@event4u/agent-config 14.23.0 → 16.0.0

package/dist/agent-src/contexts/communication/rules-auto/token-efficiency-mechanics.md

@@ -108,6 +108,39 @@ The step-2 grep is not a second probe of the same file for the same fact — it
 returns information step 1 did not have, so it is one operation with step 3, per
 the enumerated-set carve-out.
 
+### Where the 800 came from, and what would falsify it
+
+Migrated out of `token-efficiency.md` on 2026-09-09 to fund that rule's
+provided-artifact carve-out — a named substitution rather than a deletion, per
+the council verdict on `blocker: standing-payload-headroom`.
+
+The number is a **stated default, not a measured optimum** — said plainly rather
+than implying a derivation it does not have. *Revisit-if:* a run records a
+probe-then-slice that cost more than the full read would have, or the host's
+ranged-read primitive changes its own default. Either falsifies the number, not
+the obligation.
+
+### The provided-artifact carve-out
+
+A handed-over design artifact is not a large file to be probed; it is the spec,
+and reading it whole is the work. A bundle of several thousand lines across
+markup, CSS and tokens is ordinary, so the agent that reads it properly is the
+one the size gate and the read-loop detector both punish, while the agent that
+skims it produces the fidelity failure `design-fidelity` exists to prevent.
+
+Two obligations, and they compose rather than cancel:
+
+1. **The size gate does not fire on it.** Read the artifact whole.
+2. **The read is declared** — [`context-hygiene`](../../../guidelines/agent-infra/context-hygiene-mechanics.md)
+   § the declared-protocol cap — with its goal, its expected read count and the
+   output shape, before the reading starts. Declaring raises the read-only abort
+   from 5 turns to 8; it never suspends it, and exceeding the declared count by
+   more than 2 is still the violation.
+
+What this does NOT do: it does not exempt an *undeclared* read loop, and it does
+not apply to a file that merely happens to be large. The discriminator is the
+handover, not the size.
+
 ### Exceptions
 
 - Small output (< 30 lines) — read directly.
@@ -187,6 +220,47 @@ Over 40,268 real Bash calls from one maintainer's transcripts:
   measurement artifact. It is not: that shape cannot be written as an
   allowlist pattern at all, so it shrinks only by not being written.
 
+### Re-measured 2026-09-10, with a shipped probe
+
+The figures above were computed once by hand. `autonomy_friction_traffic`
+(`./scripts-run src/scripts/autonomy_friction_traffic --store <dir> --limit 40`)
+recomputes them from a transcript store and shares the live detectors — and the
+metacharacter class is `category_a`'s own exported constant — so those cannot
+drift; the bucket ORDER restates the classifier by hand and is pinned by a test.
+Over **7,569 distinct** Bash calls in 39 transcripts (deduplicated by tool-use
+id, measuring session excluded):
+
+- **1.7 %** (126) are category A. Of the 7,443 uncovered calls, **7,143** are
+  disqualified by a shell metacharacter before their argv is read, 21 name a
+  consequence operation, and **279** get as far as the head list. Widening the
+  head list therefore cannot move this number — the shape can. The 279 is an
+  upper bound: a directory flag whose value escapes the tree lands there too.
+- **73.8 %** (5,585) carry the chain class; `cd` heads 3,573 of the uncovered
+  calls — a different denominator from the shape classes, which count every call.
+- **4.0 %** (306) write a file through the shell: 216 `cat >`, 66 `sed -i`,
+  16 a `python3 -c` opening a path for writing, 7 `perl -i`, 1 `tee`. A **floor**
+  — the rules are a positive list of five commands, so `echo >`, `jq >` and `cp`
+  are silent.
+
+**Two host facts that decide what any of this can buy**, both read out of the
+host's own permission documentation on 2026-09-10. First, `permissions.allow`
+does **not** bypass the auto-mode classifier — they are layers, so an allow
+entry cannot make a prompt go away on its own. Second, "don't ask again" saves a
+permanent rule for a read-only command and only a session-lifetime one for a
+write-shaped one. The second is why the write class earns its own line: no
+amount of confirming makes the next `sed -i` cheaper. The adjacent question —
+whether a hook's `permissionDecision: allow` suppresses the classifier — was
+looked for in the same pass and **not found documented**.
