@event4u/agent-config 14.14.0 → 14.15.0

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@event4u/agent-config",
     "mcpName": "io.github.event4u-app/agent-config",
-    "version": "14.14.0",
+    "version": "14.15.0",
     "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including the counts in these badges.",
     "license": "MIT",
     "private": false,

package/src/config/assurance-capability-registry.json

@@ -6,7 +6,7 @@
   "registered_at": "2026-08-23",
   "grader": {
     "path": "src/scripts/grade_target_readiness.ts",
-    "dimensions": 10,
+    "dimensions": 13,
     "knockouts": [
       "test-presence",
       "static-analysis",

package/src/config/evaluator-budgets.json

@@ -58,11 +58,11 @@
       "deterministic": false
     },
     "cli_help_command_count": {
-      "max": 109,
-      "last_measured": 109,
-      "last_measured_at": "2026-08-26",
+      "max": 110,
+      "last_measured": 110,
+      "last_measured_at": "2026-09-03",
       "method": "registry enumeration — count of `{ name: '...', disposition` entries in src/cli/registry.ts (NOT --help prose parsing; methods historically disagreed 74 vs 76 vs 79)",
-      "baseline_note": "80 → 81 on 2026-08-03 (release 9.15.0 gate). This RECORDS growth that already shipped through its own reviewed PR; it does not authorize new surface. The +1 is f02db54c2 (fix(cli): register routing:doctor in the CLI registry) — the command existed, only its registry entry was missing, and the registering PR did not move this budget. The gate did its job again: breach WARNS on main and BLOCKS on release, which is the conscious-decision point rather than a silently raised cap. Re-measured 2026-08-03 via the pinned method: 81. Headroom stays zero by design — the next registry addition must move this number in its own PR. 81 → 82 on 2026-08-04: the `handoff` subcommand (road-to-agent-handoff-resume Phase 4) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 82. 82 → 84 on 2026-08-04: the `route:explain` + `route:audit` verbs (routing-correctness validation surface) register in the same PR that adds the surface. Re-measured via the pinned method: 84. 84 → 85 on 2026-08-05: the `settings:set` verb (road-to-zero-ceremony-settings Phase 2 — the one agent-reachable settings writer) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 85. 85 → 86 on 2026-08-06: the `conformance:behavior` verb (road-to-agent-behavior-conformance Phase 5 — replays the local transcript store through the four mechanised conformance checks) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 86. 86 → 88 on 2026-08-07: the `sessions:list` + `sessions:claim` verbs (road-to-parallel-session-coordination — the shell surface of the shared session register, needed because /roadmap:next is command markdown and can only reach the register through a shell call) register in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 88. 88 → 89 on 2026-08-08: the `council:status` verb registers in the same PR that adds the surface, per this record's own contract. It exists because an agent in a consumer project announced \"kein Council konfiguriert (keine .agent-settings.yml)\" and substituted a weaker path while the council was configured user-globally the whole time — there was no verb that answered availability, so the only route was an inference from a filename, and the intuitive filename is the one location ADR-104 guarantees is never consulted. Re-measured via the pinned method: 89. 89 → 91 on 2026-08-08: the `self-repair:status` + `self-repair:release` verbs (the queued-defect reader and the single Hard-Floor-gated outward step of the self-repair loop — the loop is deliberately unable to publish unless a human runs the release command) register in the same PR that adds the surface, per this record's own contract. Landed alongside the +1 council:status move in the same branch. Re-measured via the pinned method: 91. 91 → 94 on 2026-08-08: the `packs:active`, `settings:get` and `mcp:available` verbs (road-to-capability-answerability Phase 2 — the three capability probes for the gaps that had none) register in the same PR that adds the surface, per this record's own contract. Each answers a question that was previously only inferable from a filename: which packs are active and from which file, what a setting resolves to and which file set it, and what is declared in mcp.json versus what can actually launch. 94 -> 95 in the same PR: `brand:status` (Phase 2.4 — brand-layer presence, which the rule depended on and no surface could answer). Re-measured twice via the pinned method on the unchanged tree: 95/95. 95 → 96 on 2026-08-10: the `session:recycle` verb (road-to-token-economy-recycling Phase 2.2 — the deterministic producer of the main-session recycle envelope; the recycle advisory names this exact verb, so it must exist as a shell surface) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 96. 96 -> 97 on 2026-08-10: the `gates` verb registers in the same PR that adds the surface, per this record's own contract. It exists because the blocker fields the dashboard already parses (Owner, What to do, Resolved when — CI-enforced by lint_roadmap_blockers) had no owner-filtered reader: the dashboard counts the open blockers across a 600-line file and links each to a per-roadmap anchor, so \"which of these are mine\" was a manual read of every anchor. The same inference-from-a-filename shape as the council:status entry above, one layer up. This branch and the session:recycle branch each measured 96 independently and landed on the same number for different verbs; the merge makes it 97, re-measured twice via the pinned method on the merged tree: 97/97. 97 -> 98 on 2026-08-15: the `workspace:doctor` verb (road-to-inbox-harvest-2026-08-c-workspace-identity Phase 3 — the read-only report over the new `workspaceIdentity()` resolver) registers in the same PR that adds the surface, per this record's own contract. It exists for the same inference-from-a-filename shape as the council:status and gates entries above, one layer down: the tree answered \"where am I\" in eight ad-hoc places across six files, and the 12.0.0 span shipped the same worktree misclassification twice, so no verb could be asked which checkout is the main one. Read-only by construction — the roadmap's Non-goals put worktree disposal out of scope and its Risk 3 names \"the pressure read becomes a disposal path by accident\" as the failure to design against, so the command carries no --fix and no --prune. Re-measured twice via the pinned method on the unchanged tree: 98/98. 98 -> 99 on 2026-08-17: the `council:quota` verb (road-to-council-quota-accounting-truth Phase 2) registers in the same PR that adds the surface, per this record's own contract. Exactly the inference-from-a-filename shape as the council:status entry above, one layer down: `cmd_quota` had existed in council_cli.ts and been reachable only via `scripts-run`, so the documented recovery path for an exhausted shared counter -- read the usage, reset one provider -- did not resolve through `agent-config`, and an operator debugging a quota failure met `unknown command`. The verb is read-only apart from the pre-existing `--reset <provider>`, which already required `--confirm`. Re-measured twice via the pinned method on the unchanged tree: 99/99. 99 -> 100 on 2026-08-19: the `decision:memo` verb (road-to-long-horizon-execution Phase 2.2, sequencing UOTL Phase 4.3 -- the decision-memo channel) registers in the same PR that adds the surface, per this record's own contract. It exists because the question ladder gained a rung between \"halt and ask\" and \"decide silently\": a resolution the run makes without contacting the operator is only legitimate if it is reviewable afterwards, and there was no surface that wrote such a record with a fixed shape. Write-and-list only, local-only (agents/runtime/ is gitignored), and it gates nothing -- the locked decision classes are refused at the config schema, never in the ledger. 100 -> 101 in the same PR: `run:supervise` (Phase 3.1 -- the out-of-process watcher for runs whose session died with open steps left). It is the operator-facing half of session continuity: nothing anywhere had the job of noticing that a claimed run stopped moving, so a roadmap 40% done and a roadmap finished looked identical from outside the dead session. Report-only by default and it NEVER merges, pushes or closes -- the auto-merge the reference design carries is a named rejection in the roadmap's harvest section, not an unbuilt feature. Re-measured twice via the pinned method on the unchanged tree: 101/101. 