@event4u/agent-config 14.12.0 → 14.13.0

package/dist/agent-src/skills/symfony-workflow/SKILL.md

@@ -180,3 +180,38 @@ Then add these **Symfony-specific** checks:
 - Messenger `failure_transport` is opt-in; without it, failures vanish.
 - Compiled container changes need `cache:clear` in `prod` before debugging "config not applied".
 - Symfony 7.x removed deprecated APIs — verify `composer.lock` before assuming 6.x patterns work.
+
+## When NOT to use — components without the framework
+
+```
+A DEPENDENCY PROVES A LIBRARY IS AVAILABLE. ONLY THE ENTRY POINT AND THE
+ROUTER PROVE WHICH APPLICATION SHAPE IS RUNNING.
+`symfony/*` PACKAGES WITH NO SKELETON MARKER IS A THIRD STATE, AND THIS SKILL
+DOES NOT APPLY TO IT.
+```
+
+Symfony ships its ORM, container, collections and HTTP layer as
+independently installable packages, usable with no framework present — a
+published distribution model, not one consumer's arrangement. An application
+built that way has a **custom entry point and a custom router**. Routing it here
+offers a CLI that does not exist, a request-validation primitive that is not
+wired, and a routes file that was never there: every suggestion confidently
+wrong, and the reason visible only from the entry point.
+
+**The probe set, and its cost.** A fixed set of filesystem existence checks plus
+one manifest read — no directory walk, no content scan, and never re-derived per
+session. Any ONE marker present means the framework is real:
+
+| Probe | Meaning |
+|---|---|
+| `bin/console` | the console entry point the skeleton writes |
+| `config/bundles.php` | the bundle registry |
+| `config/services.yaml` | the DI service config |
+
+`symfony/*` in `composer.json` with **none** of those markers is
+*components-without-the-framework*. Say so and route away from this skill rather
+than answering as though the framework were there.
+
+Implemented deterministically in `src/install/detect_php_shape.ts`
+(`detectPhpShape`), whose `PROBE_PATHS` is this table and whose verdict names
+what a wrong route would have offered.

package/dist/agent-src/skills/test-case-discovery/SKILL.md

@@ -37,6 +37,91 @@ FLOOR PER BEHAVIOR: 1 HAPPY + 1 BOUNDARY + 1 ERROR (+1 ABUSE ON SECURITY PATHS).
 CAP PER BEHAVIOR: 5–8 CASES — EACH MUST FAIL FOR A DISTINCT REASON.
 ```
 
+## Does this change owe an executable behavior contract?
+
+Cases and contracts are not the same artifact. A **case** is something you assert
+in the project's unit runner. An **executable behavior contract** — a
+specification written in the language of whoever asked for the change, and run
+by a tool that reads it — is a heavier thing, and most changes do not owe one.
+Ask for one everywhere and it degrades into a second, slower unit suite; ask for
+one nowhere and behavior nobody can read stays unstated.
+
+### The observable-behavior test
+
+> **Does this change alter behavior someone outside the code can observe, and
+> would that person describe it in their own words?**
+
+Both halves have to hold: observable behavior with no outside audience is
+still only a case. *Observable* rules out anything a caller cannot see. *In their own
+words* rules out behavior that is real but has no audience outside the codebase —
+if the only person who can state the rule is the person reading the
+implementation, a case in the unit runner states it better and cheaper.
+
+**Yes → a contract is owed.** A refund is issued when an order is cancelled
+within 14 days; a member on a lapsed plan is denied the export; a rejected
+upload tells the uploader which rule it broke.
+
+**No → cases, not a contract.** At least these:
+
+- **A refactor with no behavior change.** Nothing outside the code can observe
+  it, by definition. If something can, it was not a refactor.
+- **An internal invariant with no external vocabulary.** Cache key derivation,
+  retry backoff, connection-pool sizing, a query plan. Real behavior, no
+  audience — the failure is stated as a case, not as a sentence somebody outside
+  the code would say.
+- **A pure boundary or error path with no business reading.** Rejecting a
+  malformed UTF-8 sequence is a case; *"we do not accept expired coupons"* is a
+  contract.
+- **A change whose only observer is another part of this system.** A consumer
+  written by the same team is a caller, not an audience. Contract tests between
+  services are a different tool and a different question.
