@event4u/agent-config 14.4.0 → 14.6.0

package/dist/agent-src/commands/analyze/decision.md

@@ -93,6 +93,13 @@ suggest deferring or strengthening evidence before proposing.
 ### Rules
 
 - Do NOT commit, push, or open a PR.
+- Do NOT report an ADR as still binding without evaluating it first —
+  `./scripts-run src/scripts/adr_cite_check <ADR-NNN>` resolves status,
+  `review_trigger` state, amendments, successors, and back-references in one
+  call. A `superseded` / `deprecated` ADR is not a live decision
+  to audit, and an amended one is not the text its body's top half claims.
+  (`rejected` is NOT in that set — on an ADR it records a rejected *proposal*,
+  so the rejection is the live decision.)
 - Do NOT auto-promote — `/memory propose` is the intake.
 - Do NOT re-litigate a decision confirmed still valid — acknowledge it,
   note the validation date, stop.

package/dist/agent-src/commands/optimize/project.md

@@ -166,6 +166,16 @@ Hard rules for this step:
   and its recorded revisit-conditions first; if it truly blocks, the
   only flip path offered is option 3 (council re-eval) — "Flip" is not
   offered for locks.
+- **An ADR lock is evaluated before it is reported.** When the lock is a
+  numbered ADR, the FIRST action is
+  `./scripts-run src/scripts/adr_cite_check <ADR-NNN>` — not "report the
+  lock". A `superseded` / `deprecated` status means there is no
+  live lock to route at all, and an amended ADR means the cited text may not
+  be the operative one. `rejected` stays live — it records a rejected
+  *proposal*, so reopening it means showing the premise it rejected on has
+  changed. Reporting an unevaluated ADR as a blocker is the
+  ordering defect `decision-revisit-gate` exists over: it costs the owner a
+  turn to discover what one command answers.
 - **Session budget:** at most 5 interview questions by default
   (`--max-questions=N` to override). Budget exhausted → remaining
   candidates go to Step 4 as "further candidates".

package/dist/agent-src/commands/roadmap/process-full.md

@@ -46,10 +46,15 @@ with the **scope delta below**.
 - **Working set:** every open step across every phase, in document
   order. Phase-internal annotations like `(deferred)` / `(optional)` /
   "gated on Phase N" do not narrow the working set.
-- **Stop after:** the entire roadmap reaches `count_open == 0`, or a
-  halt condition fires (Hard-Floor, council-off + ambiguity — the
-  latter only outside an accepted contract with council available,
+- **Stop after:** the entire roadmap reaches `count_open == 0`
+  (`complete`), or the runnable set is empty with steps still open
+  (`blocked` — see the terminal-outcomes section below), or a halt
+  condition fires (Hard-Floor, council-off + ambiguity — the latter only
+  outside an accepted contract with council available,
   security-sensitive, scope-out-of-roadmap, test/quality red).
+- **Do not start** when NO open step is runnable: that is
+  `blocked-preflight`, and it creates no branch and takes no grant. The
+  runnable test is § 3c of the loop.
 - **Phase boundary handling:** at every phase boundary, run the
   per-phase quality pipeline when `quality_cadence: per_phase` (or
   `per_step`) AND `quality.local_auto_run: true` — under the default
@@ -91,6 +96,8 @@ FORBIDDEN NON-HALT REASONS — NEVER STOP THE RUN FOR ANY OF THESE:
   · "avoid a PR pile-up" / "let the open PRs merge first"
   · "this phase is large / touches a deep subsystem"
   · "phase-checkpoints mode, so I'll checkpoint and wait"
+  · "this step looks human-gated" — `blocked` is reached by the § 3c
+    runnable test over PRE-EXISTING blockers, never by how a step feels
   · any agent-invented caution not in the five halt conditions above.
 INVENTING A HALT REASON IS A VIOLATION OF THE COMMAND AND THE USER'S WILL.
 IF CONTEXT RUNS OUT MID-RUN, KEEP LANDING COMPLETE STEPS UNTIL IT DOES —
@@ -110,6 +117,41 @@ roadmap carries such phrasing — whether by legacy or by an opt-in
 setting — treat it as ordinary prose during execution, never as a
 gate. Phase ordering and explicit dependency gates govern the loop.
 
