@event4u/agent-config 14.22.0 → 15.0.0

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@event4u/agent-config",
     "mcpName": "io.github.event4u-app/agent-config",
-    "version": "14.22.0",
+    "version": "15.0.0",
     "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including the counts in these badges.",
     "license": "MIT",
     "private": false,
@@ -67,7 +67,9 @@
         "!src/**/*.test.ts",
         "!src/**/*.spec.ts",
         "!dist/agent-src/skills/**/evals/**",
-        "!dist/**/*.map"
+        "!dist/**/*.map",
+        "!**/__pycache__/**",
+        "!**/*.pyc"
     ],
     "bin": {
         "agent-config": "dist/cli/agent-config.js"
@@ -80,6 +82,8 @@
         "build:install-bundle": "esbuild src/scripts/install.ts --bundle --platform=node --format=esm --target=node20 --define:__AGENT_CONFIG_BUNDLE__=true --outfile=dist/install/install.mjs --banner:js=\"import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);\"",
         "build:hooks": "esbuild src/scripts/hooks/dispatch_entry.ts --bundle --platform=node --format=esm --target=node20 --define:__AGENT_CONFIG_BUNDLE__=true --outfile=dist/hooks/dispatch.js --banner:js=\"import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url); const __acPath = require('node:path'); const __acFs = require('node:fs'); const __acUrl = require('node:url'); const __acReal = (p) => { try { return __acFs.realpathSync(p); } catch { return p; } }; const __acSelf = __acReal(__acUrl.fileURLToPath(import.meta.url)); if (process.argv[1] !== undefined && __acReal(__acPath.resolve(process.argv[1])) === __acSelf) { globalThis.__AC_HOOKS_BUNDLE_DIRECT = true; process.argv = [process.argv[0], __acSelf + '.__direct__', ...process.argv.slice(2)]; }\"",
         "build:mcp-bundle": "esbuild src/scripts/mcp_server/__main__.ts --bundle --platform=node --format=esm --target=node20 --define:__AGENT_CONFIG_BUNDLE__=true --outfile=dist/mcp/server.mjs --banner:js=\"import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url); const __acPath = require('node:path'); const __acFs = require('node:fs'); const __acUrl = require('node:url'); const __acReal = (p) => { try { return __acFs.realpathSync(p); } catch { return p; } }; const __acSelf = __acReal(__acUrl.fileURLToPath(import.meta.url)); if (process.argv[1] !== undefined && __acReal(__acPath.resolve(process.argv[1])) === __acSelf) { globalThis.__AC_MCP_BUNDLE_DIRECT = true; process.argv = [process.argv[0], __acSelf + '.__direct__', ...process.argv.slice(2)]; }\"",
+        "clean:cli-delegate": "rm -rf dist/cli-delegate",
+        "build:delegates": "npm run clean:cli-delegate && npm run build:cli-delegate && npm run build:agent-src-delegate && npm run build:delegate-aux",
         "build:cli-delegate": "esbuild src/scripts/_cli/cmd_*.ts --bundle --splitting --platform=node --format=esm --target=node20 --define:__AGENT_CONFIG_BUNDLE__=true --define:__AGENT_CONFIG_CLI_DELEGATE__=true --outdir=dist/cli-delegate --banner:js=\"import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);\"",
         "build:agent-src-delegate": "esbuild src/agent-src/scripts/*.ts --bundle --splitting --platform=node --format=esm --target=node20 --define:__AGENT_CONFIG_BUNDLE__=true --define:__AGENT_CONFIG_CLI_DELEGATE__=true --outdir=dist/cli-delegate --banner:js=\"import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);\"",
         "build:delegate-aux": "esbuild src/scripts/_lib/pin_resolver.ts src/scripts/check_update_banner.ts --bundle --splitting --platform=node --format=esm --target=node20 --define:__AGENT_CONFIG_BUNDLE__=true --define:__AGENT_CONFIG_CLI_DELEGATE__=true --outbase=src/scripts --outdir=dist/cli-delegate --banner:js=\"import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);\"",
@@ -89,7 +93,7 @@
         "build:discovery": "./scripts-run src/scripts/build_discovery_manifest --write --strict",
         "build:mcp-manifest": "./scripts-run src/scripts/build_mcp_registry_manifest --write --strict",
         "build:mcp-catalog": "./scripts-run src/scripts/build_mcp_catalog --write --strict",
-        "build": "npm run build:cli && npm run build:install-bundle && npm run build:hooks && npm run build:mcp-bundle && npm run build:cli-delegate && npm run build:agent-src-delegate && npm run build:delegate-aux && npm run build:ui",
+        "build": "npm run build:cli && npm run build:install-bundle && npm run build:hooks && npm run build:mcp-bundle && npm run build:delegates && npm run build:ui",
         "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.scripts.json",
         "lint:ts": "eslint --cache --max-warnings 0 'src/**/*.ts'",
         "test:ts": "vitest run",

package/src/agent-src/scripts/archive_completed_roadmaps.ts

@@ -58,7 +58,11 @@ import * as path from 'node:path';
 import process from 'node:process';
 import { fileURLToPath } from 'node:url';
 
-import { collect } from './update_roadmap_progress.js';
+import {
+    blocker_is_resolved,
+    collect,
+    parse_blockers,
+} from './update_roadmap_progress.js';
 import { guardedBaselineProblems, parseGuardedBaselines } from './guarded_baseline.js';
 
 import { isCliEntry } from './_cli_entry.js';
@@ -265,6 +269,80 @@ function _git_mv(root: string, src_rel: string, dst_rel: string, dry_run: boolea
     }
 }
 