+
+When the answer is yes, the ordering is unchanged: the contract fails before the
+implementation exists and passes after — see
+[`test-driven-development`](../test-driven-development/SKILL.md). A contract
+first seen green has the same unknown sensitivity as any other test never seen
+red.
+
+### The anti-script rule
+
+```
+A CONTRACT STEP NAMING A SELECTOR, A TIMEOUT, OR A KEYSTROKE IS A DEFECT
+IN THE CONTRACT — NOT AN IMPLEMENTATION DETAIL THAT HAPPENS TO BE THERE.
+WRITE WHAT IS TRUE, NEVER WHAT IS CLICKED.
+```
+
+A contract that scripts the interface is pinned to the interface: it goes red on
+every redesign that changes nothing anyone cares about, and stays green through
+the redesign that breaks the rule. It also stops being readable by the person
+whose words it was supposed to be in — which was the only reason to pay for it.
+
+**Wrong** — this is a click script wearing Given-When-Then:
+
+```gherkin
+Given I open "/cart?id=42"
+When I click #apply-coupon
+And I type "SUMMER" into input[name=code]
+And I wait 2 seconds
+Then .cart-total should contain "€45.00"
+```
+
+Every line is about the page. Change the button id and it fails; move the
+discount rule and it passes.
+
+**Right** — same behavior, stated as the rule it is:
+
+```gherkin
+Given a cart of €50
+When the customer applies a valid 10% coupon
+Then the order total is €45
+```
+
+The rule survives the redesign, and the person who asked for it can read it.
+
+**The test for a step:** could it still be true if the product were a CLI, an
+API, and a web page? If not, it belongs in the implementation the contract calls
+into, not in the contract.
+
 ## Procedure — the five-step funnel
 
 ### 1. Behavior inventory (30 seconds)

package/dist/agent-src/skills/test-driven-development/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: medium
 name: test-driven-development
-description: "Use when implementing a feature, fixing a bug, or refactoring — write a failing test first, then the code — even if the user just says 'add this function' or 'fix this bug'."
+description: "Implementing a feature, fixing a bug, refactoring — failing test first, then the code. For a WRONG test, `testing-anti-patterns` wins."
 domain: quality
 workspaces:
   - engineering
@@ -72,16 +72,28 @@ failed proves nothing about the code under test.
 ### Iron Law — delete-and-restart over keep-as-reference
 
 ```
-WHEN UNTESTED CODE EXISTS AND A TEST IS NEEDED — DELETE THE CODE,
+UNTESTED CODE THIS TASK JUST WROTE, AND A TEST IS NEEDED — DELETE THE CODE,
 WRITE THE TEST, REIMPLEMENT. NEVER KEEP IT "AS REFERENCE".
+THIS LAW COVERS YOUR OWN UNTESTED OUTPUT. IT IS NOT A LICENCE TO DELETE
+PRE-EXISTING CODE, AND NEVER OVERRIDES A REUSE VERDICT.
 ```
 
 Reading the existing implementation while writing its test is
-test-after-the-fact with extra steps. The 12-row anti-rationalization
-table that follows expands the most common ways this Iron Law gets
-talked-around. Externalized to
-[`testing-anti-patterns/process-anti-patterns.md`](../testing-anti-patterns/process-anti-patterns.md)
-to keep this skill under the 400-line sunset trigger.
+test-after-the-fact with extra steps. Which code that applies to has three
+answers, and only the first is a deletion:
+
+| The code is | Do |
+|---|---|
+| **untested, written by this task** | delete it, write the test, reimplement — the Iron Law above |
+| **pre-existing and tested** | keep it. Its tests are the record of its behaviour; deleting it to re-derive the same thing discards evidence and contradicts the reuse verdict |
+| **pre-existing and untested** | do NOT delete. Write a **characterization test** pinning the behaviour it has today — including the behaviour you think is wrong — then change it under that test |
+
+The middle row is the one this law used to get wrong: unqualified, it read as
+a standing instruction to delete tested legacy that a reuse verdict would
+keep. Case detail, the characterization-test procedure, and the 12-row
+anti-rationalization table are in
+[`testing-anti-patterns/process-anti-patterns.md`](../testing-anti-patterns/process-anti-patterns.md),
+which keeps this skill under the 400-line sunset trigger.
