@event4u/agent-config 14.11.0 → 14.13.0

package/src/config/canonical-terms.yml

@@ -0,0 +1,119 @@
+# Canonical terms — the house dialect for repository-authored prose.
+# road-to-canonical-terms Phase 1.1. AI council 2/2, 2026-08-25.
+#
+# WHAT THIS FILE DECIDES, AND WHAT IT DOES NOT.
+# It records the canonical side of each measured pair. It does NOT authorise a
+# sweep of the existing corpus. Both council seats separated the two
+# deliberately: choosing a canonical dialect and rewriting ~5000 historical
+# occurrences have different evidentiary requirements, and only the first is
+# supported today. `policy_scope` below states that boundary in the data rather
+# than only in prose, so a future reader cannot take this file for authorisation.
+#
+# WHY AMERICAN, WHEN THE PUBLISHED AGGREGATE SAID BRITISH.
+# The roadmap's Phase 1.1 rests on `behaviour`/`behavior` splitting 57/43 with
+# the BRITISH side ahead, calling it a case where the majority rule and the
+# consistency rule point in opposite directions. Decomposed by directory, they
+# do not point in opposite directions at all:
+#
+#     src/     128 behaviour / 432 behavior   -> 22/78  AMERICAN
+#     docs/    304 / 189                      -> 61/39
+#     agents/  971 / 419                      -> 69/31
+#
+# The British majority is produced almost entirely by `agents/` -- roadmaps,
+# evidence notes and archive, i.e. this repository's own working prose, much of
+# it in files nobody will edit again. On the SHIPPED surface the tree is already
+# 78 % American. So this file documents existing practice where it matters
+# rather than imposing a rewrite, which is also the strongest answer to the
+# seat that asked for evidence of harm before authorising 5000 changed lines:
+# declaring the convention `src/` already follows costs nothing and changes no
+# file.
+#
+# Full decomposition, including the two other pairs that flip between the
+# shipped surface and the aggregate (`artifact`/`artefact` and
+# `preflight`/`pre-flight`), is the CORRECTION section of
+# agents/evidence/analysis/wording-baseline-2026-08-25.md.
+schema_version: canonical-terms-v1
+
+policy_scope: prose-authored-here
+# `prose-authored-here` -- the canonical side applies to prose THIS repository
+# writes. It never applies to: exact external titles and quotations, code,
+# identifiers, paths, URLs, commands, test fixtures, snapshots, or externally
+# synchronised material. The council's wording, adopted verbatim in intent:
+# do NOT exempt ordinary prose merely because it sits near protected text.
+
+sweep_authorised: false
+# Set true only when a classified inventory and a bounded pilot exist. The
+# conditions are recorded at the roadmap's step 2.1; this key exists so a gate
+# or a future session reads the answer rather than inferring it from silence.
+
+terms:
+  # --- decided, and the direction is the same in src/, docs/ and agents/ ---
+  - canonical: subagent
+    variant: sub-agent
+    confidence: unambiguous
+    note: 98/2 in src/, 99/1 in docs/ and agents/. No directory disagrees.
+  - canonical: handoff
+    variant: hand-off
+    confidence: unambiguous
+    note: >-
+      84/16 in src/, 85/15 in docs/, 95/5 in agents/. `hand off` as two words is
+      a verb phrase and is not a variant of the noun; it is out of scope here.
+  - canonical: organize
+    variant: organise
+    confidence: unambiguous
+    note: >-
+      100/0 in src/ and docs/. agents/ is 53/47 on n=13, which is too small to
+      contradict anything.
+  - canonical: gray
+    variant: grey
+    confidence: low-count
+    note: >-
+      68/32 in src/ on n=25. Direction is consistent across directories but the
+      total is small; recorded as decided and flagged as thin evidence.
+  - canonical: canonicalize
+    variant: canonicalise
+    confidence: low-count
+    note: 100/0 in src/ on n=2. Follows `organize` rather than standing on its own count.
+
+  # --- decided AGAINST the published aggregate, on the shipped-surface reading ---
+  - canonical: behavior
+    variant: behaviour
+    confidence: decided-against-aggregate
+    note: >-
+      The pair the roadmap called hard. src/ is 22/78 American, so on the
+      shipped surface the majority rule and the consistency rule agree. The
+      aggregate's 57/43 British lead is an artifact of counting agents/.
+  - canonical: artifact
+    variant: artefact
+    confidence: decided-against-aggregate
+    note: >-
+      Aggregate 51/49 is a coin-flip and agents/ is 49/51, but src/ is 63/37.
+      Decided on the shipped surface for the same reason as `behavior`.
+
+  # --- decided, but the migration is explicitly NOT mechanical ---
+  - canonical: license
+    variant: licence
+    confidence: semantic-care-required
+    note: >-
+      94/6 in src/. `license` is both noun and verb in the canonical dialect, so
+      no noun/verb distinction is preserved in repository-authored prose. But
+      exact licence TITLES and quoted names are protected text and are never
+      rewritten -- and per the council, proximity to a protected name does not
+      exempt the surrounding prose. This pair is the one where a mechanical
+      find-and-replace would be wrong.
