@event4u/agent-config 14.12.0 → 14.13.0

package/src/scripts/check_composite_arming.ts

@@ -42,6 +42,7 @@ import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import { runGateCli, runSelfTest, type SelfTestCase } from './_lib/gate_self_test.js';
+import { GateLedger } from './_lib/gate_ledger.js';
 import { DeadScopeError, reportScanned } from './_lib/scan_scope.js';
 
 const _HERE = fileURLToPath(import.meta.url);
@@ -292,6 +293,40 @@ function main(argv?: readonly string[]): number {
         return 1;
     }
     const { readings, malformed } = parseStore(text);
+
+    // Per-line accounting. `malformed` is a COUNT, and a count cannot say WHICH
+    // lines were dropped — a store whose last 40 appends were malformed reads
+    // the same as one with 40 fewer readings, which is the "looked at almost
+    // nothing" case. The ledger names each dropped line.
+    const ledger = new GateLedger('check_composite_arming');
+    const storeLines = text.split('\n').map((l, i) => ({ n: i + 1, t: l.trim() })).filter((l) => l.t !== '');
+    ledger.plan(storeLines.map((l) => `line:${String(l.n)}`));
+    let parsedSeen = 0;
+    for (const l of storeLines) {
+        let ok = false;
+        try {
+            const o = JSON.parse(l.t) as { session?: unknown };
+            ok = typeof o.session === 'string' && 'composite_ms' in (o as object);
+        } catch {
+            ok = false;
+        }
+        if (ok) {
+            parsedSeen += 1;
+            ledger.complete(`line:${String(l.n)}`);
+        } else {
+            ledger.skip(`line:${String(l.n)}`, 'precondition_unmet');
+        }
+    }
+    ledger.report();
+    /* c8 ignore next 6 */
+    if (parsedSeen !== readings.length) {
+        process.stderr.write(
+            `❌  check_composite_arming: ledger counted ${String(parsedSeen)} parseable line(s) but ` +
+                `parseStore returned ${String(readings.length)} reading(s) — the accounting and the ` +
+                'parser disagree, which means one of them is wrong about what was read.\n',
+        );
+        return 2;
+    }
     if (malformed > 0 && readings.length === 0) {
         process.stderr.write(
             `❌  ${path.relative(REPO_ROOT, store)}: ${String(malformed)} malformed line(s) and no usable ` +