 
 ## Mode contracts — Goal / Activities / Forbidden / Output
 
@@ -91,10 +103,21 @@ checks it from the diff** — an unverifiable prohibition does not ship.
 | Mode | Goal | Activities | Forbidden (diff check) | Output contract |
 |---|---|---|---|---|
 | **Design** | One-sentence behavior + enumerated cases | Steps 1–2 | **No production code** (diff touches no `src/**` production path) · no test bodies yet | Case list (happy/boundary/error) |
-| **Test-Red** | A failing test that fails RIGHT | Steps 3–4 | **No production edits** (diff = `tests/**` only) · test must fail at an **assertion, not an import/setup error** (failure output cites the assertion line) | Failing test + its observed failure reason |
+| **Test-Red** | A failing test that fails RIGHT | Steps 3–4 | **No production edits** (diff = `tests/**` only) · the failure must be **about the behaviour under test**. Valid: a failing **assertion** · a **missing target** — class-not-found, or a compile/type error naming the unimplemented symbol · a **contract failure** (wrong shape, wrong status, unmet interface). Invalid: a broken **fixture** · a **syntax error** in the test · a missing **unrelated dependency** · a **runner or environment** fault | Failing test + its observed failure, named as one of the three valid classes |
 | **Implement** | Minimum code to green | Steps 5–6 | **No test edits** (no `tests/**` paths in Implement-phase diffs — changing the assertion to fit the code is the canonical violation; genuinely-wrong test → STOP and ask, never silently edit) · no scope beyond the one case | Green run output |
 | **Debug** | Fix a defect found later | (re-enter at 3) | **No bugfix before a reproducing regression test exists** (the fix commit contains a `tests/**` addition that fails without the fix) | Regression test + fix, verified red→green |
 
+#### What makes a RED valid — relevance, not the line number it fails on
+
+The discriminator is **whether the failure is about the behaviour under test**,
+never where in the run it surfaces. A class that does not exist yet can only
+fail at load, so demanding an assertion would force a production stub before
+the first test — the exact thing this skill forbids. The four invalid classes
+are failures of the harness: they would fail identically with the behaviour
+fully implemented, so they measure nothing about it. Unsure → re-read the
+failure output and name which of the seven it is; an unclassified red is not a
+RED.
+
 ### Mode inference on resume
 
 Step 0 of any resume: if `agents/runtime/state/HANDOFF.md` exists, resume
@@ -107,7 +130,8 @@ assume Design:
 | No test for the target behavior | Design |
 | Test exists, currently failing at an assertion | Implement |
 | Test exists + passing, defect reported | Debug |
-| Test failing at import/collection error | Test-Red (fix the test, not the code) |
+| Test failing at load because the target does not exist yet | Implement (that is a valid RED) |
+| Test failing on a harness fault — fixture, syntax, unrelated dependency, runner | Test-Red (fix the test, not the code) |
 
 At every mode transition, one consent-checkpoint sentence (per
 `ask-when-uncertain` / `autonomous-execution` — no new mechanism): name the

package/dist/agent-src/skills/testing-anti-patterns/SKILL.md

@@ -1,7 +1,7 @@
 ---
 model_tier: medium
 name: testing-anti-patterns
-description: "Use BEFORE writing/changing tests, adding mocks, or test-only methods on production classes — vs mocking-the-mock, production pollution, partial mocks, and overfit/tautological assertions"
+description: "BEFORE writing/changing tests, mocks, or test-only methods on production classes — mocking-the-mock, production pollution, overfit assertions; for order, `test-driven-development` wins."
 domain: quality
 workspaces:
   - engineering

package/dist/agent-src/skills/testing-anti-patterns/process-anti-patterns.md

@@ -17,11 +17,48 @@ is still mocking the mock.
 ```
 WHEN YOU FIND YOURSELF KEEPING UNTESTED CODE "AS REFERENCE" WHILE WRITING
 A TEST FOR IT — DELETE THE CODE. WRITE THE TEST. THEN REIMPLEMENT.
+THE CODE IN QUESTION IS THE UNTESTED CODE THIS TASK JUST WROTE.
+IT IS NOT PRE-EXISTING CODE, AND THE LAW NEVER OVERRIDES A REUSE VERDICT.
 ```
 
 The cheap path is one extra round-trip. The expensive path is a test that
 silently encodes the bug it was supposed to catch.
 
+### The three cases — only one of them is a deletion
+
+Unqualified, this law reads as a standing instruction to delete any untested
+code in reach. That reading is wrong in two of the three cases, and the wrong
+one is expensive: it discards working behavior a reuse verdict would keep.