+## Terminal outcomes — and why `blocked` is not a sixth halt
+
+The five halt conditions answer *"what interrupts runnable work"*. They never
+answered *"what does the run report when no runnable work is left and the roadmap
+is not finished"*, and the omission was not academic: measured 2026-08-19 across
+the twelve most nearly complete roadmaps in the estate, **zero** could reach
+`count_open == 0` in one PR — every remaining open step needed a human action, a
+repo-admin setting, a paid authorisation, an absent binary, or an elapsed soak
+window. Under the contract as written, such a roadmap had no legal stopping point,
+so the command could be neither obeyed nor honestly declined.
+
+| Outcome | When | Success? |
+|---|---|---|
+| `complete` | `count_open == 0` | yes — archival check runs |
+| `blocked` | `count_open > 0` and no open step is runnable per § 3c | **no** — partial progress, labelled as such |
+| `blocked-preflight` | no open step was runnable before the run started | **no** — nothing was attempted; no branch |
+| a halt | one of the five conditions fired | **no** — the halt is reported |
+
+```
+`blocked` IS NEVER REPORTED AS COMPLETION. count_open STAYS > 0.
+NEVER FLIP A BOX TO [~] TO REACH IT — THAT LAUNDERS OPEN WORK THROUGH A GLYPH.
+A PR OPENED ON A BLOCKED RUN SAYS PARTIAL PROGRESS IN ITS FIRST LINE.
+REVALIDATE THE RUNNABLE SET BEFORE REPORTING IT. ONE RUNNABLE STEP REJECTS THE CLAIM.
+```
+
+**It is a terminal outcome, not a halt, and the distinction is the safety
+property.** The Iron Law above and its forbidden list hold their full authority
+over mid-run stopping: an agent that may not stop for "this phase is large" may
+equally not stop for "this step looks human-gated". Runnability is decided by the
+§ 3c test over blockers that **pre-date the run** — a citation the run wrote
+itself buys nothing. AI council 2026-08-19, 2/2 convergent on exactly this
+separation.
+
+Recorded in [`ADR-235`](../../../../docs/decisions/ADR-235-process-full-blocked-terminal-outcome.md).
+
 ## Iron Law — Real-time dashboard
 
 ```

package/dist/agent-src/contexts/execution/roadmap-process-loop.md

@@ -180,6 +180,83 @@ change in § 3a.
   `commit-policy` § NEVER ask about committing holds regardless of
   autonomy).
 
+### 3c. Runnable-work precondition — refuse a run with nothing to do
+
+```
+A RUN WITH NO RUNNABLE OPEN STEP DOES NOT START.
+NAME THE BLOCKERS. CREATE NO BRANCH. WRITE NOTHING.
+THIS IS A PRECONDITION, NEVER A HALT — IT CANNOT FIRE MID-RUN.
+```
+
+Run once, at the end of the pre-scan, before any grant is exercised.
+
+**Runnable** is decided from the roadmap's own `## Blockers` section and nothing
+else. An open step is **not** runnable when a blocker satisfies all four:
+
+1. it exists in `## Blockers` **before this run started** — a blocker the run
+   itself authored does not count (see the gaming note below);
+2. its `Class:` is `2` (consent-once) or `3` (human-only) — classes `0` and `1`
+   are agent-runnable by construction and carry a `Run:` the agent executes,
+   per [`templates/roadmaps.md`](../../templates/roadmaps.md);
+3. its `Blocks:` field names this step, by phase-and-step identifier or by a
+   phase whose scope contains it;
+4. it names what would clear it.
+
+Every other open step is runnable. **No blocker citation → runnable**, and the
+default direction is deliberate: the failure this precondition must not have is
+refusing work an agent could have done.
+
+- **At least one runnable open step** → the run proceeds. It does *not* matter
+  how many steps are blocked; the blocked ones are skipped in place (never
+  flipped — see the terminal-outcomes section), and the run works the rest.
+- **Zero runnable open steps** → `blocked-preflight`. Report the roadmap, the
+  open-step count, and each blocker with its class and its clearing action.
+  Create no branch, write no state, take no grant.
+
+**A step this precondition judges non-runnable carries a `blocked-by:` marker on
+its own line.** The obligation is here because two mechanisms read blockedness
+from two different places and only one of them reads this section: `run-continuation`,
+the stop-slot concern that re-engages an autonomous run, decides open-vs-blocked
+from the inline `<!-- blocked-by: <id> -->` marker and never parses `## Blockers`
+at all. Without the marker a step that IS blocked per the four conditions above
+still counts as open work to the concern, which re-engages the agent into it every
+stop fire until the stall rung fires — the mechanism whose job is to detect a
+stall manufacturing one, which is the failure shape this file already records once
+for the roadmap-root split.
+
+Round 8 finding 7 caught the two predicates as disjoint. The fix is this coupling
+sentence rather than teaching the concern to parse `## Blockers`: a second
+implementation of the four conditions is a second thing to keep in step, and the
+one-line marker is checkable by eye at the step it belongs to. **The residual is
+real and is not papered over:** nothing enforces the pairing, so a `## Blockers`
+entry authored without its marker is caught by review or not at all.
+
+**Why a precondition and not a sixth halt.** The five halt conditions interrupt
+work that is still runnable; this decides whether any runnable work exists at
+all. Keeping them structurally separate is what preserves the forbidden-list's
+authority over mid-run stopping — an agent that may not stop for "this phase is
+large" also may not stop for "this feels human-gated". AI council 2026-08-19,
+2/2 convergent, explicitly on this point: *"keep this structurally separate from
+'five, and only five': the five are exceptional halts; `blocked` is an
+exhaustion-of-runnable-work terminal outcome."*
+
+**The gaming vector, named because it is the one thing that would make this
