@event4u/agent-config 14.21.0 → 14.23.0

package/src/scripts/mcp_server/suggest_skill.ts

@@ -0,0 +1,72 @@
+/**
+ * The `suggest_skill_for_task` MCP handler, extracted from `tools.ts`.
+ *
+ * `tools.ts` sits ~580 lines past the 1,500-line ceiling `check_source_size_budget`
+ * enforces as a shrink-only ratchet, so every line there costs one unit of excess
+ * and the gate names re-pinning the baseline a defect rather than a fix. Adding a
+ * `skills_roots` field to this handler's answer cost four; extracting the handler
+ * pays that back many times over and puts it in a file where its prose is free.
+ *
+ * Cohesive on its own terms too: this is the one handler in the allowlist that
+ * owns a ranking policy rather than reading a file, and it is the only consumer
+ * of the skill-catalogue resolver on the server side.
+ */
+
+/**
+ * `suggest_skill_for_task` — the recovery path for a truncated catalogue.
+ *
+ * Promoted from a discovery stub because the defect it answers is measured, not
+ * hypothetical: on the one host that publishes its own truncation, a default
+ * install had 402 entries dropped from the model-visible skills list — the
+ * host's own count against its own denominator, not a subtraction over ours.
+ * An agent
+ * that cannot see a skill also cannot ask for it by name, so the only reachable
+ * question is "what fits this task" — which is what the deterministic ranker
+ * answers, over the TREE rather than over the host's catalogue.
+ *
+ * Read-only and shell-free by construction: it reads SKILL.md frontmatter and
+ * returns names, scores and declared personas. No skill BODY is returned — the
+ * caller opens what it picked, so a wrong rank costs one read rather than a
+ * context payload.
+ */
+export async function suggestSkillForTask(
+    args: Record<string, unknown>,
+    consumerRoot: string,
+): Promise<Record<string, unknown>> {
+    const task = typeof args['task'] === 'string' ? args['task'] : '';
+    if (task.trim() === '') {
+        return { status: 'error', error: 'task must be a non-empty string', suggestions: [] };
+    }
+    // `limit`, not `top` — the stub published `limit` and a consumer may have
+    // read that contract already. Renaming it on promotion would break a
+    // caller for cosmetic reasons.
+    const limitRaw = args['limit'];
+    const limit =
+        typeof limitRaw === 'number' && Number.isFinite(limitRaw) ? Math.floor(limitRaw) : 5;
+
+    const catalogue = await import('../_lib/skill_catalogue.js');
+    // EVERY readable root — see `resolveSkillCatalogueRoots` on why not the first.
+    const roots = catalogue.resolveSkillCatalogueRoots(consumerRoot);
+    if (roots.length === 0) {
+        // A missing catalogue is UNKNOWN, never "no skill fits this task". The
+        // second reads as a ranked answer and would be a confident empty list —
+        // the same zero-from-silence failure `capture_skill_catalogue` refuses.
+        return {
+            status: 'no_catalogue',
+            searched: [...catalogue.DEFAULT_CATALOGUE_ROOTS],
+            consumer_root: consumerRoot,
+            suggestions: [],
+        };
+    }
+
+    const { rank } = await import('../skill_tools/score_skill_relevance.js');
+    const rows = rank(task, roots).slice(0, Math.max(1, limit));
+    return {
+        status: 'ok',
+        // `skills_root` kept verbatim (a consumer may read it); `skills_roots` is
+        // the additive truth about what was actually ranked.
+        skills_root: roots[0] as string,
+        skills_roots: roots,
+        suggestions: rows.map(([name, score, personas]) => ({ skill: name, score, personas })),
+    };
+}

