@event4u/agent-config 14.23.0 → 16.0.0

package/dist/scripts/condense.js

@@ -32,6 +32,7 @@ import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import * as YAML from 'yaml';
 import { _domains_command_logical, artefact_roots as _agent_src_artefact_roots, iter_all_sources as _agent_src_iter_all_sources, resolve_logical as _agent_src_resolve_logical, strip_source_prefix, } from './_lib/agent_src.js';
+import { rewriteProjectedBodyLinks } from './_lib/guidelines_lane.js';
 // Import-safety note: `project_thin_rules` guards its CLI entry
 // (`_isCliEntry()` before `process.exit(main())`), so importing it here is
 // side-effect-free. condense.ts is bundled into the installer, where a bare
@@ -693,7 +694,6 @@ const _PROJECTED_SRC_PREFIX = 'dist/agent-src/';
 const _LEGACY_PROJECTED_SRC_PREFIX = '.agent-src/';
 const _FM_LIST_ITEM_RE = /^(\s*-\s*)(["']?)([^"'\n]+?\.md)(["']?)\s*$/;
 const _FM_PATH_PREFIX_RE = /^(\s*(?:-\s+)?path_prefix:\s*)(["']?)([^"'\n]+?)(["']?)\s*$/;
-const _BODY_DOCS_RE = /\.\.\/\.\.\/(docs\/(?:guidelines|contracts)\/[^)\s]+\.md)/g;
 const _FM_PLAIN_LIST_RE = /^\s*-\s*(["']?)([^"'\n]+?)\1\s*$/;
 const _HRR_BANNER_MARKER = '<!-- agent-config:human-review-banner -->';
 function _depth_prefix(source_relative_path) {
@@ -766,9 +766,6 @@ function _rewrite_frontmatter_lines(lines, prefix) {
     }
     return out;
 }
-function _rewrite_body_links(body, prefix) {
-    return body.replace(_BODY_DOCS_RE, (_m, tail) => prefix + tail);
-}
 function _parse_trust_and_owner(fm_lines) {
     let level = 'core';
     let hrr = false;
@@ -822,7 +819,7 @@ function _inject_hrr_banner(body, level, owner) {
 export function _rewrite_paths(content, source_relative_path) {
     const prefix = _depth_prefix(source_relative_path);
     const [fm_lines, bodyInitial] = _split_frontmatter(content);
-    let body = _rewrite_body_links(bodyInitial, prefix);
+    let body = rewriteProjectedBodyLinks(bodyInitial, prefix);
     if (fm_lines === null) {
         return body;
     }

