@event4u/agent-config 14.12.0 → 14.14.0

package/src/scripts/check_estate_count.ts

@@ -47,7 +47,7 @@
  * or merges one in the same change — or the added file carries an explicit
  * `estate_offset_exempt:` reason in its frontmatter, which costs a visible line
  * in the diff of the very commit that claims it. This half is diff-scoped: it
- * reads `<base>...HEAD` over `agents/roadmaps/`, so on a branch that adds no
+ * reads `<base>...HEAD` over `agents/roadmaps/`, so on a branch that adds no  code-comment-allow provenance-comment -- the path is this script's operand, not where the code came from
  * roadmap it legitimately finds nothing to weigh.
  *
  * THE THREE WAYS THE ESTATE MAY LEGITIMATELY GROW
@@ -65,7 +65,7 @@
  *    estate rather than creating it, so it needs no authorisation; what the
  *    allowance does NOT cover is a `later/` file appearing from nowhere.
  * 3. **Anything else** — `estate_growth_exempt: <reason>` added, in this change,
- *    to the frontmatter of any roadmap under `agents/roadmaps/`. The canonical
+ *    to the frontmatter of any roadmap under `agents/roadmaps/`. The canonical  code-comment-allow provenance-comment -- the path is this script's operand, not where the code came from
  *    case is a blocker discovered while doing the work: `open_blockers` rises,
  *    nothing was archived, and the reason belongs next to the blocker.
  *
@@ -117,7 +117,7 @@
  * which one lied.
  *
  * The same function measures the BASE side, over a scratch copy of the base
- * ref's `agents/roadmaps/` (`_lib/base_tree.ts`). Re-deriving the floor with a
+ * ref's `agents/roadmaps/` (`_lib/base_tree.ts`). Re-deriving the floor with a  code-comment-allow provenance-comment -- the path is this script's operand, not where the code came from
  * second implementation would let the two sides disagree about one tree, which
  * is the failure this section already argues against, one level up.
  *
@@ -143,7 +143,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import {
     collect,
-    is_draft as isDraft,
+    is_unscheduled as isUnscheduled,
     is_roadmap_candidate as isRoadmapCandidate,
     parse_frontmatter as parseFrontmatter,
     parse_roadmap as parseRoadmap,
@@ -153,7 +153,10 @@ import { GateLedger } from './_lib/gate_ledger.js';
 import { resolveBaseRef } from './_lib/ratchet_base_ref.js';
 import { materialiseSubtree } from './_lib/base_tree.js';
 import { SKILLS_POSIX, measureSkillEstate } from './_lib/skill_estate.js';
+import { CONCERN_MANIFEST_POSIX, countConcerns } from './_lib/concern_estate.js';
 import { runGateCli, runSelfTest, type SelfTestCase } from './_lib/gate_self_test.js';
+import { countDeclaredCarriers, declaresCarrier } from './_lib/carrier_status.js';
+import { carrierEstateCases } from './_lib/estate_carrier_cases.js';
 
 const GATE = 'check_estate_count';
 const BUDGET_REL = path.join('src', 'config', 'estate-count-budget.json');
@@ -190,6 +193,23 @@ export interface EstateCounts {
      * "no tokens" — see `tokensExact`.
      */
     skill_description_tokens: number;
+    /**
+     * Hook concerns declared in `src/scripts/hook_manifest.yaml`.
+     *
+     * A FIFTH corpus on the same machinery, and the same argument that admitted
+     * skills: the floor-from-the-base-ref work is the expensive part and should
+     * not be written a third time, and a separate ratchet is a separate place to
+     * forget.
+     *
+     * Read with the SCOPED parser in `_lib/concern_estate.ts`, not the
+     * whole-file grep the originating roadmap reproduces its series with. That
+     * grep over-counts by exactly 16 at every one of its six pins, because
+     * `roles:`, `platforms:` and `native_event_aliases:` sit at the same indent.
+     * The growth finding survives the correction — the delta is constant — but
+     * the absolute figure does not: the axis stands at 55, not 71, and a floor
+     * of 71 is one this gate's own parser could never reproduce.
+     */
+    concern_count: number;
 }
 
