@event4u/agent-config 14.21.0 → 14.23.0

package/src/config/gate-coverage.yml

@@ -52,14 +52,18 @@
 #                of them.
 #   canary       optional mutation recipe (Phase 7) — see CANARY below
 #
-# COVERAGE — THE HONEST DENOMINATOR (re-measured 2026-08-28)
+# COVERAGE — THE HONEST DENOMINATOR (re-measured 2026-09-08)
 # ----------------------------------------------------------
-# 306 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`
+# 322 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`
 # (the count is computed, not asserted — `check_gate_coverage.count_gate_scripts`,
-# re-run on the tree carrying these rows, which now include the four gates the
-# two runtime-cost roadmaps add: check_prefix_stable_mutation,
-# check_loss_class_declared, check_benchmark_report_fields, and
-# check_no_currency_in_cost_surfaces).
+# re-run on the tree carrying these rows. Re-measured 2026-09-08 from the 306
+# recorded on 2026-08-28: the tree had drifted to 321 without the header moving,
+# which is 15 — exactly the drift tolerance in
+# `check_gate_coverage.test.ts` § states an honest denominator — so the next
+# single addition was always going to red it. `check_candidate_lines` from
+# `road-to-candidate-moves-floor` was that addition. The number is re-measured
+# rather than the tolerance widened: a stated population that nobody re-measures
+# is the un-asserted count this whole manifest exists to refuse.)
 # **78 of them emit the machine-readable `scanned: <N>` line under their
 # CI-identical argv, and 75 of those 78 are listed below.** The manifest is
 # complete for every gate that can carry a floor, covering ~25 % of the population.
@@ -487,14 +491,14 @@ gates:
     corpus: "every agents/roadmaps/*.md, counted as FILES rather than as declarations. THE FLOOR WAS RETIRED ON 2026-08-30 AND REPLACED WITH AN ENUMERATION ASSERTION IN THE LINTER ITSELF (AI council, anthropic + openai, convergent on option b). It sat at 5 over a population under deliberate drawdown to ZERO, so it went red the day the drain succeeded — 6 active roadmaps to 4 in one afternoon — and the only available move was lowering the number again, a treadmill ending at a floor of 0, which is no floor. What guards the scope now is `lint_consolidation_lineage` refusing outright when a declared root is missing, is not a directory, or cannot be enumerated; that check lives in the PRODUCTION linter rather than here on purpose, because an independent existsSync in this gate would observe a directory without proving the linter enumerated it. Honest limit, named rather than implied: it catches a missing or renamed root, not a glob narrowed to match nothing, not enumeration in the wrong working directory, and not roadmaps moved into nested directories the walk no longer traverses. Today none of them carries a `consolidates:` field, so the finding count is legitimately zero while the scanned count is not — that split is the point: a declaration-count floor would be a zero-check wearing a ratchet's name, and would go green the moment the scan root moved. The floor sits at 5 rather than near the present 12 because the active estate is under deliberate drawdown (one-in-one-out plus an explicit drain), so a falling count is expected work rather than a collapse; below 5 the estate would be smaller than any point in its recorded history. NO CANARY, deliberately: the council decision that admitted this gate (2026-08-27, 2/2 convergent, E1=b/E2=report) fixed it in REPORT mode, so it exits 0 on findings by design and a planted violation could not turn it red. Its ability to go red is proven instead by `--self-test`, which the same decision required: six declaration spellings must parse identically, all four finding types must fire, and a complete folder must stay silent."
     status: enforced
     no_canary_reason: "A report-mode gate cannot be turned red by a planted file. The council decision that admitted this gate (2026-08-27, 2/2 convergent, E1=b/E2=report) fixed it in report mode deliberately: the four measured failures come from a high-noise drafting context and do not establish precision on the tracked estate, so blocking is earned by tracked-scope evidence rather than assumed. A canary here would either be planted and ignored (proving nothing) or force `--strict` into CI, which would decide E2 by wiring instead of by evidence. The negative control is `--self-test` instead, required by the same decision and stronger than a single planted file: six declaration spellings must parse to an identical parent set, all four finding types must fire, and a complete folder must stay silent — the third arm being what stops a checker that returned every code unconditionally from passing the second. Revisit together with E2: when the tracked half is promoted to blocking, it owes a canary."
-  - id: lint_carrier_integrity
+  - id: lint_deferral_integrity
     argv: []
     min_scanned: 600
     corpus: "every roadmap file under agents/roadmaps/archive/ and agents/roadmaps/skipped/ — 656 at the time of writing, and the count only rises because archival is one-way. The floor sits at 600 rather than near 656 because a reading below it means the walk lost a directory, not that roadmaps were un-archived. The walk direction is the design: a `[~]` carry is validated once, when the parent is archived, by a sweep that then never looks at the pair again, so the receiver can be deleted afterwards with nothing going red. Starting from the archived parent — which names its destination by slug and which nothing rewrites — makes whole-file deletion detectable on the first pass, with no registry to maintain. TWO CLASSES, and the split decides the tier: `broken-destination` (deleted, renamed, re-parented, skipped, or archived with open steps) is a HARD failure at zero with no baseline, because every member had a recorded home and lost it; `unannotated` (a bare `[~]` with no annotation at all) is ratcheted at 243 in gate-violation-baselines.json, all of it predating the annotation contract by up to three months."
     status: enforced
     canary:
       class: contract-violation
-      path: agents/roadmaps/archive/zz-canary-carrier-integrity.md
+      path: agents/roadmaps/archive/zz-canary-deferral-integrity.md
       content: |
         ---
         complexity: bounded
@@ -1295,6 +1299,23 @@ gates:
       or if a drop to 0 is ever traced to a scanner defect rather than to an
       empty corpus.
 
+  - id: check_continuity_surface
+    argv: []
+    min_scanned: 40
+    corpus: "the rows of src/config/continuity-surface.json PLUS every distinct persisted-state leaf under agents/runtime/state/ that any source file under src/scripts, src/agent-src/scripts, src/cli, src/shared, src/server or src/install names (70 rows + 58 discovered leaves = 128 at introduction). The floor is 40 rather than ~120 because the roadmap this gate serves is SUBTRACTIVE by design: rows are meant to disappear as surfaces are retired, and a floor set near the live number would red on the very drawdown the gate exists to encourage. It is still far above a collapse — the discovery walking a moved root reads 0, and a taxonomy that dropped to a handful of hand-picked rows would trip it."
+    status: enforced
+    no_canary_reason: >-
+      the negative control is the gate's own --self-test, run in CI: 7 cases, 4
+      rejecting, covering every failure class in BOTH directions — an
+      undisposed persisted-state leaf, a row whose locus no longer resolves, a
+      counted axis above the base-ref floor, and a row with no reason of
+      substance, against three accepting cases including the shipped inventory
+      over the shipped tree. It builds throwaway repositories rather than
+      touching this one. A planted canary here would mean committing a real
+      undisposed state path into src/ and removing it again, and a forgotten one
+      is precisely the defect this gate exists to catch — the same argument
+      check_gate_reachability records for itself one row below.