+// ---------------------------------------------------------------------
+// The index/working-tree blocker divergence check (1b) + staging (1a)
+// ---------------------------------------------------------------------
+//
+// The open-blocker refusal below reads the file with `fs.readFileSync`, i.e.
+// the WORKING TREE. `git mv` then moves the INDEX ENTRY, which still carries
+// whatever was staged. When the two disagree the commit ships the index
+// content — content this gate never read.
+//
+// Measured, once, at full cost (2026-09-08): an edit removing a roadmap's
+// blocker was made and never staged; `git mv` moved the stale index entry; the
+// archived file shipped a blocker declared `Status: open` that had already been
+// relocated to an active roadmap. The same blocker was open in two files at
+// once, one of them archived, and it was caught by a human reading
+// `git status` rather than by any gate.
+//
+// The check is scoped to blocker id → status and deliberately NOT to whole-file
+// equality. An unstaged typo fix in a roadmap title has nothing to do with the
+// defect, and refusing archival for it trains `git add -A`, which destroys the
+// staging discipline this check depends on. AI council 2026-09-08, 2/2 present
+// (anthropic/claude-sonnet-4-5 + openai/gpt-4o), on that scoping specifically:
+// broad scoping is "user-hostile, trains developers to `git add -A`
+// reflexively, defeating staging discipline".
+
+/** Blocker id → status, as the archive-transition check compares them. */
+function _blockerStatuses(text: string): Map<string, string> {
+    const out = new Map<string, string>();
+    for (const b of parse_blockers(text)) {
+        out.set(b.id, blocker_is_resolved(b) ? 'resolved' : 'open');
+    }
+    return out;
+}
+
+/**
+ * `git show :<rel>` — the STAGED content of a path, or null when the path has
+ * no index entry.
+ *
+ * Null is the untracked / pre-first-commit case, which `_git_mv` already
+ * handles by falling back to a plain rename. There is no index entry to
+ * disagree with, so the divergence check has nothing to assert and says so by
+ * returning null rather than by guessing at an empty string — an empty staged
+ * file and an absent one differ, and only the second is legitimate here.
+ */
+function _indexContent(root: string, rel: string): string | null {
+    const cp = _run(['git', 'show', `:${rel}`], root);
+    return cp.returncode === 0 ? cp.stdout : null;
+}
+
+/**
+ * Human-readable disagreements between the staged and working-tree blocker
+ * maps of one path. Empty array = the two agree, or there is no index entry.
+ */
+function _blockerDivergence(root: string, rel: string, workTreeText: string): string[] {
+    const staged = _indexContent(root, rel);
+    if (staged === null) {
+        return [];
+    }
+    const wt = _blockerStatuses(workTreeText);
+    const idx = _blockerStatuses(staged);
+    const ids = [...new Set([...wt.keys(), ...idx.keys()])].sort();
+    const out: string[] = [];
+    for (const id of ids) {
+        const a = idx.get(id);
+        const b = wt.get(id);
+        if (a === b) {
+            continue;
+        }
+        out.push(
+            `blocker '${id}': staged=${a ?? 'absent'} vs working tree=${b ?? 'absent'}`,
+        );
+    }
+    return out;
+}
+
 /**
  * Repo-relative paths of files containing `needle`, by walking the filesystem.
  *
@@ -547,9 +625,8 @@ function archive_completed(
         // and invisible in a sweep that only reports what it moved; a MALFORMED
         // one on `[x]` would otherwise archive with an annotation claiming the
         // opposite. Both are named here instead.
-        const guarded = parseGuardedBaselines(
-            fs.readFileSync(path.join(roadmap_root, stats.rel), 'utf-8'),
-        );
+        const roadmapText = fs.readFileSync(path.join(roadmap_root, stats.rel), 'utf-8');
+        const guarded = parseGuardedBaselines(roadmapText);
         if (guarded.length > 0) {
             process.stderr.write(
                 `  ⚠️  ${stats.rel}: ${guarded.length} guarded-baseline step(s) — ` +
@@ -603,12 +680,37 @@ function archive_completed(
         if (changed_only && !(touched as Set<string>).has(old_rel)) {
             continue; // complete, but not this branch's work
         }
+        // The gate above validated the WORKING TREE; `git mv` ships the INDEX.
+        // When they disagree about a blocker, the validated content is not the
+        // content that gets committed — see § the index/working-tree blocker
+        // divergence check above for the measured failure.
+        const divergence = _blockerDivergence(root, old_rel, roadmapText);
+        if (divergence.length > 0) {
+            process.stderr.write(
+                `  ⚠️  ${stats.rel}: staged and working-tree blockers disagree ` +
+                    `(${divergence.length}) — not archived. \`git mv\` would commit ` +
+                    'the staged content, which this sweep never validated. Stage or ' +
+                    'discard the change, then re-run.\n',
+            );
+            for (const d of divergence) {
+                process.stderr.write(`        · ${d}\n`);
+            }
+            continue;
+        }
         const new_rel = `agents/roadmaps/archive/${stats.rel}`;
         const mv = _git_mv(root, old_rel, new_rel, dry_run);
         if (!mv.ok) {
             process.stderr.write(`  ⚠️  could not archive ${old_rel} (mv failed)\n`);
             continue;
         }
+        // `git mv` moved the index ENTRY, not the working-tree content. Staging
+        // the destination makes what gets committed identical to what the checks
+        // above read — the divergence check refuses a disagreement that exists
+        // BEFORE the move, and this closes one created by an edit between the
+        // move and the commit.
+        if (!dry_run && mv.tracked) {
+            _run(['git', 'add', '--', new_rel], root);
+        }
         const refs = _inbound_ref_rewrite(root, old_rel, new_rel, dry_run, mv.tracked);
         // Stage rewritten refs only in a tracked repo; an untracked consumer's
         // files are not in the index, so the filesystem rewrite is the whole job.

package/src/config/agent-settings.template.yml

@@ -195,8 +195,23 @@ rule_loading_tier: __RULE_LOADING_TIER__
 #             validate with `task bench:ab:live` before flipping, and
 #             keep `task trigger-coverage` at 100%. One-flip revert:
 #             set eager-all + `task generate-tools`.
+# delivery  = the `thin` projection PLUS the `rule-inject` hook concern, which
+#             delivers a rule body back on trigger match. SHIPPED DEFAULT for
+#             Claude Code since ADR-267. Measured over the frozen routing-matrix
+#             corpus: 616/616 byte-equal deliveries, 101/101 labelled rules
+#             reachable, 0 of 212 near-misses fired. Rollback is this one
+#             setting: `mode: eager-all` + `task generate-tools`.
+#
+# `hosts` scopes WHICH hosts are thinned. Every host outside the list receives
+# exactly what `eager-all` writes, asserted byte-for-byte in CI by
+# `check_host_tree_parity`. The default has one member because Claude Code is
+# the only host that both binds the concern's slots and acts on its verdict
+# (docs/enforcement-by-host.md); thinning a host with no bound slot would remove
+# a body and put nothing in its place. Only `claude-code`, `cursor` and `cline`
+# are thinnable at all - any other id is dropped with a warning.
 lean_projection:
-  mode: eager-all
+  mode: delivery
+  hosts: [claude-code]
 