 export type MetricName = keyof EstateCounts;
@@ -200,6 +220,7 @@ export const METRICS: readonly MetricName[] = [
     'open_blockers',
     'skill_count',
     'skill_description_tokens',
+    'concern_count',
 ];
 
 export interface EstateBudget {
@@ -213,6 +234,63 @@ export interface EstateBudget {
      * number here is how it gets a threshold.
      */
     one_in_one_out: { applies_above_active: number | null };
+    /**
+     * The capped provisional-promotion path — specified, and DECLINED.
+     *
+     * READ ITS NULLS THE OTHER WAY ROUND FROM THE KEY ABOVE. There `null` means
+     * UNCONDITIONAL; here `max_live: null` and `expires_after_days: null` mean
+     * NOT REGISTERED, PATH INACTIVE. The two keys sit a few lines apart in one
+     * file and their nulls mean opposite things, so a reader who transfers the
+     * sibling's semantics reads a declined path as an uncapped one.
+     */
+    provisional_promotion: ProvisionalPromotion;
+}
+
+/**
+ * The `provisional_promotion` object as the budget file carries it.
+ *
+ * `status` is optional so that a file which registered the two integers without
+ * restating a status is still readable — the integers are what activate the
+ * path, and a declination that dropped its own marker would fall to
+ * `unregistered`, which is the safe direction.
+ */
+export interface ProvisionalPromotion {
+    status?: string;
+    max_live: number | null;
+    expires_after_days: number | null;
+}
+
+/**
+ * Three states, and the reason there are three rather than two.
+ *
+ * The 2026-09-01 council that declined the path attached one obligation to the
+ * decline: the checker must distinguish an intentional declination from missing
+ * configuration. Two states cannot — `null` would read the same either way, and
+ * "nobody has written this yet" would be indistinguishable from "this was
+ * specified in full and refused on 2026-09-01".
+ */
+export type ProvisionalPromotionState = 'declined' | 'unregistered' | 'registered';
+
+/**
+ * Classify the path's state. NEVER activates it, in any state.
+ *
+ * A half-registered object — one integer, one null — throws rather than
+ * resolving to either neighbour: a cap with no expiry and an expiry with no cap
+ * are different mechanisms, and guessing which half was meant is how a bounded
+ * path becomes an unbounded one by omission.
+ */
+export function provisionalPromotionState(pp: ProvisionalPromotion): ProvisionalPromotionState {
+    const live = pp.max_live;
+    const days = pp.expires_after_days;
+    if (typeof live === 'number' && typeof days === 'number') return 'registered';
+    if ((live === null) !== (days === null)) {
+        throw new Error(
+            `${BUDGET_REL} "provisional_promotion" is half-registered ` +
+                `(max_live=${JSON.stringify(live)}, expires_after_days=${JSON.stringify(days)}). ` +
+                'Both integers activate the path; both null leave it inactive. One of each is neither.',
+        );
+    }
+    return pp.status === 'declined' ? 'declined' : 'unregistered';
 }
 
 /** One gated count that rose above the floor measured at the base ref. */
@@ -286,6 +364,15 @@ export interface EstateVerdict {
     offsets: OffsetLedger | null;
     offsetSkipReason: string | null;
     unpaid: number;
+    /**
+     * The provisional-promotion path's state, reported and never acted on.
+     *
+     * Carried in the verdict so a `--json` consumer can tell a declined path
+     * from an unwritten one without re-reading the budget file, which is the
+     * distinction the 2026-09-01 decline was conditioned on. It contributes
+     * nothing to `withinBudget` in any state: reading is not activation.
+     */
+    provisionalPromotion: ProvisionalPromotionState;
     withinBudget: boolean;
 }
 