package/src/scripts/mcp_server/tool_catalog_source.ts

@@ -33,7 +33,13 @@ export const CATALOG_DESCRIPTION =
     'backlog: per ADR-132 they are NOT registered on the stdio tools/list ' +
     "(the wire carries implemented tools only); the 'not_implemented' " +
     'envelope contract (docs/contracts/mcp-tool-stub-envelope.md) remains ' +
-    'for Worker parity. Generated by `build_mcp_catalog` — ' +
+    'for Worker parity. ' +
+    "The 'install_hint_stdio' field is the INSTALLED-BINARY form and " +
+    'therefore assumes `agent-config` is on PATH (a global install, or an ' +
+    'npx-resolved one the client already has); it deliberately carries no ' +
+    '`npx` invocation, because the un-prompted form of that command is the ' +
+    "one string this file's own gate forbids and the prompted form hangs a " +
+    'non-interactive client start. Generated by `build_mcp_catalog` — ' +
     'never hand-edit this file.';
 
 export interface StubToolSource {

package/src/scripts/mcp_server/tools.ts

@@ -47,12 +47,15 @@ import {
     slice_around as _chSliceAround,
     read_header as _chReadHeaderImpl,
 } from '../chat_history.js';
+import { suggestSkillForTask } from './suggest_skill.js';
 import {
     type CatalogEntry,
     install_hint as _catalog_install_hint,
     load_catalog,
     not_implemented_envelope,
 } from './catalog.js';
+import { GRAPH_TOOLS } from './graph_tools.js';
+import { resolvePath as _resolvePath, strip as _strip } from './path_util.js';
 import { type Outcome, record_call } from './telemetry.js';
 import type { PromptCache } from './prompts.js';
 import type { ResourceCache } from './resources.js';
@@ -110,19 +113,6 @@ export interface BuiltinTool {
     readonly handler: ToolHandler;
 }
 
-/** Mirror Python `str.strip()` (also strips the same Unicode whitespace set we care about here). */
-function _strip(s: string): string {
-    return s.replace(/^\s+/, '').replace(/\s+$/, '');
-}
-
-/** Mirror Python `Path(...).resolve()` — absolutize + realpath, tolerating a missing tail. */
-function _resolvePath(p: string): string {
-    try {
-        return fs.realpathSync(p);
-    } catch {
-        return path.resolve(p);
-    }
-}
 
 /**
  * Pick the consumer-project root.
@@ -1210,62 +1200,8 @@ async function _readResourceBodyHandler(
 // unlisted tool. Boot-time stderr log enumerates the registered set.
 // ---------------------------------------------------------------------
 
-/**
- * `suggest_skill_for_task` — the recovery path for a truncated catalogue.
- *
- * Promoted from a discovery stub because the defect it answers is measured, not
- * hypothetical: on the one host that publishes its own truncation, a default
- * install had 402 entries dropped from the model-visible skills list — the
- * host's own count against its own denominator, not a subtraction over ours
- * (`agents/evidence/analysis/scoped-projection-host-delivery.md`). An agent
- * that cannot see a skill also cannot ask for it by name, so the only reachable
- * question is "what fits this task" — which is what the deterministic ranker
- * answers, over the TREE rather than over the host's catalogue.
- *
- * Read-only and shell-free by construction: it reads SKILL.md frontmatter and
- * returns names, scores and declared personas. No skill BODY is returned — the
- * caller opens what it picked, so a wrong rank costs one read rather than a
- * context payload.
- */
-async function _suggestSkillForTaskHandler(
-    args: Record<string, unknown>,
-    consumerRoot: string,
-): Promise<Record<string, unknown>> {
-    const task = typeof args['task'] === 'string' ? args['task'] : '';
-    if (task.trim() === '') {
-        return { status: 'error', error: 'task must be a non-empty string', suggestions: [] };
-    }
-    // `limit`, not `top` — the stub published `limit` and a consumer may have
-    // read that contract already. Renaming it on promotion would break a
-    // caller for cosmetic reasons.
-    const limitRaw = args['limit'];
-    const limit =
-        typeof limitRaw === 'number' && Number.isFinite(limitRaw) ? Math.floor(limitRaw) : 5;
-
-    const catalogue = await import('../_lib/skill_catalogue.js');
-    const skillsDir = catalogue.resolveSkillsRoot(consumerRoot);
-    if (skillsDir === null) {
-        // A missing catalogue is UNKNOWN, never "no skill fits this task". The
-        // second reads as a ranked answer and would be a confident empty list —
-        // the same zero-from-silence failure `capture_skill_catalogue` refuses.
-        return {
-            status: 'no_catalogue',
-            searched: [...catalogue.DEFAULT_CATALOGUE_ROOTS],
-            consumer_root: consumerRoot,
-            suggestions: [],
-        };
-    }
-
-    const { rank } = await import('../skill_tools/score_skill_relevance.js');
-    const rows = rank(task, skillsDir).slice(0, Math.max(1, limit));
-    return {
-        status: 'ok',
-        skills_root: skillsDir,
-        suggestions: rows.map(([name, score, personas]) => ({ skill: name, score, personas })),
-    };
-}
-
 export const ALLOWLIST: Record<string, BuiltinTool> = {
+    ...GRAPH_TOOLS,
     suggest_skill_for_task: {
         name: 'suggest_skill_for_task',
         side_effect: 'ro',
@@ -1296,7 +1232,7 @@ export const ALLOWLIST: Record<string, BuiltinTool> = {
             },
             additionalProperties: false,
         },
-        handler: _suggestSkillForTaskHandler,
+        handler: suggestSkillForTask,
     },
     lint_skills: {
         name: 'lint_skills',