package/dist/server/io/yamlIO.js

@@ -33,6 +33,24 @@ function formatScalar(value) {
     // Arrays / nested objects: dump inline. Form keeps depth ≤ 2 so this is rare.
     return yamlDump(value, { lineWidth: -1, flowLevel: 0 }).replace(/\n$/, '').trim();
 }
+/**
+ * A NESTED mapping key, as both the presence probe and the insertion walk read
+ * one. Shared so the writer and its own existence-probe cannot drift apart —
+ * that drift is the shape this file has now hit four times.
+ *
+ * `-` is in the class because a dashed key is ordinary YAML (`first-name`,
+ * `dry-run`, `retry-count`) and `detectIndentWidth` already accepted one.
+ * While this pattern did not, `findScalarLine` could never find such a key:
+ * `mergeIntoTemplate` then wrote a bogus top-level `x.first-principles:` line
+ * beside the real nested one and the intended value was never written — a save
+ * that silently did nothing — and `upsertScalar` appended another child line on
+ * EVERY call, growing without bound until the file stopped parsing.
+ *
+ * `.` stays OUT, deliberately. A dotted key is the FLAT form, which
+ * `replaceFlatDottedKey` owns; letting this pattern match `a.b:` would make the
+ * nested probe claim a line that is one key literally named "a.b".
+ */
+const NESTED_KEY_RE = /^([A-Za-z_][A-Za-z0-9_-]*)\s*:/;
 function flatten(value, prefix = []) {
     if (value === null || typeof value !== 'object' || Array.isArray(value)) {
         return [{ path: prefix, value }];
@@ -55,6 +73,25 @@ export function replaceScalar(template, dottedPath, value) {
     const sections = dottedPath.slice(0, -1);
     const key = dottedPath[dottedPath.length - 1];
     const lines = template.split('\n');
+    const at = findScalarLine(lines, sections, key);
+    if (at === -1)
+        return template;
+    const width = detectIndentWidth(lines);
+    lines[at] = `${' '.repeat(width * sections.length)}${key}: ${formatScalar(value)}`;
+    return lines.join('\n');
+}
+/**
+ * Index of the line holding the scalar at `sections`/`key`, or -1.
+ *
+ * Split out of `replaceScalar` so that "is this path present?" is answerable
+ * WITHOUT writing. `mergeIntoTemplate` used to infer presence from
+ * `replaceScalar` returning a changed string, which conflates "absent" with
+ * "present and already equal to the value being written" — under that test a
+ * no-op write reads as a miss and the caller appends a duplicate mapping key.
+ * A presence question answered by a mutation's side effect is the shape to
+ * look for here; the file already carries two earlier rounds of it.
+ */
+function findScalarLine(lines, sections, key) {
     // The document's own width, the same read `upsertScalar` performs.
     //
     // R2 round 5, finding 1, and it is the second half of round 4's finding 7.
@@ -71,9 +108,7 @@ export function replaceScalar(template, dottedPath, value) {
     // A writer and its own existence-probe disagreeing about the format is the
     // shape to look for whenever one of a pair is taught something new.
     const width = detectIndentWidth(lines);
-    const targetIndent = ' '.repeat(width * sections.length);
     const currentPath = new Array(sections.length).fill(null);
-    const formatted = formatScalar(value);
     for (let i = 0; i < lines.length; i++) {
         const line = lines[i];
         if (line === undefined)
@@ -87,7 +122,7 @@ export function replaceScalar(template, dottedPath, value) {
         const level = indentLen / width;
         if (level > sections.length)
             continue;
-        const m = /^([A-Za-z_][A-Za-z0-9_]*)\s*:/.exec(stripped);
+        const m = NESTED_KEY_RE.exec(stripped);
         if (!m)
             continue;
         const lineKey = m[1];
@@ -110,10 +145,9 @@ export function replaceScalar(template, dottedPath, value) {
             continue;
         if (lineKey !== key)
             continue;
-        lines[i] = `${targetIndent}${key}: ${formatted}`;
-        return lines.join('\n');
+        return i;
     }
-    return template;
+    return -1;
 }
 /**
  * The indent width this document actually uses, or 2 when it has no nesting.
@@ -181,11 +215,19 @@ export function detectIndentWidth(lines) {
 export function upsertScalar(template, dottedPath, value) {
     if (dottedPath.length === 0)
         return template;
-    const replaced = replaceScalar(template, dottedPath, value);
-    if (replaced !== template)
-        return replaced;
     const sections = dottedPath.slice(0, -1);
     const key = dottedPath[dottedPath.length - 1];
+    // Presence is asked, never inferred from the write changing the text. The
+    // string compare that used to stand here read "key already holds this
+    // value" as "key absent" and fell through to the append below — so saving
+    // the wizard's council page twice WITHOUT changing a toggle wrote a second
+    // `api_on_quota:` into the same block, over two `{ok: true}` responses, and
+    // left `.ai-council.yml` rejected by a strict parser. Third instance of one
+    // shape in this file; `findScalarLine` exists to end it, and a fix that
+    // taught only `mergeIntoTemplate` would have left the live path here.
+    if (findScalarLine(template.split('\n'), sections, key) !== -1) {
+        return replaceScalar(template, dottedPath, value);
+    }
     const formatted = formatScalar(value);
     const lines = template.split('\n');
     // The document's OWN indent width, not an assumed two.
@@ -229,7 +271,7 @@ export function upsertScalar(template, dottedPath, value) {
             const indentLen = line.length - line.trimStart().length;
             if (indentLen !== indent.length)
                 continue;
-            const m = /^([A-Za-z_][A-Za-z0-9_]*)\s*:/.exec(line.trim());
+            const m = NESTED_KEY_RE.exec(line.trim());
             if (m !== null && m[1] === want) {
                 found = i;
                 break;
@@ -271,23 +313,139 @@ export function upsertScalar(template, dottedPath, value) {
     lines.splice(insertAt, 0, ...block);
     return lines.join('\n');
 }
+/**
+ * Rewrite an existing top-level `a.b.c: value` line — the FLAT form
+ * `mergeIntoTemplate` itself appends when a path has no template entry.
+ * Returns the template unchanged when no such line exists.
+ *
+ * `replaceScalar` cannot see this line: its key pattern is
+ * `[A-Za-z_][A-Za-z0-9_]*`, with no dot, so a path this module appended on
+ * one pass is invisible to the probe on the next and `mergeIntoTemplate`
+ * appends a SECOND copy. Two wizard saves therefore produce a file carrying
+ * duplicate mapping keys — a strict parser rejects it outright, which is what
