@event4u/agent-config 14.22.0 → 14.23.0

package/src/scripts/mcp_server/consumer_tool_catalog.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
-  "description": "Source-of-truth catalog of consumer-relevant MCP tools. Read by the stdio server (scripts/mcp_server/) and packed into the Cloud Worker bundle (internal/workers/mcp/). The 'implemented_on' field lists transports where the real handler is wired. Entries marked '[stub — implemented on demand]' are DOCUMENTATION of the on-demand backlog: per ADR-132 they are NOT registered on the stdio tools/list (the wire carries implemented tools only); the 'not_implemented' envelope contract (docs/contracts/mcp-tool-stub-envelope.md) remains for Worker parity. Generated by `build_mcp_catalog` — never hand-edit this file.",
-  "install_hint_stdio": "npx -y @event4u/agent-config mcp-server",
+  "description": "Source-of-truth catalog of consumer-relevant MCP tools. Read by the stdio server (scripts/mcp_server/) and packed into the Cloud Worker bundle (internal/workers/mcp/). The 'implemented_on' field lists transports where the real handler is wired. Entries marked '[stub — implemented on demand]' are DOCUMENTATION of the on-demand backlog: per ADR-132 they are NOT registered on the stdio tools/list (the wire carries implemented tools only); the 'not_implemented' envelope contract (docs/contracts/mcp-tool-stub-envelope.md) remains for Worker parity. The 'install_hint_stdio' field is the INSTALLED-BINARY form and therefore assumes `agent-config` is on PATH (a global install, or an npx-resolved one the client already has); it deliberately carries no `npx` invocation, because the un-prompted form of that command is the one string this file's own gate forbids and the prompted form hangs a non-interactive client start. Generated by `build_mcp_catalog` — never hand-edit this file.",
+  "install_hint_stdio": "agent-config mcp-server",
   "tools": [
     {
       "name": "capabilities_index",
@@ -222,6 +222,156 @@
         "readOnlyHint": true
       }
     },
+    {
+      "name": "graph_dead",
+      "description": "Symbols with no accepted reference that no declared entry point names. REFUSES (status `refused`) while a source is unreadable: with no exportedness recorded, an exported-but-unimported symbol is indistinguishable from a dead one. Never a deletion recommendation.",
+      "side_effect": "ro",
+      "implemented_on": [
+        "stdio"
+      ],
+      "input_schema": {
+        "type": "object",
+        "properties": {
+          "entry_points": {
+            "type": "string",
+            "description": "Path under this root to a newline-separated id/label list; `#` comments ok."
+          },
+          "accept_missing_exports": {
+            "type": "boolean",
+            "default": false,
+            "description": "Answer anyway, accepting the gap. Never a default."
+          }
+        },
+        "additionalProperties": false
+      },
+      "annotations": {
+        "readOnlyHint": true
+      }
+    },
+    {
+      "name": "graph_impact",
+      "description": "What a diff can break: callers, dependents and test files reaching the changed symbols. Walks only stated-fact edges, never a same-name guess, and reports the guesses refused. Runs `git diff` for the rev.",
+      "side_effect": "shell",
+      "implemented_on": [
+        "stdio"
+      ],
+      "input_schema": {
+        "type": "object",
+        "required": [
+          "diff"
+        ],
+        "properties": {
+          "diff": {
+            "type": "string",
+            "description": "Git rev to diff HEAD against, e.g. `HEAD~1`."
+          },
+          "depth": {
+            "type": "integer",
+            "minimum": 1,
+            "default": 2,
+            "description": "Hop limit."
+          },
+          "untested_only": {
+            "type": "boolean",
+            "default": false,
+            "description": "Instead return changed symbols no test imports."
+          }
+        },
+        "additionalProperties": false
+      },
+      "annotations": {
+        "readOnlyHint": false
+      }
+    },
+    {
+      "name": "graph_path",
+      "description": "The shortest relation chain between two symbols, direction preserved. Answers \"how does A reach B\" without reading the files between. `(no path found)` when unconnected is an answer.",
+      "side_effect": "ro",
+      "implemented_on": [
+        "stdio"
+      ],
+      "input_schema": {
+        "type": "object",
+        "required": [
+          "from",
+          "to"
+        ],
+        "properties": {
+          "from": {
+            "type": "string",
+            "description": "Start node id, label, or free text."
+          },
+          "to": {
+            "type": "string",
+            "description": "Goal node id, label, or free text."
+          },
+          "budget": {
+            "type": "integer",
+            "minimum": 1,
+            "default": 1500,
+            "description": "Token budget for lines."
+          }
+        },
+        "additionalProperties": false
+      },
+      "annotations": {
+        "readOnlyHint": true
+      }
+    },
+    {
+      "name": "graph_query",
+      "description": "A symbol's direct outgoing relations — calls, imports, uses, inherits — each line carrying its confidence and resolution mechanism. For \"what does this touch\" before reading a file.",
+      "side_effect": "ro",
+      "implemented_on": [
+        "stdio"
+      ],
+      "input_schema": {
+        "type": "object",
+        "required": [
+          "symbol"
+        ],
+        "properties": {
+          "symbol": {
+            "type": "string",
+            "description": "Node id, label, or free text."
+          },
+          "budget": {
+            "type": "integer",
+            "minimum": 1,
+            "default": 1500,
+            "description": "Token budget for lines."
+          }
+        },
+        "additionalProperties": false
+      },
+      "annotations": {
+        "readOnlyHint": true
+      }
+    },
+    {
+      "name": "graph_tests_for",
+      "description": "Which test files exercise a symbol, derived from a test file importing it or its module. Empty means no test imports it — a finding, not an error.",
+      "side_effect": "ro",
+      "implemented_on": [
+        "stdio"
+      ],
+      "input_schema": {
+        "type": "object",
+        "required": [
+          "symbol"
+        ],
+        "properties": {
+          "symbol": {
+            "type": "string",
+            "description": "Node id `<relpath>#<sym>`, label, or free text."
+          }
+        },
+        "additionalProperties": false
+      },
+      "annotations": {
+        "readOnlyHint": true
+      }
+    },
     {
       "name": "lint_skills",
       "description": "Lint skill, rule, command, guideline, and persona markdown files for frontmatter and structural errors. Use before committing or opening a PR that adds or edits any of those artifacts, to catch schema violations early. Read-only — never writes files or spawns git. Returns the `scripts/skill_linter.py --format json` payload: a `summary` object (pass / pass_with_warnings / fail / total counts) and a per-file `results` array with severity-tagged findings. Pass `paths` to lint a subset; omit for a full tree scan.",