+
+  # --- NOT decided ---
+  - canonical: null
+    variant: pre-flight
+    also: preflight
+    confidence: undecided
+    note: >-
+      The one pair this file declines to decide. src/ is 44/56 in favour of the
+      HYPHENATED form on n=25, while the aggregate says 68/32 for the closed
+      form. The honest reading of a 25-sample near-tie is undecided, not decided
+      the other way, and picking a side to make the table look complete is the
+      failure this entry exists to avoid. Revisit when src/ carries enough
+      occurrences to separate the two.
+
+# `cancelled` / `canceled` is 946/0 and needs no entry -- recorded in the
+# wording baseline so a later pass does not spend a sweep on it.

package/src/config/capability-native-outcome-bars.json

@@ -0,0 +1,81 @@
+{
+    "_comment": "Pre-registered outcome bars for road-to-capability-native-execution, step 0.6. FIXED BEFORE ANY MEASUREMENT — the step requires the prereg commit to precede any default-preference change, so a bar edited after a run is a moved goalpost and must be recorded as one. Phase 3.4 binds the other direction: the published set must cover EVERY bar named here, with none missing and none present that this file does not name. Shape asserted by tests/scripts/capability_native_outcome_bars.test.ts — a bar with no falsifier FAILS the shape check rather than passing, which is the step's own verify clause. HONESTY ABOUT THE NUMBERS: three bars are DERIVED from a contract or a frozen-fixture property and say so; three are STATED DEFAULTS with a revisit-if, and say that instead of implying a derivation they do not have; one (evidence-completeness) is a contract restatement. A pre-registered threshold nobody can source is worse than none, because it looks measured.",
+    "schema_version": 1,
+    "registered_at": "2026-08-30",
+    "owner": "maintainer",
+    "review_by": "2027-02-28",
+    "roadmap": "road-to-capability-native-execution",
+    "step": "0.6",
+    "bars": [
+        {
+            "id": "dispatch-success",
+            "what": "Of the frozen 0.5 fixtures a dispatchable adapter advertises it can handle, the share it completes without an execution error.",
+            "threshold": 0.95,
+            "direction": "at-least",
+            "unit": "ratio",
+            "basis": "DERIVED, not chosen. 0.5 froze the fixture set and 2.4/3.5 require an advertised-but-undispatchable fixture to be REFUSED BEFORE EXECUTION — so a dispatch that reaches execution has already passed a dispatchability probe, and anything below near-total success means the probe is not doing its job. The bar is on the post-probe population, which is why it is high.",
+            "falsifier": "any dispatchable adapter completes fewer than 95% of the fixtures it advertised, measured on the frozen 0.5 set with its digest recorded",
+            "measured_by": "phase 3.2"
+        },
+        {
+            "id": "evidence-completeness",
+            "what": "Every field the evidence contract requires is present in the adapter's output for a completed run.",
+            "threshold": 1.0,
+            "direction": "at-least",
+            "unit": "ratio",
+            "basis": "DERIVED from the contract, not chosen: 3.2 requires each adapter to produce THE SAME required evidence contract on the same fixture. A required field is required; 0.99 would mean the contract is advisory, and a partial evidence envelope is the shape a reader mistakes for a complete one.",
+            "falsifier": "any completed run emits an envelope missing a field the contract marks required",
+            "measured_by": "phase 3.2"
+        },
+        {
+            "id": "token-context-cost",
+            "what": "Per-fixture token cost of the capability-dispatched arm against the direct-call arm.",
+            "threshold": 1.1,
+            "direction": "at-most",
+            "unit": "ratio-vs-baseline",
+            "basis": "STATED DEFAULT, not a measured optimum — said plainly rather than implying a derivation it does not have. 1.10 encodes 'the indirection may cost something, and not much'. Revisit-if: 3.3's first paired run lands outside 0.9-1.3 in either direction, which would mean the bar was set against the wrong order of magnitude rather than against a real regression.",
+            "falsifier": "the dispatched arm costs more than 1.10x the direct arm on the frozen fixtures, both figures reproducible from a command in the bench log",
+            "measured_by": "phase 3.3"
+        },
+        {
+            "id": "wall-clock",
+            "what": "Per-fixture wall-clock of the capability-dispatched arm against the direct-call arm.",
+            "threshold": 1.25,
+            "direction": "at-most",
+            "unit": "ratio-vs-baseline",
+            "basis": "STATED DEFAULT. Looser than the token bar on purpose: dispatch adds a probe and a selection step whose cost is wall-clock rather than tokens, so a bar equal to the token one would fail on the mechanism working as designed. Revisit-if: the probe's own measured cost exceeds a quarter of the baseline, at which point the bar is measuring the probe rather than the dispatch.",
+            "falsifier": "median wall-clock of the dispatched arm exceeds 1.25x the direct arm over the frozen fixtures",
+            "measured_by": "phase 3.3"
+        },
+        {
+            "id": "setup-friction",
+            "what": "Manual steps a first-time operator performs before a dispatchable adapter runs at all.",
+            "threshold": 2,
+            "direction": "at-most",
+            "unit": "manual-steps",
