@event4u/agent-config 14.21.0 → 14.23.0

package/.augment-plugin/marketplace.json

@@ -1,20 +1,20 @@
 {
   "name": "event4u-agent-config",
   "description": "Governed agent system — skills, rules, commands, and guidelines for AI-assisted development.",
-  "version": "14.21.0",
+  "version": "14.23.0",
   "owner": {
     "name": "event4u",
     "email": "dev@event4u.app"
   },
   "metadata": {
     "description": "A policy-driven execution system that enforces quality, consistency, and developer-like behavior for AI agents.",
-    "version": "14.21.0"
+    "version": "14.23.0"
   },
   "plugins": [
     {
       "name": "agent-config",
       "description": "Full governed agent system — rules, skills, commands, guidelines, and runtime tooling.",
-      "version": "14.21.0",
+      "version": "14.23.0",
       "source": ".",
       "category": "governance",
       "tags": [

package/.augment-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-config",
   "description": "A governed skill framework for AI agents — runtime execution, tooling, observability, feedback, and lifecycle management with policy-driven quality enforcement.",
-  "version": "14.21.0",
+  "version": "14.23.0",
   "author": {
     "name": "event4u",
     "email": "dev@event4u.app"

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Bootstrap shim for the event4u agent-config suite. This plugin ships ONLY the dispatcher hooks plus one install-pointer skill — ALL content (skills, rules, commands) is installed via `npx -y @event4u/agent-config init`, which writes the file projection AND registers the same hooks in ~/.claude/settings.json. DEPRECATED as a content channel; kept so the marketplace listing stays discoverable and existing installs keep working hooks.",
-    "version": "14.21.0",
+    "version": "14.23.0",
     "keywords": [
       "agent-config",
       "skills",

package/CHANGELOG.md

@@ -650,224 +650,201 @@ Entry-shape contract: [`docs/contracts/CHANGELOG-conventions.md`](docs/contracts
 > keeps the active era under the 250-line drift cap enforced by
 > `tests/test_changelog_eras.py`.
 
