@event4u/agent-config 14.12.0 → 14.14.0

package/dist/agent-src/skills/ui-component-architect/SKILL.md

@@ -123,8 +123,51 @@ Prop budget per component:
 | Composite (Card, Dialog) | ≤ 8 props; prefer slots for variants |
 | Page section / feature shell | ≤ 4 props; everything else via context |
 
-Over-budget triggers a refactor: extract a config object, push
-state into context, or split into compound parts.
+Over-budget is a **prompt to look**, not a verdict. Extract a config object,
+push state into context, or split into compound parts — **or record why the
+count is right for this component.**
+
+```
+THE CAPS ABOVE ARE ADVISORY. THEY ARE NOT A GATE AND MUST NOT BECOME ONE
+WITHOUT A NEW MEASUREMENT. NOTHING COMPUTES THE TIER, SO NOTHING CAN APPLY THEM
+AUTOMATICALLY EVEN IF IT WANTED TO.
+```
+
+**Why advisory, measured rather than asserted** (2026-08-24, one production
+component library: 55 atoms, 3 molecules, 2 organisms):
+
+| component | its level | props | cap here | over |
+|---|---|---:|---:|---:|
+| `file-upload` | **atom** | 19 | 6 | **3.2×** |
+| `date-navigator` | molecule | 18 | 8 | 2.25× |
+| `picker-sheet` | organism | 14 | 4 | **3.5×** |
+| `duration-input` | molecule | 13 | 8 | 1.6× |
+| `stepper` | molecule | 4 | 8 | — |
+
+**The budget is INVERTED, and that is the finding rather than a calibration
+error.** This table tightens as granularity rises. Reality goes the other way:
+a higher-level component legitimately surfaces every label, callback and test id
+of the pattern it orchestrates, so a cap that shrinks with tier flags the
+components that are **correctly built** and clears the one that is 3.2× over.
+
+**And for most components the number does not exist.** Between **45 % and 72 %**
+of that library declares no root prop interface at all, depending on how you
+count — `React.ComponentProps<'div'> & VariantProps<cva>` is the dominant idiom.
+A cap over an uncountable quantity is not a lenient rule; it is no rule.
+
+**The tier itself is not computable.** Composition depth, state, sub-component
+count and prop count were each tested as a discriminator between the three
+levels. **Every one overlapped completely, and several inverted.** Sub-component
+count is the tempting replacement and fails the same way: `atoms/combobox`
+exports **16**, more than every molecule (1, 1, 2) and more than one of the two
+organisms. So there is no measurement that could assign the tier a cap would be
+applied to.
+
+**Revisit-if:** a corpus of levelled libraries — plural, and not four days old —
+yields a discriminator that separates the tiers without overlap, at which point
+the caps can be re-derived against it rather than restated. Until then these
+numbers are a conversation starter for a human reviewer, which is the only role
+the evidence supports.
 
 ### 5. Name the slot contract
 

package/dist/agent-src/skills/upstream-contribute/SKILL.md

@@ -9,7 +9,7 @@ scope:
 execution:
   type: assisted
   handler: internal
-  allowed_tools: ["github"]
+  allowed_tools: ["Bash(gh:*)"]
 workspaces:
   - agent-config-maintainer
 packs:
@@ -49,6 +49,43 @@ shared `agent-config` package — with correct file placement, quality gates, an
 - **Quality verified** — must pass linter before PR creation
 - **Local benefit immediately** — use override for instant project benefit while PR is pending
 
