@event4u/agent-config 14.12.0 → 14.13.0

package/src/scripts/probe_unblocked_ask.ts

@@ -0,0 +1,279 @@
+#!/usr/bin/env tsx
+/**
+ * The unblocked-ask rate — the class `user-interaction` measured and then had
+ * no instrument for.
+ *
+ * ## Why this one, and not one of the other 55
+ *
+ * `road-to-undeclared-obligation-disposition` Phase 2.1 ranks the
+ * `cheaply-probeable` bucket by MEASURED failure rather than by feel, and the
+ * ranking is lopsided: of 56 rules in that bucket, exactly **one** carries a
+ * cited measurement of its own failure. `user-interaction.md:75` records a
+ * 30-session conformance audit in which **every** malformed ask was a one-line
+ * parenthetical or a trailing free-text offer, and states that **no gate ships**
+ * for that class because `check_reply_consistency` inspects numbered-option
+ * blocks — "exactly the surface that did not fail".
+ *
+ * That is the whole case for building this and not a fourth probe. Phase 2.3
+ * caps the roadmap at one.
+ *
+ * ## What is counted
+ *
+ * A **hand-back** assistant turn — one immediately followed by a genuine user
+ * turn, i.e. where the agent actually stopped — that HANDS A DECISION and
+ * carries **no** numbered-options block. The rule's own § "The trigger is a
+ * decision, not a format" says the obligation fires on handing a decision in any
+ * form, so a trailing offer is an ask and owes a recommendation line.
+ *
+ * Of those, an ask is **malformed** when no recommendation line follows it.
+ *
+ * ## Honest bounds, and they are wide
+ *
+ * 1. **"Hands a decision" is a heuristic.** It matches offer shapes — *"soll ich
+ *    …?"*, *"shall I …?"*, *"sag Bescheid, wenn …"*, *"willst du …?"* — anchored
+ *    in the closing lines. A genuine clarifying question is deliberately NOT
+ *    excluded, because `user-interaction` treats a bare yes/no as an ask too.
+ *    Some rhetorical questions will be counted. The rate is therefore a
+ *    CEILING for malformed asks of this class, not a point estimate.
+ * 2. **Turns WITH a numbered block are excluded**, not judged. That surface
+ *    already has `check_reply_consistency`; measuring it here would double-count
+ *    a covered class and hide the uncovered one.
+ * 3. **A recommendation line is matched on the label**, `Recommendation:` or
+ *    `Empfehlung:` (with or without emphasis). A recommendation phrased without
+ *    the label reads as malformed here. The rule requires the label — a
+ *    wrong-language label is explicitly "no recommendation" — so this is the
+ *    rule's own bar, but it is a bar on FORM.
+ *
+ * Both edges are printed. A reader who cannot see the bracket cannot judge the
+ * number.
+ *
+ * Usage:
+ *   ./scripts-run src/scripts/probe_unblocked_ask [--limit N] [--store PATH] [--json]
+ *   ./scripts-run src/scripts/probe_unblocked_ask --self-test
+ *
+ * Exit codes: 0 always — a measurement, not a gate. `--self-test` exits 1 when
+ * the detector fails to fire on its fixtures.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+import { defaultStore, HARNESS_TEXT, isInjectedBody } from './conformance_scan.js';
+import { isSyntheticPrompt } from './_lib/prompt_shape.js';
+
+/** A numbered-options block — the surface `check_reply_consistency` already reads. */
+export const NUMBERED_BLOCK = /^\s{0,3}(\d+)[.)]\s+\S/m;
+
+/** The recommendation line, matched on its label. Either language. */
+export const RECOMMENDATION = /^\s{0,3}\**\s*(Recommendation|Empfehlung)\s*:?\**/im;
+
+/**
+ * Offer shapes that hand a decision without a block. Every one of these is a
+ * shape the 2026-08-06 audit found in a REAL malformed ask.
+ */
+export const OFFER_SHAPES: readonly RegExp[] = [
+    /\bsoll(en)? ich\b[^.!?]{0,120}\?/i,
+    /\bwillst du\b[^.!?]{0,120}\?/i,
+    /\bm(ö|oe)chtest du\b[^.!?]{0,120}\?/i,
+    /\bsag (mir )?bescheid,? (wenn|ob|falls)\b/i,
+    /\bwenn du (willst|m(ö|oe)chtest),? (dann )?(mache|kann|nehme|ziehe)\b/i,
+    /\bshall i\b[^.!?]{0,120}\?/i,
+    /\bshould i\b[^.!?]{0,120}\?/i,
+    /\bdo you want me to\b[^.!?]{0,120}\?/i,
+    /\bwould you like me to\b[^.!?]{0,120}\?/i,
+    /\blet me know (if|whether)\b/i,
+];
+
+interface Turn {
+    role: 'user' | 'assistant';
+    text: string;