 # --- Telegraph condensation (output-side) ---
 #
@@ -723,6 +738,43 @@ design:
   #              autonomy setting, roadmap, or standing instruction lifts it).
   fidelity_mode: strict
 
+  # Value reconciliation between a provided artifact and the project's own
+  # tokens. MEASUREMENT ships; BEHAVIOUR does not — AI council 2026-09-09
+  # (anthropic + openai, 2/2) on `blocker: approximation-tolerance`.
+  #
+  # The distance from the artifact's value to the nearest project token is
+  # computed and REPORTED on every value row regardless of these settings.
+  # What these decide is whether the agent may act on it without asking.
+  approximation:
+    # false ships. Turning it on lets a value INSIDE tolerance be replaced by
+    # the project's token without a per-value confirmation; outside tolerance
+    # the artifact's value is preserved either way. Shipping this enabled is a
+    # consumer-facing default flip and is owner-reserved — recorded in
+    # agents/roadmaps/stubs/road-to-frontend-power-default-flip.md, not decided
+    # here. `design.fidelity_mode: hard-floor` overrides it to off.
+    enabled: false
+
+    # Distance metric: OKLab ΔEOK for colour, absolute CSS pixels for length.
+    # The METHOD is fixed; the THRESHOLDS are deliberately absent.
+    #
+    # Both ship `null`, and `null` means "preserve and report", never
+    # "reconcile freely". No number is set because none is supported: zero of
+    # seven design-to-code benchmarks in the evidence set score token
+    # conformance, and a number in a config file — even flagged unmeasured —
+    # shapes behaviour and acquires the authority of a default.
+    #
+    # The one real measurement in the evidence set is GitHub Primer's spacing
+    # plugin, which widens each token's accepted set by ±1px and autofixes. It
+    # is recorded as an externally observed CANDIDATE in
+    # src/scripts/_lib/design_tolerance.ts and is not the shipped value.
+    tolerance:
+      # ΔEOK. Not an RGB channel delta — RGB distance is not perceptually
+      # uniform, which is why a `±5 per channel` proposal was rejected.
+      color: null
+      # CSS pixels, absolute. Not `max(1px, 2%)`, which grows more permissive
+      # at large dimensions with no evidence that this is wanted.
+      length: null
+
 # --- Cross-source consistency ---
 #
 # When the agent plans, refines, roadmaps, or implements from multiple
@@ -1093,6 +1145,47 @@ commands:
     ui_paths: []
     api_paths: []
 
+# --- Continuity ---
+#
+# Automatic session-continuity production. The continuity record is the one
+# artefact a successor session resumes from; see
+# docs/contracts/continuity-record-slot.md for the slot's capacity policy and
+# docs/contracts/continuity-rollback.md for what each switch here undoes.
+continuity:
+  # Deterministic continuity-record writer at session end
+  # (road-to-continuity-writer-activation Phase 1). When `on`, the session-eol
+  # concern writes the `continuity_record` capsule variant on Stop for a
+  # SUBSTANTIVE session that has claimed a roadmap — every field computed from
+  # on-disk state, no model spend, nothing shelled out.
+  #
+  # Default ON since 2026-09-10 (step 3.2). It shipped `off` while the parity
+  # evidence was outstanding; steps 1.1 and 1.3 discharged that, and an AI
+  # council of 2026-09-10 (2 seats, convergent, under the owner's written
+  # delegation) authorised the flip so the normal path has an automatic writer
+  # instead of a human remembering a command. The same verdict REFUSED to
+  # retire `agent-config session:recycle`, which stays as an explicit
+  # affordance — the automatic writer is not a strict superset of it (see
+  # `on` below).
+  #
+  # Existing installs are unaffected: a value already written here keeps it.
+  #   on  = (default) write the record at session end. Not written for a
+  #         session that claimed no roadmap, and the `git status` anchors
+  #         `session:recycle` collects are omitted.
+  #   off = no automatic record; only `session:recycle` writes one.
+  auto_record: "on"
+
+  # Deterministic run-checkpoint production at session end
+  # (road-to-continuity-writer-activation Phase 1.4). When `on`, a session
+  # above the recycle threshold and inside a running roadmap contract leaves
+  # agents/runtime/state/checkpoints/<run>.json behind, so a killed session can
+  # be resumed by the watcher rather than by bookkeeping. Default ON: this is
+  # the behavior the tree already had, and the switch exists so an operator can
+  # disable checkpointing WITHOUT disabling continuity writing or the recycle
+  # advisory.
+  #   on  = (default) write the checkpoint.
+  #   off = no checkpoint; every other session-end handler is unaffected.
+  run_checkpoints: "on"
+
 # --- Memory ---
 #
 # Engineering memory consolidation behaviour. Memory is entirely

package/src/config/ci-local-parity.yml

@@ -275,6 +275,40 @@ ci_only:
 # worth remote enforcement, OR it should simply be added to a workflow. Prefer
 # adding it: a local-only gate is the direction that let real defects merge.
 local_only:
+  - id: check_platform_anchor
+    class: token-scope-unavailable
+    reason: >
+      Reads `repos/{owner}/{repo}/rulesets` to check that the forge actually
+      requires what the ratification mechanism claims it does — an active branch
+      ruleset over the default branch, an approving review, last-push approval,
+      deletion and force-push blocked, strict required checks, and no
+      unconditional bypass actor.
+
+      Local-only because the permission does not exist, not because remote
+      enforcement is unwanted — which is the opposite of the usual reason on this
+      list and is why the class says so. The rulesets endpoint needs the
+      repository `administration` scope, and a workflow `GITHUB_TOKEN` cannot be
+      granted it: `administration: read` was tried in `rule-backstops.yml` on
+      2026-09-10 and actionlint refused it as an *"unknown permission scope"*,
+      listing the sixteen that do exist. None grants it.
+
+      Wiring it anyway would be worse than leaving it here. The gate fails closed
+      by design — a platform state it cannot read is `UNVERIFIABLE`, which is a
+      failure — so an unauthorised token would red every kernel and governance
+      pull request for a reason unrelated to the platform's actual state. The
+      three escapes were each rejected on the reasoning of the council that
+      commissioned the gate: `continue-on-error` makes it advisory, skipping when
+      unauthenticated makes it fail open, and putting it in `Sync + Generate Tools
+      Consistency` would freeze merges repository-wide on any red, since that
+      job's context is the ruleset's single required status check.
+
+      What moves it off this list: a PAT in a repository secret carrying
+      `administration: read`, then the workflow step. That is a human action and
+      is recorded as the open half of blocker `ratification-platform-anchor` in
+      `agents/roadmaps/road-to-typed-grants-that-persist.md`. Until then the gate
+      runs in `taskfiles/ci-fast.yml` — a real pre-push control, and not a CI one,
+      which is the honest description of its reach.
+
   - id: check_host_loadability_reach
     class: developer-machine-scoped
     reason: >

