@event4u/agent-config 14.13.0 → 14.14.1

package/src/scripts/check_estate_count.ts

@@ -47,7 +47,7 @@
  * or merges one in the same change — or the added file carries an explicit
  * `estate_offset_exempt:` reason in its frontmatter, which costs a visible line
  * in the diff of the very commit that claims it. This half is diff-scoped: it
- * reads `<base>...HEAD` over `agents/roadmaps/`, so on a branch that adds no
+ * reads `<base>...HEAD` over `agents/roadmaps/`, so on a branch that adds no  code-comment-allow provenance-comment -- the path is this script's operand, not where the code came from
  * roadmap it legitimately finds nothing to weigh.
  *
  * THE THREE WAYS THE ESTATE MAY LEGITIMATELY GROW
@@ -65,7 +65,7 @@
  *    estate rather than creating it, so it needs no authorisation; what the
  *    allowance does NOT cover is a `later/` file appearing from nowhere.
  * 3. **Anything else** — `estate_growth_exempt: <reason>` added, in this change,
- *    to the frontmatter of any roadmap under `agents/roadmaps/`. The canonical
+ *    to the frontmatter of any roadmap under `agents/roadmaps/`. The canonical  code-comment-allow provenance-comment -- the path is this script's operand, not where the code came from
  *    case is a blocker discovered while doing the work: `open_blockers` rises,
  *    nothing was archived, and the reason belongs next to the blocker.
  *
@@ -117,7 +117,7 @@
  * which one lied.
  *
  * The same function measures the BASE side, over a scratch copy of the base
- * ref's `agents/roadmaps/` (`_lib/base_tree.ts`). Re-deriving the floor with a
+ * ref's `agents/roadmaps/` (`_lib/base_tree.ts`). Re-deriving the floor with a  code-comment-allow provenance-comment -- the path is this script's operand, not where the code came from
  * second implementation would let the two sides disagree about one tree, which
  * is the failure this section already argues against, one level up.
  *
@@ -143,7 +143,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import {
     collect,
-    is_draft as isDraft,
+    is_unscheduled as isUnscheduled,
     is_roadmap_candidate as isRoadmapCandidate,
     parse_frontmatter as parseFrontmatter,
     parse_roadmap as parseRoadmap,
@@ -155,6 +155,8 @@ import { materialiseSubtree } from './_lib/base_tree.js';
 import { SKILLS_POSIX, measureSkillEstate } from './_lib/skill_estate.js';
 import { CONCERN_MANIFEST_POSIX, countConcerns } from './_lib/concern_estate.js';
 import { runGateCli, runSelfTest, type SelfTestCase } from './_lib/gate_self_test.js';
+import { countDeclaredCarriers, declaresCarrier } from './_lib/carrier_status.js';
+import { carrierEstateCases } from './_lib/estate_carrier_cases.js';
 
