@event4u/agent-config 14.23.0 → 16.0.0

package/docs/guidelines/design-reconciliation.md

@@ -0,0 +1,172 @@
+# Design reconciliation — artifact values against a project's own tokens
+
+Split out of [`design-fidelity-mechanics`](design-fidelity-mechanics.md) on
+2026-09-09, and the reason is a real constraint rather than tidiness: that file
+crossed `check_depth_budget`'s 16,000-character per-file ceiling, which is a
+shrink-only growth ratchet. The subject splits cleanly — that guideline answers
+*how do I port an artifact faithfully*, and this one answers *what happens when
+the artifact's values meet a project that already has its own*. The two rules
+that arbitrate between an artifact and a brand both point here, and neither can
+hold the arbitration itself: a consumer receives `design-fidelity`
+(`engineering-base`) or `brand-source-of-truth` (`brand`), rarely both.
+
+## Tolerance — why the mechanism ships and the number does not
+
+`design-fidelity`'s `strict` mode says EVERY visible deviation needs explicit
+confirmation. The owner directive that motivated
+`road-to-design-intent-conformance` asks for an unprompted approximation within
+a tolerance. Read literally, those contradict — and the contradiction is real
+rather than a wording problem: `grep -cE 'reconcil|tolerance|approximat|nearest'`
+over the rule and this guideline returned 0 / 0 before this section existed.
+
+**The re-frame, and its condition.** A value inside a configured tolerance stops
+being an unconfirmed deviation and becomes a **reported reconciliation**: the
+project's token is written, and the distance from the artifact's own value is
+reported on the row. Everything outside the tolerance stays confirmation-bound,
+and structure — layout, control types, component set, ordering, breakpoints —
+is never in scope at any setting, because it is not a value question.
+
+**The condition is load-bearing, not a hedge.** `design.approximation` ships
+`enabled: false` with `tolerance.color` and `tolerance.length` both `null`, so
+in a default install the paragraph above describes nothing that happens: every
+deviation stays confirmation-bound exactly as before, and no consumer default
+moved. `hard-floor` disables the mechanism outright, so the strictest mode
+cannot be loosened by configuring a tolerance under it.
+
+**Why no threshold ships**, decided by the AI council on 2026-09-09 (anthropic +
+openai, 2/2), and worth re-reading before adding one: *a number in a config
+file, even flagged unmeasured, shapes behavior and creates path dependency.*
+Zero of seven design-to-code benchmarks in the evidence set score token
+conformance, so a shipped threshold would be a guess wearing a default's
+authority. Two proposals were examined and rejected on their merits rather than
+on caution — `±5 per RGB channel`, because RGB channel distance is not
+perceptually uniform and "likely imperceptible" does not follow from it; and
+`max(1px, 2%)`, because it grows steadily more permissive at large dimensions
+with no evidence that this is wanted. GitHub Primer's ±1px spacing widening is
+the one real measurement available and is recorded as an externally observed
+**candidate**, not adopted.
+
+**The metric IS fixed, and that is the half that could be settled.** Colour
+distance is OKLab ΔEOK, length distance is absolute CSS pixels
+(`src/scripts/_lib/design_tolerance.ts`). Fixing the method mattered before
+fixing any number: RGB Euclidean, ΔE LAB, CIEDE2000 and OKLab/ΔEOK give
+different numbers for the same pair, so a threshold quoted without its metric
+is not a threshold.
+
+**The distance is reported on every row regardless.** Preserved values carry it
+too. That is what makes the deferred half decidable: a window over rows that
+report distances yields a distribution, where a window over rows reporting only
+"kept" or "changed" yields nothing to read a threshold off.
+
+## Artifact versus brand
+
+Both `design-fidelity` and `brand-source-of-truth` point here rather than
+carrying this arbitration themselves, and the pointers are **operative**: apply
+this section before reconciling a value, not as a reference to consult if
+curious. Two standing rules cannot each hold half of an arbitration between
+them — a consumer receives one of them without the other, because
+`design-fidelity` ships in `engineering-base` and `brand-source-of-truth` in
+`brand` — so the split has to be somewhere both can reach.
+
+**Values reconcile onto the brand token, with the distance reported.** Colour,
+type and spacing are the axes where the field converges, unanimously and at
+error severity, across the design systems surveyed. Where a registered brand
+token exists, it wins, and the artifact's own value is not silently absorbed:
+the distance between the two is reported on the same row, so what changed is
+visible before it is cumulative.
+
+**Structure is the artifact's, and is never adjusted to suit a token.** Layout,
+control types, component set, ordering, breakpoints and behavior are not value
+questions at all, and no brand token is evidence about any of them. A structural
+deviation stays what `design-fidelity`'s Iron Law says it is: a proposal needing
+explicit confirmation.
+
+**A conflict is surfaced, never merged.** Where the artifact and the brand
+genuinely disagree on something that is not resolvable by the two rules above —
+an artifact whose type scale contradicts the brand's, say — the agent surfaces
+both readings as a numbered choice and builds neither until the human picks.
+Averaging them produces a third design nobody approved.
+
+**Where no brand exists**, there is nothing to reconcile onto: the artifact's
+values are the values, and `brand-source-of-truth`'s own "when NOT to fire"
+already says so. The reconciliation above is a rule about *two* sources, not a
+license to normalize one.
+
+**What this section does NOT decide** is whether an in-tolerance value may be
+reconciled *without asking*. That needs a tolerance to exist and a default to be
+chosen, and both are recorded as open decisions rather than answered here —
+`design.tolerance.*` ships empty and the approximation ships disabled.
+
+## Icons on a provided artifact
+
+`icon-consistency` owns the icon axis and, until 2026-09-09, carried **zero**
+occurrences of `artifact` / `artefact` / `provided` — so no surface in the
+package handled a handed-over artifact's icons at all. Its "ad-hoc inline SVGs
+alongside a chosen set" clause is exactly the shape a faithful port produces,
+which made a port read as a violation of the rule it was obeying.
+
+**The fix is a new rung, not a re-ordering.** Rung 1 of the iconography ladder
+is the project's brand token, and the artifact does **not** outrank it. What the
+carve-out changes is which findings are violations, not which source wins.
+
+**The obligation that survives is traceability, not conformity.** An
+artifact-sourced icon is legitimate when it traces to the artifact and that
+provenance is stated. An inline `<svg>` that traces to neither the adopted icon
+set nor a named artifact is untraceable, and still fires.
+
+**A swap is still a deviation.** Replacing the artifact's icon with the
+project's nearest equivalent is a substitution of a control the artifact
+specified, so it needs the same explicit confirmation as any other deviation
+under `design-fidelity`'s Iron Law. The carve-out permits keeping the
+artifact's icon; it never permits changing it silently.
+
+**What is deliberately NOT here:** an assertion that an artifact's icons are
+*reconcilable* onto the project's set by default. `tailwind-engineer` carried
+that claim in the opposite direction — icons "stay 1:1 with the artifact", with
+no citation — and it was deleted rather than inverted. The contrary evidence and
+the two conditions that would reverse the silence are recorded in
+`road-to-design-intent-conformance` § The icon evidence.
+
+## The 2026-07-31 lock, and why its own reopening condition cannot discharge it
+
+A council lock of 2026-07-31 names its reopening condition as *"a measured run
+showing the polish loop still edits away from a provided artifact"*. No such run
+exists, which makes running one look like the cheap way to close or reopen it.
+**It is not, and this paragraph exists so the next reader meets the argument
+instead of re-deriving it and spending the run.**
+
+The mechanism is **structural, not probabilistic**. Three facts, each checkable:
+`polish.ts:135-167` drops findings flagged `artifact_covered: true`;
+`src/skills/design-tokens/SKILL.md` wired `token_violation` findings into the
+same loop **without** setting that flag; and the paragraph above states that an
+unmarked finding is treated as actionable. Those compose into a path that edits
+away from the artifact whenever a token-violation finding fires on an
+artifact-derived value. Nothing about that path is stochastic.
+
+So a green measured run would establish *"this did not trigger in the sample"*
+— it could never establish *"this cannot trigger"*, which is the claim the lock
+would need to be discharged in the useful direction. A run whose only possible
+informative outcome is the one nobody wants is not a measurement, it is a
+lottery ticket, and it costs a real run to buy.
+
+**The structural fix is the discharge, and it is `blocker:
+findings-actionability-default`** on `road-to-design-intent-conformance`.
+Resolved by the AI council on 2026-09-09 to option (b): set `artifact_covered`
+on the `token_violation` path, changing no package-wide default. Option (a) —
+inverting the default so a finding is non-actionable unless escalated — was
+rejected on blast radius: it changes the meaning of every existing unmarked
+finding across the package to fix one known producer.
+
+**No measurement is scheduled against this lock.** If a later reader wants to
+reopen it, the thing to change is the falsifiability of its condition, not the
+sample size.
+
+## See also
+
+- [`design-fidelity-mechanics`](design-fidelity-mechanics.md) — the porting
+  half, including § Provided-artifact precedence and the `artifact_covered`
+  flag whose default the lock section above turns on.
+- [`design-fidelity-routing`](design-fidelity-routing.md) — how the rule's own
+  trigger set is authored, split out in the same change.
+- `src/scripts/_lib/design_tolerance.ts` — the metric and the shipped-null
+  thresholds this file argues for.