+ * wedged `task release`: its `sync` step exits 2 with "Map keys must be
+ * unique" before the release does any git work.
+ *
+ * A pre-existing duplicate run is COLLAPSED, not merely updated: the first
+ * occurrence keeps its position and takes the new value, every later one is
+ * dropped. Collapsing is value-neutral — a lenient reader already resolved
+ * such a run last-wins — and it is the only way a file corrupted by the old
+ * behaviour becomes parseable again through the ordinary write path.
+ *
+ * Deliberately NOT folded into `replaceScalar`: `upsertScalar` calls that
+ * probe and documents the flat form as the WRONG shape for a nested key (a
+ * reader sees one key literally named "a.b"). Teaching the shared probe to
+ * match it would make `upsertScalar` write into that broken line instead of
+ * creating the nesting. The flat form is legitimate only here, where this
+ * function is the one that wrote it.
+ */
+function replaceFlatDottedKey(template, dottedPath, value) {
+    if (dottedPath.length < 2)
+        return { found: false, body: template };
+    const flat = dottedPath.join('.');
+    const lines = template.split('\n');
+    const hits = [];
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (line === undefined)
+            continue;
+        // Top level only — an indented `a.b:` is somebody else's child key.
+        if (line.length !== line.trimStart().length)
+            continue;
+        const m = /^([A-Za-z_][A-Za-z0-9_.-]*)\s*:/.exec(line);
+        if (m === null || m[1] !== flat)
+            continue;
+        hits.push(i);
+    }
+    if (hits.length === 0)
+        return { found: false, body: template };
+    lines[hits[0]] = `${flat}: ${formatScalar(value)}`;
+    // Drop the later copies back-to-front so the earlier indices stay valid.
+    for (let i = hits.length - 1; i >= 1; i--)
+        lines.splice(hits[i], 1);
+    return { found: true, body: lines.join('\n') };
+}
+/**
+ * Drop every top-level `a.b.c:` line for a path whose NESTED form the caller
+ * has just resolved.
+ *
+ * Which reader this preserves, because the two forms can disagree and only one
+ * of them is ever consulted: by YAML semantics `a.b.c` is reached by walking
+ * the `a` mapping, so a top-level key literally named "a.b.c" is a DIFFERENT
+ * path that no lookup of the dotted one visits. Removing it therefore changes
+ * no reader's answer — strict and lenient alike already resolve through the
+ * nesting — while leaving it keeps the one line a human scanning the file
+ * reads as the value, saying something the program never agreed with. It
+ * cannot self-heal either: the duplicate-key pass sees a single occurrence,
+ * and `mergeIntoTemplate` writes the nested side, so the line is permanent.
+ *
+ * The nested twin IS the safety argument, not a convenience. A flat `a.b:`
+ * standing ALONE is a key somebody may have meant — `mergeIntoTemplate`'s own
+ * fallback branch writes exactly that shape for a path the template lacks — and
+ * this function is never reached for one: the caller takes the
+ * `replaceFlatDottedKey` branch instead, which updates that line in place.
+ *
+ * Two bounds, each of which turns the sweep into a data-loss bug if dropped:
+ *
+ *   - Two segments minimum. A one-segment path joins to a name with no dot, so
+ *     the match below would hit the very line `replaceScalar` just wrote and
+ *     delete the key the caller asked to set — a rewrite silently becoming a
+ *     removal. Same guard, same reason, as `replaceFlatDottedKey`.
+ *   - Top level only, the bound `replaceFlatDottedKey` also draws: an INDENTED
+ *     `a.b:` is somebody else's child key (`parent:` / `  a.b:` means
+ *     `parent['a.b']`), an unrelated path this sweep has no claim on.
+ */
+function dropFlatDottedTwins(template, dottedPath) {
+    if (dottedPath.length < 2)
+        return template;
+    const flat = dottedPath.join('.');
+    const lines = template.split('\n');
+    const kept = lines.filter((line) => {
+        if (line.length !== line.trimStart().length)
+            return true;
+        const m = /^([A-Za-z_][A-Za-z0-9_.-]*)\s*:/.exec(line);
+        return m === null || m[1] !== flat;
+    });
+    if (kept.length === lines.length)
+        return template;
+    return kept.join('\n');
+}
 /**
  * Apply every leaf change from `newValues` to `templateBody`. Paths that
  * are not present in the template are appended at the end. Comments are
  * preserved for every key that already exists in the template.
+ *
+ * Idempotent: applying the same values twice yields the same document, so a
+ * second wizard save re-writes the flat block instead of duplicating it.
  */
 export function mergeIntoTemplate(templateBody, newValues) {
     let body = templateBody;
     const appended = [];
     for (const entry of flatten(newValues)) {
-        const before = body;
-        body = replaceScalar(body, entry.path, entry.value);
-        if (body === before) {
-            // Path is not in the template — append a flat key=value at EOF.
-            // Form coverage is asserted by parity test, so this branch only
-            // fires on hand-edited templates.
-            appended.push(`${entry.path.join('.')}: ${formatScalar(entry.value)}`);
+        const sections = entry.path.slice(0, -1);
+        const leaf = entry.path[entry.path.length - 1];
+        // Presence is asked, never inferred from the write changing the text —
+        // see `findScalarLine`. Writing the value it already holds is a hit.
+        if (findScalarLine(body.split('\n'), sections, leaf) !== -1) {
+            body = replaceScalar(body, entry.path, entry.value);
+            // The nested form won, so any flat twin of this same path is dead
+            // and stays dead. The probe above is what licenses the removal:
+            // without a nested key to resolve through, a flat `a.b:` is the
+            // real entry and the branch below owns it.
+            body = dropFlatDottedTwins(body, entry.path);
+            continue;
+        }
+        // Not in the template's nested form. It may still be here as a flat
+        // dotted line this function appended on an earlier pass.
+        const flat = replaceFlatDottedKey(body, entry.path, entry.value);
+        if (flat.found) {
+            body = flat.body;
+            continue;
         }
+        // Genuinely absent — append a flat key=value at EOF. Form coverage is
+        // asserted by parity test, so this branch only fires on hand-edited
+        // templates.
+        appended.push(`${entry.path.join('.')}: ${formatScalar(entry.value)}`);
     }
     if (appended.length > 0) {
         if (!body.endsWith('\n'))