package/src/scripts/mcp_server/graph_tools.ts

@@ -0,0 +1,294 @@
+/**
+ * The five code-graph MCP tools (`road-to-a-graph-that-is-shipped` 4.1).
+ *
+ * `graph_impact`, `graph_tests_for`, `graph_dead`, `graph_query`, `graph_path`.
+ * They are the agent-facing half of Phase 3: the verbs exist on the CLI and an
+ * agent that has to shell out to reach them will not, so the engine's answers
+ * were unreachable from the surface the consumer actually talks to. Risk-Register
+ * rank 1 is precisely "the install grows and the graph is still unread"; these
+ * are the readers.
+ *
+ * REGISTERED HERE, NOT IN `tools.ts`.
+ *
+ * `tools.ts` sits ~500 lines past the 1500-line ceiling
+ * `check_source_size_budget` enforces as a shrink-only ratchet, so five tool
+ * records with their schemas would cost ~150 units of excess there and nothing
+ * here. `tools.ts` spreads {@link GRAPH_TOOLS} into `ALLOWLIST`, which is two
+ * lines — paid for by moving `_strip` / `_resolvePath` out to `path_util.ts` in
+ * the same change.
+ *
+ * TELEMETRY NEEDS NO PER-TOOL WORK.
+ *
+ * `ToolCache.dispatch` records every `tools/call` centrally, so these five emit
+ * the identical line the other 31 do by being in `ALLOWLIST` at all — which is
+ * what the step's "same telemetry line as the other 31" asks for, and is
+ * stronger than a per-tool emit because it cannot be forgotten.
+ *
+ * READ-ONLY, WITH ONE HONEST EXCEPTION.
+ *
+ * Four are `side_effect: 'ro'`. `graph_impact` is `'shell'`, because it resolves
+ * its `diff` argument by running `git diff --name-only`. That subprocess is
+ * read-only in effect, and the enum has no value that says so — between
+ * understating the mechanism as `'ro'` and naming it, naming it is the only
+ * choice a capability enum exists to support.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { changedFiles } from '../code_graph/cli.js';
+import { detectSources, graphState, NATIVE_CACHE_REL, pickSource } from '../code_graph/detect.js';
+import { resolvePath } from './path_util.js';
+import { isTestFile } from '../code_graph/build.js';
+import { loadGraph, type LoadedGraph, path as graphPathVerb, query as graphQueryVerb } from '../code_graph/query.js';
+import {
+    dead,
+    entryPointsFromFile,
+    impact,
+    repoEntryPoints,
+    testsFor,
+    untested,
+} from '../code_graph/verbs.js';
+import type { BuiltinTool } from './tools.js';
+
+/** The `no graph here` answer, in one place so all five agree on its shape. */
+function noGraph(root: string): Record<string, unknown> {
+    return {
+        status: 'unavailable',
+        staleness: 'absent',
+        error:
+            'no code-graph source found under this root — run `agent-config code-graph build` ' +
+            'to build one, or ship a graph.json',
+        root,
+    };
+}
+
+/**
+ * Resolve the graph, run `fn`, release the handle.
+ *
+ * The handle owns an open SQLite database on the indexed path, so the `finally`
+ * is not hygiene — a long-lived MCP server that leaked one per call would hold
+ * a descriptor for the life of the process.
+ */
+function withGraph<T extends Record<string, unknown>>(
+    root: string,
+    fn: (g: LoadedGraph) => T,
+): Record<string, unknown> {
+    const picked = pickSource(detectSources(root, path.join(root, NATIVE_CACHE_REL)));
+    if (!picked || picked.kind === 'scip') return noGraph(root);
+    const g = loadGraph(picked.path, `${picked.kind}:${path.relative(root, picked.path)}`);
+    try {
+        const out = fn(g);
+        // `status` is DERIVED from the answer, never prefixed onto it. An
+        // independent review found `graph_dead`'s refusal returning
+        // `{status:'ok', refusal:'…', dead:[]}` — the same status a real answer
+        // carries, so a caller branching on `status` (which every fixture here
+        // trains it to do) read the refusal as "nothing is dead". That is the
+        // false negative the CLI's exit 1 exists to prevent, arriving over the
+        // wire instead. A refusal is its own status.
+        const refused = typeof out['refusal'] === 'string' && out['refusal'] !== '';
+        return { status: refused ? 'refused' : 'ok', ...out };
+    } finally {
+        g.close();
+    }
+}
+
+function str(args: Record<string, unknown>, key: string): string {
+    const v = args[key];
+    return typeof v === 'string' ? v.trim() : '';
+}
+
+function num(args: Record<string, unknown>, key: string, dflt: number): number {
+    const v = args[key];
+    return typeof v === 'number' && Number.isFinite(v) && v > 0 ? v : dflt;