+    at: string;
+}
+
+function turns(lines: string[]): Turn[] {
+    const out: Turn[] = [];
+    for (const line of lines) {
+        if (!line.trim()) continue;
+        let e: Record<string, unknown>;
+        try {
+            e = JSON.parse(line) as Record<string, unknown>;
+        } catch {
+            continue;
+        }
+        if (e['isSidechain'] === true) continue;
+        if (e['type'] === 'user' && e['toolUseResult'] !== undefined) continue;
+        if (e['isCompactSummary'] === true) continue;
+        const msg = e['message'] as { role?: string; content?: unknown } | undefined;
+        const role = msg?.role;
+        if (role !== 'user' && role !== 'assistant') continue;
+        const c = msg?.content;
+        const text =
+            typeof c === 'string'
+                ? c
+                : Array.isArray(c)
+                  ? c
+                        .filter((b: { type?: string }) => b?.type === 'text')
+                        .map((b: { text?: string }) => b.text ?? '')
+                        .join('\n')
+                  : '';
+        if (!text.trim()) continue;
+        if (role === 'assistant' && HARNESS_TEXT.test(text.trim())) continue;
+        if (role === 'user' && (isSyntheticPrompt(text) || isInjectedBody(text))) continue;
+        out.push({ role, text, at: String(e['timestamp'] ?? '') });
+    }
+    return out;
+}
+
+export interface AskVerdict {
+    /** The turn hands a decision with no numbered block. */
+    unblockedAsk: boolean;
+    /** …and carries no recommendation label. */
+    malformed: boolean;
+}
+
+/** Classify one assistant hand-back's closing lines. */
+export function classifyTail(tail: string): AskVerdict {
+    if (NUMBERED_BLOCK.test(tail)) return { unblockedAsk: false, malformed: false };
+    const offers = OFFER_SHAPES.some((re) => re.test(tail));
+    if (!offers) return { unblockedAsk: false, malformed: false };
+    return { unblockedAsk: true, malformed: !RECOMMENDATION.test(tail) };
+}
+
+export interface Result {
+    handbacks: number;
+    withBlock: number;
+    unblockedAsks: number;
+    malformed: number;
+    samples: { session: string; at: string; span: string }[];
+}
+
+export function measure(store: string, limit: number): Result {
+    const r: Result = { handbacks: 0, withBlock: 0, unblockedAsks: 0, malformed: 0, samples: [] };
+    let files: string[];
+    try {
+        files = fs.readdirSync(store).filter((f) => f.endsWith('.jsonl'));
+    } catch {
+        return r;
+    }
+    const ordered = files
+        .map((f) => ({ f, m: fs.statSync(path.join(store, f)).mtimeMs }))
+        .sort((a, b) => b.m - a.m)
+        .slice(0, limit)
+        .map((x) => x.f);
+
+    for (const f of ordered) {
+        const session = f.replace(/\.jsonl$/, '').slice(0, 8);
+        const ts = turns(fs.readFileSync(path.join(store, f), 'utf8').split('\n'));
+        for (let i = 0; i < ts.length; i += 1) {
+            const t = ts[i] as Turn;
+            if (t.role !== 'assistant') continue;
+            const next = ts[i + 1];
+            if (next !== undefined && next.role !== 'user') continue;
+            r.handbacks += 1;
+            // Closing lines only: an offer buried mid-reply is not the hand-back.
+            const tail = t.text.trimEnd().split('\n').slice(-8).join('\n');
+            if (NUMBERED_BLOCK.test(tail)) {
+                r.withBlock += 1;
+                continue;
+            }
+            const v = classifyTail(tail);
+            if (!v.unblockedAsk) continue;
+            r.unblockedAsks += 1;
+            if (v.malformed) {
+                r.malformed += 1;
+                if (r.samples.length < 5) {
+                    const hit = OFFER_SHAPES.find((re) => re.test(tail));
+                    r.samples.push({
+                        session,
+                        at: t.at,
+                        span: (tail.match(hit as RegExp)?.[0] ?? '').slice(0, 110),
+                    });
+                }
+            }
+        }
+    }
+    return r;
+}
+
+/**
+ * Prove the detector fires, and prove it stays silent where it must.
+ *
+ * An instrument never seen fire has unknown sensitivity — and one that fires on