101 → 102 on 2026-08-22: the `adr:effective` verb (road-to-evidence-based-adr-governance step 2.2 — the effective-state projection over one decision record) registers in the same PR that adds the surface, per this record's own contract. It exists because current truth about an ADR was only reconstructable from linear prose: an agent had to read the body, then every amendment, and decide for itself which clauses still stand. The verb reports status, the Decision verbatim, clauses the record's own amendments superseded, active amendments, the three descriptive axes and the review-trigger state. It AUTHORIZES NOTHING — Phase 2 of that roadmap is titled \"surfacing only; no authority\" and its AC-7 forbids any authority consequence, so the verb reports an absent axis as absent (`— (no provenance axis)`, `— (ungraded)`, `absent → evidence`) and an unresolvable trigger as `indeterminate` rather than inferring one. Re-measured twice via the pinned method on the unchanged tree: 102/102. 102 → 104 on 2026-08-22: the `council:grant-billing` + `council:revoke-billing` verbs (road-to-billing-cliff-gate Phase 2 — the run-scoped billing grant that lets `ai_council.fallback.api_on_quota: 'ask'` be answered once per run instead of once per seat) register in the same PR that adds the surface, per this record's own contract. The two are a pair by construction rather than by convenience: a grant that can be issued and not revoked would outlive its run, which is the failure the run-scoped TTL exists to prevent. Re-measured via the pinned method: 104. 104 -> 106 on 2026-08-23: the `ui:audit` + `ui:render` verbs (road-to-frontend-power E2.1 and E3.1 -- the two Class-A commands that give the frontend obligations an artefact a gate can read and a render a verdict can cite) register in the same PR that adds the surface, per this record's own contract. The two are a pair by construction rather than by convenience: `ui-audit-gate`'s enforced_by moved from `none` to a carrier in the same change, and that carrier reports `verification: degraded` whenever the render artefact is absent -- so an audit verb without a render verb would ship a gate that can never reach `verified`. Both are Class A under ADR-124: they terminate, their whole state is a rebuildable directory under agents/runtime/state/, and ui:render closes chromium in a `finally` on every path with no --serve, watch or cache for a resident browser to hide in. Re-measured via the pinned method on the unchanged tree: 106. 106 → 107 on 2026-08-23: the `roadmap:context` verb (road-to-roadmap-situational-awareness — the single live probe that answers what else is in flight before a roadmap is picked) registers in the same PR that adds the surface, per this record's own contract. Its branch measured 105 against a base of 104 and this branch measured 106 against the same base for `ui:audit` + `ui:render`; the merge makes it 107, re-measured on the merged tree via the pinned method (registry enumeration): 107. 107 → 108 on 2026-08-26: the `roadmap:set-step` verb (road-to-skill-ecosystem-runtime-enforcement Phase 6 — the single sanctioned writer of a checkbox glyph) registers in the same PR that adds the surface, per this record's own contract. It exists because the glyph is written today by whatever edits the file, and a concurrent writer destroys work SILENTLY: the loser of an overwrite receives no error. The verb carries an advisory lock, a line-anchored edit that cannot span entries even in principle, a step-count invariant asserted against the LIVE pre-write file rather than an in-memory snapshot, and a post-write survival check. Re-measured via the pinned method (registry enumeration) on the unchanged tree: 108. 108 → 109 on 2026-08-26: the `stubs:due` verb (road-to-inbox-harvest-2026-08-f-owner-decision-queue step 2.1 — the read-only reader over `agents/roadmaps/stubs/` frontmatter) registers in the same PR that adds the surface, per this record's own contract. It exists because step 1.2 backfills a `review_by:` date into 77 parked files, and an AI council (2026-08-26, 2/2) made the ordering a RULE rather than a preference: dates without a reader are strictly worse than no dates, because a stale date certifies attention nobody paid. The verb is read-only by construction — it authors nothing under `agents/roadmaps/stubs/`, so `check_no_stub_inventory_table` stays green and unmodified, and `roadmap:progress` consumes only its two COUNTS for the dashboard header (two integers, no rows, nothing for the deleted index tables to grow back from). Re-measured via the pinned method (registry enumeration) on the unchanged tree: 109."
+      "baseline_note": "80 → 81 on 2026-08-03 (release 9.15.0 gate). This RECORDS growth that already shipped through its own reviewed PR; it does not authorize new surface. The +1 is f02db54c2 (fix(cli): register routing:doctor in the CLI registry) — the command existed, only its registry entry was missing, and the registering PR did not move this budget. The gate did its job again: breach WARNS on main and BLOCKS on release, which is the conscious-decision point rather than a silently raised cap. Re-measured 2026-08-03 via the pinned method: 81. Headroom stays zero by design — the next registry addition must move this number in its own PR. 81 → 82 on 2026-08-04: the `handoff` subcommand (road-to-agent-handoff-resume Phase 4) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 82. 82 → 84 on 2026-08-04: the `route:explain` + `route:audit` verbs (routing-correctness validation surface) register in the same PR that adds the surface. Re-measured via the pinned method: 84. 84 → 85 on 2026-08-05: the `settings:set` verb (road-to-zero-ceremony-settings Phase 2 — the one agent-reachable settings writer) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 85. 85 → 86 on 2026-08-06: the `conformance:behavior` verb (road-to-agent-behavior-conformance Phase 5 — replays the local transcript store through the four mechanised conformance checks) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 86. 86 → 88 on 2026-08-07: the `sessions:list` + `sessions:claim` verbs (road-to-parallel-session-coordination — the shell surface of the shared session register, needed because /roadmap:next is command markdown and can only reach the register through a shell call) register in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 88. 88 → 89 on 2026-08-08: the `council:status` verb registers in the same PR that adds the surface, per this record's own contract. It exists because an agent in a consumer project announced \"kein Council konfiguriert (keine .agent-settings.yml)\" and substituted a weaker path while the council was configured user-globally the whole time — there was no verb that answered availability, so the only route was an inference from a filename, and the intuitive filename is the one location ADR-104 guarantees is never consulted. Re-measured via the pinned method: 89. 89 → 91 on 2026-08-08: the `self-repair:status` + `self-repair:release` verbs (the queued-defect reader and the single Hard-Floor-gated outward step of the self-repair loop — the loop is deliberately unable to publish unless a human runs the release command) register in the same PR that adds the surface, per this record's own contract. Landed alongside the +1 council:status move in the same branch. Re-measured via the pinned method: 91. 91 → 94 on 2026-08-08: the `packs:active`, `settings:get` and `mcp:available` verbs (road-to-capability-answerability Phase 2 — the three capability probes for the gaps that had none) register in the same PR that adds the surface, per this record's own contract. Each answers a question that was previously only inferable from a filename: which packs are active and from which file, what a setting resolves to and which file set it, and what is declared in mcp.json versus what can actually launch. 94 -> 95 in the same PR: `brand:status` (Phase 2.4 — brand-layer presence, which the rule depended on and no surface could answer). Re-measured twice via the pinned method on the unchanged tree: 95/95. 95 → 96 on 2026-08-10: the `session:recycle` verb (road-to-token-economy-recycling Phase 2.2 — the deterministic producer of the main-session recycle envelope; the recycle advisory names this exact verb, so it must exist as a shell surface) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 96. 96 -> 97 on 2026-08-10: the `gates` verb registers in the same PR that adds the surface, per this record's own contract. It exists because the blocker fields the dashboard already parses (Owner, What to do, Resolved when — CI-enforced by lint_roadmap_blockers) had no owner-filtered reader: the dashboard counts the open blockers across a 600-line file and links each to a per-roadmap anchor, so \"which of these are mine\" was a manual read of every anchor. The same inference-from-a-filename shape as the council:status entry above, one layer up. This branch and the session:recycle branch each measured 96 independently and landed on the same number for different verbs; the merge makes it 97, re-measured twice via the pinned method on the merged tree: 97/97. 