@event4u/agent-config 14.13.0 → 14.14.1

package/README.md

@@ -27,7 +27,7 @@ It is both deep **and** disciplined — and honest about what it deliberately is
 - **Surgical uninstall** — removes only its own keys from a shared host config (matched by JSON-pointer + SHA-256), never a neighbour tool's entries.<!-- claim:surgical-uninstall -->
 - **Pack-scoped install** — writes the active pack only, not a 500-artefact dump.
 
-**What it deliberately is *not*** — the core is a governance layer with optional, individually opt-in embedded engines (code intelligence, gated reach, the setup GUI, the bench lab — [ADR-124](docs/decisions/ADR-124-embedded-engine-doctrine.md)): **no background daemon, no separate state database, no self-rewriting memory, no auto-build pipeline.** Engines are never mandatory, never default-on without measured lift, and terminate with the command that invoked them. The host agent runs the loop; every learned change is human-reviewed; the same layer stays portable across tools. Capability without a process to babysit.
+**What it deliberately is *not*** — the core is a governance layer with optional, individually opt-in embedded engines (code intelligence, gated reach, the setup GUI, the bench lab — [ADR-124](docs/decisions/ADR-124-embedded-engine-doctrine.md)): **no mandatory or always-on daemon, no separate state database, no self-rewriting memory, no auto-build pipeline.** Engines are never mandatory, never default-on without measured lift, and terminate with the command that invoked them. The host agent runs the loop; every learned change is human-reviewed; the same layer stays portable across tools. Capability without a process to babysit.
 
 > **Where this comes from (honest provenance).** The skills, rules and personas
 > are distilled from real production work on TypeScript and PHP codebases. The

package/dist/agent-src/commands/analyze/inbox.md

@@ -487,6 +487,7 @@ The question is never "what does the file say" but **"what does it become here"*
 | reference material read on demand | a `guideline` or `context` |
 | a measured finding | a `decision-record`/ADR, not a rule |
 | a defect claim | a roadmap item, once verified |
+| a claim that maps onto an existing stub | **not a fresh artifact — a stub-blocked finding, see below** |
 | a consolidation omitting a parent | **not an artifact — a discharge, see below** |
 
 **An omitted parent is discharged, never left silent.** When Phase 2's `lineage`
@@ -511,6 +512,41 @@ A `ghost:` reading — a declared parent with no matching file — has the same
 discharges plus a fourth that is really a correction: fix the name. A lineage
 naming a plan nobody can open is the cheaper half of the same defect.
 
+**A survivor that maps onto an existing stub is never resolved into a verdict
+line.** When a verified claim lands on something `agents/roadmaps/stubs/` already
+holds, the mapping is neither "a defect claim → a roadmap item" nor "nothing to
+do": the plan exists, and something is holding it. Before this row the table had
+no entry for that state, so a run that found one had no prescribed output and
+wrote a summary sentence instead. The round that produced this row closed exactly
+so — *"Not a neglected guard: the cost of an unmade owner decision. On the owner's
+desk."* That sentence is accurate, and it is why nine feedback rounds on one guard
+produced no executable item: it names a state and hands nobody anything to do.
+
+The run's output MUST carry all four of these, per stub matched. Three of them
+are the difference between a finding and a shrug, and the fourth is already
+computed upstream:
+
+1. **The stub path** — `agents/roadmaps/stubs/<slug>.md`, so a reader opens it
+   instead of searching for it.
+2. **Its blocker slug** — the `### blocker: <slug>` holding it, named. Where the
+   hold is recorded outside any blocker section, say so in those words and name
+   the section; "waiting on a decision" with nothing named is the verdict line
+   again, one word longer.
+3. **Its age in days** — days since the file first appeared under
+   `agents/roadmaps/stubs/`, from
+   `git log --diff-filter=A --format=%ad --date=short -- <path> | tail -1`. A
+   stub parked eleven days and one parked two hundred are different findings and
+   a reader cannot tell them apart from the path.
+4. **The recurrence count from Phase 4c** — how many earlier rounds raised the
+   same subject. A first arrival and a ninth are different findings, 4c has
+   already counted it, and dropping it here is what let one subject arrive nine
+   times as if each were new.
+
+Missing any of the four leaves the survivor undischarged. This row does not
+decide what happens to the stub — promotion is the estate's question and this
+command does not answer it — it only forbids resolving the survivor into prose
+that names no artifact.
+
 Three hard defaults, from this repo's own scar tissue:
 
