@event4u/agent-config 14.2.0 → 14.5.0

package/dist/agent-src/rules/roadmap-progress-sync.md

@@ -46,12 +46,56 @@ IS A RULE VIOLATION, NOT AN OVERSIGHT.
 
 ```
 A ROADMAP WITH `[~]` DEFERRED ITEMS NEVER AUTO-ARCHIVES SILENTLY.
-SURFACE EVERY DEFERRED STEP. ASK THE USER WHAT HAPPENS TO THE PLAN.
+SURFACE EVERY DEFERRED STEP. RESOLVE IT — VIA THE COUNCIL WHERE THE
+DISPOSITION PRESERVES THE ITEM, VIA THE USER WHERE IT DOES NOT.
 A SILENT ARCHIVE THAT BURIES PLANNED-FOR-LATER WORK
 IS A RULE VIOLATION, NOT A CONVENIENCE.
 ```
 
-Closure check fires (`count_open == 0` and `count_deferred > 0`) → enumerate every `[~]` step, present the numbered-options resolution menu (per [`user-interaction`](user-interaction.md)), and only after the user resolves the deferrals does the `git mv` to `archive/` run. Full option menu + migration mechanics: guideline + [`roadmap-management`](../skills/roadmap-management/SKILL.md).
+Closure check fires (`count_open == 0` and `count_deferred > 0`) → enumerate every `[~]` step, present the numbered-options resolution menu (per [`user-interaction`](user-interaction.md)), and only after the deferrals are resolved does the `git mv` to `archive/` run. Full option menu + migration mechanics: guideline + [`roadmap-management`](../skills/roadmap-management/SKILL.md).
+
+### Who resolves it — the preservation test
+
+```
+THE COUNCIL MAY RESOLVE A `[~]` ONLY WHERE THE CHOSEN DISPOSITION KEEPS THE
+ITEM ALIVE IN THE ACTIVE ESTATE. ANYTHING THAT DROPS, WEAKENS, OR PERMANENTLY
+ACCEPTS THE LOSS OF IT REACHES THE USER — ALWAYS, AND NO MANDATE LIFTS THAT.
+IN DOUBT, IT IS A USER DECISION. THE COUNCIL ADVISES ON HOW AND WHEN;
+THE OWNER DECIDES WHETHER.
+```
+
+One question decides the route, and it is answerable from the option itself
+rather than from judgement: **does this disposition keep the criterion active
+in the estate?**
+
+| Disposition | Route |
+|---|---|
+| Fix the blocker now, in this change or its own PR | council |
+| Carry item **and** blocker into a named follow-up roadmap created in the SAME change and estate-ratchet compliant | council |
+| Merge the item into existing active work that already covers it | council |
+| Restore to `[ ]` in this roadmap | council |
+| Convert to `[-]` cancelled | **user** |
+| Weaken the criterion, cut its scope, or accept the breakage permanently | **user** |
+| Keep-in-archive (an intentional drop) | **user** |
+| The item carries a `high_impact` / `user_required` classification | **user** |
+
+- **"Immediately active" is not a promise.** A follow-up counts only if created
+  in the same change and estate-ratchet compliant. A verdict naming a roadmap
+  that does not exist yet **fails closed to the user**.
+- **Recorded, or it did not happen.** At the item: criterion verbatim ·
+  blocker id · every option · verdict + one-sentence rationale · dissent ·
+  destination when carried · what closes it. A verdict with no record is a
+  silent drop wearing a procedure.
+- **The residual hole, stated not papered over.** Both authoring seats named
+  it in their own strongest counter: a carried follow-up can still become an
+  indefinite deferral, so this test bounds *who decides*, not *whether the work
+  happens*. Only fix-now discharges it. A carried item untouched at the next
+  task boundary is raised again per [`active-remediation`](active-remediation.md).
+- **Why it changed.** Adopted 2026-08-19, unanimous 2/2 council (blind peer
+  review). The prior text — *"Wait for the user"* — handed back a fully
+  analysed choice with four costed options, the low-value interruption
+  [`no-cheap-questions`](no-cheap-questions.md) forbids. The gate protects the
+  item, not the maintainer's attention.
 
 ## Later disposition — blocked-for-later roadmaps are parked, never left active
 
@@ -95,9 +139,9 @@ Before sending any reply that landed roadmap work:
 4. Did `count_open` reach 0?
    - **No (real open work remains)** → continue normally.
    - **Yes + `count_deferred == 0`** → the roadmap is **complete**. Archive it — `git mv` to `archive/` + migrate inbound refs + regen, same reply — or let the next `/create-pr` § 1c sweep do it deterministically. Either way it must never be pushed to the trunk unarchived (§ PR-gate; the `--check` backstop enforces it).
-   - **Yes + `count_deferred > 0`** → STOP. Run the Iron Law 3 deferred-resolution flow (surface items + numbered options + wait). Archive only after resolution.
+   - **Yes + `count_deferred > 0`** → STOP. Run the Iron Law 3 deferred-resolution flow: surface every item, apply the preservation test above, and resolve — council where the disposition keeps the item alive, user where it does not. Archive only after resolution, and only with the resolution recorded at the item.
 