97 -> 98 on 2026-08-15: the `workspace:doctor` verb (road-to-inbox-harvest-2026-08-c-workspace-identity Phase 3 — the read-only report over the new `workspaceIdentity()` resolver) registers in the same PR that adds the surface, per this record's own contract. It exists for the same inference-from-a-filename shape as the council:status and gates entries above, one layer down: the tree answered \"where am I\" in eight ad-hoc places across six files, and the 12.0.0 span shipped the same worktree misclassification twice, so no verb could be asked which checkout is the main one. Read-only by construction — the roadmap's Non-goals put worktree disposal out of scope and its Risk 3 names \"the pressure read becomes a disposal path by accident\" as the failure to design against, so the command carries no --fix and no --prune. Re-measured twice via the pinned method on the unchanged tree: 98/98. 98 -> 99 on 2026-08-17: the `council:quota` verb (road-to-council-quota-accounting-truth Phase 2) registers in the same PR that adds the surface, per this record's own contract. Exactly the inference-from-a-filename shape as the council:status entry above, one layer down: `cmd_quota` had existed in council_cli.ts and been reachable only via `scripts-run`, so the documented recovery path for an exhausted shared counter -- read the usage, reset one provider -- did not resolve through `agent-config`, and an operator debugging a quota failure met `unknown command`. The verb is read-only apart from the pre-existing `--reset <provider>`, which already required `--confirm`. Re-measured twice via the pinned method on the unchanged tree: 99/99. 99 -> 100 on 2026-08-19: the `decision:memo` verb (road-to-long-horizon-execution Phase 2.2, sequencing UOTL Phase 4.3 -- the decision-memo channel) registers in the same PR that adds the surface, per this record's own contract. It exists because the question ladder gained a rung between \"halt and ask\" and \"decide silently\": a resolution the run makes without contacting the operator is only legitimate if it is reviewable afterwards, and there was no surface that wrote such a record with a fixed shape. Write-and-list only, local-only (agents/runtime/ is gitignored), and it gates nothing -- the locked decision classes are refused at the config schema, never in the ledger. 100 -> 101 in the same PR: `run:supervise` (Phase 3.1 -- the out-of-process watcher for runs whose session died with open steps left). It is the operator-facing half of session continuity: nothing anywhere had the job of noticing that a claimed run stopped moving, so a roadmap 40% done and a roadmap finished looked identical from outside the dead session. Report-only by default and it NEVER merges, pushes or closes -- the auto-merge the reference design carries is a named rejection in the roadmap's harvest section, not an unbuilt feature. Re-measured twice via the pinned method on the unchanged tree: 101/101. 101 → 102 on 2026-08-22: the `adr:effective` verb (road-to-evidence-based-adr-governance step 2.2 — the effective-state projection over one decision record) registers in the same PR that adds the surface, per this record's own contract. It exists because current truth about an ADR was only reconstructable from linear prose: an agent had to read the body, then every amendment, and decide for itself which clauses still stand. The verb reports status, the Decision verbatim, clauses the record's own amendments superseded, active amendments, the three descriptive axes and the review-trigger state. It AUTHORIZES NOTHING — Phase 2 of that roadmap is titled \"surfacing only; no authority\" and its AC-7 forbids any authority consequence, so the verb reports an absent axis as absent (`— (no provenance axis)`, `— (ungraded)`, `absent → evidence`) and an unresolvable trigger as `indeterminate` rather than inferring one. Re-measured twice via the pinned method on the unchanged tree: 102/102. 102 → 104 on 2026-08-22: the `council:grant-billing` + `council:revoke-billing` verbs (road-to-billing-cliff-gate Phase 2 — the run-scoped billing grant that lets `ai_council.fallback.api_on_quota: 'ask'` be answered once per run instead of once per seat) register in the same PR that adds the surface, per this record's own contract. The two are a pair by construction rather than by convenience: a grant that can be issued and not revoked would outlive its run, which is the failure the run-scoped TTL exists to prevent. Re-measured via the pinned method: 104. 104 -> 106 on 2026-08-23: the `ui:audit` + `ui:render` verbs (road-to-frontend-power E2.1 and E3.1 -- the two Class-A commands that give the frontend obligations an artefact a gate can read and a render a verdict can cite) register in the same PR that adds the surface, per this record's own contract. The two are a pair by construction rather than by convenience: `ui-audit-gate`'s enforced_by moved from `none` to a carrier in the same change, and that carrier reports `verification: degraded` whenever the render artefact is absent -- so an audit verb without a render verb would ship a gate that can never reach `verified`. Both are Class A under ADR-124: they terminate, their whole state is a rebuildable directory under agents/runtime/state/, and ui:render closes chromium in a `finally` on every path with no --serve, watch or cache for a resident browser to hide in. Re-measured via the pinned method on the unchanged tree: 106. 106 → 107 on 2026-08-23: the `roadmap:context` verb (road-to-roadmap-situational-awareness — the single live probe that answers what else is in flight before a roadmap is picked) registers in the same PR that adds the surface, per this record's own contract. Its branch measured 105 against a base of 104 and this branch measured 106 against the same base for `ui:audit` + `ui:render`; the merge makes it 107, re-measured on the merged tree via the pinned method (registry enumeration): 107. 107 → 108 on 2026-08-26: the `roadmap:set-step` verb (road-to-skill-ecosystem-runtime-enforcement Phase 6 — the single sanctioned writer of a checkbox glyph) registers in the same PR that adds the surface, per this record's own contract. It exists because the glyph is written today by whatever edits the file, and a concurrent writer destroys work SILENTLY: the loser of an overwrite receives no error. The verb carries an advisory lock, a line-anchored edit that cannot span entries even in principle, a step-count invariant asserted against the LIVE pre-write file rather than an in-memory snapshot, and a post-write survival check. Re-measured via the pinned method (registry enumeration) on the unchanged tree: 108. 108 → 109 on 2026-08-26: the `stubs:due` verb (road-to-inbox-harvest-2026-08-f-owner-decision-queue step 2.1 — the read-only reader over `agents/roadmaps/stubs/` frontmatter) registers in the same PR that adds the surface, per this record's own contract. It exists because step 1.2 backfills a `review_by:` date into 77 parked files, and an AI council (2026-08-26, 2/2) made the ordering a RULE rather than a preference: dates without a reader are strictly worse than no dates, because a stale date certifies attention nobody paid. The verb is read-only by construction — it authors nothing under `agents/roadmaps/stubs/`, so `check_no_stub_inventory_table` stays green and unmodified, and `roadmap:progress` consumes only its two COUNTS for the dashboard header (two integers, no rows, nothing for the deleted index tables to grow back from). Re-measured via the pinned method (registry enumeration) on the unchanged tree: 109. 109 → 110 on 2026-09-03: the `hooks:effect` verb (road-to-wired-instruments Phase 1.1 — the CLI entry for `hook_effect_doctor`) registers in the same PR that adds the surface, per this record's own contract. It exists because the probe and its five-state vocabulary were built, tested and reachable from nothing: `grep -rn 'hook_effect_doctor|hook_effect_probe' src Taskfile.yml .github` returned only the two modules themselves, and a closed roadmap recorded the wiring as landed at `src/scripts/hooks_doctor.ts:88`, a line that is the closing brace of a filesystem helper in a file with zero references to the probe. Deliberately NOT merged into `hooks:doctor`: that verb reads the MANIFEST (what is declared) and this one reads what happened (what took effect), and the probe's own header names merging them as the thing to avoid — a declaration report and an execution report are different instruments, and merging them makes the cheap one expensive. Read-only apart from a scratch root it removes in a `finally`. Re-measured via the pinned method (registry enumeration) on the unchanged tree: 110."
     },
     "mcp_public_tool_count": {
       "max": 20,