+
+| The code is | Do | Why |
+|---|---|---|
+| **untested, written by this task** | delete it, write the test, reimplement | Nothing is lost — you can rewrite what you wrote minutes ago, and the test is then written against the behavior you wanted rather than the code you happened to produce |
+| **pre-existing and tested** | keep it | Its tests ARE the record of its behavior. Deleting it to re-derive the same thing throws away evidence you cannot cheaply rebuild, and directly contradicts a reuse / extend verdict |
+| **pre-existing and untested** | write a characterization test first | Deleting it destroys the only remaining record of what it does. The test comes first, but it pins TODAY's behavior — not the behavior you wish it had |
+
+### The characterization-test procedure
+
+For the third case, in order:
+
+1. **Observe, do not judge.** Run the code on real inputs and record what it
+   actually returns — including outputs you believe are wrong. Bug-compatible
+   is the point: the test's job is to detect *change*, not to assert *correctness*.
+2. **Pin the observed values.** Assert them exactly. A characterization test
+   whose expected value is derived from the same code it tests is a tautology.
+3. **Name it as one.** Prefix or tag the test (`characterizes_…`, a
+   `@characterization` marker) so a later reader does not mistake a pinned bug
+   for a desired behavior.
+4. **Now change the behavior.** With the pin in place, the intended change is
+   an ordinary red-green cycle: the characterization test that must now change
+   is the blast radius, made visible.
+5. **Update or delete the pin deliberately.** When the new behavior is
+   correct, the pinned assertion is edited *because the behavior changed* —
+   stated in the diff, never quietly.
+
+**What this is NOT.** Not permission to skip TDD on new behavior — the pin
+covers what exists, the new behavior still starts from a failing test. Not a
+coverage exercise: pin the behavior the change will touch, not the whole file.
+
 ## 12-row anti-rationalization table
 
 The urge to skip TDD is strongest on tasks where TDD matters most. Name

package/dist/agent-src/skills/ui-component-architect/SKILL.md

@@ -123,8 +123,51 @@ Prop budget per component:
 | Composite (Card, Dialog) | ≤ 8 props; prefer slots for variants |
 | Page section / feature shell | ≤ 4 props; everything else via context |
 
-Over-budget triggers a refactor: extract a config object, push
-state into context, or split into compound parts.
+Over-budget is a **prompt to look**, not a verdict. Extract a config object,
+push state into context, or split into compound parts — **or record why the
+count is right for this component.**
+
+```
+THE CAPS ABOVE ARE ADVISORY. THEY ARE NOT A GATE AND MUST NOT BECOME ONE
+WITHOUT A NEW MEASUREMENT. NOTHING COMPUTES THE TIER, SO NOTHING CAN APPLY THEM
+AUTOMATICALLY EVEN IF IT WANTED TO.
+```
+
+**Why advisory, measured rather than asserted** (2026-08-24, one production
+component library: 55 atoms, 3 molecules, 2 organisms):
+
+| component | its level | props | cap here | over |
+|---|---|---:|---:|---:|
+| `file-upload` | **atom** | 19 | 6 | **3.2×** |
+| `date-navigator` | molecule | 18 | 8 | 2.25× |
+| `picker-sheet` | organism | 14 | 4 | **3.5×** |
+| `duration-input` | molecule | 13 | 8 | 1.6× |
+| `stepper` | molecule | 4 | 8 | — |
+
+**The budget is INVERTED, and that is the finding rather than a calibration
+error.** This table tightens as granularity rises. Reality goes the other way:
+a higher-level component legitimately surfaces every label, callback and test id
+of the pattern it orchestrates, so a cap that shrinks with tier flags the
+components that are **correctly built** and clears the one that is 3.2× over.
+
+**And for most components the number does not exist.** Between **45 % and 72 %**
+of that library declares no root prop interface at all, depending on how you
+count — `React.ComponentProps<'div'> & VariantProps<cva>` is the dominant idiom.
+A cap over an uncountable quantity is not a lenient rule; it is no rule.
+
+**The tier itself is not computable.** Composition depth, state, sub-component
+count and prop count were each tested as a discriminator between the three
+levels. **Every one overlapped completely, and several inverted.** Sub-component
+count is the tempting replacement and fails the same way: `atoms/combobox`
+exports **16**, more than every molecule (1, 1, 2) and more than one of the two
+organisms. So there is no measurement that could assign the tier a cap would be
+applied to.