-Any "no" at step 2 → reply is incomplete. Do not send. A skipped step 3 regen is fine when cadence permits — checkbox truth lives in the markdown file. Skipping the deferred-resolution gate at step 4 is **never** acceptable; it is the canonical "lost-information" failure mode this rule exists to prevent.
+Any "no" at step 2 → reply is incomplete. Do not send. A skipped step 3 regen is fine when cadence permits — checkbox truth lives in the markdown file. Skipping the deferred-resolution gate at step 4 is **never** acceptable; it is the canonical "lost-information" failure mode this rule exists to prevent. Note what the council path does and does not change here: it changes WHO resolves a preserving disposition, never whether the gate runs, never whether the resolution is recorded, and never the user's ownership of a drop.
 
 Body migrated to `guideline:agent-infra/roadmap-progress-mechanics` (per P4 of `road-to-kernel-and-router.md`) — glyph semantics, regen cadence, deferred-resolution menu, later-disposition procedure, PR-gate prose, plus the long-form failure-mode catalog, Copilot fallback, and hook + CI defence-in-depth.
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).

package/dist/agent-src/scripts/resume_probe.ts

@@ -16,14 +16,19 @@
  *
  * ## What it can and cannot decide, stated plainly
  *
- * A resume condition is prose. Two shapes are machine-decidable and the rest
- * are not, so the verdict set has three values rather than two:
+ * A resume condition is prose. TWO shapes are machine-decidable — a roadmap
+ * reference, and a single repo-relative file path under an existence predicate
+ * — and the rest are not, so the verdict set has three values rather than two:
  *
  *   - `fired`       — every roadmap the condition names has archived, or the
- *                     named step in a still-active roadmap is ticked.
+ *                     named step in a still-active roadmap is ticked; or the
+ *                     single path it names under `exists` is there.
  *   - `unmet`       — at least one named roadmap is still active with the
- *                     named step (or the whole file) still open.
- *   - `undecidable` — the condition names no roadmap this tree can resolve.
+ *                     named step (or the whole file) still open; or the single
+ *                     path it names under `exists` is absent.
+ *   - `undecidable` — the condition names neither, names both (a conjunction
+ *                     this probe can only half-weigh), names two of either, or
+ *                     states a predicate other than existence over its path.
  *
  * `undecidable` is reported as its own count and never folded into "nothing
  * fired". A probe that reads 44 files, understands 12 of them and announces
@@ -84,6 +89,31 @@ const COMPOUND_RE = /\bboth\b|\band\b|\([1-9]\)|\([a-e]\)|`[ \t]*\+|\+[ \t]*`/i;
 const FIELD_LABEL_RE = /\*\*[^*]+:\*\*/;
 /** A roadmap slug as written in prose, with or without the `.md` suffix. */
 const ROADMAP_REF_RE = /\broad-to-[a-z0-9][a-z0-9-]*\b/g;
+
+/**
+ * A repo-relative path named inside backticks — the second decidable form.
+ *
+ * `PARK-PROBEABLE` (`road-to-estate-drawdown` Phase 2) means the resume
+ * condition can be tested by a script, and until this existed the probe could
+ * decide exactly one phrasing: a roadmap slug. Measured 2026-08-19 on the live
+ * estate, 42 of 44 park notes were `undecidable`, and the batch-1 sweep could
+ * only add six more — a verdict whose name promised a probe that did not read
+ * the conditions it was producing.
+ *
+ * Deliberately narrow in three ways, because a false FIRED un-parks live work:
+ * the path must be **inside backticks** (prose that merely contains a slash is
+ * not a condition), it must start at a **known top-level repo directory** and
+ * end in a **file extension**, and the clause must name **exactly one** — two
+ * paths are a conjunction this function cannot weigh, and `COMPOUND_RE` does
+ * not catch a comma.
+ *
+ * The extension requirement is what keeps a *directory* out. `agents/evidence/`
+ * exists in every checkout, so "recorded under `agents/evidence/`" is not a
+ * condition a probe can decide — and since `_exists` tests `isFile()`, matching
+ * it would have reported "does not exist" about a directory that does. A
+ * directory-shaped condition stays `undecidable`, which is the honest verdict.
+ */
+const REPO_PATH_RE = /`((?:agents|docs|src|tests|internal|scripts|evals|\.github)\/[A-Za-z0-9._\-/]*[A-Za-z0-9_\-]\.[A-Za-z0-9]{2,5})`/g;
 /**
  * A step reference: `P2.1`, `Phase 2.1`, or a bare `2.1`.
  *
@@ -231,6 +261,37 @@ function _blankFencedCode(text: string): string {
     );
 }
 