package/src/config/gate-coverage.yml

@@ -52,6 +52,14 @@
 # CI-identical argv, and 75 of those 78 are listed below.** The manifest is
 # complete for every gate that can carry a floor, covering ~25 % of the population.
 #
+# RECOUNTED 2026-09-03, on the change that adds `check_agent_artifact_location`.
+# Recomputed on this tree rather than incremented: `count_gate_scripts()` returns
+# **313** and `grep -c '^  - id:'` returns **84** (83 before this row), so
+# 84/313 = 26.8 %. The script count rose by three since the 2026-08-31 block
+# below without any recount in between — the same drift every block here keeps
+# describing, and the reason this one is a new block rather than an edit to that
+# one: that block measured a tree that no longer exists.
+
 # RECOUNTED 2026-08-31, on the change that adds `lint_promotion_paths` — and the
 # 2026-08-30 block above was already stale when this row landed, in BOTH numbers
 # rather than only in the one this change moves. Recomputed on this tree:
@@ -765,7 +773,7 @@ gates:
 
   - id: check_requirements_trace
     argv: []
-    min_scanned: 2
+    min_scanned: 1
     corpus: "roadmap files at the top level of agents/roadmaps/ (25 at registration, 2026-08-22; 9 live on 2026-08-23, mid-drain). The floor tracks a corpus that shrinks by design, so completing and archiving a roadmap lowers it — it is never satisfied by un-archiving finished work. LOWERED 10 -> 2 on 2026-08-23. The 15 -> 10 move earlier the same day already recorded this shape and under-shot it: eight further PRs were open at that moment, each one titled `roadmap: complete <slug>` and each archiving exactly one top-level file, so the estate this floor tracks was already committed to landing at one or two. A floor of 10 against a corpus heading for 2 does not detect anything — it reds on every remaining merge in the drain, which is the gate firing on the drain WORKING, and the note directly above says so in its own words. 2 is chosen as one above the only reading this floor exists to catch: a scan whose root moved reports 0, never 2, so the collapse signal survives the move intact. What is given up is the middle band, and it was never load-bearing here — this gate is a LISTING (see no_canary_reason: `main()` returns 0 on every path), so the floor is its only failure mode and a partial-corpus read is not something it could act on anyway. Revisit-if: the drain ends and the estate stabilises above 2 — re-derive the floor from what the estate is then expected to hold, and never from the live count, which reds on the next archive by construction."
     status: enforced
     no_canary_reason: >-
@@ -2402,12 +2410,19 @@ gates:
     argv: ["--base", "origin/main"]
     min_scanned: 0
     corpus: >
-      the source files a change touches, measured against the base ref — a DIFF,
+      the source LINES a change adds, measured against the base ref — a DIFF,
       not a tree walk. The floor is 0 deliberately: a docs-only or config-only
       change legitimately carries no source file, and a floor above 0 would red
       exactly those commits. The scan-scope failure this class exists to catch
       cannot occur here, because there is no committed path list that can go
       stale — the root is `git diff`, and git answers for its own range.
+
+      LINES, not files, since 2026-09-02. Selecting the file set from the diff
+      while scanning each file whole made every edit to an old file carry that
+      file's whole comment history: PR #1813 added no flagged comment and was
+      refused on eleven legacy lines in four files it had touched for unrelated
+      reasons. An untracked file still counts whole — every line in it is new,
+      which is also what keeps the canary below a genuine discriminator.
     status: enforced
     canary:
       class: contract-violation
@@ -2471,3 +2486,48 @@ gates:
       reason the corpus field gives, so it was never in that population and
       the count stays at 24 either side of this change. The self-test is
       therefore adopted on its merits rather than to clear a ratchet.
+
+  - id: check_agent_artifact_location
+    argv: []
+    min_scanned: 3000
+    corpus: >
+      every `.md` file the whole-tree walk VISITS, not the roadmap-shaped ones it
+      matches. Zero matches is the normal clean state — the repository is
+      expected to have no misplaced roadmap — so only the unfiltered walk can
+      tell "nothing misplaced" from "nothing read", which is the exact
+      distinction this manifest exists to enforce.
+
+      The floor is 3,000 against a real 3,866 on the tree carrying this row.
+      Set well below the true corpus because `docs/archive/` and the roadmap
+      archive legitimately grow and shrink, and far above a collapse: the failure
+      mode this guards is the walk root moving, which would take the count to
+      single digits rather than to 3,000.
+
+      The walk skips `.git`, `node_modules`, `dist/` and the per-tool projection
+      trees (`.claude/`, `.cursor/`, `.augment/`, `.clinerules/`, `.agents/`).
+      Those are generated copies, so a finding there is a finding about `src/`
+      reported twice — excluded from the corpus deliberately, which is why the
+      count is 3,866 rather than the full tree's markdown population.
+
+      SELF-TEST ADOPTED. `--self-test` runs 5 cases, 2 rejecting, against the
+      real CLI over throwaway trees: a roadmap-shaped file under
+      `docs/roadmaps/` and one at the tree root must RED; the byte-identical
+      file under `agents/roadmaps/` and under `agents/roadmaps/later/` must stay
+      GREEN, and so must prose that carries frontmatter and a checkbox but no
+      `## Phase` heading. Both polarities, which is what the originating
+      roadmap's step 1.1 required in as many words: "Both directions, or the
+      detector's polarity is untested."
+    canary:
+      class: contract-violation
+      path: docs/roadmaps/zz-canary-artifact-location.md
+      content: |
+        ---
+        complexity: lightweight
+        status: ready
+        ---
+        # Canary planted by check_gate_coverage --canary; never ships.
+
+        ## Phase 1 - the planted phase
+
+        - [ ] **1.1 A planted step.** Carries all three shape signals so the
+              gate must report it from a directory that is not the roadmap root.