+
+**Revisit-if:** a corpus of levelled libraries — plural, and not four days old —
+yields a discriminator that separates the tiers without overlap, at which point
+the caps can be re-derived against it rather than restated. Until then these
+numbers are a conversation starter for a human reviewer, which is the only role
+the evidence supports.
 
 ### 5. Name the slot contract
 

package/dist/agent-src/skills/upstream-contribute/SKILL.md

@@ -9,7 +9,7 @@ scope:
 execution:
   type: assisted
   handler: internal
-  allowed_tools: ["github"]
+  allowed_tools: ["Bash(gh:*)"]
 workspaces:
   - agent-config-maintainer
 packs:
@@ -49,6 +49,43 @@ shared `agent-config` package — with correct file placement, quality gates, an
 - **Quality verified** — must pass linter before PR creation
 - **Local benefit immediately** — use override for instant project benefit while PR is pending
 
+## A repeated override is a signal, and a signal is not evidence
+
+```
+THE SAME ARTIFACT OVERRIDDEN IN INDEPENDENT INSTALLS IS THE CHEAPEST AVAILABLE
+HINT THAT A SHIPPED DEFAULT IS WRONG. IT IS A HINT.
+NEVER CHANGE A SHIPPED DEFAULT ON OVERRIDES FROM ONE ORGANISATION.
+INDEPENDENT MEANS DIFFERENT TEAMS, NOT DIFFERENT DIRECTORIES.
+```
+
+`agent-config doctor --check override-set` reports which shipped artifacts a
+tree overrides and in how many layers. Two same-culture installs overriding the
+same artifact is **n=2 from one toolchain culture**, which is a discovery
+channel and not a mandate — and the temptation to "just fix the default, we
+already know" is exactly how a general package becomes one organisation's house
+style.
+
+**What makes an aggregate admissible**, matching the *Evidence-based* and
+*Universality first* principles above:
+
+- overrides from **independently operated** consumers, not several repositories
+  of one team;
+- the overriding change **converging on the same substance**, not merely
+  touching the same filename — two teams deleting different halves of a rule
+  are not agreeing about anything;
+- a **named public mechanism** that explains why the shipped default is wrong,
+  rather than "several people changed it".
+
+Below that bar, the signal is one input to a future aggregate and nothing more.
+Record it and leave the default alone.
+
+**The signal carries no consumer content, by construction.** Artifact kind, name
+and a layer count — the type has no field that can hold a path, a diff or
+anything from the tree, so privacy is the schema's shape rather than a scrubbing
+pass that could fail. Never widen it to make a proposal more persuasive; a
+proposal that needs the consumer's diff is a proposal that has not cleared the
+bar.
+
 ## Package repository
 
 The shared agent-config package lives at:

package/dist/agent-src/skills/verify-repair-loop/SKILL.md

@@ -15,7 +15,8 @@ packs:
 > **executed verdict** — the project's real test/quality output, scored against a
 > numeric threshold — escalated to a **judge** for qualitative confirmation only
 > *after* the numeric gate passes (staged escalation). The loop is the
-> conversation, not a process: no daemon, no persistent cross-session state. Use
+> conversation, not a process: this loop introduces no resident process of its
+> own and no persistent cross-session state. Use
 > it to drive a change to green when the verdict source is *runtime execution*,
 > not a judge reading a diff.
 
@@ -126,7 +127,7 @@ iterating against a stale contract.
 
 State lives in the conversation, optionally mirrored to a re-read working file —
 **never** a daemon or persistent cross-session store (honors
-[`no-runtime-boundary`](../../../docs/contracts/no-runtime-boundary.md)).
+[`resident-process-governance`](../../../docs/contracts/resident-process-governance.md)).
 
 ## Validation
 
@@ -137,7 +138,11 @@ Before finalizing, confirm:
 3. The loop stopped at `max_attempts`, a plateau, or a judge `apply` — never
    ran unbounded.
 4. The judge saw only the diff + results, dispatched in fresh context.
-5. No daemon / persistent runtime introduced.
+5. No **unsupervised** resident process introduced — and none of the four
+   governance conditions in `resident-process-governance.md` left unmet if a
+   supervised one is. (Amended 2026-08-27, ADR-249: this read "No daemon /
+   persistent runtime introduced" when a daemon was prohibited outright. The
+   check still fires; what it tests moved from existence to governance.)