@@ -303,6 +390,29 @@ function repoRootFrom(start: string): string {
     }
 }
 
+/** File contents, or `null` when it is absent. Absent is a real state here. */
+function readIfPresent(file: string): string | null {
+    try {
+        return fs.readFileSync(file, 'utf-8');
+    } catch {
+        return null;
+    }
+}
+
+/**
+ * Concern count at a git ref, or `null` when the manifest is unreadable there.
+ *
+ * `null` is NOT zero, and the distinction is the whole reason this returns an
+ * option. A missing manifest read as 0 makes the floor 0, which makes the
+ * ratchet inert on that path while still printing a green line — "a gate that
+ * read nothing has not passed", in this repository's own words. The caller
+ * turns `null` into a floor-skip, which this gate already treats as a failure.
+ */
+function concernCountAt(repoRoot: string, ref: string): number | null {
+    const res = git(['show', `${ref}:${CONCERN_MANIFEST_POSIX}`], repoRoot);
+    return res.ok ? countConcerns(res.stdout) : null;
+}
+
 function git(args: readonly string[], cwd: string): { ok: boolean; stdout: string } {
     const res = spawnSync('git', [...args], { cwd, encoding: 'utf-8', maxBuffer: 32 * 1024 * 1024 });
     return { ok: res.status === 0, stdout: res.stdout ?? '' };
@@ -328,7 +438,39 @@ function countIn(roadmapRoot: string, sub: string): number {
     }
 }
 
-/** Non-draft roadmaps parked in `later/`, parsed for their blockers. */
+/**
+ * Top-level roadmaps `collect()` drops for declaring `status: carrier`, added
+ * back so that FLIPPING a status is count-neutral.
+ *
+ * Measured before this: flipping one file to `carrier` moved `active_roadmaps
+ * 3 → 2` and the gate printed "estate within its ratchet", because a count
+ * below the floor is a drawdown and free. The floor is measured at the base
+ * ref, so once such a flip merges the lowered number becomes the next floor —
+ * the file cannot be flipped back without paying, and any roadmap can be
+ * laundered out of the count by adding one word.
+ *
+ * A reclassification is not a disposal, so the metric counts the file on both
+ * sides. Same argument `open_blockers` makes below for spanning `later/`.
+ * Deleting a carrier is still a shrink and still earns no offset
+ * (`classifyDiff`); adding one is growth that takes the claim path.
+ *
+ * This is therefore the one roadmap metric that does NOT equal the dashboard
+ * header, stated here rather than left to be tripped over.
+ */
+function countActiveCarriers(roadmapRoot: string): number {
+    return countDeclaredCarriers(roadmapRoot, isRoadmapCandidate, fs, path.join);
+}
+
+/**
+ * Roadmaps parked in `later/` whose blockers count, parsed for them.
+ *
+ * Skips a draft AND a carrier, which is the same pair `collect()` skips on the
+ * active side. It used to skip only the draft, so parking a carrier moved its
+ * blockers INTO the gated count while the identical file at the top level kept
+ * them out — a ratchet verdict that moved on a relocation, for no stated
+ * reason. Three of the four status readers learned `carrier` when the status
+ * shipped; this is the fourth.
+ */
 function laterRoadmaps(roadmapRoot: string): Array<{ open_blockers: readonly unknown[] }> {
     const dir = path.join(roadmapRoot, 'later');
     let names: string[];
@@ -344,7 +486,7 @@ function laterRoadmaps(roadmapRoot: string): Array<{ open_blockers: readonly unk
         // `collect()` cannot be reused here: it filters through the same
         // path-based predicate and would reject its own root.
         const text = fs.readFileSync(abs, 'utf-8');
-        if (isDraft(parseFrontmatter(text))) continue;
+        if (isUnscheduled(parseFrontmatter(text))) continue;
         const stats = parseRoadmap(abs, dir);
         if (stats !== null) out.push(stats as unknown as { open_blockers: readonly unknown[] });
     }
@@ -354,8 +496,11 @@ function laterRoadmaps(roadmapRoot: string): Array<{ open_blockers: readonly unk
 /**
  * Count the estate, three ways.
  *
- * `active_roadmaps` comes from `collect()` so it cannot disagree with the
- * dashboard. `later_roadmaps` is a directory listing because parked files are
+ * `active_roadmaps` is `collect()` PLUS the top-level carriers `collect()`
+ * drops, so the parser is shared with the dashboard while a status flip stays
+ * count-neutral — see `countActiveCarriers` for why that beats parity here, and
+ * for the one number on this gate that the dashboard header does not print.
+ * `later_roadmaps` is a directory listing because parked files are
  * outside that corpus by design — filtered through the same `is_roadmap_candidate`
  * predicate as the active side, so `later/README.md` is not a roadmap here either.
  *
@@ -379,7 +524,7 @@ export function countEstate(repoRoot: string): EstateCounts {
         rows.reduce((n, r) => n + r.open_blockers.length, 0);
     const skills = measureSkillEstate(repoRoot);
     return {
-        active_roadmaps: stats.length,
+        active_roadmaps: stats.length + countActiveCarriers(roadmapRoot),
         later_roadmaps: countIn(roadmapRoot, 'later'),
         open_blockers: openOf(stats) + openOf(laterRoadmaps(roadmapRoot)),
         skill_count: skills.skill_count,
@@ -389,6 +534,7 @@ export function countEstate(repoRoot: string): EstateCounts {
         // against a proxy one — they differ by more than the growth a ratchet
         // is trying to catch.
         skill_description_tokens: skills.skill_description_tokens ?? 0,
+        concern_count: countConcerns(readIfPresent(path.join(repoRoot, CONCERN_MANIFEST_POSIX)) ?? ''),
     };
 }
 