-# Era: 14.20.x — current
+# Era: pre-14.23.0 — archived
 
-> Started at `14.20.0`. Full entries live inline below.
-> The drift test caps this era at 250 lines of entry body; growth past
-> that forces a new era split (`# Era: 14.21.x`, etc.) — see
-> [`docs/contracts/CHANGELOG-conventions.md § Era splits`](docs/contracts/CHANGELOG-conventions.md).
-
-## [14.21.0](https://github.com/event4u-app/agent-config/compare/14.20.0...14.21.0) (2026-09-07)
-
-### Release highlights
-
-- **Behaviour changes:** `task release` no longer asks the releaser to write prose about the next cycle — the governance-versus-product written answer, its promise read-back, the `## [Unreleased]` staging channel and the interactive prompt are deleted, and `> **Governance mix:**` is a pure measurement (ADR-261); one repo-analysis engine with a bounded three-lens loop (8488bf0); record that an unpaid route may propose and score, never decide (10c8c16).
-- **Default changes + migration:** _none_
-- **Security and correctness:** place the worktree gate where neither neighbour's pin breaks (e4ff296); harden the scan scope through the shared reporter (80514a3); read the in-flight target off state, not off --resume (9dafbc7); re-pin the council-template payload exception at its measured size (23dc5bd); guard the humanizer bench entry point (e998ce5); make the bound table say what the scanner does (20fd4c0); +4 more.
-- **Honest nulls:** record the 14.20.0 findings null, and correct the growth claim (065aeba); re-pin the council-template payload exception at its measured size (23dc5bd); disarm the rule-of-three over ordinary lists, floor the densities (ee2fb2f); pre-register the jury claim and build its aggregator (3b3c7e0); report a disabled seat and why it ships off (47a1d1c).
-- **Known limitations:** _none_
-
-> **Governance mix:** governance-only 31 vs consumer-only 10 (taxonomy 1.0.0).
-
-### Features
-
-* **gates:** refuse a push that leaves this branch's own work uncommitted ([e64d35f](https://github.com/event4u-app/agent-config/commit/e64d35fce403f665035f55eee16a70d22a30c81f))
-* **release:** make the written obligation answerable, not only refusable ([d61cab7](https://github.com/event4u-app/agent-config/commit/d61cab76ab46f5dea883b7664bd040948116aed3))
-* **scripts:** add harvest_reference_tokens, the one discovery pass ([22eed08](https://github.com/event4u-app/agent-config/commit/22eed08890e33f83479343871e81d3be86218530))
-* **analyze:** add the roadmap-repos harvester as a thin orchestrator ([64da6d4](https://github.com/event4u-app/agent-config/commit/64da6d43fd61e68e851c2a49dbf5d58a260cd7be))
-* **analyze:** one repo-analysis engine with a bounded three-lens loop ([8488bf0](https://github.com/event4u-app/agent-config/commit/8488bf078d484028f280e6a8df6a41307da019e5))
-* **humanizer:** locate findings, read a consistent pattern as intent, add --audit ([288f451](https://github.com/event4u-app/agent-config/commit/288f451a59b4a0b4f193bd1135e46ea738bc3f68))
-* **humanizer:** attribute the blind preference, and decline real-draft collection ([89fa350](https://github.com/event4u-app/agent-config/commit/89fa350b34bb2ab99956c73fecf3308d9a847f72))
-* **ai-tells:** land six English and seven German families, one epoch each ([40c77ed](https://github.com/event4u-app/agent-config/commit/40c77ed28d7498444ddb0bcf78b46d5035f848fa))
-* **hooks:** one question per structured-ask call, where a deny is honoured ([f9ee563](https://github.com/event4u-app/agent-config/commit/f9ee5638a37ad7e9791712fb1db06cc9d32d859d))
-* **feature-plan:** one decision per ask, and a summary that follows the asking ([b7222ea](https://github.com/event4u-app/agent-config/commit/b7222ea864482e7ddfb621771caa92b41644bcc2))
-* **roadmap:** ask before park, and stop Open questions reading as storage ([5442cbd](https://github.com/event4u-app/agent-config/commit/5442cbde880117da5300e4d5cd491caa329c26d9))
-* **host-capability:** make the structured-ask capability a recorded fact ([de33df2](https://github.com/event4u-app/agent-config/commit/de33df2e0f424b84013d6077bd57fa655ea52aeb))
-* **ask:** record the native-ask rate in the census artefact ([0ea82ea](https://github.com/event4u-app/agent-config/commit/0ea82eadd5df1df58d64ae50959d242aacb08bec))
-* **ask:** measure the ask surface before changing it ([1b27f7a](https://github.com/event4u-app/agent-config/commit/1b27f7a944d4cfb4031f58311620d760cf8c5340))
-* **council:** pre-register the jury claim and build its aggregator ([3b3c7e0](https://github.com/event4u-app/agent-config/commit/3b3c7e0c7d4c1c77b51af888b83974a18b63b2be))
-* **council:** make a policy refusal sayable, and fail closed on it ([f52115d](https://github.com/event4u-app/agent-config/commit/f52115d5931e349de035409559c6d7c1729ce9ba))
-* **council:** report a disabled seat and why it ships off ([47a1d1c](https://github.com/event4u-app/agent-config/commit/47a1d1cc2424c5f66f2f32fd17ffb09269a45ae4))
-* **council:** give gemini, xai and perplexity a live api transport ([92193b8](https://github.com/event4u-app/agent-config/commit/92193b8c0c1d2c8f06dc0761fdebdb17124a718e))
-
-### Bug Fixes
-
-* **decisions:** disclose ADR-260 evidence ([458ab51](https://github.com/event4u-app/agent-config/commit/458ab5148d61acc88c573341a7e933af8224c1af))
-* **decisions:** repair the provenance kind and scope the ADR-255 supersession ([df0057c](https://github.com/event4u-app/agent-config/commit/df0057cc51fa7bc72e1905f471c54a570e4d7b6e))
-* **evidence:** scrub the speaking round name the drafts cited ([fa8a8bf](https://github.com/event4u-app/agent-config/commit/fa8a8bf98771988a77b0d2d08dd4bc9e428af676))
-* **hooks:** place the worktree gate where neither neighbour's pin breaks ([e4ff296](https://github.com/event4u-app/agent-config/commit/e4ff2969f598397fd36a2a4c58870ee28065c44c))
-* **gates:** harden the scan scope through the shared reporter ([80514a3](https://github.com/event4u-app/agent-config/commit/80514a3fe81a3b1d6aee7a566b6e206059fdc35c))
-* **evidence:** give shipped 14.20.0 the findings ledger it shipped without ([182d84c](https://github.com/event4u-app/agent-config/commit/182d84cb2bb48d1df7d4fe9e7797f3c0da71beed))
-* **release:** record the 14.20.0 findings null, and correct the growth claim ([065aeba](https://github.com/event4u-app/agent-config/commit/065aeba595c887b23c2a82288bb49036f0b91f3a))
-* **gates:** pay the two ratchets this branch moved ([ff6c84d](https://github.com/event4u-app/agent-config/commit/ff6c84d8bc7306d2cf7cbf0a6766c56cfc9732ed))
-* **release:** read the in-flight target off state, not off --resume ([9dafbc7](https://github.com/event4u-app/agent-config/commit/9dafbc72419517607d4e523faab37652814bba4e))
-* **gates:** re-pin the council-template payload exception at its measured size ([23dc5bd](https://github.com/event4u-app/agent-config/commit/23dc5bde2be254b55173de68f65c3ce76dc8cb06))
-* **analyze:** keep the repo argument-hint inside the 120-char schema cap ([3862664](https://github.com/event4u-app/agent-config/commit/38626642214cd223a5ab93d8abb3959e114883b0))
-* **bench:** guard the humanizer bench entry point ([e998ce5](https://github.com/event4u-app/agent-config/commit/e998ce5a154ae25b66c38922100888ca887b72f4))
-* **humanizer:** make the bound table say what the scanner does ([20fd4c0](https://github.com/event4u-app/agent-config/commit/20fd4c0a802c982d1e3136c2b3da4225e979c64c))
-* **ai-tells:** disarm the rule-of-three over ordinary lists, floor the densities ([ee2fb2f](https://github.com/event4u-app/agent-config/commit/ee2fb2f03ab4a79c8741b1219f37954c23b9767b))
-* **handoff:** use the house dialect for handoff ([ffd42f0](https://github.com/event4u-app/agent-config/commit/ffd42f0445a877e56ebfc502b944e9e2014636f9))
-* **comments:** drop report structure and evidence paths from source ([b346418](https://github.com/event4u-app/agent-config/commit/b346418b12c47d5ab422f92c95a81a47c0f26fbd))
-* **claims:** use the house dialect in the jury claim ([dc82a5c](https://github.com/event4u-app/agent-config/commit/dc82a5caae2230cdf02444a9a49d3de330400894))
-* **lint:** satisfy the two eslint rules the new council modules tripped ([162056e](https://github.com/event4u-app/agent-config/commit/162056e2bfd63fcb5fd4e1219b4882343a2acf29))
-* **hooks:** carry rung-3 and rung-4 verdicts on the runtime carrier ([1a1f57a](https://github.com/event4u-app/agent-config/commit/1a1f57ae5e1e8352bced0b212a51af63410fea14))
-
-### Documentation
-
-* **evidence:** declare the completion-review skip for this docs-only diff ([b273d3f](https://github.com/event4u-app/agent-config/commit/b273d3f6bd0428d1b06e311bd13e632631522fda))
-* **evidence:** the inbox-2026-09-u verification and reproduction ledger ([3927a27](https://github.com/event4u-app/agent-config/commit/3927a27c224b9f6c828aec47e888c5748e690853))
-* **roadmaps:** land the standing-payload and code-graph plans, corrected against the tree ([165c154](https://github.com/event4u-app/agent-config/commit/165c1545b9a7ff40e14d735982f987ac1988d78d))
-* **decisions:** record the two owner rulings as ADR-259 and ADR-260 ([b53b182](https://github.com/event4u-app/agent-config/commit/b53b18202e1242e2492437df454aa1d481c0366c))
-* **evidence:** add the sixth drain position and the cross-session guard finding ([cb809ed](https://github.com/event4u-app/agent-config/commit/cb809ed2ec8f400b5f7e2d0bb594db498e5031c7))
-* **changelog:** record the pre-push worktree gate ([ad04f23](https://github.com/event4u-app/agent-config/commit/ad04f2363997b336d4fe56f4bb962fa68458de29))
-* **evidence:** record the 2026-09-07 PR drain run ([f5cad4c](https://github.com/event4u-app/agent-config/commit/f5cad4cfd6803c14513d629a0bbf8ad6d241668b))
-* **evidence:** correct the run-20 PR states, and record how the shared red cleared ([5bcc8b8](https://github.com/event4u-app/agent-config/commit/5bcc8b840c6c9bd236179a689cd20fb5b6c1c73d))
-* **evidence:** record the run-20 autonomous roadmap drain ([6aedb31](https://github.com/event4u-app/agent-config/commit/6aedb311a297281ce6de50c994132f1a63d73540))
-* **release:** record the three answer routes and the in-flight target fix ([c7e320b](https://github.com/event4u-app/agent-config/commit/c7e320bac67aa2ebbc3571efc000bdc083804409))
-* **roadmap:** close road-to-bounded-reference-harvest-loop, carry the observation ([1f1df17](https://github.com/event4u-app/agent-config/commit/1f1df17ceb0e49428ecce3f6c7fa8ef0c55f7684))
-* **adr:** record the 2026-07-11 prose-tell verdicts as ADR-256 ([8dcc259](https://github.com/event4u-app/agent-config/commit/8dcc259b1d9541c38149f9379550617df6b97d07))
-* **decisions:** record the one-question-per-ask concern admission ([03b865f](https://github.com/event4u-app/agent-config/commit/03b865fd8517604d8e81acd7ca8439e58f84dee9))
-* **evidence:** the post-change ask-block census ([1390aa7](https://github.com/event4u-app/agent-config/commit/1390aa7502d1fc8f00f0aa3528c052540f2ef83e))
-* **evidence:** freeze the ask-block census baseline ([27c7d40](https://github.com/event4u-app/agent-config/commit/27c7d4051241e44d716d500a8cb7b06e254ebdcd))
-* **adr:** disclose ADR-256's evidence in the body, not only its frontmatter ([a37a12e](https://github.com/event4u-app/agent-config/commit/a37a12ebf497b542dcfb290e6dbf4dfcc935ee34))
-* **proof:** regenerate after the jury claim landed in the ledger ([0753cb8](https://github.com/event4u-app/agent-config/commit/0753cb8d43fd86a396129a47c415534696b19913))
-* **roadmaps:** resolve three blockers on admissible-council-seats ([bb8cef5](https://github.com/event4u-app/agent-config/commit/bb8cef53fe4814c94b25f0fe3926a06e127c74b9))
-* **adr:** record that an unpaid route may propose and score, never decide ([10c8c16](https://github.com/event4u-app/agent-config/commit/10c8c169c4c6c2c76f0aeea4e57dd925b81e789c))
-
-### Chores
-
-* **evidence:** refresh the ADR evidence census after the main merge ([a2544fc](https://github.com/event4u-app/agent-config/commit/a2544fc61d45d9c90578633b49e84398269f28c9))
-* **baselines:** carry the merge reconciliation that was never committed ([33e811f](https://github.com/event4u-app/agent-config/commit/33e811f330ba41f9e81dafeda2bba9d047ab427c))
-* **evidence:** record the 14.20.0 findings ledger ([3bfb9b5](https://github.com/event4u-app/agent-config/commit/3bfb9b540e588358b06182bad3e60694b557d24f))
-* **install:** rebuild the install bundle for the merged capability field ([395c0b6](https://github.com/event4u-app/agent-config/commit/395c0b61d61a492b0a0b2bba9368521ccea879de))
-* **roadmap:** archive road-to-bounded-reference-harvest-loop ([0b3d0a8](https://github.com/event4u-app/agent-config/commit/0b3d0a8af6bad3f76f44b8c7857a8807c405bd50))
-* **generated:** regenerate projections, catalogs and artefact counts ([1187cd6](https://github.com/event4u-app/agent-config/commit/1187cd6932b28d42ebea49b576ba4edb885b1138))
-* **proof:** regenerate docs/proof.md for the re-scoped humanizer claim ([86951f2](https://github.com/event4u-app/agent-config/commit/86951f26bab10dfd83b8955e137b273c6c5608bd))
-* **adr:** regenerate the evidence census for ADR-256 ([f3b0054](https://github.com/event4u-app/agent-config/commit/f3b00549b87b7f04f82849738233c211655d15e5))
-* **index:** regenerate for the /humanize description change ([97d1b1d](https://github.com/event4u-app/agent-config/commit/97d1b1d61a2857166b7e2f755018979038e39613))
-* **estate:** claim the one dimension this change grows ([8203323](https://github.com/event4u-app/agent-config/commit/8203323a620c1a7a855ae62cd6f38c6292e3c26d))
-* **roadmap:** archive road-to-asked-not-parked ([952a011](https://github.com/event4u-app/agent-config/commit/952a01120d29eab49091e087b5921dfbd0c3e202))
-* **host-capability:** project the contract edit and escape the artefact pointer ([9331bbf](https://github.com/event4u-app/agent-config/commit/9331bbf59e872983ada34cfeb34e41894abe191b))
-* **census:** refresh the ADR evidence census for ADR-256 ([9379a5b](https://github.com/event4u-app/agent-config/commit/9379a5b278e5a33469ec7e3a017afc50c5f6c1bb))
-* **baselines:** lower check_source_size_budget 18,062 -> 18,061 ([51708b1](https://github.com/event4u-app/agent-config/commit/51708b18f7f06853ca5936eaf6b7ce4c8d28f596))
-* **roadmaps:** archive road-to-admissible-council-seats ([9a7ac52](https://github.com/event4u-app/agent-config/commit/9a7ac524922d65bfc85a476a0afdab039dfb415c))
-
-### Other
+> All entries before `14.23.0` live in
+> [`docs/archive/CHANGELOG-pre-14.23.0.md`](docs/archive/CHANGELOG-pre-14.23.0.md).
+> The archive is read-only; git tags remain the canonical
+> source for what shipped. Splitting them out of the main file
+> keeps the active era under the 250-line drift cap enforced by
+> `tests/test_changelog_eras.py`.
 