package/src/config/gate-reachability-exemptions.json

@@ -16,6 +16,7 @@
         "mcp:glama-drift-check": "Queries an external registry — network-dependent and flaky by construction. Would run against a recorded snapshot instead of a live query.",
         "migration-verify": "Verifies a physical move during a migration; there is no migration in flight. Would run during one.",
         "value": "Renders a dashboard; the render is the product, not a check. Nothing would make it a gate.",
+        "push-ready": "NOT A GATE — a developer-invoked helper that MUTATES the tree: it merges the base set in, regenerates derived files, and hands the push back to the contributor. It is gate-shaped only because step 5 calls `check_branch_freshness`, which IS wired to CI on its own. Wiring this target would make CI perform merges, which is the exact thing `road-to-cascading-base-integration` 2.2 forbids the pre-push hook from doing one layer down. Nothing would make it a gate; the checks inside it are wired separately.",
         "value:lint": "Lints that dashboard, which is generated and regenerated on demand. Would run if the dashboard became a committed artefact a drift could break."
     }
 }

package/src/config/gate-violation-baselines.json

@@ -34,9 +34,10 @@
       "note": "The nine active non-draft roadmaps that predate the `relates:` requirement (road-to-agentic-engineering-assurance, road-to-component-library-lifecycle, road-to-council-evidence-integrity, road-to-frontend-fidelity-calibration, road-to-monorepo-scope-and-detection, road-to-observability-plate, road-to-role-scoped-spawn-profiles, road-to-skill-delivery-over-mcp, road-to-standing-payload-diet). This is a NEW obligation rather than a repaired scan root, and the ratchet is the point: `depends:` shipped in the template with nothing requiring it and measured 0 adoption, so requiring `relates:` retroactively across the estate would be an owner-reserved write with no analysis behind the edges it would have to invent (held as step 4.3, deferred). Clearing an entry here is one roadmap at a time: run `agent-config roadmap:context` on it, write the rows the probe surfaces, and lower the count."
     },
     "check_source_size_budget": {
-      "count": 18230,
-      "landed": "2026-09-01",
-      "note": "Lowered 18,245 -> 18,230 on 2026-09-02 by drain/publication-integrity-option-a. Phase 2 Option A moved the authoring instruction out of the generator: release.ts, which sits ~530 lines PAST the 1500 cap so every line there costs one excess, loses the comment emission, a 16-line HEAD_DEFAULT doc block and its alias const, and gains a shorter writer docstring. The doc block moved to _lib/release_material.ts, which is 289 lines and therefore UNDER the cap, so the same prose now costs nothing. Net -15. The branch first came in at +8 and paid its own way down rather than raising the baseline."
+      "count": 18193,
+      "landed": "2026-09-03",
+      "note": "Lowered 18,245 -> 18,230 on 2026-09-02 by drain/publication-integrity-option-a. Phase 2 Option A moved the authoring instruction out of the generator: release.ts, which sits ~530 lines PAST the 1500 cap so every line there costs one excess, loses the comment emission, a 16-line HEAD_DEFAULT doc block and its alias const, and gains a shorter writer docstring. The doc block moved to _lib/release_material.ts, which is 289 lines and therefore UNDER the cap, so the same prose now costs nothing. Net -15. The branch first came in at +8 and paid its own way down rather than raising the baseline.",
+      "reason": "Lowered 18,230 -> 18,209 on 2026-09-03 by drain/artifact-location. `doctor --strict` needed 16 lines of integration wiring in cmd_doctor.ts, which sits ~2,100 lines PAST the 1500 cap so every line there costs one excess. The branch first came in at +137 and paid its own way down rather than raising the baseline: the strict semantics, threshold, kill switch, payload helper and argv fragments moved to _cli/_doctor_strict.ts (~160 lines, under the cap, costs nothing), taking it to +15; then the 37-line drift renderer moved to _cli/_doctor_emit.ts. Net -21. The renderer was chosen deliberately: pure rendering, two dependencies, no argparse involvement and therefore none of the byte-parity risk the parser surface carries against the retired Python implementation; nothing outside cmd_doctor.ts imported it. An AI council on the residual split (a: raise by 15 / d: descope the feature); neither was taken, because a parallel branch demonstrated the same day that paying down is achievable in this codebase, which is the evidence the split lacked. This gate's own test comment prescribes it: a commit that splits a god-file lowers the excess and must carry the lowered baseline. MERGE RECONCILIATION 2026-09-03, 18,209 -> 18,205: drain/wired-instruments and drain/artifact-location each lowered from the SAME 18,230 base in parallel -- the branch to 18,226 (net -4, run_continuation_hook.ts's termination ladder moved to _lib/continuation_ladder.ts and runtime_journal.ts's prose to _lib/outcome_vocabularies.ts, both under the cap) and main to 18,209 (net -21, the doctor --strict split above). Taking either side alone is wrong in a different direction: main's value silently discards the branch's earned -4, and the branch's value RAISES the baseline against main and weakens the gate. The committed number is neither -- it is the gate's own output on the merged tree, where both reductions apply. THIS LOCAL READING IS ADMISSIBLE HERE, and the discriminator matters because this file's ci-parity:local-only entry records a 165 -> 164 lowering that was reverted for exactly the opposite case: that count depends on how the environment resolves the projection surface, whereas this gate walks only SOURCE_ROOTS = ['src'] (check_source_size_budget.ts:88) counting excess lines over the 1500 ceiling, and `git status --porcelain -uall -- src/` reported ZERO untracked files, so a clean CI checkout of this commit measures the same 18,205. If CI reads anything else, CI's number is the correct one and this note is the record of why. LOWERED 18,205 -> 18,193 on 2026-09-03 by fix/release-curation-ask. The change adds a fifth publication guard, and its own additions landed at +10 excess: release.ts 2,008 -> 2,018, every line of which is past the 1500 cap. Paid down rather than baselined, in the two ways this gate's doctrine prescribes. The guard's rationale (~13 lines of docstring, including why prMerged is a parameter rather than a call-site if) lives in release_publication.ts, 915 lines and therefore UNDER the cap, so the prose costs nothing; and the two pure text helpers _splitlines and _rstrip moved out of release.ts into release_env.ts (333 lines, also under the cap), taking release.ts to 1,996 -- 12 BELOW where it started. The branch came in at +10 and leaves at -12. Recorded while moving them: _splitlines is duplicated a third and fourth time at adoption_report.ts:106 and readme_linter.ts:418; collapsing all three onto one definition touches three modules and was left out of this change rather than done silently."
     },
     "ci-parity:local-only": {
       "count": 165,