+## A repeated override is a signal, and a signal is not evidence
+
+```
+THE SAME ARTIFACT OVERRIDDEN IN INDEPENDENT INSTALLS IS THE CHEAPEST AVAILABLE
+HINT THAT A SHIPPED DEFAULT IS WRONG. IT IS A HINT.
+NEVER CHANGE A SHIPPED DEFAULT ON OVERRIDES FROM ONE ORGANISATION.
+INDEPENDENT MEANS DIFFERENT TEAMS, NOT DIFFERENT DIRECTORIES.
+```
+
+`agent-config doctor --check override-set` reports which shipped artifacts a
+tree overrides and in how many layers. Two same-culture installs overriding the
+same artifact is **n=2 from one toolchain culture**, which is a discovery
+channel and not a mandate — and the temptation to "just fix the default, we
+already know" is exactly how a general package becomes one organisation's house
+style.
+
+**What makes an aggregate admissible**, matching the *Evidence-based* and
+*Universality first* principles above:
+
+- overrides from **independently operated** consumers, not several repositories
+  of one team;
+- the overriding change **converging on the same substance**, not merely
+  touching the same filename — two teams deleting different halves of a rule
+  are not agreeing about anything;
+- a **named public mechanism** that explains why the shipped default is wrong,
+  rather than "several people changed it".
+
+Below that bar, the signal is one input to a future aggregate and nothing more.
+Record it and leave the default alone.
+
+**The signal carries no consumer content, by construction.** Artifact kind, name
+and a layer count — the type has no field that can hold a path, a diff or
+anything from the tree, so privacy is the schema's shape rather than a scrubbing
+pass that could fail. Never widen it to make a proposal more persuasive; a
+proposal that needs the consumer's diff is a proposal that has not cleared the
+bar.
+
 ## Package repository
 
 The shared agent-config package lives at:

package/dist/agent-src/skills/verify-repair-loop/SKILL.md

@@ -15,7 +15,8 @@ packs:
 > **executed verdict** — the project's real test/quality output, scored against a
 > numeric threshold — escalated to a **judge** for qualitative confirmation only
 > *after* the numeric gate passes (staged escalation). The loop is the
-> conversation, not a process: no daemon, no persistent cross-session state. Use
+> conversation, not a process: this loop introduces no resident process of its
+> own and no persistent cross-session state. Use
 > it to drive a change to green when the verdict source is *runtime execution*,
 > not a judge reading a diff.
 
@@ -126,7 +127,7 @@ iterating against a stale contract.
 
 State lives in the conversation, optionally mirrored to a re-read working file —
 **never** a daemon or persistent cross-session store (honors
-[`no-runtime-boundary`](../../../docs/contracts/no-runtime-boundary.md)).
+[`resident-process-governance`](../../../docs/contracts/resident-process-governance.md)).
 
 ## Validation
 
@@ -137,7 +138,11 @@ Before finalizing, confirm:
 3. The loop stopped at `max_attempts`, a plateau, or a judge `apply` — never
    ran unbounded.
 4. The judge saw only the diff + results, dispatched in fresh context.
-5. No daemon / persistent runtime introduced.
+5. No **unsupervised** resident process introduced — and none of the four
+   governance conditions in `resident-process-governance.md` left unmet if a
+   supervised one is. (Amended 2026-08-27, ADR-249: this read "No daemon /
+   persistent runtime introduced" when a daemon was prohibited outright. The
+   check still fires; what it tests moved from existence to governance.)
 
 ## Output format
 
@@ -211,7 +216,7 @@ iter2 fixes A, breaks B, 92% → "PASS"      ✗ regression ignored
 * [`playwright-testing`](../playwright-testing/SKILL.md),
   [`quality-tools`](../quality-tools/SKILL.md) — verdict sources.
 * [`autonomous-execution`](../../rules/autonomous-execution.md) — the N=3 cap.
-* [`no-runtime-boundary`](../../../docs/contracts/no-runtime-boundary.md) — the
+* [`resident-process-governance`](../../../docs/contracts/resident-process-governance.md) — the
   runtime-free constraint this loop honors.
 * Optional impact pre-step (when a code-graph is present, ADR-124): run
   `agent-config code-graph affected --since <ref>` to scope which symbols a

package/dist/agent-src/templates/agents/agent-project-settings.example.yml

@@ -39,7 +39,7 @@ schema_version: 1
 # CI guard: a release bump of `package.json` must update this value
 # in lockstep — see scripts/check_template_pin_drift.ts (road-to-
 # portable-runtime-and-update-check P3.3).
-agent_config_version: "14.12.0"
+agent_config_version: "14.14.0"
 
