@event4u/agent-config 14.10.0 → 14.12.0

package/src/config/hook-token-budget.json

@@ -1,126 +1,138 @@
 {
-    "_comment": "Pre-registered hook-INJECTION byte budget (road-to-token-economy-cache Phase 3) — the latency file's twin: same discipline, different unit. Committed BEFORE any trimming lands; the budget is the acceptance bar, not a post-hoc fit. Bytes, not tokens, as the deterministic CI unit (no tokenizer dependency — roadmap non-goal 7.6); token-exact numbers appear only in ledger-based telemetry. Consumed by scripts/bench_hook_injection and its CI gate: a concern whose measured emission (reason + additional_context + context bytes) exceeds its row fails the build, and an EMITTING concern with no row fails the build — a new injector cannot ship without a budget row.",
-    "schema_version": 1,
-    "registered_at": "2026-08-10",
-    "owner": "maintainer",
-    "review_by": "2026-11-10",
-    "unit": "bytes of concern stdout payload fields (reason + additional_context + context) per fire",
-    "default_cap_bytes": 1024,
-    "per_concern_caps_bytes": {
-        "_comment": "Named exceptions above the default, each with its reason. Absent concern = default_cap_bytes.",
-        "hot-context": 4096,
-        "hot-context_reason": "400-word working-memory restore, session_start only — one-shot, not per-turn",
-        "handoff-context": 8192,
-        "handoff-context_reason": "consume-once handoff injection, deleted after delivery — the one legitimately large one-shot",
-        "session-canary": 2048,
-        "session-canary_reason": "full canary contract once at session_start; the per-turn beat is one line",
-        "language-mirror": 2048,
-        "language-mirror_reason": "the measured 626-wrong-turn failure class justifies a full-paragraph pin per turn",
-        "council-availability": 1536,
-        "council-availability_reason": "session_start availability block incl. resolved path + member list",
-        "session-register": 2048,
-        "session-register_reason": "collision listing scales with live sessions; capped, not unbounded",
-        "chat-history": 4096,
-        "chat-history_reason": "session_start restore block",
-        "edit-shape": 1024,
-        "edit-shape_reason": "one advisory line naming the cheaper edit primitive (roadmap 5.2: budget row from day one - the economy nudge must not itself become an economy problem)",
-        "reread-guard": 1024,
-        "reread-guard_reason": "one advisory line naming the earlier read / ranged alternative (roadmap 6.1)",
-        "session-eol": 1024,
-        "session-eol_reason": "one recycle-advisory line, once per session past the committed threshold (road-to-token-economy-recycling 3.2); recording itself emits nothing",
-        "skill-route": 512,
-        "skill-route_reason": "road-to-inbox-harvest-2026-08-d-runtime-skill-routing 2.1: one line carrying at most three skill ids and their scores - pointers, never bodies. Registered BELOW the 1024 default deliberately: this row is the ceiling that keeps it a pointer line, so a later change that starts injecting descriptions fails the build instead of quietly doubling a per-turn slot that already carries nine other concerns under a 4096-byte sum cap"
-    },
-    "per_slot_sum_caps_bytes": {
-        "_comment": "Cross-concern per-fire sum per slot (roadmap 3.1). session_start is one-time and may carry the restore payloads; per-turn slots stay tight.",
-        "session_start": 16384,
-        "user_prompt_submit": 4096,
-        "pre_tool_use": 2048,
-        "post_tool_use": 2048,
-        "stop": 2048,
-        "session_end": 1024,
-        "pre_compact": 2048,
-        "agent_error": 1024
-    },
-    "per_turn_aggregate_bytes": {
-        "_comment": "road-to-standing-context-40k Phase 4 step 4.1 — the sum the USER feels, which no row above could see. The per-slot caps bound ONE fire; a turn fires user_prompt_submit once, pre_tool_use and post_tool_use once per tool call, and stop once, so the number a turn actually injects is a multiple of them and was unregistered. This row is the injection twin of `per_turn_composite` in hook-latency-budget.json: same definition shape, same tool_calls, different unit. bench_hook_injection derives and prints it on every run; the DISPATCHER enforces `ceiling_bytes` at runtime by dropping lowest-severity advisories first (src/scripts/hooks/injection_budget.ts), exempting severity:blocking and fail_closed concerns by construction so the policy can never hide a safety-relevant warning.",
-        "owner": "maintainer",
-        "review_by": "2026-11-10",
-        "definition": "(pre_tool_use + post_tool_use) x tool_calls + user_prompt_submit + stop",
-        "tool_calls": 10,
-        "tool_calls_rationale": "Taken verbatim from hook-latency-budget.json's per_turn_composite rather than re-derived. Two definitions of 'a representative turn' in one repo is how two people compute two different composites and both call their row green.",
-        "slots_counted": ["user_prompt_submit", "pre_tool_use", "post_tool_use", "stop"],
-        "excluded_slots": ["session_start", "session_end", "pre_compact", "agent_error"],
-        "excluded_slots_rationale": "session_start is excluded BY THE STEP: it is the one-shot restore slot that legitimately carries hot-context, handoff-context and the canary contract, and capping it against a per-turn number would evict exactly the payloads it exists to deliver. The other three are not per-turn events at all.",
-        "ceiling_bytes": 47104,
-        "ceiling_derivation": "NOT a fresh number, and deliberately so: it is the arithmetic consequence of the per_slot_sum_caps_bytes rows already registered above — 4096 + (2048 + 2048) x 10 + 2048. A tighter per-turn ceiling would contradict per-slot rows that are already the committed decision, and a looser one would let the composition exceed what every part was capped at. Tightening it is a decision about those rows, taken there, in a PR.",
-        "gate_on_ceiling": false,
-        "gate_on_ceiling_rationale": "The bench REPORTS the aggregate but does not red the build on it yet — the first-reading discipline the latency twin's observe_only flag encodes. Measured 2026-08-19 under the committed fixtures: ~1,142 B against a 47,104 B ceiling, i.e. the row is registered roughly forty times above any reading that exists. The reading MOVES between runs — 922, 1,140 and 1,142 B observed within one hour — and the mechanism is worth naming precisely rather than as 'flaky': the stop-slot end-review-nudge sizes its line from the branch's own mutation volume, and replay skips its writes but not its reads, so the number grows as the working branch grows. That is a pre-existing bench non-determinism this row surfaces rather than introduces, and it is the strongest single reason not to arm the ceiling against it. Arming a ceiling nobody has ever approached would gate on an untested inequality. Runtime enforcement is NOT gated by this flag and is always on: this flag governs CI, the ceiling governs the live session.",
-        "honest_null_consequence": "If the census shows real turns sitting near the ceiling, the per-slot rows move first and this row follows from them. If real turns never approach it, the row is a bound that costs nothing and the finding is published at review date either way."
