@event4u/agent-config 14.22.0 → 15.0.0

package/src/scripts/hooks/chain_nudge_hook.ts

@@ -18,11 +18,37 @@
  * a shape that cannot be written as an allowlist pattern at all. That class
  * shrinks only by not writing it.
  *
+ * THE SECOND CLASS, AND WHY IT BELONGS HERE. A Bash command that writes a
+ * file — `sed -i`, `cat > f`, `tee f`, `perl -i`, a `python3 -c` that opens a
+ * path for writing — costs a confirmation for a reason no allowlist entry
+ * fixes: a write-shaped Bash grant does NOT persist. The host's own
+ * permission documentation records that "don't ask again" saves a permanent
+ * rule for read-only and pre-approved commands and that write-shaped ones
+ * last until session end, so the same shape is confirmed again next session.
+ * The Edit and Write tools carry no such expiry for a path inside the working
+ * directory. That makes the substitution a strictly cheaper primitive rather
+ * than a style preference, which is why the concern that already reads
+ * `tool_input.command` carries it instead of a second concern reading the
+ * same field. Measured on 2026-09-10 over 7,569 distinct real Bash calls in
+ * 39 transcripts on the maintainer's machine: 306 (4.0 %) wrote a file
+ * through the shell — 216 `cat >`, 66 `sed -i`, 16 `python3 -c` with a
+ * write-mode `open`, 7 `perl -i`, 1 `tee`. Recompute with
+ * `./scripts-run src/scripts/autonomy_friction_traffic`, which shares these
+ * detectors; every figure in this change comes from that one run.
+ *
+ * THE COUNT IS A FLOOR, and the five rules are why. `echo >`, `printf >`,
+ * `jq >`, `awk >`, `git show >` and `cp` all fill a file and none is matched:
+ * the list is positive by design, and a generic redirect scanner would fire on
+ * `grep x f > out.txt`, where the shell is not the thing doing the writing.
+ * A heredoc whose BODY performs the write is invisible for the same reason the
+ * body is stripped at all. Read 4.0 % as "at least".
+ *
  * WHAT IT DOES NOT FLAG, DELIBERATELY. A pipe of ordinary filters
  * (`grep foo file | head`) is one command with a filter, not two work steps.
- * A redirect has its target checked against the file rules on its own. A
- * heredoc is a command with input. Flagging any of those would make the
- * nudge noise, and a nudge that fires on correct usage is worse than none.
+ * A redirect whose target is not a file the shell is filling with content —
+ * `2>&1`, `> /dev/null` — is not a write. A heredoc is a command with input.
+ * Flagging any of those would make the nudge noise, and a nudge that fires on
+ * correct usage is worse than none.
  *
  * NEVER BLOCKS. The dispatcher contract is 0 allow · 2 warn, and a warn on
  * `pre_tool_use` with `severity: advisory` is an injection, not a deny — the
@@ -30,10 +56,23 @@
  * failure path returns allow: unreadable stdin, malformed JSON, unwritable
  * latch. A token optimisation must never break a tool call.
  *
- * ONCE PER SESSION. A latch keyed by session id, in the state directory
- * `code-graph-nudge.json` already occupies. The rule body reaches the model
- * once, early, on the first chained call — repeating it every call would be
- * the nagging this codebase refuses elsewhere.
+ * ONCE PER SHAPE CLASS PER SESSION. A latch keyed by session id, in the state
+ * directory `code-graph-nudge.json` already occupies. Each class reaches the
+ * model once, early, on the first call carrying it — so a session sees at most
+ * two lines, never one line for two different mistakes.
+ *
+ * That is a per-CLASS latch, not a per-CALL one, and the distinction is the
+ * whole reason it is allowed to change: the recorded decision this file
+ * carried refuses "repeating it every call", which is the nagging this
+ * codebase refuses elsewhere, and a second class firing once is a different
+ * mechanism from a first class firing twice. The single-boolean latch was
+ * written when there was one class; with two, it would have let whichever
+ * shape came first silence the other for the rest of the session.
+ *
+ * A latch file written by the single-class version holds `true` rather than an
+ * object. That is read as "the chain class has fired", which is what it meant,
+ * so an in-flight session upgrades without losing its latch and without
+ * replaying a line it already showed.
  *
  * ON BY DEFAULT, WITH AN OPT-OUT. Unlike `code-graph-nudge`, which gates on a
  * project capability that may not exist, the fact this nudge carries is a
@@ -137,14 +176,208 @@ export function stripLiterals(cmd: string): string {
     return out;
 }
 
