@event4u/agent-config 14.12.0 → 14.14.0

package/src/config/canonical-terms.yml

@@ -0,0 +1,119 @@
+# Canonical terms — the house dialect for repository-authored prose.
+# road-to-canonical-terms Phase 1.1. AI council 2/2, 2026-08-25.
+#
+# WHAT THIS FILE DECIDES, AND WHAT IT DOES NOT.
+# It records the canonical side of each measured pair. It does NOT authorise a
+# sweep of the existing corpus. Both council seats separated the two
+# deliberately: choosing a canonical dialect and rewriting ~5000 historical
+# occurrences have different evidentiary requirements, and only the first is
+# supported today. `policy_scope` below states that boundary in the data rather
+# than only in prose, so a future reader cannot take this file for authorisation.
+#
+# WHY AMERICAN, WHEN THE PUBLISHED AGGREGATE SAID BRITISH.
+# The roadmap's Phase 1.1 rests on `behaviour`/`behavior` splitting 57/43 with
+# the BRITISH side ahead, calling it a case where the majority rule and the
+# consistency rule point in opposite directions. Decomposed by directory, they
+# do not point in opposite directions at all:
+#
+#     src/     128 behaviour / 432 behavior   -> 22/78  AMERICAN
+#     docs/    304 / 189                      -> 61/39
+#     agents/  971 / 419                      -> 69/31
+#
+# The British majority is produced almost entirely by `agents/` -- roadmaps,
+# evidence notes and archive, i.e. this repository's own working prose, much of
+# it in files nobody will edit again. On the SHIPPED surface the tree is already
+# 78 % American. So this file documents existing practice where it matters
+# rather than imposing a rewrite, which is also the strongest answer to the
+# seat that asked for evidence of harm before authorising 5000 changed lines:
+# declaring the convention `src/` already follows costs nothing and changes no
+# file.
+#
+# Full decomposition, including the two other pairs that flip between the
+# shipped surface and the aggregate (`artifact`/`artefact` and
+# `preflight`/`pre-flight`), is the CORRECTION section of
+# agents/evidence/analysis/wording-baseline-2026-08-25.md.
+schema_version: canonical-terms-v1
+
+policy_scope: prose-authored-here
+# `prose-authored-here` -- the canonical side applies to prose THIS repository
+# writes. It never applies to: exact external titles and quotations, code,
+# identifiers, paths, URLs, commands, test fixtures, snapshots, or externally
+# synchronised material. The council's wording, adopted verbatim in intent:
+# do NOT exempt ordinary prose merely because it sits near protected text.
+
+sweep_authorised: false
+# Set true only when a classified inventory and a bounded pilot exist. The
+# conditions are recorded at the roadmap's step 2.1; this key exists so a gate
+# or a future session reads the answer rather than inferring it from silence.
+
+terms:
+  # --- decided, and the direction is the same in src/, docs/ and agents/ ---
+  - canonical: subagent
+    variant: sub-agent
+    confidence: unambiguous
+    note: 98/2 in src/, 99/1 in docs/ and agents/. No directory disagrees.
+  - canonical: handoff
+    variant: hand-off
+    confidence: unambiguous
+    note: >-
+      84/16 in src/, 85/15 in docs/, 95/5 in agents/. `hand off` as two words is
+      a verb phrase and is not a variant of the noun; it is out of scope here.
+  - canonical: organize
+    variant: organise
+    confidence: unambiguous
+    note: >-
+      100/0 in src/ and docs/. agents/ is 53/47 on n=13, which is too small to
+      contradict anything.
+  - canonical: gray
+    variant: grey
+    confidence: low-count
+    note: >-
+      68/32 in src/ on n=25. Direction is consistent across directories but the
+      total is small; recorded as decided and flagged as thin evidence.
+  - canonical: canonicalize
+    variant: canonicalise
+    confidence: low-count
+    note: 100/0 in src/ on n=2. Follows `organize` rather than standing on its own count.
+
+  # --- decided AGAINST the published aggregate, on the shipped-surface reading ---
+  - canonical: behavior
+    variant: behaviour
+    confidence: decided-against-aggregate
+    note: >-
+      The pair the roadmap called hard. src/ is 22/78 American, so on the
+      shipped surface the majority rule and the consistency rule agree. The
+      aggregate's 57/43 British lead is an artifact of counting agents/.
+  - canonical: artifact
+    variant: artefact
+    confidence: decided-against-aggregate
+    note: >-
+      Aggregate 51/49 is a coin-flip and agents/ is 49/51, but src/ is 63/37.
+      Decided on the shipped surface for the same reason as `behavior`.
+
+  # --- decided, but the migration is explicitly NOT mechanical ---
+  - canonical: license
+    variant: licence
+    confidence: semantic-care-required
+    note: >-
+      94/6 in src/. `license` is both noun and verb in the canonical dialect, so
+      no noun/verb distinction is preserved in repository-authored prose. But
+      exact licence TITLES and quoted names are protected text and are never
+      rewritten -- and per the council, proximity to a protected name does not
+      exempt the surrounding prose. This pair is the one where a mechanical
+      find-and-replace would be wrong.
+
+  # --- NOT decided ---
+  - canonical: null
+    variant: pre-flight
+    also: preflight
+    confidence: undecided
+    note: >-
+      The one pair this file declines to decide. src/ is 44/56 in favour of the
+      HYPHENATED form on n=25, while the aggregate says 68/32 for the closed
+      form. The honest reading of a 25-sample near-tie is undecided, not decided
+      the other way, and picking a side to make the table look complete is the
+      failure this entry exists to avoid. Revisit when src/ carries enough
+      occurrences to separate the two.