-    },
-    "injection_load_metric": {
-        "definition": "Roadmap 3.4: total injected bytes per session and per turn, hook-carried. The census mode of bench_hook_injection (--record) appends counts-only lines to agents/runtime/state/injection-census.jsonl; the caps above are the thresholds; breach trend at review date decides tighten vs relax — by evidence, in a PR. The census is also the repeat-injection-census blocker's instrument (one instrumented week ranks the repeaters for the 3.3 idempotency gate).",
-        "privacy": "census lines carry {ts, slot, concern, bytes} — counts and ids only, never content"
-    },
-    "honest_null_consequence": "If real-session census data shows the caps are systematically wrong (either direction), the caps move by evidence in a PR at review date — never silently. A budget nobody benches is the fossilization failure this file's latency twin avoided via its CI harness; bench_hook_injection is wired into the same pipeline in the same phase.",
-    "advisory_adoption_metrics": {
-        "_comment": "Roadmap 5.3 + 6.4 registrations. These are BEHAVIOUR metrics (advisory adoption), not injection bytes - registered here because this file already carries the owner/review discipline for the same concerns.",
-        "owner": "maintainer",
-        "review_by": "2026-11-10",
-        "skill_route_pointer_rate": {
-            "definition": "road-to-inbox-harvest-2026-08-d-runtime-skill-routing 2.2: skill-route fires / user_prompt_submit events per session - the share of prompts where the deterministic ranker cleared its measured p90 floor and injected pointers. NO THRESHOLD IS COMMITTED, deliberately and by the house baseline-first rule: the TRIGGER is calibrated (top-1 >= 30/100, the p90 of 496 routing-matrix prompt lines, expected to fire on ~13.9%), the OUTCOME is not. Kill standard as for the sibling nudges: a nudge whose pointers are measurably ignored over the review window gets its floor raised or its line removed. Expected fire rate is the falsifier for the trigger half - a live rate far from 13.9% means the corpus is not representative of real prompts, which is a finding about the corpus and is published either way.",
-            "instrument": "rule-trips.json warn counters for the skill-route concern (fires) + conformance audits for whether the pointed-at skill was opened (adoption); HONEST GAP: no deterministic counter exists for 'the agent acted on the pointer' - the numerator is audit-carried and registered as such rather than implied to be automatic",
-            "threshold": "none committed before data - baseline first, threshold at review date (2026-11-10)"
-        },
-        "skill_route_bare_suppression_rate": {
-            "definition": "road-to-catalogue-host-fit Phase 3 step 3.2: of the prompts where skill-route FIRES, the share whose warn reason carries `N suppressed as host-bare` - i.e. how often a skill the ranker wanted to POINT AT is one the current host is KNOWN to have delivered without its description. `N` counts the pointer window (TOP_K of the unfiltered ranking), never the whole ranked list: `rank` returns every non-zero-scoring skill, so counting the tail would let a bare name at rank 40 - never pointable, never a loss - bump the count on nearly every fire (R2 finding 1). Registered beside skill_route_pointer_rate because it measures the same concern's behaviour under the same owner and review date. NO THRESHOLD IS COMMITTED, and the refusal is inherited from the sibling rather than restated: the FILTER is derived from a measurement (all 16 bare entries in the 2026-08-12 claude observation are in the ranker's catalogue, `capture_skill_catalogue --pointable-bare`), the OUTCOME - whether suppressing them changes what the agent does - is not.",
-            "instrument": "the dispatcher's warn reason string for the skill-route concern (`, N suppressed as host-bare`, appended only when non-zero) + agents/evidence/metrics/skill-catalogue.jsonl for the population; TWO HONEST GAPS, both registered as gaps rather than implied to be automatic. (1) rule-trips.json counts fires per concern and does NOT retain the reason, so the numerator is log-carried, not counter-carried - the same posture the sibling metric takes for its own audit-carried numerator. (2) TOTAL suppression is INVISIBLE here by construction (R2 finding 4): when the filter empties the pointer set the concern returns before writing stdout, so no reason line exists for the one case the roadmap calls load-bearing. `RouteDecision.suppressed` carries it at the API boundary and nothing reads that in production.",
-            "threshold": "none committed before data - baseline first, threshold at the shared review date (2026-11-10)",
-            "falsifiers": "For the FILTER half only, never for the outcome. UPPER: a live rate far above the share of the pointer window the host degrades means the ranker preferentially ranks exactly what the host drops - a finding about the projection, which belongs to Phase 2. Name the populations rather than a bare ratio, because three different denominators are in play and an earlier draft of this row conflated them (R2 finding 11): the 2026-08-12 claude observation carries `entries_total` 336, of which only 35 were enumerated at all (16 bare + 19 described), against a ranker catalogue of 338 entries at probe time. The comparable share is 16 of the 35 ENUMERATED entries; 16/336 and 16/338 describe different things and neither is this metric's denominator. LOWER: a rate of 0 does NOT establish that the ranker and the host's bare set fail to intersect - gap (2) above makes complete suppression indistinguishable from no suppression in this instrument. `capture_skill_catalogue --pointable-bare` is the instrument that separates them, and it must be read before any zero here is interpreted."
-        },
-        "full_rewrite_small_diff_rate": {
-            "definition": "edit-shape fires / Write calls per session (the full-rewrite-with-small-diff rate). Kill criterion per the shipped nudge standard: a nudge whose verdicts are measurably ignored (adoption near zero over the review window, from conformance audits) gets its trigger tightened or the injected line removed.",
-            "instrument": "rule-trips.json warn counters (the dispatcher already counts every warn per concern) + conformance audits for adoption"
-        },
-        "duplicate_read_rate": {
-            "definition": "reread-guard fires / Read calls per session; re-read advisory adoption via conformance audits. Same kill standard.",
-            "instrument": "rule-trips.json warn counters per concern"
-        },
-        "unbounded_output_advisory_rate": {
-            "definition": "Roadmap 4.3 + 4.4 registration (advisory-degraded per the resolved pretooluse-rewrite-semantics blocker: no updatedInput in the v1 contract, so nothing caps and nothing can be bypassed - the demand signal is the fire count itself). rtk-wrap cap-advisory fires per session from the OUTPUT_CAP_TABLE branch; adoption (did the next run use a bounded form) via conformance audits. GAP CLOSED 2026-08-15 (road-to-inbox-harvest-2026-08-d-context-ledger Step 1.1): the tool-result byte counter now exists and its stream is registered below as `tool_result_bytes`. The pre/post bytes half of roadmap 4.4 is measurable from that census once it carries data; it stays unread, not unmeasurable, until a baseline is published.",
-            "instrument": "rule-trips.json warn counters for the rtk-wrap concern + conformance audits",
-            "threshold": "none committed before data - baseline first, threshold at review date"
-        },
-        "tool_result_bytes": {
-            "definition": "road-to-inbox-harvest-2026-08-d-context-ledger 1.1: UTF-8 bytes of every tool RESULT entering context, per call, keyed by tool name. Closes the gap `unbounded_output_advisory_rate` registered above - the injection census measures what this suite puts into context, this measures what the host's tools do, and the second is the larger term. CAPTURE ONLY: the concern emits zero bytes to the model, so it carries no per-concern injection cap; it is registered here because this file already owns the owner/review discipline for context-cost instruments.",
-            "instrument": "the `tool-result-bytes` concern (src/scripts/hooks/tool_result_bytes_hook.ts) on post_tool_use, appending {ts, tool, bytes, measurable} to agents/runtime/state/tool-result-census.jsonl",
-            "privacy": "census lines carry a tool NAME, a byte COUNT and a timestamp - the record type has no field able to hold file contents, command output or any free text, so there is no scrubber that can fail",
-            "threshold": "none committed before data - baseline first, threshold at review date. A `measurable: false` line means the host's payload carried no readable result; that absence is itself a coverage finding and is never counted as zero bytes"
-        },
-        "turns_per_task": {
-            "definition": "user_prompt_submit count keyed to the task envelope - the invisible multiplier (every turn re-pays the accumulated context at read rates).",
-            "instrument": "session-register / chat-history turn counters; HONEST GAP: no task-envelope key exists yet in those counters - the number is per-SESSION until a task key ships; registered with that stated limitation rather than silently redefined",
-            "threshold": "none committed before data - baseline first, threshold at review date"
-        },
-        "recycle_advisory_adoption": {
-            "definition": "road-to-token-economy-recycling 3.4: of the sessions where the session-eol recycle advisory fired, the share that actually recycled (a recycle-envelope.consumed.json produced by a successor session start). Kill standard as for the sibling nudges: adoption near zero over the review window means the advisory line is dead weight - tighten the trigger or remove the line.",
-            "instrument": "rule-trips.json warn counters for the session-eol concern (fires) + presence/turnover of agents/runtime/state/recycle-envelope.consumed.json and session-eol per-session state (recycles); conformance audits for the denominator detail",
-            "threshold": "none committed before data - baseline first, threshold at review date (2026-11-10)"
-        },