+/**
+ * Heredoc BODIES removed, the command line they sit on kept.
+ *
+ * `stripLiterals` runs from `<<` to the closing tag and so deletes the redirect
+ * that shares the command line; leaving the body in instead let a heredoc that
+ * merely MENTIONS a write shape fire the nudge and spend the session's one
+ * write line. Neither view is right for the write rules, so this is the third:
+ * the marker and the rest of the command line survive, the body does not.
+ *
+ * Consequence, stated because it is a real false negative: a heredoc whose BODY
+ * performs the write — `python3 - <<PY` opening a path — is invisible here. The
+ * class is a floor, and this is one of the reasons.
+ */
+export function stripHeredocBodies(cmd: string): string {
+    const marker = /<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1/g;
+    let out = '';
+    let cursor = 0;
+    let m: RegExpExecArray | null;
+    while ((m = marker.exec(cmd)) !== null) {
+        const tag = m[2] as string;
+        const nl = cmd.indexOf('\n', m.index + m[0].length);
+        if (nl === -1) break;
+        const close = cmd.indexOf(`\n${tag}`, nl);
+        const end = close === -1 ? cmd.length : close + tag.length + 1;
+        out += cmd.slice(cursor, m.index) + '<<' + cmd.slice(m.index + m[0].length, nl);
+        cursor = end;
+        marker.lastIndex = end;
+    }
+    return out + cmd.slice(cursor);
+}
+
+/**
+ * Quoted spans removed, heredoc bodies LEFT IN PLACE.
+ *
+ * The sibling of `stripLiterals` for the write rules. That one must consume a
+ * heredoc, because an operator in its body is not chaining; this one must not,
+ * because the heredoc marker and the redirect share a command line and
+ * consuming to the closing tag takes the redirect with it.
+ */
+export function stripQuoted(cmd: string): string {
+    let out = '';
+    let i = 0;
+    let quote: string | null = null;
+    while (i < cmd.length) {
+        const c = cmd[i] as string;
+        if (quote) {
+            if (c === '\\' && quote === '"') {
+                i += 2;
+                continue;
+            }
+            if (c === quote) quote = null;
+            i += 1;
+            continue;
+        }
+        if (c === '\\') {
+            i += 2;
+            continue;
+        }
+        if (c === '"' || c === "'") {
+            quote = c;
+            i += 1;
+            continue;
+        }
+        out += c;
+        i += 1;
+    }
+    return out;
+}
+
 /** What the nudge saw, or null when the command is not chained work. */
 export function detectChaining(command: string): string | null {
-    const bare = stripLiterals(command);
+    return _detectChaining(stripLiterals(command));
+}
+
+function _detectChaining(bare: string): string | null {
     if (/^\s*[A-Za-z_][A-Za-z0-9_]*=/.test(bare) && /[;\n]/.test(bare)) {
         return 'a leading `VAR=…` assignment carrying state into a later segment';
     }
     if (/&&|\|\|/.test(bare)) return 'work steps chained with `&&` / `||`';
     if (/;\s*\S/.test(bare)) return 'work steps chained with `;`';
+    // The header names newlines among the host's split points and this rule did
+    // not read them, so `git status\ngit diff` — two work steps by any reading —
+    // was silent. Heredoc bodies are already gone from this view, so a
+    // multi-line heredoc command does not reach here.
+    if (/\n\s*\S/.test(bare)) return 'work steps separated by a newline';
+    return null;
+}
+
+/**
+ * The five shapes that fill a file's content from the shell, each matched on
+ * the literal-stripped command so a quoted mention cannot fire it.
+ *
+ * A positive list, not a redirect scan: `>` alone is a redirect and the header
+ * says a redirect is not flagged. What is flagged is a command whose named
+ * operation IS "put this content in that path", which is the operation Edit
+ * and Write perform without an expiring grant. `/dev/null` and an fd
+ * duplication (`2>&1`) are excluded because neither names a file being filled.
+ */
+const EDIT_BY_SHELL: ReadonlyArray<{ re: RegExp; seen: string }> = [
+    // `-i` may ride inside a flag cluster (`-ri`, `-Ei`) or carry a backup
+    // suffix (`-i.bak`), so the letter is matched inside the cluster rather
+    // than as a token. `sed -n 2,8p` and `sed -e s/a/b/ f` have no `i` in any
+    // flag and stay silent; `--expression=…` cannot match because the class
+    // admits letters only after the single leading dash.
+    {
+        re: /(^|[\s;&|(])sed\s+(?:-\S+\s+)*-(?:i|[nersuzE]*i[nersuzE]*|-in-place)(?:\.\S+)?(?=\s|$)/,
+        seen: '`sed -i` edits a file in place',
+    },
+    // The letter set is closed on purpose. Matching an `i` ANYWHERE in a flag