+
+# `cancelled` / `canceled` is 946/0 and needs no entry -- recorded in the
+# wording baseline so a later pass does not spend a sweep on it.

package/src/config/capability-native-outcome-bars.json

@@ -0,0 +1,81 @@
+{
+    "_comment": "Pre-registered outcome bars for road-to-capability-native-execution, step 0.6. FIXED BEFORE ANY MEASUREMENT — the step requires the prereg commit to precede any default-preference change, so a bar edited after a run is a moved goalpost and must be recorded as one. Phase 3.4 binds the other direction: the published set must cover EVERY bar named here, with none missing and none present that this file does not name. Shape asserted by tests/scripts/capability_native_outcome_bars.test.ts — a bar with no falsifier FAILS the shape check rather than passing, which is the step's own verify clause. HONESTY ABOUT THE NUMBERS: three bars are DERIVED from a contract or a frozen-fixture property and say so; three are STATED DEFAULTS with a revisit-if, and say that instead of implying a derivation they do not have; one (evidence-completeness) is a contract restatement. A pre-registered threshold nobody can source is worse than none, because it looks measured.",
+    "schema_version": 1,
+    "registered_at": "2026-08-30",
+    "owner": "maintainer",
+    "review_by": "2027-02-28",
+    "roadmap": "road-to-capability-native-execution",
+    "step": "0.6",
+    "bars": [
+        {
+            "id": "dispatch-success",
+            "what": "Of the frozen 0.5 fixtures a dispatchable adapter advertises it can handle, the share it completes without an execution error.",
+            "threshold": 0.95,
+            "direction": "at-least",
+            "unit": "ratio",
+            "basis": "DERIVED, not chosen. 0.5 froze the fixture set and 2.4/3.5 require an advertised-but-undispatchable fixture to be REFUSED BEFORE EXECUTION — so a dispatch that reaches execution has already passed a dispatchability probe, and anything below near-total success means the probe is not doing its job. The bar is on the post-probe population, which is why it is high.",
+            "falsifier": "any dispatchable adapter completes fewer than 95% of the fixtures it advertised, measured on the frozen 0.5 set with its digest recorded",
+            "measured_by": "phase 3.2"
+        },
+        {
+            "id": "evidence-completeness",
+            "what": "Every field the evidence contract requires is present in the adapter's output for a completed run.",
+            "threshold": 1.0,
+            "direction": "at-least",
+            "unit": "ratio",
+            "basis": "DERIVED from the contract, not chosen: 3.2 requires each adapter to produce THE SAME required evidence contract on the same fixture. A required field is required; 0.99 would mean the contract is advisory, and a partial evidence envelope is the shape a reader mistakes for a complete one.",
+            "falsifier": "any completed run emits an envelope missing a field the contract marks required",
+            "measured_by": "phase 3.2"
+        },
+        {
+            "id": "token-context-cost",
+            "what": "Per-fixture token cost of the capability-dispatched arm against the direct-call arm.",
+            "threshold": 1.1,
+            "direction": "at-most",
+            "unit": "ratio-vs-baseline",
+            "basis": "STATED DEFAULT, not a measured optimum — said plainly rather than implying a derivation it does not have. 1.10 encodes 'the indirection may cost something, and not much'. Revisit-if: 3.3's first paired run lands outside 0.9-1.3 in either direction, which would mean the bar was set against the wrong order of magnitude rather than against a real regression.",
+            "falsifier": "the dispatched arm costs more than 1.10x the direct arm on the frozen fixtures, both figures reproducible from a command in the bench log",
+            "measured_by": "phase 3.3"
+        },
+        {
+            "id": "wall-clock",
+            "what": "Per-fixture wall-clock of the capability-dispatched arm against the direct-call arm.",
+            "threshold": 1.25,
+            "direction": "at-most",
+            "unit": "ratio-vs-baseline",
+            "basis": "STATED DEFAULT. Looser than the token bar on purpose: dispatch adds a probe and a selection step whose cost is wall-clock rather than tokens, so a bar equal to the token one would fail on the mechanism working as designed. Revisit-if: the probe's own measured cost exceeds a quarter of the baseline, at which point the bar is measuring the probe rather than the dispatch.",
+            "falsifier": "median wall-clock of the dispatched arm exceeds 1.25x the direct arm over the frozen fixtures",
+            "measured_by": "phase 3.3"
+        },
+        {
+            "id": "setup-friction",
+            "what": "Manual steps a first-time operator performs before a dispatchable adapter runs at all.",
+            "threshold": 2,
+            "direction": "at-most",
+            "unit": "manual-steps",
+            "basis": "STATED DEFAULT, and the unit is the argument: steps are counted, not timed, because a timing figure on one machine is not transferable and a step count is. Two is 'install the engine, point at it'. Revisit-if: any adapter needs a credential, at which point the honest count is three and the bar moves with the reason recorded rather than the adapter being excluded.",
+            "falsifier": "any adapter counted as dispatchable needs more than two manual steps from a clean machine, counted from its own documented setup",
+            "measured_by": "phase 3.2"
+        },
+        {
+            "id": "deterministic-replay",
+            "what": "Re-running one fixture through one adapter twice yields the same required evidence fields.",
+            "threshold": 1.0,
+            "direction": "at-least",
+            "unit": "ratio",
+            "basis": "DERIVED. The frozen fixtures exist so a result is reproducible; an adapter whose required fields vary between runs cannot be compared against another adapter at all, which is what 3.2 exists to do. Timestamps and durations are explicitly OUT of the compared set — a bar that failed on a clock would be measuring the clock.",
+            "falsifier": "two runs of one fixture through one adapter differ in any required evidence field outside the declared volatile set",
+            "measured_by": "phase 3.2"
+        },
+        {
+            "id": "degraded-run-honesty",
+            "what": "A run that could not complete the full contract reports the degradation rather than emitting a partial envelope as if complete.",
+            "threshold": 1.0,
+            "direction": "at-least",
+            "unit": "ratio",
+            "basis": "DERIVED, and it is the bar the others rest on. Every ratio above is computed over runs the adapter CLAIMS completed; a degraded run silently counted as complete inflates all six. This is the same soundness invariant road-to-governed-harness-evolution 1.2 states for its activation ladder — an unobserved state is never silently converted to success.",
+            "falsifier": "any degraded run emits an envelope that a consumer cannot distinguish from a complete one",
+            "measured_by": "phase 3.2, phase 3.4"
+        }
+    ]
+}

package/src/config/ci-local-parity.yml

@@ -124,6 +124,41 @@ ci_only:
   - id: report_pack_delta
     class: artifact
     reason: "a pull-request-only delta report with no local meaning (base==head reads +0.0 KB and the step writes nothing); it packs two refs in throwaway worktrees at ~1 min, cannot red the build, and is reachable on demand via `task report-pack-delta`"
+
+  # road-to-supervised-telemetry-collector step 4.2 (AC-7). Runs the
+  # dispatcher-reaching suite TWICE — once with the collector present-but-off,
+  # once with it aliased away entirely — and compares per-test verdicts rather
+  # than declaring each run green. That is the whole set twice, roughly a minute,
+  # which is not a per-change local gate; and its result is a property of a
+  # clean checkout rather than of a developer's working tree, since it pins
+  # HOME to an empty directory precisely so the invoking user's own collector
+  # state cannot decide the answer.