+worse than the gap it closes.** An agent meets a hard step, writes a `## Blockers`
+entry claiming Class 3, cites it, and stops — a comfort-stop wearing a citation.
+Condition 1 is the whole defence: a blocker must pre-date the run, which is
+checkable from git rather than from the agent's word. A blocker discovered
+mid-run is recorded (that is honest and useful) and does **not** make the step
+non-runnable in this run.
+
+**One imprecision, recorded rather than smoothed over.** The class taxonomy has
+four rows and none of them says *"waiting on time"* or *"waiting on another
+roadmap"*. A soak window and a cross-roadmap dependency are authored as `3`
+today, because absence of `Class:` already means `3` — so they are decidable but
+mislabelled as human-only. A fifth class is a taxonomy change with a linter
+behind it (`lint_roadmap_blockers`) and is not made here.
+*Revisit-if:* a run is refused on a blocker whose real content is "wait", and
+the report reads wrong to the person holding it.
+
 ## 4. Resolve cadences — read once, cache for the run
 
 Read both keys from `.agent-settings.yml` once and cache for the whole
@@ -430,6 +507,52 @@ artifact drafting, council enablement), not safety.
 
 On halt: stop, surface state, do **not** auto-fix outside the failing step.
 
+### Terminal outcomes — `complete`, `blocked`, or a halt
+
+The halt list above answers *"what interrupts runnable work"*. It does not answer
+*"what does the run report when there is no runnable work left and the roadmap is
+not finished"*, and until this section there was no answer: the wrapper's stop
+condition was `count_open == 0` or a halt, so a roadmap whose remaining steps all
+need a human had **no legal stopping point**.
+
+That is not a hypothetical. Measured 2026-08-19 across the twelve most nearly
+complete roadmaps in the estate: **zero** could reach `count_open == 0` in one
+PR. Every remaining open step needed a human action — flip branch protection,
+delete committed evidence, authorise paid spend, install an absent binary, wait
+out a soak window, use the maintainer's own machine, or edit a file an armed host
+hook denies.
+
+Three outcomes, and only one of them is success:
+
+| Outcome | When | What it reports |
+|---|---|---|
+| `complete` | `count_open == 0` | the roadmap is finished; archival check runs (§ 6) |
+| `blocked` | `count_open > 0` **and** no open step is runnable | the work that DID close, plus every blocker with its clearing action |
+| a halt | one of the five conditions above fired | the halt, its evidence, and what remains |
+
+```
+`blocked` IS NEVER PRESENTED AS COMPLETION.
+count_open STAYS > 0. NO CHECKBOX IS FLIPPED TO [~] TO REACH IT.
+A PR OPENED ON A BLOCKED RUN IS LABELLED PARTIAL PROGRESS.
+REVALIDATE IMMEDIATELY BEFORE REPORTING IT — ONE RUNNABLE STEP LEFT REJECTS THE CLAIM.
+```
+
+The `[~]` prohibition is load-bearing and was the one point the council split on.
+Deferring a blocked step to `[~]` would let the run reach `count_open == 0` and
+report completion — laundering unfinished work through a glyph, which is exactly
+what Iron Law 3 of [`roadmap-progress-sync`](../../rules/roadmap-progress-sync.md)
+exists to catch on the archival side. So the boxes stay open and the outcome
+carries the truth instead.
+
+Revalidation is the second half of the same discipline: the runnable set is
+recomputed at the moment of reporting, because steps unblock during a run (a
+prerequisite closes, a `Run:` succeeds, a peer merges). If any open step is
+runnable, `blocked` is refused and the loop continues.
+
+**Runnability is decided by the § 3c test**, unchanged — the same four conditions,
+including that a qualifying blocker must pre-date the run. A blocker the run
+authored is recorded and does not make a step non-runnable in that run.
+
 ### Forbidden non-halt reasons — agent-invented cautions
 
 The halt list above is **exhaustive**. An agent running `process-full` (or any
@@ -446,9 +569,15 @@ a violation of the command and the user's will:
   a phase boundary emits a non-blocking status line and the run **continues**;
   the stop-and-wait reading of `phase-checkpoints` applies only to
   `process-phase`.
+- **"this step looks human-gated"** — the `blocked` outcome above is reached by
+  the § 3c test over blockers that pre-date the run, never by a judgement about
+  how a step feels. A step with no qualifying blocker citation is runnable, and
+  writing the citation yourself does not make it one. This entry exists because
+  the terminal outcome is the single most abusable thing on this page.
 
 If the work genuinely cannot continue, it will be because one of the five real
-halt conditions fired — surface THAT, not a manufactured caution.
+halt conditions fired, or because the runnable set is empty by the § 3c test —
+surface THAT, with the blockers named, not a manufactured caution.
 
 ### Non-halt — gating notes, "optional" tags
 

package/dist/agent-src/rules/decision-revisit-gate.md

@@ -10,8 +10,14 @@ triggers:
   - keyword: "already decided"
   - keyword: "locked decision"
   - keyword: "budget blocks"
+  - keyword: "adr-"
+  - keyword: "adrs"
+  - keyword: "superseded"
+  - keyword: "review_trigger"
+  - phrase: "the adr"
 routes_to:
-  - "skill:decision-review"
+  - "skill:ai-council"
+  - "skill:decision-record"
 workspaces: [agent-config-maintainer, engineering]
 packs: [meta]
 collision_ok:
@@ -28,24 +34,99 @@ obligation_frequency: "per-task"
 A LOCK IS A DECISION UNDER PAST CONDITIONS, NOT A PERMANENT LAW.
 BENEFIT BLOCKED BY A LOCK → SURFACE + OFFER RE-EVALUATION.
 NEVER SILENT COMPLIANCE. NEVER SILENT DROP OF A GOOD CHANGE.
+RE-EVALUATION GOES TO THE COUNCIL FIRST, NOT TO THE USER FIRST.
+THE USER IS REACHED FOR THE RESERVED SET — AND ALWAYS FOR IT.
+NEVER CITE A LOCK YOU HAVE NOT EVALUATED THIS TURN.
 ```
 
