@event4u/agent-config 14.22.0 → 15.0.0

package/src/config/gate-violation-baselines.json

@@ -34,9 +34,9 @@
       "note": "The nine active non-draft roadmaps that predate the `relates:` requirement (road-to-agentic-engineering-assurance, road-to-component-library-lifecycle, road-to-council-evidence-integrity, road-to-frontend-fidelity-calibration, road-to-monorepo-scope-and-detection, road-to-observability-plate, road-to-role-scoped-spawn-profiles, road-to-skill-delivery-over-mcp, road-to-standing-payload-diet). This is a NEW obligation rather than a repaired scan root, and the ratchet is the point: `depends:` shipped in the template with nothing requiring it and measured 0 adoption, so requiring `relates:` retroactively across the estate would be an owner-reserved write with no analysis behind the edges it would have to invent (held as step 4.3, deferred). Clearing an entry here is one roadmap at a time: run `agent-config roadmap:context` on it, write the rows the probe surfaces, and lower the count."
     },
     "check_source_size_budget": {
-      "count": 17973,
-      "landed": "2026-09-08",
-      "note": "Lowered 17,974 -> 17,973 on 2026-09-08 by drain/topology-c1. The branch adds a live-path emit to council_cli.ts, which sits 2,454 lines PAST the 1500 cap so every line there is one unit, and paid its own way down rather than raising the baseline, in the way this entry's doctrine prescribes. The twelve-line `all_responses` assembly (a spread, three conditionals and a push) moved out of council_cli.ts into ai_council/deliberation_metrics.ts::runCallsFrom, 353 lines and therefore UNDER the cap, so the six stage labels and their prose cost nothing. It moved on merit rather than only on arithmetic: 'which calls did this run make, and at which stage' is that module's own subject, and the CLI held the list only as a flat array with the stage boundaries implicit in the order -- both readings now come out of one walk, so the billing total and the attribution can never be computed over different sets. council_cli.ts 3,955 -> 3,954 net, after the two call lines, the import and the one payload key the feature needed. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the two new src/ files staged and nothing untracked, so a clean CI checkout of this commit measures the same 17,973. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 18,016 -> 17,974 on 2026-09-07 by fix/single-delivery-unconditional. SETTLED FIGURE, and it supersedes an intra-session 17,962 this same branch committed earlier — read the direction against MAIN, which is what the ratchet protects: main is 18,016, the branch leaves 17,974, net -42. The 17,962 was this branch's own low before a neutral review returned twelve findings; fixing them added a real mechanism to mcp_server and condense.ts (the flat-wrapper carriage gate the review showed was missing, plus its four-skip predicate), and condense.ts sits ~1,215 lines PAST the cap so each of those lines is one unit. Paid down first, in the way this entry's doctrine prescribes: _suggestSkillForTaskHandler and its 18-line docstring moved out of mcp_server/tools.ts (2,079 -> 2,025) into mcp_server/suggest_skill.ts, 72 lines and UNDER the cap, so its prose costs nothing. The residual +12 against the intra-session low is the gate's own output on the settled tree and is recorded rather than engineered away, because the alternative was extracting _nested_command_subpath and its two callers out of condense.ts - which needs MODULE_STATE, _relativeToPosix and _domains_command_logical passed in, a wider diff than the finding warrants and one no review asked for. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the three new src/ files staged and nothing untracked, so a clean CI checkout of this commit measures the same 17,974. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: MERGE RECONCILIATION 2026-09-07, 18,061/18,017 -> 18,016. drain/admissible-council-seats and fix/release-obligation-answerable each lowered from the SAME 18,062 base in parallel — main to 18,061 (net -1: curlJsonPost, the seat-status helpers and the per-seat config parsing moved out of the three over-ceiling council files) and the branch to 18,017 (net -45: the /dev/tty prompt helpers moved out of release.ts into _lib/tty_prompt.ts, 76 lines and UNDER the cap, taking release.ts 1871 -> 1826). Taking either side alone is wrong in a different direction, which is the reconciliation doctrine this entry already carried from 2026-09-03: main's value silently discards the branch's earned -45, and the branch's value RAISES the baseline against main and weakens the gate. The committed number is neither — it is the gate's own output on the MERGED tree, where both reductions apply, and it equals the arithmetic (18,062 - 45 - 1 = 18,016) rather than being reconciled by it. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports ZERO untracked files, so a clean CI checkout of this commit measures the same 18,016. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in the merge commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 18,062 -> 18,061 on 2026-09-07 by drain/admissible-council-seats. The branch's own additions to the three over-ceiling files (ai_council/config.ts, council_cli.ts, ai_council/clients.ts) came in at +96 excess and were paid down to -1 rather than baselined, in the four ways this entry's doctrine prescribes: `curlJsonPost` moved out of clients.ts into ai_council/api_transport.ts (UNDER the cap, so the prose and the three new provider shims cost nothing); the seat-status helpers moved out of council_cli.ts into ai_council/status_surface.ts, taking an orphaned doc comment with them; the three new per-seat config fields' parsing moved out of config.ts into ai_council/seat_policy.ts::parseSeatFields; and three prose blocks that the branch's own transport repair made FACTUALLY FALSE (the `openai` / `google-genai` Python-SDK claims, and a `_curlJsonPost` pointer to a function that had moved) were corrected and shortened in the same change. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports zero untracked files with the five new src/ files staged, so a clean CI checkout of this commit measures the same 18,061. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried here because tests/scripts/check_source_size_budget.test.ts:166 asserts baseline == live and therefore blocks where the gate only advises -- the lowering commit must carry its own baseline update. Lowered 18,068 -> 18,062 on 2026-09-06 by drain/host-enforcement-truth. Collapsing the five per-host binding constants in install.ts into src/scripts/hooks/host_lowering.yaml removed 29 lines from a file ~3,900 past the 1500 cap, where every line costs one excess; the journal's surface column and its extracted migration helper gave 23 back. Lowered 18,245 -> 18,230 on 2026-09-02 by drain/publication-integrity-option-a. Phase 2 Option A moved the authoring instruction out of the generator: release.ts, which sits ~530 lines PAST the 1500 cap so every line there costs one excess, loses the comment emission, a 16-line HEAD_DEFAULT doc block and its alias const, and gains a shorter writer docstring. The doc block moved to _lib/release_material.ts, which is 289 lines and therefore UNDER the cap, so the same prose now costs nothing. Net -15. The branch first came in at +8 and paid its own way down rather than raising the baseline.",
+      "count": 17959,
+      "landed": "2026-09-09",
+      "note": "Lowered 17,963 -> 17,959 on 2026-09-09 by feat/cdd-fidelity-council, on the same shape as the entry below and with the same discriminator. The branch's src-link rewrite (a blind review found 253 of 268 links under dist/agent-src/guidelines/ dead, because condense.ts folded only the docs/ prefixes and never (../)+src/rules|skills) came in at +15 excess: condense.ts sits ~1,208 lines PAST the 1500 cap, so every line there is one unit. Paid down rather than baselined, in the way this entry's doctrine prescribes. `_rewrite_body_links` and its two regex constants moved out of condense.ts into _lib/guidelines_lane.ts, 151 lines and therefore UNDER the cap, so the function and its prose now cost nothing. It moved on merit rather than only on arithmetic: every rule the rewriter applies is a statement about which source tree projects where, which is that module's own subject, and condense.ts held it only because that is where the projector lives. condense.ts 2,712 -> 2,708 net, after the one import line and the one call-site rename -- a branch that ADDED a rewrite rule leaves the file four lines shorter than it found it. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the branch's new src/ files tracked and nothing untracked, so a clean CI checkout of this commit measures the same 17,959. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 17,973 -> 17,963 on 2026-09-08 by drain/graph-shipped-close. The branch registers five code-graph MCP tools (road-to-a-graph-that-is-shipped 4.1). Their five records and schemas are ~250 lines, and putting them in mcp_server/tools.ts -- which sits ~500 lines PAST the 1500 cap, so every line there is one unit -- would have cost ~250 excess. They live in mcp_server/graph_tools.ts instead (~280 lines, UNDER the cap, so they and their prose cost nothing), and tools.ts spreads them into ALLOWLIST in two lines: one import and one `...GRAPH_TOOLS,`. Those two were paid for rather than baselined, in the way this entry's doctrine prescribes: `_strip` and `_resolvePath` -- a whitespace trim and a tolerant realpath, generic by nature -- moved out of tools.ts into mcp_server/path_util.ts, also under the cap. They are imported under their original underscore names, so all 28 call sites are unchanged and a two-function move does not read as a sweep. tools.ts 2,025 -> 2,015: -12 from the extraction, +2 from the registration, net -10 for a branch that ADDED a feature. CORRECTED 2026-09-08 after an independent review checked the figure against the tree -- this sentence read '2,025 -> 2,013, net -12, against the +2 the registration needed', which states an intermediate file length as the final one and leaves the arithmetic (-12) and the conclusion (-10) describing different trees. `git show origin/main:...tools.ts | wc -l` is 2025 and the working tree is 2015. The TOTAL, 17,963, was always the gate's own output and is unchanged. Every other file this branch touches or creates -- code_graph/verbs.ts, code_graph/cli.ts, code_graph/build.ts, code_graph/detect.ts, code_graph/query.ts, code_graph/sqlite_store.ts, code_graph/types.ts, _lib/regression_neighbourhood.ts -- is under the 1500 ceiling before and after, so it contributes zero excess whatever it grew by. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the two new src/ files staged and nothing untracked, so a clean CI checkout of this commit measures the same 17,963. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 17,974 -> 17,973 on 2026-09-08 by drain/topology-c1. The branch adds a live-path emit to council_cli.ts, which sits 2,454 lines PAST the 1500 cap so every line there is one unit, and paid its own way down rather than raising the baseline, in the way this entry's doctrine prescribes. The twelve-line `all_responses` assembly (a spread, three conditionals and a push) moved out of council_cli.ts into ai_council/deliberation_metrics.ts::runCallsFrom, 353 lines and therefore UNDER the cap, so the six stage labels and their prose cost nothing. It moved on merit rather than only on arithmetic: 'which calls did this run make, and at which stage' is that module's own subject, and the CLI held the list only as a flat array with the stage boundaries implicit in the order -- both readings now come out of one walk, so the billing total and the attribution can never be computed over different sets. council_cli.ts 3,955 -> 3,954 net, after the two call lines, the import and the one payload key the feature needed. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the two new src/ files staged and nothing untracked, so a clean CI checkout of this commit measures the same 17,973. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 18,016 -> 17,974 on 2026-09-07 by fix/single-delivery-unconditional. SETTLED FIGURE, and it supersedes an intra-session 17,962 this same branch committed earlier — read the direction against MAIN, which is what the ratchet protects: main is 18,016, the branch leaves 17,974, net -42. The 17,962 was this branch's own low before a neutral review returned twelve findings; fixing them added a real mechanism to mcp_server and condense.ts (the flat-wrapper carriage gate the review showed was missing, plus its four-skip predicate), and condense.ts sits ~1,215 lines PAST the cap so each of those lines is one unit. Paid down first, in the way this entry's doctrine prescribes: _suggestSkillForTaskHandler and its 18-line docstring moved out of mcp_server/tools.ts (2,079 -> 2,025) into mcp_server/suggest_skill.ts, 72 lines and UNDER the cap, so its prose costs nothing. The residual +12 against the intra-session low is the gate's own output on the settled tree and is recorded rather than engineered away, because the alternative was extracting _nested_command_subpath and its two callers out of condense.ts - which needs MODULE_STATE, _relativeToPosix and _domains_command_logical passed in, a wider diff than the finding warrants and one no review asked for. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the three new src/ files staged and nothing untracked, so a clean CI checkout of this commit measures the same 17,974. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: MERGE RECONCILIATION 2026-09-07, 18,061/18,017 -> 18,016. drain/admissible-council-seats and fix/release-obligation-answerable each lowered from the SAME 18,062 base in parallel — main to 18,061 (net -1: curlJsonPost, the seat-status helpers and the per-seat config parsing moved out of the three over-ceiling council files) and the branch to 18,017 (net -45: the /dev/tty prompt helpers moved out of release.ts into _lib/tty_prompt.ts, 76 lines and UNDER the cap, taking release.ts 1871 -> 1826). Taking either side alone is wrong in a different direction, which is the reconciliation doctrine this entry already carried from 2026-09-03: main's value silently discards the branch's earned -45, and the branch's value RAISES the baseline against main and weakens the gate. The committed number is neither — it is the gate's own output on the MERGED tree, where both reductions apply, and it equals the arithmetic (18,062 - 45 - 1 = 18,016) rather than being reconciled by it. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports ZERO untracked files, so a clean CI checkout of this commit measures the same 18,016. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in the merge commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 18,062 -> 18,061 on 2026-09-07 by drain/admissible-council-seats. The branch's own additions to the three over-ceiling files (ai_council/config.ts, council_cli.ts, ai_council/clients.ts) came in at +96 excess and were paid down to -1 rather than baselined, in the four ways this entry's doctrine prescribes: `curlJsonPost` moved out of clients.ts into ai_council/api_transport.ts (UNDER the cap, so the prose and the three new provider shims cost nothing); the seat-status helpers moved out of council_cli.ts into ai_council/status_surface.ts, taking an orphaned doc comment with them; the three new per-seat config fields' parsing moved out of config.ts into ai_council/seat_policy.ts::parseSeatFields; and three prose blocks that the branch's own transport repair made FACTUALLY FALSE (the `openai` / `google-genai` Python-SDK claims, and a `_curlJsonPost` pointer to a function that had moved) were corrected and shortened in the same change. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports zero untracked files with the five new src/ files staged, so a clean CI checkout of this commit measures the same 18,061. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried here because tests/scripts/check_source_size_budget.test.ts:166 asserts baseline == live and therefore blocks where the gate only advises -- the lowering commit must carry its own baseline update. Lowered 18,068 -> 18,062 on 2026-09-06 by drain/host-enforcement-truth. Collapsing the five per-host binding constants in install.ts into src/scripts/hooks/host_lowering.yaml removed 29 lines from a file ~3,900 past the 1500 cap, where every line costs one excess; the journal's surface column and its extracted migration helper gave 23 back. Lowered 18,245 -> 18,230 on 2026-09-02 by drain/publication-integrity-option-a. Phase 2 Option A moved the authoring instruction out of the generator: release.ts, which sits ~530 lines PAST the 1500 cap so every line there costs one excess, loses the comment emission, a 16-line HEAD_DEFAULT doc block and its alias const, and gains a shorter writer docstring. The doc block moved to _lib/release_material.ts, which is 289 lines and therefore UNDER the cap, so the same prose now costs nothing. Net -15. The branch first came in at +8 and paid its own way down rather than raising the baseline.",
       "reason": "Lowered 18,230 -> 18,209 on 2026-09-03 by drain/artifact-location. `doctor --strict` needed 16 lines of integration wiring in cmd_doctor.ts, which sits ~2,100 lines PAST the 1500 cap so every line there costs one excess. The branch first came in at +137 and paid its own way down rather than raising the baseline: the strict semantics, threshold, kill switch, payload helper and argv fragments moved to _cli/_doctor_strict.ts (~160 lines, under the cap, costs nothing), taking it to +15; then the 37-line drift renderer moved to _cli/_doctor_emit.ts. Net -21. The renderer was chosen deliberately: pure rendering, two dependencies, no argparse involvement and therefore none of the byte-parity risk the parser surface carries against the retired Python implementation; nothing outside cmd_doctor.ts imported it. An AI council on the residual split (a: raise by 15 / d: descope the feature); neither was taken, because a parallel branch demonstrated the same day that paying down is achievable in this codebase, which is the evidence the split lacked. This gate's own test comment prescribes it: a commit that splits a god-file lowers the excess and must carry the lowered baseline. MERGE RECONCILIATION 2026-09-03, 18,209 -> 18,205: drain/wired-instruments and drain/artifact-location each lowered from the SAME 18,230 base in parallel -- the branch to 18,226 (net -4, run_continuation_hook.ts's termination ladder moved to _lib/continuation_ladder.ts and runtime_journal.ts's prose to _lib/outcome_vocabularies.ts, both under the cap) and main to 18,209 (net -21, the doctor --strict split above). Taking either side alone is wrong in a different direction: main's value silently discards the branch's earned -4, and the branch's value RAISES the baseline against main and weakens the gate. The committed number is neither -- it is the gate's own output on the merged tree, where both reductions apply. THIS LOCAL READING IS ADMISSIBLE HERE, and the discriminator matters because this file's ci-parity:local-only entry records a 165 -> 164 lowering that was reverted for exactly the opposite case: that count depends on how the environment resolves the projection surface, whereas this gate walks only SOURCE_ROOTS = ['src'] (check_source_size_budget.ts:88) counting excess lines over the 1500 ceiling, and `git status --porcelain -uall -- src/` reported ZERO untracked files, so a clean CI checkout of this commit measures the same 18,205. If CI reads anything else, CI's number is the correct one and this note is the record of why. LOWERED 18,205 -> 18,193 on 2026-09-03 by fix/release-curation-ask. The change adds a fifth publication guard, and its own additions landed at +10 excess: release.ts 2,008 -> 2,018, every line of which is past the 1500 cap. Paid down rather than baselined, in the two ways this gate's doctrine prescribes. The guard's rationale (~13 lines of docstring, including why prMerged is a parameter rather than a call-site if) lives in release_publication.ts, 915 lines and therefore UNDER the cap, so the prose costs nothing; and the two pure text helpers _splitlines and _rstrip moved out of release.ts into release_env.ts (333 lines, also under the cap), taking release.ts to 1,996 -- 12 BELOW where it started. The branch came in at +10 and leaves at -12. Recorded while moving them: _splitlines is duplicated a third and fourth time at adoption_report.ts:106 and readme_linter.ts:418; collapsing all three onto one definition touches three modules and was left out of this change rather than done silently. LOWERED 18,193 -> 18,180 on 2026-09-03 by fix/release-branch-reuse. The step-1 branch decision -- twenty lines of if/else in release.ts -- became one call to checkout_release_branch in release_publication.ts, which is 1,019 lines and therefore UNDER the 1500 cap, so the twenty lines plus a ~35-line rationale now cost nothing. release.ts 1,996 -> 1,983, every one of those lines being past the cap. The drill grew 765 -> 918 for two new scenarios and the snapshot/restore that keeps them from writing the real CHANGELOG, and it is under the cap too. A change that adds a feature and lowers the excess is the shape this gate's doctrine asks for; the alternative was a +13 raise for logic that had no business in the god-file. LOWERED 18,180 -> 18,068 on 2026-09-05 by fix/release-gate-producer-parity. The change wires the governance-mix obligation into the writer and the two local guards and adds a release-gate locality registry; its own additions to release.ts landed at +19 excess, every one of those lines past the 1500 cap. Paid down rather than baselined, in the way this entry's doctrine prescribes: the 132-line test-count-trend unit (_TEST_COUNT_LINE_RE, _TEST_LIST_MAX_BUFFER, _count_from_list_result, _count_tests_current, _previous_test_count_from_changelog, _render_test_trend_line) moved from release.ts into release_publication.ts, which is under the cap and where it now belongs on merit rather than only on arithmetic -- the same diff makes the missing `Tests: N` footer a section-level publication blocker, so the writer that emits the footer and the guard that refuses its absence sit in one module. release.ts 1,983 -> 1,871. All four names are re-exported from release.ts, so tests/scripts/release.test.ts is unchanged. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the ceiling, and `git status --porcelain -uall -- src/` reports ZERO untracked files with the two new src/ files staged, so a clean CI checkout of this commit measures the same 18,068. If CI reads anything else, CI's number is the correct one and this note is the record of why."
     },
     "ci-parity:local-only": {