+
   - id: check_gate_reachability
     script: src/scripts/check_gate_reachability.ts
     min_scanned: 10

package/src/config/gate-violation-baselines.json

@@ -34,9 +34,9 @@
       "note": "The nine active non-draft roadmaps that predate the `relates:` requirement (road-to-agentic-engineering-assurance, road-to-component-library-lifecycle, road-to-council-evidence-integrity, road-to-frontend-fidelity-calibration, road-to-monorepo-scope-and-detection, road-to-observability-plate, road-to-role-scoped-spawn-profiles, road-to-skill-delivery-over-mcp, road-to-standing-payload-diet). This is a NEW obligation rather than a repaired scan root, and the ratchet is the point: `depends:` shipped in the template with nothing requiring it and measured 0 adoption, so requiring `relates:` retroactively across the estate would be an owner-reserved write with no analysis behind the edges it would have to invent (held as step 4.3, deferred). Clearing an entry here is one roadmap at a time: run `agent-config roadmap:context` on it, write the rows the probe surfaces, and lower the count."
     },
     "check_source_size_budget": {
-      "count": 18016,
-      "landed": "2026-09-07",
-      "note": "MERGE RECONCILIATION 2026-09-07, 18,061/18,017 -> 18,016. drain/admissible-council-seats and fix/release-obligation-answerable each lowered from the SAME 18,062 base in parallel — main to 18,061 (net -1: curlJsonPost, the seat-status helpers and the per-seat config parsing moved out of the three over-ceiling council files) and the branch to 18,017 (net -45: the /dev/tty prompt helpers moved out of release.ts into _lib/tty_prompt.ts, 76 lines and UNDER the cap, taking release.ts 1871 -> 1826). Taking either side alone is wrong in a different direction, which is the reconciliation doctrine this entry already carried from 2026-09-03: main's value silently discards the branch's earned -45, and the branch's value RAISES the baseline against main and weakens the gate. The committed number is neither — it is the gate's own output on the MERGED tree, where both reductions apply, and it equals the arithmetic (18,062 - 45 - 1 = 18,016) rather than being reconciled by it. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports ZERO untracked files, so a clean CI checkout of this commit measures the same 18,016. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in the merge commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 18,062 -> 18,061 on 2026-09-07 by drain/admissible-council-seats. The branch's own additions to the three over-ceiling files (ai_council/config.ts, council_cli.ts, ai_council/clients.ts) came in at +96 excess and were paid down to -1 rather than baselined, in the four ways this entry's doctrine prescribes: `curlJsonPost` moved out of clients.ts into ai_council/api_transport.ts (UNDER the cap, so the prose and the three new provider shims cost nothing); the seat-status helpers moved out of council_cli.ts into ai_council/status_surface.ts, taking an orphaned doc comment with them; the three new per-seat config fields' parsing moved out of config.ts into ai_council/seat_policy.ts::parseSeatFields; and three prose blocks that the branch's own transport repair made FACTUALLY FALSE (the `openai` / `google-genai` Python-SDK claims, and a `_curlJsonPost` pointer to a function that had moved) were corrected and shortened in the same change. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports zero untracked files with the five new src/ files staged, so a clean CI checkout of this commit measures the same 18,061. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried here because tests/scripts/check_source_size_budget.test.ts:166 asserts baseline == live and therefore blocks where the gate only advises -- the lowering commit must carry its own baseline update. Lowered 18,068 -> 18,062 on 2026-09-06 by drain/host-enforcement-truth. Collapsing the five per-host binding constants in install.ts into src/scripts/hooks/host_lowering.yaml removed 29 lines from a file ~3,900 past the 1500 cap, where every line costs one excess; the journal's surface column and its extracted migration helper gave 23 back. Lowered 18,245 -> 18,230 on 2026-09-02 by drain/publication-integrity-option-a. Phase 2 Option A moved the authoring instruction out of the generator: release.ts, which sits ~530 lines PAST the 1500 cap so every line there costs one excess, loses the comment emission, a 16-line HEAD_DEFAULT doc block and its alias const, and gains a shorter writer docstring. The doc block moved to _lib/release_material.ts, which is 289 lines and therefore UNDER the cap, so the same prose now costs nothing. Net -15. The branch first came in at +8 and paid its own way down rather than raising the baseline.",
+      "count": 17963,
+      "landed": "2026-09-08",
+      "note": "Lowered 17,973 -> 17,963 on 2026-09-08 by drain/graph-shipped-close. The branch registers five code-graph MCP tools (road-to-a-graph-that-is-shipped 4.1). Their five records and schemas are ~250 lines, and putting them in mcp_server/tools.ts -- which sits ~500 lines PAST the 1500 cap, so every line there is one unit -- would have cost ~250 excess. They live in mcp_server/graph_tools.ts instead (~280 lines, UNDER the cap, so they and their prose cost nothing), and tools.ts spreads them into ALLOWLIST in two lines: one import and one `...GRAPH_TOOLS,`. Those two were paid for rather than baselined, in the way this entry's doctrine prescribes: `_strip` and `_resolvePath` -- a whitespace trim and a tolerant realpath, generic by nature -- moved out of tools.ts into mcp_server/path_util.ts, also under the cap. They are imported under their original underscore names, so all 28 call sites are unchanged and a two-function move does not read as a sweep. tools.ts 2,025 -> 2,015: -12 from the extraction, +2 from the registration, net -10 for a branch that ADDED a feature. CORRECTED 2026-09-08 after an independent review checked the figure against the tree -- this sentence read '2,025 -> 2,013, net -12, against the +2 the registration needed', which states an intermediate file length as the final one and leaves the arithmetic (-12) and the conclusion (-10) describing different trees. `git show origin/main:...tools.ts | wc -l` is 2025 and the working tree is 2015. The TOTAL, 17,963, was always the gate's own output and is unchanged. Every other file this branch touches or creates -- code_graph/verbs.ts, code_graph/cli.ts, code_graph/build.ts, code_graph/detect.ts, code_graph/query.ts, code_graph/sqlite_store.ts, code_graph/types.ts, _lib/regression_neighbourhood.ts -- is under the 1500 ceiling before and after, so it contributes zero excess whatever it grew by. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the two new src/ files staged and nothing untracked, so a clean CI checkout of this commit measures the same 17,963. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 17,974 -> 17,973 on 2026-09-08 by drain/topology-c1. The branch adds a live-path emit to council_cli.ts, which sits 2,454 lines PAST the 1500 cap so every line there is one unit, and paid its own way down rather than raising the baseline, in the way this entry's doctrine prescribes. The twelve-line `all_responses` assembly (a spread, three conditionals and a push) moved out of council_cli.ts into ai_council/deliberation_metrics.ts::runCallsFrom, 353 lines and therefore UNDER the cap, so the six stage labels and their prose cost nothing. It moved on merit rather than only on arithmetic: 'which calls did this run make, and at which stage' is that module's own subject, and the CLI held the list only as a flat array with the stage boundaries implicit in the order -- both readings now come out of one walk, so the billing total and the attribution can never be computed over different sets. council_cli.ts 3,955 -> 3,954 net, after the two call lines, the import and the one payload key the feature needed. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the two new src/ files staged and nothing untracked, so a clean CI checkout of this commit measures the same 17,973. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 18,016 -> 17,974 on 2026-09-07 by fix/single-delivery-unconditional. SETTLED FIGURE, and it supersedes an intra-session 17,962 this same branch committed earlier — read the direction against MAIN, which is what the ratchet protects: main is 18,016, the branch leaves 17,974, net -42. The 17,962 was this branch's own low before a neutral review returned twelve findings; fixing them added a real mechanism to mcp_server and condense.ts (the flat-wrapper carriage gate the review showed was missing, plus its four-skip predicate), and condense.ts sits ~1,215 lines PAST the cap so each of those lines is one unit. Paid down first, in the way this entry's doctrine prescribes: _suggestSkillForTaskHandler and its 18-line docstring moved out of mcp_server/tools.ts (2,079 -> 2,025) into mcp_server/suggest_skill.ts, 72 lines and UNDER the cap, so its prose costs nothing. The residual +12 against the intra-session low is the gate's own output on the settled tree and is recorded rather than engineered away, because the alternative was extracting _nested_command_subpath and its two callers out of condense.ts - which needs MODULE_STATE, _relativeToPosix and _domains_command_logical passed in, a wider diff than the finding warrants and one no review asked for. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the three new src/ files staged and nothing untracked, so a clean CI checkout of this commit measures the same 17,974. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: MERGE RECONCILIATION 2026-09-07, 18,061/18,017 -> 18,016. drain/admissible-council-seats and fix/release-obligation-answerable each lowered from the SAME 18,062 base in parallel — main to 18,061 (net -1: curlJsonPost, the seat-status helpers and the per-seat config parsing moved out of the three over-ceiling council files) and the branch to 18,017 (net -45: the /dev/tty prompt helpers moved out of release.ts into _lib/tty_prompt.ts, 76 lines and UNDER the cap, taking release.ts 1871 -> 1826). Taking either side alone is wrong in a different direction, which is the reconciliation doctrine this entry already carried from 2026-09-03: main's value silently discards the branch's earned -45, and the branch's value RAISES the baseline against main and weakens the gate. The committed number is neither — it is the gate's own output on the MERGED tree, where both reductions apply, and it equals the arithmetic (18,062 - 45 - 1 = 18,016) rather than being reconciled by it. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports ZERO untracked files, so a clean CI checkout of this commit measures the same 18,016. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in the merge commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 18,062 -> 18,061 on 2026-09-07 by drain/admissible-council-seats. The branch's own additions to the three over-ceiling files (ai_council/config.ts, council_cli.ts, ai_council/clients.ts) came in at +96 excess and were paid down to -1 rather than baselined, in the four ways this entry's doctrine prescribes: `curlJsonPost` moved out of clients.ts into ai_council/api_transport.ts (UNDER the cap, so the prose and the three new provider shims cost nothing); the seat-status helpers moved out of council_cli.ts into ai_council/status_surface.ts, taking an orphaned doc comment with them; the three new per-seat config fields' parsing moved out of config.ts into ai_council/seat_policy.ts::parseSeatFields; and three prose blocks that the branch's own transport repair made FACTUALLY FALSE (the `openai` / `google-genai` Python-SDK claims, and a `_curlJsonPost` pointer to a function that had moved) were corrected and shortened in the same change. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports zero untracked files with the five new src/ files staged, so a clean CI checkout of this commit measures the same 18,061. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried here because tests/scripts/check_source_size_budget.test.ts:166 asserts baseline == live and therefore blocks where the gate only advises -- the lowering commit must carry its own baseline update. Lowered 18,068 -> 18,062 on 2026-09-06 by drain/host-enforcement-truth. Collapsing the five per-host binding constants in install.ts into src/scripts/hooks/host_lowering.yaml removed 29 lines from a file ~3,900 past the 1500 cap, where every line costs one excess; the journal's surface column and its extracted migration helper gave 23 back. Lowered 18,245 -> 18,230 on 2026-09-02 by drain/publication-integrity-option-a. Phase 2 Option A moved the authoring instruction out of the generator: release.ts, which sits ~530 lines PAST the 1500 cap so every line there costs one excess, loses the comment emission, a 16-line HEAD_DEFAULT doc block and its alias const, and gains a shorter writer docstring. The doc block moved to _lib/release_material.ts, which is 289 lines and therefore UNDER the cap, so the same prose now costs nothing. Net -15. The branch first came in at +8 and paid its own way down rather than raising the baseline.",
       "reason": "Lowered 18,230 -> 18,209 on 2026-09-03 by drain/artifact-location. `doctor --strict` needed 16 lines of integration wiring in cmd_doctor.ts, which sits ~2,100 lines PAST the 1500 cap so every line there costs one excess. The branch first came in at +137 and paid its own way down rather than raising the baseline: the strict semantics, threshold, kill switch, payload helper and argv fragments moved to _cli/_doctor_strict.ts (~160 lines, under the cap, costs nothing), taking it to +15; then the 37-line drift renderer moved to _cli/_doctor_emit.ts. Net -21. The renderer was chosen deliberately: pure rendering, two dependencies, no argparse involvement and therefore none of the byte-parity risk the parser surface carries against the retired Python implementation; nothing outside cmd_doctor.ts imported it. An AI council on the residual split (a: raise by 15 / d: descope the feature); neither was taken, because a parallel branch demonstrated the same day that paying down is achievable in this codebase, which is the evidence the split lacked. This gate's own test comment prescribes it: a commit that splits a god-file lowers the excess and must carry the lowered baseline. MERGE RECONCILIATION 2026-09-03, 18,209 -> 18,205: drain/wired-instruments and drain/artifact-location each lowered from the SAME 18,230 base in parallel -- the branch to 18,226 (net -4, run_continuation_hook.ts's termination ladder moved to _lib/continuation_ladder.ts and runtime_journal.ts's prose to _lib/outcome_vocabularies.ts, both under the cap) and main to 18,209 (net -21, the doctor --strict split above). Taking either side alone is wrong in a different direction: main's value silently discards the