@event4u/agent-config 14.22.0 → 14.23.0

package/dist/scripts/project_thin_rules.js

@@ -19,7 +19,7 @@
  * `.augment/` projections.
  *
  * NOTE (faithful literal): the thin-entry pointer keeps the verbatim
- * `Body: [`{rule_id}`](../../.agent-src.uncondensed/rules/{rule_id}.md)`
+ * `Body: [`{rule_id}`](../../dist/agent-src/rules/{rule_id}.md)`
  * Markdown link from the retired Python implementation. The same-basename `.py` twin
  * carries that literal, so the ADR-051 legacy-path guard exempts this `.ts`
  * file by twin-parity.
@@ -34,6 +34,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import process from 'node:process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
+import { pathOnlyRuleIds, triggerlessRuleIds, } from './_lib/rule_injection.js';
 import * as token_count from './_lib/token_count.js';
 const _HERE = fileURLToPath(import.meta.url);
 // REPO_ROOT = Path(__file__).resolve().parent.parent.parent — three dirs up
@@ -72,21 +73,85 @@ export function kernel_ids() {
  * visible instead of being absorbed into the pointer count
  * (road-to-trigger-delivered-rule-bodies 1.3).
  */
+/**
+ * Rules whose ONLY triggers are path-shaped — reachable from `pre_tool_use`
+ * and from no other slot (road-to-delivery-for-every-host 3.2).
+ *
+ * They must never be thinned while the delivery concern is NOT bound on
+ * `pre_tool_use`, because a stub plus a slot nobody listens on is a rule that
+ * reaches the model at no scope at all. This is the same failure the
+ * `no_trigger_ids` exemption prevents, one step out: there the rule has nothing
+ * to match on, here it has nothing to match ON.
+ *
+ * Stated as a PROPERTY rather than a list of ids. If the concern is ever bound
+ * on `pre_tool_use` again, this exemption is what should be reconsidered — not
+ * three names someone has to remember.
+ *
+ * WHAT THIS EXEMPTION DOES **NOT** COVER — recorded 2026-09-08, R2 finding 1,
+ * because the silence read as coverage. The predicate is `every` trigger
+ * path-shaped. A rule with BOTH path and non-path triggers is therefore THINNED,
+ * and its path-shaped half then has no carrier at all: the stub carries no
+ * frontmatter (`condense.ts` writes it with `_writeText`, bypassing
+ * `_emit_claude_rule`'s host-native `paths:` key), `pre_tool_use` lost the
+ * binding under owner ruling E2, and `user_prompt_submit` never populates
+ * `openFiles`. Measured over the current `dist/router.json`: **18 such rules**,
+ * all non-kernel and all thinned — augment-edit-discipline, design-fidelity,
+ * doc-screenshot-hygiene, domain-adoption-policy,
+ * framework-neutrality-in-generic-skills, image-likeness-and-rights,
+ * laravel-translations, lethal-trifecta-guard, linked-projects-onboarding-gate,
+ * low-impact-corpus-privacy-floor, markdown-safe-codeblocks, onboarding-gate,
+ * persona-governance, php-coding, provider-lifecycle-discipline,
+ * roadmap-ci-steps-policy, roadmap-progress-sync, settings-ask-protocol.
+ *
+ * They do NOT reach the model at no scope: every non-path route
+ * (keyword / phrase / command) still delivers the body through the concern, and
+ * on `claude-code` they never had a separate host-native path route to lose —
+ * `_claude_paths_plan` emits no `paths:` for a mixed-trigger rule on purpose, so
+ * under `eager-all` they loaded UNCONDITIONALLY. What is lost is the difference
+ * between unconditional and prompt-triggered: a session that touches a matching
+ * file and says nothing that matches gets nothing.
+ *
+ * The labelled corpus cannot see this and the endpoint says so rather than
+ * implying otherwise — `model_rule_injection --endpoints` (b) now publishes the
+ * shipped `user_prompt_submit` reach beside the pre-registered reading, and
+ * every one of these 18 has at least one prompt-matching positive, so none
+ * appears in its "reachable only via a path trigger" column.
+ *
+ * WHY THIS IS NOT WIDENED TO `some` HERE. Measured: exempting all 18 moves the
+ * thin rule layer 23,592 -> 39,921 GPT tok (+16,329, +69 %), which is a budget
+ * move of a magnitude no agent may take, and it would erase most of the saving
+ * the flip is licensed on. Restoring a path route needs either that exemption
+ * under a re-anchored baseline or a `pre_tool_use` binding under a raised slot
+ * cap — both owner-reserved, so the closure is tracked rather than taken here.
+ * ADR-267's Consequences section names the receiver.
+ */
+/**
+ * ONE spelling of the router-derived sets, shared with the injector (R2
+ * finding 11).
+ *
+ * `path_only_ids` and `no_trigger_ids` were each a second, hand-rolled
+ * implementation of `_lib/rule_injection.ts::pathOnlyRuleIds` /
+ * `triggerlessRuleIds` — verified identical over the current router at the time
+ * (symmetric difference empty), so drift risk rather than a live defect. It is
+ * exactly the hazard `THIN_ENTRY_MARKER`'s own comment argues against one
+ * screen below ("a gate that re-spelled this string would drift from the writer
+ * silently"), and the two consumers here are the PROJECTOR's exemption set and
+ * the INJECTOR's reachability set: they must not be able to disagree about which
+ * rules the delivery path can reach.
+ *
+ * The finding named `path_only_ids`. The defect-pattern sweep found the SECOND
+ * instance one function down — `no_trigger_ids` against `triggerlessRuleIds` —
+ * and it is delegated in the same change. Count: 2 of 2 duplicated
+ * router-derived sets in this file, 0 remaining.
+ */
+function _router() {
+    return JSON.parse(fs.readFileSync(ROUTER, 'utf-8'));
+}
