cause, and the rejected option. Maintainer-decided in the PR that tripped it, surfaced rather than smuggled — the same standing this file's `owner: maintainer` requires. MEASURED TWICE, and the two do not agree: CI reported 6.907 on this exact commit, a local run under the documented conditions reports 7.238. The 331 KB gap is UNEXPLAINED — the tree matches the pushed commit and only this file differs — so the cap is set over the HIGHER figure rather than the convenient one, and the discrepancy is recorded here as an open question instead of resolved by assumption. A third party reproducing this should expect either number and should not treat the lower one as authoritative. Separately, and this part IS understood: `npm pack --dry-run --ignore-scripts` in a worktree that has been BUILT reads 8.45, because the flag assumes dist/cli, dist/ui, dist/mcp and dist/hooks are absent and a built tree has them. That figure is not comparable to this budget and must never be written here — recorded because it is a trap the documented method invites. Trip cause: road-to-conformance-round5 Phase 3 added src/scripts/hooks/turn_end_gate_hook.ts (32 KB) and src/scripts/measure_turn_end_gate.ts (12 KB) in packed paths plus schema/template/contract growth, landing 7 KB over a 6.9 cap. Max set to 7.8 (~8% headroom over 7.238, and ~13% over CI's 6.907) for the reason the 2026-08-05 note already gives: a cap pinned just above the measurement reds on the next commit and teaches the reader to raise it again. ALTERNATIVE EXAMINED AND REJECTED, so it is not re-proposed: dropping measure_turn_end_gate.ts from the pack would have cleared the cap with room, but the settings description added in the same change instructs CONSUMERS to run that script against their own transcript store before arming the gate — excluding it would break a shipped instruction.",
             "baseline_note": "5.903 → 6.398 re-baselined 2026-08-05. This is a RE-BASELINE, not a carve-out for the change that tripped it: measured on the tracked tree, `origin/main` alone was already at 6.372 of a 6.4 cap, so 28 KB of headroom remained after months of accretion and the next legitimate addition of any size was going to cross it. The addition here is 26 KB — docs/contracts/settings-classes.md (the A/B/C fence, read at RUNTIME by the settings writer, so it must ship) plus src/server/io/yamlIO.ts (imported by that writer to preserve the user's comments). CI measures ~4 KB above the local figure because it regenerates dist/agent-src first. Max set to 6.9 rather than to a number that merely clears: a cap pinned 2 KB above the measurement reds on the next commit and teaches the reader to raise it again, which is how a budget becomes a formality. That restores the ~8% headroom the 5.903/6.4 pair originally carried. The `owner: maintainer` on this file stands — this raise is surfaced in the PR for that decision, not smuggled."

package/src/config/quorum-attendance-budget.json

@@ -1,11 +1,11 @@
 {
-    "_comment": "Pre-registered council ATTENDANCE metrics (road-to-inbox-harvest-2026-08-b Phase 1.4). Registered here rather than in roadmap prose because a roadmap is archived when it closes and a metric outlives it — the sibling budget files (hook-token-budget.json, recycle-threshold-budget.json) already carry the owner / review_by / honest-gap discipline this reuses. The instrument is the quorum_result line appendQuorumEvent writes to agents/runtime/council/events.log (schema v4 since the ADR-224 shadow floor added gate_class + floor_would_hold at v3 and min_present at v4; v2 lines carry none of the three and v3 lines carry no min_present, so a rate over them must exclude rather than assume them); nothing here is measured yet, and no threshold is committed before data exists.",
+    "_comment": "Pre-registered council ATTENDANCE metrics (road-to-inbox-harvest-2026-08-b Phase 1.4). Registered here rather than in roadmap prose because a roadmap is archived when it closes and a metric outlives it — the sibling budget files (hook-token-budget.json, recycle-threshold-budget.json) already carry the owner / review_by / honest-gap discipline this reuses. The instrument is the quorum_result line appendQuorumEvent writes to agents/runtime/council/events.log (schema v5 since road-to-council-evidence-integrity Phase 3 added stance_agreement, on top of the ADR-224 shadow floor which added gate_class + floor_would_hold at v3 and min_present at v4; v2 lines carry none of the three, v3 lines carry no min_present, and v4-and-earlier lines carry no stance_agreement, so a rate over them must exclude rather than assume them); nothing here is measured yet, and no threshold is committed before data exists.",