package/docs/guidelines/gtm-handoff.md

@@ -12,7 +12,7 @@ the typed artifact looks like**, and **who owns the failure mode
 when the chain breaks**.
 
 Cycle / dangling / tier-mismatch enforcement is not duplicated here —
-`task lint-handoffs` (per cross-wing-handoff § 4) is the mechanical
+The `lint-handoffs` task (per cross-wing-handoff § 4) is the mechanical
 gate.
 
 ## Chain 1 — brand → channel
@@ -101,7 +101,7 @@ the contract (O2 owns the interface; H10 only consumes it).
 ## See also
 
 - [`docs/contracts/cross-wing-handoff.md`](../contracts/cross-wing-handoff.md)
-  — typed-handoff mechanical contract; `task lint-handoffs` enforces
+  — typed-handoff mechanical contract; the `lint-handoffs` task enforces
   cycles, dangling references, and tier mismatches over the graph.
 - [`docs/guidelines/cross-role-handoff.md`](cross-role-handoff.md)
   — when to hand off at all, how to phrase the routing, L4 / C8

package/docs/guidelines/wing4-handoff.md

@@ -15,7 +15,7 @@ artifact looks like**, and **who owns the failure mode when the
 chain breaks**.
 
 Cycle / dangling / tier-mismatch enforcement is not duplicated here —
-`task lint-handoffs` (per cross-wing-handoff § 4) is the mechanical
+The `lint-handoffs` task (per cross-wing-handoff § 4) is the mechanical
 gate.
 
 ## Chain 1 — money → strategy
@@ -112,7 +112,7 @@ consumes it).
 ## See also
 
 - [`docs/contracts/cross-wing-handoff.md`](../contracts/cross-wing-handoff.md)
-  — typed-handoff mechanical contract; `task lint-handoffs` enforces
+  — typed-handoff mechanical contract; the `lint-handoffs` task enforces
   cycles, dangling references, and tier mismatches over the graph.
 - [`docs/guidelines/cross-role-handoff.md`](cross-role-handoff.md)
   — when to hand off at all, how to phrase the routing, L4 / C8

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@event4u/agent-config",
     "mcpName": "io.github.event4u-app/agent-config",
-    "version": "14.23.0",
+    "version": "16.0.0",
     "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including the counts in these badges.",
     "license": "MIT",
     "private": false,
@@ -67,7 +67,9 @@
         "!src/**/*.test.ts",
         "!src/**/*.spec.ts",
         "!dist/agent-src/skills/**/evals/**",
-        "!dist/**/*.map"
+        "!dist/**/*.map",
+        "!**/__pycache__/**",
+        "!**/*.pyc"
     ],
     "bin": {
         "agent-config": "dist/cli/agent-config.js"
@@ -80,6 +82,8 @@
         "build:install-bundle": "esbuild src/scripts/install.ts --bundle --platform=node --format=esm --target=node20 --define:__AGENT_CONFIG_BUNDLE__=true --outfile=dist/install/install.mjs --banner:js=\"import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);\"",
         "build:hooks": "esbuild src/scripts/hooks/dispatch_entry.ts --bundle --platform=node --format=esm --target=node20 --define:__AGENT_CONFIG_BUNDLE__=true --outfile=dist/hooks/dispatch.js --banner:js=\"import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url); const __acPath = require('node:path'); const __acFs = require('node:fs'); const __acUrl = require('node:url'); const __acReal = (p) => { try { return __acFs.realpathSync(p); } catch { return p; } }; const __acSelf = __acReal(__acUrl.fileURLToPath(import.meta.url)); if (process.argv[1] !== undefined && __acReal(__acPath.resolve(process.argv[1])) === __acSelf) { globalThis.__AC_HOOKS_BUNDLE_DIRECT = true; process.argv = [process.argv[0], __acSelf + '.__direct__', ...process.argv.slice(2)]; }\"",
         "build:mcp-bundle": "esbuild src/scripts/mcp_server/__main__.ts --bundle --platform=node --format=esm --target=node20 --define:__AGENT_CONFIG_BUNDLE__=true --outfile=dist/mcp/server.mjs --banner:js=\"import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url); const __acPath = require('node:path'); const __acFs = require('node:fs'); const __acUrl = require('node:url'); const __acReal = (p) => { try { return __acFs.realpathSync(p); } catch { return p; } }; const __acSelf = __acReal(__acUrl.fileURLToPath(import.meta.url)); if (process.argv[1] !== undefined && __acReal(__acPath.resolve(process.argv[1])) === __acSelf) { globalThis.__AC_MCP_BUNDLE_DIRECT = true; process.argv = [process.argv[0], __acSelf + '.__direct__', ...process.argv.slice(2)]; }\"",
+        "clean:cli-delegate": "rm -rf dist/cli-delegate",
+        "build:delegates": "npm run clean:cli-delegate && npm run build:cli-delegate && npm run build:agent-src-delegate && npm run build:delegate-aux",
         "build:cli-delegate": "esbuild src/scripts/_cli/cmd_*.ts --bundle --splitting --platform=node --format=esm --target=node20 --define:__AGENT_CONFIG_BUNDLE__=true --define:__AGENT_CONFIG_CLI_DELEGATE__=true --outdir=dist/cli-delegate --banner:js=\"import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);\"",
         "build:agent-src-delegate": "esbuild src/agent-src/scripts/*.ts --bundle --splitting --platform=node --format=esm --target=node20 --define:__AGENT_CONFIG_BUNDLE__=true --define:__AGENT_CONFIG_CLI_DELEGATE__=true --outdir=dist/cli-delegate --banner:js=\"import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);\"",
         "build:delegate-aux": "esbuild src/scripts/_lib/pin_resolver.ts src/scripts/check_update_banner.ts --bundle --splitting --platform=node --format=esm --target=node20 --define:__AGENT_CONFIG_BUNDLE__=true --define:__AGENT_CONFIG_CLI_DELEGATE__=true --outbase=src/scripts --outdir=dist/cli-delegate --banner:js=\"import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);\"",
@@ -89,7 +93,7 @@
         "build:discovery": "./scripts-run src/scripts/build_discovery_manifest --write --strict",
         "build:mcp-manifest": "./scripts-run src/scripts/build_mcp_registry_manifest --write --strict",
         "build:mcp-catalog": "./scripts-run src/scripts/build_mcp_catalog --write --strict",
-        "build": "npm run build:cli && npm run build:install-bundle && npm run build:hooks && npm run build:mcp-bundle && npm run build:cli-delegate && npm run build:agent-src-delegate && npm run build:delegate-aux && npm run build:ui",
+        "build": "npm run build:cli && npm run build:install-bundle && npm run build:hooks && npm run build:mcp-bundle && npm run build:delegates && npm run build:ui",
         "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.scripts.json",
         "lint:ts": "eslint --cache --max-warnings 0 'src/**/*.ts'",
         "test:ts": "vitest run",