-        "auto_compact_incidence": {
-            "definition": "road-to-token-economy-recycling 3.4: sessions with >=1 auto compact_boundary event / all sessions, from the session-eol per-session counters (baseline: 11.2%, 23/205 sessions - agents/evidence/analysis/token-economy-recycling-phase1.md). TARGET DIRECTION: trends toward zero as recycle adoption rises; a flat or rising incidence with rising adoption falsifies the mechanism.",
-            "instrument": "session-eol state files (compactions[] counters) aggregated by session_eol_report; the marker-drift alarm in the same report guards the detector against silent host shape changes",
-            "threshold": "baseline 11.2%; direction-only target (down) until the review date"
-        },
-        "envelope_resume_success": {
-            "definition": "road-to-token-economy-recycling 3.4: successor sessions that completed the recycled task WITHOUT re-asking for state the envelope should have carried - i.e. the 2.1 not_carried_forward list staying honest (everything else was carried; the successor re-derived only what the list named).",
-            "instrument": "conformance audits over successor-session transcripts (the consumed envelope names the task; the audit checks the successor's first turns for state re-asks); HONEST GAP: no deterministic counter exists for 'had to re-ask' - this is audit-carried and registered as such",
-            "threshold": "none committed before data - baseline first, threshold at review date"
-        },
-        "post_recycle_verify_fail_vs_baseline": {
-            "definition": "road-to-token-economy-recycling 3.4, the falsifiable core: verify-fail rate of recycled successor sessions vs the long-session baseline. PUBLISH-IF-WORSE COMMITMENT, pre-registered before data exists: if recycled sessions verify WORSE, the result is published and the threshold (recycle-threshold-budget.json) or the envelope schema revises in a PR citing the numbers - the claim never survives on vibes.",
-            "instrument": "session-eol per-session state (recycled or not) joined with verify outcomes from conformance audits / review_skipped telemetry; HONEST GAP: transcripts carry no verify-outcome field, so the join is audit-carried until a verify-outcome counter ships",
-            "threshold": "comparison metric - no absolute threshold; verdict recorded at review date whichever way it went"
-        }
-    }
-}
+ "_comment": "Pre-registered hook-INJECTION byte budget (road-to-token-economy-cache Phase 3) — the latency file's twin: same discipline, different unit. Committed BEFORE any trimming lands; the budget is the acceptance bar, not a post-hoc fit. Bytes, not tokens, as the deterministic CI unit (no tokenizer dependency — roadmap non-goal 7.6); token-exact numbers appear only in ledger-based telemetry. Consumed by scripts/bench_hook_injection and its CI gate: a concern whose measured emission (reason + additional_context + context bytes) exceeds its row fails the build, and an EMITTING concern with no row fails the build — a new injector cannot ship without a budget row.",
+ "schema_version": 1,
+ "registered_at": "2026-08-10",
+ "owner": "maintainer",
+ "review_by": "2026-11-10",
+ "unit": "bytes of concern stdout payload fields (reason + additional_context + context) per fire",
+ "default_cap_bytes": 1024,
+ "per_concern_caps_bytes": {
+  "_comment": "Named exceptions above the default, each with its reason. Absent concern = default_cap_bytes.",
+  "hot-context": 4096,
+  "hot-context_reason": "400-word working-memory restore, session_start only — one-shot, not per-turn",
+  "handoff-context": 8192,
+  "handoff-context_reason": "consume-once handoff injection, deleted after delivery — the one legitimately large one-shot",
+  "session-canary": 2048,
+  "session-canary_reason": "full canary contract once at session_start; the per-turn beat is one line",
+  "language-mirror": 2048,
+  "language-mirror_reason": "the measured 626-wrong-turn failure class justifies a full-paragraph pin per turn",
+  "council-availability": 1536,
+  "council-availability_reason": "session_start availability block incl. resolved path + member list",
+  "session-register": 2048,
+  "session-register_reason": "collision listing scales with live sessions; capped, not unbounded",
+  "chat-history": 4096,
+  "chat-history_reason": "session_start restore block",
+  "edit-shape": 1024,
+  "edit-shape_reason": "one advisory line naming the cheaper edit primitive (roadmap 5.2: budget row from day one - the economy nudge must not itself become an economy problem)",
+  "reread-guard": 1024,
+  "reread-guard_reason": "one advisory line naming the earlier read / ranged alternative (roadmap 6.1)",
+  "session-eol": 1024,
+  "session-eol_reason": "one recycle-advisory line, once per session past the committed threshold (road-to-token-economy-recycling 3.2); recording itself emits nothing",
+  "skill-route": 512,
+  "skill-route_reason": "road-to-inbox-harvest-2026-08-d-runtime-skill-routing 2.1: one line carrying at most three skill ids and their scores - pointers, never bodies. Registered BELOW the 1024 default deliberately: this row is the ceiling that keeps it a pointer line, so a later change that starts injecting descriptions fails the build instead of quietly doubling a per-turn slot that already carries nine other concerns under a 4096-byte sum cap",
+  "rule-inject": 20480,
+  "rule-inject_reason": "road-to-trigger-delivered-rule-bodies 1.1: this concern delivers rule BODIES, not a pointer line, so its ceiling is the per-prompt token cap converted to bytes rather than a measured emission - 5,000 exact-BPE tokens (the p90 of the matched-body-token distribution over tests/eval/routing-matrix, rounded up to 500, reproduced by `model_rule_injection --corpus tests/eval/routing-matrix`) at ~4 bytes/token. Registered ABOVE the 4,096-byte user_prompt_submit and 2,048-byte pre_tool_use slot sums ON PURPOSE, and the mismatch is the finding rather than an oversight: the concern is default-OFF and emits ZERO bytes under every shipped setting, so no slot sum is breached today. The run that flips `lean_projection.mode: delivery` is the run that must move those two slot rows - that is the activation charge step 1.7 defers, and it is recorded here so the flip cannot be taken without meeting it."
+ },
+ "per_slot_sum_caps_bytes": {
+  "_comment": "Cross-concern per-fire sum per slot (roadmap 3.1). session_start is one-time and may carry the restore payloads; per-turn slots stay tight.",
+  "session_start": 16384,
+  "user_prompt_submit": 4096,
+  "pre_tool_use": 2048,
+  "post_tool_use": 2048,
+  "stop": 2048,
+  "session_end": 1024,
+  "pre_compact": 2048,
+  "agent_error": 1024
+ },
+ "per_turn_aggregate_bytes": {
+  "_comment": "road-to-standing-context-40k Phase 4 step 4.1 — the sum the USER feels, which no row above could see. The per-slot caps bound ONE fire; a turn fires user_prompt_submit once, pre_tool_use and post_tool_use once per tool call, and stop once, so the number a turn actually injects is a multiple of them and was unregistered. This row is the injection twin of `per_turn_composite` in hook-latency-budget.json: same definition shape, same tool_calls, different unit. bench_hook_injection derives and prints it on every run; the DISPATCHER enforces `ceiling_bytes` at runtime by dropping lowest-severity advisories first (src/scripts/hooks/injection_budget.ts), exempting severity:blocking and fail_closed concerns by construction so the policy can never hide a safety-relevant warning.",
+  "owner": "maintainer",
+  "review_by": "2026-11-10",
+  "definition": "(pre_tool_use + post_tool_use) x tool_calls + user_prompt_submit + stop",
+  "tool_calls": 10,
+  "tool_calls_rationale": "Taken verbatim from hook-latency-budget.json's per_turn_composite rather than re-derived. Two definitions of 'a representative turn' in one repo is how two people compute two different composites and both call their row green.",
+  "slots_counted": [
+   "user_prompt_submit",
+   "pre_tool_use",
+   "post_tool_use",
+   "stop"
+  ],
+  "excluded_slots": [
+   "session_start",
+   "session_end",
+   "pre_compact",
+   "agent_error"
+  ],
+  "excluded_slots_rationale": "session_start is excluded BY THE STEP: it is the one-shot restore slot that legitimately carries hot-context, handoff-context and the canary contract, and capping it against a per-turn number would evict exactly the payloads it exists to deliver. The other three are not per-turn events at all.",
+  "ceiling_bytes": 47104,
+  "ceiling_derivation": "NOT a fresh number, and deliberately so: it is the arithmetic consequence of the per_slot_sum_caps_bytes rows already registered above — 4096 + (2048 + 2048) x 10 + 2048. A tighter per-turn ceiling would contradict per-slot rows that are already the committed decision, and a looser one would let the composition exceed what every part was capped at. Tightening it is a decision about those rows, taken there, in a PR.",
+  "gate_on_ceiling": false,
+  "gate_on_ceiling_rationale": "The bench REPORTS the aggregate but does not red the build on it yet — the first-reading discipline the latency twin's observe_only flag encodes. Measured 2026-08-19 under the committed fixtures: ~1,142 B against a 47,104 B ceiling, i.e. the row is registered roughly forty times above any reading that exists. The reading MOVES between runs — 922, 1,140 and 1,142 B observed within one hour — and the mechanism is worth naming precisely rather than as 'flaky': the stop-slot end-review-nudge sizes its line from the branch's own mutation volume, and replay skips its writes but not its reads, so the number grows as the working branch grows. That is a pre-existing bench non-determinism this row surfaces rather than introduces, and it is the strongest single reason not to arm the ceiling against it. Arming a ceiling nobody has ever approached would gate on an untested inequality. Runtime enforcement is NOT gated by this flag and is always on: this flag governs CI, the ceiling governs the live session.",
+  "honest_null_consequence": "If the census shows real turns sitting near the ceiling, the per-slot rows move first and this row follows from them. If real turns never approach it, the row is a bound that costs nothing and the finding is published at review date either way."