 - **Extend before you create.** Run the four-surface overlap scan from

package/dist/agent-src/commands/pr/create.md

@@ -149,10 +149,25 @@ than less: the gate can now read the PR's real `baseRefName` from the forge, so
 a stacked or release-line PR is measured against the branch it will actually
 merge into instead of against the repo default.
 
+**The whole SEQUENCE is executable now, not just this step.** All six steps —
+fetch, integrate the base set, regenerate, verify, re-check freshness, then hand
+the push back to you — sit behind one runner, and a dry mode prints each step
+with its outcome without touching the tree. In this package that runner is the
+`push-ready` target in `taskfiles/dev.yml`; a consumer project wires the same
+six steps behind whatever its own task runner is, with steps 3 and 4 being its
+own generator and verify commands. The pre-push hook refuses and points at the
+runner; the hook never merges, because a merge inside `pre-push` rewrites the
+tree at the moment you believe your work is finished.
+
 **The resolution is executable now, not just described.**
 `./scripts-run src/scripts/sync_pr_branch` resolves the base from the open PR
 (so a stacked or release-line PR is measured against what it actually merges
-into), fetches, and merges it in when the branch is behind. On a conflict it
+into), fetches, and merges it in when the branch is behind. The base is a
+**set**: when the PR targets something other than the default branch, whether
+the default branch joins the set is a per-target policy read from the *target's
+own commit*, never from this branch — see `src/scripts/_lib/branch_convergence.ts`.
+A non-default target with no policy entry is refused, not guessed. The default
+is merged first, so a conflict surfaces against the broader base first. On a conflict it
 STOPS and splits the conflicted paths into generated, remeasured and authored —
 the first has one correct resolution (regenerate), the second's is to re-run the
 measurement on the merged tree (a ratchet baseline, where picking a side is how

package/dist/agent-src/contexts/execution/terminal-states.md

@@ -10,7 +10,7 @@ identically to a win: a loop that hit its iteration cap, a gate that could not
 run, an approval that never came — each ending with a summary that says the work
 is done.
 
-## The six states
+## The seven states
 
 | state | what it means | what it is NOT |
 |---|---|---|
@@ -20,6 +20,23 @@ is done.
 | `approval-required` | The work is ready and the next action crosses a gate the agent may not cross alone. | Not `blocked`: nothing is missing, and the run produced a deliverable. |
 | `exhausted` | A declared budget ran out — iterations, tokens, spend, wall-clock. | **Never** `success`, whatever partial progress exists. The cap firing IS the outcome. |
 | `stagnated` | The budget has not run out and progress has stopped: the same failure signature is repeating. | Not `exhausted`. Stagnation is detected by a NO-PROGRESS signal, not by a counter. |
+| `premise-invalidated` | The plan premise moved: the situational-awareness fingerprint the run engaged under (`origin/main` plus every open PR head) was re-observed and differs. | Not `exhausted` — the budget is untouched. Not `stagnated` — progress may have been fine. Not `blocked` — nothing is missing; what the run knew went stale. |
+
+**Why `premise-invalidated` is not `blocked` with a reason field.** Added
+2026-09-03 (AI council, unanimous) when the continuation ladder needed a word for
+a run whose base ref and open-PR set had moved under it. Reusing `blocked` keeps
+the arity at six and loses two things that are not decorative: the ability to
+COUNT premise invalidation separately from a missing precondition, and
+type-enforced exhaustive handling in the consumers that switch on the state. The
+remedies differ as sharply as `exhausted` and `stagnated` do — `blocked` says
+obtain the missing thing, `premise-invalidated` says re-probe and re-plan against
+the world as it now is.
+
+A consumer that cannot represent it reports `blocked`, which is the DECLARED
+downgrade in `_lib/outcome_vocabularies.ts` and not an ad-hoc substitution. The
+value domain is versioned (`RUN_TERMINAL_VOCABULARY_VERSION`, v2), and a reader
+meeting an unrecognised persisted value reports it as not-recorded rather than
+crashing or guessing.
 