package/src/scripts/media/lib/adapter-contract.md

@@ -355,8 +355,13 @@ the explicit `dry-run` subcommand:
   `scripts/media/lib/fixtures/<adapter-id>/`.
 - Exit code 0.
 
-Fixtures are committed and cover one happy path per adapter.
-Phase 6 golden runs assert byte-identical stdout under
+Fixtures are committed and cover one happy path per adapter;
+committed media assets are **non-decodable ASCII placeholders**
+whose documented paths and presence, rather than encoded-media
+validity, form the fixture contract. The placeholder literal is
+`FIXTURE-<adapter-id>-<ext>`. A test that needs decodable media
+generates it at runtime — it must not read a fixture expecting
+one. Phase 6 golden runs assert byte-identical stdout under
 `AIV_DRYRUN=true`.
 
 ## Logging & redaction

package/src/scripts/model_rule_injection.ts

@@ -60,6 +60,7 @@ import {
     loadRuleBody,
     matchTierRules,
     pathCapableRuleIds,
+    pathOnlyRuleIds,
     selectForInjection,
     triggerlessRuleIds,
     type Router,
@@ -101,6 +102,18 @@ export interface CorpusCase {
     rule: string;
     prompt: string;
     openFiles: string[] | null;
+    /**
+     * The slash command the case declares, or `null` (R2 finding 1).
+     *
+     * The loader DROPPED this field, so every `command:` trigger scored as an
+     * unmatched plain prompt. Two entries in the frozen corpus carry one —
+     * `roadmap-progress-sync` and `user-interrupt-priority` — and the shipped
+     * concern DOES reach command triggers: `hooks/rule_inject_hook.ts` extracts
+     * a leading `/command` from the prompt text and passes it to
+     * `matchTierRules`. Dropping the field made the shipped-reach reading
+     * falsely low in exactly the two places it mattered.
+     */
+    command: string | null;
     label: 'positive' | 'near_miss';
     file: string;
 }
@@ -119,10 +132,12 @@ function _asCases(
         const prompt = typeof o['prompt'] === 'string' ? o['prompt'] : null;
         if (prompt === null) continue;
         const of = o['open_files'];
+        const cmd = o['command'];
         out.push({
             rule,
             prompt,
             openFiles: Array.isArray(of) ? of.map((x) => String(x)) : null,
+            command: typeof cmd === 'string' && cmd !== '' ? cmd : null,
             label,
             file,
         });
@@ -618,17 +633,54 @@ export function runEndpoints(corpusDir: string): EndpointResult[] {
     }
 