+export function path_only_ids() {
+    return pathOnlyRuleIds(_router());
+}
 export function no_trigger_ids() {
-    const data = JSON.parse(fs.readFileSync(ROUTER, 'utf-8'));
-    const out = new Set();
-    for (const tier of ['tier_1', 'tier_2']) {
-        const entries = data[tier];
-        if (!Array.isArray(entries))
-            continue;
-        for (const e of entries) {
-            const obj = e;
-            const t = obj.triggers;
-            if (!Array.isArray(t) || t.length === 0)
-                out.add(String(obj.id));
-        }
-    }
-    return out;
+    return new Set(triggerlessRuleIds(_router()));
 }
 /**
  * id → workspaces for every non-kernel router entry (router.json schema v2,
@@ -179,6 +244,42 @@ function _trigger_hint(fm) {
 function _title(s) {
     return s.replace(/[A-Za-z]+/g, (w) => w.charAt(0).toUpperCase() + w.slice(1).toLowerCase());
 }
+/**
+ * The marker that makes a projected entry recognisable as a stub.
+ *
+ * Exported so the WRITER and every DETECTOR share one definition. A gate that
+ * re-spelled this string would drift from the writer silently, and the failure
+ * would be invisible in exactly the direction that matters: a stub the gate
+ * fails to recognise reads as a complete rule body.
+ */
+export const THIN_ENTRY_MARKER = '> Routed rule — load the body on trigger-match.';
+/** Is this projected entry a pointer stub rather than a rule body? */
+export function is_thin_entry(text) {
+    return text.includes(THIN_ENTRY_MARKER);
+}
+/**
+ * Where a stub tells a reader the body actually is.
+ *
+ * FIXED 2026-09-07: this pointed into the uncondensed source tree ADR-051
+ * retired — the literal path is deliberately NOT reproduced here, because
+ * `check_no_uncondensed_refs` matches the string and cannot tell a repair
+ * record from a live reference; `git log -S` on this file finds the old value.
+ * It exists in no checkout, so EVERY stub's fallback pointer
+ * resolved to nothing — invisible under `delivery`, where the hook loads the
+ * body from `dist/agent-src/rules` and never follows this link, and total under
+ * `thin`, where the pointer is the only path to the body there is.
+ *
+ * KNOWN LIMIT, stated rather than discovered later: one relative prefix cannot
+ * be right for every tree, because they sit at different depths — `.claude/rules`
+ * and `.cursor/rules` are two levels below the repo root and `.clinerules` is
+ * one. `../../` is correct for the first two, which are the only trees the
+ * shipped `lean_projection.hosts` default can thin. A stub in `.clinerules`
+ * needs an operator to have added `cline` to that list, and its pointer is off
+ * by one level. That is strictly better than the previous state, where the
+ * pointer was dead in all three, and it is recorded here so the remaining case
+ * is a known limit rather than a surprise.
+ */
+const BODY_LINK_PREFIX = '../../dist/agent-src/rules/';
 /** Build the minimal progressive-disclosure pointer for a non-kernel rule. */
 export function thin_entry(rule_id, text) {
     const [fm] = split_frontmatter(text);
@@ -187,13 +288,25 @@ export function thin_entry(rule_id, text) {
     const title = _title(rule_id.replace(/-/g, ' '));
     const fires = hint ? ` Fires on: ${hint}.` : '';
     return (`## ${title}\n` +
-        `> Routed rule — load the body on trigger-match.${fires} ${desc} ` +
-        `Body: [\`${rule_id}\`](../../.agent-src.uncondensed/rules/${rule_id}.md)\n`);
+        `${THIN_ENTRY_MARKER}${fires} ${desc} ` +
+        `Body: [\`${rule_id}\`](${BODY_LINK_PREFIX}${rule_id}.md)\n`);
 }
 /** Map {filename: thin_or_full_text} for every rule. Kernel stays full. */
-export function build_thin(rules_dir = RULES_SOURCE, scope = null) {
+export function build_thin(rules_dir = RULES_SOURCE, scope = null, 
+/**
+ * Optional sink for the D3 diagnostic
+ * (road-to-delivery-for-every-host 2.2).
+ *
+ * An `auto` rule the router gives NO trigger is already kept full-bodied by
+ * `noTrigger` below, which is the substantive protection and predates this
+ * roadmap. What did not exist is any way to SEE it happen: the rule is
+ * silently exempted, so an author who removes a rule's last trigger gets a
+ * silently eager rule and no signal. The line makes the exemption audible.
+ */
+announce = null) {
     const kernel = kernel_ids();
     const noTrigger = no_trigger_ids();
+    const pathOnly = path_only_ids();
     const wsMap = scope !== null ? rule_workspaces_map() : new Map();
     const out = new Map();
     for (const p of _globSortedMd(rules_dir)) {
@@ -202,7 +315,14 @@ export function build_thin(rules_dir = RULES_SOURCE, scope = null) {
         if (!id_in_scope(stem, scope, kernel, wsMap, fm_workspaces(text))) {
             continue; // out of workspace scope — no body, no pointer line
         }
-        const full = kernel.has(stem) || noTrigger.has(stem);
+        const full = kernel.has(stem) || noTrigger.has(stem) || pathOnly.has(stem);
+        if (announce !== null && noTrigger.has(stem) && !kernel.has(stem)) {
+            announce(`D3: trigger-less auto rule ${path.basename(p)} — kept full-bodied, never thinned`);
+        }
+        if (announce !== null && pathOnly.has(stem) && !kernel.has(stem) && !noTrigger.has(stem)) {
+            announce(`E2: path-only auto rule ${path.basename(p)} — kept full-bodied; its only triggers ` +
+                `are path-shaped and the delivery concern is not bound on pre_tool_use`);
+        }
         out.set(path.basename(p), full ? text : thin_entry(stem, text));
     }
     return out;