+            "basis": "STATED DEFAULT, and the unit is the argument: steps are counted, not timed, because a timing figure on one machine is not transferable and a step count is. Two is 'install the engine, point at it'. Revisit-if: any adapter needs a credential, at which point the honest count is three and the bar moves with the reason recorded rather than the adapter being excluded.",
+            "falsifier": "any adapter counted as dispatchable needs more than two manual steps from a clean machine, counted from its own documented setup",
+            "measured_by": "phase 3.2"
+        },
+        {
+            "id": "deterministic-replay",
+            "what": "Re-running one fixture through one adapter twice yields the same required evidence fields.",
+            "threshold": 1.0,
+            "direction": "at-least",
+            "unit": "ratio",
+            "basis": "DERIVED. The frozen fixtures exist so a result is reproducible; an adapter whose required fields vary between runs cannot be compared against another adapter at all, which is what 3.2 exists to do. Timestamps and durations are explicitly OUT of the compared set — a bar that failed on a clock would be measuring the clock.",
+            "falsifier": "two runs of one fixture through one adapter differ in any required evidence field outside the declared volatile set",
+            "measured_by": "phase 3.2"
+        },
+        {
+            "id": "degraded-run-honesty",
+            "what": "A run that could not complete the full contract reports the degradation rather than emitting a partial envelope as if complete.",
+            "threshold": 1.0,
+            "direction": "at-least",
+            "unit": "ratio",
+            "basis": "DERIVED, and it is the bar the others rest on. Every ratio above is computed over runs the adapter CLAIMS completed; a degraded run silently counted as complete inflates all six. This is the same soundness invariant road-to-governed-harness-evolution 1.2 states for its activation ladder — an unobserved state is never silently converted to success.",
+            "falsifier": "any degraded run emits an envelope that a consumer cannot distinguish from a complete one",
+            "measured_by": "phase 3.2, phase 3.4"
+        }
+    ]
+}

package/src/config/ci-local-parity.yml

@@ -109,6 +109,56 @@ ci_only:
   # self-test is the half that IS worth running locally, and it is reachable —
   # `classify_change_risk --self-test` — but the workflow invokes it as a step of
   # its own rather than through the aggregate, which is what this checker sees.
+  # road-to-npm-payload-reduction Phase 3.1. `report_pack_delta` measures the
+  # BRANCH-vs-BASE packed payload, which has no meaning without a pull request:
+  # locally `--base origin/main --head HEAD` on main reads +0.0 KB every time, and
+  # the step's own contract is to write nothing when the delta is zero. It also
+  # checks out BOTH refs into throwaway worktrees and packs each (~1 minute), so
+  # putting it in `task ci` would add a minute to every local run for a number
+  # that is structurally absent locally. It is a REPORT and cannot red the build
+  # (`continue-on-error: true`, and the script exits 0 whatever the number), so
+  # there is no failure a contributor could discover only after pushing — which is
+  # the exact harm this checker exists to prevent.
+  #
+  # Reachable on demand: `task report-pack-delta -- --base <ref> --head <ref>`.
+  - id: report_pack_delta
+    class: artifact
+    reason: "a pull-request-only delta report with no local meaning (base==head reads +0.0 KB and the step writes nothing); it packs two refs in throwaway worktrees at ~1 min, cannot red the build, and is reachable on demand via `task report-pack-delta`"
+
+  # road-to-supervised-telemetry-collector step 4.2 (AC-7). Runs the
+  # dispatcher-reaching suite TWICE — once with the collector present-but-off,
+  # once with it aliased away entirely — and compares per-test verdicts rather
+  # than declaring each run green. That is the whole set twice, roughly a minute,
+  # which is not a per-change local gate; and its result is a property of a
+  # clean checkout rather than of a developer's working tree, since it pins
+  # HOME to an empty directory precisely so the invoking user's own collector
+  # state cannot decide the answer.
+  #
+  # Reachable on demand: `./scripts-run src/scripts/check_static_parity`.
+  - id: check_static_parity
+    class: benchmark
+    reason: "two full runs of the dispatcher-reaching suite, compared per-test verdict by verdict, ~1 minute; a per-change local gate cannot afford it and its answer is a property of a clean checkout rather than of a working tree"
+  # road-to-supervised-telemetry-collector step 5.2. What is CI-only is this
+  # WRAPPER, whose whole job is to write
+  # `internal/reports/supervision-lifecycle.json` stamped with
+  # `git rev-parse HEAD`. That artifact is gitignored and read by
+  # `check_supervision_claim_atomicity`, which refuses any result whose recorded
+  # revision is not HEAD — so an artifact written during a local run of a dirty
+  # working tree is evidence about a revision nobody shipped.
+  #
+  # CORRECTED on R2 round-3 finding 7. This note used to say the five properties
+  # "run in the ordinary vitest chain" locally AND that a `task ci` wrapper
+  # "would spawn real daemons on every local run" — which cannot both be true,
+  # and the second half was already stale: the same change excluded
+  # `collector_lifecycle.test.ts` from the `node-tests` shards. The accurate
+  # position is that the suite runs on demand and in the dedicated
+  # `Collector Lifecycle` job, and the wrapper's CI-only status rests on the
+  # revision-stamped artifact alone — the argument that survives.