+/**
+ * The head of `s` up to its first sentence terminator OUTSIDE backticks.
+ *
+ * A naive character-class scan that stops at any dot cuts inside `foo.md` or
+ * inside a step id like `3.3`, which truncates the clause mid-span and hides
+ * the very path or step the condition names. Measured 2026-08-19: three of the six park notes written by
+ * `road-to-estate-drawdown` Phase 2 batch 1 lost their backticked path this
+ * way, and the probe then reported "names no roadmap this tree can resolve"
+ * about a condition that named a file.
+ */
+function _sentenceHead(s: string): string {
+    // An ODD backtick count means the span never closes, and toggling on it
+    // would leave `inCode` stuck true for the whole remainder — the commentary
+    // paragraph then becomes the clause, and a path mentioned only in that
+    // commentary could decide the verdict. Fall back to the plain scan, which
+    // cuts at the first terminator and is the conservative direction.
+    const balanced = (s.match(/`/g) ?? []).length % 2 === 0;
+    let inCode = false;
+    for (let i = 0; i < s.length; i++) {
+        const ch = s[i] as string;
+        if (ch === '`' && balanced) {
+            inCode = !inCode;
+            continue;
+        }
+        if (!inCode && (ch === '.' || ch === '—' || ch === '–')) {
+            return s.slice(0, i);
+        }
+    }
+    return s;
+}
+
 /**
  * The condition CLAUSE inside the condition text.
  *
@@ -260,13 +321,63 @@ function conditionClause(condition: string): string {
             // (`**Resume when** that pruning lands`), so take the span plus the
             // remainder of its sentence — up to an em dash or a full stop.
             const after = condition.slice(m.index + m[0].length);
-            const tail = /^[^—–.]*/.exec(after)?.[0] ?? '';
-            return `${span}${tail}`;
+            return `${span}${_sentenceHead(after)}`;
         }
     }
     return condition;
 }
 
+/**
+ * The clause's predicate is EXISTENCE, not some property of the file's content.
+ *
+ * Without this the path branch would answer a question the condition did not
+ * ask. Measured 2026-08-19 while writing it: `road-to-catalogue-host-fit` waits
+ * until `agents/evidence/metrics/skill-catalogue.jsonl` *holds at least 20
+ * observations*; the file exists today with 7 lines, so an existence test would
+ * have reported FIRED and un-parked a roadmap whose bar is 13 observations away.
+ * A content bar is decidable — by `capture_skill_catalogue --cadence` — but not
+ * by this probe, and `undecidable` is the honest verdict for it.
+ *
+ * The predicate is bound POSITIONALLY to the path rather than tested as a word
+ * anywhere in the clause, because word-presence is not a predicate: `\`x.md\` no
+ * longer exists` would have reported FIRED while the file was still there, and
+ * `blocked until a workaround exists, see \`docs/x.md\`` would have paired the
+ * word with a path it does not govern. Both shapes are regression tests.
+ *
+ * KNOWN LIMIT, stated rather than papered over: this probe reads the condition
+ * AFTER `_truncateAtNextField`, so a content bar an author moves into a sibling
+ * bolded field is invisible to it and the note decides as bare existence. That
+ * is an authoring bypass no check here can see — the guard is that a resume
+ * condition states its whole bar inside the condition, and it is model-carried.
+ */
+const EXISTENCE_PREDICATE_RE = /`(?:agents|docs|src|tests|internal|scripts|evals|\.github)\/[A-Za-z0-9._\-/]+`[ \t]*(?:currently[ \t]+)?exists\b/i;
+
+/**
+ * The single repo-relative path a condition names, or `null`.
+ *
+ * `null` for zero paths (nothing to test) and for two or more (a conjunction
+ * this probe cannot weigh — reporting FIRED on the first would be the
+ * partial-match resume the compound guard already refuses).
+ */
+function referencedPath(condition: string): string | null {
+    if (!EXISTENCE_PREDICATE_RE.test(condition)) {
+        return null;
+    }
+    const paths = _pathsIn(condition);
+    return paths.length === 1 ? (paths[0] as string) : null;
+}
+
+/** Every distinct repo-relative file path a clause names, predicate or not. */
+function _pathsIn(condition: string): string[] {
+    REPO_PATH_RE.lastIndex = 0;
+    const found = new Set<string>();
+    let m: RegExpExecArray | null;
+    while ((m = REPO_PATH_RE.exec(condition)) !== null) {
+        found.add(m[1] as string);
+    }
+    return [...found].sort();
+}
+
 /** Roadmap slugs named by the condition, minus the parked file's own slug. */
 function referencedRoadmaps(condition: string, ownSlug: string): string[] {
     const out = new Set<string>();
@@ -310,7 +421,10 @@ function stepIsDone(text: string, stepId: string): boolean | null {
  * tree rather than the live estate — a probe whose only test is the live tree
  * stops testing anything the day the live tree changes.
  */
-function probeLater(roadmapRoot: string): ResumeFinding[] {
+function probeLater(roadmapRoot: string, repoRootArg?: string): ResumeFinding[] {
+    // Defaults to the repo that owns `agents/roadmaps/`. Passed explicitly by
+    // the tests, whose fixture tree IS the roadmap root and has no repo above it.
+    const repoRoot = repoRootArg ?? path.resolve(roadmapRoot, '..', '..');
     const laterDir = path.join(roadmapRoot, 'later');
     let entries: string[];
     try {
@@ -353,13 +467,43 @@ function probeLater(roadmapRoot: string): ResumeFinding[] {
             continue;
         }
         const refs = referencedRoadmaps(clause, ownSlug);
+        // A clause naming a roadmap AND a path is a conjunction, and deciding it
+        // on the roadmap half alone is the partial-match resume `COMPOUND_RE`
+        // already refuses for two roadmaps. `COMPOUND_RE` does not close it —
+        // a comma joins the two without an `and`, which is the same hole the
+        // two-paths rule in `referencedPath` exists for. Refused symmetrically.
+        if (refs.length > 0 && _pathsIn(clause).length > 0) {
+            findings.push({
+                file: `later/${name}`,
+                condition,
+                refs,
+                verdict: 'undecidable',
+                why: 'names a roadmap and a repo path — a conjunction the probe can only half-weigh',
+            });
+            continue;
+        }
         if (refs.length === 0) {
+            // Second decidable form: a single repo-relative path. `exists` is
+            // the whole test — the condition says the artefact will appear, so
+            // its appearance IS the firing, and no content check is implied.
+            const rel = referencedPath(clause);
+            if (rel !== null) {
+                const there = _exists(path.join(repoRoot, rel));
+                findings.push({
+                    file: `later/${name}`,
+                    condition,
+                    refs,
+                    verdict: there ? 'fired' : 'unmet',
+                    why: there ? `${rel} exists` : `${rel} does not exist`,
+                });
+                continue;
+            }
             findings.push({
                 file: `later/${name}`,
                 condition,
                 refs,
                 verdict: 'undecidable',
-                why: 'the condition names no roadmap this tree can resolve',
+                why: 'the condition names no roadmap or repo path this tree can resolve',
             });
             continue;
         }
@@ -414,6 +558,7 @@ export {
     conditionClause,
     extractCondition,
     probeLater,
+    referencedPath,
     referencedRoadmaps,
     roadmapDisposition,
     stepIsDone,