package/src/scripts/check_concern_admissions.ts

@@ -0,0 +1,365 @@
+#!/usr/bin/env node
+/**
+ * Every hook concern added from here on carries a recorded answer — or fails.
+ *
+ * The sibling of `check_skill_admissions.ts`, same shape and same reasons, with
+ * one structural difference that changes the mechanism rather than the policy.
+ *
+ * ## Forward-only, and why the scope is computed differently
+ *
+ * A skill is a FILE, so its gate reads `git diff --diff-filter=A` and the 299
+ * already in the tree are grandfathered by construction. A concern is a KEY
+ * INSIDE ONE FILE — `src/scripts/hook_manifest.yaml` — so a file-level diff
+ * says only "the manifest changed", which is true of every concern edit and
+ * discriminates nothing.
+ *
+ * The scope here is therefore a SET DIFFERENCE over the parsed ids: the
+ * concerns at HEAD minus the concerns at the base ref. Both sides go through
+ * the same scoped parser (`_lib/concern_estate.ts`), for the reason that module
+ * exists — two readings of one corpus is how a gate comes to compare a number
+ * against a differently-derived number.
+ *
+ * The grandfathering is identical in effect: the 55 already in the tree need no
+ * ledger row and cannot be forgotten off one.
+ *
+ * ## The questions are NOT the skill questions
+ *
+ * They are derived from `docs/contracts/hook-architecture-v1.md`, because what
+ * makes a concern risky is different from what makes a skill risky. A concern
+ * binds to a slot, on hosts that may or may not honour a deny, inside a
+ * per-event budget — and none of that has a skill analogue.
+ *
+ * ## A rejected row is first-class
+ *
+ * `decision: rejected` records a visible "no", and a rejected row naming a
+ * concern that EXISTS is itself a failure: it means the refusal was recorded
+ * and then overridden without the row being updated, which is worse than no
+ * record at all.
+ */
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { spawnSync } from 'node:child_process';
+
+import { CONCERN_MANIFEST_POSIX, concernIds } from './_lib/concern_estate.js';
+
+const REPO_ROOT = process.cwd();
+
+export const LEDGER_REL = 'agents/decisions/concern-admissions.jsonl';
+
+/**
+ * The five answers, each a non-empty sentence.
+ *
+ * Every one is a question `hook-architecture-v1.md` makes answerable and a
+ * reviewer would otherwise have to reconstruct from the manifest by hand.
+ */
+export const REQUIRED_ANSWERS = [
+    /** Which lifecycle slot it binds — `pre_tool_use`, `stop`, and so on. */
+    'slot',
+    /** Which hosts actually BIND it, as opposed to which declare the slot. */
+    'binding_hosts',
+    /** What it does where the host ignores a deny — the honest-coverage answer. */
+    'behaviour_where_deny_ignored',
+    /** Why an existing concern cannot carry this. */
+    'why_not_extend',
+    /** What it costs against the per-(platform,event) budget. */
+    'per_event_budget_impact',
+] as const;
+
+export const DECISIONS = ['admitted', 'rejected'] as const;
+export type Decision = (typeof DECISIONS)[number];
+
+export interface AdmissionRow {
+    concern: string;
+    decision: Decision;
+    date: string;
+    slot?: string;
+    binding_hosts?: string;
+    behaviour_where_deny_ignored?: string;
+    why_not_extend?: string;
+    per_event_budget_impact?: string;
+    /** Free-form; only meaningful on a `rejected` row. */
+    instead?: string;
+}
+
+export interface Finding {
+    concern: string;
+    kind: 'missing_row' | 'incomplete_row' | 'rejected_but_present' | 'bad_decision' | 'duplicate_row';
+    message: string;
+}
+
+function isRow(v: unknown): v is AdmissionRow {
+    return typeof v === 'object' && v !== null && typeof (v as AdmissionRow).concern === 'string';
+}
+
+export function readLedger(root = REPO_ROOT): AdmissionRow[] {
+    const p = path.join(root, LEDGER_REL);
+    if (!fs.existsSync(p)) {
+        // An absent ledger is not an empty corpus: it is a gate with nothing to
+        // read, and the forward-only scope means an absent ledger only matters
+        // once something has been added.
+        return [];
+    }
+    const out: AdmissionRow[] = [];
+    let n = 0;
+    for (const line of fs.readFileSync(p, 'utf-8').split('\n')) {
+        n += 1;
+        const t = line.trim();
+        if (t === '') continue;
+        let parsed: unknown;
+        try {
+            parsed = JSON.parse(t);
+        } catch {
+            throw new Error(
+                `${LEDGER_REL}:${String(n)} is not valid JSON. A malformed ledger is a hard ` +
+                    'failure, never a skipped line — a gate that silently drops rows admits by accident.',
+            );
+        }
+        if (isRow(parsed)) out.push(parsed);
+    }
+    return out;
+}
+
+/** Concern ids declared at a git ref, or `null` when the manifest is unreadable there. */
+export function concernsAt(root: string, ref: string): Set<string> | null {
+    const res = spawnSync('git', ['show', `${ref}:${CONCERN_MANIFEST_POSIX}`], {
+        cwd: root,