 const GATE = 'check_estate_count';
 const BUDGET_REL = path.join('src', 'config', 'estate-count-budget.json');
@@ -232,6 +234,63 @@ export interface EstateBudget {
      * number here is how it gets a threshold.
      */
     one_in_one_out: { applies_above_active: number | null };
+    /**
+     * The capped provisional-promotion path — specified, and DECLINED.
+     *
+     * READ ITS NULLS THE OTHER WAY ROUND FROM THE KEY ABOVE. There `null` means
+     * UNCONDITIONAL; here `max_live: null` and `expires_after_days: null` mean
+     * NOT REGISTERED, PATH INACTIVE. The two keys sit a few lines apart in one
+     * file and their nulls mean opposite things, so a reader who transfers the
+     * sibling's semantics reads a declined path as an uncapped one.
+     */
+    provisional_promotion: ProvisionalPromotion;
+}
+
+/**
+ * The `provisional_promotion` object as the budget file carries it.
+ *
+ * `status` is optional so that a file which registered the two integers without
+ * restating a status is still readable — the integers are what activate the
+ * path, and a declination that dropped its own marker would fall to
+ * `unregistered`, which is the safe direction.
+ */
+export interface ProvisionalPromotion {
+    status?: string;
+    max_live: number | null;
+    expires_after_days: number | null;
+}
+
+/**
+ * Three states, and the reason there are three rather than two.
+ *
+ * The 2026-09-01 council that declined the path attached one obligation to the
+ * decline: the checker must distinguish an intentional declination from missing
+ * configuration. Two states cannot — `null` would read the same either way, and
+ * "nobody has written this yet" would be indistinguishable from "this was
+ * specified in full and refused on 2026-09-01".
+ */
+export type ProvisionalPromotionState = 'declined' | 'unregistered' | 'registered';
+
+/**
+ * Classify the path's state. NEVER activates it, in any state.
+ *
+ * A half-registered object — one integer, one null — throws rather than
+ * resolving to either neighbour: a cap with no expiry and an expiry with no cap
+ * are different mechanisms, and guessing which half was meant is how a bounded
+ * path becomes an unbounded one by omission.
+ */
+export function provisionalPromotionState(pp: ProvisionalPromotion): ProvisionalPromotionState {
+    const live = pp.max_live;
+    const days = pp.expires_after_days;
+    if (typeof live === 'number' && typeof days === 'number') return 'registered';
+    if ((live === null) !== (days === null)) {
+        throw new Error(
+            `${BUDGET_REL} "provisional_promotion" is half-registered ` +
+                `(max_live=${JSON.stringify(live)}, expires_after_days=${JSON.stringify(days)}). ` +
+                'Both integers activate the path; both null leave it inactive. One of each is neither.',
+        );
+    }
+    return pp.status === 'declined' ? 'declined' : 'unregistered';
 }
 
 /** One gated count that rose above the floor measured at the base ref. */
@@ -305,6 +364,15 @@ export interface EstateVerdict {
     offsets: OffsetLedger | null;
     offsetSkipReason: string | null;
     unpaid: number;
+    /**
+     * The provisional-promotion path's state, reported and never acted on.
+     *
+     * Carried in the verdict so a `--json` consumer can tell a declined path
+     * from an unwritten one without re-reading the budget file, which is the
+     * distinction the 2026-09-01 decline was conditioned on. It contributes
+     * nothing to `withinBudget` in any state: reading is not activation.
+     */
+    provisionalPromotion: ProvisionalPromotionState;
     withinBudget: boolean;
 }
 
@@ -370,7 +438,39 @@ function countIn(roadmapRoot: string, sub: string): number {
     }
 }
 
