@event4u/agent-config 14.12.0 → 14.13.0

package/dist/agent-src/rules/code-provenance.md

@@ -25,6 +25,10 @@ enforced_by:
   - "instruction-only: close-the-source-and-re-derive is a pre-write reasoning step only the model observes; CI checks the ledger, never the derivation"
 # obligation: line 40
 obligation_frequency: "per-edit"
+evidence:
+  source_type: external-research
+  verified_on: 2026-08-30
+  normative_level: informative
 ---
 
 # Code Provenance

package/dist/agent-src/rules/design-fidelity.md

@@ -98,7 +98,7 @@ MANDATE, NEVER A **PIXEL** MANDATE — WHATEVER `design.fidelity_mode` SAYS.
 REPRODUCING A WIREFRAME'S GREYS 1:1 HONOURS THE WRONG HALF OF THE ARTEFACT.
 ```
 
-`strict` means *do not redesign*; never *reproduce a wireframe's placeholder greys*, which
+`strict` means *do not redesign*; never *reproduce a wireframe's placeholder grays*, which
 are **non-decisions** ([`wireframe`](../skills/wireframe/SKILL.md) § Gotchas).
 **The discriminator reads the ARTEFACT, never the prose.** A finished comp whose prose
 mentions a wireframe it replaces routes **strictly** — a reference to a previous artefact,

package/dist/agent-src/rules/domain-safety-pii.md

@@ -44,6 +44,10 @@ workspaces: [agent-config-maintainer, construction, engineering, finance, founde
 packs: [meta]
 # obligation: line 52
 obligation_frequency: "per-task"
+evidence:
+  source_type: external-standard
+  verified_on: 2026-08-30
+  normative_level: mandatory
 ---
 
 # Domain Safety — PII Redaction

package/dist/agent-src/rules/domain-safety-retention.md

@@ -29,6 +29,10 @@ workspaces: [agent-config-maintainer, construction, engineering, finance, founde
 packs: [meta]
 # obligation: line 47
 obligation_frequency: "per-turn"
+evidence:
+  source_type: external-standard
+  verified_on: 2026-08-30
+  normative_level: mandatory
 ---
 
 # Domain Safety — Data Retention

package/dist/agent-src/rules/engineering-safety-floor.md

@@ -30,6 +30,8 @@ collision_ok:
   "migration": "a prod migration is a hard-floor evidence surface (rollback path, blast radius)"
 # obligation: line 49
 obligation_frequency: "per-commit"
+evidence:
+  source_type: own-analysis
 ---
 
 # Engineering Safety Floor

package/dist/agent-src/rules/external-code-graph-interop.md

@@ -24,13 +24,12 @@ obligation_frequency: "per-turn"
 # External Code-Graph Interop
 
 Some repos commit a pre-built code-intelligence index — a `graph.json`-shaped
-artifact or a SCIP index (`index.scip`, `*.scip`). When one exists, it already
-answers "who calls X", "where is Y used", "what does this import" far more
-precisely than a fresh `grep`. This suite is an **orchestrator first, owner
-where it wins** (ADR-124): query a consumer-shipped index when it is present
-and fresh; where none is shipped or ours is measurably better, the suite's own
-native code-graph engine (default-off, benchmark-gated) covers the gap. Either
-way — query first, grep as fallback, and name which source answered.
+artifact or a SCIP index (`index.scip`, `*.scip`). One that exists is already
+built and structured, so it is the cheap first question for "who calls X",
+"where is Y used", "what does this import". This suite is an **orchestrator
+first, owner where it wins** (ADR-124): query a consumer-shipped index when it
+is present and fresh; where none is shipped, the native engine (default-off,
+benchmark-gated) covers the gap.
 
 ## The rule
 
@@ -59,6 +58,11 @@ AND the repo contains a detectable index:
 3. **Fall back to `grep`/read** only for what the index does not cover, and say
    so ("the index has no entry for X, so I grepped").
 
+Query-first is an **ordering** heuristic, never a claim the index answers better:
+measured 2026-08-28, zero of four graph-shaped classes beat `grep`, so no class
+is graph-first. Routing changes; permission does not. Figures:
+[`code-intelligence`](../skills/code-intelligence/SKILL.md) § Measured.
+
 ## When NOT to fire
 
 - No such index in the repo — normal `grep`/read is the right first move.
@@ -67,11 +71,9 @@ AND the repo contains a detectable index:
 ## See also
 
 - [`code-intelligence`](../skills/code-intelligence/SKILL.md) — the executable
-  routing skill: `agent-config code-graph detect|query|affected|path` over the
-  native engine or a consumer-shipped index, grep as the stated fallback. On
