@event4u/agent-config 14.20.0 → 14.22.0

package/src/config/continuity-surface.json

@@ -0,0 +1,509 @@
+{
+    "$comment": "Behavioural continuity-surface inventory. See src/scripts/_lib/continuity_surface.ts for the contract and src/scripts/check_continuity_surface.ts for the gate. Rows are validated against the tree on every run: every `locus` must resolve, and every persisted-state leaf under agents/runtime/state/ that any source file names must appear here with a disposition. Retiring a surface means DELETING its row \u2014 that is what makes a retirement measured rather than claimed.",
+    "axis_contract": {
+        "public_continuity_commands": "A public CLI verb or slash command that a normal user must invoke for continuity to happen. An optional affordance is excluded WITH its reason, never silently.",
+        "session_resume_pickers": "An interactive surface that asks a human to choose which prior session to resume.",
+        "persistent_continuity_artefacts": "Persisted state written for later session recovery, verification, or context restoration \u2014 whether or not it is labelled continuity. Corpus discovered behaviourally from agents/runtime/state/, never from the word.",
+        "continuity_schemas": "A distinct schema definition for a record a successor session reads to restore state.",
+        "normal_path_manual_actions": "A manual step a normal user must take on the normal path for continuity to work."
+    },
+    "targets": {
+        "public_continuity_commands": 0,
+        "session_resume_pickers": 0,
+        "persistent_continuity_artefacts": 1,
+        "continuity_schemas": 1,
+        "normal_path_manual_actions": 0
+    },
+    "rows": [
+        {
+            "id": "schema:capsule",
+            "axis": "continuity_schemas",
+            "disposition": "counted",
+            "locus": "src/scripts/_lib/subagent_capsule.ts:112",
+            "reason": "The one continuity-record schema: version 4, variant-discriminated, accepting v3 and v4. A recorded lock governs it \u2014 one schema, variant-discriminated, no new format, adding fields or variants but never repurposing or removing one. This is the surviving `1`."
+        },
+        {
+            "id": "schema:context-observation",
+            "axis": "continuity_schemas",
+            "disposition": "excluded",
+            "locus": "src/scripts/_lib/context_observation.ts:55",
+            "reason": "A recorded probe of external context (the fingerprint a checkpoint may carry). An input to a record, never a record."
+        },
+        {
+            "id": "schema:run-checkpoint",
+            "axis": "continuity_schemas",
+            "disposition": "excluded",
+            "locus": "src/scripts/_lib/run_checkpoint.ts:45",
+            "reason": "Run-integrity evidence, excluded on the same recorded D2 ruling that excludes the `checkpoints/` artefact: different key (run id), different consumer (`run:supervise`), different failure semantics (an integrity alarm, not a degraded resume)."
+        },
+        {
+            "id": "schema:session-eol-state",
+            "axis": "continuity_schemas",
+            "disposition": "excluded",
+            "locus": "src/scripts/_lib/session_eol.ts:55",
+            "reason": "The writer`s own bookkeeping, not a record a successor reads. It holds counters and advisory stamps used across Stops within one session; nothing restores a session from it."
+        },
+        {
+            "id": "manual:run-session-recycle-before-clear",
+            "axis": "normal_path_manual_actions",
+            "disposition": "counted",
+            "locus": "src/scripts/hooks/session_eol_hook.ts:258",
+            "reason": "The advisory the stop slot injects past the recycle threshold instructs a human to run `agent-config session:recycle`, wait for the absolute path it prints, and only then `/clear`. That is a manual action on the normal path, and it exists precisely because no automatic writer does. It is what step 3.1 removes the need for."
+        },
+        {
+            "id": ".dispatcher",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/hooks/cline-dispatcher.sh:77",
+            "reason": "The cline dispatcher marker file. Host wiring, not session state."
+        },
+        {
+            "id": ".dispatcher.lock",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/context_hygiene_hook.ts:36",
+            "reason": "A concurrency lock for the dispatcher. Held within one invocation."
+        },
+        {
+            "id": "ai-video-telemetry.jsonl",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/media/lib/telemetry.sh:7",
+            "reason": "Media-pipeline telemetry. A different subsystem entirely."
+        },
+        {
+            "id": "audit",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/_lib/activation_receipt_producer.ts:322",
+            "reason": "The append-only orchestration audit log. Telemetry and cost reporting; no restore path reads it."