 An agent that finds a genuinely beneficial change blocked by a recorded
 past decision — an honest-null eval verdict, a "don't relitigate"
 memory or context note, a token-frugality/budget canon line, or an ADR —
-does not quietly comply and drop the change. It surfaces the conflict
-and offers the user a path to re-evaluate the lock. Progress means
-adaptation: locks encode what was true when they were written, not a
-ceiling on what the package may ever become.
+does not quietly comply and drop the change. It surfaces the conflict and
+re-evaluates the lock — **in the council by default**, reaching the user only
+for the reserved set below. Progress means adaptation: locks encode what was
+true when they were written, not a ceiling on what the package may ever become.
+
+**The default venue is the council, and this is a correction, not a new
+policy.** [`ai-council`](../skills/ai-council/SKILL.md) has said since its own
+Iron Law that *"a design decision the agent cannot settle from the tree goes to
+the council first, not to the user first"*, and its class table already lists
+"reopening a recorded decision". This rule used to say "offers the user a path",
+which contradicted that and made every lock an owner interrupt. The measured
+cost of the contradiction: across 26 days of transcripts, the agent reported a
+lock and waited, and the owner had to void the decision retroactively before the
+work resumed — in the two clearest cases the lock report is timestamped **before**
+the override demand. The ordering was the defect; the permission was never
+missing.
 
