@event4u/agent-config 14.20.0 → 14.22.0

package/src/scripts/release.ts

@@ -126,6 +126,7 @@ import {
     derive_category_hits,
     render_derived_head_values,
 } from './_lib/release_highlights.js';
+import { canPrompt, promptLine } from './_lib/tty_prompt.js';
 import { preflightPosition } from './_lib/release_position.js';
 import {
     RELEASE_HEAD_DEFAULT,
@@ -554,8 +555,8 @@ function render_changelog_entry(
 
     // The curated head sits above the generated log, which stays unchanged.
     const body_lines: string[] = [...render_release_head(opts.head ?? {})];
-    // Under the head and outside it — rationale on `MIX_RESPONSE_PLACEHOLDER`.
-    if (opts.mix?.triggered) {
+    // Under the head, outside it; any resolved reading — see `MixObligation`.
+    if (opts.mix) {
         body_lines.push('');
         body_lines.push(...render_mix_response(opts.mix.level));
     }
@@ -933,74 +934,12 @@ function print_preview(plan: Plan): void {
 }
 
 function confirm(prompt: string): boolean | null {
-    const ans = _input(`${prompt} [y/N] `);
+    const ans = promptLine(`${prompt} [y/N] `);
     if (ans === null) return null; // no usable controlling terminal
     const norm = ans.trim().toLowerCase();
     return norm === 'y' || norm === 'yes';
 }
 
-/** Can we prompt at all — is fd 0 a TTY, or is a controlling terminal openable? */
-function _canPrompt(): boolean {
-    if (process.env.CI) return false; // CI is non-interactive by contract → require --yes
-    if (process.stdin.isTTY) return true;
-    try {
-        const fd = fs.openSync('/dev/tty', 'r');
-        fs.closeSync(fd);
-        return true;
-    } catch {
-        return false;
-    }
-}
-
-/**
- * Mirror of Python `input(prompt)` — write the prompt, read one line from the
- * controlling terminal. Returns `null` when no terminal is reachable.
- *
- * The answer is ALWAYS read from a freshly opened, blocking `/dev/tty`
- * (`openSync(..., 'rs')`), NEVER from fd 0. `task release` / `./scripts-run`
- * run this under go-task's `interactive: true`, which leaves fd 0 a TTY
- * (`process.stdin.isTTY === true`) but one Node treats as NON-blocking — so a
- * bare `readSync(0)` throws `EAGAIN`, the catch swallows it, and the `[y/N]`
- * prompt "auto-aborts" without ever waiting (the exact failure this fixes;
- * reproduced with `isTTY === true`). A fresh blocking `/dev/tty` descriptor
- * blocks for real input regardless of how the script was invoked — the proven
- * synchronous-prompt pattern.
- */
-function _input(prompt: string): string | null {
-    process.stdout.write(prompt);
-    let fd: number;
-    try {
-        // 'rs' → O_RDONLY | O_SYNC: a fresh, blocking descriptor on the
-        // controlling terminal, unaffected by Node's non-blocking fd 0.
-        fd = fs.openSync('/dev/tty', 'rs');
-    } catch {
-        return null; // no controlling terminal (true non-interactive)
-    }
-    try {
-        const buf = Buffer.alloc(1);
-        const chars: number[] = [];
-        for (;;) {
-            let bytesRead: number;
-            try {
-                bytesRead = fs.readSync(fd, buf, 0, 1, null);
-            } catch (e) {
-                const code = (e as NodeJS.ErrnoException).code;
-                // A blocking /dev/tty should not yield these, but inherited
-                // descriptor flags can — retry rather than abort the prompt.
-                if (code === 'EAGAIN' || code === 'EINTR') continue;
-                break; // EOF / EIO → EOFError analogue; return what we have.
-            }
-            if (bytesRead === 0) break;
-            const b = buf[0] as number;
-            if (b === 0x0a) break; // newline terminates the line (stripped, like input()).
-            chars.push(b);
-        }
-        return Buffer.from(chars).toString('utf-8');
-    } finally {
-        fs.closeSync(fd);
-    }
-}
-
 export interface ConfirmVerdict {
     proceed: boolean;
     /** Message to surface when not proceeding (no trailing newline). */
@@ -1024,7 +963,7 @@ export function confirmGate(target: string, yes: boolean): ConfirmVerdict {
             'No terminal available for the [y/N] confirmation (non-interactive shell). ' +
             'Re-run with --yes to confirm, e.g. `task release -- --yes`.',
     };
-    if (!_canPrompt()) return noTerminal;
+    if (!canPrompt()) return noTerminal;
     const answer = confirm(`Proceed with release ${target}?`);
     // null = the controlling terminal vanished between the probe and the read;
     // surface the actionable --yes guidance, never a bare silent "aborted.".
@@ -1684,17 +1623,33 @@ function main(argv: readonly string[] | null = null): number {
 