 # --- Project identity ---
 project:

package/dist/agent-src/templates/roadmaps.md

@@ -78,6 +78,53 @@ that was never a judgement call.
     `horizon_weeks` to a positive integer. Enforced by
     `task lint-roadmap-complexity` (plate-token detection skipped when
     `horizon_weeks > 0`).
+17b. **A carried deferral is annotated, or it blocks archival forever.**
+    `archive_completed_roadmaps` used to refuse any roadmap with
+    `count_deferred > 0` unconditionally. Three of the four council-decidable
+    dispositions in the preservation test — carry to a follow-up, merge into
+    existing work, restore to open — leave the `[~]` glyph in place, so a
+    genuinely UNEXECUTABLE item (one needing elapsed time rather than effort)
+    had no council-reachable path to an archived roadmap. The only glyph that
+    cleared the gate was `[-]`, which is owner-reserved AND pinned to "won't
+    happen at all"; using it for a carried item makes cancellation and transfer
+    indistinguishable to every later reader.
+    Since 2026-08-27 (AI council, 2 seats, convergent) a `[~]` step may carry
+    a machine-readable resolution, inside the step's own block:
+    ```markdown
+    - [~] **4.2 Measure the false-positive rate.**
+          <!-- deferred-resolution: carried-to=road-to-some-followup -->
+    ```
+    `merged-into=<slug>` is the second accepted form, for a merge into
+    pre-existing work rather than a new follow-up. `[-]` stays cancellation-only.
+    **Validation fails closed at every step** — a bare `[~]`, a malformed
+    annotation, a destination that does not exist, a destination in `archive/`
+    or `skipped/`, and (for `carried-to`) a destination with no
+    `parent_roadmap: <source-slug>` back-link each refuse the archive and print
+    which door closed. `merged-into` needs no back-link but the destination must
+    still mention the source slug. An annotation is cheap to write, so it is
+    made expensive to satisfy.
+    Three further doors, each found by an independent review of the first
+    version rather than designed in: the destination may not be the **source
+    itself** (it passes every other check and then dies with it); it may not be
+    a roadmap **this same sweep will archive** (both complete in one run leaves
+    the carried item with no receiver — the loss the annotation exists to
+    prevent, produced by the mechanism); and `merged-into` needs a
+    **structured** link — a `relates:` row or a `parent_roadmap:` line — because
+    a substring match on the source slug is satisfied by a filename, an example
+    or a comment. The back-link slug is regex-escaped: interpolated raw, a slug
+    like `road.parent` matched `roadXparent` and one containing `[` threw and
+    aborted the sweep.
+    **Not checked, and stated rather than implied:** that the destination's copy
+    of the criterion is faithful. Both council seats asked for stable item
+    identity over verbatim text matching, and neither exists today — the
+    back-link plus the source mention is the strongest link the sweep can verify
+    without inventing an identity scheme, and the human reviewing the carry is
+    still the one reading it.
+    Eligibility differs from representation: an item that is merely
+    **unfinished** (needs effort nobody spent) stays `[ ]`. Carrying it would be
+    scope laundering. Only an item that **cannot** be executed now qualifies.
+    Contract: `agents/roadmaps/*` · `src/agent-src/scripts/archive_completed_roadmaps.ts`
+    § `deferralProblems` · `tests/scripts/archive_deferral_resolution.test.ts`.
 17. **Follow-up roadmaps from deferred items carry `parent_roadmap`.**
     When a roadmap closes with `[~]` deferred items, the
     [`roadmap-management`](../skills/roadmap-management/SKILL.md) skill
@@ -193,7 +240,7 @@ that was never a judgement call.
     gap-table ritual. When it fires:
     - **(a) Gap-table before drafting.** Audit each proposed item against
       the existing skill / command / rule surface and keep only verified
-      gaps — `KEEP` (genuine gap) / `FOLD` (into an existing artefact) /
+      gaps — `KEEP` (genuine gap) / `FOLD` (into an existing artifact) /
       `CUT` (already covered). The plan integrates, it does not dump.
     - **(b) `## Provenance` block** — source named by a **neutral
       descriptor** (never the raw competitor / tool name, per
@@ -467,6 +514,46 @@ that was never a judgement call.
     Register: the register ranks *known* risks with mitigations; the
     pre-mortem imagines the *whole plan dead* and reconstructs why.
 