-  hook-capable hosts the PreToolUse `code-graph` nudge surfaces this once per
-  session; on instruction-file hosts this rule is the surface. Which of the two
-  you are on is `agent-config hooks:status`, not a guess from the host name.
+  routing skill (`agent-config code-graph detect|query|affected|path`), the
+  measured per-class figures, and the hook-vs-instruction-file surface question
+  (`agent-config hooks:status`, never a guess from the host name).
 - [`discovery_graph`](../scripts/discovery_graph.ts) — this suite's OWN artefact
   relation-graph (`affected`/`explain`); the external code-graph is the
   *source-code* analogue this rule defers to for code questions.

package/dist/agent-src/rules/improve-before-implement.md

@@ -64,16 +64,14 @@ Trigger-set above activates this routing on demand, independent of the disciplin
 **Challenge to improve, never to refuse.**
 
 The agent is a thought partner, not a gatekeeper. After presenting concerns:
-- User picks an option → execute immediately
-- User says "just do it" → execute immediately
+- User picks an option, or says "just do it" → execute immediately
 - Never argue twice about the same point
 - Never block work — delay is only justified if it prevents a clear mistake
 
 ## Creating new agent artifacts
 
-When the request is to create or significantly rewrite a skill, rule, command,
-or guideline, the "fit the existing architecture" check is handled by
-[`artifact-drafting-protocol`](artifact-drafting-protocol.md)'s Phase B
-(Research). Follow that protocol instead of improvising a one-shot check — it
-scans `src/` for overlap and reports candidates to extend
-before creating a new file.
+When the request is to create or significantly rewrite a skill, rule, command, or
+guideline, the "fit the existing architecture" check is handled by
+[`artifact-drafting-protocol`](artifact-drafting-protocol.md)'s Phase B (Research).
+Follow that protocol instead of improvising a one-shot check — it scans `src/` for
+overlap and reports candidates to extend before creating a new file.

package/dist/agent-src/rules/laravel-routing.md

@@ -26,7 +26,7 @@ obligation_frequency: "none"
 
 # Laravel Routing
 
-**Iron Law.** Laravel-flavoured PHP (Eloquent, Artisan, FormRequest, jobs, events, policies) → load the `laravel` skill, not `symfony-workflow` and not `php-coder`.
+**Iron Law.** Laravel-flavoured PHP → `laravel`. Discriminator: entry point and router, not the dependency list — `illuminate/*` with no skeleton marker is the third verdict.
 
 Body migrated to `skill:laravel`. Disambiguates the laravel ↔ symfony-workflow cluster head per [`adr-architectural-consensus-mechanism`](../docs/contracts/adr-architectural-consensus-mechanism.md).
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).

package/dist/agent-src/rules/lethal-trifecta-guard.md

@@ -22,6 +22,10 @@ collision_ok:
   "src/agent-src/commands/": "command authoring reviews the three trifecta legs"
 # obligation: line 60
 obligation_frequency: "per-edit"
+evidence:
+  source_type: external-standard
+  verified_on: 2026-08-30
+  normative_level: recommended
 ---
 
 # Lethal-Trifecta Guard

package/dist/agent-src/rules/secret-vcs-guard.md

@@ -29,6 +29,8 @@ collision_ok:
   "commit": "committing is the credential-leak moment this guard exists for"
 # obligation: line 43
 obligation_frequency: "per-edit"
+evidence:
+  source_type: own-analysis
 ---
 
 # Secret-in-VCS Guard

package/dist/agent-src/rules/security-sensitive-stop.md

@@ -28,6 +28,8 @@ collision_ok:
   "tenant": "tenancy is a threat-model-before-edit surface"
 # obligation: line 36
 obligation_frequency: "per-edit"
+evidence:
+  source_type: own-analysis
 ---
 
 # Security-Sensitive Stop Rule

package/dist/agent-src/rules/source-confidentiality.md

@@ -91,43 +91,21 @@ substitute for not writing the attribution in the first place.
 
 ## Why this rule is not path-scoped
 
-Under ADR-236 (`docs/decisions/ADR-236-one-artefact-one-layer.md`) this rule is
-delivered by the PROJECT layer only — it exists to maintain this package, so the
-global layer no longer carries an unscoped twin of it. A `paths:`-scoped rule is
-**not re-injected after `/compact`** (ADR-227:79-80), so scoping it would mean the
-obligation silently disappears mid-session with nothing left to reload it.