+
+**And a correction to the table below.** `git -C /repo status` is the right
+substitution for the host's matcher, but it is **not** category A: `category_a`
+refuses a global option whose value is absolute, and every cross-worktree
+invocation in a multi-worktree checkout writes an absolute one. So unwinding a
+chain removes the metacharacter without buying the allow. The row stays because
+it is still the cheaper shape; what changes is the claim that it lands inside
+category A. Pinned in `tests/scripts/autonomy_friction_traffic.test.ts` §
+"the recommended substitution is only covered with a RELATIVE path".
+
 ### The substitutions
 
 | Instead of | Write |
@@ -195,6 +269,9 @@ Over 40,268 real Bash calls from one maintainer's transcripts:
 | `V=$(git rev-parse HEAD); echo $V` | two calls, the second using the printed value |
 | `mkdir -p x && cp a x/` | two calls in the same block |
 | `cd sub && <cmd>` | the directory flag the tool already has (`-C`, `--cwd`, `--prefix`) |
+| `sed -i '' -e 's/a/b/' f` | the **Edit** tool — a write-shaped Bash grant expires with the session |
+| `cat > f <<'EOF' … EOF` | the **Write** tool for a new file, **Edit** for a change to an existing one |
+| `python3 -c "open(p,'w').write(s)"` | the same two tools; keep the interpreter for reads and computation |
 
 A loop that genuinely cannot be expressed without the shell stays a loop —
 prefer a script file over an inline `for` when it recurs.
@@ -211,7 +288,17 @@ first time a session chains work. It is ON by default with
 because the fact this one carries is a property of the host's permission
 matcher and holds in every consumer.
 
-**It never blocks, and it fires once.** So it changes what the agent knows,
+Since 2026-09-10 it carries a second shape class — a Bash command that fills a
+file (`sed -i`, `cat > f`, `tee f`, `perl -i`, a `python3 -c` opening a path for
+writing) — and the latch is per class, so a session sees at most one line per
+class instead of one line for whichever mistake came first. A redirect that
+names no file being filled (`2>&1`, `> /dev/null`) is still not a write and is
+still not flagged. The two classes read different views: the chain rules see
+quoted spans and heredocs removed, the write rules see quoted spans removed and
+heredoc BODIES removed with the command line kept — a heredoc marker and the
+redirect sharing its line cannot be separated otherwise.
+
+**It never blocks, and each class fires once.** So it changes what the agent knows,
 not what the agent may do: compliance stays model-carried, and the concern's
 tests establish detector behavior, not adherence. On a host with no
 `pre_tool_use` slot nothing fires at all and the rule is model-carried end to

package/dist/agent-src/contexts/communication/rules-auto/user-interaction-mechanics.md

@@ -189,7 +189,7 @@ rendered as a bulleted list of reasons — declines are short prose (one or
 two sentences), because a bulleted refusal reads as a checklist to argue
 against rather than a direct answer.
 
-Full example set: [`asking-and-brevity-examples § Bullet floor`](../../../../../../docs/guidelines/agent-infra/asking-and-brevity-examples.md#bullet-floor).
+Full example set: [`asking-and-brevity-examples § Bullet floor`](../../../guidelines/agent-infra/asking-and-brevity-examples.md#bullet-floor).
 
 ## Summaries
 
@@ -202,3 +202,53 @@ After completing a batch of actions, provide a summary table:
 | 2 | `test.php` | Updated assertion |
 | 3 | `config.php` | Skipped (intentional) |
 ```
+
+## The trigger is a decision, not a format — the measurement behind it
+
+Migrated out of `user-interaction.md` on 2026-09-11 to pay for Iron Law 3
+under the per-spawn preamble budget. The obligation stays in the rule; this
+is the evidence for it.
+
+Measured (30-session conformance audit, 2026-08-06): **every** malformed ask
+was a one-line parenthetical or a trailing free-text offer — a German
+"say the word if I should take the three lines along", an English "shall I
+implement it this way?" — while the same sessions formatted their **large**
+asks perfectly. So the rule is being read as *if numbered options, then a
+recommendation line*. It is the other way round, and an ask that feels too
+small for a block is exactly the one that escapes the format.
+
+Three further caught shapes: a contentless filler option; an inline
+"(recommended)" tag **beside** the recommendation line (the dual source
+Iron Law 1 forbids); an option set answerable only as `1,3,4`.
+
+**No gate ships for this.** `check_reply_consistency` can read a draft on
+stdin, but it inspects *numbered-option blocks* — and every measured failure
+had no block by construction, so it scans exactly the surface that did not
+fail. `conformance:behavior` deliberately does not score ask-shape, so an
+unmoved rate is a finding rather than a silence.