package/dist/server/schemas/settings.js

@@ -101,7 +101,7 @@ export const settingsSchema = z.object({
         access_style: accessStyle.default('getters_setters').describe('How the agent writes Laravel Eloquent property access. getters_setters = explicit getName() / setName() methods (most refactor-safe). get_attribute = $model->getAttribute("name") (verbose but explicit). magic_properties = $model->name (idiomatic but harder to grep).'),
     }),
     chat_history: z.object({
-        enabled: z.boolean().default(true).describe('Persist a structured log of every chat turn to .agent-config/chat-history/ so /chat-history:show, :import, and :learn can replay sessions. Turn off if you never want chat transcripts on disk.'),
+        enabled: z.boolean().default(true).describe('Persist a structured log of every chat turn to agents/runtime/.agent-chat-history (JSONL). Recording only — no command in this package replays a session from the file; it is a record on disk that a human or a later tool can read. Turn off if you never want chat transcripts on disk.'),
         frequency: chatFreq.default('per_turn').describe('How often the chat-history writer flushes to disk. per_turn = after every user / agent exchange (default, lowest data loss on crash). per_phase = at phase boundaries (cheaper I/O). per_tool = after every tool call (highest fidelity, noisiest log).'),
         text_limits: z.object({
             user: z.number().int().min(0).default(0).describe('Per-message character cap for user inputs in the chat-history log. 0 = log verbatim (default). Raise above 0 only if your prompts contain large pasted artefacts you do not want stored.'),
@@ -140,7 +140,21 @@ export const settingsSchema = z.object({
     }),
     design: z.object({
         fidelity_mode: fidelityMode.default('strict').describe('How strictly the agent must follow a user-provided prototype / mockup / design system (consumed by the design-fidelity rule). strict = build 1:1, every visible deviation needs confirmation; structural = structure locked, silent gaps fillable with a stated assumption; hard-floor = any deviation is never autonomous.'),
-    }).default({ fidelity_mode: 'strict' }),
+        approximation: z
+            .object({
+            enabled: z.boolean().default(false).describe('Whether a value INSIDE the configured tolerance may be replaced by the project\'s own token without a per-value confirmation. Ships false. The distance from the artifact\'s value to the nearest project token is computed and REPORTED on every value row regardless of this switch — what it decides is whether the agent may act on it without asking. Turning it on for a whole install is a consumer-facing default flip and is owner-reserved (agents/roadmaps/stubs/road-to-frontend-power-default-flip.md); design.fidelity_mode: hard-floor overrides it to off.'),
+            tolerance: z
+                .object({
+                color: z.number().nullable().default(null).describe('Colour distance below which a value may be reconciled, in OKLab ΔEOK. Ships null, and null means "preserve and report" rather than "reconcile freely". No number is set because none is supported: zero of seven design-to-code benchmarks in the evidence set score token conformance, and a number in a config file — even flagged unmeasured — shapes behavior and acquires the authority of a default. Not an RGB channel delta: RGB distance is not perceptually uniform.'),
+                length: z.number().nullable().default(null).describe('Length distance below which a value may be reconciled, in absolute CSS pixels. Ships null, same reasoning as color. GitHub Primer\'s ±1px spacing widening is recorded as an externally observed candidate in src/scripts/_lib/design_tolerance.ts and is deliberately not the shipped value; max(1px, 2%) was rejected for growing more permissive at large dimensions with no evidence that this is wanted.'),
+            })
+                .default({ color: null, length: null }),
+        })
+            .default({ enabled: false, tolerance: { color: null, length: null } }),
+    }).default({
+        fidelity_mode: 'strict',
+        approximation: { enabled: false, tolerance: { color: null, length: null } },
+    }),
     consistency: z.object({
         cross_source: crossSourceMode.default('on').describe('Consumed by the cross-source-consistency rule. When the agent works from multiple sources (ticket text, an attached image/mockup, the spec, the codebase) it checks them against each other and asks before proceeding on a discrepancy — instead of silently guessing. on (default) = surface every real cross-source contradiction / silent-scope-expansion as one question; auto = surface only high-confidence contradictions, state low-confidence as an assumption; off = no cross-source checking.'),
     }).default({ cross_source: 'on' }),
@@ -239,8 +253,8 @@ export const settingsSchema = z.object({
         }),
     }),
     continuity: z.object({
-        auto_record: z.enum(['on', 'off']).default('off').describe('Deterministic continuity-record writer at session end (road-to-continuity-writer-activation Phase 1). on = the session-eol concern writes the continuity_record capsule variant on Stop for a substantive session that has claimed a roadmap; every field is computed from on-disk state, with no model spend and no subprocess. off (default) = no automatic record — while session:recycle is still the normal path, a second producer on it before the parity evidence is in would be unverified.'),
-        run_checkpoints: z.enum(['on', 'off']).default('on').describe('Deterministic run-checkpoint production at session end (road-to-continuity-writer-activation Phase 1.4). on (default) = a session above the recycle threshold and inside a running roadmap contract leaves agents/runtime/state/checkpoints/<run>.json, so a killed run resumes from a derived checkpoint rather than from bookkeeping. off = no checkpoint; continuity writing, the recycle advisory and the context-fill surface are unaffected. Default ON because it is the behaviour the tree already had — the switch exists to make the three session-end handlers independently disableable, not to change what ships.'),
+        auto_record: z.enum(['on', 'off']).default('on').describe('Deterministic continuity-record writer at session end (road-to-continuity-writer-activation Phase 1). on (default since 2026-09-10) = the session-eol concern writes the continuity_record capsule variant on Stop for a substantive session that has claimed a roadmap; every field is computed from on-disk state, with no model spend and no subprocess. off = no automatic record, and only the explicit agent-config session:recycle writes one. The default flipped once the parity evidence landed, so the normal path carries an automatic writer rather than a remembered command; session:recycle is retained because the automatic writer skips a session that claimed no roadmap and omits the git-status anchors.'),
+        run_checkpoints: z.enum(['on', 'off']).default('on').describe('Deterministic run-checkpoint production at session end (road-to-continuity-writer-activation Phase 1.4). on (default) = a session above the recycle threshold and inside a running roadmap contract leaves agents/runtime/state/checkpoints/<run>.json, so a killed run resumes from a derived checkpoint rather than from bookkeeping. off = no checkpoint; continuity writing, the recycle advisory and the context-fill surface are unaffected. Default ON because it is the behavior the tree already had — the switch exists to make the three session-end handlers independently disableable, not to change what ships.'),
     }),
     memory: z.object({
         cadence: memoryCadence.default('always').describe('Cadence of the 🧠 memory-visibility line after a memory-consulting step. always (default) = show whenever a memory type was asked; auto = show only when 3+ types were consulted (less noise); never = suppress. Distinct from rule_loading_tier — owns its own key since the 2026-06-01 untangle.'),