+  #
+  # Reachable on demand: `./scripts-run src/scripts/check_static_parity`.
+  - id: check_static_parity
+    class: benchmark
+    reason: "two full runs of the dispatcher-reaching suite, compared per-test verdict by verdict, ~1 minute; a per-change local gate cannot afford it and its answer is a property of a clean checkout rather than of a working tree"
+  # road-to-supervised-telemetry-collector step 5.2. What is CI-only is this
+  # WRAPPER, whose whole job is to write
+  # `internal/reports/supervision-lifecycle.json` stamped with
+  # `git rev-parse HEAD`. That artifact is gitignored and read by
+  # `check_supervision_claim_atomicity`, which refuses any result whose recorded
+  # revision is not HEAD — so an artifact written during a local run of a dirty
+  # working tree is evidence about a revision nobody shipped.
+  #
+  # CORRECTED on R2 round-3 finding 7. This note used to say the five properties
+  # "run in the ordinary vitest chain" locally AND that a `task ci` wrapper
+  # "would spawn real daemons on every local run" — which cannot both be true,
+  # and the second half was already stale: the same change excluded
+  # `collector_lifecycle.test.ts` from the `node-tests` shards. The accurate
+  # position is that the suite runs on demand and in the dedicated
+  # `Collector Lifecycle` job, and the wrapper's CI-only status rests on the
+  # revision-stamped artifact alone — the argument that survives.
+  #
+  # Reachable on demand: `./scripts-run src/scripts/run_lifecycle_suite`.
+  - id: run_lifecycle_suite
+    class: artifact
+    reason: "writes the revision-stamped lifecycle evidence artifact the atomicity gate reads; the artifact is gitignored and only meaningful at the revision CI is testing, while the five properties themselves already run locally in tests/scripts/collector_lifecycle.test.ts"
   - id: classify_change_risk
     class: benchmark
     reason: "invoked as the nightly drift workflow's self-test step; the classifier itself gates nothing and its `--self-test` is runnable locally on demand (`./scripts-run src/scripts/classify_change_risk --self-test`)"
@@ -139,6 +174,27 @@ ci_only:
   - id: check_finding_dispositions
     class: release
     reason: "adjudicates the release-PR self-review findings ledger, whose input JSON is produced by the self-review workflow job"
+  # road-to-source-silence Phase 5.3. Two modes, and the distinction is the whole
+  # reason this is a declaration rather than a `task ci` entry.
+  #
+  # The mode a CI workflow invokes on a schedule is the FIVE-SURFACE CENSUS
+  # (source-surface-sweep.yml, weekly). It needs `gh` for the pull-request
+  # surface and a full-depth clone for the 9,000-commit trunk surface, it takes
+  # minutes, it writes no verdict, and it deliberately CANNOT red the build — a
+  # scheduled job that fails `main` for a residual count nobody can lower this
+  # week is a job that gets disabled. Putting it in `task ci` would add minutes
+  # to every local run for a number that is a standing observation, not a gate.
+  #
+  # The mode that IS a gate — `--gate-metadata`, which refuses source
+  # attribution in a branch name, PR title, PR body or commit message — has a
+  # stronger local story than `task ci` membership gives anything else here: it
+  # runs on PRE-PUSH via src/scripts/hooks/prepush_metadata_sources.sh, i.e.
+  # BEFORE the metadata is public, which is the only moment fixing it is free.
+  # A contributor therefore discovers that failure locally by construction,
+  # which is exactly the harm this checker exists to prevent.
+  - id: sweep_source_surfaces
+    class: network
+    reason: "the CI invocation is the weekly five-surface census — needs `gh` for the PR surface and a full-depth clone for the ~9,000-commit trunk surface, writes counts not a verdict, and is deliberately non-failing; its GATE mode (`--gate-metadata`) is reachable locally on pre-push via src/scripts/hooks/prepush_metadata_sources.sh and by hand, so no failure is discoverable only after a push"
   - id: rule_trigger_eval
     class: network
     reason: "live cross-model LLM trigger evaluation in the secret-gated canary workflow; advisory, paid, and never gating"
@@ -213,6 +269,30 @@ ci_only:
 # worth remote enforcement, OR it should simply be added to a workflow. Prefer
 # adding it: a local-only gate is the direction that let real defects merge.
 local_only:
+  - id: check_host_loadability_reach
+    class: developer-machine-scoped
+    reason: >
+      `check_host_loadability --reach` asks whether each generated host tree
+      carries artefacts, and — when it does not — whether the TOOL is absent or
+      the PROJECTION is dead. Those two are opposite findings that every current
+      gate reports as the same green, because a checker that returns early on a
+      missing tree cannot tell them apart.