+    // cluster made `perl -Mstrict`, `perl -MList::Util` and `perl -Ilib` all
+    // report an in-place edit — the letters after `-M` and `-I` are a module
+    // name and a directory, not switches. Only perl's own one-letter switches
+    // may share the cluster with `i`.
+    {
+        re: /(^|[\s;&|(])perl\s+(?:-\S+\s+)*-(?:i|[pnlaw]*i[pnlaw]*)(?:\.\S+)?(?=\s|$)/,
+        seen: '`perl -i` edits a file in place',
+    },
+    // `[^\n]*` between the head and the redirect, so `cat <<'EOF' > out.txt`
+    // and `cat a b > merged` both land, while `> /dev/null` and an fd
+    // duplication (`2>&1`) are excluded by the lookahead at every position the
+    // engine tries.
+    // `[^\n|;&]*` — the redirect must belong to the SAME simple command. With
+    // `[^\n]*` this rule was a general redirect scanner for any cat-headed
+    // pipeline, so `cat f | grep x > out.txt` fired while the identical
+    // `grep x f > out.txt` stayed silent, which its own "positive list, not a
+    // redirect scan" comment forbids.
+    { re: /(^|[\s;&|(])cat\b[^\n|;&]*>{1,2}\s*(?!&|\/dev\/null)\S/, seen: '`cat >` fills a file from the shell' },
+    // A flag cluster before the path is normal (`tee -a out.txt`), and the path
+    // is REQUIRED. Dropping the original `(?!-)` lookahead to admit the flagged
+    // form turned a false negative into a false-positive class: `tee -a`,
+    // `foo | tee | wc -l`, `foo | tee -` and `tee -a /dev/null` all fired. The
+    // path token is therefore matched explicitly — not a flag, not a shell
+    // operator, not the null device.
+    {
+        re: /(^|[\s;&|(])tee\s+(?:-[A-Za-z]+\s+)*(?!\/dev\/null)[^-\s;&|<>][^\s;&|<>]*/,
+        seen: '`tee` writes its input to a file',
+    },
+];
+
+/** The interpreter form, split across the two views for the reason below. */
+const PY_AT_COMMAND_POSITION = /(^|[\s;&|(])python3?\s+-c\b/;
+const PY_OPENS_FOR_WRITING = /\bopen\s*\([^)]*['"][wax]\+?['"]/;
+
+/**
+ * What the write-shaped detector saw, or null when the call writes no file.
+ *
+ * `stripQuoted` rather than `stripLiterals` for the redirect rules: the
+ * heredoc branch of `stripLiterals` runs to the closing tag and swallows the
+ * command line with it, so `cat <<'EOF' > out.txt` lost its own redirect and
+ * the largest measured write shape went undetected in its most common spelling.
+ *
+ * The interpreter rule reads BOTH views, and needs to. Its program is a quoted
+ * argument, so the write mode is only visible in the raw string; but matching
+ * the raw string alone fires on any command that merely QUOTES the shape —
+ * `git commit -m "use python3 -c open(p,'w')"` did, and this change ships that
+ * exact string in a substitution table. So the interpreter must sit at a
+ * command position in the STRIPPED text, where a quoted mention has already
+ * been removed, and the write mode must be named in the RAW text.
+ */
+export function detectEditByShell(command: string): string | null {
+    return _detectEditByShell(command, writeView(command));
+}
+
+/** The view the write rules read: no heredoc bodies, no quoted spans. */
+export function writeView(command: string): string {
+    return stripQuoted(stripHeredocBodies(command));
+}
+
+function _detectEditByShell(command: string, quotesStripped: string): string | null {
+    for (const shape of EDIT_BY_SHELL) {
+        if (shape.re.test(quotesStripped)) return shape.seen;
+    }
+    if (PY_AT_COMMAND_POSITION.test(quotesStripped) && PY_OPENS_FOR_WRITING.test(command)) {
+        return 'a `python3 -c` one-liner opens a path for writing';
+    }
+    return null;
+}
+
+/** The two shape classes this concern carries. */
+export type NudgeClass = 'edit-by-shell' | 'chain';
+
+/** One finding: which class fired, and what it saw. */
+export interface NudgeFinding {
+    klass: NudgeClass;
+    seen: string;
+}
+
+/**
+ * The finding for this command, or null.
+ *
+ * `edit-by-shell` is tested first, and on a call that is both — `cd d && sed
+ * -i … f` is — it wins: its line names a primitive that costs no confirmation
+ * at all, while the chain line only explains why this one did.
+ */
+export function detectShape(command: string): NudgeFinding | null {
+    // Each view is built once. This runs on every shell tool call and the
+    // header documents 26 ms p95 as load-bearing, so calling the two exported
+    // wrappers here would strip the same string twice per call for nothing.
+    const write = _detectEditByShell(command, writeView(command));
+    if (write) return { klass: 'edit-by-shell', seen: write };
+    const chained = _detectChaining(stripLiterals(command));
+    if (chained) return { klass: 'chain', seen: chained };
     return null;
 }
 