+ * everything measures nothing, which is why the negative cases are here too.
+ */
+export function selfTest(): number {
+    const cases: Array<[string, string, boolean, boolean]> = [
+        ['a trailing German offer with no recommendation', 'Fertig.\n\nSag Bescheid, wenn ich die drei Zeilen mitnehmen soll.', true, true],
+        ['a bare yes/no offer', 'Der Branch ist grün.\n\nSoll ich das so umsetzen?', true, true],
+        ['an English trailing offer', 'Done.\n\nLet me know if you want the second half too.', true, true],
+        ['an offer WITH a recommendation label', 'Soll ich das so umsetzen?\n\n**Empfehlung:** ja, es ist reversibel.', true, false],
+        ['a numbered block is excluded — another gate reads it', '1. do it\n2. skip it\n\nRecommendation: 1', false, false],
+        ['an ordinary statement hands nothing', 'Fixed the schema lint; force-pushed b17c4ef8.', false, false],
+        ['a question about the code is not an offer to act', 'Why does this function take a callback?', false, false],
+    ];
+    let failed = 0;
+    for (const [name, tail, wantAsk, wantMalformed] of cases) {
+        const v = classifyTail(tail);
+        const ok = v.unblockedAsk === wantAsk && v.malformed === wantMalformed;
+        process.stdout.write(
+            `${ok ? '✅' : '❌'}  ${name} — ask=${String(v.unblockedAsk)} malformed=${String(v.malformed)}` +
+                (ok ? '\n' : ` (wanted ask=${String(wantAsk)} malformed=${String(wantMalformed)})\n`),
+        );
+        if (!ok) failed += 1;
+    }
+    const positives = cases.filter((c) => c[3]).length;
+    if (positives < 3) {
+        process.stderr.write('❌  probe_unblocked_ask --self-test: fewer than 3 positive cases — a truncated suite must fail.\n');
+        return 1;
+    }
+    process.stdout.write(
+        `\nprobe_unblocked_ask --self-test: ${String(cases.length - failed)}/${String(cases.length)} case(s) behaved ` +
+            `(${String(positives)} positive, ${String(cases.length - positives)} negative)\n`,
+    );
+    return failed > 0 ? 1 : 0;
+}
+
+export function main(argv: string[]): number {
+    let limit = 60;
+    let storeArg: string | null = null;
+    let json = false;
+    for (let i = 0; i < argv.length; i += 1) {
+        const a = argv[i] as string;
+        if (a === '--limit') limit = Number(argv[++i]);
+        else if (a === '--store') storeArg = String(argv[++i]);
+        else if (a === '--json') json = true;
+        // --self-test runs BEFORE the store is resolved: the fixtures are
+        // in-process, and resolving a transcript store that may not exist here
+        // would make the sensitivity proof depend on the host having one.
+        else if (a === '--self-test') return selfTest();
+        else {
+            process.stderr.write(`probe_unblocked_ask: unrecognized argument: ${a}\n`);
+            return 0;
+        }
+    }
+    const store = storeArg ?? defaultStore(process.cwd());
+    const r = measure(store, limit);
+    if (json) {
+        process.stdout.write(`${JSON.stringify(r, null, 2)}\n`);
+        return 0;
+    }
+    const pct = (n: number, d: number): string => (d === 0 ? 'n/a' : `${((100 * n) / d).toFixed(1)}%`);
+    process.stdout.write(
+        `probe_unblocked_ask · ${String(limit)} most recent session(s) under ${store}\n` +
+            `  hand-back turns          ${String(r.handbacks)}\n` +
+            `  …with a numbered block   ${String(r.withBlock)}  (excluded — check_reply_consistency reads that surface)\n` +
+            `  …unblocked asks          ${String(r.unblockedAsks)}  ${pct(r.unblockedAsks, r.handbacks)} of hand-backs\n` +
+            `  …of those, malformed     ${String(r.malformed)}  ${pct(r.malformed, r.unblockedAsks)} of unblocked asks\n` +
+            '\n  CEILING, not a point estimate: "hands a decision" is a heuristic and a\n' +
+            '  rhetorical question can match it. A recommendation is matched on its LABEL,\n' +
+            '  which is the rule\'s own bar but a bar on form.\n',
+    );
+    for (const s of r.samples) {
+        process.stdout.write(`    · ${s.session} ${s.at}: ${s.span}\n`);
+    }
+    return 0;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+    process.exit(main(process.argv.slice(2)));
+}