@@ -397,7 +543,7 @@ export function skillTokensExact(root: string): boolean {
     return measureSkillEstate(root).skill_description_tokens !== null;
 }
 
-/** `agents/roadmaps/<name>.md` — the active top level, never a subdirectory. */
+/** `agents/roadmaps/<name>.md` — the active top level. code-comment-allow provenance-comment -- operand, not provenance */
 function isActiveTopLevel(rel: string): boolean {
     const norm = rel.split(path.sep).join('/');
     if (!norm.startsWith('agents/roadmaps/') || !norm.endsWith('.md')) {
@@ -444,6 +590,9 @@ export function exemptionReason(text: string): string | null {
     return reason === '' ? null : reason;
 }
 
+/** Re-export; `_lib/carrier_status.ts` holds the one implementation. */
+export const isCarrierText = declaresCarrier;
+
 /**
  * Classify the change's effect on the active roadmap tree.
  *
@@ -452,7 +601,17 @@ export function exemptionReason(text: string): string | null {
  * `later/road-to-x.md` → `road-to-x.md` is an un-parking and counts as an
  * addition. A top-level-to-top-level rename is neither.
  */
-export function classifyDiff(nameStatus: string, readFile: (rel: string) => string | null): OffsetLedger {
+export function classifyDiff(
+    nameStatus: string,
+    readFile: (rel: string) => string | null,
+    /**
+     * The file's content at the BASE ref, for paths this change removed — a
+     * deleted carrier cannot be read from the working tree and its status
+     * decides whether the deletion earns an offset. Defaults to null, which
+     * reproduces the previous scoring for any caller without a pre-image.
+     */
+    readBase: (rel: string) => string | null = () => null,
+): OffsetLedger {
     const added: string[] = [];
     const offsets: string[] = [];
     const exempt: Array<{ file: string; reason: string }> = [];
@@ -465,8 +624,10 @@ export function classifyDiff(nameStatus: string, readFile: (rel: string) => stri
             const from = cols[1] ?? '';
             const to = cols[2] ?? '';
             if (isActiveTopLevel(from) && isDisposed(to)) {
-                offsets.push(from);
-                if (isParked(to)) parked.push(to);
+                if (!isCarrierText(readBase(from))) {
+                    offsets.push(from);
+                    if (isParked(to)) parked.push(to);
+                }
             } else if (isDisposed(from) && isActiveTopLevel(to)) {
                 added.push(to);
             }
@@ -477,7 +638,10 @@ export function classifyDiff(nameStatus: string, readFile: (rel: string) => stri
         if (status === 'A') {
             added.push(file);
         } else if (status === 'D') {
-            offsets.push(file);
+            // A carrier's removal is never an offset. See `readBase`.
+            if (!isCarrierText(readBase(file))) {
+                offsets.push(file);
+            }
         }
     }
     for (const file of added) {
@@ -544,6 +708,18 @@ export function evaluate(
     if (budget.one_in_one_out === undefined) {
         throw new Error(`${BUDGET_REL} carries no "one_in_one_out" object.`);
     }
+    // Same shape, same reason: an absent policy object is a could-not-run, not a
+    // pass. Here it also carries a second job — with the key required, "the path
+    // was declined on 2026-09-01" and "nobody has configured this" cannot
+    // collapse into the same reading, which is the condition the council
+    // attached to the decline.
+    if (budget.provisional_promotion === undefined) {
+        throw new Error(
+            `${BUDGET_REL} carries no "provisional_promotion" object. ` +
+                'Absent is misconfiguration, never an inactive path — a declination is recorded, not implied.',
+        );
+    }
+    const provisionalPromotion = provisionalPromotionState(budget.provisional_promotion);
 