+ },
+ "injection_load_metric": {
+  "definition": "Roadmap 3.4: total injected bytes per session and per turn, hook-carried. The census mode of bench_hook_injection (--record) appends counts-only lines to agents/runtime/state/injection-census.jsonl; the caps above are the thresholds; breach trend at review date decides tighten vs relax — by evidence, in a PR. The census is also the repeat-injection-census blocker's instrument (one instrumented week ranks the repeaters for the 3.3 idempotency gate).",
+  "privacy": "census lines carry {ts, slot, concern, bytes} — counts and ids only, never content"
+ },
+ "honest_null_consequence": "If real-session census data shows the caps are systematically wrong (either direction), the caps move by evidence in a PR at review date — never silently. A budget nobody benches is the fossilization failure this file's latency twin avoided via its CI harness; bench_hook_injection is wired into the same pipeline in the same phase.",
+ "advisory_adoption_metrics": {
+  "_comment": "Roadmap 5.3 + 6.4 registrations. These are BEHAVIOUR metrics (advisory adoption), not injection bytes - registered here because this file already carries the owner/review discipline for the same concerns.",
+  "owner": "maintainer",
+  "review_by": "2026-11-10",
+  "skill_route_pointer_rate": {
+   "definition": "road-to-inbox-harvest-2026-08-d-runtime-skill-routing 2.2: skill-route fires / user_prompt_submit events per session - the share of prompts where the deterministic ranker cleared its measured p90 floor and injected pointers. NO THRESHOLD IS COMMITTED, deliberately and by the house baseline-first rule: the TRIGGER is calibrated (top-1 >= 30/100, the p90 of 496 routing-matrix prompt lines, expected to fire on ~13.9%), the OUTCOME is not. Kill standard as for the sibling nudges: a nudge whose pointers are measurably ignored over the review window gets its floor raised or its line removed. Expected fire rate is the falsifier for the trigger half - a live rate far from 13.9% means the corpus is not representative of real prompts, which is a finding about the corpus and is published either way.",
+   "instrument": "rule-trips.json warn counters for the skill-route concern (fires) + conformance audits for whether the pointed-at skill was opened (adoption); HONEST GAP: no deterministic counter exists for 'the agent acted on the pointer' - the numerator is audit-carried and registered as such rather than implied to be automatic",
+   "threshold": "none committed before data - baseline first, threshold at review date (2026-11-10)"
+  },
+  "skill_route_bare_suppression_rate": {
+   "definition": "road-to-catalogue-host-fit Phase 3 step 3.2: of the prompts where skill-route FIRES, the share whose warn reason carries `N suppressed as host-bare` - i.e. how often a skill the ranker wanted to POINT AT is one the current host is KNOWN to have delivered without its description. `N` counts the pointer window (TOP_K of the unfiltered ranking), never the whole ranked list: `rank` returns every non-zero-scoring skill, so counting the tail would let a bare name at rank 40 - never pointable, never a loss - bump the count on nearly every fire (R2 finding 1). Registered beside skill_route_pointer_rate because it measures the same concern's behaviour under the same owner and review date. NO THRESHOLD IS COMMITTED, and the refusal is inherited from the sibling rather than restated: the FILTER is derived from a measurement (all 16 bare entries in the 2026-08-12 claude observation are in the ranker's catalogue, `capture_skill_catalogue --pointable-bare`), the OUTCOME - whether suppressing them changes what the agent does - is not.",
+   "instrument": "the dispatcher's warn reason string for the skill-route concern (`, N suppressed as host-bare`, appended only when non-zero) + agents/evidence/metrics/skill-catalogue.jsonl for the population; TWO HONEST GAPS, both registered as gaps rather than implied to be automatic. (1) rule-trips.json counts fires per concern and does NOT retain the reason, so the numerator is log-carried, not counter-carried - the same posture the sibling metric takes for its own audit-carried numerator. (2) TOTAL suppression is INVISIBLE here by construction (R2 finding 4): when the filter empties the pointer set the concern returns before writing stdout, so no reason line exists for the one case the roadmap calls load-bearing. `RouteDecision.suppressed` carries it at the API boundary and nothing reads that in production.",
+   "threshold": "none committed before data - baseline first, threshold at the shared review date (2026-11-10)",
+   "falsifiers": "For the FILTER half only, never for the outcome. UPPER: a live rate far above the share of the pointer window the host degrades means the ranker preferentially ranks exactly what the host drops - a finding about the projection, which belongs to Phase 2. Name the populations rather than a bare ratio, because three different denominators are in play and an earlier draft of this row conflated them (R2 finding 11): the 2026-08-12 claude observation carries `entries_total` 336, of which only 35 were enumerated at all (16 bare + 19 described), against a ranker catalogue of 338 entries at probe time. The comparable share is 16 of the 35 ENUMERATED entries; 16/336 and 16/338 describe different things and neither is this metric's denominator. LOWER: a rate of 0 does NOT establish that the ranker and the host's bare set fail to intersect - gap (2) above makes complete suppression indistinguishable from no suppression in this instrument. `capture_skill_catalogue --pointable-bare` is the instrument that separates them, and it must be read before any zero here is interpreted."
+  },
+  "full_rewrite_small_diff_rate": {
+   "definition": "edit-shape fires / Write calls per session (the full-rewrite-with-small-diff rate). Kill criterion per the shipped nudge standard: a nudge whose verdicts are measurably ignored (adoption near zero over the review window, from conformance audits) gets its trigger tightened or the injected line removed.",
+   "instrument": "rule-trips.json warn counters (the dispatcher already counts every warn per concern) + conformance audits for adoption"
+  },
+  "duplicate_read_rate": {
+   "definition": "reread-guard fires / Read calls per session; re-read advisory adoption via conformance audits. Same kill standard.",
+   "instrument": "rule-trips.json warn counters per concern"
+  },
+  "unbounded_output_advisory_rate": {
+   "definition": "Roadmap 4.3 + 4.4 registration (advisory-degraded per the resolved pretooluse-rewrite-semantics blocker: CAUSE CORRECTED 2026-08-23: this said 'no updatedInput in the v1 contract', which is false for Claude Code 2.1.241 -- the host documents and schema-validates the field (agents/evidence/analysis/host-input-rewrite-probe-2026-08-23.md). The real cause is that THIS dispatcher emits no such field and carries no accepted composition policy for one across concerns, so nothing caps and nothing can be bypassed - the demand signal is the fire count itself). rtk-wrap cap-advisory fires per session from the OUTPUT_CAP_TABLE branch; adoption (did the next run use a bounded form) via conformance audits. GAP CLOSED 2026-08-15 (road-to-inbox-harvest-2026-08-d-context-ledger Step 1.1): the tool-result byte counter now exists and its stream is registered below as `tool_result_bytes`. The pre/post bytes half of roadmap 4.4 is measurable from that census once it carries data; it stays unread, not unmeasurable, until a baseline is published.",
+   "instrument": "rule-trips.json warn counters for the rtk-wrap concern + conformance audits",
+   "threshold": "none committed before data - baseline first, threshold at review date"
+  },
+  "tool_result_bytes": {
+   "definition": "road-to-inbox-harvest-2026-08-d-context-ledger 1.1: UTF-8 bytes of every tool RESULT entering context, per call, keyed by tool name. Closes the gap `unbounded_output_advisory_rate` registered above - the injection census measures what this suite puts into context, this measures what the host's tools do, and the second is the larger term. CAPTURE ONLY: the concern emits zero bytes to the model, so it carries no per-concern injection cap; it is registered here because this file already owns the owner/review discipline for context-cost instruments.",
+   "instrument": "the `tool-result-bytes` concern (src/scripts/hooks/tool_result_bytes_hook.ts) on post_tool_use, appending {ts, tool, bytes, measurable} to agents/runtime/state/tool-result-census.jsonl",
+   "privacy": "census lines carry a tool NAME, a byte COUNT and a timestamp - the record type has no field able to hold file contents, command output or any free text, so there is no scrubber that can fail",
+   "threshold": "none committed before data - baseline first, threshold at review date. A `measurable: false` line means the host's payload carried no readable result; that absence is itself a coverage finding and is never counted as zero bytes"
+  },
+  "turns_per_task": {
+   "definition": "user_prompt_submit count keyed to the task envelope - the invisible multiplier (every turn re-pays the accumulated context at read rates).",
+   "instrument": "session-register / chat-history turn counters; HONEST GAP: no task-envelope key exists yet in those counters - the number is per-SESSION until a task key ships; registered with that stated limitation rather than silently redefined",
+   "threshold": "none committed before data - baseline first, threshold at review date"
+  },
+  "recycle_advisory_adoption": {
+   "definition": "road-to-token-economy-recycling 3.4: of the sessions where the session-eol recycle advisory fired, the share that actually recycled (a recycle-envelope.consumed.json produced by a successor session start). Kill standard as for the sibling nudges: adoption near zero over the review window means the advisory line is dead weight - tighten the trigger or remove the line.",
+   "instrument": "rule-trips.json warn counters for the session-eol concern (fires) + presence/turnover of agents/runtime/state/recycle-envelope.consumed.json and session-eol per-session state (recycles); conformance audits for the denominator detail",
+   "threshold": "none committed before data - baseline first, threshold at review date (2026-11-10)"
+  },
+  "auto_compact_incidence": {
+   "definition": "road-to-token-economy-recycling 3.4: sessions with >=1 auto compact_boundary event / all sessions, from the session-eol per-session counters (baseline: 11.2%, 23/205 sessions - agents/evidence/analysis/token-economy-recycling-phase1.md). TARGET DIRECTION: trends toward zero as recycle adoption rises; a flat or rising incidence with rising adoption falsifies the mechanism.",
+   "instrument": "session-eol state files (compactions[] counters) aggregated by session_eol_report; the marker-drift alarm in the same report guards the detector against silent host shape changes",
+   "threshold": "baseline 11.2%; direction-only target (down) until the review date"
+  },
+  "envelope_resume_success": {
+   "definition": "road-to-token-economy-recycling 3.4: successor sessions that completed the recycled task WITHOUT re-asking for state the envelope should have carried - i.e. the 2.1 not_carried_forward list staying honest (everything else was carried; the successor re-derived only what the list named).",
+   "instrument": "conformance audits over successor-session transcripts (the consumed envelope names the task; the audit checks the successor's first turns for state re-asks); HONEST GAP: no deterministic counter exists for 'had to re-ask' - this is audit-carried and registered as such",