package/src/config/hook-token-budget.json

@@ -9,7 +9,7 @@
  "per_concern_caps_bytes": {
   "_comment": "Named exceptions above the default, each with its reason. Absent concern = default_cap_bytes.",
   "hot-context": 4096,
-  "hot-context_reason": "400-word working-memory restore, session_start only — one-shot, not per-turn",
+  "hot-context_reason": "memory session-index restore, session_start only — one-shot, not per-turn",
   "handoff-context": 8192,
   "handoff-context_reason": "consume-once handoff injection, deleted after delivery — the one legitimately large one-shot",
   "session-canary": 2048,
@@ -30,13 +30,14 @@
   "session-eol_reason": "one recycle-advisory line, once per session past the committed threshold (road-to-token-economy-recycling 3.2); recording itself emits nothing",
   "skill-route": 512,
   "skill-route_reason": "road-to-inbox-harvest-2026-08-d-runtime-skill-routing 2.1: one line carrying at most three skill ids and their scores - pointers, never bodies. Registered BELOW the 1024 default deliberately: this row is the ceiling that keeps it a pointer line, so a later change that starts injecting descriptions fails the build instead of quietly doubling a per-turn slot that already carries nine other concerns under a 4096-byte sum cap",
-  "rule-inject": 20480,
-  "rule-inject_reason": "road-to-trigger-delivered-rule-bodies 1.1: this concern delivers rule BODIES, not a pointer line, so its ceiling is the per-prompt token cap converted to bytes rather than a measured emission - 5,000 exact-BPE tokens (the p90 of the matched-body-token distribution over tests/eval/routing-matrix, rounded up to 500, reproduced by `model_rule_injection --corpus tests/eval/routing-matrix`) at ~4 bytes/token. Registered ABOVE the 4,096-byte user_prompt_submit and 2,048-byte pre_tool_use slot sums ON PURPOSE, and the mismatch is the finding rather than an oversight: the concern is default-OFF and emits ZERO bytes under every shipped setting, so no slot sum is breached today. The run that flips `lean_projection.mode: delivery` is the run that must move those two slot rows - that is the activation charge step 1.7 defers, and it is recorded here so the flip cannot be taken without meeting it."
+  "rule-inject": 16384,
+  "rule-inject_reason": "LOWERED 20480 -> 16384 on 2026-09-08, R2 finding 3. THE OLD PAIR WAS TWO STATISTICS IN TWO UNITS, not one decision: this row and `hooks/rule_inject_hook.ts::CAP_BYTES` carried the p90 of the matched-body TOKEN distribution rounded to 500 tok and converted at ~4 B/tok (5,000 tok -> 20,480 B), while `per_slot_sum_caps_bytes.user_prompt_submit` carries the p90 gate-open FIRE SIZE in bytes rounded up to 512 (16,384 B) \u2014 the activation charge owner ruling E2 specifies for the flipping run. One concern licensed 25% above the whole slot's registered sum, on a slot carrying 12 other concerns, made the overrun DESIGNED IN: measured max fire was 20,406 B and 38 of 330 corpus fires exceeded 16,384 B. Reconciled DOWNWARD, never by raising the slot: the charge is the owner-specified number and the concern now conforms to it instead of exceeding it. MEASURED COST of the lowering, over the frozen `tests/eval/routing-matrix` corpus with the command path included (330 fires): p90 16,865 -> 14,507 B, max 20,406 -> 16,348 B, fires truncated 33 -> 45, rule bodies dropped to fit the cap 63 -> 88. So 25 further bodies are withheld on the top-decile fires, where five or more rules matched at once \u2014 a delivery reduction, stated rather than implied, and the endpoints do not measure it (`b-recall` scores `matchTierRules`, not `selectForInjection`). WHAT ENFORCES WHAT, because the finding correctly asked: `CAP_BYTES` is enforced at emission by `selectForInjection`, which drops whole bodies to stay under it, so a fire is TRUNCATED and never over-emitted. The per-slot sums here are an AUTHORING-time control read by `bench_hook_injection`; the only runtime enforcement is `per_turn_aggregate_bytes.ceiling_bytes` in `hooks/injection_budget.ts`, which drops lowest-severity advisories and does not read a per-slot row. And the bench cannot see a real fire from this concern at all: it runs each concern under AGENT_CONFIG_REPLAY=1, which re-imposes the settings gate, and this repository carries no `.agent-settings.yml`, so the concern measures 0 B there. The CROSS-CONCERN residue is therefore still unbounded by any acting gate \u2014 it is now bounded in the authoring record rather than guaranteed to breach, which is a smaller claim than closure and is the honest one."
  },
  "per_slot_sum_caps_bytes": {
   "_comment": "Cross-concern per-fire sum per slot (roadmap 3.1). session_start is one-time and may carry the restore payloads; per-turn slots stay tight.",
   "session_start": 16384,
-  "user_prompt_submit": 4096,
+  "user_prompt_submit": 16384,
+  "user_prompt_submit_reason": "RAISED 4096 -> 16384 on 2026-09-07 by road-to-delivery-for-every-host 3.2, under owner ruling E2, which assigns this move to the run that flips `lean_projection.mode: delivery` and is the activation charge the `rule-inject` row below defers to it. THE NUMBER IS MEASURED, NOT CHOSEN: 16,384 is the p90 gate-open fire size of the delivery concern over the frozen `tests/eval/routing-matrix` corpus rounded UP to 512 bytes, exactly as E2 specifies. Distribution over 318 gate-open fires: p50 6,674 B, p90 16,188 B, max 20,406 B. Reproduce it from `_lib/rule_injection.ts::matchTierRules` + `selectForInjection` at `hooks/rule_inject_hook.ts::CAP_BYTES` over that corpus. NOT config weakening, and the guard agrees by its own classification: `hooks/block_config_weakening.ts:96-98` classifies `*-budget.json` as `advisory`, so its decide() path returns `warn` and never a block — treat that warning as expected and documented. `pre_tool_use` is deliberately NOT raised alongside it: the concern's binding on that slot was REMOVED in the same change, so nothing new emits there and its 2,048 stands.",
   "pre_tool_use": 2048,
   "post_tool_use": 2048,
   "stop": 2048,
@@ -64,10 +65,10 @@
    "agent_error"
   ],
   "excluded_slots_rationale": "session_start is excluded BY THE STEP: it is the one-shot restore slot that legitimately carries hot-context, handoff-context and the canary contract, and capping it against a per-turn number would evict exactly the payloads it exists to deliver. The other three are not per-turn events at all.",
-  "ceiling_bytes": 47104,
-  "ceiling_derivation": "NOT a fresh number, and deliberately so: it is the arithmetic consequence of the per_slot_sum_caps_bytes rows already registered above — 4096 + (2048 + 2048) x 10 + 2048. A tighter per-turn ceiling would contradict per-slot rows that are already the committed decision, and a looser one would let the composition exceed what every part was capped at. Tightening it is a decision about those rows, taken there, in a PR.",
+  "ceiling_bytes": 59392,
+  "ceiling_derivation": "NOT a fresh number, and deliberately so: it is the arithmetic consequence of the per_slot_sum_caps_bytes rows already registered above — 16384 + (2048 + 2048) x 10 + 2048. A tighter per-turn ceiling would contradict per-slot rows that are already the committed decision, and a looser one would let the composition exceed what every part was capped at. Tightening it is a decision about those rows, taken there, in a PR.",
   "gate_on_ceiling": false,
-  "gate_on_ceiling_rationale": "The bench REPORTS the aggregate but does not red the build on it yet — the first-reading discipline the latency twin's observe_only flag encodes. Measured 2026-08-19 under the committed fixtures: ~1,142 B against a 47,104 B ceiling, i.e. the row is registered roughly forty times above any reading that exists. The reading MOVES between runs — 922, 1,140 and 1,142 B observed within one hour — and the mechanism is worth naming precisely rather than as 'flaky': the stop-slot end-review-nudge sizes its line from the branch's own mutation volume, and replay skips its writes but not its reads, so the number grows as the working branch grows. That is a pre-existing bench non-determinism this row surfaces rather than introduces, and it is the strongest single reason not to arm the ceiling against it. Arming a ceiling nobody has ever approached would gate on an untested inequality. Runtime enforcement is NOT gated by this flag and is always on: this flag governs CI, the ceiling governs the live session.",
+  "gate_on_ceiling_rationale": "The bench REPORTS the aggregate but does not red the build on it yet — the first-reading discipline the latency twin's observe_only flag encodes. Measured 2026-08-19 under the committed fixtures: ~1,142 B against the 47,104 B ceiling that applied then, i.e. the row is registered roughly forty times above any reading that exists. The ceiling has since become 59,392 B, following the `user_prompt_submit` slot raise above; the measurement is left at its original date rather than restated, and the headroom the sentence describes only widened. The reading MOVES between runs — 922, 1,140 and 1,142 B observed within one hour — and the mechanism is worth naming precisely rather than as 'flaky': the stop-slot end-review-nudge sizes its line from the branch's own mutation volume, and replay skips its writes but not its reads, so the number grows as the working branch grows. That is a pre-existing bench non-determinism this row surfaces rather than introduces, and it is the strongest single reason not to arm the ceiling against it. Arming a ceiling nobody has ever approached would gate on an untested inequality. Runtime enforcement is NOT gated by this flag and is always on: this flag governs CI, the ceiling governs the live session.",
   "honest_null_consequence": "If the census shows real turns sitting near the ceiling, the per-slot rows move first and this row follows from them. If real turns never approach it, the row is a bound that costs nothing and the finding is published at review date either way."
  },
  "injection_load_metric": {

package/src/config/host-injection-effect.json

@@ -4,8 +4,8 @@
     "state": "unobserved",
     "host_version": null,
     "transcript": null,
-    "date": null,
-    "reason": "The delivery mechanism is measured for EQUIVALENCE (579/579 then 616/616 byte-equal deliveries, docs/CLAIMS.md) and for cost, and neither is what E3 asks for. E3 wants one transcript in which the model VISIBLY ACTS on a delivered body, and no such transcript exists: `lean_projection.mode` resolved to `eager-all` for the whole recorded history, so the concern emitted zero bytes in every session on record. Recording `observed-true` from the byte-equality measurement would be exactly the documentation-is-not-admission move K1 forbids, one layer in."
+    "date": "2026-09-10",
+    "reason": "UPDATED 2026-09-10. The premise of the earlier reason is now FALSE and the state is unchanged, which is the finding. That reason said the concern had emitted zero bytes in every session on record because `lean_projection.mode` resolved to `eager-all` throughout. It has now delivered: with `mode: delivery` set locally, a live Claude Code session (2.1.268) received 2 rule bodies / 7,685 B on `user_prompt_submit`, and later in the same session 4 bodies / 16,314 B. So delivery into a live model context is no longer the open question. AN INDEPENDENT READER — a fresh context that did not produce the turn — was given the transcript and a neutral three-way question, and returned ACTED, with a qualification it raised itself and which is why this row is NOT `observed-true`: \"the ACTED verdict rests on 'referring to its substance', not on 'doing something it asks for'\". The model quoted the injection's own byte count (a string the reader confirmed appears nowhere else in the transcript, so the reference is demonstrable) and treated the payload as an OBJECT OF STUDY. On the two delivered rules' actual obligations it returned NONE: no point in the turn surfaces a source discrepancy (`cross-source-consistency`) or classifies the prompt continuation-vs-interrupt (`user-interrupt-priority`). E3 asks for a model that VISIBLY ACTS ON a delivered body; citing that a body arrived is not that, and it is especially not that when the observed turn was one that had been WAITING for the delivery — which makes the reference cheap and is the K1 shape one layer further in. A STRUCTURAL LIMIT THE READER ALSO FOUND, and it bounds what any future attempt can prove: thinking blocks are recorded with length 0 in the transcript, so an internal application of a delivered rule is invisible by construction. Only externally visible behaviour can ever satisfy E3 here. The language pin delivered in the same payload is separately COINCIDENT rather than acted on — the prompt was German anyway, and the pin's own text concedes its trigger is not observable from the transcript."
   },
   "_cursor_md_tree_loaded": {
     "state": "unobserved",