+
+## Iron Law 3 — why laws 1 and 2 do not reach across a turn boundary
+
+Iron Laws 1 and 2 are discharged by the shape of the reply that carries the
+block. Neither survives a turn boundary, which is the gap Iron Law 3 closes:
+a second assistant execution with no user message between it and the ask is
+not a new conversation, and from the user's side a thread that ends without
+the question ended without the question.
+
+**The measured failure.** A turn put three numbered options and a
+recommendation line to the user. A `stop` concern then produced a second
+assistant execution with no intervening user message, and that second reply
+handled the concern while demoting the open question to a subordinate clause.
+The four rules that could have caught it did not, each for a stated reason:
+Iron Law 1 inspects a reply that HAS an options block, `check_reply_consistency`
+receives a draft rather than a transcript, `active-remediation` governs
+findings rather than issued decisions, and `no-cheap-questions` guards the
+opposite direction.
+
+**Carrier, stated honestly.** The deterministic half is the
+`pending-decision` detector in `src/scripts/hooks/turn_end_gate_hook.ts` —
+it refuses a turn-end when an earlier reply in the same user turn carried a
+block and the closing reply carries none. It sees one user turn on one host,
+so everything outside that is model-carried, exactly like Iron Law 2's own
+"no gate ships for this" note. `check_reply_consistency` reads a single draft
+and holds no cross-turn state; it cannot see this law at all.

package/dist/agent-src/contexts/contracts/frugality-charter.md

@@ -56,4 +56,4 @@ kernel chars. The pointers below replace them.
 
 ## Decidable carve-out predicates
 
-Predicates with one-sentence tests live in [`docs/guidelines/agent-infra/carve-out-predicates.md`](../../../docs/guidelines/agent-infra/carve-out-predicates.md). Default-terse applies unless a predicate's test is yes/no decidable from the artifact alone.
+Predicates with one-sentence tests live in [`docs/guidelines/agent-infra/carve-out-predicates.md`](../../guidelines/agent-infra/carve-out-predicates.md). Default-terse applies unless a predicate's test is yes/no decidable from the artifact alone.

package/dist/agent-src/contexts/execution/auto-dispatch-classification.md

@@ -129,7 +129,7 @@ tier `inferSliceTier` (§ below) already raised.
 Deny-by-default — a direction not listed here is denied. Direction rules,
 payload allow/deny lists, the report-only boundary, the no-recursion clause and
 the human egress gate:
-[`cross-vendor-worker-direction`](../../../../docs/contracts/cross-vendor-worker-direction.md).
+[`cross-vendor-worker-direction`](../../docs/contracts/cross-vendor-worker-direction.md).
 Role pairs, never vendor names — `classifyLadder` carries no vendor identity
 ([`subagent-routing`](subagent-routing.md) § Why vendor-neutral).
 

package/dist/agent-src/contexts/execution/auto-orchestration-activation.md

@@ -20,7 +20,7 @@ set, and what the host can physically do.
 | `subagents.downshift` | `true` | Route delegable sub-tasks to the lowest-capable tier (Phase 2). |
 | `subagents.quota_arbitrage` | `true` | Prefer a separate-quota-pool model where the host manifest allows it (Phase 2 bonus). |
 | `subagents.model_map` | `{}` | Optional per-tier model override for downshift routing. |
-| `emergency.orchestration_halt` | `false` | The ONE audited incident switch — see [`settings-classes.md`](../../../../docs/contracts/settings-classes.md) § "The one exception". NOT an activation gate: on-by-default, ceremony-free to arm, requires a non-empty `orchestration_halt_justification` to disarm. |
+| `emergency.orchestration_halt` | `false` | The ONE audited incident switch — see [`settings-classes.md`](../../docs/contracts/settings-classes.md) § "The one exception". NOT an activation gate: on-by-default, ceremony-free to arm, requires a non-empty `orchestration_halt_justification` to disarm. |
 
 ## Activation decision
 

package/dist/agent-src/contexts/execution/autonomy-mechanics.md

@@ -13,7 +13,7 @@ relevant. Detection logic lives in [`autonomy-detection.md`](autonomy-detection.