+        encoding: 'utf-8',
+        maxBuffer: 32 * 1024 * 1024,
+    });
+    if (res.status !== 0) return null;
+    return new Set(concernIds(res.stdout ?? ''));
+}
+
+/** Concern ids in the working tree. */
+export function liveConcerns(root = REPO_ROOT): Set<string> {
+    const p = path.join(root, CONCERN_MANIFEST_POSIX);
+    if (!fs.existsSync(p)) return new Set();
+    return new Set(concernIds(fs.readFileSync(p, 'utf-8')));
+}
+
+/**
+ * Concerns ADDED since `baseRef` — the forward-only scope.
+ *
+ * A set difference rather than a file diff, because a concern is a key inside
+ * one file. `null` from `concernsAt` means the manifest could not be read at
+ * the base, in which case NOTHING is treated as added: a ref that predates the
+ * file must not retroactively demand a row for all 55.
+ */
+export function addedConcerns(root: string, baseRef: string): string[] {
+    const base = concernsAt(root, baseRef);
+    if (base === null) return [];
+    return [...liveConcerns(root)].filter((id) => !base.has(id)).sort();
+}
+
+export function evaluate(root = REPO_ROOT, baseRef: string | null): Finding[] {
+    const findings: Finding[] = [];
+    const rows = readLedger(root);
+    const live = liveConcerns(root);
+
+    const seen = new Map<string, number>();
+    for (const r of rows) {
+        seen.set(r.concern, (seen.get(r.concern) ?? 0) + 1);
+        if (!(DECISIONS as readonly string[]).includes(r.decision)) {
+            findings.push({
+                concern: r.concern,
+                kind: 'bad_decision',
+                message: `decision must be one of ${DECISIONS.join(' | ')}, got ${JSON.stringify(r.decision)}`,
+            });
+            continue;
+        }
+        if (r.decision === 'rejected' && live.has(r.concern)) {
+            findings.push({
+                concern: r.concern,
+                kind: 'rejected_but_present',
+                message:
+                    'the ledger records a REJECTION and the concern exists in the manifest. A refusal that ' +
+                    'was later overridden without updating its row is worse than no record at all.',
+            });
+        }
+    }
+    for (const [id, n] of seen) {
+        if (n > 1) {
+            findings.push({
+                concern: id,
+                kind: 'duplicate_row',
+                message: `${String(n)} rows name this concern; one decision per concern, amended in place`,
+            });
+        }
+    }
+
+    if (baseRef === null) return findings;
+
+    const admitted = new Map(rows.filter((r) => r.decision === 'admitted').map((r) => [r.concern, r]));
+    for (const id of addedConcerns(root, baseRef)) {
+        const row = admitted.get(id);
+        if (row === undefined) {
+            findings.push({
+                concern: id,
+                kind: 'missing_row',
+                message: `added since ${baseRef} with no \`admitted\` row in ${LEDGER_REL}`,
+            });
+            continue;
+        }
+        const blank = REQUIRED_ANSWERS.filter((k) => {
+            const v = row[k];
+            return typeof v !== 'string' || v.trim() === '';
+        });
+        if (blank.length > 0) {
+            findings.push({
+                concern: id,
+                kind: 'incomplete_row',
+                message: `row is missing a real answer for: ${blank.join(', ')}`,
+            });
+        }
+    }
+    return findings;
+}
+
+// ---------------------------------------------------------------------------
+// CLI
+// ---------------------------------------------------------------------------
+
+import { reportScanned } from './_lib/scan_scope.js';
+import { runGateCli, runSelfTest, type SelfTestCase } from './_lib/gate_self_test.js';
+import * as os from 'node:os';
+
+function resolveBase(root: string): string | null {
+    for (const ref of ['origin/main', 'main']) {
+        const r = spawnSync('git', ['rev-parse', '--verify', '--quiet', ref], { cwd: root, encoding: 'utf-8' });
+        if (r.status === 0) return ref;
+    }
+    return null;
+}
+
+const MANIFEST = (ids: readonly string[]): string =>
+    ['concerns:', ...ids.map((i) => `  ${i}:\n    severity: advisory`), 'roles:', '  dev:', ''].join('\n');
+
+const ROW = (concern: string, decision: Decision, blank?: string): string =>
+    JSON.stringify({
+        concern,
+        decision,
+        date: '2026-08-30',
+        ...Object.fromEntries(REQUIRED_ANSWERS.map((k) => [k, k === blank ? '' : `a real answer for ${k}`])),
+    });
+
+function selfTest(): number {
+    const roots: string[] = [];
+    const script = path.join('src', 'scripts', 'check_concern_admissions.ts');
+
+    /** A throwaway repo with a base commit and a working-tree change on top. */
+    const fixture = (opts: { base: readonly string[]; head: readonly string[]; ledger?: string }): number => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ca-selftest-'));
+        roots.push(dir);
+        const g = (...a: string[]): void => {