branch's earned -4, and the branch's value RAISES the baseline against main and weakens the gate. The committed number is neither -- it is the gate's own output on the merged tree, where both reductions apply. THIS LOCAL READING IS ADMISSIBLE HERE, and the discriminator matters because this file's ci-parity:local-only entry records a 165 -> 164 lowering that was reverted for exactly the opposite case: that count depends on how the environment resolves the projection surface, whereas this gate walks only SOURCE_ROOTS = ['src'] (check_source_size_budget.ts:88) counting excess lines over the 1500 ceiling, and `git status --porcelain -uall -- src/` reported ZERO untracked files, so a clean CI checkout of this commit measures the same 18,205. If CI reads anything else, CI's number is the correct one and this note is the record of why. LOWERED 18,205 -> 18,193 on 2026-09-03 by fix/release-curation-ask. The change adds a fifth publication guard, and its own additions landed at +10 excess: release.ts 2,008 -> 2,018, every line of which is past the 1500 cap. Paid down rather than baselined, in the two ways this gate's doctrine prescribes. The guard's rationale (~13 lines of docstring, including why prMerged is a parameter rather than a call-site if) lives in release_publication.ts, 915 lines and therefore UNDER the cap, so the prose costs nothing; and the two pure text helpers _splitlines and _rstrip moved out of release.ts into release_env.ts (333 lines, also under the cap), taking release.ts to 1,996 -- 12 BELOW where it started. The branch came in at +10 and leaves at -12. Recorded while moving them: _splitlines is duplicated a third and fourth time at adoption_report.ts:106 and readme_linter.ts:418; collapsing all three onto one definition touches three modules and was left out of this change rather than done silently. LOWERED 18,193 -> 18,180 on 2026-09-03 by fix/release-branch-reuse. The step-1 branch decision -- twenty lines of if/else in release.ts -- became one call to checkout_release_branch in release_publication.ts, which is 1,019 lines and therefore UNDER the 1500 cap, so the twenty lines plus a ~35-line rationale now cost nothing. release.ts 1,996 -> 1,983, every one of those lines being past the cap. The drill grew 765 -> 918 for two new scenarios and the snapshot/restore that keeps them from writing the real CHANGELOG, and it is under the cap too. A change that adds a feature and lowers the excess is the shape this gate's doctrine asks for; the alternative was a +13 raise for logic that had no business in the god-file. LOWERED 18,180 -> 18,068 on 2026-09-05 by fix/release-gate-producer-parity. The change wires the governance-mix obligation into the writer and the two local guards and adds a release-gate locality registry; its own additions to release.ts landed at +19 excess, every one of those lines past the 1500 cap. Paid down rather than baselined, in the way this entry's doctrine prescribes: the 132-line test-count-trend unit (_TEST_COUNT_LINE_RE, _TEST_LIST_MAX_BUFFER, _count_from_list_result, _count_tests_current, _previous_test_count_from_changelog, _render_test_trend_line) moved from release.ts into release_publication.ts, which is under the cap and where it now belongs on merit rather than only on arithmetic -- the same diff makes the missing `Tests: N` footer a section-level publication blocker, so the writer that emits the footer and the guard that refuses its absence sit in one module. release.ts 1,983 -> 1,871. All four names are re-exported from release.ts, so tests/scripts/release.test.ts is unchanged. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the ceiling, and `git status --porcelain -uall -- src/` reports ZERO untracked files with the two new src/ files staged, so a clean CI checkout of this commit measures the same 18,068. If CI reads anything else, CI's number is the correct one and this note is the record of why."
     },
     "ci-parity:local-only": {
@@ -52,9 +52,9 @@
       "falsifier": "./scripts-run src/scripts/check_gate_coverage"
     },
     "lint_canonical_terms": {
-      "count": 1006,
-      "landed": "2026-09-07",
-      "note": "Lowered 1007 -> 1006 on 2026-09-07 by drain/observed-learning-signal, and the gain was INCIDENTAL rather than sought: the branch's own new prose introduced five house-dialect occurrences under src/ and docs/ (four `artefact`/`artefacts`, one `behaviour`), which were rewritten LINE-SCOPED — only lines this diff authored, never a file-wide sweep, because `sweep_authorised: false` is still a live constraint. Four of the five were net-neutral (they replaced deleted lines carrying the same word) and one was a genuine reduction. The gate reported the tree at 1006 against a baseline of 1007 and asked for exactly this lowering, so the gain cannot be silently given back. LOCAL READING, ADMISSIBLE ON THE SAME DISCRIMINATOR THIS FILE'S check_source_size_budget ENTRY USES: the gate walks only authored prose under src/ and docs/, and `git status --porcelain -uall -- src docs` reported ZERO untracked files, so a clean CI checkout of this commit measures the same 1006. If CI reads anything else, CI's number is the correct one and this note is the record of why. `landed` is refreshed deliberately: checkRatchet returns `improved` BEFORE it evaluates staleness, so an entry left at 1007 while the tree measures 1006 would never expire at any age. PRIOR ENTRY: House-dialect debt in authored prose under src/ and docs/, measured by the gate this entry governs (road-to-canonical-terms 2.2). NOT a dead-root repair: the gate is new, and the debt is the corpus that predates the dialect decision recorded in src/config/canonical-terms.yml. A hard-zero gate was refused on the same ground the AI council refused an unconditional sweep on 2026-08-25. The ratchet IS the council's staged promotion: report-only for existing debt, blocking for anything new. What remains is dominated by two large-radius pairs — `artefact`->`artifact` and `behaviour`->`behavior` — plus `hand-off`->`handoff` and `licence`->`license`, the last of which the map flags `semantic-care-required` because licence TITLES are protected text. Shrink-only from here. Full classified inventory: agents/evidence/analysis/canonical-terms-inventory-2026-08-26.md.",
+      "count": 1005,
+      "landed": "2026-09-08",
+      "note": "Lowered 1006 -> 1005 on 2026-09-08 by drain/graph-shipped, on the same shape as the entry below and with the same discriminator. This branch's payload migration moved a See-also line carrying `artefact` from the rule into the code-intelligence skill; keeping the word in both places would have RAISED the count, so both occurrences were written canonical LINE-SCOPED — only lines this diff authored, never a file-wide sweep. One of the two is a genuine reduction. The gate reported the tree at 1005 against a baseline of 1006 and asked for exactly this lowering. `landed` is refreshed for the reason the prior entry records: checkRatchet returns `improved` before it evaluates staleness, so an entry left high never expires. PRIOR ENTRY: Lowered 1007 -> 1006 on 2026-09-07 by drain/observed-learning-signal, and the gain was INCIDENTAL rather than sought: the branch's own new prose introduced five house-dialect occurrences under src/ and docs/ (four `artefact`/`artefacts`, one `behaviour`), which were rewritten LINE-SCOPED — only lines this diff authored, never a file-wide sweep, because `sweep_authorised: false` is