+
+      Local-only by declaration rather than by omission, and the reason inverts
+      the obvious one: the verdict depends on which host tools are INSTALLED,
+      and a CI runner has none. Wired into a workflow, every row would resolve
+      `skipped-tool-absent` and the gate would scan nothing — the empty-scope
+      false green this repository's gate-coverage manifest exists to refuse.
+
+      This CORRECTS `road-to-skill-ecosystem-runtime-enforcement` Phase 3 Step 2,
+      which asked for a continuous-integration-only job. That instruction fits
+      the SHAPE half (`check_host_loadability --root .`), which is already
+      wired into `consistency.yml` and does not depend on installed tools; it
+      does not fit the reach half, and wiring it there would have produced a
+      permanently-skipping check that looked like coverage. Measured on a
+      developer machine: 6 of 6 host surfaces present and projecting
+      (claude-code 13, cursor 228, cline 14, windsurf 215, gemini-cli 1,
+      copilot 1).
   - id: check_hook_bundle_content
     class: developer-machine-scoped
     reason: >

package/src/config/drafting-channels.yml

@@ -0,0 +1,43 @@
+# Drafting channel registry — the `--channel` enum and its per-channel
+# defaults, extracted from docs/contracts/write-engine.md § Per-channel
+# defaults (road-to-channel-contract-and-profile-drift Phase 1.2).
+#
+# WHY THIS IS A SIBLING OF reach-channels.yml AND NOT AN EXTENSION OF IT.
+# One line, as the step requires: a drafting channel is an OUTPUT SHAPE for
+# prose this package writes (how long, how many paragraphs, whether hashtags
+# are allowed), whereas a reach channel is an EXTERNAL RETRIEVAL BACKEND the
+# operator installs and the package never calls — that file's own header says
+# it is "not a routing table, not a recommendation, not an agent-facing
+# surface" and that its Phase-0 benchmark returned `band: stop`, so nothing in
+# it is agent-facing at all. The two share the word "channel" and no field: a
+# drafting channel has no backend, no install string, no health probe and no
+# lifecycle; a reach channel has no length and no cadence. Merging them would
+# produce one schema in which every field is optional for half its rows, which
+# is the "two truths for one word" this roadmap's Risk Register row 2 names.
+#
+# WHAT READS THIS FILE. `docs/contracts/write-engine.md` is the prose contract
+# and stays the human-facing statement of the same values; this file is the
+# machine-checked copy, and
+# `tests/scripts/drafting_channels_schema.test.ts` asserts the two agree, so a
+# future edit to one that is not made to the other fails rather than drifts.
+#
+# THE VALUE IS THE FLAG VALUE. `id` is what a user types after `--channel=`.
+# `linkedin-post` is the value; `linkedin` is not a value and is rejected —
+# see the test case that pins exactly that, because the short form is the
+# plausible typo and silently accepting it would make the enum decorative.
+schema_version: drafting-channels-v1
+channels:
+  - id: tweet
+    length_default: 50
+    cadence: One paragraph, no lists.
+  - id: linkedin-post
+    length_default: 180
+    cadence: >-
+      2–4 short paragraphs. Hashtags only if
+      `style.fingerprint.hashtag_rules` allows.
+  - id: blog
+    length_default: 600
+    cadence: Inherits `style.fingerprint.paragraph_cadence`.
+  - id: freeform
+    length_default: 250
+    cadence: Inherits `style.fingerprint.paragraph_cadence`.

package/src/config/estate-count-budget.json

@@ -1,38 +1,59 @@
 {
-  "_comment": "Roadmap-estate ratchet (road-to-estate-drawdown T2 + T3). POLICY ONLY \u2014 this file no longer stores a number. Until ADR-243 it carried a measured `baseline` object plus a `baseline_history` audit trail (113 entries at removal, last measurement 23/59/60), and that made it the most-conflicted non-generated path in the repository: 7 of 7 CONFLICTING open PRs on 2026-08-21, and 39 of 43 non-merge commits in a 60-day window moving the baseline. `check_estate_count` now MEASURES the floor on the base ref's own tree with the same functions it measures HEAD with, so the 'before' side is still something the change under review cannot rewrite \u2014 it is just no longer something a human has to remember to walk. Two failure classes went with the storage and are now unrepresentable: a baseline left above the truth (spendable headroom, which the gate used to fail on as an un-walked tightening), and a baseline left below it after main archived a roadmap without walking the number, which reddened every branch that merged main. The legitimate-growth path the stored number provided \u2014 a raise carrying a recorded reason \u2014 is replaced by `estate_growth_exempt: <reason>` in the frontmatter of a roadmap the change touches, read from the diff so it cannot be banked. T1's proposed ceilings stay under `target` and are still NOT registered: they are the maintainer's to set.",
-  "schema_version": 2,
-  "registered_at": "2026-08-18",
-  "baseline_removed_at": "2026-08-22",
-  "owner": "maintainer",
-  "review_by": "2027-08-18",
-  "metric": {
-    "basis": "src/scripts/check_estate_count.ts. The live side uses collect() from update_roadmap_progress \u2014 the same parser the dashboard is generated from, imported rather than re-implemented. The floor side runs the SAME functions over a scratch copy of the base ref's agents/roadmaps/, materialised by _lib/base_tree.ts (git ls-tree + git cat-file --batch; `git archive` cannot be used here because .gitattributes carries `/agents export-ignore` and would yield an empty, silently-zero tree). SKILL METRICS (added 2026-08-24): _lib/skill_estate.ts walks src/skills/*/SKILL.md under the SAME root, so the floor side measures the base ref's own skill tree with the same function. That needs a SECOND materialised subtree \u2014 materialiseSubtree takes one prefix \u2014 and the two are independent on purpose: a base ref with no src/skills (an old tag, a shallow clone) drops the skill metrics and leaves the roadmap metrics ratcheting.",