package/dist/shared/settingsSurface.js

@@ -77,7 +77,12 @@ export function computeSurfaceDelta(oldS, newS) {
             continue;
         }
         const o = oldS.entries[key];
-        if (o.type !== n.type) {
+        // `sameJson`, not `!==`: `type` is an array for a nullable key, and two
+        // structurally equal arrays are never `===`. Left as a strict compare
+        // it reported `type_changed` on EVERY version bump for every nullable
+        // key, forever — caught by the identical-surface test the moment the
+        // first one shipped (`design.approximation.tolerance.*`).
+        if (!sameJson(o.type, n.type)) {
             changes.push({ key, kind: 'type_changed', old: o, new: n });
         }
         if (!sameJson(o.default, n.default)) {

package/docs/contracts/settings-classes.md

@@ -247,8 +247,8 @@ dispatch runs, not WHETHER the layer exists, so they keep their own C rows.
 |---|---|
 | A — preference | 26 |
 | B — consent | 3 |
-| C — guarded | 113 |
-| **Total** | **142** |
+| C — guarded | 116 |
+| **Total** | **145** |
 
 It rose to 142 on 2026-09-08 from two independent additions that landed in the same
 day and are counted together here: `lean_projection.hosts` (one C, `policy`, from
@@ -258,9 +258,15 @@ side's figure to the other, which is the arithmetic `lint_settings_classes` chec
 
 It rose on 2026-09-08 when `road-to-continuity-writer-activation`
 step 1.2 added `continuity.auto_record` — one C, `consent`: it arms an automatic
-producer on the normal session-end path, and the roadmap step requires the
-default to stay `off` until parity is measured, which is a decision no agent may
-take by writing the key. Step 1.4 added
+producer on the normal session-end path, and the roadmap step required the
+default to stay `off` until parity was measured, which is a decision no agent may
+take by writing the key. **It ships `on` since 2026-09-10.** The class did not
+change and neither did the write protection — `settings:set` still refuses this
+key. What changed is the shipped default, edited by hand in the template and the
+schema on a recorded AI-council verdict (2026-09-10, 2 seats, convergent, under
+the owner's written delegation), which is the route a class-C default moves by
+and the reason the refusal in `settings:set` is not a contradiction: the guard
+stops an agent from deciding, not a recorded decision from being applied. Step 1.4 added
 `continuity.run_checkpoints` the same day — a second C, shipping `on` because
 that is the behavior the tree already had. It exists so the three session-end
 handlers are independently disableable, which is what the 2026-09-07 council's
@@ -363,9 +369,9 @@ the template, which is the drift this contract exists to prevent.
 |---|---|
 | derivable | 83 |
 | un-inferrable | 9 |
-| consent | 43 |
-| policy | 7 |
-| **Total** | **142** |
+| consent | 44 |
+| policy | 9 |
+| **Total** | **145** |
 