+            spawnSync('git', a, { cwd: dir, encoding: 'utf-8' });
+        };
+        const put = (rel: string, body: string): void => {
+            fs.mkdirSync(path.join(dir, path.dirname(rel)), { recursive: true });
+            fs.writeFileSync(path.join(dir, rel), body, 'utf-8');
+        };
+        g('init', '-q', '-b', 'main');
+        g('config', 'user.email', 'selftest@local');
+        g('config', 'user.name', 'selftest');
+        put(CONCERN_MANIFEST_POSIX, MANIFEST(opts.base));
+        put(LEDGER_REL, '');
+        g('add', '-A');
+        g('commit', '-q', '-m', 'base');
+        put(CONCERN_MANIFEST_POSIX, MANIFEST(opts.head));
+        if (opts.ledger !== undefined) put(LEDGER_REL, `${opts.ledger}\n`);
+        // repoRoot locates tsx AND resolves the relative script path, so it is
+        // THIS checkout; cwd and --root are the fixture.
+        return runGateCli(REPO_ROOT, script, ['--base', 'main', '--root', dir], dir);
+    };
+
+    const cases: SelfTestCase[] = [
+        {
+            name: 'no concern added → accept',
+            expect: 'accept',
+            run: () => fixture({ base: ['one'], head: ['one'] }),
+        },
+        {
+            name: 'a concern added with no ledger row → reject',
+            expect: 'reject',
+            run: () => fixture({ base: ['one'], head: ['one', 'two'] }),
+        },
+        {
+            name: 'a concern added WITH a complete admitted row → accept',
+            expect: 'accept',
+            run: () => fixture({ base: ['one'], head: ['one', 'two'], ledger: ROW('two', 'admitted') }),
+        },
+        {
+            // A row that exists but answers nothing is the shape a gate is
+            // easiest to satisfy dishonestly, so it is tested explicitly.
+            name: 'an admitted row with a blank answer → reject',
+            expect: 'reject',
+            run: () =>
+                fixture({ base: ['one'], head: ['one', 'two'], ledger: ROW('two', 'admitted', 'why_not_extend') }),
+        },
+        {
+            name: 'a rejected row naming a LIVE concern → reject',
+            expect: 'reject',
+            run: () => fixture({ base: ['one', 'two'], head: ['one', 'two'], ledger: ROW('two', 'rejected') }),
+        },
+        {
+            // The grandfathering, asserted rather than assumed: pre-existing
+            // concerns must never demand a row.
+            name: 'the pre-existing set needs no rows → accept',
+            expect: 'accept',
+            run: () => fixture({ base: ['a', 'b', 'c'], head: ['a', 'b', 'c'] }),
+        },
+    ];
+
+    try {
+        return runSelfTest({ gate: 'check_concern_admissions', cases, minCases: 5, minRejectCases: 3 });
+    } finally {
+        for (const d of roots) fs.rmSync(d, { recursive: true, force: true });
+    }
+}
+
+export function main(argv: string[] = process.argv.slice(2), rootIn = REPO_ROOT): number {
+    if (argv.includes('--self-test')) return selfTest();
+    const i = argv.indexOf('--base');
+    const j = argv.indexOf('--root');
+    const root = j >= 0 && argv[j + 1] !== undefined ? path.resolve(argv[j + 1] as string) : rootIn;
+    const baseRef = i >= 0 ? (argv[i + 1] as string) : resolveBase(root);
+
+    const rows = readLedger(root);
+    const added = baseRef === null ? [] : addedConcerns(root, baseRef);
+    reportScanned({
+        gate: 'check_concern_admissions',
+        scanned: rows.length + added.length,
+        units: 'admission row(s) + added concern(s)',
+        roots: [LEDGER_REL, CONCERN_MANIFEST_POSIX],
+        // The state this ships in: 55 concerns are grandfathered by the
+        // forward-only set-difference scope, so the first row arrives with the
+        // first new concern. `readLedger` throws on a MALFORMED ledger, so
+        // "moved" and "empty" stay different verdicts.
+        allowEmpty:
+            'EMPTY_VALID: no concern has been admitted or refused through this ledger yet — the ' +
+            'pre-existing 55 are grandfathered by the forward-only set-difference scope, and a ' +
+            'malformed ledger is a separate hard error in readLedger()',
+    });
+
+    const findings = evaluate(root, baseRef);
+    if (baseRef === null) {
+        process.stdout.write(
+            '  ⏭️  no base ref resolved — the added-concern scope could not be computed; ' +
+                'ledger consistency was still checked\n',
+        );
+    }
+    if (findings.length === 0) {
+        process.stdout.write(
+            `✅  check_concern_admissions: ${String(added.length)} concern(s) added since ` +
+                `${baseRef ?? '<no base>'}, each carrying a recorded answer.\n`,
+        );
+        return 0;
+    }
+    process.stderr.write(`❌  check_concern_admissions: ${String(findings.length)} finding(s):\n`);
+    for (const f of findings) process.stderr.write(`  🔴 ${f.concern} [${f.kind}] — ${f.message}\n`);
+    return 1;
+}
+
+if (process.argv[1] !== undefined && process.argv[1].includes('check_concern_admissions')) {
+    process.exit(main());
+}