package/src/config/continuity-surface.json

@@ -43,13 +43,6 @@
             "locus": "src/scripts/_lib/session_eol.ts:55",
             "reason": "The writer`s own bookkeeping, not a record a successor reads. It holds counters and advisory stamps used across Stops within one session; nothing restores a session from it."
         },
-        {
-            "id": "manual:run-session-recycle-before-clear",
-            "axis": "normal_path_manual_actions",
-            "disposition": "counted",
-            "locus": "src/scripts/hooks/session_eol_hook.ts:258",
-            "reason": "The advisory the stop slot injects past the recycle threshold instructs a human to run `agent-config session:recycle`, wait for the absolute path it prints, and only then `/clear`. That is a manual action on the normal path, and it exists precisely because no automatic writer does. It is what step 3.1 removes the need for."
-        },
         {
             "id": ".dispatcher",
             "axis": "persistent_continuity_artefacts",
@@ -125,7 +118,7 @@
             "axis": "persistent_continuity_artefacts",
             "disposition": "counted",
             "locus": "src/scripts/hooks/session_eol_hook.ts:31",
-            "reason": "Machine-readable fill level plus threshold state, overwritten every Stop. Written for later verification of whether the session crossed the recycle threshold. AUTHORISED FOR RETIREMENT and NOT RETIRED \u2014 the authorisation (AI council 2026-09-08 D1, resting on producer/no-consumer evidence) was obtained on incomplete facts. There is no consumer in code, but `agents/roadmaps/later/road-to-cost-parity-2-state-aware-dispatch.md` is a live parked roadmap whose open steps 1.1 and 1.4c read this file as a planned input, and 1.4c is specifically about bounding its staleness. The same council's own qualification anticipated this: \"no consumer in the tree\" proves no in-repository consumer, and a planned consumer inside the tree is a stronger objection than an external one because it is checkable. Retiring it is a decision for that roadmap's owner, not a side effect of this one. Blocker: `context-fill-retirement-has-a-parked-consumer`."
+            "reason": "Machine-readable fill level plus threshold state, overwritten every Stop. Written for later verification of whether the session crossed the recycle threshold. AUTHORISED FOR RETIREMENT and NOT RETIRED \u2014 the authorisation (AI council 2026-09-08 D1, resting on producer/no-consumer evidence) was obtained on incomplete facts. There is no consumer in code, but `agents/roadmaps/later/road-to-cost-parity-2-state-aware-dispatch.md` is a live parked roadmap whose open steps 1.1 and 1.4c read this file as a planned input, and 1.4c is specifically about bounding its staleness. The same council's own qualification anticipated this: \"no consumer in the tree\" proves no in-repository consumer, and a planned consumer inside the tree is a stronger objection than an external one because it is checkable. Retiring it is a decision for that roadmap's owner, not a side effect of this one. RETENTION DECIDED 2026-09-09 and this row is that decision, not a note about a pending one. An AI council under the owner's written delegation for the drain run (2 seats, anthropic + openai, quorum 2/2) resolved `context-fill-retirement-has-a-parked-consumer` as RETAIN: the file and `writeContextFill` stay, and this row stays `counted`. The named consumer is `agents/roadmaps/later/road-to-cost-parity-2-state-aware-dispatch.md` steps 1.1 and 1.4c. The alternative was re-anchoring those steps, which means editing a roadmap that is parked precisely because nobody is working on it \u2014 one small per-session write is the cheaper side of that trade. The artefact-axis reduction 5 to 4 is NOT claimed. Revisit when that roadmap is resumed, cancelled, or re-anchored onto another source. Blocker: `context-fill-retirement-has-a-parked-consumer`, resolved."
         },
         {
             "id": "context-hygiene.json",
@@ -204,13 +197,6 @@
             "locus": "src/scripts/_cli/cmd_handoff.ts:9",
             "reason": "A second, prose-shaped session handoff written by `agent-config handoff` and injected once at the next `session_start`. Same job as the record, different format and different lifecycle \u2014 a competing mental model, which is what the count exists to expose."
         },
-        {
-            "id": "hot-context.md",
-            "axis": "persistent_continuity_artefacts",
-            "disposition": "counted",
-            "locus": "src/scripts/hot_context_hook.ts:11",
-            "reason": "A working-memory cache rebuilt on stop/session_end/pre_compact and restored at session_start. Persisted state written for context restoration, so the behavioural rule counts it whatever it is called."
-        },
         {
             "id": "injection-census.jsonl",
             "axis": "persistent_continuity_artefacts",
@@ -265,7 +251,7 @@
             "axis": "persistent_continuity_artefacts",
             "disposition": "counted",
             "locus": "src/scripts/_cli/cmd_session_recycle.ts:9",
-            "reason": "The continuity record itself: written by `session:recycle`, resolved per session by `resolveContinuityRecord`, consumed once at `session_start` by the handoff-context concern. This is the artefact the whole roadmap is collapsing the others INTO \u2014 the surviving `1`."
+            "reason": "The continuity record itself: written by `session:recycle` and, since 2026-09-10, by the automatic writer in the session-eol concern (`src/scripts/_lib/continuity_writer.ts` via `writeContinuityRecord`), resolved per session by `resolveContinuityRecord`, consumed once at `session_start` by the handoff-context concern. This is the artefact the whole roadmap is collapsing the others INTO \u2014 the surviving `1`. The locus stays on the command because the command still writes it; the second producer is named here so a reader does not conclude from the locus that a human is still the only source."
         },
         {
             "id": "render",
@@ -482,14 +468,7 @@
             "axis": "public_continuity_commands",
             "disposition": "counted",
             "locus": "src/cli/registry.ts:73",
-            "reason": "REQUIRED on the normal path today: it is the only writer of the continuity record in the tree, so continuity does not happen unless a human runs it. That is what makes it a continuity command rather than an affordance, and it is on the owner-authorised retirement set of 2026-09-06."
-        },
-        {
-            "id": "command:chat-history",
-            "axis": "session_resume_pickers",
-            "disposition": "excluded",
-            "locus": "src/domains/meta/chat-history/command.md:3",
-            "reason": "The orchestrator shell that routes to the import picker; it presents no picker of its own. Counting both would double-count one surface. It is retired together with the picker it routes to, so the row disappears with it."
+            "reason": "RETAINED as an explicit affordance, and no longer the normal path. It was the ONLY writer of the continuity record until step 3.2 of road-to-continuity-writer-activation armed the automatic writer by default (2026-09-10), which is why this row's earlier reason called it REQUIRED. The same AI council (2 seats, convergent, under the owner's written delegation) REFUSED to retire the verb: removing a public callable contract is a different act from removing a manual step, and the automatic writer is not a strict superset of this command \u2014 it leaves no record for a session that claimed no roadmap, and it omits the `git status` anchor fields the command collects. So it stays COUNTED on this axis rather than excluded: it is a public continuity command that exists, the axis counts what exists, and the target of 0 is therefore not reachable while this decision stands. Recorded here rather than argued away, on the same terms as the `verb:handoff` exclusion note above."
         },
         {
             "id": "picker:agent-handoff",
@@ -499,11 +478,11 @@
             "reason": "A numbered-options block asking a human which prior session to resume. It is a picker by construction, and the parent`s target of 0 pickers is in tension with its preservation of this command \u2014 recorded here so the tension is visible in the count rather than argued away."
         },
         {
-            "id": "picker:chat-history-import",
-            "axis": "session_resume_pickers",
-            "disposition": "counted",
-            "locus": "src/domains/meta/chat-history/import/command.md:77",
-            "reason": "A numbered-table session picker plus a resume offer \u2014 a second, competing answer to \"which prior session do I continue from\". On the owner-authorised retirement set of 2026-09-06."
+            "id": "session-index-latch",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/_lib/session_index_trust.ts:251",
+            "reason": "A duplicate-suppression latch, not a record. It holds one file per session under agents/runtime/state/session-index-latch/ whose entire content is a claim timestamp, and nothing reads it to restore anything \u2014 a successor session that finds it learns only that THIS session already received the memory index, which is the opposite of resumable state. It exists because `session_start` can fire more than once for one session (resume, host reconnect, compaction boundary on some hosts) and two injections double a fixed cost while presenting two corpora as one session memory. Excluded on the same reasoning as schema:session-eol-state: the writer own bookkeeping, not a record a successor reads. Deleting the directory costs a session nothing but a possible second injection."
         }
     ]
 }