@@ -190,25 +423,59 @@ function latchFile(root: string): string {
     return path.join(root, 'agents', 'runtime', 'state', 'chain-nudge.json');
 }
 
-function alreadyNudged(root: string, session: string): boolean {
+/** One session's latch: the object form, or the pre-two-class `true`. */
+type LatchEntry = boolean | Record<string, boolean>;
+
+/**
+ * Has `klass` already fired for this session?
+ *
+ * A legacy `true` is read as the chain class having fired, which is what the
+ * single-class version wrote it to mean. The write class is then unlatched in
+ * that session and gets its first line — correct, because it never had one.
+ */
+export function classAlreadyNudged(entry: LatchEntry | undefined, klass: NudgeClass): boolean {
+    if (entry === true) return klass === 'chain';
+    if (isObject(entry)) return entry[klass] === true;
+    return false;
+}
+
+/** `klass` recorded on top of whatever the entry already held. */
+export function withClassLatched(entry: LatchEntry | undefined, klass: NudgeClass): Record<string, boolean> {
+    const next: Record<string, boolean> = entry === true ? { chain: true } : isObject(entry) ? { ...(entry as Record<string, boolean>) } : {};
+    next[klass] = true;
+    return next;
+}
+
+/**
+ * The latch state, or `{}` for anything that is not a JSON object.
+ *
+ * The shape check is not decoration. `JSON.parse` returns `null` for a latch
+ * file holding `null` and a number for one holding `7`, neither of which throws
+ * — so the try/catch alone let a corrupted file reach the caller as a non-object
+ * and crash the property read. The helper this replaced guarded that by reading
+ * the property inside its own try; consolidating the read dropped the guard, and
+ * the header's "every failure path returns allow" stopped being true.
+ */
+function readLatch(root: string): Record<string, LatchEntry> {
     try {
-        const state = JSON.parse(fs.readFileSync(latchFile(root), 'utf-8')) as Record<string, boolean>;
-        return state[session] === true;
+        const parsed: unknown = JSON.parse(fs.readFileSync(latchFile(root), 'utf-8'));
+        return isObject(parsed as JsonValue) ? (parsed as Record<string, LatchEntry>) : {};
     } catch {
-        return false;
+        return {};
     }
 }
 