-* **measured-prose-tells:** archive, and correct the parent's stale note ([5c1baf5](https://github.com/event4u-app/agent-config/commit/5c1baf5cc78fdaf8747cae55601f6da3ad5b8f7b))
-* **measured-prose-tells:** close all 25 boxes and resolve the blocker ([224de7f](https://github.com/event4u-app/agent-config/commit/224de7f7b7ed814894830a36ab0ba41fce0406b3))
-* **humanizer:** split the fixture corpus into tune and holdout ([1c6f4ea](https://github.com/event4u-app/agent-config/commit/1c6f4eae62453d90d19086c97601c6d277be1bbf))
-* **prose-tells:** publish run 1 and run 2, including two falsified predictions ([fb03dba](https://github.com/event4u-app/agent-config/commit/fb03dba730b86980e81203a3d3c16ee10100fa89))
-* **prose-tells:** build the clean corpus and the per-rule FP instrument ([b1c95eb](https://github.com/event4u-app/agent-config/commit/b1c95eb4d9aabca793d52feb4d7679429e30d4d7))
-* **prose-tells:** pre-register the false-positive instrument before measuring ([822b5b2](https://github.com/event4u-app/agent-config/commit/822b5b2ddcfc7f4f7de225b803941373d78d2e60))
-* **asked-not-parked:** resolve both blockers and close every step ([1a8cb04](https://github.com/event4u-app/agent-config/commit/1a8cb04709314b7c19a4c7e2339e4901a062ad80))
+# Era: 14.23.x — current
 
-Tests: 21855 (+249 since 14.20.0)
+> Started at `14.23.0`. Full entries live inline below.
+> The drift test caps this era at 250 lines of entry body; growth past
+> that forces a new era split (`# Era: 14.24.x`, etc.) — see
+> [`docs/contracts/CHANGELOG-conventions.md § Era splits`](docs/contracts/CHANGELOG-conventions.md).
 
-## [14.20.0](https://github.com/event4u-app/agent-config/compare/14.19.0...14.20.0) (2026-09-07)
+## [14.23.0](https://github.com/event4u-app/agent-config/compare/14.22.0...14.23.0) (2026-09-09)
 
 ### Release highlights
 
-- **Behaviour changes:** drop a stale self-referential suppression from untrusted-input-defense (3fb3405); bind every suppression pragma to the evidence it accepts (98e9af2).
-- **Default changes + migration:** _none_
-- **Security and correctness:** a parity-pinned pair carries one bound hash per identity (8a08504); house dialect in the lines this branch authored (085279f); drop a stale self-referential suppression from untrusted-input-defense (3fb3405); bind every suppression pragma to the evidence it accepts (98e9af2); the scout's security gate reads what a candidate says (35bcf7e); the agent-security umbrella publishes what it read, and carries a floor (a416ef8); +8 more.
+- **Behaviour changes:** the artifact-versus-brand split does not fit the standing payload (b798f4f); one skill taught the failure design-fidelity forbids (1c04ccd); name `killed-if` as the field a falsified rejection reads (7f21116); stop a vacuous parity comparison reading as a pass, and record two contracts honestly (f121cf9); compensate the standing-payload growth instead of raising the ceiling (4bdca0f); move the horizon reference material out of the per-spawn body (89658f1); +2 more.
+- **Default changes + migration:** deterministic session-end record writer, default-off (1dc768d); MIGRATION entry for the readers, and regenerate the skills catalog (3fa7886); pay the activation charge and flip the default for Claude Code (ffb09a6).
+- **Security and correctness:** repair the regressions #1964 introduced — a blocking guard is weakened on main (#1966) (bdbd5b7); Fix: a successor now finds its predecessor's recycle envelope (#1965) (f58ba26); block-speaking-inbox-dir refused reads it was never scoped to (82169c5); repair all seven R2 findings on the trust contract (ced1322); repair all five R2 round-2 findings (bd9962e); repair all three R2 completion-review findings (30ea290); +15 more.
 - **Honest nulls:** _none_
 - **Known limitations:** _none_
 
-> **Governance mix:** governance-only 16 vs consumer-only 3 (taxonomy 1.0.0).
-> Next cycle ships the ask surface: a decision this package needs from its user
-> reaches the user instead of parking in a roadmap `blocked-by:` marker, an
-> `## Open questions` section nothing obliges the next session to read, or a
-> printed `{count}` where a question belonged — tracked in
-> `agents/roadmaps/road-to-asked-not-parked.md`, which stands at zero of its
-> twenty-five steps at this tag.
-
-> **Previous cycle:** the 14.19.0 head promised the installed MCP bridge repair —
-> a version-pinned server entry instead of an `npx -y` resolution of `latest`, a
-> registration that migrates itself when the bridge shape changes under an update,
-> and setup docs matching the command the installer actually writes. It **shipped**,
-> in this span: `mcpBridgeEntry` now emits `@event4u/agent-config@<version>` read
-> from the installed manifest and leaves the spec unpinned rather than guessed when
-> the version cannot be read (`src/scripts/_lib/mcp_bridge.ts:52-60`, commit
-> d01873a88); the documented client snippets are gated against the installer entry
-> (21c215e54) and `grep -c "/absolute/path/to/agent-config" docs/mcp-server.md`
-> returns 0; MCP registration is gated on the capability axis with the consent
-> residual named (55de37904). `road-to-mcp-bridge-integrity-and-reach-truth` closed
-> at seventeen of seventeen steps. The promise stood outstanding across 14.18.0 and
-> 14.19.0 and is now discharged.
+> **Governance mix:** governance-only 62 vs consumer-only 13 (taxonomy 1.1.0).
 