-/** Non-draft roadmaps parked in `later/`, parsed for their blockers. */
+/**
+ * Top-level roadmaps `collect()` drops for declaring `status: carrier`, added
+ * back so that FLIPPING a status is count-neutral.
+ *
+ * Measured before this: flipping one file to `carrier` moved `active_roadmaps
+ * 3 → 2` and the gate printed "estate within its ratchet", because a count
+ * below the floor is a drawdown and free. The floor is measured at the base
+ * ref, so once such a flip merges the lowered number becomes the next floor —
+ * the file cannot be flipped back without paying, and any roadmap can be
+ * laundered out of the count by adding one word.
+ *
+ * A reclassification is not a disposal, so the metric counts the file on both
+ * sides. Same argument `open_blockers` makes below for spanning `later/`.
+ * Deleting a carrier is still a shrink and still earns no offset
+ * (`classifyDiff`); adding one is growth that takes the claim path.
+ *
+ * This is therefore the one roadmap metric that does NOT equal the dashboard
+ * header, stated here rather than left to be tripped over.
+ */
+function countActiveCarriers(roadmapRoot: string): number {
+    return countDeclaredCarriers(roadmapRoot, isRoadmapCandidate, fs, path.join);
+}
+
+/**
+ * Roadmaps parked in `later/` whose blockers count, parsed for them.
+ *
+ * Skips a draft AND a carrier, which is the same pair `collect()` skips on the
+ * active side. It used to skip only the draft, so parking a carrier moved its
+ * blockers INTO the gated count while the identical file at the top level kept
+ * them out — a ratchet verdict that moved on a relocation, for no stated
+ * reason. Three of the four status readers learned `carrier` when the status
+ * shipped; this is the fourth.
+ */
 function laterRoadmaps(roadmapRoot: string): Array<{ open_blockers: readonly unknown[] }> {
     const dir = path.join(roadmapRoot, 'later');
     let names: string[];
@@ -386,7 +486,7 @@ function laterRoadmaps(roadmapRoot: string): Array<{ open_blockers: readonly unk
         // `collect()` cannot be reused here: it filters through the same
         // path-based predicate and would reject its own root.
         const text = fs.readFileSync(abs, 'utf-8');
-        if (isDraft(parseFrontmatter(text))) continue;
+        if (isUnscheduled(parseFrontmatter(text))) continue;
         const stats = parseRoadmap(abs, dir);
         if (stats !== null) out.push(stats as unknown as { open_blockers: readonly unknown[] });
     }
@@ -396,8 +496,11 @@ function laterRoadmaps(roadmapRoot: string): Array<{ open_blockers: readonly unk
 /**
  * Count the estate, three ways.
  *
- * `active_roadmaps` comes from `collect()` so it cannot disagree with the
- * dashboard. `later_roadmaps` is a directory listing because parked files are
+ * `active_roadmaps` is `collect()` PLUS the top-level carriers `collect()`
+ * drops, so the parser is shared with the dashboard while a status flip stays
+ * count-neutral — see `countActiveCarriers` for why that beats parity here, and
+ * for the one number on this gate that the dashboard header does not print.
+ * `later_roadmaps` is a directory listing because parked files are
  * outside that corpus by design — filtered through the same `is_roadmap_candidate`
  * predicate as the active side, so `later/README.md` is not a roadmap here either.
  *
@@ -421,7 +524,7 @@ export function countEstate(repoRoot: string): EstateCounts {
         rows.reduce((n, r) => n + r.open_blockers.length, 0);
     const skills = measureSkillEstate(repoRoot);
     return {
-        active_roadmaps: stats.length,
+        active_roadmaps: stats.length + countActiveCarriers(roadmapRoot),
         later_roadmaps: countIn(roadmapRoot, 'later'),
         open_blockers: openOf(stats) + openOf(laterRoadmaps(roadmapRoot)),
         skill_count: skills.skill_count,
@@ -440,7 +543,7 @@ export function skillTokensExact(root: string): boolean {
     return measureSkillEstate(root).skill_description_tokens !== null;
 }
 
-/** `agents/roadmaps/<name>.md` — the active top level, never a subdirectory. */
+/** `agents/roadmaps/<name>.md` — the active top level. code-comment-allow provenance-comment -- operand, not provenance */
 function isActiveTopLevel(rel: string): boolean {
     const norm = rel.split(path.sep).join('/');
     if (!norm.startsWith('agents/roadmaps/') || !norm.endsWith('.md')) {
@@ -487,6 +590,9 @@ export function exemptionReason(text: string): string | null {
     return reason === '' ? null : reason;
 }
 