package/src/scripts/render_benchmark_md.ts

@@ -617,7 +617,7 @@ export function render(quiet = false): number {
     const parts = [
         '# Package-Impact A/B Benchmark',
         '',
-        '> Generated by `scripts/render_benchmark_md.py`. Source of truth: ' +
+        '> Generated by `render_benchmark_md`. Do not edit. Source of truth: ' +
             '`internal/bench/reports/ab/`. Re-render anytime with `task bench:ab:diff`.',
         '',
         render_headline(trackA, trackB, trackBRdp),

package/src/scripts/rule_activation_census.ts

@@ -58,6 +58,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
+import { isExclusivelyPackageOnly } from '../install/partitionEligibility.js';
 import { _claude_paths_plan, _has_non_path_trigger, _parse_frontmatter } from './condense.js';
 
 const RULES_DIR = path.join('src', 'rules');
@@ -83,6 +84,13 @@ export interface RuleActivation {
     emitted_globs: string[];
     /** Patterns the emitter deliberately drops, with the reason it records. */
     dropped: { pattern: string; reason: string }[];
+    /**
+     * Scoped to this package alone, so ADR-236 withholds it from every global
+     * host layer. Load-bearing for the projection comparison: a package-only
+     * rule is counted by the source verdict and is absent from a delivered
+     * tree by design, not by drift.
+     */
+    package_only: boolean;
     /**
      * The emitter's verdict in one word.
      * `scoped` — loads on a path match · `unconditional` — loads every session ·
@@ -111,7 +119,11 @@ function _declares(meta: Record<string, unknown>, keys: readonly string[]): bool
 }
 
 /** Classify one rule file through the emitter's own exported decision path. */
-export function classify_rule(id: string, content: string): RuleActivation {
+export function classify_rule(
+    id: string,
+    content: string,
+    package_only = false,
+): RuleActivation {
     const [meta] = _parse_frontmatter(content);
     const plan = _claude_paths_plan(meta);
     const has_path_trigger = _declares(meta, PATH_TRIGGER_KEYS);
@@ -139,6 +151,7 @@ export function classify_rule(id: string, content: string): RuleActivation {
         emitted_globs: plan.globs,
         dropped: plan.dropped.map((d) => ({ pattern: d.pattern, reason: d.reason })),
         verdict,
+        package_only,
     };
 }
 
@@ -150,7 +163,11 @@ export function census(root: string): RuleActivation[] {
         .map((e) => e.name)
         .sort();
     return files.map((f) =>
-        classify_rule(f.replace(/\.md$/, ''), fs.readFileSync(path.join(dir, f), 'utf8')),
+        classify_rule(
+            f.replace(/\.md$/, ''),
+            fs.readFileSync(path.join(dir, f), 'utf8'),
+            isExclusivelyPackageOnly(path.join(dir, f)),
+        ),
     );
 }
 