-    "active_roadmaps": "non-draft roadmap candidates at the top level of agents/roadmaps/, as collect() counts them. This is exactly the number the dashboard header prints as 'N open roadmaps'.",
-    "later_roadmaps": "roadmap-shaped *.md files under agents/roadmaps/later/ \u2014 the same is_roadmap_candidate name filter the active side uses, so later/README.md is not counted. Counted from the filesystem because parked roadmaps sit outside collect()'s corpus by design; they are estate all the same, and a drawdown that moved everything into later/ and called the number down would be the burial T1's quality anchor exists to prevent.",
-    "open_blockers": "blockers whose Status does not start with `resolved`, summed over the active and later corpora.",
-    "floor": "the same three metrics measured at the base ref (origin/main, else the merge commit's first parent). No base ref resolves -> no floor -> the gate FAILS rather than skipping: a shrink-only gate with no floor passes every possible tree. `--base <ref>` is the explicit escape.",
-    "skill_count": "Maintained src/skills/*/SKILL.md files; `lifecycle: deprecated` EXCLUDED. The exclusion is load-bearing rather than tidy: with deprecated skills counted, deprecating one would create no headroom and the retirement mechanism would be unusable against its own gate. 0 skills carry it today, so the exclusion is a no-op now and a correctness property once a tranche lands. Measured 2026-08-24: 299. Reproduce with `find src/skills -name SKILL.md | wc -l` (299 including any deprecated) or `npx tsx -e \"import {measureSkillEstate} from './src/scripts/_lib/skill_estate.ts'; console.log(measureSkillEstate(process.cwd()))\"` for the split.",
-    "skill_description_tokens": "Exact-BPE tokens (js-tiktoken, cl100k_base, via _lib/token_count.ts gpt_tokens) across those skills' `description:` frontmatter fields ONLY \u2014 not bodies. Measured 2026-08-24: 11,461 over 299 skills (52,983 chars). A SECOND DIMENSION, not a companion figure: a count ratchet alone is gameable by merging four large skills into one file, which lowers the count while the description payload a host must carry stays put. AI council 2/2 (2026-08-24) asked for both in one gate over the roadmap's own recommendation of count-plus-informational-figure. UNRESOLVED rather than approximated: when the tokeniser does not resolve on either side the metric is dropped from the compare with a printed reason, because an exact reading against a proxy one differs by more than the growth this gate is trying to catch.",
-    "skill_metric_rejected_candidates": "Measured before choosing, not argued. (b) catalogue bytes via _lib/skill_catalogue.ts read 0 on a real checkout: readProjectedCatalogue walks .claude/skills, empty in any tree where `task generate-tools` cannot complete (it fails under projection.mode=scoped without the config package) \u2014 a ratchet whose reading depends on whether a generator ran reds for the environment. (d) host-listing slots are the host's decision, not the repository's: a measured install published its own budget event stating it had stripped every description and dropped 402 entries. Neither is reproducible from the repo, so neither can carry a floor."
-  },
-  "growth_allowances": {
-    "_comment": "An exact floor leaves no incidental headroom, so every legitimate increase needs a named path. Two are automatic because existing policy already sanctions the act; the third is the general authorisation.",
-    "active_roadmaps": "+1 per addition carrying `estate_offset_exempt: <reason>` in its own frontmatter (unchanged T3 key). Without this the sanctioned un-offsettable addition would fail the count half with no green path.",
-    "later_roadmaps": "+1 per roadmap moved from the active top level into later/ in the same change. Parking relocates estate rather than creating it. It does NOT cover a later/ file that appears from nowhere, and it is keyed on parking rather than on any offset so that an archive move cannot buy a new later/ file.",
-    "open_blockers": "none. Nothing in the policy sanctions a new blocker, so it takes the claim path or nothing.",
-    "claim": "`estate_growth_exempt: <reason>` added, in this change, to the frontmatter of any roadmap under agents/roadmaps/. Authorises growth in any metric, with the reason printed. Diff-scoped, so a claim left in a file authorises nothing later \u2014 the banking failure a stored baseline had. Deliberately unbounded, which a stored baseline could not afford: there the surplus of an over-raise was inherited by the next change, where nobody could act on it; here the next change's floor IS this change's measurement, so there is no surplus to inherit.",
-    "skill_count": "0 \u2014 no allowance, deliberately. The defect this metric addresses is a corpus that grew +8 in one release (290 at 14.0.0, 291 at 14.9.0 and 14.10.0, 299 at 14.11.0) with nothing objecting. An addition takes the estate_growth_exempt claim path \u2014 a recorded reason read from the diff \u2014 or it fails.",
-    "skill_description_tokens": "0 \u2014 same reasoning. An addition that grows the description payload without adding a file is the gaming path this dimension exists to close, and an allowance would reopen it."