package/dist/agent-src/scripts/roadmap_gates.ts

@@ -342,6 +342,201 @@ function render(
  * Returns '' when nothing is owned by the user, so the caller can append the
  * result unconditionally and get silence when silence is correct.
  */
+/**
+ * Whether a recorded recommendation was drafted by the agent rather than decided
+ * by the maintainer.
+ *
+ * Read from the field's own text, because that is where the claim has to live: a
+ * drafted recommendation is written INTO the roadmap so every consumer
+ * (`gates`, `--reply`, the sheet) sees the same string, and a marker held only
+ * in the sheet would be invisible to the other two. The convention is a leading
+ * `(agent-drafted …)` — matched loosely on purpose, since the parenthetical also
+ * carries a date and a sentence of provenance.
+ */
+export function isAgentDrafted(recommendation: string): boolean {
+    return /\(agent-drafted\b/i.test(recommendation);
+}
+
+/**
+ * How a row names its decision.
+ *
+ * `legacy` is the parser's PLACEHOLDER id for a `> Blocked until …` note, not an
+ * identifier anyone wrote — `renderEntry` already substitutes "blocked-until
+ * note" for exactly that reason, and the sheet printing the raw placeholder made
+ * the two views disagree about the same row.
+ */
+export function sheetLabel(b: Blocker): string {
+    return isLegacy(b) ? 'blocked-until note' : `\`${b.id}\``;
+}
+
+/** First sentence of a passage, for the one-line `Default:` column. */
+function firstSentence(text: string): string {
+    const trimmed = text.trim();
+    if (trimmed === '') {
+        return '';
+    }
+    const m = /^(.+?[.!?])(\s|$)/.exec(trimmed.replace(/\s+/g, ' '));
+    return m === null ? trimmed.replace(/\s+/g, ' ') : (m[1] as string);
+}
+
+/**
+ * The one-line question a sheet row leads with.
+ *
+ * `Question:` is an optional field and only 5 of the 21 user-owned entries carry
+ * one (measured 2026-08-18), so a sheet that printed it and nothing else would
+ * be blank for three quarters of the estate. Falling back to the first step of
+ * `What to do:` and then to `Blocks:` is deterministic and derived from the
+ * blocker's own text — which is why the row LABELS which of the three it used
+ * rather than presenting all three as the same kind of statement.
+ */
+export function sheetQuestion(b: Blocker): { text: string; source: 'question' | 'todo' | 'blocks' } {
+    if (b.question.trim() !== '') {
+        return { text: firstSentence(b.question), source: 'question' };
+    }
+    const steps = regroupTodo(b.todo);
+    if (steps.length > 0 && (steps[0] as string).trim() !== '') {
+        return { text: firstSentence(steps[0] as string), source: 'todo' };
+    }
+    return { text: firstSentence(b.blocks), source: 'blocks' };
+}
+
+/**
+ * The consolidated decision sheet — every user-owned decision in ONE artefact.
+ *
+ * `road-to-estate-drawdown` Phase 0 exists because thirteen reading assignments
+ * spread across thirteen files did not happen once. The sheet is the whole of
+ * the human's contribution to that campaign, front-loaded: one document, sorted
+ * by how much each answer unblocks, with a default per item so that
+ * accept-all-defaults is a valid answer.
+ *
+ * This differs from `--all` in the two ways that matter for that job. `--all`
+ * renders every blocker grouped by owner and is a terminal view; the sheet is
+ * user-owned ONLY, and every row carries a `Default:` plus the PROVENANCE of
+ * that default. Provenance is the load-bearing column: a sheet that presented an
+ * agent-drafted default beside a maintainer-recorded one as the same thing would
+ * invite accept-all over exactly the items nobody has examined.
+ *
+ * No population figure is quoted here on purpose. The first version cited
+ * "14 of 21 record a `Recommendation:`, 7 do not" as the justification, and the
+ * change that added this renderer then drafted six of those seven — so the
+ * docstring was contradicted by the sheet committed beside it (R2 finding).
+ * The split is rendered in the sheet's own header from the live tree, which is
+ * the only place it cannot go stale.
+ *
+ * Deterministic by construction — the generator never invents a default. Where
+ * none is recorded it says so and names what the reader must supply, so
+ * regenerating the sheet cannot silently overwrite an answer with a guess.
+ */
+function renderSheet(entries: readonly Entry[], now: Date): string {
+    const mine = entries.filter((e) => needsUser(e.blocker.owner));
+    const stamp = now.toISOString().slice(0, 10);
+    if (mine.length === 0) {
+        return (
+            `# Consolidated decision sheet — nothing owned by you (${stamp})\n\n` +
+            'No open blocker in the active roadmap tree carries `Owner: user`. Nothing to answer.\n'
+        );
+    }
+
+    const noRec = mine.filter((e) => e.blocker.recommendation.trim() === '');
+    const legacyNotes = noRec.filter((e) => isLegacy(e.blocker)).length;
+    const missing = noRec.length - legacyNotes;
+    const drafted = mine.filter((e) => isAgentDrafted(e.blocker.recommendation)).length;
+    const maintainerRecorded = mine.length - noRec.length - drafted;
+    const out: string[] = [
+        `# Consolidated decision sheet — ${String(mine.length)} decisions owned by you`,
+        '',