+}
+
+export const GRAPH_TOOLS: Record<string, BuiltinTool> = {
+    graph_impact: {
+        name: 'graph_impact',
+        side_effect: 'shell',
+        description:
+            'What a diff can break: callers, dependents and test files reaching the ' +
+            'changed symbols. Walks only stated-fact edges, never a same-name guess, ' +
+            'and reports the guesses refused. Runs `git diff` for the rev.',
+        input_schema: {
+            type: 'object',
+            required: ['diff'],
+            properties: {
+                diff: { type: 'string', description: 'Git rev to diff HEAD against, e.g. `HEAD~1`.' },
+                depth: { type: 'integer', minimum: 1, default: 2, description: 'Hop limit.' },
+                untested_only: {
+                    type: 'boolean',
+                    default: false,
+                    description: 'Instead return changed symbols no test imports.',
+                },
+            },
+            additionalProperties: false,
+        },
+        handler: async (args, root) => {
+            const rev = str(args, 'diff');
+            if (rev === '') return { status: 'error', error: 'diff must be a non-empty git rev' };
+            const files = changedFiles(root, rev);
+            if (files === null) return { status: 'error', error: `cannot resolve rev '${rev}' in ${root}` };
+            const state = graphState(root);
+            return withGraph(root, (g) =>
+                args['untested_only'] === true
+                    ? { ...untested(g, files, state), changed_files: files.length }
+                    : { ...impact(g, files, state, num(args, 'depth', 2), isTestFile), changed_files: files.length },
+            );
+        },
+    },
+
+    graph_tests_for: {
+        name: 'graph_tests_for',
+        side_effect: 'ro',
+        description:
+            'Which test files exercise a symbol, derived from a test file importing ' +
+            'it or its module. Empty means no test imports it — a finding, not an error.',
+        input_schema: {
+            type: 'object',
+            required: ['symbol'],
+            properties: {
+                symbol: { type: 'string', description: 'Node id `<relpath>#<sym>`, label, or free text.' },
+            },
+            additionalProperties: false,
+        },
+        handler: async (args, root) => {
+            const symbol = str(args, 'symbol');
+            if (symbol === '') return { status: 'error', error: 'symbol must be a non-empty string' };
+            const state = graphState(root);
+            return withGraph(root, (g) => ({ ...testsFor(g, symbol, state) }));
+        },
+    },
+
+    graph_dead: {
+        name: 'graph_dead',
+        side_effect: 'ro',
+        description:
+            'Symbols with no accepted reference that no declared entry point names. ' +
+            'REFUSES (status `refused`) while a source is unreadable: with no ' +
+            'exportedness recorded, an exported-but-unimported symbol is ' +
+            'indistinguishable from a dead one. Never a deletion recommendation.',
+        input_schema: {
+            type: 'object',
+            properties: {
+                entry_points: {
+                    type: 'string',
+                    description: 'Path under this root to a newline-separated id/label list; `#` comments ok.',
+                },
+                accept_missing_exports: {
+                    type: 'boolean',
+                    default: false,
+                    description: 'Answer anyway, accepting the gap. Never a default.',
+                },
+            },
+            additionalProperties: false,
+        },
+        handler: async (args, root) => {
+            const state = graphState(root);
+            const listArg = str(args, 'entry_points');
+            let sources = repoEntryPoints(root);
+            if (listArg !== '') {
+                // REALPATH containment, matching the sibling pattern in
+                // `tools.ts` rather than reimplementing a weaker one — an
+                // independent review found this check using `path.resolve` +
+                // `startsWith`, which a symlink inside the root walks straight
+                // through, in the same change that extracted `resolvePath` for
+                // reuse. `fs.readFileSync` would then follow the link, and
+                // because the file's lines used to be echoed back in the
+                // response (see `entry_count` below) that was an