-
-It is therefore delivered unconditionally, and the path triggers were removed
-rather than worked around. **This section is the shared record for all four such
-rules** — `no-roadmap-references`, `rule-type-governance` and `skill-quality` carry
-the same change and no note of their own. Two reasons: four copies of the rationale
-cost more standing context than the decision they explain, and the other three are
-migrated POINTER stubs held at their pointer's size by
-`check_rule_stub_ceiling` — prose added there is prose in the wrong place by that
-gate's own contract, which is what caught the first attempt to duplicate it.
-
-AI council 2026-08-20, 2/2 convergent on this option over three alternatives, with
-two independent decisive arguments. First: the obligation governs an **authoring
-decision**, which happens before any file exists for a path trigger to match — so
-path-scoping fails at greenfield creation whether or not a compaction ever occurs.
-Second: the measured cost is small against what the partition returns. Keeping an
-unscoped global copy was rejected because it re-creates the duplication the
-partition exists to remove; splitting the four by "has a CI gate" was rejected by
-both seats as the wrong axis — a validator observes an outcome, it does not hold an
-obligation during the session, and `rule-type-governance` has no gate at all.
-
-**Cost, measured and corrected.** An earlier revision of this note claimed 1,754
-tokens (1.8 % of the partition's 96,584-token saving). That figure was a
-`chars / 4` proxy over the projected files and **understated the real cost by about
-half**: `check_rule_activation_census`, which counts with the exact BPE tokenizer,
-measures the unconditional corpus growing **108,130 → 111,642, i.e. +3,512 tokens
-(3.6 %)** — and that number includes this rationale, which is why it lives in one
-place instead of four. The verdict does not depend on the figure: one seat argued
-the token axis was the wrong one entirely, the other that cost is a legitimate axis
-which simply loses this particular comparison. Both readings survive 3.6 %.
+Delivered unconditionally by the PROJECT layer, with no `paths:` triggers: the
+obligation governs an **authoring decision** taken before any file exists for a
+path trigger to match, and a path-scoped rule is not re-injected after
+`/compact`, so scoping it would make the obligation vanish mid-session. The
+measurement, the AI-council record of 2026-08-20, the three rejected
+alternatives and the +3,512-token cost this shared note carries for four rules
+live in
+[`source-confidentiality-mechanics`](../docs/guidelines/agent-infra/source-confidentiality-mechanics.md)
+§ Why these four rules are unconditional — moved there 2026-08-29 because a
+rationale paid on every subagent spawn is the most expensive place to keep an
+argument nobody re-reads.
 
 ## See also
 
+- [`source-confidentiality-mechanics`](../docs/guidelines/agent-infra/source-confidentiality-mechanics.md) — the claim/residual honesty clause, the two-class split by path, and the gate's shape checks and tiering.
 - [`source-of-truth`](source-of-truth.md) — edit `src/`, never the projections.
 - [`augment-edit-discipline`](augment-edit-discipline.md) — portability + cross-ref sync.
 - `src/scripts/_lib/link_crypto.ts` — encrypted link storage.

package/dist/agent-src/rules/symfony-routing.md

@@ -22,7 +22,7 @@ obligation_frequency: "none"
 
 # Symfony Routing
 
-**Iron Law.** Symfony-flavoured PHP (DI container, bundles, Doctrine entities, Messenger, Security voters, console commands) → load the `symfony-workflow` skill, not `laravel` and not `php-coder`.
+**Iron Law.** Symfony-flavoured PHP → `symfony-workflow`. Discriminator: entry point and router, not the dependency list — `symfony/*` with no skeleton marker is the third verdict.
 
 Body migrated to `skill:symfony-workflow`. Disambiguates the laravel ↔ symfony-workflow cluster head per [`adr-architectural-consensus-mechanism`](../docs/contracts/adr-architectural-consensus-mechanism.md).
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).

package/dist/agent-src/rules/token-efficiency.md

@@ -28,6 +28,20 @@ NEVER CALL THE SAME TOOL >2 TIMES IN A ROW WITH SIMILAR PARAMETERS.
 IF YOU CATCH YOURSELF REPEATING → STOP, RETHINK, ASK.
 ```
 