+        `> Generated ${stamp} by \`agent-config gates --sheet\` over \`agents/roadmaps/\`.`,
+        '> Sorted by unblock count, descending. **Accept-all-defaults is a valid answer**',
+        '> (`road-to-estate-drawdown` blocker `b-consolidated-decision-sheet`, option (a));',
+        '> answering only the two largest-unblock items and deferring the rest is option (c),',
+        '> which the roadmap itself recommends. Whichever you pick, the agent writes the answers',
+        '> back into each roadmap at its own blocker — that is not your work.',
+        '>',
+        `> **Provenance of the ${String(mine.length)} defaults: ${String(maintainerRecorded)} maintainer-recorded ·`,
+        `> ${String(drafted)} \`agent-drafted\` · ${String(missing)} with no recommendation at all ·`,
+        `> ${String(legacyNotes)} legacy \`> Blocked until …\` note(s) that have no field to carry one.**`,
+        '> The distinction is in every row on purpose: an agent-drafted default is the',
+        '> least-examined thing on this sheet, and accept-all-defaults would accept those too.',
+        '>',
+        '> This file is DERIVED — every line above and below comes from the roadmaps themselves,',
+        '> so regenerating is deterministic and an answer written into this file would be lost.',
+        '> Answers go back into each roadmap at its own blocker; the agent does that.',
+        '',
+        '| # | Decision | Roadmap | Unblocks | Default source |',
+        '|---:|---|---|---:|---|',
+    ];
+    mine.forEach((e, i) => {
+        const source =
+            e.blocker.recommendation.trim() !== ''
+                ? isAgentDrafted(e.blocker.recommendation)
+                    ? '`agent-drafted`'
+                    : 'maintainer-recorded'
+                : isLegacy(e.blocker)
+                  ? 'none — legacy note'
+                  : 'none recorded';
+        out.push(
+            `| ${String(i + 1)} | ${sheetLabel(e.blocker)} | ${e.roadmapRel} | ` +
+                `${String(e.openSteps)} | ${source} |`,
+        );
+    });
+
+    mine.forEach((e, i) => {
+        const q = sheetQuestion(e.blocker);
+        const qLabel =
+            q.source === 'question'
+                ? 'recorded `Question:`'
+                : q.source === 'todo'
+                  ? 'derived from the first `What to do:` step'
+                  : 'derived from `Blocks:`';
+        const recorded = e.blocker.recommendation.trim();
+        out.push(
+            '',
+            `## ${String(i + 1)} · ${sheetLabel(e.blocker)}`,
+            '',
+            `- **Roadmap:** ${e.roadmapRel}`,
+            `- **Unblocks:** ${String(e.openSteps)} open step(s) — ${e.blocker.blocks || '(not recorded)'}`,
+            `- **Question** (${qLabel})**:** ${q.text || '(the blocker records no question, no steps and no Blocks: field)'}`,
+        );
+        if (recorded === '' && isLegacy(e.blocker)) {
+            // A legacy `> Blocked until …` note is not a `### blocker:` entry and
+            // has no field to carry a recommendation. Saying "agent-drafted, to
+            // be written in" would point at a slot that does not exist, so the
+            // row names the actual next action instead.
+            out.push(
+                '- **Default:** _this is a legacy `> Blocked until …` note, not a `### blocker:` entry,' +
+                    ' so it has no `Recommendation:` field to read. Converting it into a real blocker' +
+                    ' entry is what gives it a default._',
+                '- **Default source:** none — legacy note',
+            );
+        } else if (recorded === '') {
+            out.push(
+                '- **Default:** _none recorded — needs an agent-drafted default before this row can be' +
+                    ' answered by accepting it._',
+                '- **Default source:** `agent-drafted` (to be written in below, and marked as such)',
+            );
+        } else {
+            const drafted = isAgentDrafted(recorded);
+            out.push(
+                `- **Default:** ${firstSentence(recorded)}`,
+                drafted
+                    ? '- **Default source:** `agent-drafted` — written into the roadmap’s ' +
+                      '`Recommendation:` field and marked there, NOT a maintainer decision'
+                    : '- **Default source:** maintainer-recorded `Recommendation:` in the roadmap',
+                `- **Recommendation (full):** ${recorded.replace(/\s+/g, ' ')}`,
+            );
+        }
+        if (e.blocker.ifNothing.trim() !== '') {
+            out.push(`- **If you do nothing:** ${e.blocker.ifNothing.replace(/\s+/g, ' ')}`);
+        }
+        out.push(
+            `- **Done when:** ${e.blocker.resolvedWhen.replace(/\s+/g, ' ') || '(not recorded)'}`,
+            '- **Your answer:** _(accept default · override · defer)_',
+        );
+    });
+    out.push('');
+    return out.join('\n');
+}
+
 function renderReply(entries: readonly Entry[]): string {
     const mine = entries.filter((e) => needsUser(e.blocker.owner));
     if (mine.length === 0) {
@@ -564,6 +759,7 @@ function main(argv?: readonly string[]): number {
     const json = args.includes('--json');
     const reply = args.includes('--reply');
     const pending = args.includes('--pending');
+    const sheet = args.includes('--sheet');
 