@@ -223,10 +240,14 @@ export function main(): number {
 
     const rows = census(root);
     const sum = summarize(rows);
+    const resolved_projection_dir =
+        projection_dir === undefined || projection_dir === null || projection_dir === ''
+            ? ''
+            : path.isAbsolute(projection_dir)
+              ? projection_dir
+              : path.join(root, projection_dir);
     const projection = projection_dir
-        ? projection_reading(path.isAbsolute(projection_dir)
-            ? projection_dir
-            : path.join(root, projection_dir))
+        ? projection_reading(resolved_projection_dir)
         : null;
 
     if (as_json) {
@@ -259,11 +280,51 @@ export function main(): number {
             `\n  host projection at ${projection_dir} — reported SEPARATELY, not merged:\n` +
                 `    files ${projection.files} · declaring paths: ${projection.with_paths}\n`,
         );
-        if (projection.with_paths !== sum.scoped) {
+        // The source verdict counts EVERY rule in `src/rules/`. A GLOBAL host
+        // layer does not carry the package-only ones: ADR-236 partitions them to
+        // the project layer, so such a tree is expected to be short by exactly
+        // that many. Comparing the raw counts reported a divergence on every
+        // partitioned install forever — the emitter was right and the
+        // comparator was not subtracting.
+        //
+        // But the subtraction is NOT unconditional, and making it so was its own
+        // regression (completion review, 2026-08-30): a full or project-layer
+        // projection — which is also the fail-safe default `partitionEligibility`
+        // returns on a fresh checkout, an absent install record, or a version or
+        // fingerprint mismatch — DOES carry those rules, and for this repo's own
+        // project layer `source-of-truth` is the one rule delivered there and the
+        // only one declaring `paths:`. Subtracting it there inverts the line.
+        //
+        // So the partition is DETECTED from the projection rather than assumed:
+        // if a package-only rule's file is present, this is not a global layer.
+        const pkg_only_ids = rows.filter((r) => r.package_only).map((r) => r.id);
+        const partitioned = !pkg_only_ids.some((id) =>
+            fs.existsSync(path.join(resolved_projection_dir, `${id}.md`)),
+        );
+        const scoped_pkg_only = partitioned
+            ? rows.filter((r) => r.verdict === 'scoped' && r.package_only)
+            : [];
+        const expected = sum.scoped - scoped_pkg_only.length;
+        if (scoped_pkg_only.length > 0) {
+            process.stdout.write(
+                `    source scopes ${sum.scoped}; ${scoped_pkg_only.length} of those ` +
+                    `${scoped_pkg_only.length === 1 ? 'is' : 'are'} package-only and never\n` +
+                    `      delivered (${scoped_pkg_only.map((r) => r.id).join(', ')}), so a ` +
+                    `partitioned projection is\n      expected to declare ${expected}.\n`,
+            );
+        }
+        if (projection.with_paths !== expected) {
+            process.stdout.write(
+                `    ⚠️  diverges from the source verdict (${expected} expected` +
+                    `${scoped_pkg_only.length > 0 ? `, ${sum.scoped} before the package-only partition` : ''}).\n` +
+                    `        A projection carries no record of the scope or commit it was generated\n` +
+                    `        at, so this is a reason to regenerate it — never a reading of the\n` +
+                    `        emitter.\n`,
+            );
+        } else {
             process.stdout.write(
-                `    ⚠️  diverges from the source verdict (${sum.scoped} scoped). A projection\n` +
-                    `        carries no record of the scope or commit it was generated at, so this\n` +
-                    `        is a reason to regenerate it — never a reading of the emitter.\n`,
+                `    ✅  consistent with the source verdict (${expected} expected, ` +
+                    `${projection.with_paths} found).\n`,
             );
         }
     } else if (projection_dir) {

package/src/scripts/rule_backlinks.ts

@@ -228,7 +228,7 @@ export function render(
     validation: ValidationResult = validate_targets(byTarget),
 ): string {
     const L: string[] = [];
-    L.push('<!-- GENERATED by src/scripts/rule_backlinks.ts — do NOT hand-edit.');
+    L.push('<!-- GENERATED by rule_backlinks — do NOT hand-edit.');
     L.push('     Regenerate after each P4 migration batch. Report-only. -->');
     L.push('');
     L.push('# Rule backlinks — which rules route here');