package/src/config/pack-size-budget.json

@@ -7,15 +7,16 @@
     "measurement_conditions": "npm pack --dry-run --json --ignore-scripts, run at the repo root on a clean checkout. `--ignore-scripts` means NO build runs, so dist/cli, dist/ui, dist/mcp and dist/hooks are absent and the figure covers only the TRACKED payload (src/scripts/, dist/agent-src/, dist/install/, docs/guidelines/, templates). That is deliberate: this gate is always-on for every PR, and the tracked content tree is exactly the surface that grows by accretion. The built artifact is ~5.4 MB larger and is NOT gated — corrected 2026-08-24. This sentence named `evaluator-budgets.unpacked_size_mb` as a release-time gate; that key was removed by maintainer decision on 2026-08-04 (see `_comment`). `evaluator_umbrella.sh` still measures and records the figure as evidence, so the number exists and nothing enforces it. That is the honest state and it is deliberate.",
     "budgets": {
         "packed_size_mb": {
-            "max": 9.1,
-            "last_measured": 8.475,
+            "max": 11.5,
+            "last_measured": 10.509,
             "baseline_note_2026_08_23": "8.4 → 9.2 re-baselined 2026-08-23. RATCHET RESET, not the config bent around a failing check: the cap was exhausted at TRUNK level before the tripping branch existed. MEASURED on clean clones under the documented conditions — origin/main at f16c7d9df reads 8.3911, i.e. 8.9 KB under its own cap; PR #1597 reads 8.4083 local / 8.416 CI, +17.2 KB across 4 new pack entries of functional source its roadmap deliberately adds. With 8.9 KB of headroom ANY commit reds this gate, which is the failure the 2026-08-20 note predicted in writing, arriving a second time three days later. Max = 8.4083 × 1.095, derived from this file's own regression_pct: 10 rather than from the tripping measurement; last_measured records CI's 8.416, the enforcing environment and the higher of the disagreeing pair. GIVEN UP: ~0.79 MB of unpoliced accretion — this gate catches a step change in payload, which regression_pct still catches at any cap, and it cannot police 17 KB increments. REJECTED, measured rather than argued: payload reduction inside the PR — the whitelist is already tight (docs/guidelines/ plus three named contracts), tests/ is 6 KB and agents/ 39 KB uncompressed, so excluding both saves ~13 KB compressed and does not clear even this one PR. The structural surface the 2026-08-20 note named (src/scripts/ at 14.9 MB unpacked, src/agent-src/ duplicating dist/agent-src/) is still unexamined and still the open debt this raise defers. Revisit-if: a single PR moves the figure by more than regression_pct, or the drain ends and the cap can ratchet DOWN from a re-measured trunk — never up again from a fresh trip. DECIDED BY: maintainer, numbered-options option 1, after the alternative above was measured and the exhaustion was reported rather than the cap raised silently.",
             "method": "npm pack --dry-run --json --ignore-scripts → dist.size / 1e6 (the compressed tarball a consumer actually downloads)",
             "baseline_note_2026_08_24": "8.4 → 9.1 re-baselined 2026-08-24, and this is a RATCHET RESET rather than the config bent around a failing check. The discriminator this file demands, answered with a measurement rather than an argument: THE TRUNK WAS ALREADY AT THE CEILING BEFORE THE CHANGE THAT TRIPPED IT EXISTED. `origin/main` at f16c7d9df measures 8.3911 under the documented conditions — 8.9 KB of headroom against an 8.4 cap, i.e. 0.1 %. An addition of any size crosses it. That is verbatim the failure mode the 2026-08-20 note predicted in writing — 'a cap pinned just above the measurement reds on the next commit and teaches the reader to raise it again' — arriving on schedule for the SECOND time, which is why the correction here is the headroom and not the payload. TRIP CAUSE: merging `origin/main` into `drain/chained-clip-continuity` (PR #1598). The branch adds ~2,600 net lines inside packed paths — `src/scripts/lint_adapter_tier.ts` (662 lines; it is the gate that verifies the generated tier table in `docs/contracts/provider-lifecycle.md`, so it must ship), the ai-video adapter / seam-plan / stitch shell libraries, and the `model-capabilities/*.json` files read at runtime — landing 39 KB over the cap. NEITHER SIDE WAS OVER ALONE; together they cross, which is the shape a merge produces and no per-branch check can see. MEASURED, on two clean detached worktrees with unbuilt `dist/` per `measurement_conditions` (so dist/cli, dist/ui, dist/mcp and dist/hooks absent): main 8.3911 (2,746 entries) · branch 8.4305 (2,753 entries) · CI 8.439 (Consistency job 97266868959). `last_measured` records CI's 8.439 — the enforcing environment and the higher of the disagreeing pair, per the rule the 2026-08-10 and 2026-08-20 notes both applied to their own; the ~8 KB CI-over-local gap matches the pattern both recorded. The 10 % regression rule did NOT trip (threshold 8.586 against the prior `last_measured` 7.805); only the absolute cap did. Max set to 9.1, ~7.8 % headroom over 8.439, which is the ~8 % the 5.903/6.4, 7.238/7.8 and 7.805/8.4 pairs all carried: deliberately not a number that merely clears. ALTERNATIVE EXAMINED AND NOT TAKEN, measured rather than argued, and its verdict left HONESTLY OPEN: excluding `src/scripts/ai_council/` — the tree the 2026-08-20 note names as the one whose consumer need is 'unverified', 0.903 MB as measured here — saves 270 KB compressed (8.4305 → 8.1607, under the OLD cap with 239 KB to spare). It is not taken here because whether it is SAFE is still undecided, and this note deliberately does not decide it. `src/server/routes/wizard.ts:48` imports `apiOnQuotaView` from `scripts/ai_council/transport_resolver.js`, and `council:status` is a registered verb in `src/cli/registry.ts` — but the specifier ends in `.js` and therefore cannot settle whether it resolves to the TS source under `src/scripts/` or to built output under `dist/` in a published install. An earlier draft of this note asserted that the exclusion 'breaks the wizard quota view in every consumer install'; that was an over-claim read off the specifier, and it is retracted here rather than quietly dropped. What IS established: `src/cli/python/workspace_hosts.ts:180-191` records a real `ERR_MODULE_NOT_FOUND` in a global install caused by a shipped module importing from a directory absent from `files[]`, and `src/server/routes/wizard.ts:136-137` invokes `bash src/scripts/install_anthropic_key.sh` BY PATH at runtime. So a blanket trim of `src/scripts/` is unsafe, while the ai_council-specific verdict needs a global-install smoke test rather than a reading of an import. THE DEBT IS NOW WRITTEN DOWN, which is the one thing the 2026-08-20 note promised and did not deliver: it said 'this raise buys the time to write one [a roadmap]', and no roadmap was ever written — a grep of `agents/roadmaps/` (active, `stubs/`, `later/`, `archive/`) finds no payload-reduction plan. `agents/roadmaps/archive/road-to-npm-payload-reduction.md` lands in this same change and carries the measured split: `src/scripts/` is 16.384 MB of the 28.604 MB unpacked payload (57.3 %, 1,158 files) and is the actual growth surface; `dist/agent-src/` is 8.040 MB; `src/agent-src/` is 1.347 MB and partly duplicates it, unmeasured until that roadmap's Phase 1.3. Its Phase 2.3 lowers this cap again, so `max: 9.1` still standing later is the visible signal the plan did not finish. [AMENDED 2026-08-24 by the run that finished it, because that sentence would otherwise mislead in the opposite direction: the plan DID finish, and 9.1 is now its RESULT rather than its deferral signal — see baseline_note_2026_08_24_lowered. The roadmap path in this sentence was rewritten from agents/roadmaps/ to agents/roadmaps/archive/ by the archival ref-migration, so a dated note now points at a path that did not exist on its own date; the migration is kept because the reference must resolve, and it is flagged here rather than left to read as if the file had always been archived.] A raise that defers the same debt a fourth time with no plan is a formality, so this one carries the plan. DECIDED BY: maintainer, on the PR that tripped it, chosen from numbered options carrying the measurements above rather than applied to make a red go away — and the write itself was performed by the maintainer, because the block-config-weakening guard refused four agent attempts at this file. That is the standing this file's `owner: maintainer` requires, enforced rather than asserted. MET A SECOND, INDEPENDENT RESET IN A MERGE, 2026-08-24: the drain's council-evidence-integrity branch reached the same diagnosis from the same measurement (main at 8.3911, 8.9 KB of headroom) and set 9.2 instead of 9.1, landing on trunk first. The HIGHER cap prevails and BOTH derivations are kept, because two independent readings converging on one trip cause is the strongest evidence this entry has ever carried — and dropping one of them would leave the record looking like a single unreviewed judgement. `last_measured` is re-measured on the merged tree rather than taken from either side, per the method every prior entry here prescribes.",
             "baseline_note_2026_08_20": "7.8 → 8.4 re-baselined 2026-08-20, and this is a RATCHET RESET rather than the config bent around a failing check — the discriminator the 2026-08-10 note demands, answered here. TRIP CAUSE: nothing was added. `origin/main` at cfd8426d9 measures 7.7916 under the documented conditions, and CI reads ~7 KB above the local figure, so trunk itself already stood ~8 KB below a 7.8 cap before the release branch existed; the 14.6.0 CHANGELOG entry (6.3 KB — a file on the release-PR shape allowlist, i.e. the release's own permitted payload) is what crossed it, at 7.7979 local / 7.805 CI. That is precisely the failure mode the 2026-08-10 note predicted in writing — 'a cap pinned just above the measurement reds on the next commit and teaches the reader to raise it again' — arriving on schedule, which is why the correction here is the headroom and not the payload. MEASURED, on a clean clone of each tree with the method `measurement_conditions` documents (unbuilt dist/, so dist/cli, dist/ui, dist/mcp and dist/hooks absent): main 7.7916 · release/14.6.0 7.7979 · CI 7.805 (Consistency job 96239721013). `last_measured` records CI's 7.805 — the enforcing environment and the higher of the disagreeing pair, per the same rule the 2026-08-10 note applied to its own. Max set to 8.4, ~7.6 % headroom over 7.805, which is the ~8 % both the 5.903/6.4 and 7.238/7.8 pairs carried: deliberately not a number that merely clears. ALTERNATIVE EXAMINED AND REJECTED, measured rather than argued: forcing the CHANGELOG era split early — the one payload reduction that IS on the release-PR allowlist, so it could have landed without touching main at all — moves the 144-line 14.5.0 section (7,266 bytes) into `docs/archive/`, which sits outside `files[]`. It saves 1.0 KB compressed (7.7979 → 7.7969). Prose compresses; a ~7 KB deficit cannot be closed by relocating 7 KB of prose. Recorded so it is not re-proposed as the cheap fix it looks like. NOT EXAMINED HERE, and named as the open question this raise defers rather than answers: `src/scripts/` is 14.9 MB of the 26.0 MB unpacked payload and is the actual growth surface, `src/agent-src/` partly duplicates `dist/agent-src/`, and whether a consumer needs the 846 KB `src/scripts/ai_council/` tree at all is unverified. Each is a structural change with its own blast radius, not a release-time edit — that belongs in a roadmap, and this raise buys the time to write one. A debt this note records, not one it discharges. DECIDED BY: maintainer, on the release that tripped it, in its own PR against main — `src/config/pack-size-budget.json` is not on the release-PR shape allowlist, so this cannot ride the release branch and is not smuggled into one.",
             "baseline_note_2026_08_10": "6.9 → 7.8 re-baselined 2026-08-10. WHICH OF THE TWO THIS IS, stated because the guard asks: a RATCHET RESET, not the config bent around a failing check — and the discriminator is that the payload is real and needed rather than that the check was inconvenient. The 44 KB is two source files a shipped instruction depends on, the cheaper alternative was examined and rejected on that ground (below), the new cap carries ~8% headroom over the higher of two disagreeing measurements rather than clearing by a hair, and the raise was put to the maintainer as a decision instead of applied to make a red go away. A reader who disagrees has everything needed to reverse it: the measurement, its method, the trip cause, and the rejected option. Maintainer-decided in the PR that tripped it, surfaced rather than smuggled — the same standing this file's `owner: maintainer` requires. MEASURED TWICE, and the two do not agree: CI reported 6.907 on this exact commit, a local run under the documented conditions reports 7.238. The 331 KB gap is UNEXPLAINED — the tree matches the pushed commit and only this file differs — so the cap is set over the HIGHER figure rather than the convenient one, and the discrepancy is recorded here as an open question instead of resolved by assumption. A third party reproducing this should expect either number and should not treat the lower one as authoritative. Separately, and this part IS understood: `npm pack --dry-run --ignore-scripts` in a worktree that has been BUILT reads 8.45, because the flag assumes dist/cli, dist/ui, dist/mcp and dist/hooks are absent and a built tree has them. That figure is not comparable to this budget and must never be written here — recorded because it is a trap the documented method invites. Trip cause: road-to-conformance-round5 Phase 3 added src/scripts/hooks/turn_end_gate_hook.ts (32 KB) and src/scripts/measure_turn_end_gate.ts (12 KB) in packed paths plus schema/template/contract growth, landing 7 KB over a 6.9 cap. Max set to 7.8 (~8% headroom over 7.238, and ~13% over CI's 6.907) for the reason the 2026-08-05 note already gives: a cap pinned just above the measurement reds on the next commit and teaches the reader to raise it again. ALTERNATIVE EXAMINED AND REJECTED, so it is not re-proposed: dropping measure_turn_end_gate.ts from the pack would have cleared the cap with room, but the settings description added in the same change instructs CONSUMERS to run that script against their own transcript store before arming the gate — excluding it would break a shipped instruction.",