     const bump = resolve_bump(args.bump_override, commits);
 
-    // Resume mode: prefer an existing `release/X.Y.Z` over computed bump,
-    // so we don't accidentally start a 1.16.0 release while 1.15.0 is
-    // still in flight. Explicit --version still wins.
-    const in_flight = args.resume ? _detect_in_flight_target() : null;
+    // An in-flight release is a STATE, never a flag — so the probe runs
+    // unconditionally and `--resume` no longer decides what is being released.
+    //
+    // The comment this replaces already stated the right intent ("so we don't
+    // accidentally start a 1.16.0 release while 1.15.0 is still in flight") and
+    // the `args.resume ?` gate narrowed it to resumed runs only. Measured on
+    // 14.20.0: `guard_release_curation` refuses after step 2 has bumped
+    // `package.json`, so a plain re-run computed the bump from the ALREADY
+    // BUMPED version, landed on 14.21.0, and then refused its own branch with
+    // `release must run from 'main' or 'release/14.21.0', currently on
+    // 'release/14.20.0'`. The 2026-09-07 start-position fix could not help: it
+    // was asked about the wrong target.
+    //
+    // Neither branch of `_detect_in_flight_target` needs the flag — HEAD
+    // sitting on `release/X.Y.Z`, and a `package.json` version whose tag is not
+    // PUBLISHED, are both facts about the repository. On a clean `main` after a
+    // completed release the second branch returns null (the tag is published),
+    // so a fresh release is unaffected; what changes is that an abandoned bump
+    // can no longer be silently released as the NEXT version.
+    const in_flight = _detect_in_flight_target();
     let target: string;
     if (args.explicit) {
         target = args.explicit;
     } else if (in_flight) {
         target = in_flight;
         process.stdout.write(
-            `(resume) in-flight target ${in_flight} (package.json version with no tag yet)\n`,
+            `in-flight target ${in_flight} (package.json version with no published tag yet)\n`,
         );
     } else {
         target = bump_version(current, bump);

package/src/scripts/release_drill.ts

@@ -244,17 +244,13 @@ export function defaultChangelogFixture(target: string): string {
         '',
         '- fixture entry for the release drill',
         '',
-        // Both lines are section-level publication obligations
-        // (`section_publication_blockers`), so a fixture without them refuses
-        // at the curation guard and every sequencing scenario dies at step 2 —
-        // the same "fixture trips the guard the drill exists to sequence"
-        // failure this builder's docstring already warns about, for the two
-        // obligations added 2026-09-05. The mix answer is written OUT rather
-        // than measured: measuring would couple every scenario to the live
-        // repository's commit span, which is the coupling `changelog` was
-        // introduced to remove.
+        // The mix line is written OUT rather than measured: measuring would
+        // couple every scenario to the live repository's commit span, which is
+        // the coupling `changelog` was introduced to remove. It is no longer a
+        // publication obligation (ADR-261 deleted the written answer it used to
+        // carry) — it stays because the drill exercises the shape the writer
+        // actually renders.
         '> **Governance mix:** governance-only 2 vs consumer-only 1 (taxonomy 1.0.0).',
-        '> Next cycle ships the fixture consumer work, tracked in the drill.',
         '',
         'Tests: 1000 (+0 since 0.0.0)',
         '',