+/** Re-export; `_lib/carrier_status.ts` holds the one implementation. */
+export const isCarrierText = declaresCarrier;
+
 /**
  * Classify the change's effect on the active roadmap tree.
  *
@@ -495,7 +601,17 @@ export function exemptionReason(text: string): string | null {
  * `later/road-to-x.md` → `road-to-x.md` is an un-parking and counts as an
  * addition. A top-level-to-top-level rename is neither.
  */
-export function classifyDiff(nameStatus: string, readFile: (rel: string) => string | null): OffsetLedger {
+export function classifyDiff(
+    nameStatus: string,
+    readFile: (rel: string) => string | null,
+    /**
+     * The file's content at the BASE ref, for paths this change removed — a
+     * deleted carrier cannot be read from the working tree and its status
+     * decides whether the deletion earns an offset. Defaults to null, which
+     * reproduces the previous scoring for any caller without a pre-image.
+     */
+    readBase: (rel: string) => string | null = () => null,
+): OffsetLedger {
     const added: string[] = [];
     const offsets: string[] = [];
     const exempt: Array<{ file: string; reason: string }> = [];
@@ -508,8 +624,10 @@ export function classifyDiff(nameStatus: string, readFile: (rel: string) => stri
             const from = cols[1] ?? '';
             const to = cols[2] ?? '';
             if (isActiveTopLevel(from) && isDisposed(to)) {
-                offsets.push(from);
-                if (isParked(to)) parked.push(to);
+                if (!isCarrierText(readBase(from))) {
+                    offsets.push(from);
+                    if (isParked(to)) parked.push(to);
+                }
             } else if (isDisposed(from) && isActiveTopLevel(to)) {
                 added.push(to);
             }
@@ -520,7 +638,10 @@ export function classifyDiff(nameStatus: string, readFile: (rel: string) => stri
         if (status === 'A') {
             added.push(file);
         } else if (status === 'D') {
-            offsets.push(file);
+            // A carrier's removal is never an offset. See `readBase`.
+            if (!isCarrierText(readBase(file))) {
+                offsets.push(file);
+            }
         }
     }
     for (const file of added) {
@@ -587,6 +708,18 @@ export function evaluate(
     if (budget.one_in_one_out === undefined) {
         throw new Error(`${BUDGET_REL} carries no "one_in_one_out" object.`);
     }
+    // Same shape, same reason: an absent policy object is a could-not-run, not a
+    // pass. Here it also carries a second job — with the key required, "the path
+    // was declined on 2026-09-01" and "nobody has configured this" cannot
+    // collapse into the same reading, which is the condition the council
+    // attached to the decline.
+    if (budget.provisional_promotion === undefined) {
+        throw new Error(
+            `${BUDGET_REL} carries no "provisional_promotion" object. ` +
+                'Absent is misconfiguration, never an inactive path — a declination is recorded, not implied.',
+        );
+    }
+    const provisionalPromotion = provisionalPromotionState(budget.provisional_promotion);
 
     const counts = countEstate(repoRoot);
     const baseRef = opts.baseRef ?? resolveBaseRef(repoRoot);
@@ -699,13 +832,20 @@ export function evaluate(
         if (!diff.ok) {
             offsetSkipReason = `git diff against ${baseRef} failed — one-in-one-out not evaluated`;
         } else {
-            offsets = classifyDiff(diff.stdout, (rel) => {
-                try {
-                    return fs.readFileSync(path.join(repoRoot, rel), 'utf-8');
-                } catch {
-                    return null;
-                }
-            });
+            offsets = classifyDiff(
+                diff.stdout,
+                (rel) => {
+                    try {
+                        return fs.readFileSync(path.join(repoRoot, rel), 'utf-8');
+                    } catch {
+                        return null;
+                    }
+                },
+                (rel) => {
+                    const show = git(['show', `${baseRef}:${rel}`], repoRoot);
+                    return show.ok ? show.stdout : null;
+                },
+            );
         }
         const patch = git(
             ['diff', '--unified=0', '--find-renames', `${baseRef}...HEAD`, '--', ROADMAPS_REL],
@@ -790,6 +930,7 @@ export function evaluate(
         offsets,
         offsetSkipReason,
         unpaid,
+        provisionalPromotion,
         // No floor is a FAILURE, not a skip, and it is the one place this gate
         // convicts on a missing input. The other halves can report "unproven" and
         // still leave a meaningful verdict behind; the count half IS the verdict,
@@ -800,7 +941,7 @@ export function evaluate(
 }
 
 /** Floors for `--self-test`, declared here so a truncation is a visible diff. */
-const SELF_TEST_MIN_CASES = 12;
+const SELF_TEST_MIN_CASES = 13;
 const SELF_TEST_MIN_REJECT = 8;
 