     const counts = countEstate(repoRoot);
     const baseRef = opts.baseRef ?? resolveBaseRef(repoRoot);
@@ -554,6 +730,15 @@ export function evaluate(
     // property, and unlike a number nobody has to remember to update it.
     let floor: EstateCounts | null = null;
     let floorSkipReason: string | null = null;
+    /**
+     * Does the WORKING TREE carry a manifest at all?
+     *
+     * The base-ref read only matters when it does. A repository with no manifest
+     * on either side has no concern axis to ratchet, and failing there would
+     * turn every unrelated fixture red — which is how the first version of this
+     * clause was caught.
+     */
+    const headHasManifest = fs.existsSync(path.join(repoRoot, CONCERN_MANIFEST_POSIX));
     /** Set when the base ref carries no `src/skills` — the skill metrics drop. */
     let skillFloorSkipReason: string | null = null;
     /** Set when either side's tokeniser did not resolve — that ONE metric drops. */
@@ -584,7 +769,14 @@ export function evaluate(
                 if (baseSkills.error !== null || baseSkills.files === 0) {
                     // Roadmap floor stands; the skill floor is stated as
                     // unavailable and its metrics are dropped from the compare.
-                    floor = roadmapFloor;
+                    const cf = concernCountAt(repoRoot, baseRef);
+                    floor = { ...roadmapFloor, concern_count: cf ?? 0 };
+                    if (cf === null && headHasManifest) {
+                        floorSkipReason =
+                            `could not read ${CONCERN_MANIFEST_POSIX} at ${baseRef} while HEAD ` +
+                            'carries one. A floor of 0 would make the concern ratchet inert while ' +
+                            'still printing green, so this fails rather than skips.';
+                    }
                     skillFloorSkipReason =
                         `could not read ${SKILLS_POSIX} at ${baseRef} — ` +
                         `${baseSkills.error ?? 'no files'}`;
@@ -594,7 +786,23 @@ export function evaluate(
                         ...roadmapFloor,
                         skill_count: s.skill_count,
                         skill_description_tokens: s.skill_description_tokens ?? 0,
+                        // A SINGLE FILE, so `git show` rather than a third
+                        // `materialiseSubtree` — stated because the roadmap asks
+                        // which of the two this uses. Materialising a subtree to
+                        // reach one known path would spend a temp tree and a
+                        // recursive ls-tree on a `git cat-file` in disguise.
+                        //
+                        // `?? 0` never stands for "unreadable": the branch below
+                        // turns that into a floor-skip, which fails. This
+                        // coalesce only satisfies the type.
+                        concern_count: concernCountAt(repoRoot, baseRef) ?? 0,
                     };
+                    if (concernCountAt(repoRoot, baseRef) === null && headHasManifest) {
+                        floorSkipReason =
+                            `could not read ${CONCERN_MANIFEST_POSIX} at ${baseRef} while HEAD ` +
+                            'carries one. A floor of 0 would make the concern ratchet inert while ' +
+                            'still printing green, so this fails rather than skips.';
+                    }
                     if (s.skill_description_tokens === null) {
                         skillTokenSkipReason =
                             `the tokeniser did not resolve at ${baseRef}; an exact reading may ` +
@@ -624,13 +832,20 @@ export function evaluate(
         if (!diff.ok) {
             offsetSkipReason = `git diff against ${baseRef} failed — one-in-one-out not evaluated`;
         } else {
-            offsets = classifyDiff(diff.stdout, (rel) => {
-                try {
-                    return fs.readFileSync(path.join(repoRoot, rel), 'utf-8');
-                } catch {
-                    return null;
-                }
-            });
+            offsets = classifyDiff(
+                diff.stdout,
+                (rel) => {
+                    try {
+                        return fs.readFileSync(path.join(repoRoot, rel), 'utf-8');
+                    } catch {
+                        return null;
+                    }
+                },
+                (rel) => {
+                    const show = git(['show', `${baseRef}:${rel}`], repoRoot);
+                    return show.ok ? show.stdout : null;
+                },
+            );
         }
         const patch = git(
             ['diff', '--unified=0', '--find-renames', `${baseRef}...HEAD`, '--', ROADMAPS_REL],
@@ -663,6 +878,14 @@ export function evaluate(
         // claim path — a recorded reason in the diff — or it fails.
         skill_count: 0,
         skill_description_tokens: 0,
+        // Step 1.2: NO new allowance key. The concern axis joins `skill_count`
+        // in taking the claim path or nothing, for the reason the budget file
+        // already records for skills — an allowance reopens the gaming path the
+        // dimension exists to close. Eight concerns spread across eight events
+        // violate the existing per-event cap zero times, which is exactly why a
+        // total-growth ratchet was needed and exactly why it must not carry a
+        // per-change freebie.
+        concern_count: 0,
     };
 