 ### Features
 
-* **publish:** classify the packed surface by type, bound per entry ([d08656d](https://github.com/event4u-app/agent-config/commit/d08656dfe50bee05579691b9229b9b1dfb23870c))
-* **security:** bind every suppression pragma to the evidence it accepts ([98e9af2](https://github.com/event4u-app/agent-config/commit/98e9af29744a8ad76192eb48615764a5bc3fa8d2))
-* **security:** the scout's security gate reads what a candidate says ([35bcf7e](https://github.com/event4u-app/agent-config/commit/35bcf7e972679dae961b7c812a6e397c5a1d68c2))
-* **security:** the agent-security umbrella publishes what it read, and carries a floor ([a416ef8](https://github.com/event4u-app/agent-config/commit/a416ef8ce3b89e35aa2459f5204599ff5d9066db))
-* **handoff:** carry falsifiable uncertainty, and capture rather than chase ([83de12e](https://github.com/event4u-app/agent-config/commit/83de12e0760a592060f30a94575d9dc9898215bf))
-* **self-repair:** give a model-noticed observation a target-addressed record ([32c8302](https://github.com/event4u-app/agent-config/commit/32c83025e421072ed6084f06e612622b0b9da965))
-* **continuity:** key the record by session and give the schema what worked ([72c0962](https://github.com/event4u-app/agent-config/commit/72c096257210e9f12f9dfdc7a24be686aed30eea))
-* **install:** gate MCP registration on the capability axis, and name the residual ([55de379](https://github.com/event4u-app/agent-config/commit/55de379047c3e1ae6cbeabfa563290117e20bc6e))
-* **telemetry:** publish the MCP-lite reading, zero included ([b2e3f20](https://github.com/event4u-app/agent-config/commit/b2e3f207b737f725dfd28b9a9ce0c06a329d56fc))
-* **mcp:** emit one collector row per stdio-lite tools/call ([6fb0fe9](https://github.com/event4u-app/agent-config/commit/6fb0fe90c21114096507406c58158a312792bb4b))
-* **mcp:** serve the standard resource annotations, and add the MCP capability axis ([3dfd70a](https://github.com/event4u-app/agent-config/commit/3dfd70a028ef6e9f60f75c4d28fc9f76ed75658f))
-* **mcp:** make the documented client snippets match the installer, and gate it ([21c215e](https://github.com/event4u-app/agent-config/commit/21c215e54d423a6abda8a47b9fdafb2c2475497b))
-* **mcp:** pin the bridge entry to the installed version, and repair it on update ([d01873a](https://github.com/event4u-app/agent-config/commit/d01873a88cd2800dd49f201cbb64f2cf4c640488))
+* **ci-settle:** refuse a verdict about a head that stopped mattering ([7a07631](https://github.com/event4u-app/agent-config/commit/7a076319734f501cdb0559ef6310340592e8479a))
+* **roadmap:** the recycle envelope is written but never read — measured ([45f372a](https://github.com/event4u-app/agent-config/commit/45f372a3263375a70d3076377e5b3b92f46ac665))
+* **memory:** wire the trust contract, and the corpus fixture that proves it ([b6b464c](https://github.com/event4u-app/agent-config/commit/b6b464c0aaa6deb2c62f2983760eb66d65349cc1))
+* **memory:** the six-property trust contract for the session-start index ([0296fb5](https://github.com/event4u-app/agent-config/commit/0296fb5981f8de8dbb148c794ab62fbbe3b895d4))
+* **hook-hosts:** close step 4.2 and resolve the predecessor blocker ([26b1876](https://github.com/event4u-app/agent-config/commit/26b1876ef8943c3d9869108c6a6ef4d9ff0985f5))
+* **vendor:** anchor the vendored grammars to the locked upstream ([ca37441](https://github.com/event4u-app/agent-config/commit/ca374419226924b6a9aca50597348108acf17b6f))
+* **gate:** no blocker id may be open in both an active and an archived roadmap ([85883c6](https://github.com/event4u-app/agent-config/commit/85883c600bccbe172c8bd7499dc41d291cdf4e6f))
+* **autonomy:** ADR-268 plus the three receiver roadmaps from the inbox-2026-09-w drain ([9f2e714](https://github.com/event4u-app/agent-config/commit/9f2e714ae38bb8246c74a0157188b6675559169c))
+* **pr-merge:** activate section 9 under ADR-266 ([0f24135](https://github.com/event4u-app/agent-config/commit/0f241359eb786f1356ab109c0883b0eeb263b545))
+* **continuity:** three independent kill switches and the rollback note ([8a23f6b](https://github.com/event4u-app/agent-config/commit/8a23f6b0840a50c3635b21beb6c2b9f8e744946f))
+* **continuity:** deterministic session-end record writer, default-off ([1dc768d](https://github.com/event4u-app/agent-config/commit/1dc768d442d06e9f553bc48c83b4386e799acaf7))
+* **continuity:** settle the record-slot capacity policy before any writer ([7bb1bf5](https://github.com/event4u-app/agent-config/commit/7bb1bf53a6cfd0f41a1203d909b4d78b79a36dba))
+* **notes:** name `killed-if` as the field a falsified rejection reads ([7f21116](https://github.com/event4u-app/agent-config/commit/7f2111668d68d2a3144c49a99a30bf1863371285))
+* **mcp:** five graph tools, the pinned install hint, and the skill description ([9452f29](https://github.com/event4u-app/agent-config/commit/9452f29b4b82790c867b1e62b93ca7e82003f539))
+* enforce the shrink-only standing-payload grace ceiling ([7c0d109](https://github.com/event4u-app/agent-config/commit/7c0d1096e32c93381a16cd669fecc034712237bd))
+* **regression-selector:** select over the native code graph ([2d900fc](https://github.com/event4u-app/agent-config/commit/2d900fc4a2aa2166dd3472d4c8fb3148187c2442))
+* **code-graph:** four gate verbs — impact, tests-for, untested, dead ([a8ff075](https://github.com/event4u-app/agent-config/commit/a8ff075c59d8a6f774b6cb02d6866e400fa647ac))
+* **code-graph:** derive the tests relation and move GraphState into the engine ([a31335f](https://github.com/event4u-app/agent-config/commit/a31335f9a21acc51e66ea801f7509acf88894d7e))
+* **delivery:** pay the activation charge and flip the default for Claude Code ([ffb09a6](https://github.com/event4u-app/agent-config/commit/ffb09a604b5328d9e27cad5c10f2e2dd58c91646))
+* **reasoning:** a commitment horizon that is decidable, and a reopen that ends ([306df03](https://github.com/event4u-app/agent-config/commit/306df03ec6ef866519a9c81e4cd051bb38082cc4))
+* **delivery:** scope thinning to a host, and prove the other hosts are untouched ([9ae0ff2](https://github.com/event4u-app/agent-config/commit/9ae0ff2889ce3c30d5cbd9432d659fc624685b2b))
+* **delivery:** freeze the standing payload per host, and correct D3 from 8 to 11 ([afd1579](https://github.com/event4u-app/agent-config/commit/afd15798d798ca38b139d3721179496b20d4ae14))
 