package/src/scripts/run_lifecycle_suite.ts

@@ -0,0 +1,208 @@
+/**
+ * run_lifecycle_suite — run the process-level lifecycle suite and write the
+ * evidence artifact `check_supervision_claim_atomicity` reads
+ * (`road-to-supervised-telemetry-collector` steps 5.1 and 5.2).
+ *
+ * ## Why a producer script and not just `vitest run`
+ *
+ * The atomicity gate refuses a present-tense supervision claim unless
+ * `internal/reports/supervision-lifecycle.json` records a suite that ran on THIS
+ * revision, exercised real processes, and was not empty or mostly skipped. That
+ * artifact has to be written by something that knows all four facts. A test file
+ * knows whether it ran; only the runner knows the revision and the counts.
+ *
+ * ## Every field here is observed, not asserted
+ *
+ * - `revision` — `git rev-parse HEAD`, read at run time. Never a constant.
+ * - `cases_run` / `cases_skipped` — parsed out of vitest's own JSON report,
+ *   never counted by hand from the source.
+ * - `processes_exercised` — true only when the suite ACTUALLY spawned daemons,
+ *   established by re-reading the report for the property names that can only
+ *   pass against real processes. A hardcoded `true` here would defeat the entire
+ *   point of the gate, which exists because a mocked suite can demonstrate all
+ *   five properties and prove none of them.
+ *
+ * ## A skip is a failure
+ *
+ * AC-8: *"a suite that skips on a platform is a failure on that platform, not an
+ * absence."* So a run whose cases were skipped writes the artifact with the
+ * honest counts and exits non-zero, rather than writing nothing — a missing
+ * artifact and a skipped suite need different remediation and the gate
+ * distinguishes them.
+ */
+
+import { execFileSync, spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const REPO = path.resolve(HERE, '..', '..');
+
+/** The suite, by path. Named once so the artifact and the runner cannot drift. */
+export const SUITE_REL = 'tests/scripts/collector_lifecycle.test.ts';
+export const SUITE_NAME = 'supervision-lifecycle';
+export const EVIDENCE_REL = path.join('internal', 'reports', 'supervision-lifecycle.json');
+
+/**
+ * The five property names the suite must have RUN for the artifact to claim
+ * real processes were exercised.
+ *
+ * Matched against the report's test names rather than counted, because a count
+ * cannot tell five properties from five repeats of one.
+ */
+export const REQUIRED_PROPERTIES = [
+    'PROPERTY 1',
+    'PROPERTY 2',
+    'PROPERTY 3',
+    'PROPERTY 4',
+    'PROPERTY 5',
+] as const;
+
+export interface SuiteCounts {
+    readonly run: number;
+    readonly skipped: number;
+    readonly passedNames: readonly string[];
+}
+
+export function countsFromReport(reportJson: string): SuiteCounts {
+    const raw = JSON.parse(reportJson) as {
+        testResults?: { assertionResults?: { fullName?: string; status?: string }[] }[];
+    };
+    let run = 0;
+    let skipped = 0;
+    const passedNames: string[] = [];
+    for (const suite of raw.testResults ?? []) {
+        for (const assertion of suite.assertionResults ?? []) {
+            const status = assertion.status ?? 'unknown';
+            if (status === 'pending' || status === 'skipped' || status === 'todo') {
+                skipped += 1;
+                continue;
+            }
+            run += 1;
+            if (status === 'passed') passedNames.push(assertion.fullName ?? '');
+        }
+    }
+    return { run, skipped, passedNames };
+}
+
+/**
+ * Did the run exercise real processes?
+ *
+ * True only when every one of the five named properties PASSED. Anything less —
+ * a skipped property, a renamed one, a suite that never collected — leaves this
+ * false, and the gate then refuses the capability claim rather than accepting a
+ * partial demonstration as a whole one.
+ */
+export function processesExercised(counts: SuiteCounts): boolean {
+    return REQUIRED_PROPERTIES.every((property) =>
+        counts.passedNames.some((name) => name.includes(property)),
+    );
+}
+
+export function headRevision(repo: string = REPO): string {
+    try {
+        return execFileSync('git', ['-C', repo, 'rev-parse', 'HEAD'], { encoding: 'utf8' }).trim();
+    } catch {
+        return '';
+    }
+}
+