 
 ## Output format
 
@@ -211,7 +216,7 @@ iter2 fixes A, breaks B, 92% → "PASS"      ✗ regression ignored
 * [`playwright-testing`](../playwright-testing/SKILL.md),
   [`quality-tools`](../quality-tools/SKILL.md) — verdict sources.
 * [`autonomous-execution`](../../rules/autonomous-execution.md) — the N=3 cap.
-* [`no-runtime-boundary`](../../../docs/contracts/no-runtime-boundary.md) — the
+* [`resident-process-governance`](../../../docs/contracts/resident-process-governance.md) — the
   runtime-free constraint this loop honors.
 * Optional impact pre-step (when a code-graph is present, ADR-124): run
   `agent-config code-graph affected --since <ref>` to scope which symbols a

package/dist/agent-src/templates/agents/agent-project-settings.example.yml

@@ -39,7 +39,7 @@ schema_version: 1
 # CI guard: a release bump of `package.json` must update this value
 # in lockstep — see scripts/check_template_pin_drift.ts (road-to-
 # portable-runtime-and-update-check P3.3).
-agent_config_version: "14.12.0"
+agent_config_version: "14.13.0"
 
 # --- Project identity ---
 project:

package/dist/agent-src/templates/roadmaps.md

@@ -78,6 +78,53 @@ that was never a judgement call.
     `horizon_weeks` to a positive integer. Enforced by
     `task lint-roadmap-complexity` (plate-token detection skipped when
     `horizon_weeks > 0`).
+17b. **A carried deferral is annotated, or it blocks archival forever.**
+    `archive_completed_roadmaps` used to refuse any roadmap with
+    `count_deferred > 0` unconditionally. Three of the four council-decidable
+    dispositions in the preservation test — carry to a follow-up, merge into
+    existing work, restore to open — leave the `[~]` glyph in place, so a
+    genuinely UNEXECUTABLE item (one needing elapsed time rather than effort)
+    had no council-reachable path to an archived roadmap. The only glyph that
+    cleared the gate was `[-]`, which is owner-reserved AND pinned to "won't
+    happen at all"; using it for a carried item makes cancellation and transfer
+    indistinguishable to every later reader.
+    Since 2026-08-27 (AI council, 2 seats, convergent) a `[~]` step may carry
+    a machine-readable resolution, inside the step's own block:
+    ```markdown
+    - [~] **4.2 Measure the false-positive rate.**
+          <!-- deferred-resolution: carried-to=road-to-some-followup -->
+    ```
+    `merged-into=<slug>` is the second accepted form, for a merge into
+    pre-existing work rather than a new follow-up. `[-]` stays cancellation-only.
+    **Validation fails closed at every step** — a bare `[~]`, a malformed
+    annotation, a destination that does not exist, a destination in `archive/`
+    or `skipped/`, and (for `carried-to`) a destination with no
+    `parent_roadmap: <source-slug>` back-link each refuse the archive and print
+    which door closed. `merged-into` needs no back-link but the destination must
+    still mention the source slug. An annotation is cheap to write, so it is
+    made expensive to satisfy.
+    Three further doors, each found by an independent review of the first
+    version rather than designed in: the destination may not be the **source
+    itself** (it passes every other check and then dies with it); it may not be
+    a roadmap **this same sweep will archive** (both complete in one run leaves
+    the carried item with no receiver — the loss the annotation exists to
+    prevent, produced by the mechanism); and `merged-into` needs a
+    **structured** link — a `relates:` row or a `parent_roadmap:` line — because
+    a substring match on the source slug is satisfied by a filename, an example
+    or a comment. The back-link slug is regex-escaped: interpolated raw, a slug
+    like `road.parent` matched `roadXparent` and one containing `[` threw and
+    aborted the sweep.
+    **Not checked, and stated rather than implied:** that the destination's copy
+    of the criterion is faithful. Both council seats asked for stable item
+    identity over verbatim text matching, and neither exists today — the
+    back-link plus the source mention is the strongest link the sweep can verify
+    without inventing an identity scheme, and the human reviewing the carry is
+    still the one reading it.
+    Eligibility differs from representation: an item that is merely
+    **unfinished** (needs effort nobody spent) stays `[ ]`. Carrying it would be
+    scope laundering. Only an item that **cannot** be executed now qualifies.