 **Why `exhausted` and `stagnated` are separate**, when both stop a loop: they
 have different remedies and different next actions. `exhausted` says *the work
@@ -40,8 +57,8 @@ budget-exhausted stop indistinguishable from a completed one in a dashboard.
 | `[~]` | deferred | `blocked` or `approval-required`, undistinguished |
 | `[-]` | cancelled | *(a decision, not a run outcome)* |
 
-**Three states have no glyph, and they are exactly the ones a validation budget
-and a hard-blocker class produce:**
+**Four states have no glyph, and they are exactly the ones a validation budget,
+a hard-blocker class and a drift detector produce:**
 
 1. **`exhausted`** — the run stopped at its cap with the step still open. The
    glyph stays `[ ]`, which is identical to *never attempted*. A reader cannot
@@ -51,6 +68,8 @@ and a hard-blocker class produce:**
 3. **`approval-required`** — collapses into `[~]` alongside `blocked`, so a
    roadmap cannot show that the work is FINISHED and waiting on a human, versus
    not startable at all.
+4. **`premise-invalidated`** — same `[ ]` again, and the reader cannot see that
+   the step was not attempted because the plan it belonged to went stale.
 
 **This is recorded rather than fixed.** Adding glyphs would change a format that
 `update_roadmap_progress`, `check_roadmap_trackable`, `lint_empty_roadmaps` and
@@ -75,11 +94,13 @@ applies unchanged.
 
 ## Reporting contract
 
-A closing report names the state **by one of the six words above**, and where the
+A closing report names the state **by one of the seven words above**, and where the
 state is not `success` it names what would change it:
 
 - `exhausted` — the budget that ran out, its value, and what was achieved inside it.
 - `stagnated` — the repeating failure signature, and the attempts it survived.
+- `premise-invalidated` — which fingerprint was claimed, which was observed, and
+  that the next act is a re-probe rather than another iteration.
 - `blocked` — the missing thing, by name.
 - `approval-required` — the exact action awaiting approval.
 - `clean-no-op` — what was scanned, so "nothing to do" is distinguishable from

package/dist/agent-src/rules/code-comment-discipline.md

@@ -22,6 +22,9 @@ collision_ok:
   "implement": "fresh implementation is where over-commenting lands"
 # obligation: line 5
 obligation_frequency: "per-edit"
+enforced_by:
+  - "validator:src/scripts/lint_code_comments.ts"
+  - "hook:comment-discipline"
 ---
 