 First measured 2026-08-12 at 140 leaves (derivable 88 · consent 38 ·
 un-inferrable 9 · policy 5), from the table below rather than predicted — the
@@ -531,6 +537,9 @@ Rows follow template order, so a diff against the template reads straight down.
 | `planning.completion_review` | C | `true` | disables the completion-review validator | derivable — `check_completion_review`'s own scope predicate, bound to the current diff hash |
 | `quality.local_auto_run` | C | `false` | governs whether local verification runs at all | consent |
 | `design.fidelity_mode` | C | `strict` | strict-mode selector, one of whose values is a Hard Floor | policy |
+| `design.approximation.enabled` | C | `false` | lets a value change without a per-value confirmation; enabling it is a consumer-facing default flip | consent |
+| `design.approximation.tolerance.color` | C | `null` | decides which colour deviations may be taken silently | policy |
+| `design.approximation.tolerance.length` | C | `null` | decides which length deviations may be taken silently | policy |
 | `consistency.cross_source` | C | `"on"` | disables the cross-source discrepancy gate | derivable — the rule's own trigger condition; a discrepancy exists only when two present sources contradict |
 | `screenshots.identity_allowlist` | C | `[]` | allowlist of identities that ship unredacted | consent |
 | `screenshots.forbid_terminal_capture` | C | `true` | kill-switch over the highest-leak capture path | consent |
@@ -567,7 +576,7 @@ Rows follow template order, so a diff against the template reads straight down.
 | `commands.create_pr.screenshots` | C | `false` | puts captured screenshots into a published PR body | consent |
 | `commands.create_pr.ui_paths` | C | `[]` | glob allowlist | derivable — the frontend-surface heuristic the PR-description flow already applies when the glob list is empty |
 | `commands.create_pr.api_paths` | C | `[]` | glob allowlist | derivable — the API-endpoint heuristic the same flow already applies as its documented empty-list fallback |
-| `continuity.auto_record` | C | `"off"` | arms an automatic producer on the normal session-end path | consent |
+| `continuity.auto_record` | C | `"on"` | arms an automatic producer on the normal session-end path | consent |
 | `continuity.run_checkpoints` | C | `"on"` | disabling it removes a recovery artifact a killed run resumes from | consent |
 | `memory.cadence` | C | `always` | suppressing the visibility line hides what the agent learned from the user | derivable — the hits/asks count the memory-visibility summary already computes; the line only exists when memory was consulted |
 | `memory.review_threshold` | A | `10` | when a review preview surfaces; governs no gate | derivable — the unreviewed-intake count `/memory load` already computes before rendering its preview |

package/docs/guidelines/abstraction-thresholds.md

@@ -45,6 +45,41 @@ present in the diff** — never speculative abstraction for "this could grow
 later". See [`component-oriented-and-oop-development`](component-oriented-and-oop-development.md)
 § The load-bearing caveat.
 
+## The provided-artifact clause — repetition observable before the code exists
+
+ADR-213 authorises extraction on repetition **already present in the diff**. A
+handed-over **runnable** artifact makes repetition observable before any code
+exists at all: four `<Card>` instances are visible in the handover, so a port
+that writes them one at a time and extracts on the second is doing the
+threshold's own arithmetic in the wrong order.
+
+This is a **different mechanism** than the one the threshold tested, not a
+loophole in it. `adr_cite_check ADR-213` reports the record LIVE with an
+**indeterminate** review trigger and `reopen_policy: unclassified`, so
+investigation is permitted; the numbers themselves — 2 · 3+ · ~4+ — are
+**unchanged**, and this clause moves only *when* the count may be taken.
+
+**Two guards, both required. The first alone is insufficient.**
+
+1. **A runnable artifact, not a design comp.** A comp shows a picture of four
+   cards; a runnable artifact carries four instances of a thing. Counting
+   rectangles in an image is not counting repetition, and a comp therefore does
+   not qualify.
+2. **Repetition of the ELEMENT, not of its compositional context.** Four
+   `<Card>` instances show that Card is used four times. They do **not** show
+   that a `CardGrid` is needed — that needs multiple distinct contexts each
+   arranging several cards. Without this guard the clause would license
+   extracting a wrapper for every layout the artifact happens to contain once,
+   which is speculative abstraction with an artifact as its excuse.
+
+**Enforcement, stated honestly: guard (2) is model-carried and audit-enforced.**
+Nothing mechanical separates *"I saw four Cards"* from *"I saw a CardGrid
+pattern"* — the distinction is about what the repetition MEANS, and
+`lint_abstraction_thresholds.ts` checks numeric threshold drift, which is a
+different property. Guard (1) is checkable (is the handover runnable), guard (2)
+is not, and claiming otherwise would be the coverage inflation this tree forbids
+elsewhere. The discipline is the control.
+
 ## See also
 