             "baseline_note": "5.903 → 6.398 re-baselined 2026-08-05. This is a RE-BASELINE, not a carve-out for the change that tripped it: measured on the tracked tree, `origin/main` alone was already at 6.372 of a 6.4 cap, so 28 KB of headroom remained after months of accretion and the next legitimate addition of any size was going to cross it. The addition here is 26 KB — docs/contracts/settings-classes.md (the A/B/C fence, read at RUNTIME by the settings writer, so it must ship) plus src/server/io/yamlIO.ts (imported by that writer to preserve the user's comments). CI measures ~4 KB above the local figure because it regenerates dist/agent-src first. Max set to 6.9 rather than to a number that merely clears: a cap pinned 2 KB above the measurement reds on the next commit and teaches the reader to raise it again, which is how a budget becomes a formality. That restores the ~8% headroom the 5.903/6.4 pair originally carried. The `owner: maintainer` on this file stands — this raise is surfaced in the PR for that decision, not smuggled.",
-            "baseline_note_2026_08_24_lowered": "9.2 -> 9.1 LOWERED 2026-08-24 — the first DOWNWARD move in this file's history, and the reason it is possible is that road-to-npm-payload-reduction measured the lever the previous four raises kept deferring. Method, because the verdicts turn on it: a behavioural global-install harness (src/scripts/pack_install_smoke.ts) packs a real BUILT tarball, installs it into a throwaway prefix, and runs eleven consumer probes including the bash orchestrator FROM the installed tree, which is the only probe that exercises path-reachability rather than imports. Sensitivity was proven by sabotage before any verdict was trusted: excluding src/scripts/_lib/ produces ERR_MODULE_NOT_FOUND on four probes. WHAT THE BISECT FOUND, and it retires a suggestion this file has carried since 2026-08-20: EVERY named subtree SHIPS. src/scripts/ai_council/ — the 270 KB candidate the 2026-08-24 note left explicitly undecided — breaks council:status AND hooks:status with ERR_MODULE_NOT_FOUND. So does src/scripts/hooks/ (271.5 KB), src/scripts/_cli/ (204.1 KB), src/agent-src/ (101.8 KB), src/scripts/ai-video/ (95.4 KB, its shell entry point), src/scripts/mcp_server/ (53.1 KB). Two of those first read GREEN and flipped RED when the probe set was widened with mcp:setup and an ai-video shell check — recorded because it is the exact false-negative shape this file's own Risk 2 names, caught rather than shipped. WHAT IS ACTUALLY REMOVABLE is three FILE PATTERNS, not subtrees, and no prior note looked for them: dist/**/*.map (323.5 KB), dist/agent-src/skills/**/evals/** (56.2 KB), src/**/*.test.ts + *.spec.ts (22.6 KB) — 402.9 KB on the built tarball, all eleven probes green together. MEASURED under this file's own documented conditions (npm pack --dry-run --ignore-scripts, clean unbuilt worktree, which is what check_pack_size reads): 8.5596 -> 8.4667 MB, 2,775 -> 2,609 entries, a 92.9 KB drop. The gap between 402.9 KB and 92.9 KB is not a discrepancy: most of the .map saving lives in dist/cli, dist/ui, dist/mcp and dist/hooks, which --ignore-scripts excludes by design. HEADROOM IS 7.4 %, NOT 8 %, and the number is stated exactly rather than rounded up to match the pattern: 9.1 over the CI-adjusted 8.475 (local 8.4667 plus the ~8 KB CI delta every prior note here records) is 7.37 %. The 5.903/6.4, 7.238/7.8, 7.805/8.4 and 8.439/9.1 pairs carried ~8 %; this one carries slightly less, which is a real if small increase in flake risk and is why the falsifier below names it. STILL OPEN, quantified for the first time: src/agent-src/ is 94.2 % byte-identical to dist/agent-src/ (284 of 297 files, 2,144,870 of 2,276,707 bytes, content-hash diff). Two prior notes called this 'partial'; it is near-total. It is NOT removable by exclusion — nine shipped scripts under src/scripts/ import through it (build_archive_index, check_estate_count, eval_ui_triviality, explain_run, lint_ui_stack_bundles, skill_usage_report, smoke_quickstart, telemetry_disclosure_hook, utilization_report) while dist/agent-src/ is the tree the installer deploys, so the two copies ship for different reasons. Repointing those imports at dist/ would make source depend on a generated projection, which src/rules/source-of-truth.md exists to prevent. AI council 2026-08-24, 2/2: that needs an ADR covering compiled script entry points and asset resolution, not another files[] experiment. Worth ~102 KB and deliberately not taken here. TRADE-OFF ACCEPTED, named rather than absorbed: excluding dist/**/*.map means published packages carry no source maps, so consumer stack traces show compiled names. GREEN here means 'no regression across the recorded eleven-probe matrix', never 'semantically equivalent'. REVISIT-IF: three clean CI runs measure above 9.1 (the method does not match the gate); or observed run-to-run variance exceeds the 7.4 % margin, making the ratchet noise rather than a floor; or the src/agent-src/ ADR lands and the cap can drop again. NEVER raise it again from a fresh trip without the discriminator the 2026-08-10 note demands. DECIDED BY: AI council 2026-08-24, 2/2 convergent (anthropic/claude-sonnet-4-5 + openai/codex-default, 2 rounds, blind peer review), on a maintainer delegation of owner-reserved blockers for an autonomous drain run. Both seats independently required the 7.4 % to be stated exactly and the GREEN to be scoped to the probe matrix."
+            "baseline_note_2026_08_24_lowered": "9.2 -> 9.1 LOWERED 2026-08-24 — the first DOWNWARD move in this file's history, and the reason it is possible is that road-to-npm-payload-reduction measured the lever the previous four raises kept deferring. Method, because the verdicts turn on it: a behavioural global-install harness (src/scripts/pack_install_smoke.ts) packs a real BUILT tarball, installs it into a throwaway prefix, and runs eleven consumer probes including the bash orchestrator FROM the installed tree, which is the only probe that exercises path-reachability rather than imports. Sensitivity was proven by sabotage before any verdict was trusted: excluding src/scripts/_lib/ produces ERR_MODULE_NOT_FOUND on four probes. WHAT THE BISECT FOUND, and it retires a suggestion this file has carried since 2026-08-20: EVERY named subtree SHIPS. src/scripts/ai_council/ — the 270 KB candidate the 2026-08-24 note left explicitly undecided — breaks council:status AND hooks:status with ERR_MODULE_NOT_FOUND. So does src/scripts/hooks/ (271.5 KB), src/scripts/_cli/ (204.1 KB), src/agent-src/ (101.8 KB), src/scripts/ai-video/ (95.4 KB, its shell entry point), src/scripts/mcp_server/ (53.1 KB). Two of those first read GREEN and flipped RED when the probe set was widened with mcp:setup and an ai-video shell check — recorded because it is the exact false-negative shape this file's own Risk 2 names, caught rather than shipped. WHAT IS ACTUALLY REMOVABLE is three FILE PATTERNS, not subtrees, and no prior note looked for them: dist/**/*.map (323.5 KB), dist/agent-src/skills/**/evals/** (56.2 KB), src/**/*.test.ts + *.spec.ts (22.6 KB) — 402.9 KB on the built tarball, all eleven probes green together. MEASURED under this file's own documented conditions (npm pack --dry-run --ignore-scripts, clean unbuilt worktree, which is what check_pack_size reads): 8.5596 -> 8.4667 MB, 2,775 -> 2,609 entries, a 92.9 KB drop. The gap between 402.9 KB and 92.9 KB is not a discrepancy: most of the .map saving lives in dist/cli, dist/ui, dist/mcp and dist/hooks, which --ignore-scripts excludes by design. HEADROOM IS 7.4 %, NOT 8 %, and the number is stated exactly rather than rounded up to match the pattern: 9.1 over the CI-adjusted 8.475 (local 8.4667 plus the ~8 KB CI delta every prior note here records) is 7.37 %. The 5.903/6.4, 7.238/7.8, 7.805/8.4 and 8.439/9.1 pairs carried ~8 %; this one carries slightly less, which is a real if small increase in flake risk and is why the falsifier below names it. STILL OPEN, quantified for the first time: src/agent-src/ is 94.2 % byte-identical to dist/agent-src/ (284 of 297 files, 2,144,870 of 2,276,707 bytes, content-hash diff). Two prior notes called this 'partial'; it is near-total. It is NOT removable by exclusion — nine shipped scripts under src/scripts/ import through it (build_archive_index, check_estate_count, eval_ui_triviality, explain_run, lint_ui_stack_bundles, skill_usage_report, smoke_quickstart, telemetry_disclosure_hook, utilization_report) while dist/agent-src/ is the tree the installer deploys, so the two copies ship for different reasons. Repointing those imports at dist/ would make source depend on a generated projection, which src/rules/source-of-truth.md exists to prevent. AI council 2026-08-24, 2/2: that needs an ADR covering compiled script entry points and asset resolution, not another files[] experiment. Worth ~102 KB and deliberately not taken here. TRADE-OFF ACCEPTED, named rather than absorbed: excluding dist/**/*.map means published packages carry no source maps, so consumer stack traces show compiled names. GREEN here means 'no regression across the recorded eleven-probe matrix', never 'semantically equivalent'. REVISIT-IF: three clean CI runs measure above 9.1 (the method does not match the gate); or observed run-to-run variance exceeds the 7.4 % margin, making the ratchet noise rather than a floor; or the src/agent-src/ ADR lands and the cap can drop again. NEVER raise it again from a fresh trip without the discriminator the 2026-08-10 note demands. DECIDED BY: AI council 2026-08-24, 2/2 convergent (anthropic/claude-sonnet-4-5 + openai/codex-default, 2 rounds, blind peer review), on a maintainer delegation of owner-reserved blockers for an autonomous drain run. Both seats independently required the 7.4 % to be stated exactly and the GREEN to be scoped to the probe matrix.",
+            "baseline_note_2026_09_10": "9.1 -> 11.5 on 2026-09-10. RATCHET RESET on a measured UNBUILT reading, decided by an AI council over three rounds under an owner delegation and recorded in ADR-273. Derivation is this file's own documented formula, not a number picked to clear a failure: measured 10.5090 x 1.095 = 11.5074, rounded DOWN to 11.5, which is stricter than the formula. HEADROOM IS 9.43 %, NOT 9.5 % -- the formula grants 9.5 and rounding the cap down hands 0.07 points of it back; the exact figure is stated because a rounded one is how a previous entry in this file had to be corrected, and it is COMPUTED by the test rather than pinned as a literal, so the next reset does not have to hand-edit it. last_measured records the same 10.5090, which is the reading on THIS branch with this record in the tree (local; no CI reading of this gate exists, because check_pack_size has no .github invocation at all -- its only caller is taskfiles/ci-fast.yml:846, so every figure in this note is a workstation reading and is labelled as one). WHY THE CAP MOVED. The gate had been red on every branch for weeks and had stopped discriminating. Three causes were separated by measurement rather than argued: (1) 25 gitignored __pycache__/*.pyc files were being packed, because files[] lists src/scripts/ and .npmignore cannot withhold what files[] admits -- removing the local caches took the BINARY axis from 28 observed / 3 allowed to 3 / 3, green; (2) dist/cli-delegate had accumulated 105 esbuild chunks dated 2026-07-31 through 2026-09-07 because three esbuild runs share one --outdir with --splitting and none cleaned it -- fixed in the same change by prefixing build:cli-delegate with `rm -rf dist/cli-delegate`, worth -1.32 MB packed; (3) the residual is genuine tree growth. WHAT WAS NOT ACCEPTED ON FAITH. src/scripts/** is 48.2% of the tarball (6.0231 MB packed, measured by files[] negation) and the council would not reset the ratchet around a subtree of unproven necessity. The differential packed-consumer test both seats specified was RUN, not deferred: two tarballs (12.489 MB full, 6.466 MB with `!src/scripts/**`) installed into empty projects with --omit=dev. Result: the stripped install fails EVERY command except --version and --help with rc=127, because the shipped consumer entry point IS src/scripts/_dispatch.bash, which routes only some commands to dist/cli-delegate/. The subtree is part of the supported runtime contract; the provisional clause the council attached to this raise is therefore DISCHARGED rather than carried. A FALSE PREMISE, CORRECTED HERE SO IT IS NOT REPEATED. Council rounds 1 and 2 both asserted that WASM 'compresses poorly' and that the three tree-sitter grammars therefore explained most of the growth. Measured: 3.807 MB unpacked -> 0.3752 MB packed, ~90% compression, i.e. 3.0% of the tarball and 19% of the unbuilt growth. The grammars are not the driver. FOUR RENDERINGS OF ONE READING, LABELLED because this file's own discipline is that an unlabelled figure is how a previous entry had to be corrected: 10.5035 is the pre-branch reading on origin/main; 10.5056 was the branch mid-edit, before the two files[] negations and the delegates restructure landed; 10.5090 is the final branch reading and the one last_measured carries; 10.506 and 10.508 are the gate's own three-decimal rendering of the last two. All four measure the same tree modulo this record's own bytes, whose total self-reference is under 0.005 MB against 0.99 MB of headroom. GIVEN UP, stated rather than hidden: the pre-existing accretion between 8.4953 (2026-08-24, clean) and 10.5090 is absorbed into the new floor and will never be reviewed line by line. The ratchet still catches a step change from here, and it may only walk down."