+                // arbitrary-file-read path.
+                const abs = resolvePath(path.resolve(root, listArg));
+                const rootReal = resolvePath(path.resolve(root));
+                if (abs !== rootReal && !abs.startsWith(rootReal + path.sep)) {
+                    return { status: 'error', error: `path escapes consumer_root: ${abs}` };
+                }
+                if (!fs.existsSync(abs)) return { status: 'error', error: `entry-point list not found: ${listArg}` };
+                sources = [
+                    ...sources.map((s) =>
+                        s.name === 'exports'
+                            ? { ...s, status: 'read' as const, detail: `supplied by ${listArg}`, entries: [] }
+                            : s,
+                    ),
+                    entryPointsFromFile(abs),
+                ];
+            }
+            return withGraph(root, (g) => {
+                const r = dead(g, sources, state, {
+                    acceptMissingExports: args['accept_missing_exports'] === true,
+                });
+                // The `entries` arrays are NOT returned. On this repository they
+                // are ~2,595 identifier strings — an unbounded per-call payload
+                // beside the standing-cost row this change itself adds — and
+                // returning a file the caller named is what made the
+                // containment check above a read primitive. A count answers the
+                // question a caller actually has ("was this source read, and did
+                // it have anything in it") without shipping the contents.
+                return {
+                    ...r,
+                    sources: r.sources.map((srcRow) => ({
+                        name: srcRow.name,
+                        status: srcRow.status,
+                        ...(srcRow.detail === undefined ? {} : { detail: srcRow.detail }),
+                        entry_count: srcRow.entries.length,
+                    })),
+                };
+            });
+        },
+    },
+
+    graph_query: {
+        name: 'graph_query',
+        side_effect: 'ro',
+        description:
+            "A symbol's direct outgoing relations — calls, imports, uses, inherits — " +
+            'each line carrying its confidence and resolution mechanism. For "what ' +
+            'does this touch" before reading a file.',
+        input_schema: {
+            type: 'object',
+            required: ['symbol'],
+            properties: {
+                symbol: { type: 'string', description: 'Node id, label, or free text.' },
+                budget: { type: 'integer', minimum: 1, default: 1500, description: 'Token budget for lines.' },
+            },
+            additionalProperties: false,
+        },
+        handler: async (args, root) => {
+            const symbol = str(args, 'symbol');
+            if (symbol === '') return { status: 'error', error: 'symbol must be a non-empty string' };
+            const staleness = graphState(root);
+            return withGraph(root, (g) => ({
+                staleness,
+                ...graphQueryVerb(g, symbol, num(args, 'budget', 1500)),
+            }));
+        },
+    },
+
+    graph_path: {
+        name: 'graph_path',
+        side_effect: 'ro',
+        description:
+            'The shortest relation chain between two symbols, direction preserved. ' +
+            'Answers "how does A reach B" without reading the files between. ' +
+            '`(no path found)` when unconnected is an answer.',
+        input_schema: {
+            type: 'object',
+            required: ['from', 'to'],
+            properties: {
+                from: { type: 'string', description: 'Start node id, label, or free text.' },
+                to: { type: 'string', description: 'Goal node id, label, or free text.' },
+                budget: { type: 'integer', minimum: 1, default: 1500, description: 'Token budget for lines.' },
+            },
+            additionalProperties: false,
+        },
+        handler: async (args, root) => {
+            const from = str(args, 'from');
+            const to = str(args, 'to');
+            if (from === '' || to === '') return { status: 'error', error: 'from and to must be non-empty strings' };
+            const staleness = graphState(root);
+            return withGraph(root, (g) => ({
+                staleness,
+                ...graphPathVerb(g, from, to, num(args, 'budget', 1500)),
+            }));
+        },
+    },
+};