 **Mechanism-match check comes FIRST**: a verdict settles the *mechanism it
 tested*, not every future proposal that resembles it — if the blocked change
 is a different mechanism, the lock does not apply; proceed, noting the
 distinction.
 
-Body migrated to [`skill:decision-review` § Decision-revisit gate — mechanics](../skills/decision-review/SKILL.md) (per P4 of `road-to-kernel-and-router.md`) — what-counts-as-a-lock catalog (honest nulls, don't-relitigate notes, budget-canon lines, ADRs, hard structural caps), the five fire steps, when-NOT-to-fire, failure modes.
+## The five steps, carried here — the depth is elsewhere, the obligation is not
+
+1. **Mechanism-match** (above) — different mechanism, no lock, proceed.
+2. **Evaluate the lock before citing it.** An ADR may not be presented as a
+   reason not to act until its status, `review_trigger` state, amendments and
+   successors have been read. In this repository that is one command —
+   `./scripts-run src/scripts/adr_cite_check <ADR-NNN>`; elsewhere it is the
+   same four reads done by hand. A `superseded` / `deprecated` status means it is
+   not a live lock at all; a fired or indeterminate trigger means it is not an
+   **unqualified** one. `rejected` is NOT in the dead set — on an ADR it records
+   a rejected *proposal*, so the rejection binds until its premise is shown to
+   have changed.
+3. **Surface** the change, the lock, the condition it recorded, and what has
+   changed since.
+4. **Route it** — council by default (below), user only for the reserved set.
+5. **Record** the outcome with scope and `revisit-if`.
+
+These five are the obligation and they are stated here rather than only behind
+a route, because the route was measurably unreachable: `decision-revisit-gate`
+lives in the always-on `meta` pack while `decision-review` ships
+`install.default: false` in the non-default `analysis-workbench` pack, so a
+pack-legal install received the obligation and not the procedure. `routes_to`
+now names two always-on skills; the backward-audit depth in
+[`decision-review`](../skills/decision-review/SKILL.md) stays optional, which is
+the correct status for depth.
+
+Full catalog (honest nulls, don't-relitigate notes, budget-canon lines, ADRs,
+hard structural caps), the per-step detail, when-NOT-to-fire and the failure
+modes remain in [`skill:decision-review` § Decision-revisit gate — mechanics](../skills/decision-review/SKILL.md).
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).
 
+## Who decides — the owner-reserved set
+
+The discriminator, in one question: **does the proposed transition weaken an
+owner-reserved invariant, or create an undelegated external, irreversible, or
+destructive commitment?** No, and reversible inside the authorised envelope →
+the council decides. Yes, or not establishable from tree evidence → the owner.
+
+The routing unit is the **transition**, never the document: the same ADR may be
+strengthened by the council and weakened only by the owner.
+
+| Reserved to the owner | Council-decidable |
+|---|---|
+| Changes the project's purpose or a declared non-negotiable outcome | Any mechanism serving that purpose |
+| **Lowers or removes** a recorded security / privacy / safety / data-handling floor | Strengthening a floor, or an equivalent swap above it |
+| Irreversible or materially destructive | Reversible within the envelope |
+| Spend or liability **above** a delegated threshold | Budgeted, threshold-bounded spend |
+| Creates / removes / weakens a legal, regulatory, contractual, licensing, compatibility, or public commitment | Internal-only commitments |
+| Governance self-amendment — reopening authority, quorum, escalation, this set | What the rules already permit |
+| Cannot be bounded from available evidence | Bounded, with the evidence cited |
+
+Council split, abstention, or no quorum is an **escalation condition**, not a
+class: that transition escalates, the ADR does not become owner-reserved
+forever. Availability is `agent-config council:status`, never a project file
+([`council-availability`](council-availability.md)).
+
+Field on the ADR: `reopen_policy: directional | owner | unclassified`, absent →
+**`unclassified`**, which permits council investigation and reversible
+experiments and gates only execution of a reserved transition. Absent is
+deliberately not `owner`: with 146 accepted ADRs that default would encode
+today's blockage into the new schema. Full contract, the reopen record, and the
+precedent-creates-no-authority clause: [`adr-layout § Reopen authority`](../docs/contracts/adr-layout.md).
+
 ## See also
 