     // `--execute <id>` is answered FIRST, and it is the only mode that writes.
     // It used to sit after the `--pending` early return, so `--pending
@@ -643,13 +839,20 @@ function main(argv?: readonly string[]): number {
     // `--reply` deliberately does not carry the probe: ADR-222 fixes that form
     // at exactly ONE decision rendered in full, and a fired resume condition is
     // not a decision the reader owes anybody — it is a file that can move.
-    const resumed = reply ? [] : probeLater(roadmapRoot);
+    // `--reply` and `--sheet` deliberately do not carry the probe: ADR-222 fixes
+    // the reply form at exactly ONE decision rendered in full, and a fired resume
+    // condition is not a decision the reader owes anybody — it is a file that can
+    // move. The sheet is the same argument for the same reason: it is the set of
+    // answers the user owes, and a movable file is not one of them.
+    const resumed = reply || sheet ? [] : probeLater(roadmapRoot, repoRoot);
     process.stdout.write(
-        reply
-            ? renderReply(entries)
-            : json
-              ? renderJson(entries, all, resumed)
-              : render(entries, all, resumed),
+        sheet
+            ? renderSheet(entries, new Date())
+            : reply
+              ? renderReply(entries)
+              : json
+                ? renderJson(entries, all, resumed)
+                : render(entries, all, resumed),
     );
     return 0;
 }
@@ -687,6 +890,7 @@ export {
     renderJson,
     renderReply,
     renderResumed,
+    renderSheet,
     renderPending,
     renderPendingJson,
 };