 | `auto` (default) | Same as `off` by default. Flips to `on` for the rest of the conversation as soon as the user expresses the intent "stop asking, just work". See [detection logic](autonomy-detection.md) — match by **intent**, not exact string. The flip never lifts the Hard Floor. |
 
 The value is read once on the first turn (per
-[`layered-settings`](../../../docs/guidelines/agent-infra/layered-settings.md#section-aware-merge-rules))
+[`layered-settings`](../../guidelines/agent-infra/layered-settings.md#section-aware-merge-rules))
 and cached. Missing key → treat as `auto` (fail-closed — same behavior
 as the shipped template default; absence of a key never grants the most
 permissive mode). The one exception is the explicit cloud carve-out

package/dist/agent-src/contexts/execution/cheap-question-mechanics.md

@@ -4,7 +4,7 @@ Catalog material for [`no-cheap-questions`](../../rules/no-cheap-questions.md)
 
 ## Cheap classes — full catalog
 
-Sequencing · format-only · commit / CI / test asks · fenced re-ask · Iron-Law option · context-derived · dominant option · re-ask after decline · paternalistic (IL 3) · continuation under mandate (IL 4) · prereq-for-authorized-action (IL 5) · destination-already-stated (IL 6) · self-cleaning artefact follow-up · disguised commit ask (preview-as-bait) · commit-chunking-strategy (one-or-multiple / which-first / how-to-split). Extended examples: [`asking-and-brevity-examples`](../../../docs/guidelines/agent-infra/asking-and-brevity-examples.md#cheap-question-class-catalog--extended-examples).
+Sequencing · format-only · commit / CI / test asks · fenced re-ask · Iron-Law option · context-derived · dominant option · re-ask after decline · paternalistic (IL 3) · continuation under mandate (IL 4) · prereq-for-authorized-action (IL 5) · destination-already-stated (IL 6) · self-cleaning artefact follow-up · disguised commit ask (preview-as-bait) · commit-chunking-strategy (one-or-multiple / which-first / how-to-split). Extended examples: [`asking-and-brevity-examples`](../../guidelines/agent-infra/asking-and-brevity-examples.md#cheap-question-class-catalog--extended-examples).
 
 ## Iron Law 3 — No Paternalistic State-Assuming Options
 

package/dist/agent-src/contexts/execution/contract-decision-sheet.md

@@ -24,7 +24,7 @@ sheet-eligible when **all** hold:
 - it is answerable **before** the run starts — its answer does not depend on
   something the run itself produces;
 - its decision class is `trivial`, `low_impact`, or `medium_impact`
-  ([`ai-council-config`](../../../docs/contracts/ai-council-config.md)
+  ([`ai-council-config`](../../docs/contracts/ai-council-config.md)
   § decision_resolution);
 - a **conservative default** exists and can be stated in one line.
 
@@ -68,7 +68,7 @@ cost: each override is a decision the default did not carry.
 
 The contradiction was resolved on **the sheet's** side deliberately, and the
 asymmetry is durable rather than incidental: `user-interaction` is one of the
-locked nine ([`kernel-membership § 4`](../../../docs/contracts/kernel-membership.md)),
+locked nine ([`kernel-membership § 4`](../../docs/contracts/kernel-membership.md)),
 so amending its clause is an owner-reserved edit that `block-kernel-rule-writes`
 refuses at tool-call time, while the answer SHAPE is this page's own. When a
 page and a kernel rule contradict each other, the page is both the cheaper half
@@ -110,6 +110,6 @@ by whichever mechanism happened to hit them first.
 
 - [`roadmap-execution-contract`](roadmap-execution-contract.md) — the screen this renders inside; its single Accept is the authorization.
 - [`roadmap-process-loop § 3`](roadmap-process-loop.md) — the pre-scan that produces the rows, and the § 3a ladder that decides whether a contract is derived at all.
-- [`ai-council-config`](../../../docs/contracts/ai-council-config.md) § decision_resolution — the class table and the locked-class Iron Law.
+- [`ai-council-config`](../../docs/contracts/ai-council-config.md) § decision_resolution — the class table and the locked-class Iron Law.
 - [`ask-when-uncertain`](../../rules/ask-when-uncertain.md) — one question per turn; one sheet answered by one keystroke is one question.
 - [`user-interaction`](../../rules/user-interaction.md) — the numbered-options shape and the single recommendation line.

package/dist/agent-src/contexts/execution/mandated-lines.md

@@ -175,6 +175,6 @@ counter and is the first thing to look at before adding a sixth line.