package/dist/server/schemas/settings.js

@@ -29,7 +29,8 @@ const confidenceBand = z.enum(['off', 'low', 'medium', 'high']);
 const onBlock = z.enum(['stop', 'ask', 'warn']);
 const onBlockFallback = z.enum(['stop', 'warn']);
 const modelAutoSwitch = z.enum(['auto', 'suggest', 'off']);
-const leanProjectionMode = z.enum(['eager-all', 'thin']);
+const leanProjectionMode = z.enum(['eager-all', 'thin', 'delivery']);
+const leanProjectionHost = z.enum(['claude-code', 'cursor', 'cline']);
 const projectionMode = z.enum(['legacy-all', 'scoped']);
 const memoryCadence = z.enum(['auto', 'always', 'never']);
 const projectAudience = z.enum(['self', 'internal', 'client', 'public']);
@@ -46,8 +47,16 @@ export const settingsSchema = z.object({
     rule_loading_tier: ruleLoadingTier.default('balanced').describe('Master switch for which rule tiers load and how cautiously the agent spends tokens. minimal = only the 9 kernel rules (cheapest, fewest guardrails). balanced = kernel + tier-1 (recommended default). full = kernel + tier-1 + tier-2 (most guardrails, highest token cost). custom = roll your own in agents/overrides/. LEGACY: superseded by discipline_profile — when that key is set it wins (mapping: minimal→off, balanced→essential, full→full).'),
     discipline_profile: disciplineProfile.optional().describe('The ONE runtime knob for the discipline-rule tier (successor of rule_loading_tier; council 2026-07-07). off = kernel only (~1x tokens). essential = kernel + the measured lift-carrying rules (~3.3x, keeps the weak-host discipline lift). full = everything (~11.7x, EXPERIMENTAL — residual lift over essential not established). auto = resolve per session against the evidence-gated NULL-lift disable-list in src/config/host-capabilities.yml (measured-null host → off, otherwise → essential). Optional and opt-in until the P1/P2 evidence gates pass (agents/roadmaps/road-to-discipline-profile-tiering.md); absent = legacy rule_loading_tier applies.'),
     lean_projection: z.object({
-        mode: leanProjectionMode.default('eager-all').describe('How the per-tool projector emits the rule layer. eager-all = every rule body inlined into every projection (default, safe). thin = kernel rules full-bodied + non-kernel rules as router-resolved pointers (~45k GPT-tok lighter per session). EXPERIMENTAL: validate with the live A/B before flipping; one-flip revert to eager-all.'),
-    }).default({ mode: 'eager-all' }),
+        mode: leanProjectionMode.default('eager-all').describe('How the per-tool projector emits the rule layer. eager-all = every rule body inlined into every projection (safe; what an ABSENT key still resolves to, per ADR-267 decision point 4). thin = kernel rules full-bodied + non-kernel rules as router-resolved pointers (~45k GPT-tok lighter per session), with no delivery mechanism. delivery = thin stubs PLUS the rule-inject hook concern, which delivers a body back on a trigger match; this is the value the SHIPPED TEMPLATE carries for Claude Code since ADR-267, and the activation charge for it is paid in src/config/hook-token-budget.json (user_prompt_submit slot sum 4,096 -> 16,384).'),
+        hosts: z.array(leanProjectionHost).default(['claude-code']).describe('Which hosts a thinning mode may thin (ADR-267). Absent resolves to [claude-code]. '
+            + 'Only the three hosts with a per-rule rule tree are accepted, and this enum is the '
+            + 'AUTHORING layer: an id outside it is a hard validation FAILURE here and under '
+            + 'validate_agent_settings, never a warning. resolveLeanProjectionHosts is the '
+            + 'READ-TIME backstop for a hand-edited .agent-settings.yml that passed neither, and '
+            + 'THERE the id is dropped with a warning (R2 finding 6 — the two layers answer '
+            + 'differently and neither said so). Every host outside this list receives exactly '
+            + 'what eager-all writes, asserted byte-for-byte by check_host_tree_parity.'),
+    }).default({ mode: 'eager-all', hosts: ['claude-code'] }),
     cost: z.object({
         budgets: z.object({
             daily: z.number().min(0).default(0).describe('Daily USD ceiling across all model calls. The agent warns at 50% / 75% / 90% and either stops or warns at 100% depending on cost.enforcement. Set 0 to disable the daily budget entirely.'),
@@ -229,6 +238,10 @@ export const settingsSchema = z.object({
             api_paths: z.array(z.string()).default([]).describe('Optional glob list that makes API-endpoint detection explicit instead of heuristic (e.g. ["app/Http/Controllers/Api/**", "src/pages/api/**"]). Empty (default) = a light path/extension heuristic that fails open.'),
         }),
     }),
+    continuity: z.object({
+        auto_record: z.enum(['on', 'off']).default('off').describe('Deterministic continuity-record writer at session end (road-to-continuity-writer-activation Phase 1). on = the session-eol concern writes the continuity_record capsule variant on Stop for a substantive session that has claimed a roadmap; every field is computed from on-disk state, with no model spend and no subprocess. off (default) = no automatic record — while session:recycle is still the normal path, a second producer on it before the parity evidence is in would be unverified.'),
+        run_checkpoints: z.enum(['on', 'off']).default('on').describe('Deterministic run-checkpoint production at session end (road-to-continuity-writer-activation Phase 1.4). on (default) = a session above the recycle threshold and inside a running roadmap contract leaves agents/runtime/state/checkpoints/<run>.json, so a killed run resumes from a derived checkpoint rather than from bookkeeping. off = no checkpoint; continuity writing, the recycle advisory and the context-fill surface are unaffected. Default ON because it is the behaviour the tree already had — the switch exists to make the three session-end handlers independently disableable, not to change what ships.'),
+    }),
     memory: z.object({
         cadence: memoryCadence.default('always').describe('Cadence of the 🧠 memory-visibility line after a memory-consulting step. always (default) = show whenever a memory type was asked; auto = show only when 3+ types were consulted (less noise); never = suppress. Distinct from rule_loading_tier — owns its own key since the 2026-06-01 untangle.'),
         review_threshold: z.number().int().min(0).default(10).describe('Maximum number of memory entries /memory:load surfaces inline before falling back to a summary view. Default 10 keeps the chat readable. Raise to see more candidates, lower to keep the context tight.'),