 /**
@@ -825,11 +966,32 @@ function selfTest(): number {
      * the baseline with no reason" is not a state a change can reach.
      */
     const budgetJson = (): string =>
-        `${JSON.stringify({ one_in_one_out: { applies_above_active: null } }, null, 4)}\n`;
+        `${JSON.stringify(
+            {
+                one_in_one_out: { applies_above_active: null },
+                // Required since the path was specified and declined: the gate
+                // refuses a budget that carries no `provisional_promotion`, so a
+                // fixture without it exits 2 on every case rather than on the one
+                // case testing that refusal.
+                provisional_promotion: { status: 'declined', max_live: null, expires_after_days: null },
+            },
+            null,
+            4,
+        )}\n`;
 
     const roadmap = (name: string, extra = ''): string =>
         `# Roadmap: ${name}\n\n## Phase 1\n\n- [ ] **1.1** s\n${extra}`;
 
+    /** A `status: carrier` roadmap — counted as estate, and never an offset. */
+    const CARRIER = `---\nstatus: carrier\n---\n# Roadmap: carrier\n\n## Phase 1\n\n- [~] **1.1** s\n`;
+
+    /**
+     * A `status: draft` roadmap — invisible to `collect()`, so adding one cannot
+     * move `active_roadmaps`. That is what makes it the fixture for a case that
+     * must be decided by the offset scoring and by nothing else.
+     */
+    const DRAFT = `---\nstatus: draft\n---\n# Roadmap: draft\n\n## Phase 1\n\n- [ ] **1.1** s\n`;
+
     /** An open blocker — no `Status: resolved` prefix, so it counts as open. */
     const BLOCKER = '\n## Blockers\n\n### Blocker: fixture\n\n- **Status:** open\n';
 
@@ -1035,6 +1197,14 @@ function selfTest(): number {
                     after: (dir) => write(dir, 'agents/roadmaps/later/road-to-parked.md', roadmap('P')),
                 }),
         },
+        ...carrierEstateCases({
+            fixture,
+            write,
+            remove: (dir, rel) => fs.rmSync(path.join(dir, rel)),
+            roadmap,
+            CARRIER,
+            DRAFT,
+        }),
         {
             name: 'a new open blocker with no claim → reject',
             expect: 'reject',
@@ -1160,7 +1330,7 @@ export function main(argv: string[] = process.argv.slice(2)): number {
         return 2;
     }
 
-    // A ratchet over an empty estate always passes. Move `agents/roadmaps/` and
+    // A ratchet over an empty estate always passes. Move `agents/roadmaps/` and  code-comment-allow provenance-comment -- the path is this script's operand, not where the code came from
     // every count is 0, which is trivially under any baseline — exit 2 (could
     // not run), never 1, which would assert the estate actually grew.
     try {
@@ -1237,6 +1407,17 @@ export function main(argv: string[] = process.argv.slice(2)): number {
     } else if (verdict.offsetSkipReason !== null) {
         process.stdout.write(`  ⚠️  ${verdict.offsetSkipReason}\n`);
     }
+    // Printed unconditionally so the state is visible without `--json`. It never
+    // changes the exit code — a declined path and a registered one both leave
+    // the ratchet exactly as it was, and the allowance a registered path would
+    // grant is deliberately unwired (the owner registers the numbers; wiring
+    // what they buy is a separate, separately authorised change).
+    process.stdout.write(
+        `  ${'provisional'.padEnd(18)} ${verdict.provisionalPromotion.padStart(5)}` +
+            `${verdict.provisionalPromotion === 'declined' ? '  (specified and declined 2026-09-01 — path inactive by decision)' : ''}` +
+            `${verdict.provisionalPromotion === 'unregistered' ? '  (no numbers registered — path inactive)' : ''}` +
+            `${verdict.provisionalPromotion === 'registered' ? '  (numbers registered by the owner; this gate grants no allowance for them)' : ''}\n`,
+    );
     for (const c of verdict.claims) {
         process.stdout.write(`  ↑ growth claimed in ${c.file}: ${c.reason.slice(0, 120)}\n`);
     }