 
 ## See also
 
-- [`docs/contracts/settings-classes.md`](../../../docs/contracts/settings-classes.md) — a sibling contract in the same shape: prose that a gate reads.
+- [`docs/contracts/settings-classes.md`](../../docs/contracts/settings-classes.md) — a sibling contract in the same shape: prose that a gate reads.
 - [`verify-before-complete`](../../rules/verify-before-complete.md) — the evidence gate the pre-send sweep runs beside.
 - `src/scripts/lint_mandated_lines.ts` — the deterministic half.

package/dist/agent-src/contexts/execution/non-interactive-contract.md

@@ -127,6 +127,6 @@ A misbehaving heuristic is disabled by config, not by reverting 6.1.0.
 
 ## See also
 
-- [`command-clusters`](../../../docs/contracts/command-clusters.md) — the locked cluster/sub-command set.
+- [`command-clusters`](../../docs/contracts/command-clusters.md) — the locked cluster/sub-command set.
 - [`user-interaction`](../../rules/user-interaction.md) — numbered-options + recommendation rules the interactive path obeys.
 - [`non-destructive-by-default`](../../rules/non-destructive-by-default.md) — the Hard Floor destructive sub-commands still answer to.

package/dist/agent-src/contexts/execution/orchestration-telemetry.md

@@ -243,7 +243,7 @@ removes or tightens THE TRIGGER, and the removal PR cites the numbers.
 
 ## Related
 
-- [`audit-log-v1`](../../../../docs/contracts/audit-log-v1.md) — the frozen
+- [`audit-log-v1`](../../docs/contracts/audit-log-v1.md) — the frozen
   JSONL contract this object rides on; the `orchestration` field is optional
   and additive, schema_version unchanged.
 - [`host-capability-manifest`](host-capability-manifest.md) — the manifest that

package/dist/agent-src/contexts/execution/plan-confidence-gate.md

@@ -7,7 +7,7 @@ the [`roadmap-writing`](../../skills/roadmap-writing/SKILL.md) skill,
 [`/feature:roadmap`](../../commands/feature/roadmap.md) — each of which links
 here instead of restating the gate. Machine-checked grammars (the C→R1 state
 schema, marker lines) are owned by
-[`docs/contracts/plan-review-gates.md`](../../../docs/contracts/plan-review-gates.md);
+[`docs/contracts/plan-review-gates.md`](../../docs/contracts/plan-review-gates.md);
 this context carries the agent-side procedure.
 
 ## Activation
@@ -22,7 +22,7 @@ equivalents drop the gate immediately
 (`DE: "einfach schreiben", "Interview überspringen" · EN: "just write it", "skip the interview"`).
 A bypass is **counted**, never punished: append a `gate_c_bypass` event to
 `agents/evidence/metrics/gate-metrics.jsonl` (see
-[`plan-review-gates § metrics`](../../../docs/contracts/plan-review-gates.md))
+[`plan-review-gates § metrics`](../../docs/contracts/plan-review-gates.md))
 so gate erosion stays visible.
 
 ## When it fires — and when NOT
@@ -127,7 +127,7 @@ On completing the gate (either path that ran an interview), write
 `agents/runtime/state/gate-c-<plan-slug>.json` so the R1 risk pass never
 re-asks resolved branches — the user is never interviewed twice for one
 plan. Schema (canonical:
-[`plan-review-gates § C→R1 handoff`](../../../docs/contracts/plan-review-gates.md)):
+[`plan-review-gates § C→R1 handoff`](../../docs/contracts/plan-review-gates.md)):
 resolved branches, plan hash, timestamp, and a mandatory `transcript_ref`
 (path + content hash of the interview transcript artifact).
 
@@ -136,7 +136,7 @@ resolved branches, plan hash, timestamp, and a mandatory `transcript_ref`
 lint and no hook entry behind it, and the state file is gitignored so CI never
 sees it — a human reading the diff is what catches a violation (stated
 `enforced_by: none` in
-[`plan-review-gates § 4.1`](../../../docs/contracts/plan-review-gates.md)).
+[`plan-review-gates § 4.1`](../../docs/contracts/plan-review-gates.md)).
 The rule defends against silent agent shortcuts, not against the local human
 (who holds the settings escape hatch anyway).
 Confident-path runs (no interview) write no state file; R1 then runs its
@@ -155,7 +155,7 @@ risk pass fresh.