package/docs/MIGRATION.md

@@ -42,6 +42,62 @@ reason, which no arithmetic can.
 or that promises a future breaking removal, gets a row here in the same commit
 that makes the promise. A promise with no row is not tracked and will be missed.
 
+## 14.22.x — the code-graph engine gets readers, and the MCP install hint changes
+
+💡 advisory · 🔄 automatic — **one exception, below.**
+
+The 14.21.x entry above shipped the engine to consumers. This one ships the
+things that read it (`road-to-a-graph-that-is-shipped`, Phases 3 and 4).
+
+### Additive — nothing to do
+
+- **Four new `code-graph` subcommands**, all answering questions about a DIFF
+  rather than a symbol: `impact --diff <rev>`, `tests-for <symbol>`,
+  `untested --diff <rev>`, `dead`. Each prints the resolution mechanisms it
+  accepted, the mechanisms it refused, and the graph's three-state staleness.
+  No existing subcommand changed, and no new top-level verb was added.
+- **Five new MCP tools** on the existing stdio server — `graph_impact`,
+  `graph_tests_for`, `graph_dead`, `graph_query`, `graph_path` — taking the
+  catalogue from 31 tools to 36. Four are read-only; `graph_impact` runs
+  `git diff --name-only` to resolve its rev and declares `side_effect: shell`
+  for that reason.
+- **A new `tests` edge relation**, derived in the build pass from a test file's
+  imports. `SCHEMA_VERSION` 3 → 4 and `GRAPH_STORE_VERSION` 3 → 4, so an
+  existing cache and its SQLite twin are refused and rebuilt on the next
+  `code-graph build`. The cache is derived and disposable
+  (ADR-129) — there is nothing to migrate, and a rebuild takes seconds.
+
+### The one thing to check — `dead` refuses by default
+
+`agent-config code-graph dead` exits **1** with an empty list unless you either
+supply an entry-point list (`--entry-points <file>`) or accept the gap
+(`--accept-missing-exports`). That is deliberate: this engine records no
+exportedness, so without a supplied list an exported-but-not-yet-imported public
+symbol is indistinguishable from a dead one, and a confident false "dead" invites
+a deletion the graph cannot justify. If you wire `dead` into a script, handle the
+refusal — an exit 1 here is not a crash, and treating it as an empty dead list
+is the false negative the refusal exists to prevent.
+
+### One consumer-visible string changed
+
+`install_hint_stdio` in the published MCP tool catalogue was
+`npx -y @event4u/agent-config mcp-server` and is now **`agent-config mcp-server`**
+— the installed-binary form the setup docs already lead with. It resolves no
+dist-tag, so the server you run is the version you installed rather than
+whatever the registry served most recently. **It assumes `agent-config` is on
+PATH.** If you read that field programmatically and rely on `npx`, keep using
+the pinned form from [`mcp-server.md`](mcp-server.md) —
+`npx -y @event4u/agent-config@<version> mcp-server` — which is unchanged and
+still the documented client configuration.
+
+### Standing context cost
+
+Registering the stdio MCP server now costs **4,876 tokens** of standing context
+per session, up from 3,886 — the five graph tools measure 993 between them. It
+remains roughly 4x under the ~20,000-token Tool Search deferral threshold at a
+200k window, so the surface still loads upfront. Measured, with the prior reading
+kept: `agents/evidence/metrics/mcp-tool-standing-cost.jsonl`.
+
 ## 14.21.x — the code-graph engine ships to consumers
 