package/src/scripts/release_env.ts

@@ -124,6 +124,7 @@ function _set_changelog_reader(fn: ((file: string) => string) | null): void {
 function read_changelog_text(): string {
     return _changelog_reader ? _changelog_reader(CHANGELOG) : fs.readFileSync(CHANGELOG, 'utf-8');
 }
+
 const MAIN_BRANCH = 'main';
 const REMOTE = 'origin';
 const REPO_SLUG = 'event4u-app/agent-config';

package/src/scripts/release_mix_taxonomy.json

@@ -1,6 +1,6 @@
 {
-  "taxonomy_version": "1.0.0",
-  "updated": "2026-09-04",
+  "taxonomy_version": "1.1.0",
+  "updated": "2026-09-08",
   "contract": "docs/decisions/ADR-253-per-pr-user-artifact-gate-declined.md",
   "reader": "src/scripts/measure_release_mix.ts",
   "note": [
@@ -62,6 +62,7 @@
     { "prefix": "src/install/", "category": "consumer" },
     { "prefix": "src/server/", "category": "consumer" },
     { "prefix": "src/ui/", "category": "consumer" },
+    { "prefix": "src/vendor/grammars/", "category": "consumer" },
     { "prefix": "src/shared/", "category": "unclassified" },
 
     { "prefix": "src/scripts/", "category": "maintenance" },

package/src/scripts/release_publication.ts

@@ -458,15 +458,14 @@ export function local_release_gate_argv(): string[] {
 /**
  * Measure the governance-versus-product level for the span under release.
  *
- * The push guard's fourth site reads the SAME obligation the release PR reads,
- * which until 2026-09-05 it did not: `publication_blockers` knew two sentinels
- * and not this one, so the earliest refusal was the pull request. That gap was
- * documented in `docs/contracts/CHANGELOG-conventions.md` and it is what turned
- * 14.17.0 red after a branch, a PR and a CI run had already been spent.
+ * REPORTING ONLY since ADR-261. It feeds exactly one consumer: the `>
+ * **Governance mix:** …` line the writer renders into the section. No guard
+ * reads it, nothing refuses over it, and `triggered` gates nothing — the
+ * written-answer obligation it used to serve is deleted.
  *
  * Returns `null` on any measurement failure — a shallow clone or a missing tag
- * is an environment fact, and the contract is explicit that it degrades to a
- * warning rather than to a refusal. `null` produces no blocker downstream.
+ * is an environment fact, and a release must not stop over one. `null` means
+ * the line is simply not rendered.
  */
 export function measure_mix_obligation(
     version: string,
@@ -478,19 +477,18 @@ export function measure_mix_obligation(
         const reading = measureRange(from, 'HEAD', loadTaxonomy(), version, REPO_ROOT);
         const o = reading.response_obligation;
         return {
-            triggered: o.triggered,
             level:
                 `governance-only ${String(o.governance_only)} vs consumer-only ` +
                 `${String(o.consumer_only)} (taxonomy ${reading.taxonomy_version})`,
         };
     } catch (err) {
-        // The CI side prints `⚠️  governance mix not measured`; swallowing it
-        // here made a broken taxonomy file disable BOTH local guards in
-        // silence while CI kept refusing — the exact asymmetry this change
-        // exists to remove, restored one layer down.
+        // Printed rather than swallowed. Nothing refuses over the reading any
+        // more (ADR-261), so this is not a blocked release — it is a section
+        // that will publish without its `> **Governance mix:** …` line, and the
+        // operator is entitled to know why the line is missing.
         process.stderr.write(
             `⚠️   governance mix not measured for ${version}: ${(err as Error).message}\n` +
-                '    Both local guards are inert for this obligation; the release PR still refuses.\n',
+                '    The section will publish without the measured line. Nothing is blocked.\n',
         );
         return null;
     }
@@ -539,12 +537,7 @@ export function guard_release_branch_push(branch: string): void {
     if (!section) {
         return;
     }
-    const blockers = section_publication_blockers(
-        section.body,
-        version,
-        `\`${branch}\``,
-        measure_mix_obligation(version),
-    );
+    const blockers = section_publication_blockers(section.body, version, `\`${branch}\``);
     if (blockers.length === 0) {
         return;
     }
@@ -685,6 +678,13 @@ export function integrate_main_if_behind(branch: string, say: (msg: string) => v
     run(['git', 'merge', `${REMOTE}/${MAIN_BRANCH}`, '--no-edit']);
 }
 