-  },
-  "target": {
-    "_comment": "T1's proposed ceilings, kept as the destination. PROPOSALS, NOT REGISTERED: the roadmap says in as many words that both numbers and the window belong to the maintainer, and no date is pinned in this file. Nothing reads these values \u2014 `one_in_one_out.applies_above_active` is the only threshold the gate evaluates.",
-    "active_roadmaps": 15,
-    "open_blockers": 12,
-    "window": "roughly six weeks from campaign start (drafted; unregistered)"
-  },
-  "one_in_one_out": {
-    "_comment": "T3. `applies_above_active: null` means UNCONDITIONAL. T3 phrases the condition as 'while the active count sits above target', and T1 says the target belongs to the maintainer \u2014 so rather than inventing a ceiling so the condition could be evaluated, null states that no ceiling is registered and the lint therefore applies. Registering a number here is how it gets a threshold; registering one above the live count is how it is turned off.",
-    "applies_above_active": null,
-    "exemption": "estate_offset_exempt: <reason> in the added roadmap's own frontmatter. The key lives in the file rather than in this config for the reason RATCHET_RESET_KEY gives for living inside its baseline JSON: the claim shows up in the diff of the change that makes it."
-  }
+    "_comment": "Roadmap-estate ratchet (road-to-estate-drawdown T2 + T3). POLICY ONLY — this file no longer stores a number. Until ADR-243 it carried a measured `baseline` object plus a `baseline_history` audit trail (113 entries at removal, last measurement 23/59/60), and that made it the most-conflicted non-generated path in the repository: 7 of 7 CONFLICTING open PRs on 2026-08-21, and 39 of 43 non-merge commits in a 60-day window moving the baseline. `check_estate_count` now MEASURES the floor on the base ref's own tree with the same functions it measures HEAD with, so the 'before' side is still something the change under review cannot rewrite — it is just no longer something a human has to remember to walk. Two failure classes went with the storage and are now unrepresentable: a baseline left above the truth (spendable headroom, which the gate used to fail on as an un-walked tightening), and a baseline left below it after main archived a roadmap without walking the number, which reddened every branch that merged main. The legitimate-growth path the stored number provided — a raise carrying a recorded reason — is replaced by `estate_growth_exempt: <reason>` in the frontmatter of a roadmap the change touches, read from the diff so it cannot be banked. T1's proposed ceilings stay under `target` and are still NOT registered: they are the maintainer's to set.",
+    "schema_version": 2,
+    "registered_at": "2026-08-18",
+    "baseline_removed_at": "2026-08-22",
+    "owner": "maintainer",
+    "review_by": "2027-08-18",
+    "metric": {
+        "basis": "src/scripts/check_estate_count.ts. The live side uses collect() from update_roadmap_progress — the same parser the dashboard is generated from, imported rather than re-implemented. The floor side runs the SAME functions over a scratch copy of the base ref's agents/roadmaps/, materialised by _lib/base_tree.ts (git ls-tree + git cat-file --batch; `git archive` cannot be used here because .gitattributes carries `/agents export-ignore` and would yield an empty, silently-zero tree). SKILL METRICS (added 2026-08-24): _lib/skill_estate.ts walks src/skills/*/SKILL.md under the SAME root, so the floor side measures the base ref's own skill tree with the same function. That needs a SECOND materialised subtree — materialiseSubtree takes one prefix — and the two are independent on purpose: a base ref with no src/skills (an old tag, a shallow clone) drops the skill metrics and leaves the roadmap metrics ratcheting.",
+        "active_roadmaps": "roadmap candidates at the top level of agents/roadmaps/ that are not drafts, as collect() counts them, PLUS the ones collect() drops for declaring status: carrier. NO LONGER EQUAL TO THE DASHBOARD HEADER'S 'N open roadmaps', and the divergence is deliberate: with carriers excluded, flipping one roadmap's frontmatter to status: carrier measured active_roadmaps 3 -> 2 with the gate printing 'estate within its ratchet', because a count below the floor is a drawdown and free. The floor is measured at the base ref, so that flip lowers the next change's floor permanently, the file cannot be flipped back without paying, and any roadmap can be laundered out of the count by adding one word. A reclassification is not a disposal, so the metric counts the file on both sides and a flip changes nothing. Same reasoning later_roadmaps and open_blockers already carry: estate all the same, and a number that falls on a relocation prints free tightening over a burial. Both directions hold - deleting a carrier is still a shrink that earns no offset (classifyDiff), and adding one is growth that takes the estate_growth_exempt claim path like any other new roadmap. Drafts stay excluded on both sides, unchanged.",
+        "later_roadmaps": "roadmap-shaped *.md files under agents/roadmaps/later/ — the same is_roadmap_candidate name filter the active side uses, so later/README.md is not counted. Counted from the filesystem because parked roadmaps sit outside collect()'s corpus by design; they are estate all the same, and a drawdown that moved everything into later/ and called the number down would be the burial T1's quality anchor exists to prevent.",
+        "open_blockers": "blockers whose Status does not start with `resolved`, summed over the active and later corpora.",
+        "floor": "the same three metrics measured at the base ref (origin/main, else the merge commit's first parent). No base ref resolves -> no floor -> the gate FAILS rather than skipping: a shrink-only gate with no floor passes every possible tree. `--base <ref>` is the explicit escape.",