package/src/config/agent-settings.template.yml

@@ -738,6 +738,43 @@ design:
   #              autonomy setting, roadmap, or standing instruction lifts it).
   fidelity_mode: strict
 
+  # Value reconciliation between a provided artifact and the project's own
+  # tokens. MEASUREMENT ships; BEHAVIOUR does not — AI council 2026-09-09
+  # (anthropic + openai, 2/2) on `blocker: approximation-tolerance`.
+  #
+  # The distance from the artifact's value to the nearest project token is
+  # computed and REPORTED on every value row regardless of these settings.
+  # What these decide is whether the agent may act on it without asking.
+  approximation:
+    # false ships. Turning it on lets a value INSIDE tolerance be replaced by
+    # the project's token without a per-value confirmation; outside tolerance
+    # the artifact's value is preserved either way. Shipping this enabled is a
+    # consumer-facing default flip and is owner-reserved — recorded in
+    # agents/roadmaps/stubs/road-to-frontend-power-default-flip.md, not decided
+    # here. `design.fidelity_mode: hard-floor` overrides it to off.
+    enabled: false
+
+    # Distance metric: OKLab ΔEOK for colour, absolute CSS pixels for length.
+    # The METHOD is fixed; the THRESHOLDS are deliberately absent.
+    #
+    # Both ship `null`, and `null` means "preserve and report", never
+    # "reconcile freely". No number is set because none is supported: zero of
+    # seven design-to-code benchmarks in the evidence set score token
+    # conformance, and a number in a config file — even flagged unmeasured —
+    # shapes behaviour and acquires the authority of a default.
+    #
+    # The one real measurement in the evidence set is GitHub Primer's spacing
+    # plugin, which widens each token's accepted set by ±1px and autofixes. It
+    # is recorded as an externally observed CANDIDATE in
+    # src/scripts/_lib/design_tolerance.ts and is not the shipped value.
+    tolerance:
+      # ΔEOK. Not an RGB channel delta — RGB distance is not perceptually
+      # uniform, which is why a `±5 per channel` proposal was rejected.
+      color: null
+      # CSS pixels, absolute. Not `max(1px, 2%)`, which grows more permissive
+      # at large dimensions with no evidence that this is wanted.
+      length: null
+
 # --- Cross-source consistency ---
 #
 # When the agent plans, refines, roadmaps, or implements from multiple
@@ -1119,20 +1156,30 @@ continuity:
   # (road-to-continuity-writer-activation Phase 1). When `on`, the session-eol
   # concern writes the `continuity_record` capsule variant on Stop for a
   # SUBSTANTIVE session that has claimed a roadmap — every field computed from
-  # on-disk state, no model spend, nothing shelled out. Default OFF: while the
-  # manual writer (`agent-config session:recycle`) is still the normal path,
-  # arming this by default would put a second producer on it before the parity
-  # evidence is in.
-  #   off = (default) no automatic record; the tree behaves as it does today.
-  #   on  = write the record at session end.
-  auto_record: "off"
+  # on-disk state, no model spend, nothing shelled out.
+  #
+  # Default ON since 2026-09-10 (step 3.2). It shipped `off` while the parity
+  # evidence was outstanding; steps 1.1 and 1.3 discharged that, and an AI
+  # council of 2026-09-10 (2 seats, convergent, under the owner's written
+  # delegation) authorised the flip so the normal path has an automatic writer
+  # instead of a human remembering a command. The same verdict REFUSED to
+  # retire `agent-config session:recycle`, which stays as an explicit
+  # affordance — the automatic writer is not a strict superset of it (see
+  # `on` below).
+  #
+  # Existing installs are unaffected: a value already written here keeps it.
+  #   on  = (default) write the record at session end. Not written for a
+  #         session that claimed no roadmap, and the `git status` anchors
+  #         `session:recycle` collects are omitted.
+  #   off = no automatic record; only `session:recycle` writes one.
+  auto_record: "on"
 