+   "threshold": "none committed before data - baseline first, threshold at review date"
+  },
+  "post_recycle_verify_fail_vs_baseline": {
+   "definition": "road-to-token-economy-recycling 3.4, the falsifiable core: verify-fail rate of recycled successor sessions vs the long-session baseline. PUBLISH-IF-WORSE COMMITMENT, pre-registered before data exists: if recycled sessions verify WORSE, the result is published and the threshold (recycle-threshold-budget.json) or the envelope schema revises in a PR citing the numbers - the claim never survives on vibes.",
+   "instrument": "session-eol per-session state (recycled or not) joined with verify outcomes from conformance audits / review_skipped telemetry; HONEST GAP: transcripts carry no verify-outcome field, so the join is audit-carried until a verify-outcome counter ships",
+   "threshold": "comparison metric - no absolute threshold; verdict recorded at review date whichever way it went"
+  }
+ }
+}

package/src/config/pack-size-budget.json

@@ -1,18 +1,21 @@
 {
-    "_comment": "Payload budget for the published npm tarball (road-to-zero-ceremony-install Phase 4). MEASURED, NEVER INVENTED — the numbers below come from `npm pack --dry-run --json --ignore-scripts` on the tracked tree at 9.9.0 (2026-07-31). Two metrics, both genuinely ungated before this file: COMPRESSED tarball size, and PER-SKILL share of the skills subtree. The UNPACKED size is deliberately absent — it is already owned by src/config/evaluator-budgets.json (unpacked_size_mb), and a second number for one lever is how three conflicting figures start circulating.",
+    "_comment": "Payload budget for the published npm tarball (road-to-zero-ceremony-install Phase 4). SURFACE LABEL, added 2026-08-24 (2.3): every packed_size_mb figure in this file and in every baseline_note_* below was measured on the UNBUILT tree under measurement_conditions. The BUILT surface a consumer installs is larger and is recorded separately in built_surface_measurement_2026_08_24 \u2014 do not compare a note's figure against a built one. MEASURED, NEVER INVENTED \u2014 the numbers below come from `npm pack --dry-run --json --ignore-scripts` on the tracked tree at 9.9.0 (2026-07-31). Two metrics, both genuinely ungated before this file: COMPRESSED tarball size, and PER-SKILL share of the skills subtree. The UNPACKED size is deliberately absent, and the reason CHANGED on 2026-08-04 without this sentence being updated \u2014 corrected 2026-08-24. It used to read that unpacked size is 'already owned by src/config/evaluator-budgets.json (unpacked_size_mb)'. That key was REMOVED by maintainer decision at the 9.17.0 release (`evaluator-budgets.json` -> `removed_2026_08_04`): the gate turned every legitimate payload addition into a blocked release (28.22 measured against max 28, all functional gates green) and the maintainer judged tarball size not worth gating. So the built artifact's unpacked size is MEASURED as evidence by `evaluator_umbrella.sh` and is deliberately NOT budget-gated. Reinstating `unpacked_size_mb` reverses a recorded maintainer release decision and requires owner review under `decision-revisit-gate` \u2014 it is not a wiring fix. The original point stands on its own terms: a second number for one lever is how three conflicting figures start circulating.",
     "schema_version": 1,
     "owner": "maintainer",
     "review_by": "2027-07-31",
     "regression_pct": 10,
-    "measurement_conditions": "npm pack --dry-run --json --ignore-scripts, run at the repo root on a clean checkout. `--ignore-scripts` means NO build runs, so dist/cli, dist/ui, dist/mcp and dist/hooks are absent and the figure covers only the TRACKED payload (src/scripts/, dist/agent-src/, dist/install/, docs/guidelines/, templates). That is deliberate: this gate is always-on for every PR, and the tracked content tree is exactly the surface that grows by accretion. The built artifact is ~5.4 MB larger and is gated separately, at release time, by evaluator-budgets.unpacked_size_mb.",
+    "measurement_conditions": "npm pack --dry-run --json --ignore-scripts, run at the repo root on a clean checkout. `--ignore-scripts` means NO build runs, so dist/cli, dist/ui, dist/mcp and dist/hooks are absent and the figure covers only the TRACKED payload (src/scripts/, dist/agent-src/, dist/install/, docs/guidelines/, templates). That is deliberate: this gate is always-on for every PR, and the tracked content tree is exactly the surface that grows by accretion. The built artifact is ~5.4 MB larger and is NOT gated \u2014 corrected 2026-08-24. This sentence named `evaluator-budgets.unpacked_size_mb` as a release-time gate; that key was removed by maintainer decision on 2026-08-04 (see `_comment`). `evaluator_umbrella.sh` still measures and records the figure as evidence, so the number exists and nothing enforces it. That is the honest state and it is deliberate.",
     "budgets": {
         "packed_size_mb": {
-            "max": 8.4,
-            "last_measured": 7.805,
-            "method": "npm pack --dry-run --json --ignore-scripts → dist.size / 1e6 (the compressed tarball a consumer actually downloads)",
-            "baseline_note_2026_08_20": "7.8 → 8.4 re-baselined 2026-08-20, and this is a RATCHET RESET rather than the config bent around a failing check — the discriminator the 2026-08-10 note demands, answered here. TRIP CAUSE: nothing was added. `origin/main` at cfd8426d9 measures 7.7916 under the documented conditions, and CI reads ~7 KB above the local figure, so trunk itself already stood ~8 KB below a 7.8 cap before the release branch existed; the 14.6.0 CHANGELOG entry (6.3 KB — a file on the release-PR shape allowlist, i.e. the release's own permitted payload) is what crossed it, at 7.7979 local / 7.805 CI. That is precisely the failure mode the 2026-08-10 note predicted in writing — 'a cap pinned just above the measurement reds on the next commit and teaches the reader to raise it again' — arriving on schedule, which is why the correction here is the headroom and not the payload. MEASURED, on a clean clone of each tree with the method `measurement_conditions` documents (unbuilt dist/, so dist/cli, dist/ui, dist/mcp and dist/hooks absent): main 7.7916 · release/14.6.0 7.7979 · CI 7.805 (Consistency job 96239721013). `last_measured` records CI's 7.805 — the enforcing environment and the higher of the disagreeing pair, per the same rule the 2026-08-10 note applied to its own. Max set to 8.4, ~7.6 % headroom over 7.805, which is the ~8 % both the 5.903/6.4 and 7.238/7.8 pairs carried: deliberately not a number that merely clears. ALTERNATIVE EXAMINED AND REJECTED, measured rather than argued: forcing the CHANGELOG era split early — the one payload reduction that IS on the release-PR allowlist, so it could have landed without touching main at all — moves the 144-line 14.5.0 section (7,266 bytes) into `docs/archive/`, which sits outside `files[]`. It saves 1.0 KB compressed (7.7979 → 7.7969). Prose compresses; a ~7 KB deficit cannot be closed by relocating 7 KB of prose. Recorded so it is not re-proposed as the cheap fix it looks like. NOT EXAMINED HERE, and named as the open question this raise defers rather than answers: `src/scripts/` is 14.9 MB of the 26.0 MB unpacked payload and is the actual growth surface, `src/agent-src/` partly duplicates `dist/agent-src/`, and whether a consumer needs the 846 KB `src/scripts/ai_council/` tree at all is unverified. Each is a structural change with its own blast radius, not a release-time edit — that belongs in a roadmap, and this raise buys the time to write one. A debt this note records, not one it discharges. DECIDED BY: maintainer, on the release that tripped it, in its own PR against main — `src/config/pack-size-budget.json` is not on the release-PR shape allowlist, so this cannot ride the release branch and is not smuggled into one.",
-            "baseline_note_2026_08_10": "6.9 → 7.8 re-baselined 2026-08-10. WHICH OF THE TWO THIS IS, stated because the guard asks: a RATCHET RESET, not the config bent around a failing check — and the discriminator is that the payload is real and needed rather than that the check was inconvenient. The 44 KB is two source files a shipped instruction depends on, the cheaper alternative was examined and rejected on that ground (below), the new cap carries ~8% headroom over the higher of two disagreeing measurements rather than clearing by a hair, and the raise was put to the maintainer as a decision instead of applied to make a red go away. A reader who disagrees has everything needed to reverse it: the measurement, its method, the trip cause, and the rejected option. Maintainer-decided in the PR that tripped it, surfaced rather than smuggled — the same standing this file's `owner: maintainer` requires. MEASURED TWICE, and the two do not agree: CI reported 6.907 on this exact commit, a local run under the documented conditions reports 7.238. The 331 KB gap is UNEXPLAINED — the tree matches the pushed commit and only this file differs — so the cap is set over the HIGHER figure rather than the convenient one, and the discrepancy is recorded here as an open question instead of resolved by assumption. A third party reproducing this should expect either number and should not treat the lower one as authoritative. Separately, and this part IS understood: `npm pack --dry-run --ignore-scripts` in a worktree that has been BUILT reads 8.45, because the flag assumes dist/cli, dist/ui, dist/mcp and dist/hooks are absent and a built tree has them. That figure is not comparable to this budget and must never be written here — recorded because it is a trap the documented method invites. Trip cause: road-to-conformance-round5 Phase 3 added src/scripts/hooks/turn_end_gate_hook.ts (32 KB) and src/scripts/measure_turn_end_gate.ts (12 KB) in packed paths plus schema/template/contract growth, landing 7 KB over a 6.9 cap. Max set to 7.8 (~8% headroom over 7.238, and ~13% over CI's 6.907) for the reason the 2026-08-05 note already gives: a cap pinned just above the measurement reds on the next commit and teaches the reader to raise it again. ALTERNATIVE EXAMINED AND REJECTED, so it is not re-proposed: dropping measure_turn_end_gate.ts from the pack would have cleared the cap with room, but the settings description added in the same change instructs CONSUMERS to run that script against their own transcript store before arming the gate — excluding it would break a shipped instruction.",
-            "baseline_note": "5.903 → 6.398 re-baselined 2026-08-05. This is a RE-BASELINE, not a carve-out for the change that tripped it: measured on the tracked tree, `origin/main` alone was already at 6.372 of a 6.4 cap, so 28 KB of headroom remained after months of accretion and the next legitimate addition of any size was going to cross it. The addition here is 26 KB — docs/contracts/settings-classes.md (the A/B/C fence, read at RUNTIME by the settings writer, so it must ship) plus src/server/io/yamlIO.ts (imported by that writer to preserve the user's comments). CI measures ~4 KB above the local figure because it regenerates dist/agent-src first. Max set to 6.9 rather than to a number that merely clears: a cap pinned 2 KB above the measurement reds on the next commit and teaches the reader to raise it again, which is how a budget becomes a formality. That restores the ~8% headroom the 5.903/6.4 pair originally carried. The `owner: maintainer` on this file stands — this raise is surfaced in the PR for that decision, not smuggled."