package/src/scripts/mcp_server/path_util.ts

@@ -0,0 +1,31 @@
+/**
+ * Two string/path helpers extracted from `tools.ts`.
+ *
+ * They are generic — a whitespace trim and a tolerant realpath — and `tools.ts`
+ * sits ~525 lines past the 1500-line ceiling `check_source_size_budget`
+ * enforces as a shrink-only ratchet, so every line there costs one unit of
+ * excess and the gate names re-pinning the baseline a defect rather than a fix.
+ * Moving them here pays for the graph-tool registration that arrives with
+ * `road-to-a-graph-that-is-shipped` 4.1, and puts them in a file where their
+ * prose is free.
+ *
+ * They are imported under their original underscore-prefixed names, so the
+ * 28 call sites in `tools.ts` are unchanged — a rename would have made a
+ * two-function move read as a sweep.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+/** Mirror Python `str.strip()` (also strips the same Unicode whitespace set we care about here). */
+export function strip(s: string): string {
+    return s.replace(/^\s+/, '').replace(/\s+$/, '');
+}
+
+/** Mirror Python `Path(...).resolve()` — absolutize + realpath, tolerating a missing tail. */
+export function resolvePath(p: string): string {
+    try {
+        return fs.realpathSync(p);
+    } catch {
+        return path.resolve(p);
+    }
+}