   # Deterministic run-checkpoint production at session end
   # (road-to-continuity-writer-activation Phase 1.4). When `on`, a session
   # above the recycle threshold and inside a running roadmap contract leaves
   # agents/runtime/state/checkpoints/<run>.json behind, so a killed session can
   # be resumed by the watcher rather than by bookkeeping. Default ON: this is
-  # the behaviour the tree already had, and the switch exists so an operator can
+  # the behavior the tree already had, and the switch exists so an operator can
   # disable checkpointing WITHOUT disabling continuity writing or the recycle
   # advisory.
   #   on  = (default) write the checkpoint.

package/src/config/ci-local-parity.yml

@@ -275,6 +275,40 @@ ci_only:
 # worth remote enforcement, OR it should simply be added to a workflow. Prefer
 # adding it: a local-only gate is the direction that let real defects merge.
 local_only:
+  - id: check_platform_anchor
+    class: token-scope-unavailable
+    reason: >
+      Reads `repos/{owner}/{repo}/rulesets` to check that the forge actually
+      requires what the ratification mechanism claims it does — an active branch
+      ruleset over the default branch, an approving review, last-push approval,
+      deletion and force-push blocked, strict required checks, and no
+      unconditional bypass actor.
+
+      Local-only because the permission does not exist, not because remote
+      enforcement is unwanted — which is the opposite of the usual reason on this
+      list and is why the class says so. The rulesets endpoint needs the
+      repository `administration` scope, and a workflow `GITHUB_TOKEN` cannot be
+      granted it: `administration: read` was tried in `rule-backstops.yml` on
+      2026-09-10 and actionlint refused it as an *"unknown permission scope"*,
+      listing the sixteen that do exist. None grants it.
+
+      Wiring it anyway would be worse than leaving it here. The gate fails closed
+      by design — a platform state it cannot read is `UNVERIFIABLE`, which is a
+      failure — so an unauthorised token would red every kernel and governance
+      pull request for a reason unrelated to the platform's actual state. The
+      three escapes were each rejected on the reasoning of the council that
+      commissioned the gate: `continue-on-error` makes it advisory, skipping when
+      unauthenticated makes it fail open, and putting it in `Sync + Generate Tools
+      Consistency` would freeze merges repository-wide on any red, since that
+      job's context is the ruleset's single required status check.
+
+      What moves it off this list: a PAT in a repository secret carrying
+      `administration: read`, then the workflow step. That is a human action and
+      is recorded as the open half of blocker `ratification-platform-anchor` in
+      `agents/roadmaps/road-to-typed-grants-that-persist.md`. Until then the gate
+      runs in `taskfiles/ci-fast.yml` — a real pre-push control, and not a CI one,
+      which is the honest description of its reach.
+
   - id: check_host_loadability_reach
     class: developer-machine-scoped
     reason: >