package/src/config/evaluator-budgets.json

@@ -65,11 +65,11 @@
       "baseline_note": "80 → 81 on 2026-08-03 (release 9.15.0 gate). This RECORDS growth that already shipped through its own reviewed PR; it does not authorize new surface. The +1 is f02db54c2 (fix(cli): register routing:doctor in the CLI registry) — the command existed, only its registry entry was missing, and the registering PR did not move this budget. The gate did its job again: breach WARNS on main and BLOCKS on release, which is the conscious-decision point rather than a silently raised cap. Re-measured 2026-08-03 via the pinned method: 81. Headroom stays zero by design — the next registry addition must move this number in its own PR. 81 → 82 on 2026-08-04: the `handoff` subcommand (road-to-agent-handoff-resume Phase 4) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 82. 82 → 84 on 2026-08-04: the `route:explain` + `route:audit` verbs (routing-correctness validation surface) register in the same PR that adds the surface. Re-measured via the pinned method: 84. 84 → 85 on 2026-08-05: the `settings:set` verb (road-to-zero-ceremony-settings Phase 2 — the one agent-reachable settings writer) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 85. 85 → 86 on 2026-08-06: the `conformance:behavior` verb (road-to-agent-behavior-conformance Phase 5 — replays the local transcript store through the four mechanised conformance checks) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 86. 86 → 88 on 2026-08-07: the `sessions:list` + `sessions:claim` verbs (road-to-parallel-session-coordination — the shell surface of the shared session register, needed because /roadmap:next is command markdown and can only reach the register through a shell call) register in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 88. 88 → 89 on 2026-08-08: the `council:status` verb registers in the same PR that adds the surface, per this record's own contract. It exists because an agent in a consumer project announced \"kein Council konfiguriert (keine .agent-settings.yml)\" and substituted a weaker path while the council was configured user-globally the whole time — there was no verb that answered availability, so the only route was an inference from a filename, and the intuitive filename is the one location ADR-104 guarantees is never consulted. Re-measured via the pinned method: 89. 89 → 91 on 2026-08-08: the `self-repair:status` + `self-repair:release` verbs (the queued-defect reader and the single Hard-Floor-gated outward step of the self-repair loop — the loop is deliberately unable to publish unless a human runs the release command) register in the same PR that adds the surface, per this record's own contract. Landed alongside the +1 council:status move in the same branch. Re-measured via the pinned method: 91. 91 → 94 on 2026-08-08: the `packs:active`, `settings:get` and `mcp:available` verbs (road-to-capability-answerability Phase 2 — the three capability probes for the gaps that had none) register in the same PR that adds the surface, per this record's own contract. Each answers a question that was previously only inferable from a filename: which packs are active and from which file, what a setting resolves to and which file set it, and what is declared in mcp.json versus what can actually launch. 94 -> 95 in the same PR: `brand:status` (Phase 2.4 — brand-layer presence, which the rule depended on and no surface could answer). Re-measured twice via the pinned method on the unchanged tree: 95/95. 95 → 96 on 2026-08-10: the `session:recycle` verb (road-to-token-economy-recycling Phase 2.2 — the deterministic producer of the main-session recycle envelope; the recycle advisory names this exact verb, so it must exist as a shell surface) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 96. 96 -> 97 on 2026-08-10: the `gates` verb registers in the same PR that adds the surface, per this record's own contract. It exists because the blocker fields the dashboard already parses (Owner, What to do, Resolved when — CI-enforced by lint_roadmap_blockers) had no owner-filtered reader: the dashboard counts the open blockers across a 600-line file and links each to a per-roadmap anchor, so \"which of these are mine\" was a manual read of every anchor. The same inference-from-a-filename shape as the council:status entry above, one layer up. This branch and the session:recycle branch each measured 96 independently and landed on the same number for different verbs; the merge makes it 97, re-measured twice via the pinned method on the merged tree: 97/97. 97 -> 98 on 2026-08-15: the `workspace:doctor` verb (road-to-inbox-harvest-2026-08-c-workspace-identity Phase 3 — the read-only report over the new `workspaceIdentity()` resolver) registers in the same PR that adds the surface, per this record's own contract. It exists for the same inference-from-a-filename shape as the council:status and gates entries above, one layer down: the tree answered \"where am I\" in eight ad-hoc places across six files, and the 12.0.0 span shipped the same worktree misclassification twice, so no verb could be asked which checkout is the main one. Read-only by construction — the roadmap's Non-goals put worktree disposal out of scope and its Risk 3 names \"the pressure read becomes a disposal path by accident\" as the failure to design against, so the command carries no --fix and no --prune. Re-measured twice via the pinned method on the unchanged tree: 98/98. 