 ### Bug Fixes
 
-* **security:** a parity-pinned pair carries one bound hash per identity ([8a08504](https://github.com/event4u-app/agent-config/commit/8a0850449d8f9f89b262a74af218a5f895aa4412))
-* **security:** drop a stale self-referential suppression from untrusted-input-defense ([3fb3405](https://github.com/event4u-app/agent-config/commit/3fb34055b2df64b21d435f221c7cb967d0e0c5ef))
-* **deps:** bump open from 11.0.1 to 11.0.2 in the npm-production group ([0dd9c23](https://github.com/event4u-app/agent-config/commit/0dd9c2364436dad56a308fccf15a595f7ade93d8))
-* **security:** the agent-security umbrella fails closed on a child that did not answer ([6a9411f](https://github.com/event4u-app/agent-config/commit/6a9411fc60f226b16c9efcaa1c6c5cf209e06207))
-* **ci:** clear lint_code_comments on this branch's own new comments ([e2589b0](https://github.com/event4u-app/agent-config/commit/e2589b0d7b21a7a78c4c5dd353861326f7c9a96d))
-* **gates:** make the park gate read a wake condition, not a status word ([4636ad8](https://github.com/event4u-app/agent-config/commit/4636ad80da321fce0012bd20b5b52bee4515428b))
-* **audit:** make rules_applied an observation, retiring the constant and its card ([bffae3d](https://github.com/event4u-app/agent-config/commit/bffae3dd1d1f8feee8fbb86ca3557b7a803b34fa))
-* **ci:** rewrite two docblocks as prose, and record the 14.19.0 review null ([83bc671](https://github.com/event4u-app/agent-config/commit/83bc671e6653110877ff525add31b66ff6f9e955))
-* **release:** record why 14.19.0's findings ledger is empty ([e6aab8f](https://github.com/event4u-app/agent-config/commit/e6aab8fdaa0ceb62a10d7c17f870d2d142890436))
-* **release:** make the curated-head refusal recoverable from where it stops ([5affd8a](https://github.com/event4u-app/agent-config/commit/5affd8adcb8f56e9bd4999e483d5bfeef5530710))
+* **budgets:** record the mcp_public_tool_count move 20 -> 25 ([#1968](https://github.com/event4u-app/agent-config/pull/1968)) ([7b76059](https://github.com/event4u-app/agent-config/commit/7b76059585e30dc646ee899ff5d8620299505910))
+* **hooks,design:** repair the regressions #1964 introduced — a blocking guard is weakened on main (#1966) ([bdbd5b7](https://github.com/event4u-app/agent-config/commit/bdbd5b762a1943c75040014198b7c8aba5030660))
+* **design:** one skill taught the failure design-fidelity forbids ([1c04ccd](https://github.com/event4u-app/agent-config/commit/1c04ccd158c44f089ac1a18372d4062c398e9c42))
+* **hooks:** block-speaking-inbox-dir refused reads it was never scoped to ([82169c5](https://github.com/event4u-app/agent-config/commit/82169c5cfa4987027a86547c52a94b66e0244636))
+* **memory:** repair all seven R2 findings on the trust contract ([ced1322](https://github.com/event4u-app/agent-config/commit/ced1322f266a02ae567a32293e334b0416c16e3c))
+* **continuity:** dispose of the session-index latch in the inventory ([1f8e051](https://github.com/event4u-app/agent-config/commit/1f8e05166d22c5c67da69b568daba27bba54a459))
+* **hook-hosts:** move the 4.2 note under its own step, re-review the risk register ([88608f2](https://github.com/event4u-app/agent-config/commit/88608f22f522ce44e1efc5c647d107c47ff0571f))
+* **review:** repair all five R2 round-2 findings ([bd9962e](https://github.com/event4u-app/agent-config/commit/bd9962e046f4132c06d33130d88a53cd6b330857))
+* **review:** repair all three R2 completion-review findings ([30ea290](https://github.com/event4u-app/agent-config/commit/30ea290301b3270fc060aef459cb5a1595688857))
+* **adr-263:** the 187 figure is an arithmetic error; 189 stands ([f6de539](https://github.com/event4u-app/agent-config/commit/f6de5393679268d064292964d0ab10bf8bd5c1ed))
+* **archival:** refuse to archive a roadmap whose staged blockers differ from the working tree ([c3f6c00](https://github.com/event4u-app/agent-config/commit/c3f6c00565f247f3256ef25edf56e97cf013d7b7))
+* **adr:** give ADR-266 the Evidence section it owes ([2876dd9](https://github.com/event4u-app/agent-config/commit/2876dd91eca6f881b26b5094ea70398450988ba5))
+* **roadmap:** correct 192 -> 193, and record the drift as the finding ([a9d1bfe](https://github.com/event4u-app/agent-config/commit/a9d1bfe6e6a59a7b2bce9b20546f09572a51d72a))
+* **estate:** claim the one-in-one-out offset the second receiver needs ([abdfa4e](https://github.com/event4u-app/agent-config/commit/abdfa4e4eca22eaa1759d2f0672f8a535cea6dbf))
+* **contracts:** keep-beta-until must sit inside the 90-day window ([fcdfc30](https://github.com/event4u-app/agent-config/commit/fcdfc300b4a5278418fb39976a8ae58abfedfdee))
+* **settings:** the two downstream surfaces the continuity section missed ([adaa5c3](https://github.com/event4u-app/agent-config/commit/adaa5c387f384ff5571f07a8298344120266b882))
+* **release-findings:** disposition the eleven 14.22.0 blocking findings ([7151087](https://github.com/event4u-app/agent-config/commit/71510872cbcaec3f7e4af7e9132577b2033c9bbd))
+* **roadmap:** land the blocker pointer that git mv left unstaged ([7c7d2f7](https://github.com/event4u-app/agent-config/commit/7c7d2f76d3b9a1d4edb4a59863ebd735da1c5ce7))
+* **release-findings:** ingest the 14.22.0 self-review, envelope included ([4a35059](https://github.com/event4u-app/agent-config/commit/4a350592b8dfc12a125806ea45affb1e28d1cb3d))
+* **ci:** the generator self-reference rule, and re-measure the delivery-set record ([3d0ce92](https://github.com/event4u-app/agent-config/commit/3d0ce9213025b5a22a791772c4e7556cd9a42dc3))
+* mark the not-yet-existing ledger path as a deliberate non-reference ([2066776](https://github.com/event4u-app/agent-config/commit/2066776bbdbbd194cc8fca0d30557410fa3066fe))
+* **code-graph:** repair every defect an independent completion review found ([62bfb0e](https://github.com/event4u-app/agent-config/commit/62bfb0e80395f2919849c8f8b0763200e46fc308))
+* **lint:** drop the roadmap path from a source docblock ([a0b9d20](https://github.com/event4u-app/agent-config/commit/a0b9d20635c72e970e4ad0b75681693a5b29384f))
+* **report:** derive the census figure instead of hardcoding a literal that went stale ([23e390b](https://github.com/event4u-app/agent-config/commit/23e390baff4bd7f88b981fd2b6520eccf82efcb7))
+* **estate:** trim the skill description by one word to hold the token floor ([a2ca885](https://github.com/event4u-app/agent-config/commit/a2ca8851751de9230e556f9a49a357be8b33689a))
+* **delivery:** close R2 finding 1 by measuring the shipped reach, and de-duplicate the router sets ([0870750](https://github.com/event4u-app/agent-config/commit/08707501c63ce528809c3f599b1fb3fd5293a1a5))
+* **lint:** drop markdown headings and box rules from the new comments ([dac3f12](https://github.com/event4u-app/agent-config/commit/dac3f12c4e457d538c5843385c883868286de2e3))
+* **budget:** reconcile the rule-inject cap onto the owner-specified charge, downward ([80769d7](https://github.com/event4u-app/agent-config/commit/80769d76a3df743d7a94d4f3395fd6d7a0e39e02))
+* **report:** make the standing-payload report's own guards as strong as its sentences ([2145f18](https://github.com/event4u-app/agent-config/commit/2145f184429954c0f8b55b9958eb09d84add37e1))
+* **gates:** stop a vacuous parity comparison reading as a pass, and record two contracts honestly ([f121cf9](https://github.com/event4u-app/agent-config/commit/f121cf975e18c93e825abf6830b2805ba2ddc514))
+* **delivery:** make both lean_projection readers agree — same-indent hosts list, host-aware gate ([e1743b5](https://github.com/event4u-app/agent-config/commit/e1743b508480088d60ba9f0df8ee7718b90c1ae4))
+* **adr:** finish the 263 -> 265 renumber inside the record itself ([0949257](https://github.com/event4u-app/agent-config/commit/0949257ab41a720fc83fb24708b41c3a2e0840d2))
+* **settings:** admit lean_projection delivery + hosts in the server schema ([767b007](https://github.com/event4u-app/agent-config/commit/767b00791c26813cf64ad4312e03885ccd775e5e))
+* **ci:** carry the four measurements this branch moved, none of them a threshold ([f7f0986](https://github.com/event4u-app/agent-config/commit/f7f0986f91d45c8323523fef95c0607a465e5dc0))
+* **tests:** the repair record quoted the literal its own gate forbids ([4803b9d](https://github.com/event4u-app/agent-config/commit/4803b9dafda0ac8d8eb75b15ab84b72643bf5457))
+* **thin-rules:** the repair record reproduced the literal the gate forbids ([b197df8](https://github.com/event4u-app/agent-config/commit/b197df81ed85f2776ee1736abffe3d4dcca2da97))
+
+### Performance
+
+* **mcp:** trim the graph tool surface, then re-anchor only mcp_schemas ([a904c00](https://github.com/event4u-app/agent-config/commit/a904c0046361a0ca4bbe4a4a16f217bd574bd363))
+* **bench:** re-anchor thin_rule_load onto the post-E2 projection, attribution measured ([12ccf11](https://github.com/event4u-app/agent-config/commit/12ccf1158f796216d9ec775ec1efc5f0c7437085))
+* **rule:** compensate the standing-payload growth instead of raising the ceiling ([4bdca0f](https://github.com/event4u-app/agent-config/commit/4bdca0f4cc6018207de8793cc2ca50e9b966ad21))
+* **rule:** move the horizon reference material out of the per-spawn body ([89658f1](https://github.com/event4u-app/agent-config/commit/89658f16c0dc094a25345f492da34861530c397a))
+
+### Reverts
+
+* **brand:** the artifact-versus-brand split does not fit the standing payload ([b798f4f](https://github.com/event4u-app/agent-config/commit/b798f4fc0b092ead6bd67f3219b0151cefc1f81e))
 