     "schema_version": 1,
     "registered_at": "2026-08-10",
     "owner": "maintainer",
     "review_by": "2026-11-10",
     "unit": "quorum_result event lines in agents/runtime/council/events.log",
-    "privacy": "a quorum_result line carries {phase, command, dispatch, verdict, threshold, configured_total, total, present, solo, gate_class, min_present, floor_would_hold, absent[{member, reason}]} — counts, closed vocabularies, booleans, and member ids only. The type has no field able to hold free-form content, so the CLI's own `detail` string (provider error text, which can embed paths and prompt fragments) is dropped at the boundary rather than scrubbed. The two v3 additions are booleans and the v4 addition is a small integer read from config, none of which can widen that surface.",
+    "privacy": "a quorum_result line carries {phase, command, dispatch, verdict, threshold, configured_total, total, present, solo, gate_class, min_present, floor_would_hold, absent[{member, reason}]} — counts, closed vocabularies, booleans, and member ids only. The type has no field able to hold free-form content, so the CLI's own `detail` string (provider error text, which can embed paths and prompt fragments) is dropped at the boundary rather than scrubbed. The two v3 additions are booleans, the v4 addition is a small integer read from config, and the v5 addition is a three-value closed vocabulary (consensus | split | not_tallied) derived from tally_stances — none of which can widen that surface. stance_agreement in particular carries no option LABEL: the labels members vote on are free-form member text, so recording which option won would have opened exactly the free-form hole the type is built to refuse.",
     "phase_split": "A pass emits `pre_run` (build_members — who could be constructed) and, on the `run` path, `post_run` (_postRunQuorum — who actually returned a usable response). They disagree whenever a member constructs and then fails mid-flight, so a rate computed over both double-counts. A `pre_run` line is NOT evidence a pass ran: `command: estimate` is a spend-free preview, and a `run` / `debate` line is written before the `--confirm` gate (which defaults to false and returns before any provider call) and before the necessity and size-fit gates. A `post_run` line is the only line that proves providers were called — which is why every rate below is post_run-scoped, and why `command` exists at all.",
     "attendance_rate": {
         "definition": "of the members that entered the pass, how many answered: present / total per post_run pass. Bounded by 1 by construction (evaluateQuorum clamps present into [0, total]).",
@@ -42,6 +42,14 @@
         "`command: debate` carries the pre_run half ONLY. There is no _postRunQuorum on the debate path, and defining `usable response` for a multi-round debate is a separate question this registration does not answer. So debate contributes to absent_reason_distribution and to nothing else: attendance_rate and solo_conclusion_rate cover the `run` path, and a reader must not read them as covering every metered pass.",
         "A pre_run line proves construction happened, never that a pass followed — the `--confirm` gate (default false), the necessity gate and the size-fit gate all abort afterwards and nothing on the line records it. Any count over pre_run lines is an upper bound; pair it with a post_run line before treating it as a pass.",
         "`gate_class` is `false` on EVERY line written so far and will stay false until a caller declares otherwise — nothing in the tree branches on QuorumStatus to hold a gate, so there is no gate-class caller to mark. shadow_floor_fire_rate is therefore a rate over ALL post_run passes, not over gate-class ones, and the gate-class-scoped rate ADR-224 actually cares about is UNMEASURED, not zero. Do not read a `false` majority as evidence that gate-class passes are rare; it is evidence that the concept has no consumer yet.",
-        "The CLI emit wiring itself has no test. The two modules are covered directly, but nothing exercises build_members / cmd_run / cmd_debate end-to-end against a captured log — and `_emitQuorumEvent` forwards no AppendEventOptions, so there is no target to capture into. Two defects in this file's first version (a `dispatch` written from the flag rather than the outcome, and a rate mixing config entries with clients) were found by review rather than by a test, which is what that gap costs."