-function latch(root: string, session: string): void {
+/**
+ * Record `klass` into an ALREADY-READ state and persist it.
+ *
+ * The state is passed in rather than re-read: the caller has just consulted it
+ * to decide whether to fire, and reading the same file twice per firing call is
+ * the kind of hot-path waste this file's own ordering comment exists to avoid.
+ */
+function latch(root: string, session: string, klass: NudgeClass, state: Record<string, LatchEntry>): void {
     try {
         const p = latchFile(root);
-        let state: Record<string, boolean> = {};
-        try {
-            state = JSON.parse(fs.readFileSync(p, 'utf-8')) as Record<string, boolean>;
-        } catch {
-            /* fresh */
-        }
-        state[session] = true;
+        state[session] = withClassLatched(state[session], klass);
         fs.mkdirSync(path.dirname(p), { recursive: true });
         fs.writeFileSync(p, JSON.stringify(state));
     } catch {
@@ -216,6 +483,24 @@ function latch(root: string, session: string): void {
     }
 }
 
+/** The write-shape line — names the expiry, then the primitive without one. */
+export function editByShellReason(seen: string): string {
+    return (
+        `This Bash call writes a file through the shell: ${seen}. A write-shaped ` +
+        'Bash grant does not persist — the host saves a permanent rule for ' +
+        'read-only commands, while a write-shaped one lasts until session end, so ' +
+        'this same shape costs another confirmation next session. Edit and Write ' +
+        'carry no such expiry inside the working directory: Edit for a targeted ' +
+        'change, Write for a new file, the shell for reads. ' +
+        'See `token-efficiency` § One command per Bash call.'
+    );
+}
+
+/** The line for a finding, dispatched on its class. */
+export function reasonFor(finding: NudgeFinding): string {
+    return finding.klass === 'edit-by-shell' ? editByShellReason(finding.seen) : nudgeReason(finding.seen);
+}
+
 /** The nudge line — one line, names what was seen and what to do instead. */
 export function nudgeReason(seen: string): string {
     return (
@@ -247,8 +532,8 @@ export function main(): number {
     const command = bashCommand(envelope);
     if (!command) return EXIT_ALLOW;
 
-    const seen = detectChaining(command);
-    if (!seen) return EXIT_ALLOW;
+    const finding = detectShape(command);
+    if (!finding) return EXIT_ALLOW;
 
     const cwd = envelope['cwd'];
     const pr = envelope['workspace_root'] ?? envelope['project_root'];
@@ -256,10 +541,11 @@ export function main(): number {
     if (!enabled(root)) return EXIT_ALLOW;
 
     const session = sessionId(envelope);
-    if (alreadyNudged(root, session)) return EXIT_ALLOW;
+    const state = readLatch(root);
+    if (classAlreadyNudged(state[session], finding.klass)) return EXIT_ALLOW;
 
-    latch(root, session);
-    process.stdout.write(`${JSON.stringify({ decision: 'warn', reason: nudgeReason(seen) })}\n`);
+    latch(root, session, finding.klass, state);
+    process.stdout.write(`${JSON.stringify({ decision: 'warn', reason: reasonFor(finding) })}\n`);
     return EXIT_WARN;
 }
 

package/src/scripts/hooks/code_graph_context_hook.ts

@@ -39,7 +39,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
-import { detectSources, pickSource } from '../code_graph/detect.js';
+import { type GraphState, graphState } from '../code_graph/detect.js';
 import { readHookStdin } from './hook_stdin.js';
 
 const EXIT_ALLOW = 0;
@@ -114,26 +114,15 @@ function latch(root: string, session: string): void {
     }
 }
 