 💡 advisory · 🔄 automatic — no action required.

package/docs/contracts/settings-classes.md

@@ -247,8 +247,33 @@ dispatch runs, not WHETHER the layer exists, so they keep their own C rows.
 |---|---|
 | A — preference | 26 |
 | B — consent | 3 |
-| C — guarded | 110 |
-| **Total** | **139** |
+| C — guarded | 113 |
+| **Total** | **142** |
+
+It rose to 142 on 2026-09-08 from two independent additions that landed in the same
+day and are counted together here: `lean_projection.hosts` (one C, `policy`, from
+`road-to-delivery-for-every-host`) and the two continuity keys below. The merge that
+combined them re-derived the total from the class table rather than adding either
+side's figure to the other, which is the arithmetic `lint_settings_classes` checks.
+
+It rose on 2026-09-08 when `road-to-continuity-writer-activation`
+step 1.2 added `continuity.auto_record` — one C, `consent`: it arms an automatic
+producer on the normal session-end path, and the roadmap step requires the
+default to stay `off` until parity is measured, which is a decision no agent may
+take by writing the key. Step 1.4 added
+`continuity.run_checkpoints` the same day — a second C, shipping `on` because
+that is the behavior the tree already had. It exists so the three session-end
+handlers are independently disableable, which is what the 2026-09-07 council's
+D2 asked for; it changes nothing that ships.
+
+Its disposition is `consent`, and `derivable` was considered first and rejected:
+`derivable` is the **deletion queue**, a claim that the key disappears once the
+mechanism it names exists. This one is an operator kill switch over a recovery
+artifact, so it is meant to survive — and nothing in the tree can derive whether
+an operator wants resumability traded for quiet. It sits in the same shape as the
+kill switches already classified `consent` (`knowledge.global_sharing.enabled`
+and its allowlist): the mechanism's own preconditions are computable, the
+operator's decision to suppress it is not.
 
 The total was 140 until 2026-08-12, when five of the six keys no code path read were
 deleted, minus the one held open (§ The six unread keys, below): one A
@@ -338,9 +363,9 @@ the template, which is the drift this contract exists to prevent.
 |---|---|
 | derivable | 83 |
 | un-inferrable | 9 |
-| consent | 41 |
-| policy | 6 |
-| **Total** | **139** |
+| consent | 43 |
+| policy | 7 |
+| **Total** | **142** |
 
 First measured 2026-08-12 at 140 leaves (derivable 88 · consent 38 ·
 un-inferrable 9 · policy 5), from the table below rather than predicted — the
@@ -355,8 +380,12 @@ mechanism it names actually exists, so 83 measures work outstanding, not keys
 about to disappear. The count is expected to fall while `un-inferrable` does not
 — those 9 plus whatever survives re-examination in `consent` are the floor this
 surface has, and stating it is the point. `policy` is the smallest class and the
-only one whose action is a *move* rather than a keep or a delete: five keys carry
-a project fact the tree could hold instead.
+only one whose action is a *move* rather than a keep or a delete: seven keys carry
+a project fact the tree could hold instead. (This sentence read "five" while the
+counts table beside it read 6, and 2026-09-08 added `lean_projection.hosts` as the
+seventh — corrected in both directions rather than only incremented, because a
+prose number that disagrees with a computed one beside it is the exact defect
+`lint_settings_classes` fails the two Total rows for.)
 