 
 - [`/challenge-me vision`](../../commands/challenge-me/vision.md) — the four
   95%-conditions and the interview this gate routes into.
-- [`plan-review-gates`](../../../docs/contracts/plan-review-gates.md) — machine
+- [`plan-review-gates`](../../docs/contracts/plan-review-gates.md) — machine
   grammars: C→R1 state schema, Risk Register, completion review.
 - [`ask-when-uncertain`](../../rules/ask-when-uncertain.md) — the
   one-question-per-turn floor the degrade protocol runs under.

package/dist/agent-src/contexts/execution/roadmap-execution-contract.md

@@ -191,7 +191,7 @@ bodies.
 Identity semantics, revision semantics, the three senses of "gate" and the
 `[AC:<id>]` convention — including the verified fact that nothing parses
 `verify:` lines structurally today — are in
-[`guideline:agent-infra/traceability-field-mechanics`](../../../../docs/guidelines/agent-infra/traceability-field-mechanics.md).
+[`guideline:agent-infra/traceability-field-mechanics`](../../guidelines/agent-infra/traceability-field-mechanics.md).
 They are not optional reading: a slug grammar does not imply a namespace, and
 `evidence_refs` are syntactically safe tokens rather than verified evidence.
 

package/dist/agent-src/contexts/execution/subagent-modes-detail.md

@@ -114,7 +114,7 @@ Cross-wing or cross-skill chain executed across isolated git
 worktrees — each handoff in the chain runs in its own worktree, so
 the workspace state of one step never leaks into the next. Operationalizes
 the worktree boundary clause in
-[`docs/contracts/cross-wing-handoff.md`](../../../../docs/contracts/cross-wing-handoff.md)
+[`docs/contracts/cross-wing-handoff.md`](../../docs/contracts/cross-wing-handoff.md)
 § 3. State-machine layer only — worktree creation/destruction lives
 in [`using-git-worktrees`](../../skills/using-git-worktrees/SKILL.md) and
 [`finishing-a-development-branch`](../../skills/finishing-a-development-branch/SKILL.md).

package/dist/agent-src/contexts/execution/subagent-routing.md

@@ -49,7 +49,7 @@ THE SAME MINUS THE QUOTA WIN.
    for a removed category — and because `session_tier` sits non-null in 0 of 327
    records, leaving the saving unmeasurable in principle. Migration record and
    the union revisit-if:
-   [`budget-routing` contract](../../../../docs/contracts/budget-routing.md).
+   [`budget-routing` contract](../../docs/contracts/budget-routing.md).
    **Tier resolution therefore ends at step 3.** What survives of the module is
    `TIER_ORDER` and `readCooldowns`, read by `routing:doctor` as a diagnostic —
    monitoring, not routing, and note that nothing writes the cool-down file any
@@ -177,7 +177,7 @@ This resolves the direction; it does not license downshifting as a target. The
 cold start is paid per leg regardless of tier, which is precisely what the
 non-escalation floor above bounds. Analogous downgrade/cache coupling on the
 council side: see
-[`docs/contracts/ai-council-config.md`](../../../../docs/contracts/ai-council-config.md)
+[`docs/contracts/ai-council-config.md`](../../docs/contracts/ai-council-config.md)
 § `model_downgrade` for the analogous downgrade/cache coupling this suite
 already ships on the council side.
 

package/dist/agent-src/contexts/execution/subagent-spawn-contract.md

@@ -22,7 +22,7 @@ task without re-inventing any taxonomy.
 
 | Element | Source |
 |---|---|
-| `role_mode` | The six contracts in [`role-contracts`](../../../docs/guidelines/agent-infra/role-contracts.md). A review sub-task → `reviewer`; a planning sub-task → `planner`; default → null (no contract). |
+| `role_mode` | The six contracts in [`role-contracts`](../../guidelines/agent-infra/role-contracts.md). A review sub-task → `reviewer`; a planning sub-task → `planner`; default → null (no contract). |
 | `profile` | The active profile (`profile.id` in `.agent-settings.yml`); inherited from the session unless the sub-task is a different domain. |
 | `personas` | The persona ids already cited in the task's skill frontmatter (review lenses). Capped at 2 (`MAX_PERSONAS`). |
 | `knowledge_refs` | A SMALL set of knowledge references (ingest ids / file paths) relevant to the sub-task. Capped at 5 (`MAX_KNOWLEDGE_REFS`). |

package/dist/agent-src/contexts/execution/user-memory-channels.md

@@ -18,7 +18,7 @@ behaviour was to detect it and throw it away. It now has a second
 destination: `~/.event4u/agent-config/user/observations.jsonl`, the global
 observation buffer from ADR-138's sibling phase — mirroring, one level up,
 the project-local `.agent-user.observations.jsonl` contract in
-[`agent-user-schema.md § Observation buffer`](../../../docs/contracts/agent-user-schema.md#observation-buffer).