package/dist/agent-src/skills/roadmap-management/SKILL.md

@@ -293,8 +293,8 @@ After the last step of a roadmap is done, check completion status:
    |---|---|---|---|---|
    | ≥ 1 | 0 | 0 | 0 | **Auto-archive** (silent) — pure completion |
    | ≥ 1 | 0 | 0 | ≥ 1 | **Auto-archive** (silent) — done with explicit drops |
-   | ≥ 1 | 0 | ≥ 1 | ≥ 0 | **STOP — Iron Law 3 flow.** Surface deferred items, present follow-up options, wait. See step 4b. |
-   | 0 | 0 | ≥ 1 | ≥ 0 | **STOP — Iron Law 3 flow.** Was this a scope-drop or deferred-to-later? Same options as 4b. |
+   | ≥ 1 | 0 | ≥ 1 | ≥ 0 | **STOP — Iron Law 3 flow.** Surface deferred items, present the options, resolve by the preservation test (council where the item survives, user where it does not). See step 4b. |
+   | 0 | 0 | ≥ 1 | ≥ 0 | **STOP — Iron Law 3 flow.** Was this a scope-drop or deferred-to-later? Same options and same routing as 4b. |
    | 0 | 0 | 0 | ≥ 1 | **Auto-skip** (silent) — no work, all cancelled |
    | ≥ 0 | ≥ 1 | ≥ 0 | ≥ 0 | **Ask the user** — open work remains (step 4a) |
 
@@ -343,8 +343,13 @@ After the last step of a roadmap is done, check completion status:
    the active tree.
 
 4b. **Deferred items present (`count_deferred ≥ 1`, `count_open == 0`)** — Iron Law 3 flow.
-   The archive is **blocked** until the user resolves the deferrals. Surface
-   the plan and ask:
+   Archive **blocked** until resolved. WHO resolves is the preservation test in
+   [`roadmap-progress-sync § Who resolves it`](../../rules/roadmap-progress-sync.md),
+   never the mode — same menu either way, only the resolver differs:
+
+   - **1, 2, 4** keep the item alive → **council**, recorded at the item (2 only
+     if the follow-up lands in the SAME change).
+   - **3, 5** drop or weaken it → **user**, always. In doubt: user.
 
    ```
    📋 Roadmap closure check — deferred items must resolve before archive:

package/dist/agent-src/templates/agent-settings.md

@@ -507,6 +507,68 @@ telemetry:
       # Append-only JSONL log. Path is relative to the project root.
       # Always gitignored (see config/gitignore-block.txt).
       path: .agent-engagement.jsonl
+  # --- Org telemetry (road-to-org-telemetry Phase 1) ---
+  #
+  # Class-A usage records: which skill was invoked, on which host, at which
+  # package version and rule tier, under a pseudonymous user hash and an
+  # hour-bucketed timestamp. Zero bytes of project content — the record type
+  # has no field capable of holding free text.
+  #
+  # `enabled: true` on its own does NOT switch this on. All three of
+  # `endpoint`, `org_id`, and `salt` must also carry a value, and none of
+  # them has a default. That is deliberate: this repository is public, so it
+  # ships the key NAMES and no values, and a clone cannot reach the write
+  # path by copying the tree. The values come from an org pack.
+  #
+  # Phase 1 writes records LOCALLY and nothing else. The outbound flush is
+  # Phase 2 and org-wide enablement is Phase 3; both are gated on open
+  # blockers in the roadmap.
+  remote:
+    # Master switch. Combined with the three required fields below — see
+    # `active` in scripts/telemetry/settings.ts.
+    enabled: false
+    # Where Phase 2 will flush to. Recorded now, never called in Phase 1.
+    endpoint: ""
+    # The org whose pack enabled this install; written into every record.
+    org_id: ""
+    # Org-pack secret. Salts the user and session hashes so a digest of a
+    # login name is not reversible by dictionary. Never written into a
+    # record, never logged.
+    #
+    # It must live in the SAME `.agent-settings.yml` the reader resolves —
+    # `read_remote_settings` opens one file and consults no override layer,
+    # so a salt placed in `.agent-settings.local.yml` leaves the install
+    # silently inactive. Keep that file out of version control, or supply it
+    # from the org pack at install time.
+    salt: ""
+    # `session-end` = flush at session end (Phase 2). `never` = no transport,
+    # which is a legitimate way to run the local half while the sink question
+    # is still open.
+    #
+    # `never` is NOT an unbounded steady state: the retention budget below
+    # bounds the log whether or not a flush is configured. The consequence
+    # worth knowing before choosing `never` is that the local file is then the
+    # only store, so a record retention evicts is a record that is never sent
+    # anywhere. Raise `retention.max_age_days` if you need a longer local
+    # history.
+    flush: session-end
+    # Growth budget for the log below (`scale-discipline` R-A7). Enforced by
+    # the writer itself, so there is no sweep to remember to run: after each
+    # append, records older than `max_age_days` are dropped, and the file is
+    # held under `max_bytes` from the oldest end regardless of dates.
+    #
+    # The defaults are measured, not guessed. The busiest machine this tree
+    # has observed writes 6.6 skill invocations a day at ~270 bytes each, so
+    # 90 days is roughly 600 records (~160 KiB) and is the cap that actually
+    # binds; 2 MiB is the backstop for a rate that has not been observed.
+    # Omit the section to take both defaults — there is no way to configure
+    # "unbounded", which is the state R-A7 forbids.
+    retention:
+      max_age_days: 90
+      max_bytes: 2097152
+    output:
+      # Append-only JSONL log, relative to the project root. Gitignored.
+      path: .agent-telemetry.jsonl
 