+26. **A consolidating roadmap declares its parent set in `consolidates:`.**
+    When a roadmap claims to fold sibling proposals into one — a "master",
+    a consolidation, a document that supersedes others — it declares every
+    parent as a frontmatter list:
+
+    ```yaml
+    consolidates:
+      - road-to-first-parent.md
+      - road-to-second-parent.md
+    ```
+
+    The field is the *only* spelling a tracked roadmap may use. Five
+    legacy spellings exist in inbox artifacts and are read by
+    `lint_consolidation_lineage` so a legacy folder parses to the same
+    parent set rather than to an empty one — `supersedes_analysis:`, a
+    prose `**Inputs consolidated:**` list, a prose `**Ersetzt als
+    führendes Proposal:**` list, a `Master-Konsolidierung` heading with a
+    table, and a prose supersession sentence. They are **deprecated
+    spellings a reader may still encounter**, never shapes to author.
+
+    Why the field rather than prose: a consolidation presents its content
+    as adjudicated — parents named, conflicts resolved, a kill register
+    for what was rejected. A parent missing from that list is not
+    *killed*, it is *undiscussed*, and nothing in the artifact
+    distinguishes those two states. Measured
+    (`agents/evidence/analysis/consolidation-lineage-census-2026-08-26.md`):
+    four inbox folders carrying a declared consolidation, four with an
+    incomplete lineage.
+
+    An omission is discharged in exactly one of three ways, never by
+    silence: fold the parent in · record a kill ID for it · state that it
+    was read and adds nothing. `/analyze:inbox` carries the obligation at
+    the point the artifacts are produced.
+
+    Reported by `lint_consolidation_lineage` — report-mode, not blocking
+    (council 2026-08-27, 2/2 convergent: the four measured cases come from
+    a high-noise drafting context and do not establish precision on the
+    tracked estate; blocking is earned by tracked-scope evidence, not
+    assumed).
+
 ---
 