-const NATIVE_CACHE = path.join('agents', 'runtime', 'state', 'code-graph-v1.json');
-
-/** The three-state staleness token this hook reports. */
-export type GraphState = 'absent' | 'fresh' | `behind:${number}`;
-
 /**
- * Resolve the graph's state for `root`.
+ * The three-state staleness token this hook reports.
  *
- * `absent` means no source at all — the silent case. A picked source whose
- * staleness is UNKNOWN reads as `fresh`, mirroring `computeVerdict`'s own
- * `picked.stale ? STALE : FRESH`: unknown is not treated as stale, because
- * inventing a commit count would be worse than reporting none.
+ * Re-exported, not defined here: Phase 3's verbs must print the same token, and
+ * an engine module importing this hook to learn it would invert the dependency
+ * direction D9 measures. The definition lives in `code_graph/detect.ts`; this
+ * re-export keeps every existing importer of the hook working unchanged.
  */
-export function graphState(root: string): GraphState {
-    const picked = pickSource(detectSources(root, path.join(root, NATIVE_CACHE)));
-    if (!picked) return 'absent';
-    if (picked.stale !== true) return 'fresh';
-    const behind = picked.commits_behind;
-    return `behind:${typeof behind === 'number' ? behind : 0}`;
-}
+export { type GraphState, graphState };
 
 /**
  * The one line, ≤ ~45 tokens.

package/src/scripts/hooks/push_settle_hook.ts

@@ -191,8 +191,9 @@ export function buildReminder(branch: string, pr: number | null): { reason: stri
     `own exit code.\n\n` +
     `Before this turn ends:\n` +
     `  1. Settle it:\n     ${settle}\n` +
-    `     Exit 0 = settled green · 1 = settled, something failed · 2 = NOT a verdict ` +
-    `(timed out or unreadable — never report 2 as green).\n` +
+    `     Exit 0 = settled green, and the line names the head it is about · 1 = settled, ` +
+    `something failed · 2 = NOT a verdict (timed out, unreadable, or the PR is merged / ` +
+    `closed / head-diverged — never report 2 as green).\n` +
     `  2. Red? Read only the failing part:\n` +
     `     gh run view --job <id> --log-failed | grep -E '×|FAIL|Error'\n` +
     `     then fix it and push again (fix-what-you-see: the author is irrelevant).\n` +