 ## The floor — the nine keys no mechanism can derive
 
@@ -440,6 +469,7 @@ Rows follow template order, so a diff against the template reads straight down.
 | `discipline_profile` | C | `__DISCIPLINE_PROFILE__` | master switch for the discipline rule tier | derivable — its own `auto` resolution against `src/config/host-capabilities.yml` |
 | `rule_loading_tier` | C | `__RULE_LOADING_TIER__` | legacy master switch for rule loading | derivable — `discipline_profile` supersedes it with a documented mapping (minimal→off, balanced→essential, full→full) |
 | `lean_projection.mode` | C | `eager-all` | `thin` removes rule bodies from the agent's context | derivable — `probe_host_compliance.ts` already computes the per-host thin/eager recommendation |
+| `lean_projection.hosts` | C | `[claude-code]` | decides WHICH hosts a thinning mode may thin, so an added id removes rule bodies from that host's context | policy — the value is a package-level decision the tree already holds: ADR-267 scopes the shipped `delivery` flip to `claude-code` alone. NOT `derivable`, and the distinction is the whole reason for this row: the mechanism that would compute an admissible host set, `admissibleUnderE3` in `src/scripts/_lib/injection_effect.ts`, admits **nothing** today — `src/config/host-injection-effect.json` carries 1 `observed-false` and 8 `unobserved` rows and no `observed-true` — so a derivation would yield `[]` rather than the shipped `[claude-code]`. Naming a mechanism that returns empty as the replacement would put a key in the deletion queue whose deletion would silently change the default. Move target: the ADR plus that census, once a host earns an `observed-true` row |
 | `telegraph.speak` | C | `false` | ships a rule body; a token-cost lever in both directions | derivable — the telegraph kill-criterion bench verdict is a package-level decision, not a per-install one |
 | `tokens.rich_skills` | C | `"on"` | token-spend lever | derivable — the skill's own `token_budget_class: rich` declaration plus the CI ceiling in `lint_token_budget_discipline.ts` |
 | `cost.budgets.daily` | C | `0` | rolling spend ceiling | consent |
@@ -537,6 +567,8 @@ Rows follow template order, so a diff against the template reads straight down.
 | `commands.create_pr.screenshots` | C | `false` | puts captured screenshots into a published PR body | consent |
 | `commands.create_pr.ui_paths` | C | `[]` | glob allowlist | derivable — the frontend-surface heuristic the PR-description flow already applies when the glob list is empty |
 | `commands.create_pr.api_paths` | C | `[]` | glob allowlist | derivable — the API-endpoint heuristic the same flow already applies as its documented empty-list fallback |
+| `continuity.auto_record` | C | `"off"` | arms an automatic producer on the normal session-end path | consent |
+| `continuity.run_checkpoints` | C | `"on"` | disabling it removes a recovery artifact a killed run resumes from | consent |
 | `memory.cadence` | C | `always` | suppressing the visibility line hides what the agent learned from the user | derivable — the hits/asks count the memory-visibility summary already computes; the line only exists when memory was consulted |
 | `memory.review_threshold` | A | `10` | when a review preview surfaces; governs no gate | derivable — the unreviewed-intake count `/memory load` already computes before rendering its preview |
 | `memory.redact_patterns` | C | `[]` | deny-list of secret and PII regexes | policy |

package/docs/guidelines/agent-infra/notes-horizon-mechanics.md

@@ -0,0 +1,90 @@
+# Notes-first reasoning — horizon and reopening mechanics
+
+Migrated out of [`notes-first-reasoning`](../../../src/rules/notes-first-reasoning.md)
+on 2026-09-08. That rule is delivered on **every subagent spawn**, so its body is
+paid per spawn; this material is reference read on demand. Nothing was dropped —
+the four passages below are the rule's own text, verbatim, and the rule keeps
+both Iron Laws and points here.
+
+Same reason, and the same remedy, as the 2026-08-29 drain run recorded for
+`source-confidentiality`: the addition had no room under the per-spawn ceiling,
+and raising that ceiling is the config-weakening move this repository refuses.
+
+### Why reasoning stays out of the reply, and what grounds the notes file
+
+Reasoning dumped into the user-facing answer is both noise and a
+`reasoning_extraction` refusal risk (see `rdp-gate`). Keep it in the notes file.
+
+The notes file is grounded in the documented cross-run lessons memory
+(consolidated via [`memory-consolidation`](../../../src/skills/memory-consolidation/SKILL.md));
+the rule's in-task sections are a local derivation for within-task scope. The
+gate itself reads settings + task-signal + host self-assessment.
+
+### The two section fields, in full
+
+The rule lists the sections and no count. That is deliberate: the structure
+carries the enumeration, so there is no "write N hypotheses" instruction to
+follow — a run records what the work actually surfaced, and an empty section is
+a fact about the work rather than a gap in the notes.
+
+`## Predictions` carries **chosen form** · prediction · confidence · result ·
+lesson — the calibration loop: hypothesis → prediction → reality →
+calibration. The form is named first because a prediction with no subject
+cannot be contradicted: when the observation comes back, "the prediction
+missed" has to point at *what* it was a prediction about, or nothing reopens.
+
+`## Decisions` escalates to
+[`decision-record`](../../../src/skills/decision-record/SKILL.md)/ADR when the
+decision is cross-task or architectural — litmus: would a dev on a different
+component next month need this context? And `next-commitment` is the boundary
+this choice authorises work up to, not the plan for it: choosing a form is not
+permission to execute a twelve-step plan on it without re-reading the position.
+
+### The horizon — which boundaries count
+
+The boundary is the nearest of these that the plan actually reaches: a **test
+result** · a **type or schema inspection** · a **compile** · a **runtime probe**
+· a **call-site inventory** · a **dry run** · a **browser observation** · a
+**dependency-contract read**. The set is enumerable, which is the whole point —
+"the work up to the nearest of those" is decidable from the plan, and `next
+justified commitment` as prose degrades to *"implement solution"*, which is the
+starting point wearing a label.
+
+### Width scales with reversibility, never with task size
+
+| The action is… | The horizon runs to… |
+|---|---|
+| a reversible local edit | a whole implementation slice — stopping at the first boundary costs more than it saves |
+| stateful or cross-layer | the next boundary from the list above |
+| irreversible or a public contract | **before** the irreversible step, unless direct evidence already covers it |
+
+### The look-ahead ladder is a CEILING, never a quota
+
+Three to five moves is the *maximum*, and only for a forcing, irreversible or
+externally observable line. Stateful or cross-layer gets two to three. A quiet
+reversible line gets **one, deliberately** — and no artifact anywhere requires a
+minimum depth. Always-three-to-five across all variants is 1024 leaves at four
+branches and depth five, which buys nothing and costs the run its budget.
+
+### Reopening — the two consequences
+
+A reopen driven by ritual rather than by contradicting evidence is ceremony, and
+an uncapped reopen is a loop with better manners. Two consequences:
+
+- **A rejection whose premise is falsified is not a rejection.** A candidate
+  killed by an assumption that later turns out false is *un-evaluated*, not
+  dead — it returns to the set. That is what makes a stated `killed-if`
+  condition worth carrying: without it, "we ruled that out" is unfalsifiable.
+- **The first failure reads the candidate list before the retry**, where one
+  exists — see [`autonomy-mechanics`](../../../src/agent-src/contexts/execution/autonomy-mechanics.md)
+  § Retry-budget escalation ladder. Where none exists the ladder is unchanged.
+  This adds a branch; it does not move the N=3 budget.
+
+## See also
+
+- [`notes-first-reasoning`](../../../src/rules/notes-first-reasoning.md) — the
+  rule this material was paid for in, and which keeps both Iron Laws.
+- [`rdp-gate`](../../../src/agent-src/contexts/execution/rdp-gate.md) — the
+  engagement gate that decides whether the notes discipline runs at all.
+- [`decision-record`](../../../src/skills/decision-record/SKILL.md) — where a
+  cross-task or architectural decision escalates to.