still a live constraint. Four of the five were net-neutral (they replaced deleted lines carrying the same word) and one was a genuine reduction. The gate reported the tree at 1006 against a baseline of 1007 and asked for exactly this lowering, so the gain cannot be silently given back. LOCAL READING, ADMISSIBLE ON THE SAME DISCRIMINATOR THIS FILE'S check_source_size_budget ENTRY USES: the gate walks only authored prose under src/ and docs/, and `git status --porcelain -uall -- src docs` reported ZERO untracked files, so a clean CI checkout of this commit measures the same 1006. If CI reads anything else, CI's number is the correct one and this note is the record of why. `landed` is refreshed deliberately: checkRatchet returns `improved` BEFORE it evaluates staleness, so an entry left at 1007 while the tree measures 1006 would never expire at any age. PRIOR ENTRY: House-dialect debt in authored prose under src/ and docs/, measured by the gate this entry governs (road-to-canonical-terms 2.2). NOT a dead-root repair: the gate is new, and the debt is the corpus that predates the dialect decision recorded in src/config/canonical-terms.yml. A hard-zero gate was refused on the same ground the AI council refused an unconditional sweep on 2026-08-25. The ratchet IS the council's staged promotion: report-only for existing debt, blocking for anything new. What remains is dominated by two large-radius pairs — `artefact`->`artifact` and `behaviour`->`behavior` — plus `hand-off`->`handoff` and `licence`->`license`, the last of which the map flags `semantic-care-required` because licence TITLES are protected text. Shrink-only from here. Full classified inventory: agents/evidence/analysis/canonical-terms-inventory-2026-08-26.md.",
       "falsifier": "./scripts-run src/scripts/lint_canonical_terms"
     },
     "lint_handoffs": {
@@ -85,10 +85,10 @@
       "falsifier": "./scripts-run src/scripts/check_no_external_sources  # the 'attribution shape' line names the current block count; the gate fails when it RISES above this entry",
       "note": "Lowered 243 -> 148 on 2026-08-30 by road-to-source-silence-cutover step 3.1. AI COUNCIL 2026-08-30, 2/2 seats present (anthropic + openai), option (a): NARROW the `source-header` class, do not delete it, and lower the baseline to the new measured total. REASON THE OLD NUMBER WAS WRONG, not merely high: the class flagged the VALUE of every `**Source:**` header that was not an ENC1 token or an opaque round id, so a correctly ANONYMISED header scored exactly like a leaking one. All 95 findings were read; not one named an external source in readable form, and six were flagging the anonymisation notice itself. One seat: the detector penalised correct behaviour. WHAT CHANGED: `sourceHeaderHits` now flags only a value carrying a readable identifier - an owner/repo slug, a domain, or an @scope/package - per the operational grammar in `readableIdentifierIn`, written out because a seat warned that 'readable slug' left unspecified 'merely moves subjective classification into code'. Both seats REFUSED option (c), deleting the class: a `**Source:**` header is where policy tells authors to record attribution and is therefore the highest-value place to keep looking. THE DELTA IS AUDITED: 148 = 127 tmp-quote + 21 repo-slug, and a full-tree recount removed exactly the 95 audited source-header findings and ADDED ZERO. The first run produced 150, on two middle-of-path segments (`uncondensed/rules`, `installer/src`) that read like slugs; both are pinned as fixtures. EVIDENCE: `tests/scripts/source_header_narrowing.test.ts` over three labeled fixtures under `tests/fixtures/source-headers/` - compliant (must not flag), internal-ref (must not flag), leaking (MUST flag, all three identifier shapes). The pre-narrowing predicate is kept as `legacySourceHeaderHits` and shadow-reported by the gate; it enforces nothing. ROLLBACK, as specified: revert the matcher and restore 243 if a readable identifier in a `**Source:**` fixture escapes detection, if the full-tree count is not reproducibly 148, or if the delta contains anything outside the audited source-header set. WHAT REMAINS IS REAL DEBT: 127 quoted speaking inbox-directory names and 21 repository slugs, 152 of them in `agents/roadmaps/archive/`. Paying it down is in-place redaction under ADR-250, which this change deliberately did not attempt. EXPIRY: 56 days from `landed`, i.e. 2026-10-25. HONEST LIMIT, added on the completion review that measured it: the narrowed `source-header` class now contributes ZERO of the 148 in-tree findings — 148 is 127 tmp-quote + 21 repo-slug — so IN THIS TREE it is operationally indistinguishable from option (c), deleting it, which both council seats refused. What separates them is the fixture corpus and nothing else, and the same review found the first corpus unrepresentative: it missed the most natural citation shape there is, a FILE inside an external repository (`somevendor/some-suite/skills/foo.md`), because the matcher judged a slug by the characters either side of it rather than by the whole token. The corpus now covers that shape in both directions, and the grammar tokenises. Nothing will notice if the class silently stops firing on real content — only the fixtures will, which is why they are the deliverable rather than a nicety."
     },
-    "lint_carrier_integrity": {
+    "lint_deferral_integrity": {
       "count": 243,
       "landed": "2026-09-02",
-      "note": "243 pre-contract usages of `[~]` in archived roadmaps that carry no `deferred-resolution:` annotation. The annotation contract was settled by council on 2026-08-27; every file in this population predates it, the oldest by months (agents/roadmaps/archive/step-99-north-star-restructure.md:92 is 2026-05 and uses the glyph to mean 'partially green, not a regression'). They are NOT repaired: rewriting an archived roadmap's step semantics retroactively invents an intent nobody recorded, and the honest alternative glyph `[-]` is owner-reserved (archive_completed_roadmaps.ts:396). Shrink-only from here, one owner decision at a time. This ratchet covers ONLY the unannotated class; the broken-destination class -- a receiver deleted, renamed, re-parented, skipped, or archived with open steps -- is a hard failure at zero with no baseline, because deleting agents/roadmaps/road-to-council-topology-evidence-followups.md produces 38 of those and must red immediately rather than nudge a count. REMEDY WHEN THE 56-DAY NON-STAGNATION CLAUSE FIRES (from `landed`, i.e. 2026-10-28), named here because neither remedy the checker prints fits this population: \"fix the findings\" is ruled out by the sentence above -- rewriting an archived roadmap's step semantics retroactively invents an intent nobody recorded -- and \"lower the count\" is ruled out with it, since this population only shrinks when an owner decides one entry at a time. The remedy that fits is a `reaffirmed: {date, reason}` block on THIS entry (`_lib/gate_baseline.ts`), whose reason lands in the diff of the change that makes it: that is the path for debt which is genuinely unrepairable rather than merely unattended. A reaffirmation is not automatic. It asserts that the 243 were re-read and are still unrepairable, and if any of them has become repairable in the meantime the count goes down instead. Do not reaffirm at age 0 -- the clause exists so the question is asked once every 56 days, and answering it early answers nothing."