+        },
+        {
+            "id": "chain-nudge.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/hooks/chain_nudge_hook.ts:190",
+            "reason": "Once-per-session nudge latch."
+        },
+        {
+            "id": "checkpoints",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/_lib/headless_invocation.ts:48",
+            "reason": "Run-integrity evidence, not conversational state. THE KEEP/RETIRE QUESTION IS ANSWERED HERE, IN WRITING, and the answer is KEEP \u2014 which is what roadmap step 4.1's third verify clause asks for, recorded at the point where the count is computed rather than in a document nobody opens. The AI council of 2026-09-07 (D2) ruled it: a run checkpoint is keyed by RUN id, consumed by `run:supervise` and `latestCheckpointFor`, and a disagreement there is an integrity alarm; a continuity record is keyed by SESSION, consumed by resume, and a gap there is a degraded resume. Different lifecycle, consumer, key and failure semantics, so one concern owning both would be \"a lifecycle subsystem wearing a continuity name\". Excluded from the continuity axis on that ruling \u2014 and this is the exclusion the same council named as the gaming vector for position 3, which is exactly why it is printed on every run instead of living inside a predicate."
+        },
+        {
+            "id": "code-graph-context.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/hooks/code_graph_context_hook.ts:90",
+            "reason": "Code-intelligence context state for the code-graph hook. A derived cache over the source tree, rebuildable from it, and read within the session that wrote it \u2014 it restores no conversation and no run."
+        },
+        {
+            "id": "code-graph-refresh.lock",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "reason": "A concurrency lock guarding the code-graph refresh so two checkouts do not rebuild the index at once. Held for the duration of one refresh; it carries no state anyone reads afterwards.",
+            "locus": "src/scripts/install-hooks.sh:634"
+        },
+        {
+            "id": "code-graph-v1.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/code_graph/cli.ts:28",
+            "reason": "A derived code-intelligence index. A cache of the source tree, rebuildable from it, and never session state."
+        },
+        {
+            "id": "config-weakening.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/hooks/block_config_weakening.ts:211",
+            "reason": "Per-session allowlist-growth counters for the config-weakening guard."
+        },
+        {
+            "id": "context-fill.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "counted",
+            "locus": "src/scripts/hooks/session_eol_hook.ts:31",
+            "reason": "Machine-readable fill level plus threshold state, overwritten every Stop. Written for later verification of whether the session crossed the recycle threshold. AUTHORISED FOR RETIREMENT and NOT RETIRED \u2014 the authorisation (AI council 2026-09-08 D1, resting on producer/no-consumer evidence) was obtained on incomplete facts. There is no consumer in code, but `agents/roadmaps/later/road-to-cost-parity-2-state-aware-dispatch.md` is a live parked roadmap whose open steps 1.1 and 1.4c read this file as a planned input, and 1.4c is specifically about bounding its staleness. The same council's own qualification anticipated this: \"no consumer in the tree\" proves no in-repository consumer, and a planned consumer inside the tree is a stronger objection than an external one because it is checkable. Retiring it is a decision for that roadmap's owner, not a side effect of this one. Blocker: `context-fill-retirement-has-a-parked-consumer`."
+        },
+        {
+            "id": "context-hygiene.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/_cli/cmd_analyze_session.ts:15",
+            "reason": "Turn and loop counters for the context-hygiene carrier. Read within a session to decide whether to warn; never read by a successor."
+        },
+        {
+            "id": "council-probes.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/ai_council/probe_store.ts:52",
+            "reason": "Council seat availability probe cache. Provider state."
+        },
+        {
+            "id": "decisions",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/_dispatch.bash:1302",
+            "reason": "Decision memos written during a run and rendered by `run:supervise`. A record of what was decided, not state a successor resumes from."
+        },
+        {
+            "id": "design-pass-hook.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/hooks/design_pass_hook.ts:66",
+            "reason": "Design-pass hook latch."
+        },
+        {
+            "id": "design-slop-hook.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/hooks/design_slop_hook.ts:18",
+            "reason": "Design-slop hook latch."
+        },
+        {
+            "id": "discovery-graph-v1.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/complexity_report.ts:223",
+            "reason": "A derived artefact-relation cache. Rebuildable from the tree."
+        },
+        {
+            "id": "dispatch-issues.jsonl",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/hooks/dispatch_issues.ts:12",
+            "reason": "Dispatcher self-diagnostics. Read by `hooks_doctor`."