+[`agent-user-schema.md § Observation buffer`](../../docs/contracts/agent-user-schema.md#observation-buffer).
 
 **The project-scoped rule in Phase 3 (CONSOLIDATE) is unchanged.** No user
 fact enters `agents/memory/` curated YAML through this or any other path —
@@ -73,7 +73,7 @@ than at review, and from reusing the existing redaction gate verbatim:
   birthdays · financial figures · health / legal / therapy status ·
   demographics · external-source identifiers — refused when the
   observation is captured, per
-  [`agent-user-schema.md § Explicit exclusions`](../../../docs/contracts/agent-user-schema.md#explicit-exclusions).
+  [`agent-user-schema.md § Explicit exclusions`](../../docs/contracts/agent-user-schema.md#explicit-exclusions).
 - **Hidden unicode.** Every write routes through
   `knowledge_global_redaction.redaction_scan`, including its
   `hidden_unicode` class (the ADR-103 zero-width-smuggling detector) — the
@@ -120,7 +120,7 @@ against the project root once, during ORIENT:
   `seen_in[]` recurrence tally to the fact and appends it to the SAME
   global buffer Phase 2 uses — never a second store, never a
   project-indexed directory (the council's round-2 namespace refusal; see
-  [`agent-user-schema.md § Project attribution`](../../../docs/contracts/agent-user-schema.md#project-attribution-road-to-global-user-memory-phase-3)).
+  [`agent-user-schema.md § Project attribution`](../../docs/contracts/agent-user-schema.md#project-attribution-road-to-global-user-memory-phase-3)).
 
 **This is the only generalisation path.** A fact recurring in a
 *different* unmanaged project (Jaccard similarity ≥ `MERGE_THRESHOLD`,

package/dist/agent-src/contexts/execution/verification-mechanics.md

@@ -96,6 +96,6 @@ on the follow-up PR.
 ### Examples
 
 Wrong/right/why demos (hedged claims, trusting earlier runs,
-partial-verification creep): [`verify-before-complete-demos`](../../../../docs/guidelines/agent-infra/verify-before-complete-demos.md).
+partial-verification creep): [`verify-before-complete-demos`](../../guidelines/agent-infra/verify-before-complete-demos.md).
 Outcome baseline:
 [`tests/golden/outcomes/verify_before_complete.json`](../../../../tests/golden/outcomes/verify_before_complete.json).

package/dist/agent-src/contexts/judges/persona-voice-rubric.md

@@ -133,8 +133,8 @@ files `contexts/judges/no-consolidate-rationale.md`.
 
 ## References
 
-- [`docs/contracts/context-paths.md`](../../../docs/contracts/context-paths.md)
+- [`docs/contracts/context-paths.md`](../../docs/contracts/context-paths.md)
   — locked path tree (this file lives at `contexts/judges/`).
-- [`docs/contracts/load-context-schema.md`](../../../docs/contracts/load-context-schema.md)
+- [`docs/contracts/load-context-schema.md`](../../docs/contracts/load-context-schema.md)
   — frontmatter contract for citing this rubric from a slimmed `judge-*`
   skill in Phase 3a.2.

package/dist/agent-src/guidelines/abstraction-thresholds.md

@@ -0,0 +1,88 @@
+# Abstraction Thresholds — the per-class canon
+
+> The single source of truth for "how many repetitions before you extract". Every
+> other artifact that states a numeric extraction threshold cites this table and
+> names its artifact class — a bare number outside this file is drift
+> (enforced by `src/scripts/lint_abstraction_thresholds.ts`).
+
+_Origin: council convergence 2026-08-03 (claude-sonnet-4-5 + gpt-4o, unanimous), recorded in ADR-213. Before this file, four artifacts stated four bare numbers (2 / 3+ / ≥4 / ≥3) with no scope tags — an agent loading them together received contradictory instructions._
+
+## Why the bars differ — cost scales with the artifact class
+
+Extracting a pure helper function is a near-zero-cost act; extracting a stateful
+UI component creates a file, a props contract, and a test surface. The threshold
+is a price signal: the heavier the extraction, the more proven repetition it
+must buy. These are **deliberately different bars for different acts**, not
+editorial drift.