     // (b) No labelled rule may end with ZERO matched positives.
-    const byRule = new Map<string, { hit: number; total: number }>();
+    //
+    // TWO READINGS SINCE 2026-09-08 (R2 finding 1), and the second one is the
+    // honest half. The pre-registered bar is scored with `open_files` HONOURED,
+    // which is the reach of the MECHANISM. It is not the reach of the SHIPPED
+    // BINDING: `rule-inject` is bound on `user_prompt_submit` + `pre_compact`
+    // only (the `pre_tool_use` binding was removed under owner ruling E2), and
+    // `user_prompt_submit` never populates `openFiles` — the payload carries no
+    // open-file list. So a rule whose only matching positives carry
+    // `open_files` is credited as reachable while no shipped slot can deliver
+    // it on that route.
+    //
+    // The bar is UNCHANGED (it is pre-registered; see
+    // `internal/bench/thin-inject-PREREG.md`). What is added is the column: the
+    // same recall computed with `open_files` ignored, and the names of the rules
+    // that differ between the two. A rule in that difference is either kept
+    // full-bodied by the always-eager residue — in which case it is reachable
+    // by projection rather than by delivery — or it is thinned, in which case it
+    // reaches a Claude Code session on the prompt route only.
+    const reach = (c: CorpusCase, honourOpenFiles: boolean): boolean =>
+        matchTierRules(
+            router,
+            c.prompt,
+            honourOpenFiles ? c.openFiles : null,
+            c.command,
+        ).some((m) => m.id === c.rule);
+
+    const byRule = new Map<string, { hit: number; total: number; shipped: number }>();
     for (const c of positives) {
-        const e = byRule.get(c.rule) ?? { hit: 0, total: 0 };
+        const e = byRule.get(c.rule) ?? { hit: 0, total: 0, shipped: 0 };
         e.total += 1;
-        if (matchTierRules(router, c.prompt, c.openFiles).some((m) => m.id === c.rule)) e.hit += 1;
+        if (reach(c, true)) e.hit += 1;
+        if (reach(c, false)) e.shipped += 1;
         byRule.set(c.rule, e);
     }
     const unreachable = [...byRule.entries()].filter(([, v]) => v.hit === 0).map(([k]) => k);
     const partial = [...byRule.entries()]
         .filter(([, v]) => v.hit > 0 && v.hit < v.total)
         .map(([k, v]) => `${k} ${v.hit}/${v.total}`);
+    const pathOnlyReach = [...byRule.entries()]
+        .filter(([, v]) => v.hit > 0 && v.shipped === 0)
+        .map(([k]) => k)
+        .sort();
+    const alwaysEager = new Set([
+        ...triggerlessRuleIds(router),
+        ...pathOnlyRuleIds(router),
+        ...kernelIds(router),
+    ]);
+    const thinnedAndPathOnly = pathOnlyReach.filter((id) => !alwaysEager.has(id));
 
     // (c) A near-miss must never deliver its labelled rule.
     const exact = scoreExact(router, cases, true);
@@ -659,7 +711,12 @@ export function runEndpoints(corpusDir: string): EndpointResult[] {
             reading:
                 `${byRule.size - unreachable.length}/${byRule.size} rules reachable; ` +
                 `unreachable: ${unreachable.length === 0 ? 'none' : unreachable.join(', ')}; ` +
-                `partial: ${partial.length === 0 ? 'none' : partial.join(', ')}`,
+                `partial: ${partial.length === 0 ? 'none' : partial.join(', ')}` +
+                ` | shipped user_prompt_submit reach (open_files IGNORED): ` +
+                `${byRule.size - pathOnlyReach.length}/${byRule.size}; reachable only via a ` +
+                `path trigger: ${pathOnlyReach.length === 0 ? 'none' : pathOnlyReach.join(', ')}` +
+                ` (of which thinned, i.e. at no scope on that route: ` +
+                `${thinnedAndPathOnly.length === 0 ? 'none' : thinnedAndPathOnly.join(', ')})`,
             bar: 'unreachable == 0 (a rule with zero matched positives is a rule the mode removed)',
             passed: unreachable.length === 0,
         },