package/src/scripts/mcp_server/tool_catalog_source.ts

@@ -33,7 +33,13 @@ export const CATALOG_DESCRIPTION =
     'backlog: per ADR-132 they are NOT registered on the stdio tools/list ' +
     "(the wire carries implemented tools only); the 'not_implemented' " +
     'envelope contract (docs/contracts/mcp-tool-stub-envelope.md) remains ' +
-    'for Worker parity. Generated by `build_mcp_catalog` — ' +
+    'for Worker parity. ' +
+    "The 'install_hint_stdio' field is the INSTALLED-BINARY form and " +
+    'therefore assumes `agent-config` is on PATH (a global install, or an ' +
+    'npx-resolved one the client already has); it deliberately carries no ' +
+    '`npx` invocation, because the un-prompted form of that command is the ' +
+    "one string this file's own gate forbids and the prompted form hangs a " +
+    'non-interactive client start. Generated by `build_mcp_catalog` — ' +
     'never hand-edit this file.';
 
 export interface StubToolSource {

package/src/scripts/mcp_server/tools.ts

@@ -54,6 +54,8 @@ import {
     load_catalog,
     not_implemented_envelope,
 } from './catalog.js';
+import { GRAPH_TOOLS } from './graph_tools.js';
+import { resolvePath as _resolvePath, strip as _strip } from './path_util.js';
 import { type Outcome, record_call } from './telemetry.js';
 import type { PromptCache } from './prompts.js';
 import type { ResourceCache } from './resources.js';
@@ -111,19 +113,6 @@ export interface BuiltinTool {
     readonly handler: ToolHandler;
 }
 
-/** Mirror Python `str.strip()` (also strips the same Unicode whitespace set we care about here). */
-function _strip(s: string): string {
-    return s.replace(/^\s+/, '').replace(/\s+$/, '');
-}
-
-/** Mirror Python `Path(...).resolve()` — absolutize + realpath, tolerating a missing tail. */
-function _resolvePath(p: string): string {
-    try {
-        return fs.realpathSync(p);
-    } catch {
-        return path.resolve(p);
-    }
-}
 
 /**
  * Pick the consumer-project root.
@@ -1212,6 +1201,7 @@ async function _readResourceBodyHandler(
 // ---------------------------------------------------------------------
 
 export const ALLOWLIST: Record<string, BuiltinTool> = {
+    ...GRAPH_TOOLS,
     suggest_skill_for_task: {
         name: 'suggest_skill_for_task',
         side_effect: 'ro',

package/src/scripts/model_rule_injection.ts

@@ -60,6 +60,7 @@ import {
     loadRuleBody,
     matchTierRules,
     pathCapableRuleIds,
+    pathOnlyRuleIds,
     selectForInjection,
     triggerlessRuleIds,
     type Router,
@@ -101,6 +102,18 @@ export interface CorpusCase {
     rule: string;
     prompt: string;
     openFiles: string[] | null;
+    /**
+     * The slash command the case declares, or `null` (R2 finding 1).
+     *
+     * The loader DROPPED this field, so every `command:` trigger scored as an
+     * unmatched plain prompt. Two entries in the frozen corpus carry one —
+     * `roadmap-progress-sync` and `user-interrupt-priority` — and the shipped
+     * concern DOES reach command triggers: `hooks/rule_inject_hook.ts` extracts
+     * a leading `/command` from the prompt text and passes it to
+     * `matchTierRules`. Dropping the field made the shipped-reach reading
+     * falsely low in exactly the two places it mattered.
+     */
+    command: string | null;
     label: 'positive' | 'near_miss';
     file: string;
 }
@@ -119,10 +132,12 @@ function _asCases(
         const prompt = typeof o['prompt'] === 'string' ? o['prompt'] : null;
         if (prompt === null) continue;
         const of = o['open_files'];
+        const cmd = o['command'];
         out.push({
             rule,
             prompt,
             openFiles: Array.isArray(of) ? of.map((x) => String(x)) : null,
+            command: typeof cmd === 'string' && cmd !== '' ? cmd : null,
             label,
             file,
         });
@@ -618,17 +633,54 @@ export function runEndpoints(corpusDir: string): EndpointResult[] {
     }
 