 ## Quality Gates (remote CI by default)
@@ -587,8 +674,15 @@ complexity: lightweight
 <!-- ## Provenance — INCLUDE ONLY for source-derived / harvest / capability-adoption
      roadmaps (rule 19). OMIT entirely for internally-originated roadmaps —
      do NOT ship an empty Provenance section.
-- Source: <neutral descriptor> (anonymized per source-confidentiality);
-  link via `src/scripts/_lib/link_crypto.ts decrypt`: ENC1:<token>
+- Source: `agents/tmp.old/<opaque-round-id>/` — an OPAQUE round identifier
+  (`inbox-2026-08-h`, `round-a91f3c`, `S17`), never a speaking directory name.
+  The `source-header` and `tmp-quote` shape classes BLOCK inside `agents/**`, so
+  a speaking value fails CI. Naming rule: `/analyze:inbox` Phase 1.
+- Source class, if it needs saying: <neutral descriptor> (anonymized per
+  source-confidentiality) — describe the KIND, never the identity.
+- Identity: recorded once, encrypted, in the round's intake note; the codename
+  map is `agents/evidence/reports/source-codename-map.md`. Decrypt via
+  `src/scripts/_lib/link_crypto.ts decrypt`: ENC1:<token>
 - Council: <members>, <date>, <depth>; convergence inlined above. -->
 ```
 

package/dist/agent-src/templates/scripts/check_memory.ts

@@ -1,17 +1,36 @@
 #!/usr/bin/env tsx
+/*
+ * TEMPLATE COPY — reconciled with `src/scripts/check_memory.ts` on 2026-08-26
+ * (`road-to-memory-twin-reconciliation` 2.2, verdict `dev-side-correct`).
+ *
+ * TWO differences remain, and both are `keep-duplicated` for the same
+ * STRUCTURAL reason rather than by preference: the installed consumer tree has
+ * no `scripts/_lib/`, so a template script may import node built-ins, `yaml`
+ * and its own installed siblings — nothing else.
+ *
+ *   - `assertScanned` (`_lib/scan_scope.js`), the dead-scope guard. Not
+ *     importable here, and its absence is safe in the direction that matters:
+ *     a consumer with no `agents/memory/` scans zero and passes, which is the
+ *     correct reading for a project that keeps no memory.
+ *   - `asOf` (`_lib/as_of.js`), the reproducible-clock pin behind this
+ *     repository's own `AC_AS_OF` discipline. A consumer has no such pin, so
+ *     `new Date()` is the right substitute rather than a downgrade.
+ *
+ * Everything else is identical, INCLUDING the validations this copy used to
+ * lack entirely: the `priority` enum, the critical-stale SLA, the one-fact
+ * length limit, relative-date discipline, per-type caps, tier-0 inflation, and
+ * `status: superseded`.
+ */
 /**
  * Engineering Memory validator.
  *
- * TypeScript twin of `src/agent-src/templates/scripts/check_memory.py`
- * (ADR-200, Phase 1 — consumer-shipped template). Adapted from the dev-side
- * `src/scripts/check_memory.ts` twin: the template `.py` is the leaner
- * consumer surface — it has NO `--shadow-report`, NO `priority`/date-discipline/
- * critical-stale/tier-0-inflation checks. Those are stripped here so this twin
- * matches the template `.py` exactly. The CLI contract mirrors the Python
- * original EXACTLY — same flags (`--path`, `--format`, `--append-only`,
- * `--base`), same exit codes, same stdout/stderr split, byte-identical finding
- * messages, same scan scope and ordering. No behaviour changes — latent bugs
- * are replicated and flagged in the porting report, not fixed.
+ * Ported from the retired Python `src/scripts/check_memory.py` (ADR-200, Phase 4 /
+ * Wave 4a). The CLI contract pins the historical contract exactly — same
+ * flags (`--path`, `--format`, `--append-only`, `--base`), same exit
+ * codes, same stdout/stderr split,
+ * byte-identical finding messages, same scan scope and ordering. No
+ * behaviour changes — latent bugs are replicated and flagged in the
+ * porting report, not fixed.
  *
  * Validates YAML files under `agents/memory/<type>/**\/*.yml` against the
  * schema documented in `guidelines/agent-infra/engineering-memory-data-format`.
@@ -39,7 +58,7 @@
  *     check_memory --append-only       # CI: diff vs origin/main
  *     check_memory --append-only --base HEAD~1
  *
- * Note on YAML date typing: the Python original relies on PyYAML's
+ * Note on YAML date typing: the retired Python implementation relies on PyYAML's
  * `safe_load` converting unquoted `YYYY-MM-DD` scalars to `datetime.date`
  * (and `YYYY-MM-DD HH:MM:SS` to `datetime.datetime`). The `yaml` npm
  * package parses every scalar to a string, so this twin re-implements
@@ -56,6 +75,7 @@ import process from 'node:process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import YAML, { parseDocument } from 'yaml';
 
+
 type Severity = 'error' | 'warning' | 'info';
 
 const REQUIRED_KEYS: ReadonlySet<string> = new Set([