98 -> 99 on 2026-08-17: the `council:quota` verb (road-to-council-quota-accounting-truth Phase 2) registers in the same PR that adds the surface, per this record's own contract. Exactly the inference-from-a-filename shape as the council:status entry above, one layer down: `cmd_quota` had existed in council_cli.ts and been reachable only via `scripts-run`, so the documented recovery path for an exhausted shared counter -- read the usage, reset one provider -- did not resolve through `agent-config`, and an operator debugging a quota failure met `unknown command`. The verb is read-only apart from the pre-existing `--reset <provider>`, which already required `--confirm`. Re-measured twice via the pinned method on the unchanged tree: 99/99. 99 -> 100 on 2026-08-19: the `decision:memo` verb (road-to-long-horizon-execution Phase 2.2, sequencing UOTL Phase 4.3 -- the decision-memo channel) registers in the same PR that adds the surface, per this record's own contract. It exists because the question ladder gained a rung between \"halt and ask\" and \"decide silently\": a resolution the run makes without contacting the operator is only legitimate if it is reviewable afterwards, and there was no surface that wrote such a record with a fixed shape. Write-and-list only, local-only (agents/runtime/ is gitignored), and it gates nothing -- the locked decision classes are refused at the config schema, never in the ledger. 100 -> 101 in the same PR: `run:supervise` (Phase 3.1 -- the out-of-process watcher for runs whose session died with open steps left). It is the operator-facing half of session continuity: nothing anywhere had the job of noticing that a claimed run stopped moving, so a roadmap 40% done and a roadmap finished looked identical from outside the dead session. Report-only by default and it NEVER merges, pushes or closes -- the auto-merge the reference design carries is a named rejection in the roadmap's harvest section, not an unbuilt feature. Re-measured twice via the pinned method on the unchanged tree: 101/101. 101 → 102 on 2026-08-22: the `adr:effective` verb (road-to-evidence-based-adr-governance step 2.2 — the effective-state projection over one decision record) registers in the same PR that adds the surface, per this record's own contract. It exists because current truth about an ADR was only reconstructable from linear prose: an agent had to read the body, then every amendment, and decide for itself which clauses still stand. The verb reports status, the Decision verbatim, clauses the record's own amendments superseded, active amendments, the three descriptive axes and the review-trigger state. It AUTHORIZES NOTHING — Phase 2 of that roadmap is titled \"surfacing only; no authority\" and its AC-7 forbids any authority consequence, so the verb reports an absent axis as absent (`— (no provenance axis)`, `— (ungraded)`, `absent → evidence`) and an unresolvable trigger as `indeterminate` rather than inferring one. Re-measured twice via the pinned method on the unchanged tree: 102/102. 102 → 104 on 2026-08-22: the `council:grant-billing` + `council:revoke-billing` verbs (road-to-billing-cliff-gate Phase 2 — the run-scoped billing grant that lets `ai_council.fallback.api_on_quota: 'ask'` be answered once per run instead of once per seat) register in the same PR that adds the surface, per this record's own contract. The two are a pair by construction rather than by convenience: a grant that can be issued and not revoked would outlive its run, which is the failure the run-scoped TTL exists to prevent. Re-measured via the pinned method: 104. 104 -> 106 on 2026-08-23: the `ui:audit` + `ui:render` verbs (road-to-frontend-power E2.1 and E3.1 -- the two Class-A commands that give the frontend obligations an artefact a gate can read and a render a verdict can cite) register in the same PR that adds the surface, per this record's own contract. The two are a pair by construction rather than by convenience: `ui-audit-gate`'s enforced_by moved from `none` to a carrier in the same change, and that carrier reports `verification: degraded` whenever the render artefact is absent -- so an audit verb without a render verb would ship a gate that can never reach `verified`. Both are Class A under ADR-124: they terminate, their whole state is a rebuildable directory under agents/runtime/state/, and ui:render closes chromium in a `finally` on every path with no --serve, watch or cache for a resident browser to hide in. Re-measured via the pinned method on the unchanged tree: 106. 106 → 107 on 2026-08-23: the `roadmap:context` verb (road-to-roadmap-situational-awareness — the single live probe that answers what else is in flight before a roadmap is picked) registers in the same PR that adds the surface, per this record's own contract. Its branch measured 105 against a base of 104 and this branch measured 106 against the same base for `ui:audit` + `ui:render`; the merge makes it 107, re-measured on the merged tree via the pinned method (registry enumeration): 107. 107 → 108 on 2026-08-26: the `roadmap:set-step` verb (road-to-skill-ecosystem-runtime-enforcement Phase 6 — the single sanctioned writer of a checkbox glyph) registers in the same PR that adds the surface, per this record's own contract. It exists because the glyph is written today by whatever edits the file, and a concurrent writer destroys work SILENTLY: the loser of an overwrite receives no error. The verb carries an advisory lock, a line-anchored edit that cannot span entries even in principle, a step-count invariant asserted against the LIVE pre-write file rather than an in-memory snapshot, and a post-write survival check. Re-measured via the pinned method (registry enumeration) on the unchanged tree: 108. 