package/src/config/rule-enforcement-baseline.json

@@ -11,7 +11,6 @@
   "brand-source-of-truth.md",
   "broken-access-control.md",
   "cli-output-handling.md",
-  "code-comment-discipline.md",
   "command-suggestion-policy.md",
   "commit-conventions.md",
   "commit-policy.md",

package/src/config/web-launch-readiness.json

@@ -168,7 +168,7 @@
     "ceiling_enforced_by": "tests/scripts/web_launch_readiness_config.test.ts asserts checks.length < 50. Currently 7."
   },
   "regions": {
-    "_comment": "Region axis (road-to-web-launch-readiness 2.3). Separate from site_types because it answers a different question: site_types decides WHETHER a check applies, regions decides HOW SEVERELY. A DE-targeted site owes Impressum and Datenschutz by law (TMG 5 / DSGVO Art. 13), so `required-legal-pages` is critical there and situational elsewhere -- the same check, a different tier. Modelled as a tier ESCALATION rather than as a second applies_to list, because a legal page is not more or less applicable in Germany, it is more or less optional.",
+    "_comment": "Region axis (road-to-web-launch-readiness 2.3). LEGAL-ROW CONTRACT: any row here or in `checks` whose `why` names a statute MUST carry `authority` (the citation and where it can be read) and `review_by` (the ISO date it must be re-read by); `authority` and `review_by` travel together, so a citation moved out of prose into `authority` stays dated; and a lapsed `review_by` FAILS the loader rather than warning, because a date nothing reads is a comment. Enforced by legalRowViolations() in src/scripts/check_web_launch_readiness.ts, which loadConfig() calls before returning. Separate from site_types because it answers a different question: site_types decides WHETHER a check applies, regions decides HOW SEVERELY. A DE-targeted site owes an Impressum and a Datenschutzerklaerung by law -- the citations sit in the escalation's `authority` field, dated, rather than in prose, which is what the `ddg-citation-authority` decision of 2026-09-03 settled -- so `required-legal-pages` is critical there and situational elsewhere -- the same check, a different tier. Modelled as a tier ESCALATION rather than as a second applies_to list, because a legal page is not more or less applicable in Germany, it is more or less optional.",
     "values": [
       "de",
       "eu",
@@ -181,7 +181,9 @@
         "check": "required-legal-pages",
         "region": "de",
         "to": "critical",
-        "why": "TMG 5 obliges an Impressum and DSGVO Art. 13 a Datenschutzerklaerung for a DE-targeted commercial site. Abmahnung risk is real and immediate, which is what separates critical from situational here."
+        "why": "A DE-targeted commercial site owes a published imprint and a privacy notice by law; the two citations and the date they must be re-read by live in this row's `authority` field, not in this sentence. Abmahnung risk is real and immediate, which is what separates critical from situational here.",
+        "authority": "Impressum: DDG § 5 (Digitale-Dienste-Gesetz), gesetze-im-internet.de/ddg -- in force since 2024-05-14, superseding the identically-numbered provision of the TMG, which is why the pre-2026-09-03 form of this row cited dead law: it was written on 2026-08-25, twenty-seven months after that supersession. Datenschutzerklaerung: DSGVO Art. 13, Regulation (EU) 2016/679, consolidated text at eur-lex.europa.eu. Both are cited here as provenance a reader can re-check, never as counsel: src/rules/legal-safety-floor.md governs how this package may speak about law, and `review_by` below is the date these two must be read again.",
+        "review_by": "2027-09-03"
       }
     ]
   }

package/src/scripts/_cli/_doctor_emit.ts

@@ -0,0 +1,71 @@
+/**
+ * The drift renderer, moved out of `cmd_doctor.ts`.
+ *
+ * WHY IT MOVED, because a reader will otherwise take this for a drive-by
+ * refactor. `cmd_doctor.ts` sits thousands of lines past the 1,500-line
+ * threshold `check_source_size_budget` measures, so every line added to it
+ * counts as new excess — and that ratchet turns one way, with its own test
+ * asserting `baseline == live` in BOTH directions.
+ *
+ * `doctor --strict` needed fifteen lines of integration wiring in that file
+ * that cannot live anywhere else: an import, two option fields, four argv-table
+ * splices, a validator call, both exit paths, and the payload attachment. So
+ * the choice was to raise the ratchet or to pay it down. The ratchet's own test
+ * comment answers that: a commit which splits a god-file lowers the excess and
+ * must carry the lowered baseline. Paying down is the response it was designed
+ * for; raising it is what the gate calls a defect.
+ *
+ * THIS function was chosen, and the choice is not arbitrary. It is pure
+ * rendering with two dependencies — a print sink and the tag id — no argparse
+ * involvement, and therefore none of the byte-parity risk the parser surface
+ * carries against the retired Python implementation. Nothing outside
+ * `cmd_doctor.ts` imported it; `cmd_prune.ts` has a same-named local of its own
+ * and is untouched. Behaviour is identical and the export surface is preserved
+ * by re-export.
+ */
+
+type Dict = Record<string, unknown>;
+
+const PACKAGE_TAG_ID = 'event4u/agent-config';
+
+function print(line = ''): void {
+    process.stdout.write(`${line}\n`);
+}
+
+export function _emit_text(
+    project_root: string,
+    missing: Dict[],
+    modified: Dict[],
+    foreign: Dict[],
+    tag_drift: Dict[],
+): void {
+    const total = missing.length + modified.length + foreign.length + tag_drift.length;
+    if (total === 0) {
+        print(`✅  doctor: manifest matches filesystem under ${project_root}`);
+        return;
+    }
+    print(`⚠️   doctor: ${total} drift item(s) under ${project_root}`);
+    const groups: ReadonlyArray<[string, Dict[]]> = [
+        ['missing', missing],
+        ['modified', modified],
+        ['foreign', foreign],
+        ['tag-drift', tag_drift],
+    ];
+    for (const [label, items] of groups) {
+        if (items.length === 0) {
+            continue;
+        }
+        print(`\n  ${label} (${items.length}):`);
+        for (const it of items) {
+            const tool = (it['tool'] as string) || '?';
+            print(`    · [${tool}] ${it['path']}`);
+            if (label === 'tag-drift') {
+                const found = (it['found'] as string) || '(missing)';
+                const expected = 'expected' in it ? it['expected'] : PACKAGE_TAG_ID;
+                print(`        expected: ${expected}`);
+                print(`        found:    ${found}`);
+            }
+            print(`        fix: ${it['fix']}`);
+        }
+    }
+}