+  #
+  # Reachable on demand: `./scripts-run src/scripts/run_lifecycle_suite`.
+  - id: run_lifecycle_suite
+    class: artifact
+    reason: "writes the revision-stamped lifecycle evidence artifact the atomicity gate reads; the artifact is gitignored and only meaningful at the revision CI is testing, while the five properties themselves already run locally in tests/scripts/collector_lifecycle.test.ts"
   - id: classify_change_risk
     class: benchmark
     reason: "invoked as the nightly drift workflow's self-test step; the classifier itself gates nothing and its `--self-test` is runnable locally on demand (`./scripts-run src/scripts/classify_change_risk --self-test`)"
@@ -124,6 +174,27 @@ ci_only:
   - id: check_finding_dispositions
     class: release
     reason: "adjudicates the release-PR self-review findings ledger, whose input JSON is produced by the self-review workflow job"
+  # road-to-source-silence Phase 5.3. Two modes, and the distinction is the whole
+  # reason this is a declaration rather than a `task ci` entry.
+  #
+  # The mode a CI workflow invokes on a schedule is the FIVE-SURFACE CENSUS
+  # (source-surface-sweep.yml, weekly). It needs `gh` for the pull-request
+  # surface and a full-depth clone for the 9,000-commit trunk surface, it takes
+  # minutes, it writes no verdict, and it deliberately CANNOT red the build — a
+  # scheduled job that fails `main` for a residual count nobody can lower this
+  # week is a job that gets disabled. Putting it in `task ci` would add minutes
+  # to every local run for a number that is a standing observation, not a gate.
+  #
+  # The mode that IS a gate — `--gate-metadata`, which refuses source
+  # attribution in a branch name, PR title, PR body or commit message — has a
+  # stronger local story than `task ci` membership gives anything else here: it
+  # runs on PRE-PUSH via src/scripts/hooks/prepush_metadata_sources.sh, i.e.
+  # BEFORE the metadata is public, which is the only moment fixing it is free.
+  # A contributor therefore discovers that failure locally by construction,
+  # which is exactly the harm this checker exists to prevent.
+  - id: sweep_source_surfaces
+    class: network
+    reason: "the CI invocation is the weekly five-surface census — needs `gh` for the PR surface and a full-depth clone for the ~9,000-commit trunk surface, writes counts not a verdict, and is deliberately non-failing; its GATE mode (`--gate-metadata`) is reachable locally on pre-push via src/scripts/hooks/prepush_metadata_sources.sh and by hand, so no failure is discoverable only after a push"
   - id: rule_trigger_eval
     class: network
     reason: "live cross-model LLM trigger evaluation in the secret-gated canary workflow; advisory, paid, and never gating"
@@ -198,6 +269,30 @@ ci_only:
 # worth remote enforcement, OR it should simply be added to a workflow. Prefer
 # adding it: a local-only gate is the direction that let real defects merge.
 local_only:
+  - id: check_host_loadability_reach
+    class: developer-machine-scoped
+    reason: >
+      `check_host_loadability --reach` asks whether each generated host tree
+      carries artefacts, and — when it does not — whether the TOOL is absent or
+      the PROJECTION is dead. Those two are opposite findings that every current
+      gate reports as the same green, because a checker that returns early on a
+      missing tree cannot tell them apart.
+
+      Local-only by declaration rather than by omission, and the reason inverts
+      the obvious one: the verdict depends on which host tools are INSTALLED,
+      and a CI runner has none. Wired into a workflow, every row would resolve
+      `skipped-tool-absent` and the gate would scan nothing — the empty-scope
+      false green this repository's gate-coverage manifest exists to refuse.
+
+      This CORRECTS `road-to-skill-ecosystem-runtime-enforcement` Phase 3 Step 2,
+      which asked for a continuous-integration-only job. That instruction fits
+      the SHAPE half (`check_host_loadability --root .`), which is already
+      wired into `consistency.yml` and does not depend on installed tools; it
+      does not fit the reach half, and wiring it there would have produced a
+      permanently-skipping check that looked like coverage. Measured on a
+      developer machine: 6 of 6 host surfaces present and projecting
+      (claude-code 13, cursor 228, cline 14, windsurf 215, gemini-cli 1,
+      copilot 1).
   - id: check_hook_bundle_content
     class: developer-machine-scoped
     reason: >

package/src/config/discovery/prompt-patterns.yml

@@ -0,0 +1,56 @@
+# Controlled prompt-pattern vocabulary for command `## Examples` Why lines.
+#
+# Read by `src/scripts/check_command_examples.ts` (sub-check c). A Why line on
+# an example must cite exactly ONE id from `approved_patterns`.