-    ]
+        "The CLI emit wiring itself has no test. The two modules are covered directly, but nothing exercises build_members / cmd_run / cmd_debate end-to-end against a captured log — and `_emitQuorumEvent` forwards no AppendEventOptions, so there is no target to capture into. Two defects in this file's first version (a `dispatch` written from the flag rather than the outcome, and a rate mixing config entries with clients) were found by review rather than by a test, which is what that gap costs.",
+        "stance_agreement measures agreement among the members that ANSWERED and were parseable — it says nothing about a member that was absent or unparsed, which the attendance fields on the same line cover separately. A pass reading `1/2 present · stance_agreement: consensus` is one voice agreeing with itself, and the two fields must be read together; neither is a summary of the other."
+    ],
+    "stance_agreement_rate": {
+        "definition": "share of passes whose seats reached consensus: `stance_agreement: 'consensus'` over post_run/command=run lines AT SCHEMA >= 5. Three values, not a boolean, and the third is why this metric can exist honestly: stance tallying is opt-in and off by default, so most passes never ask the question — `not_tallied` records that, where a boolean would have been forced to write `false` and read as disagreement. Written by tally_stances' own verdict (`consensus !== null` vs `split`), never re-derived from the tally numbers here, the same one-definition discipline solo_conclusion_rate follows by deferring to isSoloConcluded.",
+        "instrument": "quorum_result lines, phase=post_run, command=run, field stance_agreement — replayed by `./scripts-run src/scripts/council_attendance_metrics`, which prints this rate next to its denominator and its excluded count",
+        "threshold": "none committed before data — baseline first, threshold at review date. Nothing is gated on this value and no pass is held, delayed or failed by it.",
+        "exclude_pre_v5_lines_or_the_rate_is_invented": "A v4-and-earlier line carries no stance_agreement field and NO honest value can be inferred for it: that pass may have run a tally whose verdict was never recorded, or none at all, and the line cannot tell you which. So the denominator is v5+ lines only. Defaulting the missing field to `not_tallied` manufactures a measurement out of an absence — on the committed span fixture it moves the rate from 1/3 to 1/6, a plausible number with nothing behind it. `attendance_metrics.test.ts` asserts both the exclusion and its mirror (dropping the v4 stratum must not move the rate), and the sabotage that defaults instead of excluding fails both.",
+        "denominator_is_not_the_attendance_denominator": "agreement_eligible is a SUBSET of passes, so this rate and the four above are computed over different populations and must never be presented as parts of one table without their own denominators printed. The replay prints both counts on the line for exactly that reason."
+    }
 }

package/src/config/rule-activation-census.json

@@ -1,8 +1,8 @@
 {
-    "_comment": "Rule-activation ratchet baseline (road-to-mixed-trigger-activation-cost step 4.1). Two axes: the scoped/mixed ID SETS are pinned by identity, and the unconditional token total may only walk DOWN. Raising a number here to clear a failing check is the config-weakening move this repo blocks by construction \u2014 every raise needs a baseline_history entry whose reason is a real sentence. Regenerate with `check_rule_activation_census --write-baseline`; never hand-edit the counts.",
+    "_comment": "Rule-activation ratchet baseline (road-to-mixed-trigger-activation-cost step 4.1). Two axes: the scoped/mixed ID SETS are pinned by identity, and the unconditional token total may only walk DOWN. Raising a number here to clear a failing check is the config-weakening move this repo blocks by construction — every raise needs a baseline_history entry whose reason is a real sentence. Regenerate with `check_rule_activation_census --write-baseline`; never hand-edit the counts.",
     "measured_at_commit": "unrecorded",
     "tokens_exact": true,
-    "unconditional_tokens": 111012,
+    "unconditional_tokens": 113699,
     "scoped_ids": [
         "design-review-after-ui-write",
         "roadmap-progress-sync",
@@ -39,11 +39,15 @@
         },
         {
             "date": "2026-08-20",
-            "reason": "Re-anchored WITH an authorized addition, not to clear a red: the new `recurring-criticism` rule plus the reconciling edits to `self-repair-loop` and `decision-revisit-gate`. The cost is structural, not sloppy authoring \u2014 the rule fires on a recurrence phrase in the USER PROMPT, and on Claude the emitter writes no `paths:` at all once any non-path trigger is present, so a prompt-triggered rule is unconditional by construction. There is no scoped variant of this obligation to choose instead: a path-scoped version would never see the prompt that triggers it, which is the whole mechanism. The body was already cut once for this reason (~45 percent, depth moved to guideline:agent-infra/recurring-criticism-mechanics, which is read on demand and costs nothing at session start); what remains is the Iron Law, the three-outcome table that is the anti-sycophancy guard, and the honest-enforcement paragraph. Trimming further would remove the reasoning the rule itself marks as the clause most likely to be trimmed. Delta 3575 tokens against a 2000 allowance, standing cost per session, stated rather than hidden."