 # Code Comment Discipline
@@ -37,6 +40,9 @@ NO DOCBLOCK THAT ONLY MIRRORS THE NATIVE SIGNATURE.
 DOCBLOCKS EARN THEIR PLACE ONLY WITH MACHINE-RELEVANT PRECISION
 (GENERICS, ARRAY SHAPES, NON-TRIVIAL UNIONS) OR GENUINE WHY-CONTEXT.
 WHEN IN DOUBT: NO COMMENT. SHORTER IS BETTER. NONE IS OFTEN BEST.
+A COMMENT NAMING WHERE THE CODE CAME FROM — A ROADMAP PATH, A PHASE AND STEP,
+A PROTOTYPE — IS EVIDENCE IN THE WRONG PLACE. PROVENANCE IS NOT A WHY.
+A ROADMAP CANNOT LICENSE A COMMENT THIS RULE FORBIDS.
 ```
 
 ## What a comment is FOR

package/dist/agent-src/rules/missing-skill-recovery.md

@@ -31,8 +31,8 @@ and dropped **402 entries** from the model-visible skills list
 projection moved that to 330 and stripped the descriptions anyway.
 
 402 is the **host's own count against the host's own denominator**, which is not
-this package's: the same install projects 297 skills, so the figure is a
-magnitude, never a subtraction anyone can perform. What it establishes is that
+this package's: that install projected 297 skills <!-- count: dated -->, so the figure
+is a magnitude, never a subtraction anyone can perform. What it establishes is that
 most of the catalogue is not model-visible — which is all this rule needs.
 
 So "I do not see a skill for this" is evidence about the **delivery**, never

package/dist/agent-src/rules/token-budget-discipline.md

@@ -57,8 +57,8 @@ A skill claiming `rich` MUST satisfy ALL three:
    carry a `load_context` pointer instead.
 
 3. **≤ 15 % of the suite's skills may claim `rich`** — the CI linter counts
-   rich-tagged skills and hard-fails if the ratio is exceeded. With ~290 skills
-   (288 as-of 2026-08), the cap is ~43. Do not claim `rich` for convenience; claim it only for
+   rich-tagged skills and hard-fails if the ratio is exceeded. With 299 skills
+   the cap is ~44. Do not claim `rich` for convenience; claim it only for
    irreducible-complexity skills.
 
 ## Telegraph-speak amendment

package/dist/agent-src/scripts/archive_completed_roadmaps.ts

@@ -12,8 +12,8 @@
  * `urp.collect()` completion criterion, and exit code 0. snake_case kept.
  *
  * A roadmap that has reached `count_open == 0` and `count_deferred == 0` is
- * **complete**. This sweep moves it to `agents/roadmaps/archive/`, rewrites
- * inbound references (`agents/roadmaps/<x>.md` → `agents/roadmaps/archive/<x>.md`)
+ * **complete**. This sweep moves it to `agents/roadmaps/archive/`, rewrites code-comment-allow provenance-comment -- the sweep's own operand
+ * inbound references (`agents/roadmaps/<x>.md` → `agents/roadmaps/archive/<x>.md`) code-comment-allow provenance-comment -- the rewrite this sweep performs
  * across tracked files so links never break, and regenerates the dashboard.
  *
  * It replaces the old **merge-gate** (keep one item open + a manual post-merge
@@ -136,7 +136,7 @@ function _branch_touched_paths(root: string, base: string): Set<string> | null {
  *
  * Two classes, and the second is why this predicate exists at all:
  *
- * - `agents/evidence/**` — a committed record of what was true, or of what a
+ * - `agents/evidence/**` — a committed record of what was true, or of what a code-comment-allow provenance-comment -- the predicate's operand set
  *   reviewer was shown, at one point in time. Retroactively editing it makes it
  *   claim something that did not happen, which is the failure
  *   `evaluator-independence` exists to prevent ("the prompt ships with the
@@ -146,7 +146,7 @@ function _branch_touched_paths(root: string, base: string): Set<string> | null {
  *   AND makes `git apply` target a path the diff never created.
  *
  * Measured 2026-08-11: archiving one roadmap rewrote four frozen artifacts
- * under `agents/evidence/reviews/`, including the `diff.patch` headers of a
+ * under `agents/evidence/reviews/`, including the `diff.patch` headers of a code-comment-allow provenance-comment -- names what the predicate protects
  * recorded review input. Nothing caught it — the sweep reported it as