@@ -67,14 +87,48 @@ const REQUIRED_KEYS: ReadonlySet<string> = new Set([
     'last_validated',
     'review_after_days',
 ]);
-const VALID_STATUS: ReadonlySet<string> = new Set(['active', 'deprecated', 'archived']);
+const VALID_STATUS: ReadonlySet<string> = new Set(['active', 'deprecated', 'archived', 'superseded']);
 const VALID_CONFIDENCE: ReadonlySet<string> = new Set(['low', 'medium', 'high']);
+// `priority` is optional (default `normal`); enum is the smallest set that
+// solves the tier-0 surfacing use case. See the Phase 2 council brief for why
+// the `high` tier was rejected.
+const VALID_PRIORITY: ReadonlySet<string> = new Set(['critical', 'normal', 'low']);
+// Soft-cap on `priority: critical` entries per memory type. Tier-0 inflation
+// is the failure mode: when too many entries claim "always surface", the
+// slice loses signal. Warn (not fail) when the cap is exceeded so curators
+// notice without being blocked.
+const CRITICAL_WARN_THRESHOLD = 10;
+// Stale-critical guard: a `priority: critical` entry that hasn't been
+// re-validated in this many days emits a warning. Surfaced separately
+// from the generic `stale:` info so reviewers see it before merge.
+const CRITICAL_STALE_DAYS = 90;
 const KNOWN_TYPES: ReadonlySet<string> = new Set([
     'domain-invariants',
+    'historical-patterns',
     'incident-learnings',
+    'ownership',
     'product-rules',
 ]);
 
+// Per-type soft entry cap (size-bounding without a decay engine). Over-cap →
+// warning, never a hard fail: the right answer to bloat is a consolidation pass
+// (prune archived, merge duplicates), not CI failure. See
+// road-to-memory-pipeline-consolidation.md Phase 7.
+const PER_TYPE_CAPS: Readonly<Record<string, number>> = {
+    ownership: 50,
+    'domain-invariants': 150,
+    'product-rules': 100,
+    'incident-learnings': 150,
+    'historical-patterns': 150,
+};
+const DEFAULT_TYPE_CAP = 150;
+// One-durable-fact-per-entry: a content field longer than this reads as a
+// transcript / narrative blob, not a single durable fact → warning.
+const ONE_FACT_MAX_CHARS = 600;
+const ONE_FACT_FIELDS = ['rule', 'pattern', 'statement', 'observation', 'body', 'decision', 'note'] as const;
+// Per-type entry tally, populated during validation, consumed by main().
+const _TYPE_COUNTS: Record<string, number> = {};
+
 // Redaction heuristics — plain-regex, deliberately conservative.
 // False positives are fixed by quoting the line differently; false
 // negatives are a curator responsibility.
@@ -90,6 +144,15 @@ const REDACTION_PATTERNS: ReadonlyArray<readonly [RegExp, string]> = [
     [/\b192\.168\.\d{1,3}\.\d{1,3}\b/, 'internal ipv4 range'],
 ];
 
+// Date-discipline — relative-date phrases without an ISO YYYY-MM-DD anchor
+// within ±20 chars are rejected. Memory entries that say "yesterday" or
+// "last week" rot the moment the file is re-read on another day; the
+// anchor pins meaning.
+const RELATIVE_DATE_PATTERN =
+    /\b(yesterday|today|tomorrow|last\s+(?:week|month|year)|next\s+(?:week|month|year)|this\s+(?:week|month|year))\b/gi;
+const ISO_DATE_PATTERN = /\b\d{4}-\d{2}-\d{2}\b/;
+const DATE_ANCHOR_WINDOW = 20;
+
 // PyYAML timestamp implicit-resolver. A *plain* (unquoted) scalar matching
 // this is constructed as datetime.date / datetime.datetime — both pass
 // `isinstance(value, datetime.date)`. Source: yaml/resolver.py.
@@ -246,6 +309,15 @@ function _isInteger(v: unknown): v is number {
     return typeof v === 'number' && Number.isInteger(v);
 }
 
+/** Mirror Python len(str) — code-point count, not UTF-16 unit count. */
+function _pyLen(s: string): number {
+    let n = 0;
+    for (const _ of s) {
+        n += 1;
+    }
+    return n;
+}
+
 function _memoryType(p: string): string {
     // Supports `memory/<type>.yml`, `memory/<type>/<hash>.yml`, and
     // `memory/<type>.example.yml` template filenames.
@@ -270,7 +342,13 @@ function _stem(name: string): string {
     return base.slice(0, dot);
 }
 
-function _validateEntry(entry: Entry, p: string, seenIds: Set<string>, findings: Finding[]): void {
+function _validateEntry(
+    entry: Entry,
+    p: string,
+    seenIds: Set<string>,
+    findings: Finding[],
+    criticalCounts: Record<string, number> | null,
+): void {
     const eid = typeof entry['id'] === 'string' ? (entry['id'] as string) : entry['id'] != null ? String(entry['id']) : '';
     const eidStr = entry['id'] == null ? '' : eid;
     const present = new Set(Object.keys(entry));
@@ -292,6 +370,22 @@ function _validateEntry(entry: Entry, p: string, seenIds: Set<string>, findings:
     if (confidence && typeof confidence === 'string' && !VALID_CONFIDENCE.has(confidence)) {