package/src/scripts/check_release_highlights.ts

@@ -18,7 +18,33 @@
  * `_none_` everywhere. That removes the guaranteed first-run red (9.17.0,
  * 9.18.0) without blunting this gate: a machine-written `_none_` was never the
  * failure it was built for — a HUMAN writing one was (9.13.0, 9.14.0), and that
- * still fails here. An unrewritten derived line warns; it never blocks.
+ * still fails here.
+ *
+ * ## REVERSED 2026-09-01 — an unrewritten derived line now BLOCKS
+ *
+ * This header used to end the paragraph above with *"An unrewritten derived
+ * line warns; it never blocks."* That is no longer the behaviour, and the
+ * sentence is replaced rather than deleted so the reversal is legible.
+ *
+ * **The premise was never wrong; the conclusion drawn from it was.** A derived
+ * line does carry true evidence — the deriving reason plus citing SHAs — so it
+ * is not false-if-shipped. What the advisory conclusion assumed is that
+ * "unpolished-if-unedited" would in fact get edited. Measured at `b50b27281`,
+ * it did not: `_auto-derived, rewrite before merge:_` shipped in FIVE
+ * consecutive released sections — 14.9.0 (4 lines), 14.10.0 (2), 14.11.0 (4),
+ * 14.12.0 (4), 14.13.0 (4), eighteen lines in total. A warning that has been
+ * ignored eighteen times is not a warning; it is a comment.
+ *
+ * **Instructing authority:** the maintainer, in the closing instruction of the
+ * 2026-09-a inbox round, requiring that the release-placeholder defect be taken
+ * into a roadmap and fixed. Carried into
+ * `agents/roadmaps/archive/road-to-publication-integrity-hard-fail.md` § Phase 1, which
+ * is the record of this change.
+ *
+ * **What did NOT change.** The read stays scoped to the section under release
+ * (`extract_changelog_section` below), so the eighteen historical lines cannot
+ * red a future release; a filled field is still never judged for prose quality;
+ * and the `_none_` contradiction check is untouched.
  *
  * Derivation is deliberately conservative (documented per-label below):
  * a false red makes every release annoying; a miss only returns the head to
@@ -29,7 +55,8 @@
  *       [--changelog <path>]
  *
  * `--from` defaults to the latest reachable release tag before `--to`
- * (default HEAD). Exit codes: 0 plausible · 1 contradiction · 2 usage error.
+ * (default HEAD). Exit codes: 0 plausible · 1 refusal (an unrewritten
+ * auto-derived head line, or a `_none_` contradiction) · 2 usage error.
  */
 import * as fs from 'node:fs';
 import * as path from 'node:path';
@@ -37,6 +64,7 @@ import process from 'node:process';
 import { fileURLToPath } from 'node:url';
 
 import {
+    DERIVED_MARKER,
     HEAD_LABELS,
     HEAD_NONE,
     type SpanCommit,
@@ -46,7 +74,10 @@ import {
     previous_release_tag,
     stale_draft_labels,
 } from './_lib/release_highlights.js';
-import { extract_changelog_section } from './_lib/release_material.js';
+import {
+    CURATED_HEAD_INSTRUCTION,
+    extract_changelog_section,
+} from './_lib/release_material.js';
 import { assertScanned, assertWatchlistResolves, DeadScopeError } from './_lib/scan_scope.js';
 
 const _HERE = fileURLToPath(import.meta.url);
@@ -116,9 +147,17 @@ export function highlight_contradictions(
 