         }
     },
     "per_skill_share": {
@@ -55,7 +56,57 @@
         },
         "what_this_says_about_the_removed_gate": "unpacked_size_mb was removed on 2026-08-04 with max 28 and a measurement of 28.22 — 0.8 % over. The built unpacked size TODAY is 37.3775 MB, i.e. that cap would now be exceeded by 33.5 %. Reinstating it is therefore not 'add a key with a measured baseline': it is setting a cap a third higher than the one whose 0.8 % breach caused its removal. Recorded because it makes the 2026-08-04 decision look better in hindsight than it did at the time, and because an owner reopening it under decision-revisit-gate should start from 37.4, not from 28.",
         "measured_at": "2026-08-24",
-        "measured_on": "One machine, two worktrees of the same commit. CI has historically read ~8 KB above the local packed figure; no CI reading of the BUILT surface exists, so the built numbers here are local-only and are not a CI baseline."
+        "measured_on": "One machine, two worktrees of the same commit. CI has historically read ~8 KB above the local packed figure; no CI reading of the BUILT surface exists, so the built numbers here are local-only and are not a CI baseline.",
+        "measurement_status_2026_09_10": "HISTORICAL AND POLLUTED -- annotated in place, deliberately NOT renamed. The built figure 10.5525 below was measured on a tree carrying stale esbuild output. Reconstructed today by checking out this record's own commit ab398ed05 into a detached worktree, running `npm ci` against its lockfile and a full `npm run build`, then packing: the CLEAN figure at that exact revision is 10.1467 MB over 2785 entries, so the recorded number carries 0.4058 MB / 23 entries of pollution. Consequence for anyone comparing: real clean-to-clean growth to 2026-09-10 is +2.3424 MB, LARGER than the +1.9366 a naive subtraction gives -- the old pollution masked growth rather than inventing it. WHY NOT RENAMED. One council seat proposed renaming this key to `built_surface_measurement_2026_08_24_HISTORICAL_POLLUTED` on the stated ground that the selector would then skip it. That ground is false and was checked against the code: check_pack_size.ts:599-601 filters on /^built_surface_measurement_/ and takes the lexicographic last, so the renamed key would still match, and it would still lose to the 2026_09_10 key either way. A rename would mutate a historical record for no selector effect. Superseded by built_surface_measurement_2026_09_10."
+    },
+    "built_surface_measurement_2026_09_10": {
+        "purpose": "road-to-the-packed-payload-cap step 1.1, option (a), decided by an AI council over three rounds under an owner delegation on 2026-09-10 and recorded in ADR-273. This key exists because the 2026-08-24 record above is provably polluted; the enforcement note below already named adding a dated key as the sanctioned way to re-measure, and this is that.",
+        "unbuilt": {
+            "packed_mb": 10.509,
+            "unpacked_mb": 38.2748,
+            "entries": 3039,
+            "command": "npm pack --dry-run --json --ignore-scripts   # clean worktree of the branch, dist/ carrying only its tracked content",
+            "note": "The surface budgets.packed_size_mb.max is compared against. max was reset to 11.5 in the same change; see baseline_note_2026_09_10."
+        },
+        "built": {
+            "packed_mb": 12.4548,
+            "unpacked_mb": 46.0205,
+            "entries": 3240,
+            "command": "npm run build && npm pack --dry-run --json --ignore-scripts   # full pristine build, every untracked dist/ subtree deleted first",
+            "note": "The surface a consumer downloads. This is the figure the BUILT regression line now compares against; the derived ceiling is 13.700 at regression_pct 10. Measured on the branch that carries this record, after `npm ci` and a full `npm run build` in a checkout whose only untracked dist/ content was produced by that build."
+        },
+        "reproducibility": "REQUIRED BY THE COUNCIL BEFORE THE RESET, AND PASSED. Two independent pristine builds from one clean tree produced byte-identical pack manifests -- 3241 entries, 12,489,135 bytes, path-and-size equal line for line -- and neither left the tracked tree dirty. Without that a single reading is one observation, not a baseline. A THIRD BUILD, in a different checkout of the same content, read 12.4548 over 3240 entries, 0.034 MB under the 12.4891 above. THE GAP RECONCILES EXACTLY, AND THE FIRST ATTEMPT AT THIS SENTENCE DID NOT -- it attributed the gap partly to `dist/catalog-index-v1.json` at 0.225 MB, which is the UNPACKED size and cannot net to a 0.035 MB packed difference. A completion review caught it, and the error is the one this record's own `packed_attribution.method` names as the council's: reasoning from unpacked bytes about a packed cap. MEASURED instead, by `files[]` negation on the checkout that has the file: its PACKED share is 0.0437 MB (43,722 B). So 12.4891 - 0.0437 = 12.4454 without it, and the branch reads 12.4548, i.e. +0.0094 MB for the two content-hashed filenames that differ (`dist/ui/assets/index-*.js` from vite, one `dist/cli-delegate/chunk-*.js` from esbuild) plus this record's own added bytes. -0.0437 + 0.0094 = -0.0343, which is the gap. The catalog file is present in one tree and absent from the other because it is produced by `build:mcp-catalog`, which `npm run build` does not run and `prepack` does not call. The LOWER of the two readings is recorded, so the ratchet is set from the tree this change actually produces.",
+        "third_observation_worth_a_look": "FOUND WHILE ATTRIBUTING THE ABOVE, recorded rather than fixed. `dist/catalog-index-v1.json` ships via the `dist/` entry in files[], is untracked, and is written only by `npm run build:mcp-catalog` -- which is in neither `npm run build` nor `prepack`. So whether that file reaches a published tarball depends on whether somebody happened to run that script in the publishing checkout. Its size is 0.225 MB UNPACKED and 0.0437 MB PACKED -- both stated, with their units, because conflating them is exactly what the `reproducibility` note above had to be corrected for. Not investigated further here; it is a release-reproducibility question, not a budget one.",
+        "historical_clean_reconstruction": {
+            "at_commit": "ab398ed05",
+            "date": "2026-08-24",
+            "recorded_packed_mb": 10.5525,
+            "recorded_entries": 2808,
+            "clean_packed_mb": 10.1467,
+            "clean_entries": 2785,
+            "clean_unpacked_mb": 35.4032,
+            "pollution_packed_mb": 0.4058,
+            "pollution_entries": 23,
+            "method": "git worktree --detach ab398ed05, npm ci --ignore-scripts against that commit's lockfile, npm run build, npm pack --dry-run --json --ignore-scripts",
+            "growth_clean_to_clean_packed_mb": 2.3424,
+            "growth_clean_to_clean_entries": 456,
+            "note": "Kept as metadata inside this record rather than as its own dated key, so it can never be selected as the active comparator by the lexicographic scan."
+        },
+        "packed_attribution": {
+            "method": "one `!<subtree>/**` negation added to files[] at a time, re-pack, take the delta. PACKED bytes, not unpacked -- an unpacked table cannot be reasoned from, which is the error the council made in rounds 1 and 2.",
+            "total_packed_mb": 12.4891,
+            "src/scripts": 6.0231,
+            "dist/agent-src": 2.6187,
+            "dist/cli-delegate": 0.6462,
+            "dist/mcp": 0.5319,
+            "src/vendor": 0.3752,
+            "dist/hooks": 0.3308
+        },
+        "src_scripts_necessity": "PROVEN NECESSARY, by the differential packed-consumer test the council specified. Two real tarballs were built from this tree: the full one at 12,489,135 B and one with `!src/scripts/**` added to files[] at 6,466,000 B. Each was installed with `--omit=dev --ignore-scripts` into an otherwise empty Node project and driven through twelve entry points. FULL: --version, --help, settings:get, packs:active, mcp:available, brand:status, hooks:status, council:status, routing:doctor and sessions:list all succeed. STRIPPED: only --version and --help survive; every other command exits 127 on a missing src/scripts/_dispatch.bash. That file is the shipped consumer entry point and it routes only SOME commands to dist/cli-delegate/, so the subtree is not a second representation of the bundle -- it is the dispatcher plus the targets the bundle does not cover. WHAT THIS DOES NOT PROVE, stated because the council asked for the boundary: it settles the SUPPORTED contract only. It cannot prove no consumer deep-imports a path inside the subtree, which is a compatibility-policy question this record does not answer. A RESIDUAL WORTH NAMING, and not this change's to fix: several commands print `package-local tsx not found -- falling back to npx tsx`, so a consumer's control plane can depend on a network fetch of a dev-only runtime. src/scripts/_dispatch.bash:462-483 documents that resolution order and calls npx a last resort. Moving those commands behind dist/cli-delegate would shrink this subtree AND remove the fallback, which is a packaging decision far larger than a budget reset.",
+        "headroom_is_sized_on_one_tree_state": "NAMED BY THE COMPLETION REVIEW, and it is the sharpest thing in it. The 9.44 % headroom is measured on a tree whose dist/ carries only tracked content, and `payloadIsBuilt` keys on `dist/cli/**` ALONE. A workstation that has run the test suite typically carries dist/mcp and dist/ui but not dist/cli -- and that tree is still classified UNBUILT, so it is judged against `max` while carrying 0.601 MB the unbuilt reading does not include. Real headroom in that state is about 0.39 MB, i.e. roughly 3.7 %, not the 0.99 MB the reset was sized for. This change does NOT address it: nothing here touches the classifier, and widening `payloadIsBuilt` is a gate change rather than a budget one. What the reset does buy is that the same state now passes where it previously failed outright. Recorded rather than fixed so the next person who sees a surprising red reaches for the classifier instead of the cap. Revisit-if: `payloadIsBuilt` gains a second key, or a workstation red is traced to this state again.",
+        "second_defect_instance_not_fixed_here": "DEFECT-PATTERN SEARCH, reported with its count. The cleaned-outdir defect fixed in this change has exactly one further instance: build:cli is `tsc`, which also never cleans its outDir, so a deleted source leaves an orphan .js under dist/cli, dist/scripts, dist/server, dist/shared, dist/linear and dist/migration. Measured on the accumulating workstation tree that produced this record: 0.158 MB. NOT fixed here because dist/install is TRACKED and shares the tsc output root, so a blanket clean would delete tracked files -- a different change with a different risk. It moves local readings only; a publish builds from a fresh checkout, so no released artifact ever carried it.",
+        "measured_at": "2026-09-10",
+        "measured_on": "One machine, one clean checkout plus one detached worktree for the historical reconstruction. No CI reading of either surface exists and none can: check_pack_size has no .github invocation, only taskfiles/ci-fast.yml:846. Every figure here is a workstation reading. Node and npm as resolved by the repo's engines field (node >=20.11.0)."
     },
     "built_surface_enforcement_2026_08_30": "How the two surfaces this file records are now ENFORCED, which until 2026-08-30 they were not. `check_pack_size` compared every payload against `budgets.packed_size_mb.max`, and that cap was measured on the UNBUILT tree — this file has said so since 2026-08-24 in `measurement_conditions` and in `built_surface_measurement_2026_08_24`, and the gate did not read it. Measured on the day this note was written: main packed 8.985 MB over 2715 entries with `--ignore-scripts` and passed; a branch adding six source files packed 9.922 over 2827 and failed `max: 9.1`. The 112-entry difference is `dist/cli` plus `dist/cli-delegate` — the build, not the diff. The gate now reads the payload it is judging (`payloadIsBuilt`, keyed on `dist/cli/**`, already used by the content classes for the same reason) and routes: an UNBUILT payload against `max` and the `last_measured` creep line, unchanged; a BUILT payload against `built_surface_measurement_*.built.packed_mb` with the same `regression_pct`. A built payload with no recorded built figure is a FINDING, not a pass — otherwise removing the record would silently disable the built path. What this does NOT do: it does not raise `max`, and it does not gate the built surface against an absolute cap. The built surface gets a regression line only, because no absolute figure for it was ever set by a maintainer and inventing one here would be exactly the invented number the `_comment` warns about. Revisit-if: a maintainer sets an absolute built cap, or the built figure is re-measured (add a new `built_surface_measurement_<date>` key — the newest is read, so no code changes)."
 }