+            "max": 9.1,
+            "last_measured": 8.475,
+            "baseline_note_2026_08_23": "8.4 \u2192 9.2 re-baselined 2026-08-23. RATCHET RESET, not the config bent around a failing check: the cap was exhausted at TRUNK level before the tripping branch existed. MEASURED on clean clones under the documented conditions \u2014 origin/main at f16c7d9df reads 8.3911, i.e. 8.9 KB under its own cap; PR #1597 reads 8.4083 local / 8.416 CI, +17.2 KB across 4 new pack entries of functional source its roadmap deliberately adds. With 8.9 KB of headroom ANY commit reds this gate, which is the failure the 2026-08-20 note predicted in writing, arriving a second time three days later. Max = 8.4083 \u00d7 1.095, derived from this file's own regression_pct: 10 rather than from the tripping measurement; last_measured records CI's 8.416, the enforcing environment and the higher of the disagreeing pair. GIVEN UP: ~0.79 MB of unpoliced accretion \u2014 this gate catches a step change in payload, which regression_pct still catches at any cap, and it cannot police 17 KB increments. REJECTED, measured rather than argued: payload reduction inside the PR \u2014 the whitelist is already tight (docs/guidelines/ plus three named contracts), tests/ is 6 KB and agents/ 39 KB uncompressed, so excluding both saves ~13 KB compressed and does not clear even this one PR. The structural surface the 2026-08-20 note named (src/scripts/ at 14.9 MB unpacked, src/agent-src/ duplicating dist/agent-src/) is still unexamined and still the open debt this raise defers. Revisit-if: a single PR moves the figure by more than regression_pct, or the drain ends and the cap can ratchet DOWN from a re-measured trunk \u2014 never up again from a fresh trip. DECIDED BY: maintainer, numbered-options option 1, after the alternative above was measured and the exhaustion was reported rather than the cap raised silently.",
+            "method": "npm pack --dry-run --json --ignore-scripts \u2192 dist.size / 1e6 (the compressed tarball a consumer actually downloads)",
+            "baseline_note_2026_08_24": "8.4 \u2192 9.1 re-baselined 2026-08-24, and this is a RATCHET RESET rather than the config bent around a failing check. The discriminator this file demands, answered with a measurement rather than an argument: THE TRUNK WAS ALREADY AT THE CEILING BEFORE THE CHANGE THAT TRIPPED IT EXISTED. `origin/main` at f16c7d9df measures 8.3911 under the documented conditions \u2014 8.9 KB of headroom against an 8.4 cap, i.e. 0.1 %. An addition of any size crosses it. That is verbatim the failure mode the 2026-08-20 note predicted in writing \u2014 'a cap pinned just above the measurement reds on the next commit and teaches the reader to raise it again' \u2014 arriving on schedule for the SECOND time, which is why the correction here is the headroom and not the payload. TRIP CAUSE: merging `origin/main` into `drain/chained-clip-continuity` (PR #1598). The branch adds ~2,600 net lines inside packed paths \u2014 `src/scripts/lint_adapter_tier.ts` (662 lines; it is the gate that verifies the generated tier table in `docs/contracts/provider-lifecycle.md`, so it must ship), the ai-video adapter / seam-plan / stitch shell libraries, and the `model-capabilities/*.json` files read at runtime \u2014 landing 39 KB over the cap. NEITHER SIDE WAS OVER ALONE; together they cross, which is the shape a merge produces and no per-branch check can see. MEASURED, on two clean detached worktrees with unbuilt `dist/` per `measurement_conditions` (so dist/cli, dist/ui, dist/mcp and dist/hooks absent): main 8.3911 (2,746 entries) \u00b7 branch 8.4305 (2,753 entries) \u00b7 CI 8.439 (Consistency job 97266868959). `last_measured` records CI's 8.439 \u2014 the enforcing environment and the higher of the disagreeing pair, per the rule the 2026-08-10 and 2026-08-20 notes both applied to their own; the ~8 KB CI-over-local gap matches the pattern both recorded. The 10 % regression rule did NOT trip (threshold 8.586 against the prior `last_measured` 7.805); only the absolute cap did. Max set to 9.1, ~7.8 % headroom over 8.439, which is the ~8 % the 5.903/6.4, 7.238/7.8 and 7.805/8.4 pairs all carried: deliberately not a number that merely clears. ALTERNATIVE EXAMINED AND NOT TAKEN, measured rather than argued, and its verdict left HONESTLY OPEN: excluding `src/scripts/ai_council/` \u2014 the tree the 2026-08-20 note names as the one whose consumer need is 'unverified', 0.903 MB as measured here \u2014 saves 270 KB compressed (8.4305 \u2192 8.1607, under the OLD cap with 239 KB to spare). It is not taken here because whether it is SAFE is still undecided, and this note deliberately does not decide it. `src/server/routes/wizard.ts:48` imports `apiOnQuotaView` from `scripts/ai_council/transport_resolver.js`, and `council:status` is a registered verb in `src/cli/registry.ts` \u2014 but the specifier ends in `.js` and therefore cannot settle whether it resolves to the TS source under `src/scripts/` or to built output under `dist/` in a published install. An earlier draft of this note asserted that the exclusion 'breaks the wizard quota view in every consumer install'; that was an over-claim read off the specifier, and it is retracted here rather than quietly dropped. What IS established: `src/cli/python/workspace_hosts.ts:180-191` records a real `ERR_MODULE_NOT_FOUND` in a global install caused by a shipped module importing from a directory absent from `files[]`, and `src/server/routes/wizard.ts:136-137` invokes `bash src/scripts/install_anthropic_key.sh` BY PATH at runtime. So a blanket trim of `src/scripts/` is unsafe, while the ai_council-specific verdict needs a global-install smoke test rather than a reading of an import. THE DEBT IS NOW WRITTEN DOWN, which is the one thing the 2026-08-20 note promised and did not deliver: it said 'this raise buys the time to write one [a roadmap]', and no roadmap was ever written \u2014 a grep of `agents/roadmaps/` (active, `stubs/`, `later/`, `archive/`) finds no payload-reduction plan. `agents/roadmaps/archive/road-to-npm-payload-reduction.md` lands in this same change and carries the measured split: `src/scripts/` is 16.384 MB of the 28.604 MB unpacked payload (57.3 %, 1,158 files) and is the actual growth surface; `dist/agent-src/` is 8.040 MB; `src/agent-src/` is 1.347 MB and partly duplicates it, unmeasured until that roadmap's Phase 1.3. Its Phase 2.3 lowers this cap again, so `max: 9.1` still standing later is the visible signal the plan did not finish. [AMENDED 2026-08-24 by the run that finished it, because that sentence would otherwise mislead in the opposite direction: the plan DID finish, and 9.1 is now its RESULT rather than its deferral signal \u2014 see baseline_note_2026_08_24_lowered. The roadmap path in this sentence was rewritten from agents/roadmaps/ to agents/roadmaps/archive/ by the archival ref-migration, so a dated note now points at a path that did not exist on its own date; the migration is kept because the reference must resolve, and it is flagged here rather than left to read as if the file had always been archived.] A raise that defers the same debt a fourth time with no plan is a formality, so this one carries the plan. DECIDED BY: maintainer, on the PR that tripped it, chosen from numbered options carrying the measurements above rather than applied to make a red go away \u2014 and the write itself was performed by the maintainer, because the block-config-weakening guard refused four agent attempts at this file. That is the standing this file's `owner: maintainer` requires, enforced rather than asserted. MET A SECOND, INDEPENDENT RESET IN A MERGE, 2026-08-24: the drain's council-evidence-integrity branch reached the same diagnosis from the same measurement (main at 8.3911, 8.9 KB of headroom) and set 9.2 instead of 9.1, landing on trunk first. The HIGHER cap prevails and BOTH derivations are kept, because two independent readings converging on one trip cause is the strongest evidence this entry has ever carried \u2014 and dropping one of them would leave the record looking like a single unreviewed judgement. `last_measured` is re-measured on the merged tree rather than taken from either side, per the method every prior entry here prescribes.",