+        "skill_count": "Maintained src/skills/*/SKILL.md files; `lifecycle: deprecated` EXCLUDED. The exclusion is load-bearing rather than tidy: with deprecated skills counted, deprecating one would create no headroom and the retirement mechanism would be unusable against its own gate. 0 skills carry it today, so the exclusion is a no-op now and a correctness property once a tranche lands. Measured 2026-08-24: 299. Reproduce with `find src/skills -name SKILL.md | wc -l` (299 including any deprecated) or `npx tsx -e \"import {measureSkillEstate} from './src/scripts/_lib/skill_estate.ts'; console.log(measureSkillEstate(process.cwd()))\"` for the split.",
+        "skill_description_tokens": "Exact-BPE tokens (js-tiktoken, cl100k_base, via _lib/token_count.ts gpt_tokens) across those skills' `description:` frontmatter fields ONLY — not bodies. Measured 2026-08-24: 11,461 over 299 skills (52,983 chars). A SECOND DIMENSION, not a companion figure: a count ratchet alone is gameable by merging four large skills into one file, which lowers the count while the description payload a host must carry stays put. AI council 2/2 (2026-08-24) asked for both in one gate over the roadmap's own recommendation of count-plus-informational-figure. UNRESOLVED rather than approximated: when the tokeniser does not resolve on either side the metric is dropped from the compare with a printed reason, because an exact reading against a proxy one differs by more than the growth this gate is trying to catch.",
+        "skill_metric_rejected_candidates": "Measured before choosing, not argued. (b) catalogue bytes via _lib/skill_catalogue.ts read 0 on a real checkout: readProjectedCatalogue walks .claude/skills, empty in any tree where `task generate-tools` cannot complete (it fails under projection.mode=scoped without the config package) — a ratchet whose reading depends on whether a generator ran reds for the environment. (d) host-listing slots are the host's decision, not the repository's: a measured install published its own budget event stating it had stripped every description and dropped 402 entries. Neither is reproducible from the repo, so neither can carry a floor.",
+        "concern_count": "Hook concerns declared under the `concerns:` map in src/scripts/hook_manifest.yaml. Measured 2026-08-30: 55. Reproduce with `npx tsx -e \"import {countConcerns} from './src/scripts/_lib/concern_estate.ts';import fs from 'node:fs';console.log(countConcerns(fs.readFileSync('src/scripts/hook_manifest.yaml','utf-8')))\"`. THE ORIGINATING ROADMAP'S REPRODUCE COMMAND IS A PROXY AND OVER-COUNTS, and the correction is recorded here rather than only in the roadmap because this file is what a later reader checks the number against. `grep -cE '^  [a-z][a-z0-9_-]*:$'` greps the WHOLE manifest, so it also counts members of `roles:`, `platforms:` and `native_event_aliases:`, which sit at the same two-space indent. Re-measured at the roadmap's own six pins the over-count is EXACTLY 16 every time: 63/65/65/68/69/71 by the grep is 47/49/49/52/53/55 scoped. Both consequences, because they point in opposite directions -- the FINDING survives untouched (the delta is constant, so the axis climbs +8 either way and is growing exactly as the roadmap says), and the ABSOLUTE FIGURE does not (the axis stands at 55, and a floor of 71 is one this gate's own parser could never reproduce, i.e. a gate that fails on its first honest run). REJECTED CANDIDATES, measured rather than argued: counting `platforms:` rows instead -- rejected, it is 8 and flat across all six pins, so it measures host coverage and not concern growth; counting the per-(platform,event) cap in lint_hook_concern_budget.ts -- rejected, DEFAULT_MAX_PER_EVENT=8 is blind to total growth by construction (eight new concerns spread across eight events violate nothing) and it ships DEFAULT_HARD_FAIL=false, which is why this axis needed a ratchet at all."
+    },
+    "growth_allowances": {
+        "_comment": "An exact floor leaves no incidental headroom, so every legitimate increase needs a named path. Two are automatic because existing policy already sanctions the act; the third is the general authorisation.",
+        "active_roadmaps": "+1 per addition carrying `estate_offset_exempt: <reason>` in its own frontmatter (unchanged T3 key). Without this the sanctioned un-offsettable addition would fail the count half with no green path.",
+        "later_roadmaps": "+1 per roadmap moved from the active top level into later/ in the same change. Parking relocates estate rather than creating it. It does NOT cover a later/ file that appears from nowhere, and it is keyed on parking rather than on any offset so that an archive move cannot buy a new later/ file.",
+        "open_blockers": "none. Nothing in the policy sanctions a new blocker, so it takes the claim path or nothing.",
+        "claim": "`estate_growth_exempt: <reason>` added, in this change, to the frontmatter of any roadmap under agents/roadmaps/. Authorises growth in any metric, with the reason printed. Diff-scoped, so a claim left in a file authorises nothing later — the banking failure a stored baseline had. Deliberately unbounded, which a stored baseline could not afford: there the surplus of an over-raise was inherited by the next change, where nobody could act on it; here the next change's floor IS this change's measurement, so there is no surplus to inherit.",
+        "skill_count": "0 — no allowance, deliberately. The defect this metric addresses is a corpus that grew +8 in one release (290 at 14.0.0, 291 at 14.9.0 and 14.10.0, 299 at 14.11.0) with nothing objecting. An addition takes the estate_growth_exempt claim path — a recorded reason read from the diff — or it fails.",
+        "skill_description_tokens": "0 — same reasoning. An addition that grows the description payload without adding a file is the gaming path this dimension exists to close, and an allowance would reopen it.",
+        "concern_count": "0 — no allowance, deliberately, and the same reason skill_count gives. An allowance reopens the gaming path the dimension exists to close. Sharper here than for skills: eight concerns spread across eight events violate the existing per-event cap zero times, which is precisely why a total-growth ratchet was needed and precisely why it must not carry a per-change freebie. An addition takes the estate_growth_exempt claim path — a recorded reason read from the diff — or it fails."