package/src/config/continuity-surface.json

@@ -43,13 +43,6 @@
             "locus": "src/scripts/_lib/session_eol.ts:55",
             "reason": "The writer`s own bookkeeping, not a record a successor reads. It holds counters and advisory stamps used across Stops within one session; nothing restores a session from it."
         },
-        {
-            "id": "manual:run-session-recycle-before-clear",
-            "axis": "normal_path_manual_actions",
-            "disposition": "counted",
-            "locus": "src/scripts/hooks/session_eol_hook.ts:258",
-            "reason": "The advisory the stop slot injects past the recycle threshold instructs a human to run `agent-config session:recycle`, wait for the absolute path it prints, and only then `/clear`. That is a manual action on the normal path, and it exists precisely because no automatic writer does. It is what step 3.1 removes the need for."
-        },
         {
             "id": ".dispatcher",
             "axis": "persistent_continuity_artefacts",
@@ -125,7 +118,7 @@
             "axis": "persistent_continuity_artefacts",
             "disposition": "counted",
             "locus": "src/scripts/hooks/session_eol_hook.ts:31",
-            "reason": "Machine-readable fill level plus threshold state, overwritten every Stop. Written for later verification of whether the session crossed the recycle threshold. AUTHORISED FOR RETIREMENT and NOT RETIRED \u2014 the authorisation (AI council 2026-09-08 D1, resting on producer/no-consumer evidence) was obtained on incomplete facts. There is no consumer in code, but `agents/roadmaps/later/road-to-cost-parity-2-state-aware-dispatch.md` is a live parked roadmap whose open steps 1.1 and 1.4c read this file as a planned input, and 1.4c is specifically about bounding its staleness. The same council's own qualification anticipated this: \"no consumer in the tree\" proves no in-repository consumer, and a planned consumer inside the tree is a stronger objection than an external one because it is checkable. Retiring it is a decision for that roadmap's owner, not a side effect of this one. Blocker: `context-fill-retirement-has-a-parked-consumer`."
+            "reason": "Machine-readable fill level plus threshold state, overwritten every Stop. Written for later verification of whether the session crossed the recycle threshold. AUTHORISED FOR RETIREMENT and NOT RETIRED \u2014 the authorisation (AI council 2026-09-08 D1, resting on producer/no-consumer evidence) was obtained on incomplete facts. There is no consumer in code, but `agents/roadmaps/later/road-to-cost-parity-2-state-aware-dispatch.md` is a live parked roadmap whose open steps 1.1 and 1.4c read this file as a planned input, and 1.4c is specifically about bounding its staleness. The same council's own qualification anticipated this: \"no consumer in the tree\" proves no in-repository consumer, and a planned consumer inside the tree is a stronger objection than an external one because it is checkable. Retiring it is a decision for that roadmap's owner, not a side effect of this one. RETENTION DECIDED 2026-09-09 and this row is that decision, not a note about a pending one. An AI council under the owner's written delegation for the drain run (2 seats, anthropic + openai, quorum 2/2) resolved `context-fill-retirement-has-a-parked-consumer` as RETAIN: the file and `writeContextFill` stay, and this row stays `counted`. The named consumer is `agents/roadmaps/later/road-to-cost-parity-2-state-aware-dispatch.md` steps 1.1 and 1.4c. The alternative was re-anchoring those steps, which means editing a roadmap that is parked precisely because nobody is working on it \u2014 one small per-session write is the cheaper side of that trade. The artefact-axis reduction 5 to 4 is NOT claimed. Revisit when that roadmap is resumed, cancelled, or re-anchored onto another source. Blocker: `context-fill-retirement-has-a-parked-consumer`, resolved."
         },
         {
             "id": "context-hygiene.json",
@@ -204,13 +197,6 @@
             "locus": "src/scripts/_cli/cmd_handoff.ts:9",
             "reason": "A second, prose-shaped session handoff written by `agent-config handoff` and injected once at the next `session_start`. Same job as the record, different format and different lifecycle \u2014 a competing mental model, which is what the count exists to expose."
         },
-        {
-            "id": "hot-context.md",
-            "axis": "persistent_continuity_artefacts",
-            "disposition": "counted",
-            "locus": "src/scripts/hot_context_hook.ts:11",
-            "reason": "A working-memory cache rebuilt on stop/session_end/pre_compact and restored at session_start. Persisted state written for context restoration, so the behavioural rule counts it whatever it is called."
-        },
         {
             "id": "injection-census.jsonl",
             "axis": "persistent_continuity_artefacts",
@@ -265,7 +251,7 @@
             "axis": "persistent_continuity_artefacts",
             "disposition": "counted",
             "locus": "src/scripts/_cli/cmd_session_recycle.ts:9",
-            "reason": "The continuity record itself: written by `session:recycle`, resolved per session by `resolveContinuityRecord`, consumed once at `session_start` by the handoff-context concern. This is the artefact the whole roadmap is collapsing the others INTO \u2014 the surviving `1`."
+            "reason": "The continuity record itself: written by `session:recycle` and, since 2026-09-10, by the automatic writer in the session-eol concern (`src/scripts/_lib/continuity_writer.ts` via `writeContinuityRecord`), resolved per session by `resolveContinuityRecord`, consumed once at `session_start` by the handoff-context concern. This is the artefact the whole roadmap is collapsing the others INTO \u2014 the surviving `1`. The locus stays on the command because the command still writes it; the second producer is named here so a reader does not conclude from the locus that a human is still the only source."