package/llms.txt

@@ -41,7 +41,7 @@ canvas-design: Creating static visual art — posters, marketing visuals, brand
 character-consistency: Use when a character must stay visually identical across AI video scenes — locks identity tokens (silhouette, palette, wardrobe, prop) in JSON. Triggers 'character lock', 'same character'.
 check-refs: Use when verifying cross-references between skills, rules, commands, guidelines, and context documents are not broken after edits, renames, or deletions.
 churn-prevention: Use when designing churn defence — health-score signals, churn-cause split (involuntary / value / relationship / fit), early-warning loop. Triggers on 'why are accounts leaving'.
-code-intelligence: Route codebase-structure questions (who calls X, where is this used, what imports, change-impact) to an existing code-graph first: cheaper, never more precise; grep stays routine. Also 'call graph'.
+code-intelligence: Route codebase-structure questions (who calls X, where used, change-impact) to an existing code-graph first: impact, tests-for, dead cheaper, never more precise; grep routine. Also 'call graph'.
 code-refactoring: When the user says 'refactor this', 'rename class', or 'move method'. Safely refactors code in any language — finds all callers, updates downstream dependencies, verifies via quality tools.
 code-review: Use when the user says \"review this\", \"check my code\", or wants feedback on changes. Reviews for correctness, quality, security, and coding standards.
 command-routing: Use when the user invokes a slash command like /create-pr, /commit, /fix-ci, or pastes command file content — routes to the right command with context inference and GitHub API patterns.

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@event4u/agent-config",
     "mcpName": "io.github.event4u-app/agent-config",
-    "version": "14.22.0",
+    "version": "14.23.0",
     "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including the counts in these badges.",
     "license": "MIT",
     "private": false,

package/src/agent-src/scripts/archive_completed_roadmaps.ts

@@ -58,7 +58,11 @@ import * as path from 'node:path';
 import process from 'node:process';
 import { fileURLToPath } from 'node:url';
 
-import { collect } from './update_roadmap_progress.js';
+import {
+    blocker_is_resolved,
+    collect,
+    parse_blockers,
+} from './update_roadmap_progress.js';
 import { guardedBaselineProblems, parseGuardedBaselines } from './guarded_baseline.js';
 
 import { isCliEntry } from './_cli_entry.js';
@@ -265,6 +269,80 @@ function _git_mv(root: string, src_rel: string, dst_rel: string, dry_run: boolea
     }
 }
 