  * "4 ref(s) migrated", which reads like success.
  */
@@ -346,7 +346,7 @@ function _escapeRe(v: string): string {
  * bare `- <name>` item inside the `relates:` block, which is a declaration the
  * author made deliberately. A mention anywhere else in the file does not count.
  */
-function _relatesTo(text: string, slug: string): boolean {
+export function _relatesTo(text: string, slug: string): boolean {
     const lines = text.split('\n');
     const start = lines.findIndex((l) => /^relates:/.test(l));
     if (start === -1) return false;
@@ -654,7 +654,7 @@ function _regen_dashboard(root: string, dry_run: boolean): void {
 /**
  * Rebuild the archive index after a move, when the builder is present.
  *
- * The sweep is the one operation that changes what `agents/roadmaps/archive/`
+ * The sweep is the one operation that changes what `agents/roadmaps/archive/` code-comment-allow provenance-comment -- the directory this function writes
  * contains, so it is the one operation that can leave the generated index
  * stale — and the drift gate on that index runs in the same PR the sweep runs
  * in. Regenerating here keeps the two from disagreeing by construction rather

package/dist/agent-src/scripts/guarded_baseline.ts

@@ -226,9 +226,18 @@ export function guardedBaselineProblems(items: readonly GuardedBaselineItem[]):
  *
  * HONEST SCOPE. Only a PATH trigger is machine-checkable: a token containing `/`
  * is resolved against the repo root and stale iff it exists. A bare symbol name
- * cannot be decided from a path, so it is returned as `unverifiable` rather than
- * silently reading as "not stale" — an unchecked trigger that looks checked is
- * the failure this whole state exists to avoid.
+ * cannot be decided from a path, so a record carrying ONLY symbol tokens is
+ * returned as `unverifiable` rather than silently reading as "not stale" — an
+ * unchecked trigger that looks checked is the failure this whole state exists
+ * to avoid.
+ *
+ * A record whose trigger carries AT LEAST ONE path token is decided by that
+ * path and is NOT reported as unverifiable, even when a companion symbol token
+ * sits beside it. Reporting it would be the mirror of the failure above: a
+ * checked trigger that looks unchecked. Measured 2026-09-01 — three of the four
+ * lines the dashboard printed as "not machine-checkable" carried a path token
+ * and were therefore already decidable, which is noise that trains a reader to
+ * skip the section where the one genuinely undecidable trigger also lives.
  */
 export function guardedBaselineStaleness(
     items: readonly GuardedBaselineItem[],
@@ -241,16 +250,22 @@ export function guardedBaselineStaleness(
         if (trigger === '') {
             continue;
         }
-        for (const token of trigger.split(/[\s,]+/).filter((t) => t !== '')) {
-            if (!token.includes('/')) {
-                unverifiable.push(`line ${it.line} (${it.label}): recheck_when \`${token}\``);
-            } else if (fs.existsSync(path.join(repo_root, token))) {
+        const tokens = trigger.split(/[\s,]+/).filter((t) => t !== '');
+        const paths = tokens.filter((t) => t.includes('/'));
+        for (const token of paths) {
+            if (fs.existsSync(path.join(repo_root, token))) {
                 stale.push(
                     `line ${it.line} (${it.label}): recheck_when \`${token}\` now exists — ` +
                         're-verify against the real mechanism',
                 );
             }
         }
+        if (paths.length > 0) {
+            continue;
+        }
+        for (const token of tokens) {
+            unverifiable.push(`line ${it.line} (${it.label}): recheck_when \`${token}\``);
+        }
     }
     return { stale, unverifiable };
 }

package/dist/agent-src/scripts/stubs_due.ts

@@ -66,6 +66,48 @@ export interface StubRecord {
     owner_decisions: number;
     overdue: boolean;
     days_overdue: number | null;
+    /** Frontmatter `design_validated:` — a citation, or null when absent. */