+/** Everything this site refuses over: the head-level blockers, nothing else. */
+function curation_blockers(version: string): string[] {
+    const section = extract_changelog_section(read_changelog_text(), version);
+    if (section === null) return [];
+    return publication_blockers(section.body, version, `\`release/${version}\``);
+}
+
 export function guard_release_curation(version: string, prMerged = false): void {
     if (prMerged) {
         return;
@@ -693,8 +693,7 @@ export function guard_release_curation(version: string, prMerged = false): void
     if (!section) {
         return;
     }
-    // The head-level blockers plus the mix obligation — deliberately NOT the
-    // tests footer.
+    // The head-level blockers only — deliberately NOT the tests footer.
     //
     // This site runs BEFORE `prepend_changelog`'s output is committed, and
     // `--resume` skips the whole bump block once `package.json` already carries
@@ -707,17 +706,23 @@ export function guard_release_curation(version: string, prMerged = false): void
     //
     // `guard_release_branch_push` carries it instead: by then the section is
     // committed and editable on the branch, and nothing has left the machine.
-    const blockers = [
-        ...publication_blockers(
-            section.body,
-            version,
-            `\`release/${version}\``,
-            measure_mix_obligation(version),
-        ),
-    ];
+    //
+    // What is NOT here any more (ADR-261): the governance-versus-product
+    // written answer, the next-cycle promise, the read-back of the previous
+    // one, the `## [Unreleased]` staging channel that fed them and the
+    // interactive prompt that asked for them. This guard refuses the
+    // generator's own unrewritten draft — a claim no human has looked at — and
+    // nothing else. It never asks the operator to write prose about a future
+    // cycle to get a version out.
+    const blockers = curation_blockers(version);
     if (blockers.length === 0) {
         return;
     }
+    // Read once. This used to re-read the file here, because
+    // `consume_staged_answers` / `collect_curation_answers` could rewrite the
+    // section between the two reads; both write paths are gone (ADR-261) and
+    // `curation_blockers` is read-only, so a second read could only ever
+    // return the same bytes.
     const marked = section.body
         .split('\n')
         .filter((l) => l.includes(DERIVED_MARKER))