+        },
+        {
+            "id": "edit-shape",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/hooks/edit_shape_hook.ts:46",
+            "reason": "Edit-shape hook per-file state, scoped to one session."
+        },
+        {
+            "id": "end-review-nudge",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/hooks/end_review_nudge_hook.ts:138",
+            "reason": "Once-per-session nudge latch."
+        },
+        {
+            "id": "gate-budget-ledger.jsonl",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/server/schemas/settings.ts:208",
+            "reason": "Gate-budget accounting. CI cost bookkeeping."
+        },
+        {
+            "id": "handoff-context.md",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "counted",
+            "locus": "src/scripts/_cli/cmd_handoff.ts:9",
+            "reason": "A second, prose-shaped session handoff written by `agent-config handoff` and injected once at the next `session_start`. Same job as the record, different format and different lifecycle \u2014 a competing mental model, which is what the count exists to expose."
+        },
+        {
+            "id": "hot-context.md",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "counted",
+            "locus": "src/scripts/hot_context_hook.ts:11",
+            "reason": "A working-memory cache rebuilt on stop/session_end/pre_compact and restored at session_start. Persisted state written for context restoration, so the behavioural rule counts it whatever it is called."
+        },
+        {
+            "id": "injection-census.jsonl",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/bench_hook_injection.ts:42",
+            "reason": "Hook-injection benchmark output. Measurement, not state."
+        },
+        {
+            "id": "injection-turn",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/hooks/injection_budget.ts:349",
+            "reason": "Per-turn injection budget accounting. Lives and dies inside one turn."
+        },
+        {
+            "id": "interruptions.jsonl",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/hooks/interruption_ledger_hook.ts:6",
+            "reason": "An interruption ledger for reporting. Analysis input, never a restore source."
+        },
+        {
+            "id": "memory-index-v1.sqlite3",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/_lib/memory_fts_index.ts:36",
+            "reason": "The memory full-text index. A derived cache over `agents/memory/`, rebuildable, and not session state."
+        },
+        {
+            "id": "onboarding-gate.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/onboarding_gate_hook.ts:13",
+            "reason": "Onboarding latch. Same class as the disclosure latch."
+        },
+        {
+            "id": "probe-throttle",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/hooks/probe_throttle.ts:9",
+            "reason": "Generic probe throttling stamps."
+        },
+        {
+            "id": "quota-parked",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/_lib/quota_parked.ts:38",
+            "reason": "Council seat quota parking. Provider state, unrelated to session recovery."
+        },
+        {
+            "id": "recycle-envelope.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "counted",
+            "locus": "src/scripts/_cli/cmd_session_recycle.ts:9",
+            "reason": "The continuity record itself: written by `session:recycle`, resolved per session by `resolveContinuityRecord`, consumed once at `session_start` by the handoff-context concern. This is the artefact the whole roadmap is collapsing the others INTO \u2014 the surviving `1`."
+        },
+        {
+            "id": "render",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/_dispatch.bash:77",
+            "reason": "Scratch render output for the UI surfaces."
+        },
+        {
+            "id": "reread-guard",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/hooks/reread_guard_hook.ts:21",
+            "reason": "Per-file re-read guard stamps, scoped to one session and never restored into another."
+        },
+        {
+            "id": "review-axis",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/review_axis_report.ts:209",
+            "reason": "Review-axis report state. Analysis output."
+        },
+        {
+            "id": "routing-telemetry.jsonl",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/_cli/cmd_route_audit.ts:48",
+            "reason": "Router match telemetry for `route:audit`. Opt-in measurement."
+        },
+        {
+            "id": "rule-inject",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/hooks/rule_inject_hook.ts:124",
+            "reason": "Rule-injection dedupe state, scoped to one session."
+        },
+        {
+            "id": "rule-trips.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/_cli/cmd_route_audit.ts:17",
+            "reason": "Rule-trip counters for `route:audit`. Measurement."
+        },
+        {
+            "id": "run-continuation.jsonl",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/hooks/run_continuation_hook.ts:41",
+            "reason": "An append-only event ledger for the stop-slot continuation gate. It records what the gate decided, and nothing reads it to restore a session."
+        },
+        {
+            "id": "session-eol",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "counted",
+            "locus": "src/scripts/_cli/handoff_sessions.ts:102",
+            "reason": "Per-session end-of-life counters plus the advisory stamps. Persisted for VERIFICATION across Stops (the \"advised, but no envelope exists\" counter-check) and read by `handoff_sessions.ts` to populate the resume picker, so it is in scope under the behavioural rule even though it restores nothing itself."