+    design_validated: string | null;
+    /** Frontmatter `capability_gap:` — `none` means the stub declares no gap. */
+    capability_gap: string | null;
+    /** Frontmatter `blocker_class:` — `estate` | `budget` | `product`. */
+    blocker_class: string | null;
+    /** Frontmatter `blocker_opened:` — ISO date the hold began, or null. */
+    blocker_opened: string | null;
+    /** Releases published since `blocker_opened`, or null when it is absent. */
+    releases_since_blocked: number | null;
+    /** All three membership conditions hold. See {@link BLOCKED_QUICKWIN_FIELDS}. */
+    blocked_quickwin: boolean;
+}
+
+/**
+ * The three frontmatter keys that decide fourth-bucket membership.
+ *
+ * Read as SCALARS, never as substrings of the body. A substring match over
+ * prose is what put a validated fix and a waiting preference into one bucket
+ * in the first place; doing it with three substrings instead of one would be
+ * worse, not better. A stub missing any of the three is not a member and falls
+ * through to the OWNER bucket exactly as before — absence is never a member.
+ */
+export const BLOCKED_QUICKWIN_FIELDS = ['design_validated', 'capability_gap', 'blocker_class'] as const;
+
+/** Blocker classes that make a stub a BLOCKED QUICK-WIN rather than a product wait. */
+export const QUICKWIN_BLOCKER_CLASSES = ['estate', 'budget'] as const;
+
+/**
+ * All three conditions, read from frontmatter only.
+ *
+ * A recorded design validation, an explicit `capability_gap: none`, and an open
+ * blocker that is an estate or budget decision rather than a product one.
+ */
+export function is_blocked_quickwin(
+    design_validated: string | null,
+    capability_gap: string | null,
+    blocker_class: string | null,
+): boolean {
+    if (design_validated === null || design_validated === '') return false;
+    if (capability_gap !== 'none') return false;
+    return (QUICKWIN_BLOCKER_CLASSES as readonly string[]).includes(blocker_class ?? '');
 }
 
 function _isDir(p: string): boolean {
@@ -188,7 +230,48 @@ function _parseIso(s: string): Date | null {
 
 /** Read every stub and classify it. `today` is injectable so tests are stable. */
 export function scan(root: string, today: string): StubRecord[] {
-    return scan_dir(path.join(root, STUB_DIR), today);
+    return scan_dir(path.join(root, STUB_DIR), today, release_dates(root));
+}
+
+/**
+ * Changelog files that carry released sections, newest era first.
+ *
+ * BOTH are read, and that is the whole point of the pair. The era split moved
+ * older releases into the archive, so a count taken over the current file alone
+ * silently reports zero for anything before the split — measured: 14.11.0 lives
+ * only in the archive, and grepping `CHANGELOG.md` for it returns nothing.
+ */
+export const CHANGELOG_ERAS = ['CHANGELOG.md', 'docs/archive/CHANGELOG-pre-14.12.0.md'] as const;
+
+/** `## [x.y.z](…) (YYYY-MM-DD)` — a released section heading with its date. */
+const RELEASE_HEADING = /^## \[\d+\.\d+\.\d+\][^\n]*\((\d{4}-\d{2}-\d{2})\)\s*$/gm;
+
+/** Every released section's date across both eras, unsorted. */
+export function release_dates(root: string): string[] {
+    const out: string[] = [];
+    for (const rel of CHANGELOG_ERAS) {
+        let text: string;
+        try {
+            text = fs.readFileSync(path.join(root, rel), 'utf8');
+        } catch {
+            continue;
+        }
+        for (const m of text.matchAll(RELEASE_HEADING)) {
+            if (m[1] !== undefined) out.push(m[1]);
+        }
+    }
+    return out;
+}
+
+/**
+ * Releases published strictly AFTER the day the hold began.
+ *
+ * Strictly after, because a release cut on the same day cannot have carried a
+ * fix the hold was blocking — counting it would inflate the figure the
+ * council's falsifier is read against.
+ */
+export function releases_since(opened: string, dates: readonly string[]): number {
+    return dates.filter((d) => d > opened).length;
 }
 
 /**
@@ -198,7 +281,11 @@ export function scan(root: string, today: string): StubRecord[] {