package/src/scripts/report_host_injection_effect.ts

@@ -0,0 +1,189 @@
+#!/usr/bin/env tsx
+/**
+ * The per-host injection-effect census — one line per host, provenance or none.
+ *
+ * `road-to-delivery-on-hook-hosts` steps 1.2 and 1.3. It renders the committed
+ * record at `src/config/host-injection-effect.json` and adds the one thing the
+ * record deliberately does not hold: the COMPUTED half, read fresh from the hook
+ * manifest, so a reader sees both axes side by side and can see that they
+ * disagree.
+ *
+ * WHY BOTH COLUMNS ARE PRINTED, ALWAYS
+ * ------------------------------------
+ * `cowork` is the row that makes this table worth generating: eight slots bound
+ * and a measured `observed-false`. Printing only the observation would hide the
+ * near-miss; printing only the binding would produce the wrong verdict for the
+ * one host we have actually measured. The table exists so the gap between "could
+ * emit" and "did arrive" is visible per host rather than argued in prose.
+ *
+ * It computes NO verdict. `admissibleUnderE3` is a one-line read of the observed
+ * column and is applied by the caller that would change a projection, never here:
+ * a report that also decided admission would be the single place where an
+ * inference could quietly replace an observation.
+ *
+ * Usage:
+ *     ./scripts-run src/scripts/report_host_injection_effect
+ *     ./scripts-run src/scripts/report_host_injection_effect --emit --pin <sha>
+ *
+ * Deterministic: hosts sort by id, no timestamp, the pin is an argument.
+ */
+
+import { execFileSync, spawnSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+import {
+    concernBound,
+    loadRecord,
+    recordProblems,
+    type InjectionRecord,
+} from './_lib/injection_effect.js';
+
+const _HERE = fileURLToPath(import.meta.url);
+export const REPO_ROOT = path.resolve(path.dirname(_HERE), '..', '..');
+export const ARTIFACT_REL = path.join(
+    'agents', 'evidence', 'analysis', 'host-injection-effect-2026-09.md',
+);
+
+/** Platform → slot → concern ids, straight out of the manifest. */
+export function loadPlatforms(root: string): Record<string, Record<string, string[]>> {
+    const raw = fs.readFileSync(path.join(root, 'src', 'scripts', 'hook_manifest.yaml'), 'utf-8');
+    const out = spawnSync(
+        process.execPath,
+        [
+            '-e',
+            'const y=require("js-yaml");let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{' +
+                'const d=y.load(s);process.stdout.write(JSON.stringify(d.platforms||{}))})',
+        ],
+        { input: raw, encoding: 'utf-8', cwd: root, maxBuffer: 64 * 1024 * 1024 },
+    );
+    if (out.status !== 0 || !out.stdout) {
+        throw new Error(`hook_manifest.yaml could not be parsed: ${out.stderr || 'no output'}`);
+    }
+    return JSON.parse(out.stdout) as Record<string, Record<string, string[]>>;
+}
+
+/**
+ * Keys under a platform that are NOT lifecycle slots.
+ *
+ * `fallback_only` is a marker saying this package binds nothing here, and
+ * counting it as a slot made copilot read 1 against the 0 that
+ * `docs/enforcement-by-host.md` records — a one-row disagreement with the host
+ * table for a nameable reason, which is the drift this repository gates
+ * elsewhere. Caught by comparing the generated table against that doc rather
+ * than by a test, so it is named here.
+ */
+const NON_SLOT_KEYS: ReadonlySet<string> = new Set(['fallback_only']);
+
+/** Lifecycle slots bound for a host, on the host table's own definition. */
+export function boundSlotCount(platforms: Readonly<Record<string, Readonly<Record<string, readonly string[]>>>>, host: string): number {
+    return Object.keys(platforms[host] ?? {}).filter((k) => !NON_SLOT_KEYS.has(k)).length;
+}
+
+/** Host ids that are real rows, in sort order. Underscore keys are annotations. */
+export function hostIds(rec: InjectionRecord): string[] {
+    return Object.keys(rec).filter((k) => !k.startsWith('_')).sort();
+}
+
+export function renderArtifact(root: string, pin: string): string {
+    const rec = loadRecord(root);
+    const platforms = loadPlatforms(root);
+    const L: string[] = [];
+    L.push('<!-- evidence-type: analysis -->');
+    L.push('# Host injection effect — does a delivered rule body reach the model?');
+    L.push('');
+    L.push(`Pinned to commit \`${pin}\`. Generated by`);
+    L.push(`\`./scripts-run src/scripts/report_host_injection_effect --emit --pin ${pin}\`.`);