+    Contract: `agents/roadmaps/*` · `src/agent-src/scripts/archive_completed_roadmaps.ts`
+    § `deferralProblems` · `tests/scripts/archive_deferral_resolution.test.ts`.
 17. **Follow-up roadmaps from deferred items carry `parent_roadmap`.**
     When a roadmap closes with `[~]` deferred items, the
     [`roadmap-management`](../skills/roadmap-management/SKILL.md) skill
@@ -193,7 +240,7 @@ that was never a judgement call.
     gap-table ritual. When it fires:
     - **(a) Gap-table before drafting.** Audit each proposed item against
       the existing skill / command / rule surface and keep only verified
-      gaps — `KEEP` (genuine gap) / `FOLD` (into an existing artefact) /
+      gaps — `KEEP` (genuine gap) / `FOLD` (into an existing artifact) /
       `CUT` (already covered). The plan integrates, it does not dump.
     - **(b) `## Provenance` block** — source named by a **neutral
       descriptor** (never the raw competitor / tool name, per
@@ -467,6 +514,46 @@ that was never a judgement call.
     Register: the register ranks *known* risks with mitigations; the
     pre-mortem imagines the *whole plan dead* and reconstructs why.
 
+26. **A consolidating roadmap declares its parent set in `consolidates:`.**
+    When a roadmap claims to fold sibling proposals into one — a "master",
+    a consolidation, a document that supersedes others — it declares every
+    parent as a frontmatter list:
+
+    ```yaml
+    consolidates:
+      - road-to-first-parent.md
+      - road-to-second-parent.md
+    ```
+
+    The field is the *only* spelling a tracked roadmap may use. Five
+    legacy spellings exist in inbox artifacts and are read by
+    `lint_consolidation_lineage` so a legacy folder parses to the same
+    parent set rather than to an empty one — `supersedes_analysis:`, a
+    prose `**Inputs consolidated:**` list, a prose `**Ersetzt als
+    führendes Proposal:**` list, a `Master-Konsolidierung` heading with a
+    table, and a prose supersession sentence. They are **deprecated
+    spellings a reader may still encounter**, never shapes to author.
+
+    Why the field rather than prose: a consolidation presents its content
+    as adjudicated — parents named, conflicts resolved, a kill register
+    for what was rejected. A parent missing from that list is not
+    *killed*, it is *undiscussed*, and nothing in the artifact
+    distinguishes those two states. Measured
+    (`agents/evidence/analysis/consolidation-lineage-census-2026-08-26.md`):
+    four inbox folders carrying a declared consolidation, four with an
+    incomplete lineage.
+
+    An omission is discharged in exactly one of three ways, never by
+    silence: fold the parent in · record a kill ID for it · state that it
+    was read and adds nothing. `/analyze:inbox` carries the obligation at
+    the point the artifacts are produced.
+
+    Reported by `lint_consolidation_lineage` — report-mode, not blocking
+    (council 2026-08-27, 2/2 convergent: the four measured cases come from
+    a high-noise drafting context and do not establish precision on the
+    tracked estate; blocking is earned by tracked-scope evidence, not
+    assumed).
+
 ---
 
 ## Quality Gates (remote CI by default)
@@ -587,8 +674,15 @@ complexity: lightweight
 <!-- ## Provenance — INCLUDE ONLY for source-derived / harvest / capability-adoption
      roadmaps (rule 19). OMIT entirely for internally-originated roadmaps —
      do NOT ship an empty Provenance section.
-- Source: <neutral descriptor> (anonymized per source-confidentiality);
-  link via `src/scripts/_lib/link_crypto.ts decrypt`: ENC1:<token>
+- Source: `agents/tmp.old/<opaque-round-id>/` — an OPAQUE round identifier
+  (`inbox-2026-08-h`, `round-a91f3c`, `S17`), never a speaking directory name.
+  The `source-header` and `tmp-quote` shape classes BLOCK inside `agents/**`, so
+  a speaking value fails CI. Naming rule: `/analyze:inbox` Phase 1.
+- Source class, if it needs saying: <neutral descriptor> (anonymized per
+  source-confidentiality) — describe the KIND, never the identity.
+- Identity: recorded once, encrypted, in the round's intake note; the codename
+  map is `agents/evidence/reports/source-codename-map.md`. Decrypt via
+  `src/scripts/_lib/link_crypto.ts decrypt`: ENC1:<token>
 - Council: <members>, <date>, <depth>; convergence inlined above. -->
 ```