package/src/scripts/_cli/_doctor_strict.ts

@@ -0,0 +1,163 @@
+/**
+ * `doctor --strict` — the failing exit mode, its threshold, and its kill switch.
+ *
+ * A separate module rather than more lines in `cmd_doctor.ts`, which is already
+ * far past the source-size budget: every line added there is counted excess by
+ * `check_source_size_budget`, and a ratchet that only turns one way is a
+ * standing instruction to put new code somewhere else.
+ */
+/** Structural, so this module needs no import from its caller. */
+type Dict = Record<string, unknown>;
+interface StrictOptions {
+    strict: boolean;
+    strict_level: string;
+}
+
+function eprint(msg: string): void {
+    process.stderr.write(`${msg}\n`);
+}
+
+/** Raised on an unknown `--strict-level`; the caller maps it to its argparse exit. */
+export class StrictLevelError extends Error {}
+
+/**
+ * `--strict` — the failing exit mode, and the ONE decision behind it.
+ *
+ * `doctor-exit-contract` was resolved by AI council on 2026-09-03 (members
+ * anthropic, openai), unanimously **(b)**: `doctor` keeps its exit contract and
+ * a separate strict mode carries the failing exit, leaving current callers
+ * untouched at the cost of one more surface. ADR-041 governs verb growth, so a
+ * flag rather than a verb; and the existing contract is load-bearing for callers
+ * that run `doctor` for information rather than for permission.
+ *
+ * WHAT WAS ALREADY TRUE, measured rather than assumed. The originating roadmap
+ * says `doctor` "writes nothing and always exits zero". Half of that is wrong:
+ * the default run already returns 1 on DRIFT (`return drift_present ? 1 : 0`),
+ * and `--ci` already folds check failures in on top. What is genuinely missing
+ * is a failing exit for check failures OUTSIDE the `--ci` JSON contract — `--ci`
+ * forces `opts.json = true`, so there is no human-readable strict run — and that
+ * gap is what `--strict` closes. Recorded here because a comment claiming to
+ * implement a premise the code contradicts is worse than no comment.
+ *
+ * SEVERITY IS CONFIGURABLE, per a condition both council seats attached:
+ * `--strict-level fail` (default) fails on `fail` rows; `--strict-level warn`
+ * also fails on `warn`. A caller adopting strict picks its own bar rather than
+ * inheriting one.
+ *
+ * THE KILL SWITCH is `AGENT_CONFIG_DOCTOR_NO_FAIL=1`, the other condition both
+ * seats attached: an immediate way to disable failing exits that is not a code
+ * rollback. When set, `--strict` still REPORTS every finding and still emits
+ * `can_proceed: false`; only the exit code is suppressed, and the suppression is
+ * announced on stderr so a green run cannot be silently bought. A switch that
+ * hid the finding as well would be the "warning ignored eighteen times" shape
+ * this repository already documents.
+ */
+export const STRICT_DEFAULT_LEVEL = 'fail';
+export const STRICT_LEVELS: ReadonlySet<string> = new Set(['fail', 'warn']);
+/** Env var that suppresses the failing exit without suppressing the finding. */
+export const STRICT_KILL_SWITCH = 'AGENT_CONFIG_DOCTOR_NO_FAIL';
+
+/** Statuses that trip `--strict` at the given level. */
+export function strictTripping(level: string): ReadonlySet<string> {
+    return level === 'warn' ? new Set(['fail', 'warn']) : new Set(['fail']);
+}
+
+/**
+ * The machine-readable "may I proceed" answer — nothing in this tree carried
+ * one before (`grep -rc can_proceed src` returned zero hits tree-wide).
+ *
+ * Deliberately independent of `--strict`: a caller asking the JSON whether it
+ * may proceed gets the same answer whether or not the exit code was configured
+ * to fail, because the two questions are different. The exit code is a policy;
+ * `can_proceed` is a fact.
+ */
+export function canProceed(driftPresent: boolean, checks: readonly Dict[]): boolean {
+    return !driftPresent && !checks.some((c) => c['status'] === 'fail');
+}
+
+export function validateStrictLevel(level: string): void {
+    if (!STRICT_LEVELS.has(level)) {
+        throw new StrictLevelError(
+            `argument --strict-level: invalid choice: '${level}' (choose from 'fail', 'warn')`,
+        );
+    }
+}
+
+/**
+ * The `--strict` verdict, or `null` when strict is off.
+ *
+ * Factored out because `main` has TWO exit paths and only one of them was
+ * obvious: a project with no install manifest returns through
+ * `_run_no_manifest` long before the drift branch, so a strict check written
+ * only in the drift branch silently never fires there. Measured, not guessed —
+ * the first implementation exited 0 on a tree carrying a `fail` check row and a
+ * `can_proceed: false` payload, because this repository has no manifest of its
+ * own. Both paths call this now, so the two cannot diverge again.
+ */
+export function strictExit(
+    opts: StrictOptions,
+    checks: readonly Dict[],
+    driftPresent: boolean,
+): number | null {
+    if (!opts.strict) {
+        return null;
+    }
+    const tripping = strictTripping(opts.strict_level);
+    const tripped = checks.filter((c) => tripping.has(c['status'] as string));
+    if (!driftPresent && tripped.length === 0) {
+        return 0;
+    }
+    if (process.env[STRICT_KILL_SWITCH] === '1') {
+        // The finding is NEVER suppressed — only the exit code is, and the
+        // suppression announces itself. A switch that hid the finding as well
+        // would be the ignored-warning shape this repository already documents.
+        eprint(
+            `⚠️  doctor --strict: ${String(tripped.length)} finding(s) at or above ` +
+                `'${opts.strict_level}'` +
+                (driftPresent ? ' plus manifest drift' : '') +
+                `, but ${STRICT_KILL_SWITCH}=1 suppressed the failing exit. ` +
+                'The findings above still stand; unset it to restore the gate.',
+        );
+        return 0;
+    }
+    return 1;
+}
+
+/**
+ * The `can_proceed` / `status` pair, written onto a `--json` payload.
+ *
+ * Lives here rather than inline in `_emit_json` for the source-budget reason
+ * this whole module exists for. `status` is the roll-up a human reads;
+ * `can_proceed` is the boolean a caller branches on without parsing prose. Both
+ * are facts about the tree and never about the exit policy — a caller running
+ * with the kill switch set still gets `can_proceed: false`.
+ */
+export function attachProceedFields(
+    payload: Dict,
+    driftPresent: boolean,
+    checks: readonly Dict[],
+): void {
+    const proceed = canProceed(driftPresent, checks);
+    payload['can_proceed'] = proceed;
+    payload['status'] = proceed
+        ? checks.some((c) => c['status'] === 'warn')
+            ? 'warn'
+            : 'ok'
+        : 'fail';
+}
+
+/** Argv wiring, exported as fragments so the caller spends one line each. */
+export const STRICT_STORE_TRUE = { '--strict': 'strict' } as const;
+export const STRICT_VALUE_FLAGS = { '--strict-level': 'strict_level' } as const;
+export const STRICT_DEFAULTS = { strict: false, strict_level: STRICT_DEFAULT_LEVEL } as const;
+export const STRICT_USAGE = '                           [--strict] [--strict-level {fail,warn}]\n';
+
+/** Validate, mapping the module's error onto the caller's argparse exit. */
+export function validateStrictLevelOr(level: string, onError: (msg: string) => never): void {
+    try {
+        validateStrictLevel(level);
+    } catch (e) {
+        if (e instanceof StrictLevelError) onError(e.message);
+        throw e;
+    }
+}