package/src/scripts/project_thin_rules.ts

@@ -19,7 +19,7 @@
  * `.augment/` projections.
  *
  * NOTE (faithful literal): the thin-entry pointer keeps the verbatim
- * `Body: [`{rule_id}`](../../.agent-src.uncondensed/rules/{rule_id}.md)`
+ * `Body: [`{rule_id}`](../../dist/agent-src/rules/{rule_id}.md)`
  * Markdown link from the retired Python implementation. The same-basename `.py` twin
  * carries that literal, so the ADR-051 legacy-path guard exempts this `.ts`
  * file by twin-parity.
@@ -35,6 +35,11 @@ import * as path from 'node:path';
 import process from 'node:process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
+import {
+    pathOnlyRuleIds,
+    triggerlessRuleIds,
+    type Router,
+} from './_lib/rule_injection.js';
 import * as token_count from './_lib/token_count.js';
 
 const _HERE = fileURLToPath(import.meta.url);
@@ -77,19 +82,87 @@ export function kernel_ids(): Set<string> {
  * visible instead of being absorbed into the pointer count
  * (road-to-trigger-delivered-rule-bodies 1.3).
  */
+/**
+ * Rules whose ONLY triggers are path-shaped — reachable from `pre_tool_use`
+ * and from no other slot (road-to-delivery-for-every-host 3.2).
+ *
+ * They must never be thinned while the delivery concern is NOT bound on
+ * `pre_tool_use`, because a stub plus a slot nobody listens on is a rule that
+ * reaches the model at no scope at all. This is the same failure the
+ * `no_trigger_ids` exemption prevents, one step out: there the rule has nothing
+ * to match on, here it has nothing to match ON.
+ *
+ * Stated as a PROPERTY rather than a list of ids. If the concern is ever bound
+ * on `pre_tool_use` again, this exemption is what should be reconsidered — not
+ * three names someone has to remember.
+ *
+ * WHAT THIS EXEMPTION DOES **NOT** COVER — recorded 2026-09-08, R2 finding 1,
+ * because the silence read as coverage. The predicate is `every` trigger
+ * path-shaped. A rule with BOTH path and non-path triggers is therefore THINNED,
+ * and its path-shaped half then has no carrier at all: the stub carries no
+ * frontmatter (`condense.ts` writes it with `_writeText`, bypassing
+ * `_emit_claude_rule`'s host-native `paths:` key), `pre_tool_use` lost the
+ * binding under owner ruling E2, and `user_prompt_submit` never populates
+ * `openFiles`. Measured over the current `dist/router.json`: **18 such rules**,
+ * all non-kernel and all thinned — augment-edit-discipline, design-fidelity,
+ * doc-screenshot-hygiene, domain-adoption-policy,
+ * framework-neutrality-in-generic-skills, image-likeness-and-rights,
+ * laravel-translations, lethal-trifecta-guard, linked-projects-onboarding-gate,
+ * low-impact-corpus-privacy-floor, markdown-safe-codeblocks, onboarding-gate,
+ * persona-governance, php-coding, provider-lifecycle-discipline,
+ * roadmap-ci-steps-policy, roadmap-progress-sync, settings-ask-protocol.
+ *
+ * They do NOT reach the model at no scope: every non-path route
+ * (keyword / phrase / command) still delivers the body through the concern, and
+ * on `claude-code` they never had a separate host-native path route to lose —