+      "note": "243 pre-contract usages of `[~]` in archived roadmaps that carry no `deferred-resolution:` annotation. The annotation contract was settled by council on 2026-08-27; every file in this population predates it, the oldest by months (agents/roadmaps/archive/step-99-north-star-restructure.md:92 is 2026-05 and uses the glyph to mean 'partially green, not a regression'). They are NOT repaired: rewriting an archived roadmap's step semantics retroactively invents an intent nobody recorded, and the honest alternative glyph `[-]` is owner-reserved (archive_completed_roadmaps.ts:396). Shrink-only from here, one owner decision at a time. This ratchet covers ONLY the unannotated class; the broken-destination class -- a receiver deleted, renamed, re-parented, skipped, or archived with open steps -- is a hard failure at zero with no baseline, because deleting agents/roadmaps/road-to-council-topology-evidence-followups.md produces 38 of those and must red immediately rather than nudge a count. REMEDY WHEN THE 56-DAY NON-STAGNATION CLAUSE FIRES (from `landed`, i.e. 2026-10-28), named here because neither remedy the checker prints fits this population: \"fix the findings\" is ruled out by the sentence above -- rewriting an archived roadmap's step semantics retroactively invents an intent nobody recorded -- and \"lower the count\" is ruled out with it, since this population only shrinks when an owner decides one entry at a time. The remedy that fits is a `reaffirmed: {date, reason}` block on THIS entry (`_lib/gate_baseline.ts`), whose reason lands in the diff of the change that makes it: that is the path for debt which is genuinely unrepairable rather than merely unattended. A reaffirmation is not automatic. It asserts that the 243 were re-read and are still unrepairable, and if any of them has become repairable in the meantime the count goes down instead. Do not reaffirm at age 0 -- the clause exists so the question is asked once every 56 days, and answering it early answers nothing. RENAMED from `lint_carrier_integrity` to `lint_deferral_integrity` by ADR-262, which deleted the `status: carrier` frontmatter value; the count was deliberately NOT re-measured, because a rename is not a measurement and lowering a ratchet on one would be laundering."
     },
     "lint_roadmap_later_disposition:review-by": {
       "count": 68,

package/src/config/gitignore-block.txt

@@ -130,6 +130,25 @@
 # decision records in agents/decisions/.
 /agents/runtime/
 
+# Agent config — code-graph index, its derived SQLite twin, and the
+# single-flight refresh lock. REDUNDANT with the /agents/runtime/ catch-all
+# above, and named anyway rather than left implicit — do not delete as
+# duplication:
+#
+#   · Some hosts key a prompt cache on a hash of the workspace file list. The
+#     index is rewritten by post-commit and post-checkout (road-to-a-graph-that
+#     -is-shipped 1.3), so it is the most frequently-changing file a consumer
+#     never edits. An entry a reader can find by grepping the index's own name
+#     is what makes that cost traceable.
+#   · The twin and the lock are created beside the index by machinery a
+#     consumer never invokes directly; naming them says they are ours.
+#
+# All three are derived and disposable (ADR-129): rollback is `rm`, and the
+# next build or refresh re-creates them.
+/agents/runtime/state/code-graph-v1.json
+/agents/runtime/state/code-graph-v1.sqlite3
+/agents/runtime/state/code-graph-refresh.lock/
+
 # Agent config — Tier 1 hook + wizard runtime state (machine-generated,
 # regenerated on demand, never committed). Holds the dispatcher lock,
 # per-rule hook state (context-hygiene, verify-before-complete,

package/src/config/hook-token-budget.json

@@ -30,13 +30,14 @@
   "session-eol_reason": "one recycle-advisory line, once per session past the committed threshold (road-to-token-economy-recycling 3.2); recording itself emits nothing",
   "skill-route": 512,
   "skill-route_reason": "road-to-inbox-harvest-2026-08-d-runtime-skill-routing 2.1: one line carrying at most three skill ids and their scores - pointers, never bodies. Registered BELOW the 1024 default deliberately: this row is the ceiling that keeps it a pointer line, so a later change that starts injecting descriptions fails the build instead of quietly doubling a per-turn slot that already carries nine other concerns under a 4096-byte sum cap",
-  "rule-inject": 20480,
-  "rule-inject_reason": "road-to-trigger-delivered-rule-bodies 1.1: this concern delivers rule BODIES, not a pointer line, so its ceiling is the per-prompt token cap converted to bytes rather than a measured emission - 5,000 exact-BPE tokens (the p90 of the matched-body-token distribution over tests/eval/routing-matrix, rounded up to 500, reproduced by `model_rule_injection --corpus tests/eval/routing-matrix`) at ~4 bytes/token. Registered ABOVE the 4,096-byte user_prompt_submit and 2,048-byte pre_tool_use slot sums ON PURPOSE, and the mismatch is the finding rather than an oversight: the concern is default-OFF and emits ZERO bytes under every shipped setting, so no slot sum is breached today. The run that flips `lean_projection.mode: delivery` is the run that must move those two slot rows - that is the activation charge step 1.7 defers, and it is recorded here so the flip cannot be taken without meeting it."
+  "rule-inject": 16384,
+  "rule-inject_reason": "LOWERED 20480 -> 16384 on 2026-09-08, R2 finding 3. THE OLD PAIR WAS TWO STATISTICS IN TWO UNITS, not one decision: this row and `hooks/rule_inject_hook.ts::CAP_BYTES` carried the p90 of the matched-body TOKEN distribution rounded to 500 tok and converted at ~4 B/tok (5,000 tok -> 20,480 B), while `per_slot_sum_caps_bytes.user_prompt_submit` carries the p90 gate-open FIRE SIZE in bytes rounded up to 512 (16,384 B) \u2014 the activation charge owner ruling E2 specifies for the flipping run. One concern licensed 25% above the whole slot's registered sum, on a slot carrying 12 other concerns, made the overrun DESIGNED IN: measured max fire was 20,406 B and 38 of 330 corpus fires exceeded 16,384 B. Reconciled DOWNWARD, never by raising the slot: the charge is the owner-specified number and the concern now conforms to it instead of exceeding it. MEASURED COST of the lowering, over the frozen `tests/eval/routing-matrix` corpus with the command path included (330 fires): p90 16,865 -> 14,507 B, max 20,406 -> 16,348 B, fires truncated 33 -> 45, rule bodies dropped to fit the cap 63 -> 88. So 25 further bodies are withheld on the top-decile fires, where five or more rules matched at once \u2014 a delivery reduction, stated rather than implied, and the endpoints do not measure it (`b-recall` scores `matchTierRules`, not `selectForInjection`). WHAT ENFORCES WHAT, because the finding correctly asked: `CAP_BYTES` is enforced at emission by `selectForInjection`, which drops whole bodies to stay under it, so a fire is TRUNCATED and never over-emitted. The per-slot sums here are an AUTHORING-time control read by `bench_hook_injection`; the only runtime enforcement is `per_turn_aggregate_bytes.ceiling_bytes` in `hooks/injection_budget.ts`, which drops lowest-severity advisories and does not read a per-slot row. And the bench cannot see a real fire from this concern at all: it runs each concern under AGENT_CONFIG_REPLAY=1, which re-imposes the settings gate, and this repository carries no `.agent-settings.yml`, so the concern measures 0 B there. The CROSS-CONCERN residue is therefore still unbounded by any acting gate \u2014 it is now bounded in the authoring record rather than guaranteed to breach, which is a smaller claim than closure and is the honest one."