         findings.push(new Finding(p, 0, 'error', `invalid confidence '${confidence}'`, eidStr));
     }
+    // Priority is optional (defaults to `normal` at read time). When present
+    // it MUST be one of the three-tier enum — see VALID_PRIORITY for the
+    // rationale on rejecting a fourth `high` tier.
+    const priority = entry['priority'];
+    if (priority !== undefined && priority !== null && !(typeof priority === 'string' && VALID_PRIORITY.has(priority))) {
+        const sortedPri = [...VALID_PRIORITY].sort();
+        findings.push(
+            new Finding(
+                p,
+                0,
+                'error',
+                `invalid priority '${_pyStr(priority)}' (expected one of [${sortedPri.map((x) => `'${x}'`).join(', ')}])`,
+                eidStr,
+            ),
+        );
+    }
     const sources = (entry['source'] ?? []) as unknown;
     if (!Array.isArray(sources) || sources.length < 1) {
         findings.push(new Finding(p, 0, 'error', 'source must be a list with ≥1 entry', eidStr));
@@ -309,6 +403,71 @@ function _validateEntry(entry: Entry, p: string, seenIds: Set<string>, findings:
             findings.push(new Finding(p, 0, 'info', `stale: last_validated ${age} days ago (limit ${days})`, eidStr));
         }
     }
+    // Critical-stale guard: a `priority: critical` entry that has not been
+    // re-validated within CRITICAL_STALE_DAYS surfaces as a warning, even
+    // when the entry's own `review_after_days` is more lenient. Critical
+    // entries surface on every /memory:load — they have a tighter SLA.
+    if (priority === 'critical' && entry['status'] === 'active' && lv instanceof PyDate) {
+        const critAge = _dateDiffDays(_today(), lv);
+        if (critAge > CRITICAL_STALE_DAYS) {
+            findings.push(
+                new Finding(
+                    p,
+                    0,
+                    'warning',
+                    `critical-stale: last_validated ${critAge} days ago (critical SLA is ${CRITICAL_STALE_DAYS} days)`,
+                    eidStr,
+                ),
+            );
+        }
+    }
+    // One-durable-fact-per-entry: reject transcript/narrative blobs. A single
+    // content field over ONE_FACT_MAX_CHARS is the bloat signal.
+    for (const fld of ONE_FACT_FIELDS) {
+        const val = entry[fld];
+        if (typeof val === 'string' && _pyLen(val) > ONE_FACT_MAX_CHARS) {
+            findings.push(
+                new Finding(
+                    p,
+                    0,
+                    'warning',
+                    `one-fact: \`${fld}\` is ${_pyLen(val)} chars (limit ${ONE_FACT_MAX_CHARS}) — split into separate durable facts, not a narrative blob`,
+                    eidStr,
+                ),
+            );
+            break;
+        }
+    }
+    // Tier-0 inflation tracking — increment per memory type. The aggregate
+    // warning is emitted in main() after all files are validated.
+    if (criticalCounts !== null && priority === 'critical' && entry['status'] === 'active') {
+        const mtype = _memoryType(p);
+        criticalCounts[mtype] = (criticalCounts[mtype] ?? 0) + 1;
+    }
+    // Per-type entry-count tracking — aggregate cap warning in main().
+    if (criticalCounts !== null) {
+        const mt = _memoryType(p);
+        _TYPE_COUNTS[mt] = (_TYPE_COUNTS[mt] ?? 0) + 1;
+    }
+}
+
+/** Mirror Python's `str(value)` for the priority error message. */
+function _pyStr(value: unknown): string {
+    if (value === null) {
+        return 'None';
+    }
+    if (value === true) {
+        return 'True';
+    }
+    if (value === false) {
+        return 'False';
+    }
+    if (value instanceof PyDate) {
+        const mm = String(value.month).padStart(2, '0');
+        const dd = String(value.day).padStart(2, '0');
+        return `${value.year}-${mm}-${dd}`;
+    }
+    return String(value);
 }
 
 function _checkRedaction(p: string, findings: Finding[]): void {
@@ -328,6 +487,38 @@ function _checkRedaction(p: string, findings: Finding[]): void {
     });
 }
 
+function _checkDateDiscipline(p: string, findings: Finding[]): void {
+    // Reject relative-date phrases without an ISO YYYY-MM-DD anchor.
+    const text = fs.readFileSync(p, 'utf-8');
+    const lines = _splitlines(text);
+    lines.forEach((line, idx) => {
+        const lineNo = idx + 1;
+        const stripped = line.trimStart();
+        if (stripped.startsWith('#') || stripped.startsWith('last_validated')) {
+            return;
+        }
+        RELATIVE_DATE_PATTERN.lastIndex = 0;
+        let match: RegExpExecArray | null;