+ * `_claude_paths_plan` emits no `paths:` for a mixed-trigger rule on purpose, so
+ * under `eager-all` they loaded UNCONDITIONALLY. What is lost is the difference
+ * between unconditional and prompt-triggered: a session that touches a matching
+ * file and says nothing that matches gets nothing.
+ *
+ * The labelled corpus cannot see this and the endpoint says so rather than
+ * implying otherwise — `model_rule_injection --endpoints` (b) now publishes the
+ * shipped `user_prompt_submit` reach beside the pre-registered reading, and
+ * every one of these 18 has at least one prompt-matching positive, so none
+ * appears in its "reachable only via a path trigger" column.
+ *
+ * WHY THIS IS NOT WIDENED TO `some` HERE. Measured: exempting all 18 moves the
+ * thin rule layer 23,592 -> 39,921 GPT tok (+16,329, +69 %), which is a budget
+ * move of a magnitude no agent may take, and it would erase most of the saving
+ * the flip is licensed on. Restoring a path route needs either that exemption
+ * under a re-anchored baseline or a `pre_tool_use` binding under a raised slot
+ * cap — both owner-reserved, so the closure is tracked rather than taken here.
+ * ADR-267's Consequences section names the receiver.
+ */
+/**
+ * ONE spelling of the router-derived sets, shared with the injector (R2
+ * finding 11).
+ *
+ * `path_only_ids` and `no_trigger_ids` were each a second, hand-rolled
+ * implementation of `_lib/rule_injection.ts::pathOnlyRuleIds` /
+ * `triggerlessRuleIds` — verified identical over the current router at the time
+ * (symmetric difference empty), so drift risk rather than a live defect. It is
+ * exactly the hazard `THIN_ENTRY_MARKER`'s own comment argues against one
+ * screen below ("a gate that re-spelled this string would drift from the writer
+ * silently"), and the two consumers here are the PROJECTOR's exemption set and
+ * the INJECTOR's reachability set: they must not be able to disagree about which
+ * rules the delivery path can reach.
+ *
+ * The finding named `path_only_ids`. The defect-pattern sweep found the SECOND
+ * instance one function down — `no_trigger_ids` against `triggerlessRuleIds` —
+ * and it is delegated in the same change. Count: 2 of 2 duplicated
+ * router-derived sets in this file, 0 remaining.
+ */
+function _router(): Router {
+    return JSON.parse(fs.readFileSync(ROUTER, 'utf-8')) as Router;
+}
+
+export function path_only_ids(): Set<string> {
+    return pathOnlyRuleIds(_router());
+}
+
 export function no_trigger_ids(): Set<string> {
-    const data = JSON.parse(fs.readFileSync(ROUTER, 'utf-8')) as Record<string, unknown>;
-    const out = new Set<string>();
-    for (const tier of ['tier_1', 'tier_2']) {
-        const entries = data[tier];
-        if (!Array.isArray(entries)) continue;
-        for (const e of entries) {
-            const obj = e as Record<string, unknown>;
-            const t = obj.triggers;
-            if (!Array.isArray(t) || t.length === 0) out.add(String(obj.id));
-        }
-    }
-    return out;
+    return new Set(triggerlessRuleIds(_router()));
 }
 