package/src/config/packed-binary-manifest.json

@@ -1,5 +1,5 @@
 {
-  "_comment": "Every binary entry the published tarball is allowed to carry, one entry per file. Consulted by check_pack_size's binary-eligibility predicate; an entry is ALLOWED only when every mechanical condition in that predicate holds, so a row here is a claim the gate re-verifies rather than a permission it grants. Path-exact by construction: no wildcards, no directory grants, and a second row for the same path is a hard failure. AUTHORITY: AI council 2026-09-08, 2 seats, unanimous, deep tier — it reopened the `binary` class that f573d628c closed 24 hours earlier. `archive` is NOT reopened and this file may never carry one: that collision supplied zero evidence about archives.",
+  "_comment": "Every binary entry the published tarball is allowed to carry, one entry per file. Consulted by check_pack_size's binary-eligibility predicate; an entry is ALLOWED only when every mechanical condition in that predicate holds, so a row here is a claim the gate re-verifies rather than a permission it grants. Path-exact by construction: no wildcards, no directory grants, and a second row for the same path is a hard failure. AUTHORITY: AI council 2026-09-08, 2 seats, unanimous, deep tier — it reopened the `binary` class that f573d628c closed 24 hours earlier. `archive` is NOT reopened and this file may never carry one: that collision supplied zero evidence about archives. ANCHOR: every condition the predicate checks reads THIS file, so a commit that edits a row and its bytes together satisfies all of them. The check that anchors these bytes to something outside this repository is `src/scripts/_lib/vendored_grammar_upstream.ts`, exercised by `tests/scripts/vendored_grammar_upstream.test.ts`; the threat boundary between the two is written out in `packed_binary_predicate.ts`'s docblock.",
   "schema_version": 1,
   "entries": [
     {

package/src/config/platform-anchor.json

@@ -0,0 +1,47 @@
+{
+    "$comment": "The platform configuration the ratification mechanism's trust argument depends on, committed IN THE REPOSITORY so that changing the EXPECTATION is itself a reviewable governance diff rather than a settings change nobody sees. Written 2026-09-10 to the specification of an AI council (anthropic/claude-sonnet-4-5 + openai/codex-default, 2/2 convergent, 2 rounds, blind peer review) under a written owner delegation, resolving blocker `ratification-platform-anchor` of `agents/roadmaps/road-to-typed-grants-that-persist.md`. Both seats required that only generic evaluation logic live in code and that this file sit on the gated-surface list, so a policy-only edit reds `check_kernel_edit_ratified` without its own ratification. openai additionally required a non-negotiable floor embedded in the verifier itself, so that an edit HERE cannot lower a threshold and make itself green; that floor is `NON_NEGOTIABLE_FLOOR` in `src/scripts/_lib/platform_anchor.ts` and this file is rejected when it falls below it. SCHEMA 2, 2026-09-10: the field set changed \u2014 the two approval keys are gone by owner ruling and `accepted_risk_reductions` arrived \u2014 so the version moved with it rather than leaving a reader to discover the shape had changed under a constant number.",
+    "schema_version": 2,
+    "repository": "event4u-app/agent-config",
+    "required": {
+        "enforcement": "active",
+        "target": "branch",
+        "covers_default_branch": true,
+        "required_review_thread_resolution": true,
+        "block_deletion": true,
+        "block_non_fast_forward": true,
+        "strict_required_status_checks": true,
+        "required_status_check_contexts": [
+            "Sync + Generate Tools Consistency"
+        ],
+        "allow_unconditional_bypass": false
+    },
+    "accepted_risk_reductions": [
+        {
+            "id": "arr-2026-09-10-strict-status-checks",
+            "dimension": "strict_required_status_checks",
+            "baseline": true,
+            "accepted": false,
+            "failure_mode": "Semantic conflict. With strictness off a branch may merge on checks that passed against a base it has not caught up with, and the staleness is not bounded to one commit \u2014 any number of merges may have landed since. Two independently green branches can therefore compose into a broken base although neither was broken alone.",
+            "cost_avoided": "Sequential rebase plus a full re-run per branch before each merge. Measured on this repository during the 2026-09-10 session: the matrix runs 34 to 45 checks and `ci_settle` needed three 9-minute passes on several branches, so ~20-30 minutes per re-run and roughly an hour for three green branches merged back to back.",
+            "frequency_assumption": "ASSUMPTION, owner-attested, NOT a measurement: the owner states such breakage 'happens too rarely' to outweigh the re-run cost. No incident data supports or refutes it yet, and this field is worded as an assumption deliberately \u2014 presenting it as a measured rate would be the kind of overstatement this file exists to prevent.",
+            "detection_and_repair": "Post-merge. The breakage surfaces on the next `main` run of the affected workflow, or on the next branch that inherits it; the owner repairs it in a follow-up. The owner accepted this explicitly: 'If something breaks in the process, I can fix it afterwards.'",
+            "residual_protection": "`Sync + Generate Tools Consistency` stays a REQUIRED status check and must still pass, so no branch merges without the ratification gate having run. What that does not prove is compatibility with the current base \u2014 a required check certifies the commit it ran on, never the merge result.",
+            "authority": "owner",
+            "decided": "2026-09-10",
+            "expires": "2026-12-09",
+            "review_triggers": [
+                "the first attributable stale-base semantic conflict, reviewed immediately",
+                "median end-to-end required-check duration falls below 10 minutes over 30 days \u2014 the cost half of this trade-off then collapses",
+                "merge-queue or rebase-on-merge tooling removes the repeated re-runs",
+                "automatic expiry 2026-12-09; renewal is a fresh decision with refreshed measurements, never an extension"
+            ]
+        }
+    ],
+    "accepted_risk_note": "THE FLOOR IS NOW TWO TIERS, and this file says so rather than implying otherwise. Six dimensions are hard \u2014 `NEVER_WAIVABLE` in `src/scripts/_lib/platform_anchor.ts`: enforcement, target, default-branch coverage, unconditional bypass, deletion and force-push. The rest are baseline expectations a complete, unexpired, owner-authorised waiver may trade against a documented operational benefit. Calling that 'the non-negotiable floor unchanged' would be false; it is a 6-dimension hard floor plus trade-offable dimensions with documentation requirements. WHY A THIRD STATE rather than deletion or a permanent red: deleting a dimension the repository still considers safer erases the difference between 'never expected' and 'expected and knowingly waived', while an enforced-and-red dimension makes the gate report a policy violation when the policy is what chose the configuration. openai: 'If noncompliance does not fail the gate, that dimension is not enforced for the duration of the waiver. It remains a baseline expectation subject to an active exception.' WHAT STOPS THIS BECOMING AN EXEMPTION REGISTRY, which both seats warned it would: eligibility is bounded by a committed list rather than by the quality of a waiver's prose; every field is required and an incomplete waiver is REFUSED rather than honoured, so the dimension it names reds normally; a waiver past `expires` is not honoured; and a waiver for a dimension the forge already satisfies is reported as stale. A malformed waiver is worse than no waiver, never better. DECIDED BY: the owner on the policy; an AI council (anthropic/claude-sonnet-4-5 + openai/codex-default, 2 rounds, blind peer review, 2/2 convergent) on this shape, which both seats reached after rejecting outright removal AND a permanent red.",
+    "required_status_check_contexts_note": "The context that CARRIES the ratification gate, not the gate's own script name. `check_kernel_edit_ratified` is a STEP inside the `Sync + Generate Tools Consistency` job (`.github/workflows/consistency.yml:811-825`), and a GitHub required status check pins a job's reported context, never the steps inside it. This distinction is load-bearing and was corrected mid-decision: the council question asserted that the gate 'is not a required status check at all', which measurement then falsified \u2014 the containing job IS the ruleset's one required context. What survives the correction, and what the round-2 ratification review actually refused the deny-retirement over, is that pinning a job name does not pin its steps: a candidate branch may delete the gate's step and the job still reports the same context, green. A required context is therefore necessary and not sufficient, and this file asserts the necessary half.",
+    "owner_ruling_2026_09_10": "THE THREAT-MODEL QUESTION IS ANSWERED, and the answer removed two dimensions from this expectation rather than adding an exception for them. Owner ruling, 2026-09-10, quoted in substance and translated from German: 'I reset the settings deliberately. I am the only maintainer, or the main one. There are others, but they are rarely active. That is why this would be a blocker.' Measured: five accounts carry write access (four write/maintain, one admin), and the owner states the four are rarely available. So a mandatory approving review is not a control on this repository, it is a stop. WHAT THIS COST, stated because a green anchor must not be read as more than it is: `minimum_approving_reviews` and `require_last_push_approval` are gone from this file AND from `NON_NEGOTIABLE_FLOOR`, and they are NOT exemptions \u2014 a dimension outside the trust model is not a waived rule. The mechanism therefore proves nothing about independent human review, separation of duties, or protection against unilateral administrator action, and `docs/contracts/ratification-artifact.md` now says so in those words. WHO MAY DO THIS AGAIN: only the owner may AUTHORIZE a floor reduction; an agent may implement one. The distinguishable event is the owner's own review and merge of a conspicuously labelled trust-model change \u2014 not an agent's transcription of a chat message, and not a council record, which is evidence and never authorization. The verifier cannot authenticate that the owner meant it, and that limit is part of the record rather than hidden by it. THE BOUNDARY, which the mechanism cannot check: a floor reduction is legitimate only where the operating model CANNOT satisfy the floor \u2014 no second human exists \u2014 never where waiting is merely inconvenient. DECIDED BY: the owner on the policy; an AI council (anthropic/claude-sonnet-4-5 + openai/codex-default, 2 rounds each of two runs, blind peer review, 2/2 convergent on option (b)) on the implementation shape, which is council-decidable rather than owner-reserved. openai: 'Keeping those requirements hard-coded would make red mean the repository intentionally chose a different trust model, rather than the configured platform violated its policy. That is not a useful compliance signal.'",
+    "strict_status_checks_note": "SUPERSEDED the same day by the owner's second ruling, and marked rather than left standing — its sibling `threat_model_note` was marked and this one was not, which a blind review filed as its own contradiction. `strict_required_status_checks` is now a BASELINE EXPECTATION covered by the waiver `arr-2026-09-10-strict-status-checks` above, so the gate reports PASS_WITH_ACCEPTED_RISK rather than reding on it, and it has left `NON_NEGOTIABLE_FLOOR` because a floored dimension is unwaivable by construction. Original text, which was true between 12:51 and the ruling: `strict_required_status_checks` STAYS in the enforced set and is currently NOT satisfied, which is deliberate. It read true before this work, true in the write of 2026-09-10, and false afterwards, and the owner's ruling covers reviewer availability rather than whether a branch may merge against a stale base \u2014 so it is collateral rather than part of the decision. Both council seats put it out of scope for the ruling and one added the constraint this file honours: approval of a trust-model change is NOT authorization to mutate the live ruleset, so nothing here was restored on the forge. The gate consequently reds on exactly this one dimension, which is a control pointing at a real gap nobody has argued for \u2014 the opposite of the noise a permanently unsatisfiable floor would have produced. Restoring it is one setting and needs no reviewer.",
+    "threat_model_note": "SUPERSEDED IN PART by `owner_ruling_2026_09_10` above, and kept because a superseded record reads differently from a deleted one \u2014 this is what the question looked like while it was open. Its unconditional-bypass half still stands and is still enforced: `bypass_actors` was emptied on 2026-09-10 and that change held through the revert of the two approval dimensions. Original text follows. UNRESOLVED, and named rather than assumed. openai/codex-default made this an explicit condition: the contract must state whether repository administrators are inside the threat model. Measured 2026-09-10, `bypass_actors` carries `{actor_type: RepositoryRole, actor_id: 5, bypass_mode: always}` and the acting account reports `current_user_can_bypass: always`, so every rule above is advisory for that actor. `allow_unconditional_bypass: false` records the council's answer for the mechanism's own surface \u2014 an unconditional bypass actor is a FAILURE \u2014 but whether the owner intends administrators as a deliberate root-of-trust escape hatch is an owner question this file cannot answer. Until it is answered the mechanism supplies process evidence, not a platform-enforced guarantee, which is what `docs/contracts/ratification-artifact.md` now says.",
+    "evaluation_note": "The verifier evaluates the EFFECTIVE combination of every applicable ACTIVE branch ruleset, never a single ruleset by id or name. openai required this explicitly: ruleset 17749383 ('main protection') is what exists today, and assuming its id, its name, or that one monolithic ruleset carries every rule would make the check wrong the first time an administrator splits it.",
+    "revisit_if": "The repository's governance model changes; or the default branch's protection moves back to classic branch protection (this file's evaluator reads rulesets, and `repos/{owner}/{repo}/branches/main/protection` returned 404 on 2026-09-10); or the job that carries the ratification gate is renamed, in which case `required_status_check_contexts` names a context that no longer exists and the verifier reds until this file is corrected."
+}