108 → 109 on 2026-08-26: the `stubs:due` verb (road-to-inbox-harvest-2026-08-f-owner-decision-queue step 2.1 — the read-only reader over `agents/roadmaps/stubs/` frontmatter) registers in the same PR that adds the surface, per this record's own contract. It exists because step 1.2 backfills a `review_by:` date into 77 parked files, and an AI council (2026-08-26, 2/2) made the ordering a RULE rather than a preference: dates without a reader are strictly worse than no dates, because a stale date certifies attention nobody paid. The verb is read-only by construction — it authors nothing under `agents/roadmaps/stubs/`, so `check_no_stub_inventory_table` stays green and unmodified, and `roadmap:progress` consumes only its two COUNTS for the dashboard header (two integers, no rows, nothing for the deleted index tables to grow back from). Re-measured via the pinned method (registry enumeration) on the unchanged tree: 109. 109 → 110 on 2026-09-03: the `hooks:effect` verb (road-to-wired-instruments Phase 1.1 — the CLI entry for `hook_effect_doctor`) registers in the same PR that adds the surface, per this record's own contract. It exists because the probe and its five-state vocabulary were built, tested and reachable from nothing: `grep -rn 'hook_effect_doctor|hook_effect_probe' src Taskfile.yml .github` returned only the two modules themselves, and a closed roadmap recorded the wiring as landed at `src/scripts/hooks_doctor.ts:88`, a line that is the closing brace of a filesystem helper in a file with zero references to the probe. Deliberately NOT merged into `hooks:doctor`: that verb reads the MANIFEST (what is declared) and this one reads what happened (what took effect), and the probe's own header names merging them as the thing to avoid — a declaration report and an execution report are different instruments, and merging them makes the cheap one expensive. Read-only apart from a scratch root it removes in a `finally`. Re-measured via the pinned method (registry enumeration) on the unchanged tree: 110."
     },
     "mcp_public_tool_count": {
-      "max": 20,
-      "last_measured": 20,
-      "last_measured_at": "2026-08-17",
+      "max": 25,
+      "last_measured": 25,
+      "last_measured_at": "2026-09-09",
       "method": "tools/list length on the stdio server (post-ADR-132: implemented tools only)",
-      "baseline_note": "19 → 20 on 2026-08-17 (release 13.0.0 gate). The +1 is 866bd9861 (feat(mcp): recover what the host dropped — real ranker tool + a route to it, road-to-inbox-harvest-2026-08-d-runtime-skill-routing Phase 4): `suggest_skill_for_task` was promoted from a discovery STUB to a real ALLOWLIST entry and removed from STUB_TOOLS. Worth stating precisely, because the consumer-visible NAME did not grow — the stub already published that name and its `task` + `limit` input schema, which the promotion carried over verbatim. What grew is the count of tools tools/list actually returns, which is exactly what this metric measures post-ADR-132: implemented tools only. Same shape as the cli_help_command_count history above — this RECORDS growth that already shipped through its own reviewed PR (866bd9861 is on main), it does not authorize new surface. The registering PR did not move this budget, so the gate did its job: the breach warned on main and blocked on the release ref, which is the conscious-decision point rather than a silently raised cap. Re-measured twice via the pinned method on a freshly built dist/mcp/server.mjs: 20/20. Headroom stays zero by design — the next tool that leaves STUB_TOOLS must move this number in its own PR."
+      "baseline_note": "19 → 20 on 2026-08-17 (release 13.0.0 gate). The +1 is 866bd9861 (feat(mcp): recover what the host dropped — real ranker tool + a route to it, road-to-inbox-harvest-2026-08-d-runtime-skill-routing Phase 4): `suggest_skill_for_task` was promoted from a discovery STUB to a real ALLOWLIST entry and removed from STUB_TOOLS. Worth stating precisely, because the consumer-visible NAME did not grow — the stub already published that name and its `task` + `limit` input schema, which the promotion carried over verbatim. What grew is the count of tools tools/list actually returns, which is exactly what this metric measures post-ADR-132: implemented tools only. Same shape as the cli_help_command_count history above — this RECORDS growth that already shipped through its own reviewed PR (866bd9861 is on main), it does not authorize new surface. The registering PR did not move this budget, so the gate did its job: the breach warned on main and blocked on the release ref, which is the conscious-decision point rather than a silently raised cap. Re-measured twice via the pinned method on a freshly built dist/mcp/server.mjs: 20/20. Headroom stays zero by design — the next tool that leaves STUB_TOOLS must move this number in its own PR. 20 → 25 on 2026-09-09 (release 14.23.0 gate). The +5 are `graph_impact`, `graph_tests_for`, `graph_dead`, `graph_query` and `graph_path` — 9452f29b4 (feat(mcp): five graph tools, the pinned install hint, and the skill description; road-to-a-graph-that-is-shipped Phase 4.1), which is on main. They are the agent-facing readers of the code graph: the roadmap Risk-Register rank 1 is \"the install grows and the graph is still unread\", and an agent that has to shell out to reach a verb will not, so the tools ARE the mitigation rather than a convenience. Same shape as every entry above — this RECORDS growth that already shipped through its own reviewed PR; it does not authorize new surface. The registering PR did not move this budget, so the gate did its job again: the breach warned on main and BLOCKED on the release ref, which is the conscious-decision point rather than a silently raised cap. The move is +25%, over the 10% creep rule, and that is the intended reading: five tools in one commit is a surface decision, not creep. Re-measured three times via the pinned method on a freshly built dist/mcp/server.mjs: 25/25/25, the returned name set differing from the 20-tool set by exactly the five graph_* entries. Headroom stays zero by design — the next tool that leaves STUB_TOOLS must move this number in its own PR."
     }
   }
 }