+            "reason": "Re-anchored WITH an authorized addition, not to clear a red: the new `recurring-criticism` rule plus the reconciling edits to `self-repair-loop` and `decision-revisit-gate`. The cost is structural, not sloppy authoring — the rule fires on a recurrence phrase in the USER PROMPT, and on Claude the emitter writes no `paths:` at all once any non-path trigger is present, so a prompt-triggered rule is unconditional by construction. There is no scoped variant of this obligation to choose instead: a path-scoped version would never see the prompt that triggers it, which is the whole mechanism. The body was already cut once for this reason (~45 percent, depth moved to guideline:agent-infra/recurring-criticism-mechanics, which is read on demand and costs nothing at session start); what remains is the Iron Law, the three-outcome table that is the anti-sycophancy guard, and the honest-enforcement paragraph. Trimming further would remove the reasoning the rule itself marks as the clause most likely to be trimmed. Delta 3575 tokens against a 2000 allowance, standing cost per session, stated rather than hidden."
         },
         {
             "date": "2026-08-20",
             "reason": "Raised 103,265 -> 106,386 (+3,121) for one new rule, fix-what-you-see, added on maintainer instruction after a session identified a red check's cause, named the file's author, and handed it back unfixed. The rule permits exactly two dispositions -- fix it, or ship a tracked follow-up roadmap in the same change -- and removes ownership and note-only as escapes from active-remediation's ladder. WHAT THIS RE-ANCHOR EXPOSES, and it is the reason the entry is this long: the rule ships type auto rather than always because check_always_budget has two characters of headroom and its cap may only move down. That switch cleared the always gate and did NOT reduce the cost, because this census counts a rule as standing payload unless it is path-SCOPED, and a red CI check has no file pattern to scope on. So the two gates disagree about what a keyword-triggered rule costs, and the auto downgrade moved the same 3,121 tokens from a budget that refuses them into one that only asks for a sentence. Stated rather than exploited: the honest reading is that this rule costs standing payload whatever its type says, and the always-vs-auto choice bought delivery breadth, not weight."
+        },
+        {
+            "date": "2026-08-23",
+            "reason": "Re-anchored for one new rule, playbook-precedence, which ships with ADR-244's sixth context type and states that a repository's OWN configured playbook outranks a shipped skill for the same task. WHY THE DELTA IS THIS LARGE, stated rather than implied: the rule is 4,398 chars of source, but it declares seven triggers and every one of them is a keyword or phrase, so the emitter writes NO `paths:` block at all and the host loads it in every session -- the same mixed-trigger cost `ui-audit-gate` and `design-review-after-ui-write` each paid before being re-scoped to paths in road-to-mixed-trigger-activation-cost Phase 2. That is the honest reading of this number: it is not the price of the obligation, it is the price of expressing the obligation with keywords. A playbook lives at a known location, so a path-scoped form is available and would return most of these tokens; it is not cut here because the trigger set is the rule author's design decision and re-cutting it inside a merge-queue drain would change routing behaviour nobody reviewed. Recorded as the next candidate for that Phase-2 treatment rather than silently absorbed."
         }
     ]
 }

package/src/config/rule-enforcement-baseline.json

@@ -19,7 +19,6 @@
   "content-quoting-floor.md",
   "copilot-routing.md",
   "cross-source-consistency.md",
-  "decision-revisit-gate.md",
   "delegation-policy.md",
   "design-fidelity.md",
   "devcontainer-routing.md",