     /** Metrics dropped from the compare, with the reason, never silently. */
@@ -707,6 +930,7 @@ export function evaluate(
         offsets,
         offsetSkipReason,
         unpaid,
+        provisionalPromotion,
         // No floor is a FAILURE, not a skip, and it is the one place this gate
         // convicts on a missing input. The other halves can report "unproven" and
         // still leave a meaningful verdict behind; the count half IS the verdict,
@@ -717,7 +941,7 @@ export function evaluate(
 }
 
 /** Floors for `--self-test`, declared here so a truncation is a visible diff. */
-const SELF_TEST_MIN_CASES = 12;
+const SELF_TEST_MIN_CASES = 13;
 const SELF_TEST_MIN_REJECT = 8;
 
 /**
@@ -742,11 +966,32 @@ function selfTest(): number {
      * the baseline with no reason" is not a state a change can reach.
      */
     const budgetJson = (): string =>
-        `${JSON.stringify({ one_in_one_out: { applies_above_active: null } }, null, 4)}\n`;
+        `${JSON.stringify(
+            {
+                one_in_one_out: { applies_above_active: null },
+                // Required since the path was specified and declined: the gate
+                // refuses a budget that carries no `provisional_promotion`, so a
+                // fixture without it exits 2 on every case rather than on the one
+                // case testing that refusal.
+                provisional_promotion: { status: 'declined', max_live: null, expires_after_days: null },
+            },
+            null,
+            4,
+        )}\n`;
 
     const roadmap = (name: string, extra = ''): string =>
         `# Roadmap: ${name}\n\n## Phase 1\n\n- [ ] **1.1** s\n${extra}`;
 
+    /** A `status: carrier` roadmap — counted as estate, and never an offset. */
+    const CARRIER = `---\nstatus: carrier\n---\n# Roadmap: carrier\n\n## Phase 1\n\n- [~] **1.1** s\n`;
+
+    /**
+     * A `status: draft` roadmap — invisible to `collect()`, so adding one cannot
+     * move `active_roadmaps`. That is what makes it the fixture for a case that
+     * must be decided by the offset scoring and by nothing else.
+     */
+    const DRAFT = `---\nstatus: draft\n---\n# Roadmap: draft\n\n## Phase 1\n\n- [ ] **1.1** s\n`;
+
     /** An open blocker — no `Status: resolved` prefix, so it counts as open. */
     const BLOCKER = '\n## Blockers\n\n### Blocker: fixture\n\n- **Status:** open\n';
 