 /**
@@ -196,6 +269,45 @@ function _title(s: string): string {
     return s.replace(/[A-Za-z]+/g, (w) => w.charAt(0).toUpperCase() + w.slice(1).toLowerCase());
 }
 
+/**
+ * The marker that makes a projected entry recognisable as a stub.
+ *
+ * Exported so the WRITER and every DETECTOR share one definition. A gate that
+ * re-spelled this string would drift from the writer silently, and the failure
+ * would be invisible in exactly the direction that matters: a stub the gate
+ * fails to recognise reads as a complete rule body.
+ */
+export const THIN_ENTRY_MARKER = '> Routed rule — load the body on trigger-match.';
+
+/** Is this projected entry a pointer stub rather than a rule body? */
+export function is_thin_entry(text: string): boolean {
+    return text.includes(THIN_ENTRY_MARKER);
+}
+
+/**
+ * Where a stub tells a reader the body actually is.
+ *
+ * FIXED 2026-09-07: this pointed into the uncondensed source tree ADR-051
+ * retired — the literal path is deliberately NOT reproduced here, because
+ * `check_no_uncondensed_refs` matches the string and cannot tell a repair
+ * record from a live reference; `git log -S` on this file finds the old value.
+ * It exists in no checkout, so EVERY stub's fallback pointer
+ * resolved to nothing — invisible under `delivery`, where the hook loads the
+ * body from `dist/agent-src/rules` and never follows this link, and total under
+ * `thin`, where the pointer is the only path to the body there is.
+ *
+ * KNOWN LIMIT, stated rather than discovered later: one relative prefix cannot
+ * be right for every tree, because they sit at different depths — `.claude/rules`
+ * and `.cursor/rules` are two levels below the repo root and `.clinerules` is
+ * one. `../../` is correct for the first two, which are the only trees the
+ * shipped `lean_projection.hosts` default can thin. A stub in `.clinerules`
+ * needs an operator to have added `cline` to that list, and its pointer is off
+ * by one level. That is strictly better than the previous state, where the
+ * pointer was dead in all three, and it is recorded here so the remaining case
+ * is a known limit rather than a surprise.
+ */
+const BODY_LINK_PREFIX = '../../dist/agent-src/rules/';
+
 /** Build the minimal progressive-disclosure pointer for a non-kernel rule. */
 export function thin_entry(rule_id: string, text: string): string {
     const [fm] = split_frontmatter(text);
@@ -205,8 +317,8 @@ export function thin_entry(rule_id: string, text: string): string {
     const fires = hint ? ` Fires on: ${hint}.` : '';
     return (
         `## ${title}\n` +
-        `> Routed rule — load the body on trigger-match.${fires} ${desc} ` +
-        `Body: [\`${rule_id}\`](../../.agent-src.uncondensed/rules/${rule_id}.md)\n`
+        `${THIN_ENTRY_MARKER}${fires} ${desc} ` +
+        `Body: [\`${rule_id}\`](${BODY_LINK_PREFIX}${rule_id}.md)\n`
     );
 }
 
@@ -214,9 +326,21 @@ export function thin_entry(rule_id: string, text: string): string {
 export function build_thin(
     rules_dir: string = RULES_SOURCE,
     scope: readonly string[] | null = null,
+    /**
+     * Optional sink for the D3 diagnostic
+     * (road-to-delivery-for-every-host 2.2).
+     *
+     * An `auto` rule the router gives NO trigger is already kept full-bodied by
+     * `noTrigger` below, which is the substantive protection and predates this
+     * roadmap. What did not exist is any way to SEE it happen: the rule is
+     * silently exempted, so an author who removes a rule's last trigger gets a
+     * silently eager rule and no signal. The line makes the exemption audible.
+     */
+    announce: ((message: string) => void) | null = null,
 ): Map<string, string> {
     const kernel = kernel_ids();
     const noTrigger = no_trigger_ids();
+    const pathOnly = path_only_ids();
     const wsMap = scope !== null ? rule_workspaces_map() : new Map<string, string[]>();
     const out = new Map<string, string>();
     for (const p of _globSortedMd(rules_dir)) {
@@ -225,7 +349,16 @@ export function build_thin(
         if (!id_in_scope(stem, scope, kernel, wsMap, fm_workspaces(text))) {
             continue; // out of workspace scope — no body, no pointer line
         }
-        const full = kernel.has(stem) || noTrigger.has(stem);
+        const full = kernel.has(stem) || noTrigger.has(stem) || pathOnly.has(stem);
+        if (announce !== null && noTrigger.has(stem) && !kernel.has(stem)) {
+            announce(`D3: trigger-less auto rule ${path.basename(p)} — kept full-bodied, never thinned`);
+        }
+        if (announce !== null && pathOnly.has(stem) && !kernel.has(stem) && !noTrigger.has(stem)) {
+            announce(
+                `E2: path-only auto rule ${path.basename(p)} — kept full-bodied; its only triggers ` +
+                    `are path-shaped and the delivery concern is not bound on pre_tool_use`,
+            );
+        }
         out.set(path.basename(p), full ? text : thin_entry(stem, text));
     }
     return out;