+        },
+        {
+            "id": "skill-tiers.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/_lib/mcp_bridge.ts:319",
+            "reason": "Computed skill tiers. A derived cache over `src/skills/`."
+        },
+        {
+            "id": "source-first-gate.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/hooks/source_first_gate_hook.ts:95",
+            "reason": "Source-first gate latch state."
+        },
+        {
+            "id": "source-first-gate.jsonl",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/hooks/source_first_gate_hook.ts:93",
+            "reason": "Source-first gate event ledger."
+        },
+        {
+            "id": "subagent-ledger",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/_lib/host_capability.ts:219",
+            "reason": "Subagent return envelopes. Worker-generation lifecycle, explicitly a different subject from main-session continuity \u2014 the parent roadmap named the two-envelope vocabulary collision and kept them distinct."
+        },
+        {
+            "id": "suggestion-latch.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/hooks/suggestion_capture_hook.ts:58",
+            "reason": "Once-per-session suggestion latch."
+        },
+        {
+            "id": "supervise-relaunches.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/interruption_report.ts:264",
+            "reason": "Relaunch counters for the supervisor. Run-lifecycle bookkeeping under the run-integrity exclusion above."
+        },
+        {
+            "id": "surface-probe.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/surface_probe_hook.ts:15",
+            "reason": "Surface-probe throttle state."
+        },
+        {
+            "id": "team-review-gate.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/ai_team/review_gate.ts:102",
+            "reason": "Team review-gate latch, consumed within the session that set it."
+        },
+        {
+            "id": "telemetry-disclosure.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/telemetry_disclosure_hook.ts:26",
+            "reason": "A once-per-project disclosure latch. It records that a notice was shown, which is consent bookkeeping rather than context."
+        },
+        {
+            "id": "test-results.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/_lib/test_red_state.ts:2",
+            "reason": "Last test-run red state, read by the verification gates within a run."
+        },
+        {
+            "id": "tool-result-census.jsonl",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/hooks/tool_result_bytes_hook.ts:92",
+            "reason": "Tool-result byte census. Measurement output."
+        },
+        {
+            "id": "turn-end-gate",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/_lib/turn_end_refusals.ts:73",
+            "reason": "Refusal records for the turn-end quality gate. Consumed by the gate and by `hooks_doctor`, not by a successor session."
+        },
+        {
+            "id": "ui-audit.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/_dispatch.bash:74",
+            "reason": "UI audit output. Analysis result."
+        },
+        {
+            "id": "ui-route-nudge.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/hooks/ui_route_nudge_hook.ts:174",
+            "reason": "Once-per-session nudge latch."
+        },
+        {
+            "id": "unattended-budget.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/_lib/unattended_guard.ts:45",
+            "reason": "Unattended-run budget accounting."
+        },
+        {
+            "id": "unattended-jobs.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/_lib/unattended_guard.ts:46",
+            "reason": "Unattended job records."
+        },
+        {
+            "id": "verify-before-complete.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/_lib/envelope_grounding.ts:130",
+            "reason": "Verification-gate state, consumed within the run that wrote it."
+        },
+        {
+            "id": "work",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/explain_run.ts:725",
+            "reason": "Work-engine decision traces under `work/<id>/`. Per-run explainability output consumed by `explain_run`, not a restore source."
+        },
+        {
+            "id": "x.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/check_prefix_stable_mutation.ts:268",
+            "reason": "Not a surface: a string literal inside `check_prefix_stable_mutation`s own fixture, which the discovery walk sees because it scans source text. Listed rather than filtered out, because a filter is where a real leaf would eventually hide."
+        },
+        {
+            "id": "verb:chat-history:checkpoint",
+            "axis": "public_continuity_commands",
+            "disposition": "excluded",
+            "locus": "src/cli/registry.ts:113",
+            "reason": "Also capture, and out of scope on the same ground. What step 4.1b targets is the colliding NAME, not the capability: the verb dispatches to `chat_history.ts hook-append --event phase` and has four live producers in generated git hooks."
+        },
+        {
+            "id": "verb:chat-history:hook",
+            "axis": "public_continuity_commands",
+            "disposition": "excluded",
+            "locus": "src/cli/registry.ts:112",
+            "reason": "Chat-history CAPTURE, which the parent roadmap places out of scope by decision: it is the only cross-host transcript source and has no substitute on hosts with no native transcript."