 - [`architecture`](../../src/rules/architecture.md) — the rule that carries the code-level bar.

package/docs/guidelines/agent-infra/active-remediation-mechanics.md

@@ -67,16 +67,16 @@ Two failure shapes this table exists to name:
 
 ### Worked example — a red gate seen mid-task
 
-> `task check` fails; the lint step reports 7 errors, all pre-existing on `main`, in files this branch does not touch.
+> the `check` task fails; the lint step reports 7 errors, all pre-existing on `main`, in files this branch does not touch.
 
-Wrong, and the canonical shape of it: finish the task, and close with *"the only thing still open is the lint finding — 7 errors on main, which makes `task check` unusable as a chain"*. The sentence is accurate, the issue is named, and nothing about it is decided — the next session inherits it verbatim.
+Wrong, and the canonical shape of it: finish the task, and close with *"the only thing still open is the lint finding — 7 errors on main, which makes the `check` task unusable as a chain"*. The sentence is accurate, the issue is named, and nothing about it is decided — the next session inherits it verbatim.
 
 Right: the errors are pre-existing, outside the fix-now bar (unrelated files, more than ~10 lines), so they are **note + ask** — after the task is delivered, one block:
 
 1. Fix the 3 `no-unused-vars` in `src/a.ts`, `src/b.ts` — ~6 lines, mechanical, ships in this PR.
 2. Fix all 7 in a separate follow-up PR — keeps this diff single-purpose; needs a branch (permission-gated).
 3. Suppress the two in generated output with a scoped ignore, fix the rest — smallest green path, adds a suppression to review.
-4. Leave as is — `task check` stays unusable as a chain until someone else picks it up.
+4. Leave as is — the `check` task stays unusable as a chain until someone else picks it up.
 
 One recommendation line names the pick. Whatever the user answers, the item is closed. If they answer nothing, it is raised once at the next task boundary — not carried silently into a third session.
 