package/src/config/preamble-payload-budget.json

@@ -80,11 +80,10 @@
     "design_ceiling": 107646,
     "grace_ceiling": 138490,
     "grace_measured_at": "2026-09-08",
-    "grace_end_date": "2026-11-10",
     "decision": "OPTION (b) of b-preamble-ci-placement: fold into the existing standing-payload-delta.yml rather than add a per-PR job or a scheduled main job. That workflow already computes the neighbouring number and already DECLINED to fail on the premise that this gate 'already fails on growth' -- a premise that was false, because nothing in .github/ ran this gate at all. Making it fail is the smallest change that removes the contradiction instead of adding a third surface. AI council 2026-08-24, 2/2 convergent, on a maintainer delegation.",
     "why_a_single_ci_run_is_enough": "The 'per-spawn' in this metric's name describes WHERE the cost is paid, not random sampling. The measurement is a deterministic census of revision-controlled inputs -- rules, the skill catalogue and CLAUDE.md, all read from the checkout -- so one CI run represents the checked-out revision exactly. Variation between two runs on the same commit would be a CHECKER DEFECT, never budget noise, and is asserted against by the repeatability test in tests/scripts/check_preamble_payload_budget.test.ts. Both council seats rejected the single-sample objection on this ground.",
-    "why_a_grace_ceiling": "HEAD measures 138,212 against a design ceiling of 107,646 -- 28.4 % over. Making the gate blocking at the design ceiling would fail EVERY pull request from the moment it lands, which is a self-inflicted CI stop rather than a gate: nobody can reduce 30,566 tokens inside the PR that turns the gate on. The grace ceiling is set AT the measurement so growth beyond today reds immediately while today's tree passes, and it ratchets DOWN toward the design ceiling as reductions land. It may never move UP. It expires at the milestone-1 date, at which point the design ceiling applies.",
-    "decision_record": "docs/decisions/ADR-264-standing-payload-grace-ceiling-may-not-rise.md -- resolves the contradiction a reader hits in why_a_grace_ceiling above, which says the ceiling is 'set AT the measurement' AND that 'It may never move UP', while grace_ceiling_history records it moving up twice. ADR-264 decides AGAINST the measurement framing and FOR the cap: the ceiling may not rise, standing-rule growth needs a compensating reduction elsewhere, and the two recorded raises stand as violations caused by the contradictory wording rather than as precedent. It also designs, and deliberately does NOT ship, a 128-token aggregate Iron Law reserve -- because the deciding seat's own condition was that wording without enforcement and protected approval is an exploitable trust gap, and this citation is therefore the whole of this file's edit. No bound here is changed by it.",
+    "why_a_grace_ceiling": "HEAD measures 138,212 against a design ceiling of 107,646 -- 28.4 % over. Making the gate blocking at the design ceiling would fail EVERY pull request from the moment it lands, which is a self-inflicted CI stop rather than a gate: nobody can reduce 30,566 tokens inside the PR that turns the gate on. The grace ceiling is set AT the measurement so growth beyond today reds immediately while today's tree passes, and it ratchets DOWN toward the design ceiling as reductions land. It may never move UP. **IT NEVER EXPIRED, and the sentence that used to stand here said it did.** This field read \"It expires at the milestone-1 date, at which point the design ceiling applies\" from the day the concession landed, and nothing in the tree ever implemented that: `grace_end_date` was read in exactly two places, an `echo` in the workflow and a test-helper return type, and `check_preamble_payload_budget.ts` carried no date logic at all. So the design ceiling did not become operative on 2026-11-10; it becomes operative when a human edits this file. The date was deleted rather than moved, because moving it would have re-published the same fiction with a later number -- an AI council under a written owner delegation converged on that (2/2, 2026-09-10) and forbade both the extension and building the missing expiry, the latter because arming a repository-wide stop on a date where `status_2026_08_24.committed_reduction_mechanism` is still the string \"NONE\" creates a cliff nobody can clear. What survives is the half that was always real and is unchanged here: the ceiling is 138,490, it is compared against the measured total on every pull request, and it may only walk down. Evidence: agents/evidence/analysis/grace-ceiling-expiry-is-unenforced-2026-09-10.md; decision: ADR-274.",
+    "decision_record": "docs/decisions/ADR-264-standing-payload-grace-ceiling-may-not-rise.md -- resolves the contradiction a reader hits in why_a_grace_ceiling above, which says the ceiling is 'set AT the measurement' AND that 'It may never move UP', while grace_ceiling_history records it moving up twice. ADR-264 decides AGAINST the measurement framing and FOR the cap: the ceiling may not rise, standing-rule growth needs a compensating reduction elsewhere, and the two recorded raises stand as violations caused by the contradictory wording rather than as precedent. It also designs, and deliberately does NOT ship, a 128-token aggregate Iron Law reserve -- because the deciding seat's own condition was that wording without enforcement and protected approval is an exploitable trust gap, and this citation is therefore the whole of this file's edit. No bound here is changed by it. ADR-274 is the second record on this block and changes no bound either: it deletes the unenforced `grace_end_date` and leaves ADR-264's cap standing untouched. It also records that ADR-264's third `review_trigger` clause -- \"the milestone-1 date arrives and the design ceiling of 107,646 applies\" -- describes an event no code produces and therefore cannot fire; that ADR is not edited here, because its `reopen_policy` is `owner` and nothing in this change needs its decision reopened.",
     "honest_limit": "Editing this workflow makes it FAIL; it does not make it REQUIRED. Whether a failing check blocks a merge is branch-protection configuration, which is a repo-admin action outside this change and outside an autonomous run. So the claim this record supports is 'the gate can now fail a PR', never 'the gate now blocks a merge'. Verify the latter with `gh api repos/:owner/:repo/rulesets` rather than by reading this file.",
     "grace_ceiling_history": [
       {

package/src/config/publish-surface.json

@@ -40,7 +40,9 @@
     "!src/**/*.test.ts",
     "!src/**/*.spec.ts",
     "!dist/agent-src/skills/**/evals/**",
-    "!dist/**/*.map"
+    "!dist/**/*.map",
+    "!**/__pycache__/**",
+    "!**/*.pyc"
   ],
   "npmignore": [
     ".idea/",
@@ -65,5 +67,5 @@
     "agents/",
     "vendor/"
   ],
-  "shadowed_measured_in": "unbuilt tree (payload carries no dist/cli/**)"
+  "shadowed_measured_in": "built tree (payload carries dist/cli/**)"
 }

package/src/config/ratification-policy.json

@@ -0,0 +1,7 @@
+{
+  "$comment": "ADR-268 § 4's quorum policy, committed IN THE REPOSITORY so the gate never depends on a user-global file it cannot read in CI. The first review round refused the gate for exactly that: the council config resolves user-global (ADR-104), is absent on a runner, and the gate printed 'diversity unmeasured' and passed. An authoritative control that fails open when it cannot measure is advisory. This file is always present, so the rule always fires; if it is MISSING or unparseable the gate fails closed rather than skipping the rule.",
+  "required_providers": 2,
+  "required_providers_note": "Distinct provider ids a ratification artifact must name. 2 is the configured council size (anthropic, openai) at the time this landed. Lowering it is itself a governance edit and reds this gate without its own ratification, because this file sits on the gated-surface list.",
+  "verdicts_that_pass": ["ratified", "confirmed-non-expanding"],
+  "verdicts_note": "`ratified` records that an authority-EXPANDING change was approved. `confirmed-non-expanding` records that an independent reviewer looked and found no authority expansion — a typo fix in a kernel rule is not an authority ratification and should not be labelled one. Both clear the gate; the distinction exists so the vocabulary stays honest and so the pressure to weaken the gate over routine edits never builds. Proposed by the round-1 council (codex-default) and adopted."
+}

package/src/config/routing-coverage-seed.json

@@ -9,11 +9,11 @@
         "skills": "src/skills/*/evals/triggers.json over src/skills/*/SKILL.md."
     },
     "seed": {
-        "rules": 0.8952,
+        "rules": 0.9619,
         "skills": 0.3344
     },
     "seed_provenance": {
-        "rules": "94 covered of 105 routed rules (tier-1 21/24, tier-2 73/81) on 2026-08-25.",
+        "rules": "101 covered of 105 routed rules on 2026-09-08; was 94 of 105 (tier-1 21/24, tier-2 73/81) on 2026-08-25.",
         "skills": "100 of 299 skills carry evals/triggers.json on 2026-08-30.",
         "finding": "The gap between the two seeds IS the roadmap defect D1, quantified. The rules surface is ~90% covered by a deterministic corpus that can fail a PR; the skills surface -- the one production routes on -- is 25%, covered only by a harness that is advisory only, never gating (rule_trigger_eval.ts:4)."
     },
@@ -38,6 +38,13 @@
             "from": 0.3144,
             "to": 0.3344,
             "reason": "road-to-governed-harness-evolution Phase 2.4 authored six wave-1 corpus files (94 -> 100 of 299), chosen by 2.2's inbound-confusion-edge ordering rather than picked. The seed rises so the gain cannot be given back silently; it may never be LOWERED. Surfaced by check_routing_coverage.test.ts, which asserts seed == live measurement in BOTH directions -- a seed left below the tree is a red test, not slack, which is the same asymmetry check_source_size_budget uses and for the same reason: nothing else would force the ratchet to follow a gain."
+        },
+        {
+            "date": "2026-09-08",
+            "scope": "rules",
+            "from": 0.8952,
+            "to": 0.9619,
+            "reason": "road-to-delivery-for-every-host authored seven routing-matrix fixtures -- council-availability, evaluator-independence, fix-what-you-see, missing-skill-recovery, playbook-precedence, recurring-criticism, self-repair-loop (94 -> 101 of 105 routed rules). First entry on the RULES scope; the three above are all skills. The seed rises because this file's own test asserts seed == live measurement in both directions, so the gain would otherwise red the suite for doing what the ratchet encourages. It may never be LOWERED."
         }
     ]
 }