+    L.push('Observations come from `src/config/host-injection-effect.json`; the binding column is');
+    L.push('read fresh from `src/scripts/hook_manifest.yaml` on every run.');
+    L.push('');
+    L.push('## The two columns, and why neither is the other');
+    L.push('');
+    L.push('**Slots bound** is computed and cheap. **Body reaches the model** is observed and');
+    L.push('expensive, and owner ruling E3 admits a host to `lean_projection.hosts` on the second');
+    L.push('only: one transcript in which a model visibly acts on a delivered body. Documentation');
+    L.push('of a host\'s hook API is not admission.');
+    L.push('');
+    L.push('`cowork` is why the distinction is not pedantry: **eight slots bound, and measured');
+    L.push('`observed-false`** — its trampoline discards dispatcher output and exits 0. A table');
+    L.push('with only the binding column would admit it.');
+    L.push('');
+    L.push('## Per host');
+    L.push('');
+    L.push('| Host | Slots bound | `rule-inject` on `user_prompt_submit` | Body reaches the model | Citation |');
+    L.push('|---|---:|:-:|---|---|');
+    for (const host of hostIds(rec)) {
+        const obs = rec[host];
+        const slots = boundSlotCount(platforms, host);
+        const bound = concernBound(platforms, host, 'user_prompt_submit', 'rule-inject');
+        const cite =
+            obs !== undefined && obs.transcript !== null && obs.date !== null
+                ? `\`${obs.transcript}\` (${obs.date})`
+                : '—';
+        L.push(
+            `| \`${host}\` | ${String(slots)} | ${bound ? 'yes' : 'no'} | \`${obs?.state ?? 'unobserved'}\` | ${cite} |`,
+        );
+    }
+    L.push('');
+    L.push('## Why each row reads as it does');
+    L.push('');
+    for (const host of hostIds(rec)) {
+        L.push(`- **\`${host}\`** — ${rec[host]?.reason ?? 'no row'}`);
+    }
+    const mdTree = rec['_cursor_md_tree_loaded'];
+    if (mdTree !== undefined) {
+        L.push('');
+        L.push('## `cursor.md_tree_loaded` (step 1.3)');
+        L.push('');
+        L.push(`\`cursor.md_tree_loaded: ${mdTree.state}\` — ${mdTree.reason}`);
+    }
+    L.push('');
+    L.push('## What this census does NOT do');
+    L.push('');
+    L.push('It computes no verdict. Admission under E3 is a one-line read of the observed column');
+    L.push('and is applied by whatever would change a projection, never here — a report that also');
+    L.push('decided admission would be the one place an inference could quietly replace an');
+    L.push('observation.');
+    L.push('');
+    L.push('`unobserved` is a RESULT, not a gap: the host keeps its full rule bodies and loses');
+    L.push('nothing while it waits, which is the roadmap\'s K6 and is asserted per PR by');
+    L.push('`check_host_tree_parity` in the predecessor.');
+    L.push('');
+    return L.join('\n');
+}
+
+function headSha(root: string): string {
+    return execFileSync('git', ['-C', root, 'rev-parse', 'HEAD'], { encoding: 'utf-8' }).trim();
+}
+
+export function main(argv: readonly string[]): number {
+    const root = REPO_ROOT;
+    const rec = loadRecord(root);
+    const problems = recordProblems(rec);
+    if (problems.length > 0) {
+        process.stderr.write('❌  the observation record is not admissible:\n');
+        for (const p of problems) process.stderr.write(`  · ${p.host}: ${p.message}\n`);
+        return 1;
+    }
+    const pinIdx = argv.indexOf('--pin');
+    const pin = pinIdx !== -1 && pinIdx + 1 < argv.length ? (argv[pinIdx + 1] as string) : headSha(root);
+    if (argv.includes('--emit')) {
+        const out = path.join(root, ARTIFACT_REL);
+        fs.mkdirSync(path.dirname(out), { recursive: true });
+        fs.writeFileSync(out, renderArtifact(root, pin), 'utf-8');
+        process.stdout.write(`wrote ${ARTIFACT_REL} · pin ${pin}\n`);
+    }
+    const hosts = hostIds(rec);
+    const byState = new Map<string, number>();
+    for (const h of hosts) byState.set(rec[h]!.state, (byState.get(rec[h]!.state) ?? 0) + 1);
+    process.stdout.write(`scanned: ${String(hosts.length)} host(s)\n`);
+    for (const [state, n] of [...byState].sort()) {
+        process.stdout.write(`  ${state.padEnd(16)} ${String(n)}\n`);
+    }
+    return 0;
+}
+
+if (process.argv[1] !== undefined && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
+    process.exit(main(process.argv.slice(2)));
+}