+
+## The canon
+
+| Artifact class | Concrete tag (what to check) | Threshold |
+|---|---|---|
+| **Code-level abstraction** — helper, method, class, Strategy, generic, config layer | any non-UI code shape | **2 real repetitions** (or a genuine second axis of change) |
+| **Pure-markup UI shell** — props-only fragment, no state (button shell, card frame, header) | renders props, holds no state | **3+ uses** |
+| **Stateful UI component** — carries real props/state (form, table, filter) | repeats **AND** has varying props / local state | **~4+ repeats AND real state** (both conditions) |
+| **Utility-class string** (Tailwind et al.) — repeated class list | identical class string | **≥ 3 duplications** (mechanism table: [`tailwind-engineer`](../skills/tailwind-engineer/SKILL.md)) |
+
+The code-level bar of **two** is this suite's settled base decision (the
+borrowed "Rule of Three" for code was evaluated and not adopted — see
+[`minimal-safe-diff-mechanics`](agent-infra/minimal-safe-diff-mechanics.md)).
+The UI rows are scoped carve-outs **above** that base bar, never a license to
+lower it.
+
+## The qualitative floor — applies to every row
+
+A number alone never justifies an extraction. In every class, a reviewer must
+be able to name the **concrete duplication or the concrete second axis of
+change** the abstraction removes. One occurrence is not a component; one branch
+is not a Strategy; a repeat with no varying props is inlined, not extracted.
+
+## Precedence
+
+[`minimal-safe-diff`](../rules/minimal-safe-diff.md) / YAGNI win on every
+conflict: these thresholds authorize extraction when repetition is **already
+present in the diff** — never speculative abstraction for "this could grow
+later". See [`component-oriented-and-oop-development`](component-oriented-and-oop-development.md)
+§ The load-bearing caveat.
+
+## The provided-artifact clause — repetition observable before the code exists
+
+ADR-213 authorises extraction on repetition **already present in the diff**. A
+handed-over **runnable** artifact makes repetition observable before any code
+exists at all: four `<Card>` instances are visible in the handover, so a port
+that writes them one at a time and extracts on the second is doing the
+threshold's own arithmetic in the wrong order.
+
+This is a **different mechanism** than the one the threshold tested, not a
+loophole in it. `adr_cite_check ADR-213` reports the record LIVE with an
+**indeterminate** review trigger and `reopen_policy: unclassified`, so
+investigation is permitted; the numbers themselves — 2 · 3+ · ~4+ — are
+**unchanged**, and this clause moves only *when* the count may be taken.
+
+**Two guards, both required. The first alone is insufficient.**
+
+1. **A runnable artifact, not a design comp.** A comp shows a picture of four
+   cards; a runnable artifact carries four instances of a thing. Counting
+   rectangles in an image is not counting repetition, and a comp therefore does
+   not qualify.
+2. **Repetition of the ELEMENT, not of its compositional context.** Four
+   `<Card>` instances show that Card is used four times. They do **not** show
+   that a `CardGrid` is needed — that needs multiple distinct contexts each
+   arranging several cards. Without this guard the clause would license
+   extracting a wrapper for every layout the artifact happens to contain once,
+   which is speculative abstraction with an artifact as its excuse.
+
+**Enforcement, stated honestly: guard (2) is model-carried and audit-enforced.**
+Nothing mechanical separates *"I saw four Cards"* from *"I saw a CardGrid
+pattern"* — the distinction is about what the repetition MEANS, and
+`lint_abstraction_thresholds.ts` checks numeric threshold drift, which is a
+different property. Guard (1) is checkable (is the handover runnable), guard (2)
+is not, and claiming otherwise would be the coverage inflation this tree forbids
+elsewhere. The discipline is the control.
+
+## See also
+
+- [`architecture`](../rules/architecture.md) — the rule that carries the code-level bar.
+- [`fe-design`](../skills/fe-design/SKILL.md) § Component granularity — the UI-shell bar in context.
+- [`ui-component-architect`](../skills/ui-component-architect/SKILL.md) § Componentization threshold — the stateful-component bar in context.
+- ADR-213 — the decision record scoping the bars.