         },
         {
             "id": "render",
@@ -288,6 +274,13 @@
             "locus": "src/scripts/review_axis_report.ts:209",
             "reason": "Review-axis report state. Analysis output."
         },
+        {
+            "id": "review-baseline",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/_lib/review_baseline.ts:68",
+            "reason": "Start-of-session mutation baseline the end-review nudge subtracts. Two numbers and a timestamp, written once at session_start and read at stop; it carries no continuity across sessions and by construction cannot hold a path, a diff or a file body."
+        },
         {
             "id": "routing-telemetry.jsonl",
             "axis": "persistent_continuity_artefacts",
@@ -482,14 +475,7 @@
             "axis": "public_continuity_commands",
             "disposition": "counted",
             "locus": "src/cli/registry.ts:73",
-            "reason": "REQUIRED on the normal path today: it is the only writer of the continuity record in the tree, so continuity does not happen unless a human runs it. That is what makes it a continuity command rather than an affordance, and it is on the owner-authorised retirement set of 2026-09-06."
-        },
-        {
-            "id": "command:chat-history",
-            "axis": "session_resume_pickers",
-            "disposition": "excluded",
-            "locus": "src/domains/meta/chat-history/command.md:3",
-            "reason": "The orchestrator shell that routes to the import picker; it presents no picker of its own. Counting both would double-count one surface. It is retired together with the picker it routes to, so the row disappears with it."
+            "reason": "RETAINED as an explicit affordance, and no longer the normal path. It was the ONLY writer of the continuity record until step 3.2 of road-to-continuity-writer-activation armed the automatic writer by default (2026-09-10), which is why this row's earlier reason called it REQUIRED. The same AI council (2 seats, convergent, under the owner's written delegation) REFUSED to retire the verb: removing a public callable contract is a different act from removing a manual step, and the automatic writer is not a strict superset of this command \u2014 it leaves no record for a session that claimed no roadmap, and it omits the `git status` anchor fields the command collects. So it stays COUNTED on this axis rather than excluded: it is a public continuity command that exists, the axis counts what exists, and the target of 0 is therefore not reachable while this decision stands. Recorded here rather than argued away, on the same terms as the `verb:handoff` exclusion note above."
         },
         {
             "id": "picker:agent-handoff",
@@ -498,19 +484,12 @@
             "locus": "src/domains/meta/agent-handoff/command.md:41",
             "reason": "A numbered-options block asking a human which prior session to resume. It is a picker by construction, and the parent`s target of 0 pickers is in tension with its preservation of this command \u2014 recorded here so the tension is visible in the count rather than argued away."
         },
-        {
-            "id": "picker:chat-history-import",
-            "axis": "session_resume_pickers",
-            "disposition": "counted",
-            "locus": "src/domains/meta/chat-history/import/command.md:77",
-            "reason": "A numbered-table session picker plus a resume offer \u2014 a second, competing answer to \"which prior session do I continue from\". On the owner-authorised retirement set of 2026-09-06."
-        },
         {
             "id": "session-index-latch",
             "axis": "persistent_continuity_artefacts",
             "disposition": "excluded",
             "locus": "src/scripts/_lib/session_index_trust.ts:251",
-            "reason": "A duplicate-suppression latch, not a record. It holds one file per session under agents/runtime/state/session-index-latch/ whose entire content is a claim timestamp, and nothing reads it to restore anything — a successor session that finds it learns only that THIS session already received the memory index, which is the opposite of resumable state. It exists because `session_start` can fire more than once for one session (resume, host reconnect, compaction boundary on some hosts) and two injections double a fixed cost while presenting two corpora as one session memory. Excluded on the same reasoning as schema:session-eol-state: the writer own bookkeeping, not a record a successor reads. Deleting the directory costs a session nothing but a possible second injection."
+            "reason": "A duplicate-suppression latch, not a record. It holds one file per session under agents/runtime/state/session-index-latch/ whose entire content is a claim timestamp, and nothing reads it to restore anything \u2014 a successor session that finds it learns only that THIS session already received the memory index, which is the opposite of resumable state. It exists because `session_start` can fire more than once for one session (resume, host reconnect, compaction boundary on some hosts) and two injections double a fixed cost while presenting two corpora as one session memory. Excluded on the same reasoning as schema:session-eol-state: the writer own bookkeeping, not a record a successor reads. Deleting the directory costs a session nothing but a possible second injection."
         }
     ]
 }