@@ -808,6 +1053,64 @@ function selfTest(): number {
             expect: 'accept',
             run: () => fixture({ roadmaps: 3, base: 'main', after: () => undefined }),
         },
+        {
+            // The concern axis, both directions. Seeded into the BASE tree so
+            // the floor is a real reading of the fixture's own manifest rather
+            // than this repository's -- the whole point of measuring the floor
+            // from the base ref.
+            name: 'concern count grows above the base-tree floor → reject',
+            expect: 'reject',
+            run: () =>
+                fixture({
+                    roadmaps: 3,
+                    base: 'main',
+                    before: (dir) =>
+                        write(dir, CONCERN_MANIFEST_POSIX, 'concerns:\n  one:\n    severity: advisory\n'),
+                    after: (dir) =>
+                        write(
+                            dir,
+                            CONCERN_MANIFEST_POSIX,
+                            'concerns:\n  one:\n    severity: advisory\n  two:\n    severity: advisory\n',
+                        ),
+                }),
+        },
+        {
+            // AC-3's explicit clause, and it corrects the first implementation
+            // of this metric: an unreadable manifest at the base ref must FAIL,
+            // never read as 0. A floor of 0 makes the ratchet inert on that
+            // path while still printing a green line, which is the shape this
+            // repository calls "a gate that read nothing has not passed".
+            name: 'base ref carries no manifest → reject (a 0 floor is not a floor)',
+            expect: 'reject',
+            run: () =>
+                fixture({
+                    roadmaps: 3,
+                    base: 'main',
+                    after: (dir) =>
+                        write(dir, CONCERN_MANIFEST_POSIX, 'concerns:\n  one:\n    severity: advisory\n'),
+                }),
+        },
+        {
+            // The half that proves the parser is SCOPED rather than a grep: a
+            // top-level map gaining members at the same two-space indent is not
+            // concern growth, and the roadmap's own reproduce command would
+            // have counted it as such.
+            name: 'a non-concern top-level map growing is not concern growth → accept',
+            expect: 'accept',
+            run: () =>
+                fixture({
+                    roadmaps: 3,
+                    base: 'main',
+                    before: (dir) =>
+                        write(dir, CONCERN_MANIFEST_POSIX, 'concerns:\n  one:\n    severity: advisory\nroles:\n  dev:\n'),
+                    after: (dir) =>
+                        write(
+                            dir,
+                            CONCERN_MANIFEST_POSIX,
+                            'concerns:\n  one:\n    severity: advisory\nroles:\n  dev:\n  ops:\n  sre:\n',
+                        ),
+                }),
+        },
         {
             // The floor is now exact, so this case no longer depends on anyone
             // having typed the right number at the base commit.
@@ -894,6 +1197,14 @@ function selfTest(): number {
                     after: (dir) => write(dir, 'agents/roadmaps/later/road-to-parked.md', roadmap('P')),
                 }),
         },
+        ...carrierEstateCases({
+            fixture,
+            write,
+            remove: (dir, rel) => fs.rmSync(path.join(dir, rel)),
+            roadmap,
+            CARRIER,
+            DRAFT,
+        }),
         {
             name: 'a new open blocker with no claim → reject',
             expect: 'reject',
@@ -1019,7 +1330,7 @@ export function main(argv: string[] = process.argv.slice(2)): number {
         return 2;
     }
 
-    // A ratchet over an empty estate always passes. Move `agents/roadmaps/` and
+    // A ratchet over an empty estate always passes. Move `agents/roadmaps/` and  code-comment-allow provenance-comment -- the path is this script's operand, not where the code came from
     // every count is 0, which is trivially under any baseline — exit 2 (could
     // not run), never 1, which would assert the estate actually grew.
     try {
@@ -1096,6 +1407,17 @@ export function main(argv: string[] = process.argv.slice(2)): number {
     } else if (verdict.offsetSkipReason !== null) {
         process.stdout.write(`  ⚠️  ${verdict.offsetSkipReason}\n`);
     }
+    // Printed unconditionally so the state is visible without `--json`. It never
+    // changes the exit code — a declined path and a registered one both leave
+    // the ratchet exactly as it was, and the allowance a registered path would
+    // grant is deliberately unwired (the owner registers the numbers; wiring
+    // what they buy is a separate, separately authorised change).
+    process.stdout.write(
+        `  ${'provisional'.padEnd(18)} ${verdict.provisionalPromotion.padStart(5)}` +
+            `${verdict.provisionalPromotion === 'declined' ? '  (specified and declined 2026-09-01 — path inactive by decision)' : ''}` +
+            `${verdict.provisionalPromotion === 'unregistered' ? '  (no numbers registered — path inactive)' : ''}` +
+            `${verdict.provisionalPromotion === 'registered' ? '  (numbers registered by the owner; this gate grants no allowance for them)' : ''}\n`,
+    );
     for (const c of verdict.claims) {
         process.stdout.write(`  ↑ growth claimed in ${c.file}: ${c.reason.slice(0, 120)}\n`);
     }