  * immediately re-join — a fragile round trip past exactly the directory both
  * callers care about.
  */
-export function scan_dir(base: string, today: string): StubRecord[] {
+export function scan_dir(
+    base: string,
+    today: string,
+    releaseDates: readonly string[] = [],
+): StubRecord[] {
     if (!_isDir(base)) return [];
     const now = _parseIso(today);
     const out: StubRecord[] = [];
@@ -222,6 +309,10 @@ export function scan_dir(base: string, today: string): StubRecord[] {
         const review_by = _scalar(front, 'review_by');
         const reviewed_at = _scalar(front, 'reviewed_at');
         const probeVal = _scalar(front, 'probe');
+        const design_validated = _scalar(front, 'design_validated');
+        const capability_gap = _scalar(front, 'capability_gap');
+        const blocker_class = _scalar(front, 'blocker_class');
+        const blocker_opened = _scalar(front, 'blocker_opened');
         const shape: StubShape = text.includes(TRANSFER_MARKER) ? 'transfer' : 'orgmode';
         let overdue = false;
         let days_overdue: number | null = null;
@@ -242,6 +333,13 @@ export function scan_dir(base: string, today: string): StubRecord[] {
             owner_decisions: count_owner_decisions(text),
             overdue,
             days_overdue,
+            design_validated,
+            capability_gap,
+            blocker_class,
+            blocker_opened,
+            releases_since_blocked:
+                blocker_opened === null ? null : releases_since(blocker_opened, releaseDates),
+            blocked_quickwin: is_blocked_quickwin(design_validated, capability_gap, blocker_class),
         });
     }
     return out;
@@ -251,6 +349,8 @@ export interface Counts {
     overdue: number;
     owner_decisions: number;
     missing_review_by: number;
+    /** ADDITIVE 2026-09-01. Existing keys are unchanged in name, type and meaning. */
+    blocked_quickwin: number;
     total: number;
 }
 
@@ -259,6 +359,7 @@ export function counts(records: StubRecord[]): Counts {
         overdue: records.filter((r) => r.overdue).length,
         owner_decisions: records.reduce((s, r) => s + r.owner_decisions, 0),
         missing_review_by: records.filter((r) => r.review_by === null).length,
+        blocked_quickwin: records.filter((r) => r.blocked_quickwin).length,
         total: records.length,
     };
 }
@@ -328,6 +429,21 @@ export function main(argv: readonly string[] = process.argv.slice(2)): number {
         }
     }
 
+    const quickwins = records.filter((r) => r.blocked_quickwin);
+    if (quickwins.length > 0) {
+        process.stdout.write(
+            `\n  🔓  ${quickwins.length} BLOCKED QUICK-WIN(S) — design validated, no capability gap,\n` +
+                '      held by an estate or budget decision rather than a product one:\n',
+        );
+        for (const r of quickwins) {
+            const since =
+                r.releases_since_blocked === null
+                    ? 'no `blocker_opened:`'
+                    : `${String(r.releases_since_blocked)} release(s) since ${r.blocker_opened}`;
+            process.stdout.write(`      ${r.file}  (${r.blocker_class}, ${since})\n`);
+        }
+    }
+
     const noProbe = records.filter((r) => !r.probe_none && !r.has_probe_heading);
     if (noProbe.length > 0) {
         process.stdout.write(

package/dist/agent-src/scripts/update_roadmap_progress.ts

@@ -12,7 +12,7 @@
  * `archive_completed_roadmaps` can consume it the same way Python does. snake_case
  * is kept on the public surface.
  *
- * Scans every roadmap under `agents/roadmaps/` (excluding `archive/`, `skipped/`,
+ * Scans every roadmap under `agents/roadmaps/` (excluding `archive/`, `skipped/`,  code-comment-allow provenance-comment -- the path is this script's operand, not where the code came from
  * `template.md`, `README.md`, `open-questions*.md`), counts checkbox states per
  * phase, and writes a dashboard at `agents/roadmaps-progress.md` (outside the