+        while ((match = RELATIVE_DATE_PATTERN.exec(line)) !== null) {
+            const start = Math.max(0, match.index - DATE_ANCHOR_WINDOW);
+            const end = Math.min(line.length, match.index + match[0].length + DATE_ANCHOR_WINDOW);
+            const windowStr = line.slice(start, end);
+            if (ISO_DATE_PATTERN.test(windowStr)) {
+                continue;
+            }
+            const phrase = match[0];
+            findings.push(
+                new Finding(
+                    p,
+                    lineNo,
+                    'error',
+                    `relative date '${phrase}' without an ISO YYYY-MM-DD anchor within ±${DATE_ANCHOR_WINDOW} chars (re-anchor before commit)`,
+                ),
+            );
+        }
+    });
+}
+
 /** Mirror Python str.splitlines() for the line-numbering used above. */
 function _splitlines(text: string): string[] {
     if (text === '') {
@@ -342,12 +533,17 @@ function _splitlines(text: string): string[] {
     return lines;
 }
 
-function _validateFile(p: string, findings: Finding[]): void {
+function _validateFile(
+    p: string,
+    findings: Finding[],
+    criticalCounts: Record<string, number> | null,
+): void {
     const mtype = _memoryType(p);
     if (!KNOWN_TYPES.has(mtype)) {
         findings.push(new Finding(p, 0, 'warning', `unknown memory type '${mtype}'`));
     }
     _checkRedaction(p, findings);
+    _checkDateDiscipline(p, findings);
     let data: unknown;
     try {
         data = pyYamlSafeLoad(fs.readFileSync(p, 'utf-8'));
@@ -369,7 +565,7 @@ function _validateFile(p: string, findings: Finding[]): void {
     if (Array.isArray(entries)) {
         for (const entry of entries) {
             if (_isPlainObject(entry)) {
-                _validateEntry(entry as Entry, p, seenIds, findings);
+                _validateEntry(entry as Entry, p, seenIds, findings, criticalCounts);
             }
         }
     }
@@ -549,8 +745,53 @@ function main(): number {
         }
         return 0;
     }
-    for (const yml of _rglobYmlSorted(root)) {
-        _validateFile(yml, findings);
+    // An ABSENT root stays a pinned exit-0 no-op (the branch above; the memory
+    // tree is an optional surface and `task check-memory` short-circuits it).
+    // A root that EXISTS but walks to zero `*.yml` is the case nothing covered:
+    // entries moved to a subtree this walk does not reach, and the validator
+    // reported "0 error(s)" over an empty read. No `allowEmpty` for that half —
+    // a present-but-unreadable corpus is blindness, not a clean bill of health.
+    // Exit 1 is this gate's only failure code (see `_emit`).
+    // No dead-scope guard: `_lib/scan_scope.js` is not installed with the
+    // template, and a consumer with no `agents/memory/` legitimately scans zero.
+    const ymls = _rglobYmlSorted(root);
+
+    const criticalCounts: Record<string, number> = {};
+    for (const key of Object.keys(_TYPE_COUNTS)) {
+        delete _TYPE_COUNTS[key];
+    }
+    for (const yml of ymls) {
+        _validateFile(yml, findings, criticalCounts);
+    }
+    // Tier-0 inflation warning — soft cap on `priority: critical` per type.
+    // Council convergence (Phase 2 B2): warn rather than block, because the
+    // right answer to "too many criticals" is curator review, not CI failure.
+    for (const [mtype, count] of Object.entries(criticalCounts).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))) {
+        if (count > CRITICAL_WARN_THRESHOLD) {
+            findings.push(
+                new Finding(
+                    `agents/memory/${mtype}`,
+                    0,
+                    'warning',
+                    `tier-0 inflation: ${count} active 'priority: critical' entries (threshold ${CRITICAL_WARN_THRESHOLD}) — review whether all still warrant always-surface treatment`,
+                ),
+            );
+        }
+    }
+    // Per-type entry-count cap (size-bounding, Phase 7). Warn, never block —
+    // over-cap signals a consolidation pass is due (prune archived, merge dups).
+    for (const [mtype, count] of Object.entries(_TYPE_COUNTS).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))) {
+        const cap = PER_TYPE_CAPS[mtype] ?? DEFAULT_TYPE_CAP;
+        if (count > cap) {
+            findings.push(
+                new Finding(
+                    `agents/memory/${mtype}`,
+                    0,
+                    'warning',
+                    `entry-cap: ${count} entries (soft cap ${cap}) — run a consolidation pass (prune archived, merge duplicates)`,
+                ),
+            );
+        }
     }
     return _emit(findings, args.format);
 }