 ### Documentation
 
-* **roadmap:** re-review the risk register against what the six risks actually did ([79f05a1](https://github.com/event4u-app/agent-config/commit/79f05a1a78aa187c8b96deba664a17f9a5b92d58))
-* **roadmap:** resolve both blockers of road-to-scan-that-fails-closed ([1b7de23](https://github.com/event4u-app/agent-config/commit/1b7de235ffdb6649194223b988594ee0f4e6eee6))
-* **roadmaps:** drain 20 disposition -- 0 of 38 closed, every trigger re-measured ([0d39f15](https://github.com/event4u-app/agent-config/commit/0d39f1502d88a0cc5729d0de63dbf9a420162a5b))
-* **roadmaps:** record the carrier-transition-vocabulary trigger as fired ([82da6e9](https://github.com/event4u-app/agent-config/commit/82da6e9f006f62f57a7bfc5b70761aed36a5a0b0))
-* **security:** state the umbrella's child-completion gap before repairing it ([e9ccd26](https://github.com/event4u-app/agent-config/commit/e9ccd26ecfa9b16a3e20f01a072071acd120108b))
-* **roadmap:** close road-to-observed-learning-signal and its four blockers ([07f47bd](https://github.com/event4u-app/agent-config/commit/07f47bdcd896dd959846aeeac8b384f555c84c5b))
-* correct the two documents that mislead the next reader ([2f319f7](https://github.com/event4u-app/agent-config/commit/2f319f7882e80113f606a1652dbe14684c41a4ef))
-* **roadmap:** close Phases 1-2, record the council sequencing for 3-4 ([5378030](https://github.com/event4u-app/agent-config/commit/5378030e0f93b71d4a6696fd32816baface27ac5))
-* **adr:** disclose what ADR-256 rests on, and what it does not ([b634daa](https://github.com/event4u-app/agent-config/commit/b634daadb43a9d3c182caf86e33336a07f26c20c))
-* **hosts:** reconcile the enforcement surface with what the manifest binds ([909e606](https://github.com/event4u-app/agent-config/commit/909e606e443e9fb46b230bf2db7c0bfb85827b45))
-* **adr:** record the four MCP blocker rulings, and close the roadmap ([adedaf4](https://github.com/event4u-app/agent-config/commit/adedaf485a8379051012692b1c5b39867638d398))
+* **roadmap:** pass 3 finds a step no first reading produced — reuse under conformity ([ff80052](https://github.com/event4u-app/agent-config/commit/ff8005276b4b6cc5bbc795f25ddcd32c29dee6ad))
+* **roadmap:** road-to-design-intent-conformance — the contract is written, contradicted and unreachable ([b40531a](https://github.com/event4u-app/agent-config/commit/b40531ab91c3331867592cade6f774cb89dd9e20))
+* **git-workflow:** carry the new ci_settle refusal to both surfaces that state it ([762e3a3](https://github.com/event4u-app/agent-config/commit/762e3a362074cc26391fe042fb0cd036de0e4a06))
+* **vendor:** write the binary predicate threat boundary down ([620ec78](https://github.com/event4u-app/agent-config/commit/620ec78658552741f3e422890f11c0e0637eb027))
+* **adr:** disposition the three adversarial findings on ADR-266 ([b57a946](https://github.com/event4u-app/agent-config/commit/b57a9469bf496ab536f1dad369b8935f2935492f))
+* **adr:** record the owner ruling that activates /pr:merge merging ([c82c385](https://github.com/event4u-app/agent-config/commit/c82c385d96d0bea0b0899b967459406f46805e65))
+* **roadmap:** record what Phase 1 closed, and three findings that correct it ([e2349bd](https://github.com/event4u-app/agent-config/commit/e2349bd2505a1203e3ef5927936010be3758a20f))
+* **grammars:** point the refresh checklist at the manifest that exists ([9e70bc2](https://github.com/event4u-app/agent-config/commit/9e70bc29a0d1942d6cce28f234be7472bfb39a55))
+* **review:** the independent completion-review findings, with dispositions ([885bc2a](https://github.com/event4u-app/agent-config/commit/885bc2a2f9bc8caa6387ffc32d356a120e583f11))
+* **stub:** record the 14.22.0 findings-ledger recurrence on the existing 14.21.0 stub ([cbb26d3](https://github.com/event4u-app/agent-config/commit/cbb26d378fc54365751f1dc58b813dd79fca5a73))
+* MIGRATION entry for the readers, and regenerate the skills catalog ([3fa7886](https://github.com/event4u-app/agent-config/commit/3fa7886e32eff9fbed1ece6491e6e88ad8c41e5e))
+* **claims:** repoint the delivery-equivalence claim at the report that carries its figures ([ae3267f](https://github.com/event4u-app/agent-config/commit/ae3267ff56a17afc3aa07fa1cae6ead5c270bffc))
+* restate the MCP standing-cost claim at the measured figure ([9716817](https://github.com/event4u-app/agent-config/commit/971681741def028ab7957563409d0026f7f0366e))
+* ADR-265 gains its Evidence section ([2d6882f](https://github.com/event4u-app/agent-config/commit/2d6882f83cbc1670e6e34b10fcda558c8a5813b7))
+* ADR-265 — the Iron Law reserve is refused, verifier is inside the change ([c310efa](https://github.com/event4u-app/agent-config/commit/c310efa9e4ecfd37b0ddfd348c9b3742028dc190))
+* **adr-262:** disclose the evidence the accepted record rests on ([c9f064d](https://github.com/event4u-app/agent-config/commit/c9f064dda6522d0242756c8f113ea815cd2ae9ea))
+* **roadmap:** re-review the risk register, and record that Risk 3 is refuted ([4e5fcf7](https://github.com/event4u-app/agent-config/commit/4e5fcf7333af24bdd2cc8d16b82ed1e9818d3978))
+* **roadmap:** settle the acceptance criteria against what was actually measured ([07aaf83](https://github.com/event4u-app/agent-config/commit/07aaf831e205770688a86e14dc99af7b406718ab))
+* **claims:** the delivery row said not-shipped, and 4.3 made that false ([b02ba95](https://github.com/event4u-app/agent-config/commit/b02ba958ff9341dfab8f6c9d70011738bf9ca723))
 
 ### Refactoring
 
-* **mcp:** pay the size ratchet rather than raise it, and fix two CI reds ([08e011a](https://github.com/event4u-app/agent-config/commit/08e011ab8837213ea86aefcc632ebabd85b5fa8b))
-* **release:** move the start-position verdict into _lib ([97b74ad](https://github.com/event4u-app/agent-config/commit/97b74ad48eda3a96ef5e4830dd4963041decab79))
-* **continuity:** retire HANDOFF.md and decide the two colliding words ([ffd8dd7](https://github.com/event4u-app/agent-config/commit/ffd8dd754fc85ab8c928e45522d8c21f7c2460dd))
+* **continuity:** move is_substantive and resolvePredecessor into _lib ([117e5c2](https://github.com/event4u-app/agent-config/commit/117e5c275701f9dc632bed300c59545c51fda992))
 
 ### Tests
 
-* **security:** freeze the umbrella's failure corpus against today's fail-open ([b4bed8c](https://github.com/event4u-app/agent-config/commit/b4bed8c563348a94592083466859367b0352aed3))
+* **continuity:** parity in both halves the council separated ([ed06343](https://github.com/event4u-app/agent-config/commit/ed063430624a767454bdf771d0b23bd90549df5d))
+* **notes:** pin the boundary set closed and the reopen cap at one ([4edecf7](https://github.com/event4u-app/agent-config/commit/4edecf7217e2b5cf07989b9273a7b845860f5e22))
+* **mcp:** pair the entry-point escape case with an accepted nested path ([7bdaaec](https://github.com/event4u-app/agent-config/commit/7bdaaec90cabddd914e86a12b156578e081c27c2))
+* **lean-projection:** repoint the held-change tripwire onto the shipped state ([8d52e84](https://github.com/event4u-app/agent-config/commit/8d52e84eb469daab03e9e8324d40800925a54df8))
+
+### Build
+
+* rebuild the install bundle after the ADR renumber ([4039b88](https://github.com/event4u-app/agent-config/commit/4039b880fc1d798a2a58bef4288a46406204d332))
+* recompile hook_manifest.json after the R2 finding-1 comment landed in the YAML ([b887fe2](https://github.com/event4u-app/agent-config/commit/b887fe2a556750447cc6e1f26606c8b0e1bf6814))
+* rebuild the stale install bundle and regenerate the ADR evidence census ([8e791d8](https://github.com/event4u-app/agent-config/commit/8e791d822c5ef2bf5dbaec7156f46321bf853374))
 