 /**
  * Exported so the advisory-vs-blocking decision is a fixture, not a claim.
+ *
+ * CORRECTED 2026-09-01 with the reversal. This comment used to say that
  * `stale_draft_labels` firing while the exit code stays 0 is the behaviour the
- * cadence blocker adjudicates; pinning it here makes either branch of that
- * decision a one-line diff with a test that notices.
+ * cadence blocker adjudicates. That is no longer what happens — the branch at
+ * the call site returns 1 — and the sentence is replaced rather than deleted
+ * because it was the load-bearing claim on the other side.
+ *
+ * What it got RIGHT is worth keeping: the decision was a one-line diff with a
+ * test that notices, and the reversal proved it. The two fixtures that pinned
+ * the advisory branch were updated in place, not deleted, so the change of
+ * contract reads off the diff.
  */
 export function main(argv: readonly string[]): number {
     let version: string | null = null;
@@ -171,6 +210,33 @@ export function main(argv: readonly string[]): number {
         process.stderr.write(`CHANGELOG carries no section for ${version}\n`);
         return 2;
     }
+    // A LEAKED AUTHORING INSTRUCTION REFUSES THE RELEASE (roadmap § 2.2).
+    //
+    // A different mechanism from the marker check below: that one catches an
+    // unpolished claim, this one catches a reminder to the releaser that was
+    // never meant to be release content at all. `CHANGELOG.md` is the bare
+    // entry in `package.json` `files`, so a comment surviving here is
+    // published to npm — it did, twice, before Option A stopped the writer
+    // emitting it.
+    //
+    // SAME SCOPE as the marker check, and for the same reason: `section` is
+    // the ONE section `extract_changelog_section` cut for `--version`. A
+    // historical section carrying the identical comment is not read here and
+    // does not block this release. Detection is the named sentinel, never a
+    // shape match over comment prose.
+    if (section.body.includes(CURATED_HEAD_INSTRUCTION)) {
+        process.stderr.write(
+            `❌  the ${version} section still carries the generator's authoring instruction ` +
+                `(\`${CURATED_HEAD_INSTRUCTION}\`).\n` +
+                '    It is a reminder to the releaser, not release content, and CHANGELOG.md ' +
+                'is published to npm.\n' +
+                `    Delete that comment line from the ${version} section. Only that section is ` +
+                'read; historical\n' +
+                '    sections carrying the same comment are out of scope and do not block this ' +
+                'release.\n',
+        );
+        return 1;
+    }
     const curated = parse_curated_head(section.body);
     if (!curated) {
         process.stdout.write(`ℹ️  no curated head in the ${version} section — nothing to check\n`);
@@ -199,19 +265,52 @@ export function main(argv: readonly string[]): number {
             'could contradict. Deleting the scan root is not the same state — that is the ' +
             'throwing branch, not this one.',
     });
-    // A generator-derived line that nobody rewrote is a prose gap, never a
-    // contradiction: the line's evidence is true, it is just unpolished. Warn
-    // so the omission is visible, and keep the exit code owned solely by the
-    // `_none_` check — a warning that reds the build is the guaranteed-red
-    // failure mode this whole change exists to remove.
+    // A generator-derived line that nobody rewrote REFUSES the release.
+    //
+    // REVERSED 2026-09-01. This block used to warn and return the exit code to
+    // the `_none_` check alone, on the reasoning that a derived line is true
+    // and merely unpolished. The reasoning still holds and the conclusion does
+    // not: the warning was emitted and ignored through five consecutive
+    // released sections. See this file's header for the full record and the
+    // instructing authority.
+    //
+    // SCOPE, and it is the load-bearing half (roadmap § 1.3): `curated` comes
+    // from `parse_curated_head(section.body)` above, and `section` is the ONE
+    // section `extract_changelog_section` cut for `--version`. No read here
+    // reaches another section, another era file, or `docs/archive/`. That is
+    // what keeps eighteen historical marker lines from turning this into a
+    // permanent red on every future release.
+    const derived = derive_categories(span);
     const drafts = stale_draft_labels(curated);
     if (drafts.length > 0) {
-        process.stdout.write(
-            `⚠️  auto-derived head line(s) not yet rewritten for ${version}: ` +
-                `${drafts.join(', ')} — advisory, not blocking.\n`,
+        process.stderr.write(
+            `❌  unrewritten auto-derived head line(s) in the ${version} section: ` +
+                `${drafts.join(', ')}\n` +
+                `    Each still carries \`${DERIVED_MARKER}\` — the generator's draft, not a ` +
+                'curated claim.\n' +
+                `    Rewrite those line(s) in the ${version} section of the changelog. Only that ` +
+                'section is read;\n' +
+                '    historical sections carrying the same marker are out of scope and do not ' +
+                'block this release.\n',
         );
+        // The evidence, not just the verdict. The draft line cites SHAs and a
+        // deriving reason; what a releaser needs in order to write the real
+        // claim is the SUBJECT behind each SHA, and looking eleven of them up
+        // by hand is the friction that made this refusal cheaper to ignore
+        // than to satisfy across five releases. The `_none_` branch below has
+        // printed its evidence since it was built; this one now matches it.
+        for (const label of drafts) {
+            const hits = derived[label] ?? [];
+            if (hits.length === 0) {
+                continue;
+            }
+            process.stderr.write(`    - **${label}:** derived from\n`);
+            for (const e of hits) {
+                process.stderr.write(`        ${e}\n`);
+            }
+        }
+        return 1;
     }
-    const derived = derive_categories(span);
     const contradictions = highlight_contradictions(curated, derived);
     if (contradictions.length === 0) {
         process.stdout.write(`✅  curated head plausible for ${version} (span ${from}..${to})\n`);