+            "baseline_note_2026_08_20": "7.8 \u2192 8.4 re-baselined 2026-08-20, and this is a RATCHET RESET rather than the config bent around a failing check \u2014 the discriminator the 2026-08-10 note demands, answered here. TRIP CAUSE: nothing was added. `origin/main` at cfd8426d9 measures 7.7916 under the documented conditions, and CI reads ~7 KB above the local figure, so trunk itself already stood ~8 KB below a 7.8 cap before the release branch existed; the 14.6.0 CHANGELOG entry (6.3 KB \u2014 a file on the release-PR shape allowlist, i.e. the release's own permitted payload) is what crossed it, at 7.7979 local / 7.805 CI. That is precisely the failure mode the 2026-08-10 note predicted in writing \u2014 'a cap pinned just above the measurement reds on the next commit and teaches the reader to raise it again' \u2014 arriving on schedule, which is why the correction here is the headroom and not the payload. MEASURED, on a clean clone of each tree with the method `measurement_conditions` documents (unbuilt dist/, so dist/cli, dist/ui, dist/mcp and dist/hooks absent): main 7.7916 \u00b7 release/14.6.0 7.7979 \u00b7 CI 7.805 (Consistency job 96239721013). `last_measured` records CI's 7.805 \u2014 the enforcing environment and the higher of the disagreeing pair, per the same rule the 2026-08-10 note applied to its own. Max set to 8.4, ~7.6 % headroom over 7.805, which is the ~8 % both the 5.903/6.4 and 7.238/7.8 pairs carried: deliberately not a number that merely clears. ALTERNATIVE EXAMINED AND REJECTED, measured rather than argued: forcing the CHANGELOG era split early \u2014 the one payload reduction that IS on the release-PR allowlist, so it could have landed without touching main at all \u2014 moves the 144-line 14.5.0 section (7,266 bytes) into `docs/archive/`, which sits outside `files[]`. It saves 1.0 KB compressed (7.7979 \u2192 7.7969). Prose compresses; a ~7 KB deficit cannot be closed by relocating 7 KB of prose. Recorded so it is not re-proposed as the cheap fix it looks like. NOT EXAMINED HERE, and named as the open question this raise defers rather than answers: `src/scripts/` is 14.9 MB of the 26.0 MB unpacked payload and is the actual growth surface, `src/agent-src/` partly duplicates `dist/agent-src/`, and whether a consumer needs the 846 KB `src/scripts/ai_council/` tree at all is unverified. Each is a structural change with its own blast radius, not a release-time edit \u2014 that belongs in a roadmap, and this raise buys the time to write one. A debt this note records, not one it discharges. DECIDED BY: maintainer, on the release that tripped it, in its own PR against main \u2014 `src/config/pack-size-budget.json` is not on the release-PR shape allowlist, so this cannot ride the release branch and is not smuggled into one.",
+            "baseline_note_2026_08_10": "6.9 \u2192 7.8 re-baselined 2026-08-10. WHICH OF THE TWO THIS IS, stated because the guard asks: a RATCHET RESET, not the config bent around a failing check \u2014 and the discriminator is that the payload is real and needed rather than that the check was inconvenient. The 44 KB is two source files a shipped instruction depends on, the cheaper alternative was examined and rejected on that ground (below), the new cap carries ~8% headroom over the higher of two disagreeing measurements rather than clearing by a hair, and the raise was put to the maintainer as a decision instead of applied to make a red go away. A reader who disagrees has everything needed to reverse it: the measurement, its method, the trip cause, and the rejected option. Maintainer-decided in the PR that tripped it, surfaced rather than smuggled \u2014 the same standing this file's `owner: maintainer` requires. MEASURED TWICE, and the two do not agree: CI reported 6.907 on this exact commit, a local run under the documented conditions reports 7.238. The 331 KB gap is UNEXPLAINED \u2014 the tree matches the pushed commit and only this file differs \u2014 so the cap is set over the HIGHER figure rather than the convenient one, and the discrepancy is recorded here as an open question instead of resolved by assumption. A third party reproducing this should expect either number and should not treat the lower one as authoritative. Separately, and this part IS understood: `npm pack --dry-run --ignore-scripts` in a worktree that has been BUILT reads 8.45, because the flag assumes dist/cli, dist/ui, dist/mcp and dist/hooks are absent and a built tree has them. That figure is not comparable to this budget and must never be written here \u2014 recorded because it is a trap the documented method invites. Trip cause: road-to-conformance-round5 Phase 3 added src/scripts/hooks/turn_end_gate_hook.ts (32 KB) and src/scripts/measure_turn_end_gate.ts (12 KB) in packed paths plus schema/template/contract growth, landing 7 KB over a 6.9 cap. Max set to 7.8 (~8% headroom over 7.238, and ~13% over CI's 6.907) for the reason the 2026-08-05 note already gives: a cap pinned just above the measurement reds on the next commit and teaches the reader to raise it again. ALTERNATIVE EXAMINED AND REJECTED, so it is not re-proposed: dropping measure_turn_end_gate.ts from the pack would have cleared the cap with room, but the settings description added in the same change instructs CONSUMERS to run that script against their own transcript store before arming the gate \u2014 excluding it would break a shipped instruction.",
+            "baseline_note": "5.903 \u2192 6.398 re-baselined 2026-08-05. This is a RE-BASELINE, not a carve-out for the change that tripped it: measured on the tracked tree, `origin/main` alone was already at 6.372 of a 6.4 cap, so 28 KB of headroom remained after months of accretion and the next legitimate addition of any size was going to cross it. The addition here is 26 KB \u2014 docs/contracts/settings-classes.md (the A/B/C fence, read at RUNTIME by the settings writer, so it must ship) plus src/server/io/yamlIO.ts (imported by that writer to preserve the user's comments). CI measures ~4 KB above the local figure because it regenerates dist/agent-src first. Max set to 6.9 rather than to a number that merely clears: a cap pinned 2 KB above the measurement reds on the next commit and teaches the reader to raise it again, which is how a budget becomes a formality. That restores the ~8% headroom the 5.903/6.4 pair originally carried. The `owner: maintainer` on this file stands \u2014 this raise is surfaced in the PR for that decision, not smuggled.",
+            "baseline_note_2026_08_24_lowered": "9.2 -> 9.1 LOWERED 2026-08-24 \u2014 the first DOWNWARD move in this file's history, and the reason it is possible is that road-to-npm-payload-reduction measured the lever the previous four raises kept deferring. Method, because the verdicts turn on it: a behavioural global-install harness (src/scripts/pack_install_smoke.ts) packs a real BUILT tarball, installs it into a throwaway prefix, and runs eleven consumer probes including the bash orchestrator FROM the installed tree, which is the only probe that exercises path-reachability rather than imports. Sensitivity was proven by sabotage before any verdict was trusted: excluding src/scripts/_lib/ produces ERR_MODULE_NOT_FOUND on four probes. WHAT THE BISECT FOUND, and it retires a suggestion this file has carried since 2026-08-20: EVERY named subtree SHIPS. src/scripts/ai_council/ \u2014 the 270 KB candidate the 2026-08-24 note left explicitly undecided \u2014 breaks council:status AND hooks:status with ERR_MODULE_NOT_FOUND. So does src/scripts/hooks/ (271.5 KB), src/scripts/_cli/ (204.1 KB), src/agent-src/ (101.8 KB), src/scripts/ai-video/ (95.4 KB, its shell entry point), src/scripts/mcp_server/ (53.1 KB). Two of those first read GREEN and flipped RED when the probe set was widened with mcp:setup and an ai-video shell check \u2014 recorded because it is the exact false-negative shape this file's own Risk 2 names, caught rather than shipped. WHAT IS ACTUALLY REMOVABLE is three FILE PATTERNS, not subtrees, and no prior note looked for them: dist/**/*.map (323.5 KB), dist/agent-src/skills/**/evals/** (56.2 KB), src/**/*.test.ts + *.spec.ts (22.6 KB) \u2014 402.9 KB on the built tarball, all eleven probes green together. MEASURED under this file's own documented conditions (npm pack --dry-run --ignore-scripts, clean unbuilt worktree, which is what check_pack_size reads): 8.5596 -> 8.4667 MB, 2,775 -> 2,609 entries, a 92.9 KB drop. The gap between 402.9 KB and 92.9 KB is not a discrepancy: most of the .map saving lives in dist/cli, dist/ui, dist/mcp and dist/hooks, which --ignore-scripts excludes by design. HEADROOM IS 7.4 %, NOT 8 %, and the number is stated exactly rather than rounded up to match the pattern: 9.1 over the CI-adjusted 8.475 (local 8.4667 plus the ~8 KB CI delta every prior note here records) is 7.37 %. The 5.903/6.4, 7.238/7.8, 7.805/8.4 and 8.439/9.1 pairs carried ~8 %; this one carries slightly less, which is a real if small increase in flake risk and is why the falsifier below names it. STILL OPEN, quantified for the first time: src/agent-src/ is 94.2 % byte-identical to dist/agent-src/ (284 of 297 files, 2,144,870 of 2,276,707 bytes, content-hash diff). Two prior notes called this 'partial'; it is near-total. It is NOT removable by exclusion \u2014 nine shipped scripts under src/scripts/ import through it (build_archive_index, check_estate_count, eval_ui_triviality, explain_run, lint_ui_stack_bundles, skill_usage_report, smoke_quickstart, telemetry_disclosure_hook, utilization_report) while dist/agent-src/ is the tree the installer deploys, so the two copies ship for different reasons. Repointing those imports at dist/ would make source depend on a generated projection, which src/rules/source-of-truth.md exists to prevent. AI council 2026-08-24, 2/2: that needs an ADR covering compiled script entry points and asset resolution, not another files[] experiment. Worth ~102 KB and deliberately not taken here. TRADE-OFF ACCEPTED, named rather than absorbed: excluding dist/**/*.map means published packages carry no source maps, so consumer stack traces show compiled names. GREEN here means 'no regression across the recorded eleven-probe matrix', never 'semantically equivalent'. REVISIT-IF: three clean CI runs measure above 9.1 (the method does not match the gate); or observed run-to-run variance exceeds the 7.4 % margin, making the ratchet noise rather than a floor; or the src/agent-src/ ADR lands and the cap can drop again. NEVER raise it again from a fresh trip without the discriminator the 2026-08-10 note demands. DECIDED BY: AI council 2026-08-24, 2/2 convergent (anthropic/claude-sonnet-4-5 + openai/codex-default, 2 rounds, blind peer review), on a maintainer delegation of owner-reserved blockers for an autonomous drain run. Both seats independently required the 7.4 % to be stated exactly and the GREEN to be scoped to the probe matrix."