package/src/config/gate-coverage.yml

@@ -64,8 +64,8 @@
 # `road-to-candidate-moves-floor` was that addition. The number is re-measured
 # rather than the tolerance widened: a stated population that nobody re-measures
 # is the un-asserted count this whole manifest exists to refuse.)
-# **78 of them emit the machine-readable `scanned: <N>` line under their
-# CI-identical argv, and 75 of those 78 are listed below.** The manifest is
+# **79 of them emit the machine-readable `scanned: <N>` line under their
+# CI-identical argv, and 76 of those 79 are listed below.** The manifest is
 # complete for every gate that can carry a floor, covering ~25 % of the population.
 #
 # RECOUNTED 2026-09-07, on the change that adds `lint_agent_security` — the
@@ -2365,7 +2365,7 @@ gates:
   - id: check_loss_class_declared
     argv: []
     min_scanned: 45
-    corpus: "every hook-manifest concern whose script exists (53 at baseline); of those, the model-facing lossy subset is the gated population"
+    corpus: "every hook-manifest concern whose script exists (53 at baseline, 58 on 2026-09-10); of those, the CONTEXT-EMITTING ones are walked through their relative module specifiers, and the modules that walk reaches whose code applies a lossy operation are the gated population. Measured 2026-09-10: 58 scanned, 7 emitters, 5 modules matched — 4 declaring a lossy class and 1 declaring `exact`. MATCHED IS NOT LOSSY: the detector establishes a match, the declaration says whether anything is lost, and an earlier version of this row said `5 lossy` and overstated the corpus by one. It read 0 between 2026-09-09 and 2026-09-10, when the hot-context cache retirement emptied the matched subset and the gate passed over nothing. A `loss_module:` pointer refilled it to 1 for part of 2026-09-10 and was superseded by the walk, whose two rejection premises were re-measured and did not hold — see docs/contracts/loss-classes.md."
     status: enforced
     canary:
       class: contract-violation
@@ -2389,11 +2389,14 @@ gates:
       has measurably never ratcheted. Both seats added the refinement adopted
       here: unknown reachability is classified as model-reaching.
 