     // (b) No labelled rule may end with ZERO matched positives.
-    const byRule = new Map<string, { hit: number; total: number }>();
+    //
+    // TWO READINGS SINCE 2026-09-08 (R2 finding 1), and the second one is the
+    // honest half. The pre-registered bar is scored with `open_files` HONOURED,
+    // which is the reach of the MECHANISM. It is not the reach of the SHIPPED
+    // BINDING: `rule-inject` is bound on `user_prompt_submit` + `pre_compact`
+    // only (the `pre_tool_use` binding was removed under owner ruling E2), and
+    // `user_prompt_submit` never populates `openFiles` — the payload carries no
+    // open-file list. So a rule whose only matching positives carry
+    // `open_files` is credited as reachable while no shipped slot can deliver
+    // it on that route.
+    //
+    // The bar is UNCHANGED (it is pre-registered; see
+    // `internal/bench/thin-inject-PREREG.md`). What is added is the column: the
+    // same recall computed with `open_files` ignored, and the names of the rules
+    // that differ between the two. A rule in that difference is either kept
+    // full-bodied by the always-eager residue — in which case it is reachable
+    // by projection rather than by delivery — or it is thinned, in which case it
+    // reaches a Claude Code session on the prompt route only.
+    const reach = (c: CorpusCase, honourOpenFiles: boolean): boolean =>
+        matchTierRules(
+            router,
+            c.prompt,
+            honourOpenFiles ? c.openFiles : null,
+            c.command,
+        ).some((m) => m.id === c.rule);
+
+    const byRule = new Map<string, { hit: number; total: number; shipped: number }>();
     for (const c of positives) {
-        const e = byRule.get(c.rule) ?? { hit: 0, total: 0 };
+        const e = byRule.get(c.rule) ?? { hit: 0, total: 0, shipped: 0 };
         e.total += 1;
-        if (matchTierRules(router, c.prompt, c.openFiles).some((m) => m.id === c.rule)) e.hit += 1;
+        if (reach(c, true)) e.hit += 1;
+        if (reach(c, false)) e.shipped += 1;
         byRule.set(c.rule, e);
     }
     const unreachable = [...byRule.entries()].filter(([, v]) => v.hit === 0).map(([k]) => k);
     const partial = [...byRule.entries()]
         .filter(([, v]) => v.hit > 0 && v.hit < v.total)
         .map(([k, v]) => `${k} ${v.hit}/${v.total}`);
+    const pathOnlyReach = [...byRule.entries()]
+        .filter(([, v]) => v.hit > 0 && v.shipped === 0)
+        .map(([k]) => k)
+        .sort();
+    const alwaysEager = new Set([
+        ...triggerlessRuleIds(router),
+        ...pathOnlyRuleIds(router),
+        ...kernelIds(router),
+    ]);
+    const thinnedAndPathOnly = pathOnlyReach.filter((id) => !alwaysEager.has(id));
 
     // (c) A near-miss must never deliver its labelled rule.
     const exact = scoreExact(router, cases, true);
@@ -659,7 +711,12 @@ export function runEndpoints(corpusDir: string): EndpointResult[] {
             reading:
                 `${byRule.size - unreachable.length}/${byRule.size} rules reachable; ` +
                 `unreachable: ${unreachable.length === 0 ? 'none' : unreachable.join(', ')}; ` +
-                `partial: ${partial.length === 0 ? 'none' : partial.join(', ')}`,
+                `partial: ${partial.length === 0 ? 'none' : partial.join(', ')}` +
+                ` | shipped user_prompt_submit reach (open_files IGNORED): ` +
+                `${byRule.size - pathOnlyReach.length}/${byRule.size}; reachable only via a ` +
+                `path trigger: ${pathOnlyReach.length === 0 ? 'none' : pathOnlyReach.join(', ')}` +
+                ` (of which thinned, i.e. at no scope on that route: ` +
+                `${thinnedAndPathOnly.length === 0 ? 'none' : thinnedAndPathOnly.join(', ')})`,
             bar: 'unreachable == 0 (a rule with zero matched positives is a rule the mode removed)',
             passed: unreachable.length === 0,
         },