         }
     },
     "per_skill_share": {
@@ -23,9 +26,35 @@
             "design-intelligence": {
                 "max_pct": 23.5,
                 "measured_pct": 22.63,
-                "reason": "771 KB of BM25 corpus (27 CSVs + 16 design-language prose specs + manifest.json) consumed at runtime by corpus-grounding's retriever, and referenced by 6 further skills. Moving it behind a lazy fetch would add a network dependency to a skill that works offline today — the same trade-off ADR-061 §8 already REJECTED for a 745 KB font index. The exception is visible debt, not an endorsement: raising max_pct requires a reason in the same commit.",
-                "baseline_note_2026_08_13": "23.0 → 23.5 on 2026-08-13, and the reason belongs in this file per the sentence above. WHAT WAS ADOPTED: data/motion.csv, 10.5 KB, 16 rows. WHY IT IS NOT DISCRETIONARY: the roadmap's three design dials were all in its original scope, and two of the three (variance, density) were already portable — variance's keywords resolve against the local styles.csv (2/3/3 hits) and density is three pure range maps. The motion dial is not: upstream filters its corpus rows by `Intensity Tier == <dial tier>`, and that column exists only in motion.csv, so shipping the dial without the file means shipping a flag that silently does nothing. Two of three dials plus an inert third is a worse surface than three working ones. WHAT WAS DECLINED IN THE SAME PASS, so this is not a ratchet slipping: google-fonts.csv (743 KB — ADR-061 §8 rejects it by name and by size; the 2026-06-16 amendment authorises a slim top-N slice from a different mirror, not this file), typography.csv (our curated font-pairings-reference.csv is the ADR's working substitution), six desktop-UI stacks outside frontend-design's scope, and eleven content-drifted files nobody has reviewed. The base pin in ATTRIBUTION.md is deliberately NOT bumped for the same reason. HONEST LIMIT ON THE NUMBER: 22.63 is the committed measurement, not a fresh one — check_pack_size cannot be re-measured from a built worktree (it reads 9.096 against the 7.8 packed cap before any change, the trap the packed_size_mb note above documents), so the post-adoption share is arithmetic (~22.87 %) and the new cap carries ~0.6 pp over it rather than clearing by a hair. DECIDED BY: AI council, 2026-08-13, on a maintainer delegation — and honestly, by ONE member over two rounds, not by convergence: the second seat returned exit_1 (the codex CLI refuses a git worktree as an untrusted directory). Recorded as a single-member review in agents/evidence/analysis/design-system-blockers-council.md."
+                "reason": "771 KB of BM25 corpus (27 CSVs + 16 design-language prose specs + manifest.json) consumed at runtime by corpus-grounding's retriever, and referenced by 6 further skills. Moving it behind a lazy fetch would add a network dependency to a skill that works offline today \u2014 the same trade-off ADR-061 \u00a78 already REJECTED for a 745 KB font index. The exception is visible debt, not an endorsement: raising max_pct requires a reason in the same commit.",
+                "baseline_note_2026_08_13": "23.0 \u2192 23.5 on 2026-08-13, and the reason belongs in this file per the sentence above. WHAT WAS ADOPTED: data/motion.csv, 10.5 KB, 16 rows. WHY IT IS NOT DISCRETIONARY: the roadmap's three design dials were all in its original scope, and two of the three (variance, density) were already portable \u2014 variance's keywords resolve against the local styles.csv (2/3/3 hits) and density is three pure range maps. The motion dial is not: upstream filters its corpus rows by `Intensity Tier == <dial tier>`, and that column exists only in motion.csv, so shipping the dial without the file means shipping a flag that silently does nothing. Two of three dials plus an inert third is a worse surface than three working ones. WHAT WAS DECLINED IN THE SAME PASS, so this is not a ratchet slipping: google-fonts.csv (743 KB \u2014 ADR-061 \u00a78 rejects it by name and by size; the 2026-06-16 amendment authorises a slim top-N slice from a different mirror, not this file), typography.csv (our curated font-pairings-reference.csv is the ADR's working substitution), six desktop-UI stacks outside frontend-design's scope, and eleven content-drifted files nobody has reviewed. The base pin in ATTRIBUTION.md is deliberately NOT bumped for the same reason. HONEST LIMIT ON THE NUMBER: 22.63 is the committed measurement, not a fresh one \u2014 check_pack_size cannot be re-measured from a built worktree (it reads 9.096 against the 7.8 packed cap before any change, the trap the packed_size_mb note above documents), so the post-adoption share is arithmetic (~22.87 %) and the new cap carries ~0.6 pp over it rather than clearing by a hair. DECIDED BY: AI council, 2026-08-13, on a maintainer delegation \u2014 and honestly, by ONE member over two rounds, not by convergence: the second seat returned exit_1 (the codex CLI refuses a git worktree as an untrusted directory). Recorded as a single-member review in agents/evidence/analysis/design-system-blockers-council.md."
             }
         }
+    },
+    "built_surface_measurement_2026_08_24": {
+        "purpose": "road-to-standing-payload-truth 2.2 and 2.3. Every cap raise in this file's baseline_note_* history was measured on the UNBUILT tree, and nothing recorded what the BUILT surface \u2014 the one a consumer installs \u2014 actually is. Two figures for one lever with no label is how the confusion this file warns about starts, so both are recorded here with the command that produced each.",
+        "unbuilt": {
+            "packed_mb": 8.4953,
+            "unpacked_mb": 28.7516,
+            "entries": 2614,
+            "command": "npm pack --dry-run --json --ignore-scripts   # clean detached worktree, dist/ unbuilt",
+            "note": "THIS is the surface every packed_size_mb cap in this file was set against, including max 9.1."
+        },
+        "built": {
+            "packed_mb": 10.5525,
+            "unpacked_mb": 37.3775,
+            "entries": 2808,
+            "command": "npm run build && npm pack --dry-run --json   # prepack runs the build; this is what publish emits",
+            "note": "The surface a consumer downloads and installs. Gated by nothing \u2014 see _comment."
+        },
+        "delta": {
+            "packed_mb": 2.0572,
+            "unpacked_mb": 8.6259,
+            "entries": 194,
+            "correction": "The roadmap and an earlier note in this file put the built artifact at '~5.4 MB larger'. MEASURED it is +8.6259 MB unpacked and +2.0572 MB packed. The 5.4 figure is stale and is corrected here rather than carried; a reader comparing 8.4953 against 28.22 or 37.3775 was comparing three different surfaces."
+        },
+        "what_this_says_about_the_removed_gate": "unpacked_size_mb was removed on 2026-08-04 with max 28 and a measurement of 28.22 \u2014 0.8 % over. The built unpacked size TODAY is 37.3775 MB, i.e. that cap would now be exceeded by 33.5 %. Reinstating it is therefore not 'add a key with a measured baseline': it is setting a cap a third higher than the one whose 0.8 % breach caused its removal. Recorded because it makes the 2026-08-04 decision look better in hindsight than it did at the time, and because an owner reopening it under decision-revisit-gate should start from 37.4, not from 28.",
+        "measured_at": "2026-08-24",
+        "measured_on": "One machine, two worktrees of the same commit. CI has historically read ~8 KB above the local packed figure; no CI reading of the BUILT surface exists, so the built numbers here are local-only and are not a CI baseline."
     }
 }