+    },
+    "target": {
+        "_comment": "T1's proposed ceilings, kept as the destination. PROPOSALS, NOT REGISTERED: the roadmap says in as many words that both numbers and the window belong to the maintainer, and no date is pinned in this file. Nothing reads these values — `one_in_one_out.applies_above_active` is the only threshold the gate evaluates.",
+        "active_roadmaps": 15,
+        "open_blockers": 12,
+        "window": "roughly six weeks from campaign start (drafted; unregistered)"
+    },
+    "one_in_one_out": {
+        "_comment": "T3. `applies_above_active: null` means UNCONDITIONAL. T3 phrases the condition as 'while the active count sits above target', and T1 says the target belongs to the maintainer — so rather than inventing a ceiling so the condition could be evaluated, null states that no ceiling is registered and the lint therefore applies. Registering a number here is how it gets a threshold; registering one above the live count is how it is turned off.",
+        "applies_above_active": null,
+        "exemption": "estate_offset_exempt: <reason> in the added roadmap's own frontmatter. The key lives in the file rather than in this config for the reason RATCHET_RESET_KEY gives for living inside its baseline JSON: the claim shows up in the diff of the change that makes it."
+    },
+    "provisional_promotion": {
+        "_comment": "Phase 3.1 + 3.2 of road-to-blocked-quickwin-visibility: the mechanically capped provisional-promotion path the 2026-08-24 estate council named as the alternative TO loosening its five-condition rule — SPECIFIED IN FULL HERE AND DECLINED. The five conditions are answered one sentence each under `five_conditions`; the declination and its reasoning are the four `declined_*` fields; the fallback that now governs each future occurrence is `fallback`. READ THE NULLS HERE THE OTHER WAY ROUND FROM THE SIBLING KEY: `one_in_one_out.applies_above_active: null` means UNCONDITIONAL — no ceiling is registered, so that lint applies to everything — while `max_live: null` and `expires_after_days: null` HERE mean NOT REGISTERED, PATH INACTIVE. The two nulls sit a few lines apart in one file and mean opposite things, so a reader who transfers the sibling's semantics reads a declined path as an uncapped one, which is the exact inversion of what this object records. `check_estate_count` reads this object and distinguishes THREE states so that an intentional declination can never be mistaken for a config nobody wrote: `declined` (specified, refused, inactive), absent (misconfiguration — a could-not-run, never a pass, same shape as the missing-`one_in_one_out` throw), and `registered` (both integers present, which is the owner's act and nobody else's). Half-registered — one integer, one null — throws rather than guessing which half was meant. READING IS NOT ACTIVATION: the gate grants no allowance in any of the three states, and wiring an allowance for the `registered` state is a separate change that needs the owner's authorization rather than this one; a gate that started granting headroom the moment someone typed a number would be the self-certification the 2026-08-24 verdict refused, arriving one commit later.",
+        "status": "declined",
+        "declined_on": "2026-09-01",
+        "declined_by": "AI council (drain run 15), 2/2 convergent — anthropic/claude-sonnet-4-5 + openai/codex-default, 2 rounds, depth deep, peer-review, blind chairman, quorum 2/2 present (needed 1), subscription transport, billable=0, $0.0000. The verdict was endorsed by the blind chairman as the anchor reasoning of the session.",
+        "declined_reason": "Registering either integer — including the `max_live: 1` bounded-trial variant — constitutes governance self-amendment: it extends the agent's own write authority over a recorded estate floor, and `decision-revisit-gate` expressly reserves that class to the owner and states that no delegation overrides it. `max_live: 1` limits magnitude, not the legal character of the authority change, so the bounded trial is the same act at a smaller scale rather than a smaller act. The strongest counter-argument, recorded because it is real: the owner's standing instruction for the run was unusually broad and could be read as the owner personally choosing the council as decision-maker for this question. That general language nevertheless loses to the narrower rule expressly covering delegation and self-amendment, which is why the decline is convergent rather than split.",
+        "fallback": "Each future occurrence of the deadlock falsifier remains blocked until explicit owner authorization for THAT occurrence. This is the behaviour that already obtained, now recorded as a decision rather than left as a gap: `stubs:due` reports the blocked quick-win in its own bucket and `releases_since_blocked` counts the condition against published releases, so the next occurrence is detected by a query rather than by a reviewer noticing for the ninth time — and neither surface promotes anything on its own.",
+        "five_conditions": {
+            "1_authorizing_rule": "An existing repository-authorized rule explicitly permits autonomous exemption — this key is that rule and the repository holds no other, so registering `max_live` and `expires_after_days` here as integers is the single act that would create the permission, which is precisely why a specification shipping with its own numbers filled in would be the self-certification the 2026-08-24 verdict refused.",
+            "2_objective_criteria": "That rule supplies objective eligibility criteria — the three blocked-quick-win frontmatter scalars `stubs:due` already reads (`design_validated` non-empty, `capability_gap: none`, `blocker_class: estate` or `budget`) plus a defect measurable in at least two released artefacts, every one of them a field or a count rather than a judgement.",
+            "3_repository_evidence": "Repository evidence proves those criteria satisfied — `agent-config stubs:due --json` computes all three scalars from frontmatter rather than from body prose, so a claim appears in a diff and is reviewable, and `releases_since_blocked` counts published releases across both CHANGELOG eras, so the release criterion is measured against artefacts outside the promoting branch and cannot be self-asserted by the diff that claims it.",
+            "4_mechanical_cap": "The exemption is mechanically capped or expiring — `max_live` bounds how many provisional promotions may be live at once and `expires_after_days` reverts an unmerged one to `agents/roadmaps/stubs/`, both read by `check_estate_count` from this file rather than enforced by anyone remembering.",
+            "5_no_priority_choice": "Applying it requires no choice among competing roadmap priorities — a provisional promotion offsets nothing, so no active roadmap is retired in exchange and the pick that both 2026-08-24 council seats refused to invent, because no mechanical evidence identifies the least valuable active roadmap, never arises."
+        },
+        "max_live": null,
+        "expires_after_days": null,
+        "owner": "maintainer",
+        "review_by": "2027-09-01"
+    }
 }