+// ---------------------------------------------------------------------
+// The index/working-tree blocker divergence check (1b) + staging (1a)
+// ---------------------------------------------------------------------
+//
+// The open-blocker refusal below reads the file with `fs.readFileSync`, i.e.
+// the WORKING TREE. `git mv` then moves the INDEX ENTRY, which still carries
+// whatever was staged. When the two disagree the commit ships the index
+// content — content this gate never read.
+//
+// Measured, once, at full cost (2026-09-08): an edit removing a roadmap's
+// blocker was made and never staged; `git mv` moved the stale index entry; the
+// archived file shipped a blocker declared `Status: open` that had already been
+// relocated to an active roadmap. The same blocker was open in two files at
+// once, one of them archived, and it was caught by a human reading
+// `git status` rather than by any gate.
+//
+// The check is scoped to blocker id → status and deliberately NOT to whole-file
+// equality. An unstaged typo fix in a roadmap title has nothing to do with the
+// defect, and refusing archival for it trains `git add -A`, which destroys the
+// staging discipline this check depends on. AI council 2026-09-08, 2/2 present
+// (anthropic/claude-sonnet-4-5 + openai/gpt-4o), on that scoping specifically:
+// broad scoping is "user-hostile, trains developers to `git add -A`
+// reflexively, defeating staging discipline".
+
+/** Blocker id → status, as the archive-transition check compares them. */
+function _blockerStatuses(text: string): Map<string, string> {
+    const out = new Map<string, string>();
+    for (const b of parse_blockers(text)) {
+        out.set(b.id, blocker_is_resolved(b) ? 'resolved' : 'open');
+    }
+    return out;
+}
+
+/**
+ * `git show :<rel>` — the STAGED content of a path, or null when the path has
+ * no index entry.
+ *
+ * Null is the untracked / pre-first-commit case, which `_git_mv` already
+ * handles by falling back to a plain rename. There is no index entry to
+ * disagree with, so the divergence check has nothing to assert and says so by
+ * returning null rather than by guessing at an empty string — an empty staged
+ * file and an absent one differ, and only the second is legitimate here.
+ */
+function _indexContent(root: string, rel: string): string | null {
+    const cp = _run(['git', 'show', `:${rel}`], root);
+    return cp.returncode === 0 ? cp.stdout : null;
+}
+
+/**
+ * Human-readable disagreements between the staged and working-tree blocker
+ * maps of one path. Empty array = the two agree, or there is no index entry.
+ */
+function _blockerDivergence(root: string, rel: string, workTreeText: string): string[] {
+    const staged = _indexContent(root, rel);
+    if (staged === null) {
+        return [];
+    }
+    const wt = _blockerStatuses(workTreeText);
+    const idx = _blockerStatuses(staged);
+    const ids = [...new Set([...wt.keys(), ...idx.keys()])].sort();
+    const out: string[] = [];
+    for (const id of ids) {
+        const a = idx.get(id);
+        const b = wt.get(id);
+        if (a === b) {
+            continue;
+        }
+        out.push(
+            `blocker '${id}': staged=${a ?? 'absent'} vs working tree=${b ?? 'absent'}`,
+        );
+    }
+    return out;
+}
+
 /**
  * Repo-relative paths of files containing `needle`, by walking the filesystem.
  *
@@ -547,9 +625,8 @@ function archive_completed(
         // and invisible in a sweep that only reports what it moved; a MALFORMED
         // one on `[x]` would otherwise archive with an annotation claiming the
         // opposite. Both are named here instead.
-        const guarded = parseGuardedBaselines(
-            fs.readFileSync(path.join(roadmap_root, stats.rel), 'utf-8'),
-        );
+        const roadmapText = fs.readFileSync(path.join(roadmap_root, stats.rel), 'utf-8');
+        const guarded = parseGuardedBaselines(roadmapText);
         if (guarded.length > 0) {
             process.stderr.write(
                 `  ⚠️  ${stats.rel}: ${guarded.length} guarded-baseline step(s) — ` +
@@ -603,12 +680,37 @@ function archive_completed(
         if (changed_only && !(touched as Set<string>).has(old_rel)) {
             continue; // complete, but not this branch's work
         }
+        // The gate above validated the WORKING TREE; `git mv` ships the INDEX.
+        // When they disagree about a blocker, the validated content is not the
+        // content that gets committed — see § the index/working-tree blocker
+        // divergence check above for the measured failure.
+        const divergence = _blockerDivergence(root, old_rel, roadmapText);
+        if (divergence.length > 0) {
+            process.stderr.write(
+                `  ⚠️  ${stats.rel}: staged and working-tree blockers disagree ` +
+                    `(${divergence.length}) — not archived. \`git mv\` would commit ` +
+                    'the staged content, which this sweep never validated. Stage or ' +
+                    'discard the change, then re-run.\n',
+            );
+            for (const d of divergence) {
+                process.stderr.write(`        · ${d}\n`);
+            }
+            continue;
+        }
         const new_rel = `agents/roadmaps/archive/${stats.rel}`;
         const mv = _git_mv(root, old_rel, new_rel, dry_run);
         if (!mv.ok) {
             process.stderr.write(`  ⚠️  could not archive ${old_rel} (mv failed)\n`);
             continue;
         }
+        // `git mv` moved the index ENTRY, not the working-tree content. Staging
+        // the destination makes what gets committed identical to what the checks
+        // above read — the divergence check refuses a disagreement that exists
+        // BEFORE the move, and this closes one created by an edit between the
+        // move and the commit.
+        if (!dry_run && mv.tracked) {
+            _run(['git', 'add', '--', new_rel], root);
+        }
         const refs = _inbound_ref_rewrite(root, old_rel, new_rel, dry_run, mv.tracked);
         // Stage rewritten refs only in a tracked repo; an untracked consumer's
         // files are not in the index, so the filesystem rewrite is the whole job.