+#
+# WHY A CONTROLLED VOCABULARY AND NOT FREE PROSE. A worked example teaches two
+# things: what to type, and why that phrasing works. The second half is the part
+# that transfers to a command the reader has not seen. Free prose lets every
+# author invent their own account of it, and six accounts of the same pattern
+# teach the pattern less well than one. The ids are deliberately few and
+# deliberately about the SHAPE of the invocation, never about the command.
+#
+# FORWARD-ONLY, on the `command-verbs.yml` precedent (ADR-041): only commands
+# added, or promoted into `visible` / `advanced`, since the frozen grandfather
+# set in `check_command_examples.ts` are required to carry Why lines. The
+# existing surface is grandfathered and melts down voluntarily.
+#
+# Adding an id here is a governance change: land it in its own PR with the
+# reason the six below could not carry the case. Do NOT add an id to make one
+# awkward example pass — rewrite the example to an existing pattern, or leave
+# the Why line off and accept the gate's finding.
+
+approved_patterns:
+  # Name the end state, not the sequence of steps to reach it. The agent picks
+  # the steps; a step list from the operator overconstrains it and goes stale.
+  - outcome-not-steps
+
+  # Build the verification into the ask, so the agent can tell green from done
+  # without a second turn.
+  - self-check-loop
+
+  # Point at a file, a ticket, a URL, a line range — a resolvable location
+  # beats a description of the thing.
+  - measurable-target
+
+  # Hand over the artifact itself rather than describing it: paste the log, the
+  # diff, the failing output.
+  - give-the-artifact
+
+  # Cite an existing convention, doc, or sibling implementation as the standard
+  # to match, instead of restating it inline.
+  - point-at-reference
+
+  # State the shape the answer must arrive in — a table, JSON, one sentence, a
+  # file path — when the shape is what makes it usable.
+  - say-the-format
+
+# The two literals a Why line may use. Adopted verbatim from
+# `lint_examples.ts` (`### Why it works` / `**Why it works:**`), the strings
+# the demo linter already detects for the SAME purpose on a different
+# population. Reusing the strings rather than the code keeps the two
+# conventions textually aligned without coupling the gates — the demo linter's
+# scope and observable behaviour are compatibility-pinned and stay untouched.
+why_line_literals:
+  - '**Why it works:**'
+  - '### Why it works'

package/src/config/drafting-channels.yml

@@ -0,0 +1,43 @@
+# Drafting channel registry — the `--channel` enum and its per-channel
+# defaults, extracted from docs/contracts/write-engine.md § Per-channel
+# defaults (road-to-channel-contract-and-profile-drift Phase 1.2).
+#
+# WHY THIS IS A SIBLING OF reach-channels.yml AND NOT AN EXTENSION OF IT.
+# One line, as the step requires: a drafting channel is an OUTPUT SHAPE for
+# prose this package writes (how long, how many paragraphs, whether hashtags
+# are allowed), whereas a reach channel is an EXTERNAL RETRIEVAL BACKEND the
+# operator installs and the package never calls — that file's own header says
+# it is "not a routing table, not a recommendation, not an agent-facing
+# surface" and that its Phase-0 benchmark returned `band: stop`, so nothing in
+# it is agent-facing at all. The two share the word "channel" and no field: a
+# drafting channel has no backend, no install string, no health probe and no
+# lifecycle; a reach channel has no length and no cadence. Merging them would
+# produce one schema in which every field is optional for half its rows, which
+# is the "two truths for one word" this roadmap's Risk Register row 2 names.
+#
+# WHAT READS THIS FILE. `docs/contracts/write-engine.md` is the prose contract
+# and stays the human-facing statement of the same values; this file is the
+# machine-checked copy, and
+# `tests/scripts/drafting_channels_schema.test.ts` asserts the two agree, so a
+# future edit to one that is not made to the other fails rather than drifts.
+#
+# THE VALUE IS THE FLAG VALUE. `id` is what a user types after `--channel=`.
+# `linkedin-post` is the value; `linkedin` is not a value and is rejected —
+# see the test case that pins exactly that, because the short form is the
+# plausible typo and silently accepting it would make the enum decorative.
+schema_version: drafting-channels-v1
+channels:
+  - id: tweet
+    length_default: 50
+    cadence: One paragraph, no lists.
+  - id: linkedin-post
+    length_default: 180
+    cadence: >-
+      2–4 short paragraphs. Hashtags only if
+      `style.fingerprint.hashtag_rules` allows.
+  - id: blog
+    length_default: 600
+    cadence: Inherits `style.fingerprint.paragraph_cadence`.
+  - id: freeform
+    length_default: 250
+    cadence: Inherits `style.fingerprint.paragraph_cadence`.