  },
  "per_slot_sum_caps_bytes": {
   "_comment": "Cross-concern per-fire sum per slot (roadmap 3.1). session_start is one-time and may carry the restore payloads; per-turn slots stay tight.",
   "session_start": 16384,
-  "user_prompt_submit": 4096,
+  "user_prompt_submit": 16384,
+  "user_prompt_submit_reason": "RAISED 4096 -> 16384 on 2026-09-07 by road-to-delivery-for-every-host 3.2, under owner ruling E2, which assigns this move to the run that flips `lean_projection.mode: delivery` and is the activation charge the `rule-inject` row below defers to it. THE NUMBER IS MEASURED, NOT CHOSEN: 16,384 is the p90 gate-open fire size of the delivery concern over the frozen `tests/eval/routing-matrix` corpus rounded UP to 512 bytes, exactly as E2 specifies. Distribution over 318 gate-open fires: p50 6,674 B, p90 16,188 B, max 20,406 B. Reproduce it from `_lib/rule_injection.ts::matchTierRules` + `selectForInjection` at `hooks/rule_inject_hook.ts::CAP_BYTES` over that corpus. NOT config weakening, and the guard agrees by its own classification: `hooks/block_config_weakening.ts:96-98` classifies `*-budget.json` as `advisory`, so its decide() path returns `warn` and never a block — treat that warning as expected and documented. `pre_tool_use` is deliberately NOT raised alongside it: the concern's binding on that slot was REMOVED in the same change, so nothing new emits there and its 2,048 stands.",
   "pre_tool_use": 2048,
   "post_tool_use": 2048,
   "stop": 2048,
@@ -64,10 +65,10 @@
    "agent_error"
   ],
   "excluded_slots_rationale": "session_start is excluded BY THE STEP: it is the one-shot restore slot that legitimately carries hot-context, handoff-context and the canary contract, and capping it against a per-turn number would evict exactly the payloads it exists to deliver. The other three are not per-turn events at all.",
-  "ceiling_bytes": 47104,
-  "ceiling_derivation": "NOT a fresh number, and deliberately so: it is the arithmetic consequence of the per_slot_sum_caps_bytes rows already registered above — 4096 + (2048 + 2048) x 10 + 2048. A tighter per-turn ceiling would contradict per-slot rows that are already the committed decision, and a looser one would let the composition exceed what every part was capped at. Tightening it is a decision about those rows, taken there, in a PR.",
+  "ceiling_bytes": 59392,
+  "ceiling_derivation": "NOT a fresh number, and deliberately so: it is the arithmetic consequence of the per_slot_sum_caps_bytes rows already registered above — 16384 + (2048 + 2048) x 10 + 2048. A tighter per-turn ceiling would contradict per-slot rows that are already the committed decision, and a looser one would let the composition exceed what every part was capped at. Tightening it is a decision about those rows, taken there, in a PR.",
   "gate_on_ceiling": false,
-  "gate_on_ceiling_rationale": "The bench REPORTS the aggregate but does not red the build on it yet — the first-reading discipline the latency twin's observe_only flag encodes. Measured 2026-08-19 under the committed fixtures: ~1,142 B against a 47,104 B ceiling, i.e. the row is registered roughly forty times above any reading that exists. The reading MOVES between runs — 922, 1,140 and 1,142 B observed within one hour — and the mechanism is worth naming precisely rather than as 'flaky': the stop-slot end-review-nudge sizes its line from the branch's own mutation volume, and replay skips its writes but not its reads, so the number grows as the working branch grows. That is a pre-existing bench non-determinism this row surfaces rather than introduces, and it is the strongest single reason not to arm the ceiling against it. Arming a ceiling nobody has ever approached would gate on an untested inequality. Runtime enforcement is NOT gated by this flag and is always on: this flag governs CI, the ceiling governs the live session.",
+  "gate_on_ceiling_rationale": "The bench REPORTS the aggregate but does not red the build on it yet — the first-reading discipline the latency twin's observe_only flag encodes. Measured 2026-08-19 under the committed fixtures: ~1,142 B against the 47,104 B ceiling that applied then, i.e. the row is registered roughly forty times above any reading that exists. The ceiling has since become 59,392 B, following the `user_prompt_submit` slot raise above; the measurement is left at its original date rather than restated, and the headroom the sentence describes only widened. The reading MOVES between runs — 922, 1,140 and 1,142 B observed within one hour — and the mechanism is worth naming precisely rather than as 'flaky': the stop-slot end-review-nudge sizes its line from the branch's own mutation volume, and replay skips its writes but not its reads, so the number grows as the working branch grows. That is a pre-existing bench non-determinism this row surfaces rather than introduces, and it is the strongest single reason not to arm the ceiling against it. Arming a ceiling nobody has ever approached would gate on an untested inequality. Runtime enforcement is NOT gated by this flag and is always on: this flag governs CI, the ceiling governs the live session.",
   "honest_null_consequence": "If the census shows real turns sitting near the ceiling, the per-slot rows move first and this row follows from them. If real turns never approach it, the row is a bound that costs nothing and the finding is published at review date either way."
  },
  "injection_load_metric": {

package/src/config/host-injection-effect.json

@@ -0,0 +1,73 @@
+{
+  "_comment": "Per-host observations of whether a rule body delivered by the `rule-inject` concern on `user_prompt_submit` reaches the model's context. road-to-delivery-on-hook-hosts 1.1-1.3, owner ruling E3. Loader, states and the citation requirement: src/scripts/_lib/injection_effect.ts. An `observed-*` row needs host_version, transcript and date; `unobserved` needs only a reason. NOTHING here may be derived from a host binding the slot: Cowork binds eight slots and discards dispatcher output, which is why the binding and the effect are separate axes.",
+  "claude": {
+    "state": "unobserved",
+    "host_version": null,
+    "transcript": null,
+    "date": null,
+    "reason": "The delivery mechanism is measured for EQUIVALENCE (579/579 then 616/616 byte-equal deliveries, docs/CLAIMS.md) and for cost, and neither is what E3 asks for. E3 wants one transcript in which the model VISIBLY ACTS on a delivered body, and no such transcript exists: `lean_projection.mode` resolved to `eager-all` for the whole recorded history, so the concern emitted zero bytes in every session on record. Recording `observed-true` from the byte-equality measurement would be exactly the documentation-is-not-admission move K1 forbids, one layer in."