+        },
+        {
+            "id": "verb:handoff",
+            "axis": "public_continuity_commands",
+            "disposition": "excluded",
+            "locus": "src/cli/registry.ts:62",
+            "reason": "An OPTIONAL affordance, not a required step. The parent roadmap`s blocker resolution of 2026-09-06 explicitly preserved `handoff` and `/agent-handoff` as the surviving verb and command, and its goal states the target as \"no continuity-specific command is REQUIRED\" rather than none existing. Excluded on that wording \u2014 and the tension is recorded rather than hidden: read as a bare count of existing public commands, the parent`s target of 0 is unreachable while its own resolution keeps this verb alive."
+        },
+        {
+            "id": "verb:session:recycle",
+            "axis": "public_continuity_commands",
+            "disposition": "counted",
+            "locus": "src/cli/registry.ts:73",
+            "reason": "REQUIRED on the normal path today: it is the only writer of the continuity record in the tree, so continuity does not happen unless a human runs it. That is what makes it a continuity command rather than an affordance, and it is on the owner-authorised retirement set of 2026-09-06."
+        },
+        {
+            "id": "command:chat-history",
+            "axis": "session_resume_pickers",
+            "disposition": "excluded",
+            "locus": "src/domains/meta/chat-history/command.md:3",
+            "reason": "The orchestrator shell that routes to the import picker; it presents no picker of its own. Counting both would double-count one surface. It is retired together with the picker it routes to, so the row disappears with it."
+        },
+        {
+            "id": "picker:agent-handoff",
+            "axis": "session_resume_pickers",
+            "disposition": "counted",
+            "locus": "src/domains/meta/agent-handoff/command.md:41",
+            "reason": "A numbered-options block asking a human which prior session to resume. It is a picker by construction, and the parent`s target of 0 pickers is in tension with its preservation of this command \u2014 recorded here so the tension is visible in the count rather than argued away."
+        },
+        {
+            "id": "picker:chat-history-import",
+            "axis": "session_resume_pickers",
+            "disposition": "counted",
+            "locus": "src/domains/meta/chat-history/import/command.md:77",
+            "reason": "A numbered-table session picker plus a resume offer \u2014 a second, competing answer to \"which prior session do I continue from\". On the owner-authorised retirement set of 2026-09-06."
+        }
+    ]
+}

package/src/config/estate-count-budget.json

@@ -7,7 +7,7 @@
     "review_by": "2027-08-18",
     "metric": {
         "basis": "src/scripts/check_estate_count.ts. The live side uses collect() from update_roadmap_progress — the same parser the dashboard is generated from, imported rather than re-implemented. The floor side runs the SAME functions over a scratch copy of the base ref's agents/roadmaps/, materialised by _lib/base_tree.ts (git ls-tree + git cat-file --batch; `git archive` cannot be used here because .gitattributes carries `/agents export-ignore` and would yield an empty, silently-zero tree). SKILL METRICS (added 2026-08-24): _lib/skill_estate.ts walks src/skills/*/SKILL.md under the SAME root, so the floor side measures the base ref's own skill tree with the same function. That needs a SECOND materialised subtree — materialiseSubtree takes one prefix — and the two are independent on purpose: a base ref with no src/skills (an old tag, a shallow clone) drops the skill metrics and leaves the roadmap metrics ratcheting.",
-        "active_roadmaps": "roadmap candidates at the top level of agents/roadmaps/ that are not drafts, as collect() counts them, PLUS the ones collect() drops for declaring status: carrier. NO LONGER EQUAL TO THE DASHBOARD HEADER'S 'N open roadmaps', and the divergence is deliberate: with carriers excluded, flipping one roadmap's frontmatter to status: carrier measured active_roadmaps 3 -> 2 with the gate printing 'estate within its ratchet', because a count below the floor is a drawdown and free. The floor is measured at the base ref, so that flip lowers the next change's floor permanently, the file cannot be flipped back without paying, and any roadmap can be laundered out of the count by adding one word. A reclassification is not a disposal, so the metric counts the file on both sides and a flip changes nothing. Same reasoning later_roadmaps and open_blockers already carry: estate all the same, and a number that falls on a relocation prints free tightening over a burial. Both directions hold - deleting a carrier is still a shrink that earns no offset (classifyDiff), and adding one is growth that takes the estate_growth_exempt claim path like any other new roadmap. Drafts stay excluded on both sides, unchanged.",