package/src/config/estate-count-budget.json

@@ -1,33 +1,40 @@
 {
-  "_comment": "Roadmap-estate ratchet (road-to-estate-drawdown T2 + T3). POLICY ONLY \u2014 this file no longer stores a number. Until ADR-243 it carried a measured `baseline` object plus a `baseline_history` audit trail (113 entries at removal, last measurement 23/59/60), and that made it the most-conflicted non-generated path in the repository: 7 of 7 CONFLICTING open PRs on 2026-08-21, and 39 of 43 non-merge commits in a 60-day window moving the baseline. `check_estate_count` now MEASURES the floor on the base ref's own tree with the same functions it measures HEAD with, so the 'before' side is still something the change under review cannot rewrite \u2014 it is just no longer something a human has to remember to walk. Two failure classes went with the storage and are now unrepresentable: a baseline left above the truth (spendable headroom, which the gate used to fail on as an un-walked tightening), and a baseline left below it after main archived a roadmap without walking the number, which reddened every branch that merged main. The legitimate-growth path the stored number provided \u2014 a raise carrying a recorded reason \u2014 is replaced by `estate_growth_exempt: <reason>` in the frontmatter of a roadmap the change touches, read from the diff so it cannot be banked. T1's proposed ceilings stay under `target` and are still NOT registered: they are the maintainer's to set.",
-  "schema_version": 2,
-  "registered_at": "2026-08-18",
-  "baseline_removed_at": "2026-08-22",
-  "owner": "maintainer",
-  "review_by": "2027-08-18",
-  "metric": {
-    "basis": "src/scripts/check_estate_count.ts. The live side uses collect() from update_roadmap_progress \u2014 the same parser the dashboard is generated from, imported rather than re-implemented. The floor side runs the SAME functions over a scratch copy of the base ref's agents/roadmaps/, materialised by _lib/base_tree.ts (git ls-tree + git cat-file --batch; `git archive` cannot be used here because .gitattributes carries `/agents export-ignore` and would yield an empty, silently-zero tree).",
-    "active_roadmaps": "non-draft roadmap candidates at the top level of agents/roadmaps/, as collect() counts them. This is exactly the number the dashboard header prints as 'N open roadmaps'.",
-    "later_roadmaps": "roadmap-shaped *.md files under agents/roadmaps/later/ \u2014 the same is_roadmap_candidate name filter the active side uses, so later/README.md is not counted. Counted from the filesystem because parked roadmaps sit outside collect()'s corpus by design; they are estate all the same, and a drawdown that moved everything into later/ and called the number down would be the burial T1's quality anchor exists to prevent.",
-    "open_blockers": "blockers whose Status does not start with `resolved`, summed over the active and later corpora.",
-    "floor": "the same three metrics measured at the base ref (origin/main, else the merge commit's first parent). No base ref resolves -> no floor -> the gate FAILS rather than skipping: a shrink-only gate with no floor passes every possible tree. `--base <ref>` is the explicit escape."
-  },
-  "growth_allowances": {
-    "_comment": "An exact floor leaves no incidental headroom, so every legitimate increase needs a named path. Two are automatic because existing policy already sanctions the act; the third is the general authorisation.",
-    "active_roadmaps": "+1 per addition carrying `estate_offset_exempt: <reason>` in its own frontmatter (unchanged T3 key). Without this the sanctioned un-offsettable addition would fail the count half with no green path.",
-    "later_roadmaps": "+1 per roadmap moved from the active top level into later/ in the same change. Parking relocates estate rather than creating it. It does NOT cover a later/ file that appears from nowhere, and it is keyed on parking rather than on any offset so that an archive move cannot buy a new later/ file.",
-    "open_blockers": "none. Nothing in the policy sanctions a new blocker, so it takes the claim path or nothing.",
-    "claim": "`estate_growth_exempt: <reason>` added, in this change, to the frontmatter of any roadmap under agents/roadmaps/. Authorises growth in any metric, with the reason printed. Diff-scoped, so a claim left in a file authorises nothing later \u2014 the banking failure a stored baseline had. Deliberately unbounded, which a stored baseline could not afford: there the surplus of an over-raise was inherited by the next change, where nobody could act on it; here the next change's floor IS this change's measurement, so there is no surplus to inherit."
-  },
-  "target": {
-    "_comment": "T1's proposed ceilings, kept as the destination. PROPOSALS, NOT REGISTERED: the roadmap says in as many words that both numbers and the window belong to the maintainer, and no date is pinned in this file. Nothing reads these values \u2014 `one_in_one_out.applies_above_active` is the only threshold the gate evaluates.",
-    "active_roadmaps": 15,
-    "open_blockers": 12,
-    "window": "roughly six weeks from campaign start (drafted; unregistered)"
-  },
-  "one_in_one_out": {
-    "_comment": "T3. `applies_above_active: null` means UNCONDITIONAL. T3 phrases the condition as 'while the active count sits above target', and T1 says the target belongs to the maintainer \u2014 so rather than inventing a ceiling so the condition could be evaluated, null states that no ceiling is registered and the lint therefore applies. Registering a number here is how it gets a threshold; registering one above the live count is how it is turned off.",
-    "applies_above_active": null,
-    "exemption": "estate_offset_exempt: <reason> in the added roadmap's own frontmatter. The key lives in the file rather than in this config for the reason RATCHET_RESET_KEY gives for living inside its baseline JSON: the claim shows up in the diff of the change that makes it."