 ### Chores
 
-* **gates:** recount the coverage denominator on the merged tree, re-pin the canary ([1918abb](https://github.com/event4u-app/agent-config/commit/1918abb972748b52868cc8e6f2ab79104ad9319d))
-* **deps:** bump the github-actions group across 1 directory with 3 updates ([720bc5e](https://github.com/event4u-app/agent-config/commit/720bc5e17a6263f525e2c2e4e949d8687a0009ae))
-* **deps-dev:** bump the npm-development group with 6 updates ([a449541](https://github.com/event4u-app/agent-config/commit/a449541c4961ab8f72588158b204aff7212224d9))
-* **evidence:** use the reconciled 14.19.0 ledger text ([a692fe3](https://github.com/event4u-app/agent-config/commit/a692fe39443e0b2bb1e68f6e809133fc922c3abd))
-* **roadmap:** archive road-to-observed-learning-signal ([b52fed5](https://github.com/event4u-app/agent-config/commit/b52fed5f44dd23fb377f4e060de67dfd6ae1d827))
-* **reports:** regenerate skill-overlap after the TDD skill edit ([67f2c16](https://github.com/event4u-app/agent-config/commit/67f2c168adaf7ad7fdb076064f5c805e5466edbe))
-* **census:** refresh the ADR evidence census for ADR-256 ([5aa4e7c](https://github.com/event4u-app/agent-config/commit/5aa4e7cbb8852edb2f2704dbf881f6580c6fd983))
-* **evidence:** record the 14.19.0 findings ledger ([88ba528](https://github.com/event4u-app/agent-config/commit/88ba5286a58314e4a027f28ce76d489072f27a68))
-* **roadmap:** archive road-to-mcp-bridge-integrity-and-reach-truth ([02c016e](https://github.com/event4u-app/agent-config/commit/02c016e367128f2b9e604cef9b4fc906a8922e56))
+* **estate:** claim the one-in-one-out offset the committed roadmap fires ([72dfa5d](https://github.com/event4u-app/agent-config/commit/72dfa5d90601da16bde06d9ed761663baab69848))
+* **roadmap:** 3.1's second half is under-specified — record it, do not invent it ([d542bf1](https://github.com/event4u-app/agent-config/commit/d542bf14ff2eec0ce46ee4ba66fb93f5bf9ca9d8))
+* **roadmap:** park road-to-skill-menu-economy — its own review trigger fired ([11ecf8a](https://github.com/event4u-app/agent-config/commit/11ecf8aedda395cecfa2dd992de328d609576adc))
+* **review:** disposition the seven findings, record what the failure teaches ([39dce8a](https://github.com/event4u-app/agent-config/commit/39dce8adbb855b496b2e60fbbb87bee04d31fd85))
+* **review:** R2 completion review — the trust contract does NOT hold ([a1f50ea](https://github.com/event4u-app/agent-config/commit/a1f50eaa832e5cce3f2ac8129fdbb96d9e86969d))
+* **roadmap:** record 3.1's precondition as discharged, and the step as open ([4545420](https://github.com/event4u-app/agent-config/commit/4545420a941ce65a67c192a9970e45e91641c95d))
+* **roadmap:** close road-to-limited-commitment-horizon Phase 3 unbuilt ([2e1b644](https://github.com/event4u-app/agent-config/commit/2e1b644bcffa1c27f7227c2300f8a88400a7a338))
+* **roadmap:** apply E7 — archive the two token-saving roadmaps, carry the residue ([6d53a9b](https://github.com/event4u-app/agent-config/commit/6d53a9bc947ca9802a108f0dbaf4faf08c5a3dac))
+* **roadmap:** close and archive road-to-the-14-22-0-findings-ledger ([ea3a973](https://github.com/event4u-app/agent-config/commit/ea3a973767eea70b850f8aae2a7b19b396e50ba8))
+* **review:** disposition the five round-2 findings against bd9962e04 ([45c8ae8](https://github.com/event4u-app/agent-config/commit/45c8ae82535c7314641f11b039ff1a77f2edd66e))
+* **review:** R2 round 2 — 5 findings, round 1 preserved ([368ba2b](https://github.com/event4u-app/agent-config/commit/368ba2bbe9a81a0cb41eda96af55d067017e5446))
+* **adr:** regenerate the evidence census after the ADR-263 amendment ([ed9746f](https://github.com/event4u-app/agent-config/commit/ed9746f7c0e825b285771cc1d0e9f1b19e5f61fa))
+* **review:** disposition the three R2 findings against 30ea29030 ([57dd539](https://github.com/event4u-app/agent-config/commit/57dd53925c12ab9140e54d6b3b8e4835cc7f7f76))
+* **review:** R2 completion review for the 14.22.0 residuals branch ([faabcff](https://github.com/event4u-app/agent-config/commit/faabcff4a9998412b1fb2634c7f6a80217b0327a))
+* **roadmap:** stub the census-store defect, repoint the archived refs ([4d0f978](https://github.com/event4u-app/agent-config/commit/4d0f978abf152f69b461bc477df9e9be55df79de))
+* **roadmap:** close and archive road-to-a-blocker-that-cannot-hide-in-the-archive ([32e3ff0](https://github.com/event4u-app/agent-config/commit/32e3ff05eb51889c02502cb2441d6aa809031a52))
+* **index:** regenerate the catalog for the /pr:merge description change ([bf743f0](https://github.com/event4u-app/agent-config/commit/bf743f068577689e8aeef1e95b2977bbca2ce36b))
+* **adr:** regenerate the index and the evidence census for ADR-266 ([3b5a0c4](https://github.com/event4u-app/agent-config/commit/3b5a0c43c00e46a0da7b83c08b4802c1e5c9aedf))
+* **review:** rebind the findings artefact after the base merge ([9d4ebfb](https://github.com/event4u-app/agent-config/commit/9d4ebfb62b542175314c06e1d24b05340a46f7cd))
+* **stubs:** close the 14.22.0 ledger instance — another lane landed it ([0cd51a2](https://github.com/event4u-app/agent-config/commit/0cd51a2515b2aac52f38c4f6123f1e8130c218a7))
+* **review:** final scope rebind ([c6965d1](https://github.com/event4u-app/agent-config/commit/c6965d114bf2aa2ad3fb0c42d53d8f7d98a3c7a0))
+* **review:** rebind the findings artefact to the post-trim scope ([529cc55](https://github.com/event4u-app/agent-config/commit/529cc5580750e80a75be906fdde435a9c958c33f))
+* **review:** rebind the findings artefact after the pointer commit ([9fa5777](https://github.com/event4u-app/agent-config/commit/9fa5777adf7371a40f3692aa98c0ca00bc776def))
+* **review:** rebind the findings artefact to the post-archival scope ([4bd39e4](https://github.com/event4u-app/agent-config/commit/4bd39e4d777d4b4c546c2049d8d761c55b7bbaae))
+* **roadmap:** close Phases 1 and 2 of limited-commitment-horizon ([8f350dd](https://github.com/event4u-app/agent-config/commit/8f350ddf30c56acf2bd8a79a8ae4fe5e2b2a3740))
+* record the 14.22.0 findings-ledger gap as arrival 4 ([7c5dc50](https://github.com/event4u-app/agent-config/commit/7c5dc50ae4f31005e241f034bd6989d6b38de298))
+* refresh the ADR evidence census after ADR-265 gained its Evidence section ([7685ab1](https://github.com/event4u-app/agent-config/commit/7685ab13c43697f8779a7df9af86e25018b00d4b))
+* regenerate the artefact index, and record the pack-size re-measurement ([b37fcfa](https://github.com/event4u-app/agent-config/commit/b37fcfa82179ca8ef2e0d8d7765468dcfacafcb8))
+* archive road-to-a-standing-budget-with-headroom ([225a4eb](https://github.com/event4u-app/agent-config/commit/225a4ebb898b017fa1ebecf616d5fbcb3f2977ff))
+* **review:** dispatch the R2 completion review for drain/delivery-for-every-host ([7925dbb](https://github.com/event4u-app/agent-config/commit/7925dbba34443211ffff62c96e5c497eace2fa5f))
+* **adr:** regenerate the evidence census after ADR-262 gained its Evidence section ([b9276f8](https://github.com/event4u-app/agent-config/commit/b9276f80e5454da6e2e4b418d0593aea07db427c))
 