package/src/scripts/hooks/rule_inject_hook.ts

@@ -11,12 +11,23 @@
  * the 36.2 %-against-48 % run at `docs/CLAIMS.md:188-189`. Whatever that
  * instrument's flaws — and ADR-202 closed it — it points one way.
  *
- * DEFAULT OFF, AND OFF MEANS ZERO BYTES. The concern registers on two slots but
- * returns before reading the router unless `lean_projection.mode: delivery` is
- * set. Under every shipped default it emits nothing, costs no injection budget,
- * and leaves the standing corpus exactly as it is today. That is why its
- * `hook-token-budget.json` row is registered against the per-prompt cap rather
- * than a measured emission: there is no measured emission to register yet.
+ * SHIPPED ON FOR CLAUDE CODE SINCE ADR-265 — corrected 2026-09-08 (R2 finding
+ * 4), because this paragraph read "DEFAULT OFF, AND OFF MEANS ZERO BYTES …
+ * under every shipped default it emits nothing … there is no measured emission
+ * to register yet" and all four clauses became false in the same change that
+ * edited the paragraph below it. The shipped template carries
+ * `lean_projection.mode: delivery` with `hosts: [claude-code]`
+ * (`src/config/agent-settings.template.yml`), `gateOpen` returns true on that
+ * pair, and the emission IS measured: p50 6,674 B, p90 16,188 B, max 20,406 B
+ * over 318 gate-open fires on the frozen corpus, which is the distribution the
+ * `user_prompt_submit` slot raise in `src/config/hook-token-budget.json` is
+ * derived from.
+ *
+ * OFF STILL MEANS ZERO BYTES, and that half is unchanged: the concern returns
+ * before reading the router unless the resolved (mode, hosts) pair actually
+ * thins THIS host — see `gateOpen`, which checks both, because the projector
+ * does. On any other host, and on a `lean_projection.mode: eager-all` rollback,
+ * it emits nothing.
  *
  * ONE MATCHER, SHARED WITH THE OFFLINE MODEL. Everything about selection,
  * ordering, capping and body loading comes from `_lib/rule_injection.ts`, which
@@ -31,6 +42,29 @@
  * uses. State lives under `agents/runtime/state/`, the class
  * `context-hygiene.json` already occupies; no new state convention is created.
  *
+ * WHAT IS RE-DELIVERED AFTER A COMPACTION, EXACTLY
+ * (road-to-delivery-for-every-host 2.4 — stated because a rule lost at a
+ * compaction boundary is lost for the rest of the session, and "re-armed" alone
+ * does not say what a reader may rely on):
+ *
+ *   · `pre_compact` clears the WHOLE seen-set for that session, not the rules
+ *     matched on the compacted turn. There is no per-rule bookkeeping to be
+ *     partially wrong about.
+ *   · Nothing is delivered BY the compaction itself. The slot emits zero bytes
+ *     and exits allow; re-arming is silent.
+ *   · A rule's body returns on the NEXT turn whose trigger matches it — which
+ *     means a rule whose trigger does not fire again is NOT restored. Delivery
+ *     is trigger-driven on both sides of the boundary; compaction resets the
+ *     de-duplication, it does not replay a transcript.
+ *   · The seen-set is per session, so a compaction in one session re-arms only
+ *     that session.
+ *
+ * Held by three fixtures in `tests/scripts/rule_inject_hook.test.ts` under
+ * "once per session per rule, re-armed on compaction": the dedup case, the
+ * matched-rule → compaction → matching-turn → body-present case, and the
+ * per-session case. All three predate this roadmap; 2.4 adds the contract
+ * above, not the coverage, and says so rather than claiming new tests.
+ *
  * NEVER BLOCKS. Every failure path returns 0: unreadable stdin, malformed JSON,
  * missing router, unreadable body, unwritable state. The one non-zero exit is
  * the host's advisory context channel (exit 2 + `decision: "warn"`), the same
@@ -54,8 +88,12 @@ import * as path from 'node:path';
 import process from 'node:process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
-import { hookSectionEnabled, leanProjectionModeRaw } from '../_lib/hook_settings.js';
-import { deliversBodies, normalizeLeanProjectionMode } from '../_lib/lean_projection_mode.js';
+import { hookSectionEnabled, leanProjectionHostsRaw, leanProjectionModeRaw } from '../_lib/hook_settings.js';
+import {
+    deliversBodies,
+    normalizeLeanProjectionMode,
+    resolveLeanProjectionHosts,
+} from '../_lib/lean_projection_mode.js';
 import {
     loadRuleBody,
     loadRouter,
@@ -81,15 +119,38 @@ const EXIT_WARN = 2;
  * slot, for a concern that is default-OFF and emits nothing. Measured: 202 ms
  * -> 196 ms on the `pre_tool_use` p95 when the concern is unbound entirely, and
  * the CI latency gate went red on the branch that introduced it while passing
- * on main. So the runtime cap is the same bound in the unit
+ * on main. So the runtime cap is stated in the unit
  * `hook-token-budget.json` already enforces — 5,000 tok at the ~4 bytes/token
- * this corpus measures is 20,480 B, which is exactly this concern's registered
- * row. Cap and budget row are now one number instead of two units.
+ * this corpus measures was 20,480 B, and that WAS this concern's registered
+ * row until 2026-09-08. It matched the concern row and not the slot row; see
+ * the correction below.
+ *
+ * LOWERED 20480 -> 16384 on 2026-09-08 (R2 finding 3), and the paragraphs above
+ * are kept because they record how the retired number was derived. The defect
+ * was that the derivation above and the one behind the
+ * `user_prompt_submit` slot row were TWO STATISTICS IN TWO UNITS: this cap was
+ * the p90 of the matched-body TOKEN distribution, converted at ~4 B/tok; the
+ * slot row is the p90 gate-open FIRE SIZE in bytes, which is the activation
+ * charge owner ruling E2 specifies. They disagreed by 25 %, in the direction
+ * that licensed ONE concern to emit more than the whole slot — carrying 12
+ * other concerns — is registered for. Reconciled downward onto the slot row,
+ * because that is the owner-specified charge; the cost is measured and recorded
+ * in `hook-token-budget.json`'s own `rule-inject_reason` (33 -> 45 fires
+ * truncated, 63 -> 88 bodies withheld over 330 corpus fires).
+ *
+ * WHAT THIS CAP DOES, precisely: `selectForInjection` drops whole bodies to
+ * stay under it, so a fire is TRUNCATED and never over-emitted. It is the only
+ * number that acts on a single fire — the per-slot sums are an authoring-time
+ * control read by `bench_hook_injection`, and the runtime dispatcher enforces
+ * only `per_turn_aggregate_bytes.ceiling_bytes`.
  *
  * Re-run that command if the corpus or the bodies move; a cap copied from a
- * stale measurement is worse than no cap, because it looks derived.
+ * stale measurement is worse than no cap, because it looks derived. The
+ * tripwire in `tests/scripts/rule_inject_hook.test.ts` holds this equal to the
+ * registered concern row and at or below the slot sum, so the two units cannot
+ * drift apart again unnoticed.
  */
-export const CAP_BYTES = 20480;
+export const CAP_BYTES = 16384;
 