-  }
+    "_comment": "Roadmap-estate ratchet (road-to-estate-drawdown T2 + T3). POLICY ONLY — this file no longer stores a number. Until ADR-243 it carried a measured `baseline` object plus a `baseline_history` audit trail (113 entries at removal, last measurement 23/59/60), and that made it the most-conflicted non-generated path in the repository: 7 of 7 CONFLICTING open PRs on 2026-08-21, and 39 of 43 non-merge commits in a 60-day window moving the baseline. `check_estate_count` now MEASURES the floor on the base ref's own tree with the same functions it measures HEAD with, so the 'before' side is still something the change under review cannot rewrite — it is just no longer something a human has to remember to walk. Two failure classes went with the storage and are now unrepresentable: a baseline left above the truth (spendable headroom, which the gate used to fail on as an un-walked tightening), and a baseline left below it after main archived a roadmap without walking the number, which reddened every branch that merged main. The legitimate-growth path the stored number provided — a raise carrying a recorded reason — is replaced by `estate_growth_exempt: <reason>` in the frontmatter of a roadmap the change touches, read from the diff so it cannot be banked. T1's proposed ceilings stay under `target` and are still NOT registered: they are the maintainer's to set.",
+    "schema_version": 2,
+    "registered_at": "2026-08-18",
+    "baseline_removed_at": "2026-08-22",
+    "owner": "maintainer",
+    "review_by": "2027-08-18",
+    "metric": {
+        "basis": "src/scripts/check_estate_count.ts. The live side uses collect() from update_roadmap_progress — the same parser the dashboard is generated from, imported rather than re-implemented. The floor side runs the SAME functions over a scratch copy of the base ref's agents/roadmaps/, materialised by _lib/base_tree.ts (git ls-tree + git cat-file --batch; `git archive` cannot be used here because .gitattributes carries `/agents export-ignore` and would yield an empty, silently-zero tree). SKILL METRICS (added 2026-08-24): _lib/skill_estate.ts walks src/skills/*/SKILL.md under the SAME root, so the floor side measures the base ref's own skill tree with the same function. That needs a SECOND materialised subtree — materialiseSubtree takes one prefix — and the two are independent on purpose: a base ref with no src/skills (an old tag, a shallow clone) drops the skill metrics and leaves the roadmap metrics ratcheting.",
+        "active_roadmaps": "non-draft roadmap candidates at the top level of agents/roadmaps/, as collect() counts them. This is exactly the number the dashboard header prints as 'N open roadmaps'.",
+        "later_roadmaps": "roadmap-shaped *.md files under agents/roadmaps/later/ — the same is_roadmap_candidate name filter the active side uses, so later/README.md is not counted. Counted from the filesystem because parked roadmaps sit outside collect()'s corpus by design; they are estate all the same, and a drawdown that moved everything into later/ and called the number down would be the burial T1's quality anchor exists to prevent.",
+        "open_blockers": "blockers whose Status does not start with `resolved`, summed over the active and later corpora.",
+        "floor": "the same three metrics measured at the base ref (origin/main, else the merge commit's first parent). No base ref resolves -> no floor -> the gate FAILS rather than skipping: a shrink-only gate with no floor passes every possible tree. `--base <ref>` is the explicit escape.",
+        "skill_count": "Maintained src/skills/*/SKILL.md files; `lifecycle: deprecated` EXCLUDED. The exclusion is load-bearing rather than tidy: with deprecated skills counted, deprecating one would create no headroom and the retirement mechanism would be unusable against its own gate. 0 skills carry it today, so the exclusion is a no-op now and a correctness property once a tranche lands. Measured 2026-08-24: 299. Reproduce with `find src/skills -name SKILL.md | wc -l` (299 including any deprecated) or `npx tsx -e \"import {measureSkillEstate} from './src/scripts/_lib/skill_estate.ts'; console.log(measureSkillEstate(process.cwd()))\"` for the split.",
+        "skill_description_tokens": "Exact-BPE tokens (js-tiktoken, cl100k_base, via _lib/token_count.ts gpt_tokens) across those skills' `description:` frontmatter fields ONLY — not bodies. Measured 2026-08-24: 11,461 over 299 skills (52,983 chars). A SECOND DIMENSION, not a companion figure: a count ratchet alone is gameable by merging four large skills into one file, which lowers the count while the description payload a host must carry stays put. AI council 2/2 (2026-08-24) asked for both in one gate over the roadmap's own recommendation of count-plus-informational-figure. UNRESOLVED rather than approximated: when the tokeniser does not resolve on either side the metric is dropped from the compare with a printed reason, because an exact reading against a proxy one differs by more than the growth this gate is trying to catch.",
+        "skill_metric_rejected_candidates": "Measured before choosing, not argued. (b) catalogue bytes via _lib/skill_catalogue.ts read 0 on a real checkout: readProjectedCatalogue walks .claude/skills, empty in any tree where `task generate-tools` cannot complete (it fails under projection.mode=scoped without the config package) — a ratchet whose reading depends on whether a generator ran reds for the environment. (d) host-listing slots are the host's decision, not the repository's: a measured install published its own budget event stating it had stripped every description and dropped 402 entries. Neither is reproducible from the repo, so neither can carry a floor.",