package/docs/guidelines/agent-infra/false-green.md

@@ -168,8 +168,8 @@ bash src/scripts/condense.sh --changed        # dist != rewrite(src) => the scan
 ./scripts-run src/scripts/check_condensation --summary   # byte-exactness dist vs rewrite(src)
 ```
 
-**Structural fix:** regenerate before judging (`task sync` then
-`task generate-tools`, in that order), and treat a baseline unchanged past
+**Structural fix:** regenerate before judging — this repository's `sync` task
+then its `generate-tools` task, in that order — and treat a baseline unchanged past
 `STALE_AFTER_DAYS` (56, `_lib/gate_baseline.ts:39`) as suppression rather than
 as headroom. A completion claim rests on a run made **after** the last edit, not
 on the freshest run you happen to remember.

package/docs/guidelines/agent-infra/roadmap-progress-mechanics.md

@@ -15,7 +15,7 @@ _Origin: migrated from `.agent-src.uncondensed/rules/roadmap-progress-sync.md` p
 > 2. `.git/hooks/pre-commit` (installed by `scripts/install-hooks.sh`) —
 >    blocks any commit whose staged set touches `agents/roadmaps/` or
 >    `agents/roadmaps-progress.md` while the dashboard is stale.
-> 3. `task ci` runs `roadmap-progress-check` so a PR cannot land with a
+> 3. The `ci` task runs `roadmap-progress-check` so a PR cannot land with a
 >    stale dashboard even if local hooks were bypassed.
 >
 > Hook is primary; the prose below is the specification the hook

package/docs/guidelines/agent-infra/skill-quality-checklist.md

@@ -53,7 +53,7 @@ A field that carries the schema `default` (e.g. `trust.level: core`,
 `validate_frontmatter.apply_schema_defaults` injects it transparently for
 every consumer (validator, discovery manifest, drift checksum). Writing it
 anyway is boilerplate that `scripts/lint_frontmatter_boilerplate.ts` rejects
-(wired into `task ci-fast`). To strip it across the tree, run
+(wired into this repository's `ci-fast` task). To strip it across the tree, run
 `./scripts-run src/scripts/migrate_frontmatter_defaults`. Background:
 `road-to-abstraction-reduction.md` +
 `agents/evidence/analysis/abstraction-reduction-preflight.md`.

package/docs/guidelines/design-fidelity-mechanics.md

@@ -230,6 +230,10 @@ unmarked finding is treated as actionable, so the default failure direction is
 
 Regression witness: `daf-slop-vs-provided`.
 
+**Why the default is what it is, and why the 2026-07-31 council lock over this
+loop cannot be discharged by measuring it:**
+[`design-reconciliation § The 2026-07-31 lock`](design-reconciliation.md).
+
 ## Value-level provenance — the finer grain beside the flag
 
 The block above is finding-level and stays the default: `artifact_covered` is a

package/docs/guidelines/design-fidelity-routing.md

@@ -0,0 +1,78 @@
+# Design-fidelity routing mechanics — how the trigger set is authored
+
+Split out of [`design-fidelity-mechanics`](design-fidelity-mechanics.md) on
+2026-09-09 under `check_depth_budget`'s 16,000-character per-file ceiling. It is
+also a genuinely different subject: that guideline is read while PORTING an
+artifact, and this one is read while EDITING the rule's own trigger set — which
+happens rarely, by a maintainer, and never during a port.
+
+## Routing mechanics
+
+Migrated out of `design-fidelity.md` on 2026-09-09 under the council verdict on
+`blocker: rule-body-cap` — a semantic migration that frees rule-body lines for
+the operative pointers the same verdict requires, not an arbitrary line cut. The
+rule keeps the obligations; this holds the reasoning behind them.
+
+### The withdrawn builder-URL trigger
+
+A page built in Lovable / v0 / bolt and handed over as a share link is a
+finished spec, and `design-fidelity` does not route it. The obvious trigger was
+tried and **withdrawn**: matching is plain lower-cased substring containment, so
+`https://v0.dev/` also fires on `https://v0.dev/docs`, on a pricing page, and on
+a changelog link — it would treat every mention of the tool's own site as a spec
+handover. That is exactly the `claude.ai` failure the capability-URL trigger
+exists to avoid, and by the rule's own standard it is worse than the gap it
+closes. The alternatives are a bare-host keyword (broader still) or guessing
+each vendor's share-path segment, and a trigger built on a guessed path is not
+evidence.
+
+**What closes it:** a verified share-path segment per vendor, or a
+handover-word co-occurrence the matcher cannot express today. Until then the
+class needs one word in the prompt, like any other unlisted filename.
+`near-bare-host-mention` in `ROUTING_MATRIX` pins the bare-host direction silent
+so a future attempt cannot reintroduce the broad form unnoticed.
+
+### The trigger set, class by class
+
+Phrase-heavy on the German side and on `artifact` deliberately: a bare
+`artifact` keyword fires on *"the CI build artifact is 40 MB"*, which is CI
+vocabulary and not a handover. `ROUTING_MATRIX` pins both halves — every class
+that must route, and every near-miss that must stay silent (fixture
+`daf-port-trigger-de`).
+
+Each shipped class carries its own near-miss row, and the pairing is the
+contract rather than a courtesy:
+
+| Class | Its near-miss row | The direction that row tests |
+|---|---|---|
+| `phrase: claude.site/artifacts` | `near-claude-ai-chat-link` | a bare `claude.ai` chat link is a conversation reference, not a spec |
+| `path_prefix: .claude/design-system/` | `near-generic-design-system-dir` | a bare `design-system/` is a normal source folder in a large fraction of frontend repos |
+| `file_pattern: *.dc.html` | `near-plain-html-open-file`, `near-dc-in-a-filename` | an ordinary `.html` file in the tree; a filename that merely contains the letters |
+| the withdrawn builder URL | `near-bare-host-mention` | left behind on purpose, so the broad form stays pinned silent |
+
+### Write the near-miss row first — and test the right direction
+
+Extending the trigger set without adding a near-miss row is how an over-broad
+trigger lands. The stronger half of the contract is *which* near-miss:
+
+**The row must test the direction the NEW trigger opens, not a direction that
+was already closed.** The withdrawn class is the worked example. Its first
+near-miss row tested a protocol-less mention — silent *before* the change, and
+therefore incapable of catching the over-broadness the change introduced. The
+row that would have caught it is `near-builder-host-non-handover-url`, a
+documentation URL on the same host, and it exists only because a review asked
+for it after the trigger had already shipped.
+
+Applied on the next trigger to land: `*.dc.html` (the Claude Design canvas
+artboard, which `*design.html` cannot match because it compiles to
+`^(?:.*design\.html)$`) shipped with `near-plain-html-open-file` and
+`near-dc-in-a-filename` written **before** it, both testing the direction it
+opens — an ordinary `.html` file in the tree, and a filename that merely
+contains the letters. Both were confirmed red-then-green against the real
+matcher rather than asserted.
+
+## See also
+
+- [`design-fidelity-mechanics`](design-fidelity-mechanics.md) — the porting half.
+- `tests/scripts/design_fidelity_routing.test.ts` — `ROUTING_MATRIX`, which is
+  the measurement this file describes rather than a second copy of it.