package/src/scripts/check_enforcement_coverage.ts

@@ -852,6 +852,34 @@ function main(argv: string[]): number {
         }
         const base = JSON.parse(fs.readFileSync(BASELINE, 'utf-8')).summary as Summary;
         const regressions: string[] = [];
+
+        // `undeclared` is the only counter here that is a TRUE shrink-only
+        // ratchet, and the asymmetry is worth stating because the two below it
+        // are not.
+        //
+        // A rule with no declaration has no carrier, so it can contribute to
+        // neither `frequency_gap` nor `local_only`. DECLARING one truthfully can
+        // therefore only RAISE both — the gap and the taskfile-only reach were
+        // always there, and the declaration is what made them computable. Both
+        // checks compare a number against a baseline taken when the rule was
+        // invisible, so an honest declaring change reds them by construction.
+        //
+        // Measured 2026-08-27, landing 14 declarations from
+        // `road-to-undeclared-obligation-disposition` Phase 1.3:
+        // `frequency gaps rose: 9 → 14` and `validators fell back to
+        // taskfile-only: 0 → 3`. Nothing fell back and no carrier fired less
+        // often. Both readings were new visibility.
+        //
+        // The sanctioned response is the one the failure message already names —
+        // regenerate the baseline — and the obligation this comment adds is that
+        // a change doing so SAYS WHY, because a regenerated baseline and a
+        // hidden regression look identical in a diff.
+        if (summary.undeclared > (base.undeclared ?? Number.POSITIVE_INFINITY)) {
+            regressions.push(
+                `undeclared rules rose: ${base.undeclared} → ${summary.undeclared} ` +
+                    `(a rule lost its enforced_by, or a new rule landed without one)`,
+            );
+        }
         if (summary.blocking < base.blocking) {
             regressions.push(`blocking coverage fell: ${base.blocking} → ${summary.blocking}`);
         }

package/src/scripts/check_estate_count.ts

@@ -153,6 +153,7 @@ import { GateLedger } from './_lib/gate_ledger.js';
 import { resolveBaseRef } from './_lib/ratchet_base_ref.js';
 import { materialiseSubtree } from './_lib/base_tree.js';
 import { SKILLS_POSIX, measureSkillEstate } from './_lib/skill_estate.js';
+import { CONCERN_MANIFEST_POSIX, countConcerns } from './_lib/concern_estate.js';
 import { runGateCli, runSelfTest, type SelfTestCase } from './_lib/gate_self_test.js';
 
 const GATE = 'check_estate_count';
@@ -190,6 +191,23 @@ export interface EstateCounts {
      * "no tokens" — see `tokensExact`.
      */
     skill_description_tokens: number;
+    /**
+     * Hook concerns declared in `src/scripts/hook_manifest.yaml`.
+     *
+     * A FIFTH corpus on the same machinery, and the same argument that admitted
+     * skills: the floor-from-the-base-ref work is the expensive part and should
+     * not be written a third time, and a separate ratchet is a separate place to
+     * forget.
+     *
+     * Read with the SCOPED parser in `_lib/concern_estate.ts`, not the
+     * whole-file grep the originating roadmap reproduces its series with. That
+     * grep over-counts by exactly 16 at every one of its six pins, because
+     * `roles:`, `platforms:` and `native_event_aliases:` sit at the same indent.
+     * The growth finding survives the correction — the delta is constant — but
+     * the absolute figure does not: the axis stands at 55, not 71, and a floor
+     * of 71 is one this gate's own parser could never reproduce.
+     */
+    concern_count: number;
 }
 
 export type MetricName = keyof EstateCounts;
@@ -200,6 +218,7 @@ export const METRICS: readonly MetricName[] = [
     'open_blockers',
     'skill_count',
     'skill_description_tokens',
+    'concern_count',
 ];
 
 export interface EstateBudget {
@@ -303,6 +322,29 @@ function repoRootFrom(start: string): string {
     }
 }
 