+## Independent calls go in ONE block
+
+```
+CALLS WITH NO DEPENDENCY BETWEEN THEM GO IN THE SAME BLOCK.
+A CALL THAT DOES NOT READ THE PREVIOUS RESULT IS NOT A SECOND TURN.
+```
+
+The ceiling above forbids repetition; this forbids splitting work that had no
+reason to be split — measured mean batch size **1.01**, i.e. fully serial. The
+discriminator is the dependency, never the count. NOT "write shorter commands":
+the long commands are already the batching. `instruction-only` — nothing can
+observe a call that was not batched. Evidence + the absent-cause finding:
+[`token-efficiency-mechanics`](../contexts/communication/rules-auto/token-efficiency-mechanics.md).
+
 ## Enumerated file sets are ONE operation, not N repetitions
 
 The same-tool ceiling counts *repetition without new information* — the loop where the agent re-runs a tool because it did not learn from the last result. Reading N **declared, enumerated** files is the opposite: each read returns different content and the set was known before the first call. Counting it as N repetitions puts this rule in direct conflict with [`downstream-changes`](downstream-changes.md) ("find **ALL** callers, tests, imports") and with [`source-discovery-gate`](source-discovery-gate.md), which cannot be satisfied in two calls.

package/dist/agent-src/rules/tool-safety.md

@@ -12,6 +12,10 @@ enforced_by:
   - "validator:src/scripts/lint_agent_security.ts"
 # obligation: line 19
 obligation_frequency: "per-edit"
+evidence:
+  source_type: external-standard
+  verified_on: 2026-08-30
+  normative_level: recommended
 ---
 
 # Tool Safety

package/dist/agent-src/rules/untrusted-input-defense.md

@@ -21,6 +21,10 @@ enforced_by:
   - "instruction-only: no deterministic gate inspects fetched content for injected instructions; injection_scan_hook is warn-only and default-OFF"
 # obligation: line 38
 obligation_frequency: "per-event"
+evidence:
+  source_type: external-standard
+  verified_on: 2026-08-30
+  normative_level: recommended
 ---
 
 <!-- security-lint: allow instruction-smuggling "defense rule: quotes role-takeover phrases (ignore previous instructions, you are now, <IMPORTANT>) to teach refusal" -->

package/dist/agent-src/scripts/archive_completed_roadmaps.ts

@@ -59,6 +59,7 @@ import process from 'node:process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import { collect } from './update_roadmap_progress.js';
+import { guardedBaselineProblems, parseGuardedBaselines } from './guarded_baseline.js';
 
 const _HERE = fileURLToPath(import.meta.url);
 
@@ -144,7 +145,7 @@ function _branch_touched_paths(root: string, base: string): Set<string> | null {
  *   the payload. Rewriting them detaches the patch from the commit it records
  *   AND makes `git apply` target a path the diff never created.
  *
- * Measured 2026-08-11: archiving one roadmap rewrote four frozen artefacts
+ * Measured 2026-08-11: archiving one roadmap rewrote four frozen artifacts
  * under `agents/evidence/reviews/`, including the `diff.patch` headers of a
  * recorded review input. Nothing caught it — the sweep reported it as
  * "4 ref(s) migrated", which reads like success.
@@ -311,7 +312,202 @@ interface ArchiveRecord {
     refs_migrated: string[];
 }
 