+export function main(argv: readonly string[] = process.argv.slice(2)): number {
+    const dryRun = argv.includes('--dry-run');
+    const report = path.join(os.tmpdir(), `lifecycle-report-${process.pid}.json`);
+    fs.rmSync(report, { force: true });
+
+    // Clear the parity gate's alias switch, the same guard its sibling spawner
+    // takes (R2 round-5 finding 10). An ambient `AGENT_CONFIG_COLLECTOR_ABSENT`
+    // stubs the collector away for this run too, so `enableCollector` becomes a
+    // no-op and every daemon refuses with `not-enabled`. It fails loudly rather
+    // than silently — but the asymmetry between two spawners in one change is
+    // the shape the earlier finding was about.
+    const env = { ...process.env };
+    delete env.AGENT_CONFIG_COLLECTOR_ABSENT;
+
+    const result = spawnSync(
+        path.join(REPO, 'node_modules', '.bin', 'vitest'),
+        ['run', SUITE_REL, '--reporter=json', `--outputFile=${report}`],
+        { cwd: REPO, encoding: 'utf8', env, stdio: ['ignore', 'pipe', 'pipe'] },
+    );
+
+    if (!fs.existsSync(report)) {
+        process.stderr.write(
+            `run_lifecycle_suite: no report produced.\n${result.stdout ?? ''}\n${result.stderr ?? ''}\n`,
+        );
+        return 1;
+    }
+    const counts = countsFromReport(fs.readFileSync(report, 'utf8'));
+    fs.rmSync(report, { force: true });
+
+    const revision = headRevision();
+    const suiteGreen = result.status === 0;
+    // A red suite is a THIRD state, and the artifact used to record neither it
+    // nor anything that implied it: `processes_exercised` depends only on the
+    // five named properties, so a run where all five passed and a sixth case
+    // failed wrote `processes_exercised: true, cases_skipped: 0` and then exited
+    // 1 — a pass-shaped artifact left on disk by a failing run (R2 finding 18).
+    //
+    // Two changes close it. The flag itself is conjoined with the suite's exit
+    // status, so a red run can never claim the processes were exercised; and
+    // `suite_exit_status` is recorded outright, so the state is readable rather
+    // than inferred. The gate's own contract is unchanged — it reads
+    // `processes_exercised`, which is now false on a red run.
+    const exercised = processesExercised(counts) && suiteGreen;
+    const evidence = {
+        suite: SUITE_NAME,
+        revision,
+        processes_exercised: exercised,
+        cases_run: counts.run,
+        cases_skipped: counts.skipped,
+        suite_exit_status: result.status ?? null,
+        platform: `${process.platform}-${process.arch}`,
+        recorded_at: new Date().toISOString(),
+    };
+
+    process.stdout.write(
+        `run_lifecycle_suite: ${counts.run} run, ${counts.skipped} skipped, `
+            + `suite_exit=${String(result.status ?? 'null')}, `
+            + `processes_exercised=${String(exercised)}, revision=${revision || '(unknown)'}\n`,
+    );
+
+    if (dryRun) {
+        process.stdout.write(`${JSON.stringify(evidence, null, 2)}\n`);
+        return suiteGreen && exercised && counts.skipped === 0 ? 0 : 1;
+    }
+
+    const target = path.join(REPO, EVIDENCE_REL);
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.writeFileSync(target, `${JSON.stringify(evidence, null, 2)}\n`);
+    process.stdout.write(`run_lifecycle_suite: wrote ${EVIDENCE_REL}\n`);
+
+    if (result.status !== 0) {
+        process.stderr.write('run_lifecycle_suite: the suite is RED\n');
+        return 1;
+    }
+    if (counts.skipped > 0) {
+        // AC-8 makes a skip a failure on that platform rather than an absence.
+        process.stderr.write(
+            `run_lifecycle_suite: ${counts.skipped} case(s) SKIPPED — on a declared platform a `
+                + 'skip is a failure, not an absence\n',
+        );
+        return 1;
+    }
+    if (!exercised) {
+        process.stderr.write(
+            'run_lifecycle_suite: not every named property passed — the artifact records '
+                + '`processes_exercised: false` and the capability claim stays prohibited\n',
+        );
+        return 1;
+    }
+    return 0;
+}
+
+const invokedDirectly =
+    process.argv[1] !== undefined && process.argv[1].includes('run_lifecycle_suite');
+if (invokedDirectly) {
+    process.exitCode = main();
+}