package/src/scripts/check_roadmap_trackable.ts

@@ -15,7 +15,7 @@
  * (Python-only); these pure regex/parse helpers are replicated here
  * byte-for-byte from that module. Keep in lock-step with it.
  *
- * Every non-draft file under `agents/roadmaps/` (excluding `archive/`,
+ * Every non-draft file under `agents/roadmaps/` (excluding `archive/`,  code-comment-allow provenance-comment -- the path is this script's operand, not where the code came from
  * `skipped/`, template/README/open-questions) MUST:
  *   1. Be parseable by the dashboard's `PHASE_RE` (>= one `## Phase <id>`).
  *   2. Have at least one trackable checkbox under every parsed phase.
@@ -49,6 +49,15 @@ const PHASE_RE =
 // FRONTMATTER_RE = re.compile(r"\A---\n(.*?)\n---\s*\n", re.DOTALL)
 const FRONTMATTER_RE = /^---\n([\s\S]*?)\n---\s*\n/;
 const DRAFT_VALUES: ReadonlySet<string> = new Set(['draft']);
+/**
+ * A carrier holds obligations deferred out of an archived parent. It is not
+ * schedulable work — every item in it has an unmet resumption trigger — and it
+ * has no `## Phase` headings by construction, so it is skipped exactly where a
+ * draft is. It differs from a draft in what protects it: a draft may be deleted
+ * freely, a carrier may not, and `lint_carrier_integrity` reds when one loses
+ * its receiver.
+ */
+const CARRIER_VALUES: ReadonlySet<string> = new Set(['carrier']);
 
 const EXCLUDE_NAMES: ReadonlySet<string> = new Set([
     'template.md',
@@ -92,6 +101,11 @@ function is_draft(fm: Map<string, string>): boolean {
     return DRAFT_VALUES.has((fm.get('status') ?? '').toLowerCase());
 }
 
+/** True for a `status: carrier` roadmap — see CARRIER_VALUES. */
+function is_carrier(fm: Map<string, string>): boolean {
+    return CARRIER_VALUES.has((fm.get('status') ?? '').toLowerCase());
+}
+
 /** Mirror update_roadmap_progress.is_roadmap_candidate (POSIX path parts). */
 function is_roadmap_candidate(p: string): boolean {
     const name = path.basename(p);
@@ -168,7 +182,7 @@ function find_active_roadmaps(root: string): string[] {
             continue;
         }
         const text = fs.readFileSync(p, 'utf-8');
-        if (is_draft(parse_frontmatter(text))) {
+        if (is_draft(parse_frontmatter(text)) || is_carrier(parse_frontmatter(text))) {
             continue;
         }
         out.push(p);
@@ -345,6 +359,7 @@ export {
     CHECKBOX_RE,
     PHASE_RE,
     is_draft,
+    is_carrier,
     is_roadmap_candidate,
     parse_frontmatter,
     find_active_roadmaps,