-/** Archive every complete active roadmap (count_open==0, count_deferred==0). */
+
+/** One `[~]` step and whatever resolution annotation follows it. */
+export interface DeferredItem {
+    /** The step text, trimmed, for the operator message. */
+    text: string;
+    /** `carried-to` / `merged-into`, or `null` when no annotation was found. */
+    kind: 'carried-to' | 'merged-into' | null;
+    /** Destination roadmap slug, or `null`. */
+    destination: string | null;
+}
+
+/**
+ * `<!-- deferred-resolution: carried-to=<slug> -->` — the resolved-deferral
+ * annotation. `merged-into=<slug>` is the second accepted form.
+ */
+const DEFERRED_RESOLUTION_RE = /<!--\s*deferred-resolution:\s*(carried-to|merged-into)\s*=\s*([A-Za-z0-9._-]+)\s*-->/;
+
+/** `- [~] …` — a deferred step, at any indent, with `-` or `*`. */
+const DEFERRED_STEP_RE = /^[ \t]*[-*][ \t]+\[~\][ \t]*(.*)$/;
+/** Any other checkbox, or a heading — where a step's block ends. */
+const BLOCK_END_RE = /^[ \t]*[-*][ \t]+\[[ xX~-]\]|^#{1,6}[ \t]/;
+
+/** Escape a string for literal use inside a `RegExp`. */
+function _escapeRe(v: string): string {
+    return v.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+/**
+ * Does this frontmatter declare a `relates:` row naming `slug`?
+ *
+ * Structured, not textual: the slug has to appear as a `- slug: <name>` row or a
+ * bare `- <name>` item inside the `relates:` block, which is a declaration the
+ * author made deliberately. A mention anywhere else in the file does not count.
+ */
+function _relatesTo(text: string, slug: string): boolean {
+    const lines = text.split('\n');
+    const start = lines.findIndex((l) => /^relates:/.test(l));
+    if (start === -1) return false;
+    const re = new RegExp(`^\\s*-\\s*(slug:\\s*)?${_escapeRe(slug)}\\s*$`);
+    for (let i = start + 1; i < lines.length; i++) {
+        const line = lines[i] as string;
+        if (/^\S/.test(line)) break;
+        if (re.test(line)) return true;
+    }
+    return false;
+}
+
+/** Every `[~]` step in a roadmap, with the annotation that follows it (if any). */
+export function parseDeferredItems(text: string): DeferredItem[] {
+    const lines = text.split('\n');
+    const out: DeferredItem[] = [];
+    for (let i = 0; i < lines.length; i++) {
+        const m = DEFERRED_STEP_RE.exec(lines[i] as string);
+        if (m === null) continue;
+        // The annotation may sit on the step line itself or anywhere in the
+        // step's continuation block, which ends at the next checkbox or heading.
+        let block = lines[i] as string;
+        for (let j = i + 1; j < lines.length; j++) {
+            if (BLOCK_END_RE.test(lines[j] as string)) break;
+            block += '\n' + (lines[j] as string);
+        }
+        const a = DEFERRED_RESOLUTION_RE.exec(block);
+        out.push({
+            text: (m[1] ?? '').trim().slice(0, 120),
+            kind: a === null ? null : (a[1] as 'carried-to' | 'merged-into'),
+            destination: a === null ? null : (a[2] as string),
+        });
+    }
+    return out;
+}
+
+/**
+ * Decide whether a roadmap's `[~]` items are RESOLVED, per the AI council of
+ * 2026-08-27 (2 seats, convergent on option (c)).
+ *
+ * Iron Law 3 says a deferral must be resolved before archival, and the
+ * preservation test routes four dispositions to the council — but three of them
+ * (carry to a follow-up, merge into existing work, restore to open) leave the
+ * `[~]` glyph in place, and this sweep used to require `deferred === 0`
+ * unconditionally. So a genuinely UNEXECUTABLE item — one needing elapsed time
+ * rather than effort — had no council-reachable path to an archived roadmap, and
+ * the only glyph that cleared the gate was `[-]`, which is owner-reserved AND
+ * pinned to mean "won't happen at all". Using it for a carried item would make
+ * cancellation and transfer indistinguishable to every later reader.
+ *
+ * **Fail-closed at every step**, which is the condition both seats attached to
+ * their verdict: a bare `[~]` blocks, a malformed annotation blocks, a
+ * destination that does not exist blocks, a destination that is itself archived
+ * or skipped blocks, and a missing back-link blocks. The annotation is cheap to
+ * write and must therefore be expensive to satisfy.
+ *
+ * NOT checked, and named rather than implied: that the destination's copy of the
+ * criterion is faithful. Both seats asked for stable item identity over verbatim
+ * text matching, and neither a text match nor an id exists today — the back-link
+ * plus the source-slug mention is the strongest link this sweep can verify
+ * without inventing an identity scheme. The reviewer of the carry still reads it.
+ *
+ * @returns `problems` empty ⇒ every deferral is resolved and archival may proceed.
+ */
+export function deferralProblems(
+    root: string,
+    rel: string,
+    text: string,
+    /**
+     * Slugs this same sweep is about to archive. A destination in this set is
+     * about to become dead, so accepting it would leave the carried item with no
+     * live receiver — the exact loss the annotation exists to prevent, produced