+/** File contents, or `null` when it is absent. Absent is a real state here. */
+function readIfPresent(file: string): string | null {
+    try {
+        return fs.readFileSync(file, 'utf-8');
+    } catch {
+        return null;
+    }
+}
+
+/**
+ * Concern count at a git ref, or `null` when the manifest is unreadable there.
+ *
+ * `null` is NOT zero, and the distinction is the whole reason this returns an
+ * option. A missing manifest read as 0 makes the floor 0, which makes the
+ * ratchet inert on that path while still printing a green line — "a gate that
+ * read nothing has not passed", in this repository's own words. The caller
+ * turns `null` into a floor-skip, which this gate already treats as a failure.
+ */
+function concernCountAt(repoRoot: string, ref: string): number | null {
+    const res = git(['show', `${ref}:${CONCERN_MANIFEST_POSIX}`], repoRoot);
+    return res.ok ? countConcerns(res.stdout) : null;
+}
+
 function git(args: readonly string[], cwd: string): { ok: boolean; stdout: string } {
     const res = spawnSync('git', [...args], { cwd, encoding: 'utf-8', maxBuffer: 32 * 1024 * 1024 });
     return { ok: res.status === 0, stdout: res.stdout ?? '' };
@@ -389,6 +431,7 @@ export function countEstate(repoRoot: string): EstateCounts {
         // against a proxy one — they differ by more than the growth a ratchet
         // is trying to catch.
         skill_description_tokens: skills.skill_description_tokens ?? 0,
+        concern_count: countConcerns(readIfPresent(path.join(repoRoot, CONCERN_MANIFEST_POSIX)) ?? ''),
     };
 }
 
@@ -554,6 +597,15 @@ export function evaluate(
     // property, and unlike a number nobody has to remember to update it.
     let floor: EstateCounts | null = null;
     let floorSkipReason: string | null = null;
+    /**
+     * Does the WORKING TREE carry a manifest at all?
+     *
+     * The base-ref read only matters when it does. A repository with no manifest
+     * on either side has no concern axis to ratchet, and failing there would
+     * turn every unrelated fixture red — which is how the first version of this
+     * clause was caught.
+     */
+    const headHasManifest = fs.existsSync(path.join(repoRoot, CONCERN_MANIFEST_POSIX));
     /** Set when the base ref carries no `src/skills` — the skill metrics drop. */
     let skillFloorSkipReason: string | null = null;
     /** Set when either side's tokeniser did not resolve — that ONE metric drops. */
@@ -584,7 +636,14 @@ export function evaluate(
                 if (baseSkills.error !== null || baseSkills.files === 0) {
                     // Roadmap floor stands; the skill floor is stated as
                     // unavailable and its metrics are dropped from the compare.
-                    floor = roadmapFloor;
+                    const cf = concernCountAt(repoRoot, baseRef);
+                    floor = { ...roadmapFloor, concern_count: cf ?? 0 };
+                    if (cf === null && headHasManifest) {
+                        floorSkipReason =
+                            `could not read ${CONCERN_MANIFEST_POSIX} at ${baseRef} while HEAD ` +
+                            'carries one. A floor of 0 would make the concern ratchet inert while ' +
+                            'still printing green, so this fails rather than skips.';
+                    }
                     skillFloorSkipReason =
                         `could not read ${SKILLS_POSIX} at ${baseRef} — ` +
                         `${baseSkills.error ?? 'no files'}`;
@@ -594,7 +653,23 @@ export function evaluate(
                         ...roadmapFloor,
                         skill_count: s.skill_count,
                         skill_description_tokens: s.skill_description_tokens ?? 0,
+                        // A SINGLE FILE, so `git show` rather than a third
+                        // `materialiseSubtree` — stated because the roadmap asks
+                        // which of the two this uses. Materialising a subtree to
+                        // reach one known path would spend a temp tree and a
+                        // recursive ls-tree on a `git cat-file` in disguise.
+                        //
+                        // `?? 0` never stands for "unreadable": the branch below
+                        // turns that into a floor-skip, which fails. This
+                        // coalesce only satisfies the type.
+                        concern_count: concernCountAt(repoRoot, baseRef) ?? 0,
                     };
+                    if (concernCountAt(repoRoot, baseRef) === null && headHasManifest) {
+                        floorSkipReason =
+                            `could not read ${CONCERN_MANIFEST_POSIX} at ${baseRef} while HEAD ` +
+                            'carries one. A floor of 0 would make the concern ratchet inert while ' +
+                            'still printing green, so this fails rather than skips.';
+                    }
                     if (s.skill_description_tokens === null) {
                         skillTokenSkipReason =
                             `the tokeniser did not resolve at ${baseRef}; an exact reading may ` +
@@ -663,6 +738,14 @@ export function evaluate(
         // claim path — a recorded reason in the diff — or it fails.
         skill_count: 0,
         skill_description_tokens: 0,
+        // Step 1.2: NO new allowance key. The concern axis joins `skill_count`
+        // in taking the claim path or nothing, for the reason the budget file
+        // already records for skills — an allowance reopens the gaming path the
+        // dimension exists to close. Eight concerns spread across eight events
+        // violate the existing per-event cap zero times, which is exactly why a
+        // total-growth ratchet was needed and exactly why it must not carry a
+        // per-change freebie.
+        concern_count: 0,
     };
 