package/src/scripts/_cli/cmd_doctor.ts

@@ -3049,6 +3049,8 @@ function _run_no_manifest(
         }
         return fail_check ? 1 : 0;
     }
+    const sx = strictExit(opts, checks, false); // no manifest: keep the 2, never soften to 1
+    if (sx !== null) return bridge_present ? sx : 2;
     if (opts.ci && bridge_present) {
         // Same fold as the manifest path: check failures are red under --ci.
         return fail_check ? 1 : 0;
@@ -3077,6 +3079,8 @@ function _emit_json(
     }
     if (checks !== null) {
         payload['checks'] = checks;
+        const drift = missing.length + modified.length + foreign.length + tag_drift.length;
+        attachProceedFields(payload, drift > 0, checks);
         // The detection section rides along whenever checks ran, so the agent /
         // GUI contract carries the full provider → transport → billing table
         // and not just the one-line check row.
@@ -3117,48 +3121,16 @@ function _emit_detection_text(project_root: string, checks: Dict[]): void {
     print('');
 }
 
-function _emit_text(
-    project_root: string,
-    missing: Dict[],
-    modified: Dict[],
-    foreign: Dict[],
-    tag_drift: Dict[],
-): void {
-    const total = missing.length + modified.length + foreign.length + tag_drift.length;
-    if (total === 0) {
-        print(`✅  doctor: manifest matches filesystem under ${project_root}`);
-        return;
-    }
-    print(`⚠️   doctor: ${total} drift item(s) under ${project_root}`);
-    const groups: ReadonlyArray<[string, Dict[]]> = [
-        ['missing', missing],
-        ['modified', modified],
-        ['foreign', foreign],
-        ['tag-drift', tag_drift],
-    ];
-    for (const [label, items] of groups) {
-        if (items.length === 0) {
-            continue;
-        }
-        print(`\n  ${label} (${items.length}):`);
-        for (const it of items) {
-            const tool = (it['tool'] as string) || '?';
-            print(`    · [${tool}] ${it['path']}`);
-            if (label === 'tag-drift') {
-                const found = (it['found'] as string) || '(missing)';
-                const expected = 'expected' in it ? it['expected'] : PACKAGE_TAG_ID;
-                print(`        expected: ${expected}`);
-                print(`        found:    ${found}`);
-            }
-            print(`        fix: ${it['fix']}`);
-        }
-    }
-}
+
+// `--strict` lives in `_doctor_strict.ts`; the drift renderer in `_doctor_emit.ts`.
+import { STRICT_DEFAULTS, STRICT_STORE_TRUE, STRICT_USAGE, STRICT_VALUE_FLAGS, attachProceedFields, strictExit, validateStrictLevelOr } from './_doctor_strict.js';
+import { _emit_text } from './_doctor_emit.js';
 
 interface Options {
     project: string | null;
     json: boolean;
     ci: boolean;
+    strict: boolean; strict_level: string; // see `_doctor_strict.ts`
     check: string | null;
     trace_root: boolean;
     context: boolean;
@@ -3173,18 +3145,21 @@ const PROG = 'agent-config doctor';
 // terminal width; golden tests assert the `usage:` token + exit code only.
 const USAGE =
     `usage: ${PROG} [-h] [--project PROJECT] [--json] [--ci] [--check ID]\n` +
+    STRICT_USAGE +
     '                           [--trace-root] [--context] [--anatomy]\n' +
     '                           [--repair ID]\n';
 
 const _STORE_TRUE_FLAGS: Record<string, keyof Options> = {
     '--json': 'json',
     '--ci': 'ci',
+    ...STRICT_STORE_TRUE,
     '--trace-root': 'trace_root',
     '--context': 'context',
     '--anatomy': 'anatomy',
 };
 
 const _VALUE_FLAGS: Record<string, keyof Options> = {
+    ...STRICT_VALUE_FLAGS,
     '--project': 'project',
     '--check': 'check',
     '--repair': 'repair',
@@ -3201,6 +3176,7 @@ function _parse(argv: string[]): Options {
         project: null,
         json: false,
         ci: false,
+        ...STRICT_DEFAULTS,
         check: null,
         trace_root: false,
         context: false,
@@ -3430,6 +3406,7 @@ function _run_repair(opts: Options): number {
 
 function main(argv: string[] | null = null): number {
     const opts = _parse(argv !== null ? Array.from(argv) : process.argv.slice(2));
+    validateStrictLevelOr(opts.strict_level, _argError);
     if (opts.ci) {
         // `--ci` = machine-readable consumer-CI contract: JSON payload on
         // stdout, zero interactive output, and check failures fold into the
@@ -3502,6 +3479,8 @@ function main(argv: string[] | null = null): number {
         // · 2 unresolvable environment (handled above via ProjectRootError).
         return drift_present || fail_check ? 1 : 0;
     }
+    const strict = strictExit(opts, checks, drift_present);
+    if (strict !== null) return strict;
     return drift_present ? 1 : 0;
 }
 

package/src/scripts/_dispatch.bash

@@ -290,6 +290,12 @@ Tier 2 — maintenance / internal (hooks, MCP, memory, telemetry):
                              last dispatcher feedback per concern, missing trampolines.
                              Wraps hooks:status. Read-only.
                              Flags: --format json|table, --strict (CI), --project-root <path>
+  hooks:effect               Does a bound concern actually FIRE on this host? Dispatches
+                             each eligible concern against a scratch root and reports the
+                             observed state. Not hooks:doctor: that reads the manifest,
+                             this reads what happened. Read-only.
+                             Flags: --host <name>, --format text|json, --root <path>,
+                             --limit <n>, --help (prints both verdict vocabularies)
   routing:doctor             Live routing diagnosis: per-gate ACTIVE/INACTIVE with the
                              concern's own reason (read-only probes), session_start chain,
                              router + projection freshness, host bridge status.
@@ -976,6 +982,10 @@ cmd_hooks_doctor() {
   exec_hook "src/scripts/hooks_doctor" "$@"
 }
 
+cmd_hooks_effect() {
+  exec_hook "src/scripts/hook_effect_doctor" "$@"
+}
+
 cmd_routing_doctor() {
   exec_hook "src/scripts/routing_doctor" "$@"
 }
@@ -1533,6 +1543,7 @@ main() {
     dispatch:hook)           cmd_dispatch_hook "$@" ;;
     hooks:status)            cmd_hooks_status "$@" ;;
     hooks:doctor)            cmd_hooks_doctor "$@" ;;
+    hooks:effect)            cmd_hooks_effect "$@" ;;
     routing:doctor)          cmd_routing_doctor "$@" ;;
     workspace:doctor)        cmd_workspace_doctor "$@" ;;
     route:explain)           cmd_route_explain "$@" ;;