 # --- Linked projects (cross-repo awareness, local-only) ---
 #
@@ -602,6 +664,14 @@ the canonical narrative lives in
 | `telemetry.artifact_engagement.record.consulted` | `true`, `false` | `true` | When `true`: record artefacts loaded into context. |
 | `telemetry.artifact_engagement.record.applied` | `true`, `false` | `true` | When `true`: record artefacts cited or driving a decision. |
 | `telemetry.artifact_engagement.output.path` | path | `.agent-engagement.jsonl` | Append-only JSONL log path, relative to the project root. Always gitignored. |
+| `telemetry.remote.enabled` | `true`, `false` | `false` | Opt-in for Class-A org usage records. **Not the switch on its own** — `endpoint`, `org_id`, and `salt` must all carry a value too, and none has a default, so a clone of the public repository cannot reach the write path. Not in the shipped template; a missing section means disabled. |
+| `telemetry.remote.endpoint` | URL | *(none)* | Where Phase 2 will flush records to. Recorded now; no outbound call exists in Phase 1. Empty ⇒ inactive. |
+| `telemetry.remote.org_id` | string | *(none)* | The org whose pack enabled this install; written into every record. Empty ⇒ inactive. |
+| `telemetry.remote.salt` | string | *(none)* | Org-pack secret salting the user and session hashes — without it a digest of a login name is dictionary-reversible. Never written into a record, never logged. Must sit in the same `.agent-settings.yml` the reader resolves: it consults no override layer, so a salt in `.agent-settings.local.yml` leaves the install silently inactive. Empty ⇒ inactive. |
+| `telemetry.remote.flush` | `session-end`, `never` | `session-end` | When Phase 2 flushes. `never` means no transport — a legitimate way to run the local half while the sink question is open. It is **not** an unbounded steady state: `retention` below bounds the log either way. Under `never` the local file is the only store, so a record retention evicts is never sent anywhere. |
+| `telemetry.remote.retention.max_age_days` | positive integer | `90` | TTL for the local log (`scale-discipline` R-A7). Records older than this are dropped after an append. At the observed 6.6 invocations/day this is ~600 records (~160 KiB) and is the cap that actually binds. Zero, negative, and non-integer values fall back to the default — there is no way to configure "unbounded". |
+| `telemetry.remote.retention.max_bytes` | positive integer | `2097152` (2 MiB) | Hard ceiling on the local log regardless of record age; the oldest records are dropped first, back to 75 % of the cap so the next prune is not immediate. Backstop for a write rate this tree has not observed. |
+| `telemetry.remote.output.path` | path | `.agent-telemetry.jsonl` | Append-only JSONL log path, relative to the project root. Gitignored. Bounded by `retention` above. |
 | `linked_projects` | list of `{path, include}` | `[]` | IDE-attached sibling repos in scope for proactive cross-repo awareness. **Belongs in `.agent-settings.local.yml` (in agents/settings/)** (per-machine, gitignored). See [cross-repo guide](../../docs/guides/cross-repo-linked-projects.md) + ADR-032. |
 | `linked_projects_max_files` | integer | `20000` | File-count ceiling above which a detected sibling is flagged `large` (awareness only). Never excludes. |
 | `knowledge.global_sharing.enabled` | `true`, `false` | `true` | **User-global** (keep in `~/.event4u/agent-config/agent-settings.yml`). Master switch for the file-first global knowledge-card store (ADR-100; default-ON per ADR-119, the council-validated bounded-downside flip superseding ADR-103 — adversarially spot-checked redaction incl. hidden-unicode hardening, narrowest tier default, pre-registered demotion trigger). `false` fully no-ops the layer (single-key revert); v1 project-local cards unaffected. |