+     * by the mechanism meant to prevent it. Found by an independent review, with
+     * two reproducers: a roadmap naming ITSELF as destination, and two roadmaps
+     * both complete in one run where the parent carries to the child.
+     *
+     * Optional so the unit tests can call this with one roadmap in view; the
+     * sweep always passes the real set.
+     */
+    alsoArchiving: ReadonlySet<string> = new Set(),
+): string[] {
+    const sourceSlug = rel.replace(/\.md$/, '');
+    const problems: string[] = [];
+    for (const item of parseDeferredItems(text)) {
+        const label = item.text === '' ? '(unnamed step)' : item.text;
+        if (item.kind === null || item.destination === null) {
+            problems.push(
+                `deferred step ${JSON.stringify(label)} carries no ` +
+                    '`<!-- deferred-resolution: carried-to=<slug> -->` annotation',
+            );
+            continue;
+        }
+        // Active or parked are both live. Archived and skipped are not: carrying
+        // an item into a dead roadmap is the silent loss the annotation exists
+        // to prevent, and it is exactly the "broken promise" case one seat asked
+        // to be detectable.
+        const candidates = [
+            path.join(root, 'agents', 'roadmaps', `${item.destination}.md`),
+            path.join(root, 'agents', 'roadmaps', 'later', `${item.destination}.md`),
+        ];
+        // Self-reference is never a carry. It passes every other check — the
+        // file exists, and a `parent_roadmap:` naming itself would satisfy the
+        // back-link — and then the sweep archives it, so the destination is dead
+        // the moment the source is.
+        if (item.destination === sourceSlug) {
+            problems.push(
+                `deferred step ${JSON.stringify(label)} names its OWN roadmap as the destination — ` +
+                    'a carry needs a different receiver, or the item is not carried at all',
+            );
+            continue;
+        }
+        if (alsoArchiving.has(item.destination)) {
+            problems.push(
+                `destination \`${item.destination}\` is being archived by this same sweep, so it would be ` +
+                    'dead the moment the carry lands — archive it first and re-run, or carry to a roadmap that stays active',
+            );
+            continue;
+        }
+        const found = candidates.find((c) => fs.existsSync(c));
+        if (found === undefined) {
+            const dead = ['archive', 'skipped'].find((d) =>
+                fs.existsSync(path.join(root, 'agents', 'roadmaps', d, `${item.destination ?? ''}.md`)),
+            );
+            problems.push(
+                dead === undefined
+                    ? `deferred step ${JSON.stringify(label)} names destination \`${item.destination}\`, which does not exist`
+                    : `deferred step ${JSON.stringify(label)} names destination \`${item.destination}\`, which is in \`${dead}/\` — a dead roadmap cannot receive a carried item`,
+            );
+            continue;
+        }
+        const destText = fs.readFileSync(found, 'utf-8');
+        // ESCAPED. The slug was interpolated raw, so `road.parent` matched
+        // `roadXparent` and a slug containing `[` or `(` made `new RegExp` THROW
+        // and abort the whole sweep — in a function whose entire contract is
+        // failing closed. Found by an independent review; both seats named it.
+        const backlink = new RegExp(`^parent_roadmap:[ \t]*${_escapeRe(sourceSlug)}[ \t]*$`, 'm');
+        if (item.kind === 'carried-to' && !backlink.test(destText)) {
+            problems.push(
+                `destination \`${item.destination}\` carries no \`parent_roadmap: ${sourceSlug}\` back-link — ` +
+                    'the link must be verifiable from both ends',
+            );
+            continue;
+        }
+        // A STRUCTURED link, not a substring. `destText.includes(sourceSlug)` was
+        // satisfied by any incidental mention — a filename, an example, an HTML
+        // comment — so `merged-into` proved nothing about a merge. Both review
+        // seats called it trivially spoofable. The link now has to be a
+        // frontmatter declaration: a `relates:` row naming the source, or a
+        // `parent_roadmap:` back-link. Prose cannot satisfy it.
+        if (item.kind === 'merged-into' && !backlink.test(destText) && !_relatesTo(destText, sourceSlug)) {
+            problems.push(
+                `destination \`${item.destination}\` carries no structured link back to \`${sourceSlug}\` — ` +
+                    'add a `relates:` row naming it (with a `relation:`) or a `parent_roadmap:` line. A mention ' +
+                    'in prose is not a link: it is satisfied by a filename or an example.',
+            );
+        }
+    }
+    return problems;
+}
+
+/** Archive every complete active roadmap: no open steps, and every `[~]` resolved. */
 function archive_completed(
     root: string,
     opts: { changed_only: boolean; base: string; dry_run: boolean },
@@ -331,11 +527,59 @@ function archive_completed(
         return [];
     }
 