 - [`decision-review`](../skills/decision-review/SKILL.md) — the backward-audit
@@ -53,10 +134,30 @@ Trigger-set above activates this routing on demand, independent of the disciplin
 - [`ai-council`](../skills/ai-council/SKILL.md) — the re-evaluation mechanism;
   owns the convergence-summary scope + `revisit-if` contract.
 - [`decision-record`](../skills/decision-record/SKILL.md) — forward-flow decision
-  locking; the escalation litmus there names the reopening condition up front.
+  locking; its **§ 4 Lock the choice + consequences** requires the `Revisit-if:`
+  line that names the reopening condition up front. (This pointer used to cite an
+  "escalation litmus" heading; `grep` over `src/` + `docs/` returns two hits and
+  neither is in that file — the heading never existed, so the pointer led
+  nowhere. Corrected to the section that carries the obligation.)
 - [`token-budget-discipline`](token-budget-discipline.md) — the frugality-canon
   value-over-budget escalation this rule's budget-lock case defers to.
 - [`no-cheap-questions`](no-cheap-questions.md) — the question-quality floor a
   revisit-offer must still clear.
 - [`ask-when-uncertain`](ask-when-uncertain.md) — the numbered-options shape
   used to present the revisit offer.
+
+## Honest enforcement — `enforced_by: none`
+
+`adr_cite_check` is deterministic where it runs, and nothing makes it run. No
+gate can observe an agent citing a decision it never opened, so step 2 above is
+model-carried — the same honesty boundary
+[`security-sensitive-stop`](security-sensitive-stop.md) and
+[`active-remediation`](active-remediation.md) state for their own obligations.
+
+Two reach limits, named rather than implied. The tool lives in this repository's
+`src/scripts/` and is **not** exposed as an `agent-config` verb, so a consumer
+install performs step 2 by hand; wiring the verb touches six further surfaces
+plus the curated `dist/agent-src/scripts/` list and is deliberately out of this
+change. And `docs/decisions/` is projected into no agent-visible tree at all —
+the agent sees ADR *numbers* cited across rules and skills, almost never ADR
+*text*. Until that changes, "evaluate before citing" means opening the file.

package/dist/agent-src/skills/adr-create/SKILL.md

@@ -11,6 +11,8 @@ execution:
   command:
     - ./scripts-run
     - src/scripts/adr/regenerate_index
+    - --dir
+    - docs/decisions
 runtime_requires:
   bins:
     - bash
@@ -59,7 +61,10 @@ Do NOT use when:
     governance ADRs, 3-digit numbering (`ADR-NNN-<slug>.md`).
   - **Per-area** — `docs/adrs/<area>/`: sub-area ADRs, 4-digit
     numbering (`NNNN-<slug>.md`); `<area>` must match the canonical
-    inventory in [`scripts/audit_adr_coverage.ts`](../../../scripts/audit_adr_coverage.ts).
+    inventory in `src/scripts/audit_adr_coverage.ts` (`AREAS`). Deliberately not
+    a link: this skill is projected into `dist/agent-src/skills/`, whose sibling
+    `scripts/` directory carries six curated files and not this one, so any
+    relative href that resolves in `src/` is broken in the projection.
 - The decision is **already made** — ADRs record outcomes, they do
   not run the decision process. For unresolved trade-offs, run the
   council or consult `adversarial-review` first.
@@ -80,7 +85,7 @@ Ask one question only if both are plausible:
    `NNNN-<slug>.md` (4-digit, no `ADR-` prefix).
 3. **Unknown area** — `<area>` not in the inventory: refuse with a
    hint to add the area to `AREAS` in
-   `scripts/audit_adr_coverage.ts` in the same PR. Do not invent.
+   `src/scripts/audit_adr_coverage.ts` in the same PR. Do not invent.
 4. **In doubt** → per-area (cheaper to surface, easier to relocate).
 