     /** Metrics dropped from the compare, with the reason, never silently. */
@@ -808,6 +891,64 @@ function selfTest(): number {
             expect: 'accept',
             run: () => fixture({ roadmaps: 3, base: 'main', after: () => undefined }),
         },
+        {
+            // The concern axis, both directions. Seeded into the BASE tree so
+            // the floor is a real reading of the fixture's own manifest rather
+            // than this repository's -- the whole point of measuring the floor
+            // from the base ref.
+            name: 'concern count grows above the base-tree floor → reject',
+            expect: 'reject',
+            run: () =>
+                fixture({
+                    roadmaps: 3,
+                    base: 'main',
+                    before: (dir) =>
+                        write(dir, CONCERN_MANIFEST_POSIX, 'concerns:\n  one:\n    severity: advisory\n'),
+                    after: (dir) =>
+                        write(
+                            dir,
+                            CONCERN_MANIFEST_POSIX,
+                            'concerns:\n  one:\n    severity: advisory\n  two:\n    severity: advisory\n',
+                        ),
+                }),
+        },
+        {
+            // AC-3's explicit clause, and it corrects the first implementation
+            // of this metric: an unreadable manifest at the base ref must FAIL,
+            // never read as 0. A floor of 0 makes the ratchet inert on that
+            // path while still printing a green line, which is the shape this
+            // repository calls "a gate that read nothing has not passed".
+            name: 'base ref carries no manifest → reject (a 0 floor is not a floor)',
+            expect: 'reject',
+            run: () =>
+                fixture({
+                    roadmaps: 3,
+                    base: 'main',
+                    after: (dir) =>
+                        write(dir, CONCERN_MANIFEST_POSIX, 'concerns:\n  one:\n    severity: advisory\n'),
+                }),
+        },
+        {
+            // The half that proves the parser is SCOPED rather than a grep: a
+            // top-level map gaining members at the same two-space indent is not
+            // concern growth, and the roadmap's own reproduce command would
+            // have counted it as such.
+            name: 'a non-concern top-level map growing is not concern growth → accept',
+            expect: 'accept',
+            run: () =>
+                fixture({
+                    roadmaps: 3,
+                    base: 'main',
+                    before: (dir) =>
+                        write(dir, CONCERN_MANIFEST_POSIX, 'concerns:\n  one:\n    severity: advisory\nroles:\n  dev:\n'),
+                    after: (dir) =>
+                        write(
+                            dir,
+                            CONCERN_MANIFEST_POSIX,
+                            'concerns:\n  one:\n    severity: advisory\nroles:\n  dev:\n  ops:\n  sre:\n',
+                        ),
+                }),
+        },
         {
             // The floor is now exact, so this case no longer depends on anyone
             // having typed the right number at the base commit.