+        "active_roadmaps": "roadmap candidates at the top level of agents/roadmaps/ that are not drafts, as collect() counts them. EQUAL to the dashboard header's 'N open roadmaps'. It used to add back the candidates collect() dropped for declaring status: carrier, so that FLIPPING a roadmap to that status was count-neutral: the flip measured 3 -> 2 with the gate printing 'estate within its ratchet', because a count below the floor is a drawdown and free; the floor is measured at the base ref, so the lowered number became the next floor and any roadmap could be laundered out of the count by adding one word. ADR-262 (2026-09-08) deleted status: carrier, so there is no flip to neutralise, no add-back, and no divergence from the header left. Drafts stay excluded on both sides, unchanged, and a draft flip has the same laundering shape — it is tolerated because a draft may be deleted freely, which is the property the deleted status did not have.",
         "later_roadmaps": "roadmap-shaped *.md files under agents/roadmaps/later/ — the same is_roadmap_candidate name filter the active side uses, so later/README.md is not counted. Counted from the filesystem because parked roadmaps sit outside collect()'s corpus by design; they are estate all the same, and a drawdown that moved everything into later/ and called the number down would be the burial T1's quality anchor exists to prevent.",
         "open_blockers": "blockers whose Status does not start with `resolved`, summed over the active and later corpora.",
         "floor": "the same three metrics measured at the base ref (origin/main, else the merge commit's first parent). No base ref resolves -> no floor -> the gate FAILS rather than skipping: a shrink-only gate with no floor passes every possible tree. `--base <ref>` is the explicit escape.",

package/src/config/gate-coverage.yml

@@ -52,14 +52,18 @@
 #                of them.
 #   canary       optional mutation recipe (Phase 7) — see CANARY below
 #
-# COVERAGE — THE HONEST DENOMINATOR (re-measured 2026-08-28)
+# COVERAGE — THE HONEST DENOMINATOR (re-measured 2026-09-08)
 # ----------------------------------------------------------
-# 306 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`
+# 322 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`
 # (the count is computed, not asserted — `check_gate_coverage.count_gate_scripts`,
-# re-run on the tree carrying these rows, which now include the four gates the
-# two runtime-cost roadmaps add: check_prefix_stable_mutation,
-# check_loss_class_declared, check_benchmark_report_fields, and
-# check_no_currency_in_cost_surfaces).
+# re-run on the tree carrying these rows. Re-measured 2026-09-08 from the 306
+# recorded on 2026-08-28: the tree had drifted to 321 without the header moving,
+# which is 15 — exactly the drift tolerance in
+# `check_gate_coverage.test.ts` § states an honest denominator — so the next
+# single addition was always going to red it. `check_candidate_lines` from
+# `road-to-candidate-moves-floor` was that addition. The number is re-measured
+# rather than the tolerance widened: a stated population that nobody re-measures
+# is the un-asserted count this whole manifest exists to refuse.)
 # **78 of them emit the machine-readable `scanned: <N>` line under their
 # CI-identical argv, and 75 of those 78 are listed below.** The manifest is
 # complete for every gate that can carry a floor, covering ~25 % of the population.
@@ -487,14 +491,14 @@ gates:
     corpus: "every agents/roadmaps/*.md, counted as FILES rather than as declarations. THE FLOOR WAS RETIRED ON 2026-08-30 AND REPLACED WITH AN ENUMERATION ASSERTION IN THE LINTER ITSELF (AI council, anthropic + openai, convergent on option b). It sat at 5 over a population under deliberate drawdown to ZERO, so it went red the day the drain succeeded — 6 active roadmaps to 4 in one afternoon — and the only available move was lowering the number again, a treadmill ending at a floor of 0, which is no floor. What guards the scope now is `lint_consolidation_lineage` refusing outright when a declared root is missing, is not a directory, or cannot be enumerated; that check lives in the PRODUCTION linter rather than here on purpose, because an independent existsSync in this gate would observe a directory without proving the linter enumerated it. Honest limit, named rather than implied: it catches a missing or renamed root, not a glob narrowed to match nothing, not enumeration in the wrong working directory, and not roadmaps moved into nested directories the walk no longer traverses. Today none of them carries a `consolidates:` field, so the finding count is legitimately zero while the scanned count is not — that split is the point: a declaration-count floor would be a zero-check wearing a ratchet's name, and would go green the moment the scan root moved. The floor sits at 5 rather than near the present 12 because the active estate is under deliberate drawdown (one-in-one-out plus an explicit drain), so a falling count is expected work rather than a collapse; below 5 the estate would be smaller than any point in its recorded history. NO CANARY, deliberately: the council decision that admitted this gate (2026-08-27, 2/2 convergent, E1=b/E2=report) fixed it in REPORT mode, so it exits 0 on findings by design and a planted violation could not turn it red. Its ability to go red is proven instead by `--self-test`, which the same decision required: six declaration spellings must parse identically, all four finding types must fire, and a complete folder must stay silent."