+    // Every slug this sweep will consider archiving, computed BEFORE any of them
+    // is judged. Without it, a deferral carried to another roadmap that is also
+    // complete passes validation and then loses its receiver in the same run.
+    const sweepSet = new Set(
+        collect(roadmap_root)
+            .filter((s2) => s2.open_ === 0)
+            .map((s2) => s2.rel.replace(/\.md$/, '')),
+    );
+
     const archived: ArchiveRecord[] = [];
     for (const stats of collect(roadmap_root)) {
-        if (stats.open_ !== 0 || stats.deferred !== 0) {
+        // `guarded-baseline` is INCOMPLETE by construction (council 2026-08-31,
+        // 2/2 convergent) — checked BEFORE the open-step test on purpose. A
+        // well-formed record keeps its box `[ ]` and would be skipped silently as
+        // "not complete", which is the right verdict reached for the wrong reason
+        // and invisible in a sweep that only reports what it moved; a MALFORMED
+        // one on `[x]` would otherwise archive with an annotation claiming the
+        // opposite. Both are named here instead.
+        const guarded = parseGuardedBaselines(
+            fs.readFileSync(path.join(roadmap_root, stats.rel), 'utf-8'),
+        );
+        if (guarded.length > 0) {
+            process.stderr.write(
+                `  ⚠️  ${stats.rel}: ${guarded.length} guarded-baseline step(s) — ` +
+                    'not archived. Verify against the real mechanism, then flip to ' +
+                    '`[x]`.\n',
+            );
+            for (const p of guardedBaselineProblems(guarded)) {
+                process.stderr.write(`        · ${p}\n`);
+            }
+            continue;
+        }
+        if (stats.open_ !== 0) {
             continue; // not complete
         }
+        // A `[~]` no longer blocks unconditionally: it blocks unless it carries a
+        // validated resolution annotation. See `deferralProblems` for why, and
+        // for every way that check fails closed.
+        if (stats.deferred !== 0) {
+            const abs = path.join(roadmap_root, stats.rel);
+            // The source's own slug is removed: it is trivially in `sweepSet`,
+            // and self-reference is reported by its own, clearer message.
+            const others = new Set(sweepSet);
+            others.delete(stats.rel.replace(/\.md$/, ''));
+            const problems = deferralProblems(root, stats.rel, fs.readFileSync(abs, 'utf-8'), others);
+            if (problems.length > 0) {
+                process.stderr.write(
+                    `  ⚠️  ${stats.rel}: ${problems.length} unresolved deferral(s) — not archived.\n`,
+                );
+                for (const p of problems) process.stderr.write(`        · ${p}\n`);
+                continue;
+            }
+        }
         // An unresolved blocker outlives its steps. Closing every box does not
         // answer a question the roadmap raised for a human, and archiving on
         // step-count alone is how `b-highlights-mechanism` left the active tree