package/src/scripts/report_layer_overlap.ts

@@ -24,6 +24,7 @@ import * as path from 'node:path';
 import process from 'node:process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
+import { resolveHostLayerVerdict, setPartitionAnnounce } from '../install/partitionEligibility.js';
 import { warnLayerOverlap } from './_lib/layer_overlap_notice.js';
 
 // ledger-exempt: this is a REPORTER, not a gate — it always exits 0 by construction
@@ -59,6 +60,46 @@ export function main(argv?: readonly string[]): number {
             return 1;
         }
     }
+    // The projection line, and where it lives is a correction. **Both council seats
+    // (2026-08-20, 2/2) required that generation PRINT the mode it selected** rather
+    // than partition silently. The 2026-09-07 change moved the withhold off
+    // `installed.lock` and, in doing so, removed `condense.ts`'s only call into the
+    // resolver — so the emitter it installed became dead and generation withheld
+    // ~299 skills and 29 personas while printing nothing about the layer it
+    // withheld against. A neutral review found it the same day.
+    //
+    // It prints from HERE rather than from `condense.ts` because that file is ~1,200
+    // lines past the source-size ceiling, where the ratchet counts every added line
+    // and its test blocks on `baseline == live`. This step already runs in the same
+    // `generate-tools` chain, one line below the generator, so the operator sees the
+    // two lines together.
+    // Silence the resolver's OWN one-liner first: it writes to stdout by default,
+    // and leaving it on printed the verdict twice — once bare, once with the
+    // remediation text below. One line, the useful one.
+    setPartitionAnnounce(() => undefined);
+    const verdict = resolveHostLayerVerdict(projectRoot);
+    // Three states, not two. Corrected after a second neutral review: the
+    // unverified branch printed "a stale global layer is fixed by
+    // `agent-config install`" on a machine with NO global layer at all — a fresh
+    // checkout, where nothing is withheld, nothing is stale, and the remediation
+    // named does not apply. It fired on every `task generate-tools` there.
+    //
+    // What this line reports is the VERIFICATION state of the layer withheld
+    // against. The per-artefact withhold COUNTS are the generator's own summary
+    // one line above (`skills=N`, `command_skills=N (M withheld …)`), which is
+    // where a reader sees what was actually held back.
+    const noLayer = verdict.reason.includes('no host-global layer');
+    process.stdout.write(
+        verdict.verified
+            ? `  ℹ️  project layer carries only what ~/.claude lacks — ${verdict.reason}\n`
+            : noLayer
+              ? '  ℹ️  no host-global layer on this machine — nothing is withheld, so the\n' +
+                '      project layer carries the full projection by construction.\n'
+              : `  ⚠️  host layer UNVERIFIED — ${verdict.reason}\n` +
+                '      The project layer still carries only what ~/.claude lacks (per-artefact,\n' +
+                '      ADR-236 amendment 2026-09-07). A stale global layer is fixed by\n' +
+                '      `agent-config install`, not by re-running generate-tools.\n',
+    );
     warnLayerOverlap(projectRoot, (m) => process.stdout.write(`${m}\n`));
     return 0;
 }