     status: enforced
     no_canary_reason: "A report-mode gate cannot be turned red by a planted file. The council decision that admitted this gate (2026-08-27, 2/2 convergent, E1=b/E2=report) fixed it in report mode deliberately: the four measured failures come from a high-noise drafting context and do not establish precision on the tracked estate, so blocking is earned by tracked-scope evidence rather than assumed. A canary here would either be planted and ignored (proving nothing) or force `--strict` into CI, which would decide E2 by wiring instead of by evidence. The negative control is `--self-test` instead, required by the same decision and stronger than a single planted file: six declaration spellings must parse to an identical parent set, all four finding types must fire, and a complete folder must stay silent — the third arm being what stops a checker that returned every code unconditionally from passing the second. Revisit together with E2: when the tracked half is promoted to blocking, it owes a canary."
-  - id: lint_carrier_integrity
+  - id: lint_deferral_integrity
     argv: []
     min_scanned: 600
     corpus: "every roadmap file under agents/roadmaps/archive/ and agents/roadmaps/skipped/ — 656 at the time of writing, and the count only rises because archival is one-way. The floor sits at 600 rather than near 656 because a reading below it means the walk lost a directory, not that roadmaps were un-archived. The walk direction is the design: a `[~]` carry is validated once, when the parent is archived, by a sweep that then never looks at the pair again, so the receiver can be deleted afterwards with nothing going red. Starting from the archived parent — which names its destination by slug and which nothing rewrites — makes whole-file deletion detectable on the first pass, with no registry to maintain. TWO CLASSES, and the split decides the tier: `broken-destination` (deleted, renamed, re-parented, skipped, or archived with open steps) is a HARD failure at zero with no baseline, because every member had a recorded home and lost it; `unannotated` (a bare `[~]` with no annotation at all) is ratcheted at 243 in gate-violation-baselines.json, all of it predating the annotation contract by up to three months."
     status: enforced
     canary:
       class: contract-violation
-      path: agents/roadmaps/archive/zz-canary-carrier-integrity.md
+      path: agents/roadmaps/archive/zz-canary-deferral-integrity.md
       content: |
         ---
         complexity: bounded
@@ -1295,6 +1299,23 @@ gates:
       or if a drop to 0 is ever traced to a scanner defect rather than to an
       empty corpus.
 
+  - id: check_continuity_surface
+    argv: []
+    min_scanned: 40
+    corpus: "the rows of src/config/continuity-surface.json PLUS every distinct persisted-state leaf under agents/runtime/state/ that any source file under src/scripts, src/agent-src/scripts, src/cli, src/shared, src/server or src/install names (70 rows + 58 discovered leaves = 128 at introduction). The floor is 40 rather than ~120 because the roadmap this gate serves is SUBTRACTIVE by design: rows are meant to disappear as surfaces are retired, and a floor set near the live number would red on the very drawdown the gate exists to encourage. It is still far above a collapse — the discovery walking a moved root reads 0, and a taxonomy that dropped to a handful of hand-picked rows would trip it."
+    status: enforced
+    no_canary_reason: >-
+      the negative control is the gate's own --self-test, run in CI: 7 cases, 4
+      rejecting, covering every failure class in BOTH directions — an
+      undisposed persisted-state leaf, a row whose locus no longer resolves, a
+      counted axis above the base-ref floor, and a row with no reason of
+      substance, against three accepting cases including the shipped inventory
+      over the shipped tree. It builds throwaway repositories rather than
+      touching this one. A planted canary here would mean committing a real
+      undisposed state path into src/ and removing it again, and a forgotten one
+      is precisely the defect this gate exists to catch — the same argument
+      check_gate_reachability records for itself one row below.
+
   - id: check_gate_reachability
     script: src/scripts/check_gate_reachability.ts
     min_scanned: 10