+        "concern_count": "Hook concerns declared under the `concerns:` map in src/scripts/hook_manifest.yaml. Measured 2026-08-30: 55. Reproduce with `npx tsx -e \"import {countConcerns} from './src/scripts/_lib/concern_estate.ts';import fs from 'node:fs';console.log(countConcerns(fs.readFileSync('src/scripts/hook_manifest.yaml','utf-8')))\"`. THE ORIGINATING ROADMAP'S REPRODUCE COMMAND IS A PROXY AND OVER-COUNTS, and the correction is recorded here rather than only in the roadmap because this file is what a later reader checks the number against. `grep -cE '^  [a-z][a-z0-9_-]*:$'` greps the WHOLE manifest, so it also counts members of `roles:`, `platforms:` and `native_event_aliases:`, which sit at the same two-space indent. Re-measured at the roadmap's own six pins the over-count is EXACTLY 16 every time: 63/65/65/68/69/71 by the grep is 47/49/49/52/53/55 scoped. Both consequences, because they point in opposite directions -- the FINDING survives untouched (the delta is constant, so the axis climbs +8 either way and is growing exactly as the roadmap says), and the ABSOLUTE FIGURE does not (the axis stands at 55, and a floor of 71 is one this gate's own parser could never reproduce, i.e. a gate that fails on its first honest run). REJECTED CANDIDATES, measured rather than argued: counting `platforms:` rows instead -- rejected, it is 8 and flat across all six pins, so it measures host coverage and not concern growth; counting the per-(platform,event) cap in lint_hook_concern_budget.ts -- rejected, DEFAULT_MAX_PER_EVENT=8 is blind to total growth by construction (eight new concerns spread across eight events violate nothing) and it ships DEFAULT_HARD_FAIL=false, which is why this axis needed a ratchet at all."
+    },
+    "growth_allowances": {
+        "_comment": "An exact floor leaves no incidental headroom, so every legitimate increase needs a named path. Two are automatic because existing policy already sanctions the act; the third is the general authorisation.",
+        "active_roadmaps": "+1 per addition carrying `estate_offset_exempt: <reason>` in its own frontmatter (unchanged T3 key). Without this the sanctioned un-offsettable addition would fail the count half with no green path.",
+        "later_roadmaps": "+1 per roadmap moved from the active top level into later/ in the same change. Parking relocates estate rather than creating it. It does NOT cover a later/ file that appears from nowhere, and it is keyed on parking rather than on any offset so that an archive move cannot buy a new later/ file.",
+        "open_blockers": "none. Nothing in the policy sanctions a new blocker, so it takes the claim path or nothing.",
+        "claim": "`estate_growth_exempt: <reason>` added, in this change, to the frontmatter of any roadmap under agents/roadmaps/. Authorises growth in any metric, with the reason printed. Diff-scoped, so a claim left in a file authorises nothing later — the banking failure a stored baseline had. Deliberately unbounded, which a stored baseline could not afford: there the surplus of an over-raise was inherited by the next change, where nobody could act on it; here the next change's floor IS this change's measurement, so there is no surplus to inherit.",
+        "skill_count": "0 — no allowance, deliberately. The defect this metric addresses is a corpus that grew +8 in one release (290 at 14.0.0, 291 at 14.9.0 and 14.10.0, 299 at 14.11.0) with nothing objecting. An addition takes the estate_growth_exempt claim path — a recorded reason read from the diff — or it fails.",
+        "skill_description_tokens": "0 — same reasoning. An addition that grows the description payload without adding a file is the gaming path this dimension exists to close, and an allowance would reopen it.",
+        "concern_count": "0 — no allowance, deliberately, and the same reason skill_count gives. An allowance reopens the gaming path the dimension exists to close. Sharper here than for skills: eight concerns spread across eight events violate the existing per-event cap zero times, which is precisely why a total-growth ratchet was needed and precisely why it must not carry a per-change freebie. An addition takes the estate_growth_exempt claim path — a recorded reason read from the diff — or it fails."
+    },
+    "target": {
+        "_comment": "T1's proposed ceilings, kept as the destination. PROPOSALS, NOT REGISTERED: the roadmap says in as many words that both numbers and the window belong to the maintainer, and no date is pinned in this file. Nothing reads these values — `one_in_one_out.applies_above_active` is the only threshold the gate evaluates.",
+        "active_roadmaps": 15,
+        "open_blockers": 12,
+        "window": "roughly six weeks from campaign start (drafted; unregistered)"
+    },
+    "one_in_one_out": {
+        "_comment": "T3. `applies_above_active: null` means UNCONDITIONAL. T3 phrases the condition as 'while the active count sits above target', and T1 says the target belongs to the maintainer — so rather than inventing a ceiling so the condition could be evaluated, null states that no ceiling is registered and the lint therefore applies. Registering a number here is how it gets a threshold; registering one above the live count is how it is turned off.",
+        "applies_above_active": null,
+        "exemption": "estate_offset_exempt: <reason> in the added roadmap's own frontmatter. The key lives in the file rather than in this config for the reason RATCHET_RESET_KEY gives for living inside its baseline JSON: the claim shows up in the diff of the change that makes it."
+    }
 }