  * `roadmaps/` folder to keep it clean) with:
@@ -96,7 +96,7 @@ const EXCLUDE_DIRS: ReadonlySet<string> = new Set(['archive', 'skipped', 'stubs'
 
 // FRONTMATTER_RE = re.compile(r"\A---\n(.*?)\n---\s*\n", re.DOTALL)
 const FRONTMATTER_RE = /^---\n([\s\S]*?)\n---[ \t\n\r\f\v]*\n/;
-const DRAFT_VALUES: ReadonlySet<string> = new Set(['draft']);
+const UNSCHEDULED_VALUES: ReadonlySet<string> = new Set(['draft', 'carrier']);
 
 const MERGE_GATED_RE = /merge-gated/i;
 // PR_NUM_RE = re.compile(r"pr\s*[=#:]?\s*#?\s*(\d+)", re.IGNORECASE)
@@ -289,8 +289,8 @@ function _stripQuotes(s: string): string {
     return out;
 }
 
-function is_draft(fm: Record<string, string>): boolean {
-    return DRAFT_VALUES.has((fm['status'] ?? '').toLowerCase());
+function is_unscheduled(fm: Record<string, string>): boolean {
+    return UNSCHEDULED_VALUES.has((fm['status'] ?? '').toLowerCase());
 }
 
 /**
@@ -752,7 +752,7 @@ function collect(roadmap_root: string): RoadmapStats[] {
             continue;
         }
         const text = fs.readFileSync(p, { encoding: 'utf-8' });
-        if (is_draft(parse_frontmatter(text))) {
+        if (is_unscheduled(parse_frontmatter(text))) {
             continue;
         }
         const stats = parse_roadmap(p, roadmap_root);
@@ -820,7 +820,7 @@ function collect_parked(roadmap_root: string): ParkedRoadmap[] {
         } catch {
             continue;
         }
-        if (is_draft(parse_frontmatter(text))) {
+        if (is_unscheduled(parse_frontmatter(text))) {
             continue;
         }
         const cell = resume_cell(text);
@@ -1305,7 +1305,7 @@ function _parseArgs(argv: readonly string[]): Args {
 }
 
 /**
- * When the default cwd carries no `agents/roadmaps/`, fall back to the git
+ * When the default cwd carries no `agents/roadmaps/`, fall back to the git  code-comment-allow provenance-comment -- the path is this script's operand, not where the code came from
  * toplevel — hook and IDE invocations often run from a subdirectory, and a
  * cwd-only resolution silently skipped the dashboard there. An explicit
  * `--repo-root` always wins; a cwd that has the directory is used as-is
@@ -1479,7 +1479,7 @@ export {
     TITLE_RE,
     FRONTMATTER_RE,
     parse_frontmatter,
-    is_draft,
+    is_unscheduled,
     is_roadmap_candidate,
     count_checkboxes,
     parse_blockers,

package/dist/agent-src/templates/agents/agent-project-settings.example.yml

@@ -39,7 +39,7 @@ schema_version: 1
 # CI guard: a release bump of `package.json` must update this value
 # in lockstep — see scripts/check_template_pin_drift.ts (road-to-
 # portable-runtime-and-update-check P3.3).
-agent_config_version: "14.13.0"
+agent_config_version: "14.14.1"
 
 # --- Project identity ---
 project:

package/dist/cli/registry.js

@@ -77,6 +77,7 @@ export const REGISTRY = [
     { name: 'hooks:install', disposition: 'delegate', synopsis: 'Install the combined pre-commit hook.' },
     { name: 'hooks:status', disposition: 'delegate', synopsis: 'Print the runtime hook matrix (per-platform install + bindings).' },
     { name: 'hooks:doctor', disposition: 'delegate', synopsis: 'Diagnose hook health: concerns, posture, missing trampolines (read-only).' },
+    { name: 'hooks:effect', disposition: 'delegate', synopsis: 'Does a bound concern actually FIRE here? Sandboxed synthetic dispatch per concern; five per-concern states, four host verdicts (read-only).' },
     { name: 'routing:doctor', disposition: 'delegate', synopsis: 'Live routing diagnosis: per-gate ACTIVE/INACTIVE with reason, chain, freshness, orchestration state (read-only).' },
     { name: 'workspace:doctor', disposition: 'delegate', synopsis: 'Workspace identity with provenance (repo root, main worktree, current worktree, branch, PR base) + session claim and worktree pressure (read-only).' },
     { name: 'route:explain', disposition: 'delegate', synopsis: 'Deterministic rule-routing trace for one prompt: matched triggers, tier, disposition, budget, rejected candidates (trigger-match level only).' },