 ### Other
 
-* **security:** house dialect in the lines this branch authored ([085279f](https://github.com/event4u-app/agent-config/commit/085279f9cc1e84ea87a48c56bc21021873ef7704))
-* carry the closure content the archival move left behind ([cbf0b5d](https://github.com/event4u-app/agent-config/commit/cbf0b5dd69bd69ba2b5be88e12eb66d8df016876))
-* close road-to-one-continuity-record around the sequenced half ([ffab0c2](https://github.com/event4u-app/agent-config/commit/ffab0c262e0a72817e41a2b13a25ae8fabc63ff6))
-
-Tests: 21606 (+130 since 14.19.0)
+* Fix: a successor now finds its predecessor's recycle envelope (#1965) ([f58ba26](https://github.com/event4u-app/agent-config/commit/f58ba2654e1c067a6892e78c35b5e4d36b4b8c56))
+* a receiver for the archive-exclusion gap in two ratcheted gates ([f639efb](https://github.com/event4u-app/agent-config/commit/f639efbe945702ec9520e7ecdbe3827e917618ff))
+* **docs:** house dialect on the lines this branch authored ([0567287](https://github.com/event4u-app/agent-config/commit/05672878156bd075757bee137d846d8f573dc4a7))
+* the three residuals the 14.22.0 dispositions could not close ([8fab9b6](https://github.com/event4u-app/agent-config/commit/8fab9b6e16ac0721551f2ce1fae04192d7faad61))
+* relocate the pack-size blocker, and archive a-graph-that-is-shipped ([db5c4d3](https://github.com/event4u-app/agent-config/commit/db5c4d391e59a4d3fe07ea6f5df82465fca3c367))
+* Merge remote-tracking branch 'origin/main' into drain/standing-budget-approval-store ([34029ed](https://github.com/event4u-app/agent-config/commit/34029ed8847d20f090ef9d75ae3f3a703edc90d9))
+* the 14.22.0 findings ledger is missing and reds the required check ([30c0c0f](https://github.com/event4u-app/agent-config/commit/30c0c0f912411fd55fcad7cf3e660697a7eaca32))
+* **r2:** disposition all 14 findings and re-bind the round to the current scope ([0d5d8c9](https://github.com/event4u-app/agent-config/commit/0d5d8c9f9281bb90ce4713e7c11ef200b1b387fc))
+* **payload:** re-emit the standing-payload artifact from a clean tree, with an honest pin ([87f94ac](https://github.com/event4u-app/agent-config/commit/87f94ac47682ca68d84feb99a0ee68479a85f6cd))
+* **bench:** track the re-scored thin-inject report the ADR and CLAIMS cite ([9669409](https://github.com/event4u-app/agent-config/commit/966940967c222bb1bd4887edb5b2f76cdd7694b5))
+* re-review the Risk Register at close, all five rows ([ae537fd](https://github.com/event4u-app/agent-config/commit/ae537fd7568d316c9e1b8e4457e0a507ca0cb326))
+* close 1.3 and 2.3 on council verdicts, and discharge AC-4/5/6 ([9e4c6cd](https://github.com/event4u-app/agent-config/commit/9e4c6cd262aa5167c59b67a86fcbfeb909944002))
+* **r2:** 14 findings on drain/delivery-for-every-host — 3 high, 6 medium, 5 low ([2678861](https://github.com/event4u-app/agent-config/commit/2678861a315964bf1bb3b4d5646f2769652c1a4f))
+* defer standing-budget 1.3 to a named receiver, resolve its blocker ([3be6fd6](https://github.com/event4u-app/agent-config/commit/3be6fd63c541e2c5e5c1a9e19ce3f0b8b59ad90a))
+* Merge remote-tracking branch 'origin/main' into drain/delivery-for-every-host ([c2273db](https://github.com/event4u-app/agent-config/commit/c2273db25d553887e56cfb8f36ee7481a8059b8a))
+
+Tests: 22463 (+318 since 14.22.0)
 
 # Era: pre-4.0.0 — archived
 

package/CREDITS.md

@@ -13,6 +13,7 @@ contributors whose skills, rules or commands were merged.
 | `design-intelligence` (`ui-styling`-derived assets) | "claudekit" | Apache-2.0 | [`LICENSE.apache-2.0.txt`](src/skills/design-intelligence/LICENSE.apache-2.0.txt) + modified-file markers per §4b |
 | `corpus-grounding`, `design-tokens`, `react-shadcn-ui`, `tailwind-engineer` (derived slices) | see per-skill notices | MIT / Apache-2.0 | ADR-061 — the per-skill attribution notice is authoritative |
 | `src/scripts/cost/budget.mjs`, `src/scripts/cost/track.mjs` | ruvnet/ruflo — `plugins/ruflo-cost-tracker` | MIT | full notice below; transformation record in [`provenance/borrows.jsonl`](provenance/borrows.jsonl) and [`docs/THIRD-PARTY-NOTICES.md`](docs/THIRD-PARTY-NOTICES.md) |
+| `src/vendor/grammars/*.wasm` (3 compiled tree-sitter grammars) | `tree-sitter/tree-sitter-{php,typescript,javascript}`, packaged by `tree-sitter-wasms` (Unlicense) | MIT | full notice below; provenance and refresh procedure in [`src/vendor/grammars/README.md`](src/vendor/grammars/README.md) |
 
 #### MIT notice — ruvnet/ruflo
 
@@ -46,6 +47,42 @@ IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ```
 
+#### MIT notice — tree-sitter grammars
+
+Reproduced in full for the same reason as the notice above: the three
+WebAssembly grammars under `src/vendor/grammars/` are **verbatim, unmodified
+binary copies**, which is the clearest possible case of "copies or substantial
+portions of the Software". They ship in the npm package (`package.json` →
+`files`), so this file travels with them and discharges the obligation for a
+consumer who receives them from the registry.
+
+The compiled `.wasm` artefacts are built from the upstream `tree-sitter`
+grammar repositories (MIT) and were obtained through `tree-sitter-wasms@0.1.13`
+(Unlicense — public domain, imposing no attribution obligation of its own). The
+MIT notice below is the one that travels, because it is the grammars' licence,
+not the packager's.
+
+```
+Copyright (c) 2018-2026 Max Brunsfeld and the tree-sitter grammar authors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+```
+
 ### Comparators (benchmark baselines, no vendored material)
 
 | Comparator | Pinned at | License | Where it is used |

package/README.md

@@ -4,7 +4,7 @@
 
 [![Smoke](https://github.com/event4u-app/agent-config/actions/workflows/smoke.yml/badge.svg)](https://github.com/event4u-app/agent-config/actions/workflows/smoke.yml) [![Public install smoke (3 OS × 2 Node)](https://github.com/event4u-app/agent-config/actions/workflows/smoke-public-install.yml/badge.svg)](https://github.com/event4u-app/agent-config/actions/workflows/smoke-public-install.yml) [![npm](https://img.shields.io/npm/v/@event4u/agent-config?style=flat-square&label=npm&color=orange)](https://www.npmjs.com/package/@event4u/agent-config) [![agent-config MCP server](https://glama.ai/mcp/servers/event4u-app/agent-config/badges/score.svg)](https://glama.ai/mcp/servers/event4u-app/agent-config) [![MCP Toplist](https://mcptoplist.com/badge/glama%2Fevent4u-app%2Fagent-config.svg)](https://mcptoplist.com/server/glama%2Fevent4u-app%2Fagent-config)
 
-[![Skills](https://img.shields.io/badge/Skills-299-orange?style=flat-square)](dist/agent-src/skills/) [![Rules](https://img.shields.io/badge/Rules-120-orange?style=flat-square)](dist/agent-src/rules/) [![Commands](https://img.shields.io/badge/Commands-204-orange?style=flat-square)](dist/agent-src/commands/) [![Guidelines](https://img.shields.io/badge/Guidelines-118-orange?style=flat-square)](docs/guidelines/) [![Personas](https://img.shields.io/badge/Personas-29-orange?style=flat-square)](dist/agent-src/personas/) [![Advisors](https://img.shields.io/badge/Advisors-5-orange?style=flat-square)](dist/agent-src/personas/advisors/) <!-- claim:published-artifact-counts -->
+[![Skills](https://img.shields.io/badge/Skills-299-orange?style=flat-square)](dist/agent-src/skills/) [![Rules](https://img.shields.io/badge/Rules-120-orange?style=flat-square)](dist/agent-src/rules/) [![Commands](https://img.shields.io/badge/Commands-204-orange?style=flat-square)](dist/agent-src/commands/) [![Guidelines](https://img.shields.io/badge/Guidelines-119-orange?style=flat-square)](docs/guidelines/) [![Personas](https://img.shields.io/badge/Personas-29-orange?style=flat-square)](dist/agent-src/personas/) [![Advisors](https://img.shields.io/badge/Advisors-5-orange?style=flat-square)](dist/agent-src/personas/advisors/) <!-- claim:published-artifact-counts -->
 
 <sub>**How these are counted** — one canonical counter, `agent-config` → `update_counts --check`, re-derives all six from the tree and fails CI on a drift of one. Two bases are not what the linked directory shows, so they are stated here rather than left to be inferred: **Commands 202** counts every command file **recursively** (the linked directory holds 61 at its top level), and **Rules 120** counts the **source** rules while the linked projection holds 119 — one rule is dormant and is not projected. **Personas 29** excludes the directory README. Counts are of files and directories: none of them measures quality, activation, or adoption. <!-- claim:published-artifact-counts --></sub>