-      MEASURED AT LANDING: **1** module qualifies — `hot_context_hook`, which is
-      exactly the `ephemeral-lossy` exemplar `docs/contracts/loss-classes.md`
-      classifies. A gated population of one is the honest state of this tree,
-      not a broken detector, and it is why the floor below is set on the SCANNED
-      corpus (53 hook scripts) rather than on the gated subset.
+      MEASURED AT LANDING: **1** module qualified — `hot_context_hook`, the
+      `ephemeral-lossy` exemplar `docs/contracts/loss-classes.md` classifies.
+      MEASURED 2026-09-09, after step 3.1 of road-to-continuity-writer-activation
+      retired that module's cache half: **0**. Setting the floor on the SCANNED
+      corpus rather than the gated subset is what keeps this row meaningful
+      through that drop — but a matched subset of zero means the gate currently
+      proves nothing about any transform, which is tracked as blocker
+      `loss-class-corpus-is-empty-after-hot-context`.
 
       THE DETECTOR READS CODE, NOT PROSE. Its first cut matched `truncat` inside
       three docblocks that describe truncation without performing any and
@@ -2777,3 +2780,23 @@ gates:
       What the ROW buys on top of that is `ci_invocation` — the census had a
       Taskfile target and no caller at all, so its removal would have been
       noticed by nothing.
+
+  - id: check_projected_rule_routes
+    argv: []
+    min_scanned: 100
+    corpus: "dist/agent-src/rules/*.md (119 at baseline, 22 distinct `guideline:` targets)"
+    status: enforced
+    canary:
+      class: contract-violation
+      path: dist/agent-src/rules/zz-canary-projected-route.md
+      content: |
+        ---
+        name: zz-canary-projected-route
+        description: Canary planted by check_gate_coverage --canary; never ships.
+        routes_to: guideline:zz-canary-target-that-does-not-exist
+        ---
+
+        # zz-canary-projected-route
+
+        A projected rule routing to a guideline body the projection does not
+        contain. The gate must fail on this and pass once it is removed.

package/src/config/gate-reachability-exemptions.json

@@ -5,6 +5,7 @@
     "exempt": {
         "ci-strict": "An ENTRY POINT, not a gate — the stricter sibling of `ci` itself, so wiring it into `ci` would be a cycle. Would run if strict became the default, which is a policy change rather than a wiring one.",
         "check-augment-budget": "Emits a MEASUREMENT, not a verdict; a gate that cannot fail is a report. Would run once a pre-registered threshold exists to fail on.",
+    "check-platform-anchor": "THE PERMISSION DOES NOT EXIST, which is a different reason from every other row here — the others are unwired by judgement, this one by platform capability. It reads `repos/{owner}/{repo}/rulesets` to check that the forge actually requires what the ratification mechanism claims, and that endpoint needs the repository `administration` scope. A workflow `GITHUB_TOKEN` cannot be granted it: `administration: read` was tried in `rule-backstops.yml` on 2026-09-10 and actionlint refused it as an \"unknown permission scope\", listing the sixteen that do exist. Wiring it with an unauthorised token is worse than leaving it manual, because the gate fails closed by design — an unreadable platform is UNVERIFIABLE, which is a failure — so it would red every kernel and governance PR for a reason unrelated to the platform's actual state. The three escapes were each rejected on the reasoning of the council that commissioned the gate: `continue-on-error` makes it advisory, skipping when unauthenticated makes it fail open, and `Sync + Generate Tools Consistency` would freeze merges repository-wide on any red since that job's context is the single required check. The script itself IS reachable pre-push via the `preflight` list in `taskfiles/ci-fast.yml`; this target is the on-demand `task check-platform-anchor` entry point beside it. WOULD RUN given a PAT in a repository secret carrying `administration: read` — a human action, recorded as the open half of blocker `ratification-platform-anchor`.",
         "check-corpus": "Requires council configuration, which is user-global (ADR-104) and absent in CI by construction. Would run against a fixture corpus that needs no configured council.",
         "check-media-deps": "Requires external media tooling not installed on runners. Would run with those dependencies in the runner image, or behind a skip-with-reason path.",
         "check-trunk-drift": "ADVISORY BY ITS OWN DOCSTRING — 'run it in the /create-pr pre-flight or wire into CI per your branch-protection policy'. Its red state is 'this branch is behind trunk', which is the normal state of an open PR, so wiring it would fail correct work. RECLASSIFIED from should-run during Phase 2 after reading what it asserts. Would run under a branch-protection policy that requires an up-to-date base.",