+  },
+  "_cursor_md_tree_loaded": {
+    "state": "unobserved",
+    "host_version": null,
+    "transcript": null,
+    "date": null,
+    "reason": "road-to-delivery-on-hook-hosts 1.3. Does Cursor load `.cursor/rules/*.md` ALONGSIDE the `.mdc` files, i.e. does it carry every auto rule twice? Both trees are written today (condense.ts writes the symlink tree in the TOOL_DIRS loop and `_emit_cursor_mdc` writes the .mdc companions), so a double carry is possible by construction and unobserved in fact. It cannot be observed from a Claude Code session, and K4 forbids removing the .md bodies before it is. Carried under an underscore key because it is a property of a TREE rather than a host verdict, and putting it in the host namespace would make `cursor` answer two different questions."
+  },
+  "cursor": {
+    "state": "unobserved",
+    "host_version": null,
+    "transcript": null,
+    "date": null,
+    "reason": "Binds `beforeSubmitPrompt` onto `user_prompt_submit` (hook_manifest.yaml:1300, alias :1407) and carries a `.md` rule tree, which makes it the strongest candidate — and the binding is not the question. Whether Cursor adds hook stdout to the model's context is unmeasured, and cannot be measured from a Claude Code session. `rule-inject` is absent from its concern list, so nothing would be emitted there today in any case."
+  },
+  "cline": {
+    "state": "unobserved",
+    "host_version": null,
+    "transcript": null,
+    "date": null,
+    "reason": "Binds `user_prompt_submit` (hook_manifest.yaml:1315) with a `.md` rule tree, same shape as Cursor and the same unmeasured question. `rule-inject` is absent from its concern list."
+  },
+  "cowork": {
+    "state": "observed-false",
+    "host_version": "unrecorded at the time of the original observation",
+    "transcript": "docs/enforcement-by-host.md:21",
+    "date": "2026-09-07",
+    "reason": "The one host E3 excludes by an existing measurement rather than by absence of one: its trampoline discards dispatcher output and exits 0, so a delivered body cannot reach the model however many slots are bound. Eight slots bound and zero effect is precisely why `emits` and `injection_effect` are separate axes in this record. CITATION LIMIT, stated rather than smoothed over: the host version was not captured when that observation was made, so this row does not meet the four-part protocol in full and its `host_version` says so instead of inventing one."
+  },
+  "windsurf": {
+    "state": "unobserved",
+    "host_version": null,
+    "transcript": null,
+    "date": null,
+    "reason": "Three slots bound and no tool-lifecycle surface at all (docs/enforcement-by-host.md). Not observed, and not reachable from a Claude Code session."
+  },
+  "gemini": {
+    "state": "unobserved",
+    "host_version": null,
+    "transcript": null,
+    "date": null,
+    "reason": "Five slots bound, no `pre_tool_use` binding, and no session available to observe from. Recorded as unobserved rather than assumed either way."
+  },
+  "augment": {
+    "state": "unobserved",
+    "host_version": null,
+    "transcript": null,
+    "date": null,
+    "reason": "Binds five slots and does not honour a deny (docs/enforcement-by-host.md). It also has no `user_prompt_submit` slot, which is a DECLARED gap in the manifest rather than an oversight, so the delivery path this record measures does not exist there today."
+  },
+  "copilot": {
+    "state": "unobserved",
+    "host_version": null,
+    "transcript": null,
+    "date": null,
+    "reason": "`fallback_only` with zero slots bound: this package binds nothing there, so there is no hook stdout to reach anything. Recorded as unobserved rather than `observed-false`, because nobody has looked — a structural argument that it cannot work is still not an observation that it does not."
+  },
+  "codex": {
+    "state": "unobserved",
+    "host_version": null,
+    "transcript": null,
+    "date": null,
+    "reason": "No platform key in hook_manifest.yaml at all, so no slot is bound and no concern can fire. Same distinction as copilot: the absence of a binding is a computable fact and is not the observation E3 asks for."
+  }
+}

package/src/config/packed-binary-manifest.json

@@ -0,0 +1,33 @@
+{
+  "_comment": "Every binary entry the published tarball is allowed to carry, one entry per file. Consulted by check_pack_size's binary-eligibility predicate; an entry is ALLOWED only when every mechanical condition in that predicate holds, so a row here is a claim the gate re-verifies rather than a permission it grants. Path-exact by construction: no wildcards, no directory grants, and a second row for the same path is a hard failure. AUTHORITY: AI council 2026-09-08, 2 seats, unanimous, deep tier — it reopened the `binary` class that f573d628c closed 24 hours earlier. `archive` is NOT reopened and this file may never carry one: that collision supplied zero evidence about archives. ANCHOR: every condition the predicate checks reads THIS file, so a commit that edits a row and its bytes together satisfies all of them. The check that anchors these bytes to something outside this repository is `src/scripts/_lib/vendored_grammar_upstream.ts`, exercised by `tests/scripts/vendored_grammar_upstream.test.ts`; the threat boundary between the two is written out in `packed_binary_predicate.ts`'s docblock.",
+  "schema_version": 1,
+  "entries": [
+    {
+      "path": "src/vendor/grammars/tree-sitter-php.wasm",
+      "sha256": "55bb617b6f01e14bab997861f0b20a2420cf6ba3199ffeb295b9ec398966d8a3",
+      "size": 812594,
+      "kind": "tree-sitter-wasm-grammar",
+      "grammar_id": "php",
+      "abi": 14,
+      "why": "The PHP grammar the code-graph engine loads. ADR-259 ships the parsers so a consumer install can build a graph with no manual step; compiled WebAssembly is the only form a grammar has, and the production loader reads these exact bytes."
+    },
+    {
+      "path": "src/vendor/grammars/tree-sitter-typescript.wasm",
+      "sha256": "8515404dceed38e1ed86aa34b09fcf3379fff1b4ff9dd3967bcd6d1eb5ac3d8f",
+      "size": 2342690,
+      "kind": "tree-sitter-wasm-grammar",
+      "grammar_id": "typescript",
+      "abi": 14,
+      "why": "The TypeScript grammar, which also serves .tsx. Same reason as the php entry."
+    },
+    {
+      "path": "src/vendor/grammars/tree-sitter-javascript.wasm",
+      "sha256": "63812b9e275d26851264734868d27a1656bd44a2ef6eb3e85e6b03728c595ab5",
+      "size": 647334,
+      "kind": "tree-sitter-wasm-grammar",
+      "grammar_id": "javascript",
+      "abi": 14,
+      "why": "The JavaScript grammar. Same reason as the php entry."
+    }
+  ]
+}