package/src/config/gate-coverage.yml

@@ -64,8 +64,8 @@
 # `road-to-candidate-moves-floor` was that addition. The number is re-measured
 # rather than the tolerance widened: a stated population that nobody re-measures
 # is the un-asserted count this whole manifest exists to refuse.)
-# **78 of them emit the machine-readable `scanned: <N>` line under their
-# CI-identical argv, and 75 of those 78 are listed below.** The manifest is
+# **79 of them emit the machine-readable `scanned: <N>` line under their
+# CI-identical argv, and 76 of those 79 are listed below.** The manifest is
 # complete for every gate that can carry a floor, covering ~25 % of the population.
 #
 # RECOUNTED 2026-09-07, on the change that adds `lint_agent_security` — the
@@ -2365,7 +2365,7 @@ gates:
   - id: check_loss_class_declared
     argv: []
     min_scanned: 45
-    corpus: "every hook-manifest concern whose script exists (53 at baseline); of those, the model-facing lossy subset is the gated population"
+    corpus: "every hook-manifest concern whose script exists (53 at baseline, 58 on 2026-09-10); of those, the CONTEXT-EMITTING ones are walked through their relative module specifiers, and the modules that walk reaches whose code applies a lossy operation are the gated population. Measured 2026-09-10: 58 scanned, 7 emitters, 5 modules matched — 4 declaring a lossy class and 1 declaring `exact`. MATCHED IS NOT LOSSY: the detector establishes a match, the declaration says whether anything is lost, and an earlier version of this row said `5 lossy` and overstated the corpus by one. It read 0 between 2026-09-09 and 2026-09-10, when the hot-context cache retirement emptied the matched subset and the gate passed over nothing. A `loss_module:` pointer refilled it to 1 for part of 2026-09-10 and was superseded by the walk, whose two rejection premises were re-measured and did not hold — see docs/contracts/loss-classes.md."
     status: enforced
     canary:
       class: contract-violation
@@ -2389,11 +2389,14 @@ gates:
       has measurably never ratcheted. Both seats added the refinement adopted
       here: unknown reachability is classified as model-reaching.
 
-      MEASURED AT LANDING: **1** module qualifies — `hot_context_hook`, which is
-      exactly the `ephemeral-lossy` exemplar `docs/contracts/loss-classes.md`
-      classifies. A gated population of one is the honest state of this tree,
-      not a broken detector, and it is why the floor below is set on the SCANNED
-      corpus (53 hook scripts) rather than on the gated subset.
+      MEASURED AT LANDING: **1** module qualified — `hot_context_hook`, the
+      `ephemeral-lossy` exemplar `docs/contracts/loss-classes.md` classifies.
+      MEASURED 2026-09-09, after step 3.1 of road-to-continuity-writer-activation
+      retired that module's cache half: **0**. Setting the floor on the SCANNED
+      corpus rather than the gated subset is what keeps this row meaningful
+      through that drop — but a matched subset of zero means the gate currently
+      proves nothing about any transform, which is tracked as blocker
+      `loss-class-corpus-is-empty-after-hot-context`.
 
       THE DETECTOR READS CODE, NOT PROSE. Its first cut matched `truncat` inside
       three docblocks that describe truncation without performing any and
@@ -2777,3 +2780,23 @@ gates:
       What the ROW buys on top of that is `ci_invocation` — the census had a
       Taskfile target and no caller at all, so its removal would have been
       noticed by nothing.
+
+  - id: check_projected_rule_routes
+    argv: []
+    min_scanned: 100
+    corpus: "dist/agent-src/rules/*.md (119 at baseline, 22 distinct `guideline:` targets)"
+    status: enforced
+    canary:
+      class: contract-violation
+      path: dist/agent-src/rules/zz-canary-projected-route.md
+      content: |
+        ---
+        name: zz-canary-projected-route
+        description: Canary planted by check_gate_coverage --canary; never ships.
+        routes_to: guideline:zz-canary-target-that-does-not-exist
+        ---
+
+        # zz-canary-projected-route
+
+        A projected rule routing to a guideline body the projection does not
+        contain. The gate must fail on this and pass once it is removed.

package/src/config/gate-reachability-exemptions.json

@@ -5,6 +5,7 @@
     "exempt": {
         "ci-strict": "An ENTRY POINT, not a gate — the stricter sibling of `ci` itself, so wiring it into `ci` would be a cycle. Would run if strict became the default, which is a policy change rather than a wiring one.",
         "check-augment-budget": "Emits a MEASUREMENT, not a verdict; a gate that cannot fail is a report. Would run once a pre-registered threshold exists to fail on.",
+    "check-platform-anchor": "THE PERMISSION DOES NOT EXIST, which is a different reason from every other row here — the others are unwired by judgement, this one by platform capability. It reads `repos/{owner}/{repo}/rulesets` to check that the forge actually requires what the ratification mechanism claims, and that endpoint needs the repository `administration` scope. A workflow `GITHUB_TOKEN` cannot be granted it: `administration: read` was tried in `rule-backstops.yml` on 2026-09-10 and actionlint refused it as an \"unknown permission scope\", listing the sixteen that do exist. Wiring it with an unauthorised token is worse than leaving it manual, because the gate fails closed by design — an unreadable platform is UNVERIFIABLE, which is a failure — so it would red every kernel and governance PR for a reason unrelated to the platform's actual state. The three escapes were each rejected on the reasoning of the council that commissioned the gate: `continue-on-error` makes it advisory, skipping when unauthenticated makes it fail open, and `Sync + Generate Tools Consistency` would freeze merges repository-wide on any red since that job's context is the single required check. The script itself IS reachable pre-push via the `preflight` list in `taskfiles/ci-fast.yml`; this target is the on-demand `task check-platform-anchor` entry point beside it. WOULD RUN given a PAT in a repository secret carrying `administration: read` — a human action, recorded as the open half of blocker `ratification-platform-anchor`.",
         "check-corpus": "Requires council configuration, which is user-global (ADR-104) and absent in CI by construction. Would run against a fixture corpus that needs no configured council.",
         "check-media-deps": "Requires external media tooling not installed on runners. Would run with those dependencies in the runner image, or behind a skip-with-reason path.",
         "check-trunk-drift": "ADVISORY BY ITS OWN DOCSTRING — 'run it in the /create-pr pre-flight or wire into CI per your branch-protection policy'. Its red state is 'this branch is behind trunk', which is the normal state of an open PR, so wiring it would fail correct work. RECLASSIFIED from should-run during Phase 2 after reading what it asserts. Would run under a branch-protection policy that requires an up-to-date base.",