 /** Tools whose input names a file this concern can match path triggers against. */
 export const FILE_TOOLS = new Set(['Write', 'Edit', 'NotebookEdit', 'Read', 'MultiEdit']);
@@ -216,18 +277,44 @@ export function buildInjection(
 
 // ── main ─────────────────────────────────────────────────────────────────
 
+/**
+ * The one host this concern is bound on.
+ *
+ * The manifest binds `rule-inject` under `claude` alone, so the host axis
+ * `gateOpen` has to consult is a constant here rather than something read off
+ * the envelope — the envelope carries no host id, and inventing one from the
+ * process environment would be a guess where the manifest is a fact.
+ */
+export const DELIVERY_HOST = 'claude-code';
+
 /**
  * Whether the settings gate applies.
  *
- * Through the dispatcher the gate is absolute: no `lean_projection.mode:
- * delivery`, no bytes. A DIRECT CLI invocation is a probe by definition — an
- * operator piping an envelope into this file is asking to see what it would
- * deliver — so there the mode defaults to on. `AGENT_CONFIG_REPLAY` re-imposes
- * the gate, which is what keeps `bench_hook_injection` measuring the shipped
- * default (zero bytes) rather than the probe.
+ * BOTH AXES, because the projector reads both. Until 2026-09-08 this keyed on
+ * `lean_projection.mode` alone while `condense` gates stub-writing on
+ * `thinsHost(mode, hosts, host)` (R2 finding 5). The two disagreed in exactly
+ * the states the host axis exists for: `mode: delivery` with a `hosts:` list
+ * that does not resolve to `claude-code` — the documented "thin no host"
+ * state, which a fully typo'd list also produces — left this host with a
+ * FULL-BODIED tree while the hook kept injecting on a match, so every matched
+ * rule was delivered twice. `hosts: [cursor]` was the same defect with a
+ * second half: cursor received stubs with no bound slot to deliver them back.
+ *
+ * `deliversBodies` is checked separately from the host list rather than via
+ * `thinsHost`, which is true for `thin` as well: `thin` writes the same stubs
+ * and binds NO delivery concern, so it must never open this gate.
+ *
+ * An explicit `hooks.rule_inject` opt-in still opens it — that is an operator
+ * asking for the concern by name, independent of the projection mode. A DIRECT
+ * CLI invocation is a probe by definition — an operator piping an envelope into
+ * this file is asking to see what it would deliver — so there the gate defaults
+ * to open. `AGENT_CONFIG_REPLAY` re-imposes it, which is what keeps
+ * `bench_hook_injection` measuring the configured tree rather than the probe.
  */
 export function gateOpen(root: string, cliEntry: boolean): boolean {
-    if (deliversBodies(normalizeLeanProjectionMode(leanProjectionModeRaw(root)))) return true;
+    const mode = normalizeLeanProjectionMode(leanProjectionModeRaw(root));
+    const hosts = resolveLeanProjectionHosts(leanProjectionHostsRaw(root)).hosts;
+    if (deliversBodies(mode) && hosts.includes(DELIVERY_HOST)) return true;
     if (hookSectionEnabled(root, 'rule_inject')) return true;
     return cliEntry && process.env['AGENT_CONFIG_REPLAY'] !== '1';
 }