 ### 2. Pick the next ADR number
@@ -134,8 +139,12 @@ date: YYYY-MM-DD
 decision: <slug>
 supersedes: — | ADR-MMM
 superseded_by: — | ADR-MMM
+amends: — | ADR-MMM          # optional — this ADR amends that one (reciprocal required)
+amended_by: — | ADR-MMM      # optional — reciprocal of `amends`
 phase: <roadmap> · <phase-id>
 review_trigger: <the CONDITION that would reopen this decision>
+protected_dimensions: [...]  # optional — purpose | security_floor | privacy_floor | external_commitment | governance | none
+reopen_policy: directional | owner | unclassified   # optional; absent → unclassified
 ---
 
 # ADR-NNN — <Decision Title>
@@ -204,7 +213,7 @@ completeness check — not on every ADR by default.
 - **Per-area numbering is 4-digit** (`NNNN-<slug>.md`); the flat
   surface stays 3-digit (`ADR-NNN-<slug>.md`). Do not mix.
 - **Area inventory is closed** — `<area>` must already exist in
-  `AREAS` in `scripts/audit_adr_coverage.ts`. Adding a new area is
+  `AREAS` in `src/scripts/audit_adr_coverage.ts`. Adding a new area is
   a separate PR with explicit reviewer sign-off.
 - Frontmatter `adr:` (flat) is the canonical number; the filename
   prefix must match. The flat regenerator fails on mismatch.
@@ -214,6 +223,19 @@ completeness check — not on every ADR by default.
   to `superseded`.
 - Never delete an ADR file — supersede it. Deletion breaks
   historical links and round-trips through git history checks.
+- **Amending is the common case; wire it in both directions.** Most reopens
+  correct one decision inside an otherwise sound ADR rather than replacing the
+  whole record. Use `## Amendment N (YYYY-MM-DD) — <topic>` plus the reciprocal
+  `amends:` / `amended_by:` pair — the validator rejects a one-sided link,
+  because a one-sided link is invisible from the stale side, and the stale side
+  is the one a reader lands on first. Where the amendment reverses text that is
+  still asserted above it, add a one-line banner there too; the frontmatter
+  alone does not stop someone quoting the reversed sentence.
+- **Who may reopen it is recorded, not assumed** — `reopen_policy` /
+  `protected_dimensions`, both optional, absent meaning `unclassified`
+  ([`adr-layout § Reopen authority`](../../../docs/contracts/adr-layout.md)).
+  Reach for `owner` only when EVERY future transition is genuinely reserved;
+  `directional` is the normal answer, and no answer is a fine answer.
 
 ## Frugality Standards
 

package/dist/agent-src/skills/decision-review/SKILL.md

@@ -280,6 +280,24 @@ in the rule; the lock catalog, fire steps, and failure modes live here.
    contract — every re-evaluated lock gets a fresh, correctly-scoped
    disposition, not a re-statement of the old one.
 
+   When the lock is an **ADR**, the disposition carries the five-field reopen
+   record from [`adr-layout § Reopen record`](../../../docs/contracts/adr-layout.md):
+   the original rationale **addressed** (not cited), what changed with tree
+   evidence, dependants and external commitments touched, the rollback path,
+   and a blast radius — `narrow | wide | irreversible` — with the evidence for
+   that call. Two clauses bind the same record: **precedent creates no
+   authority** (that a similar ADR was reopened is never grounds for this one),
+   and **one seat must argue the strongest case for keeping the decision**.
+   Both answer precedent laundering through correlated self-review, which is
+   the failure two independent council seats named for this mechanism on
+   2026-08-19: the proposer frames the evidence, correlated seats ratify, and
+   the amendment becomes authoritative input for the next review.
+
+   Proportionally: a narrow, reversible, bounded transition takes the light
+   path (record + council); `wide` or `irreversible` adds owner notification.
+   Identical ceremony for a typo-level amendment would cost more than asking
+   the owner and the mechanism would die of its own weight.
+
 ### When NOT to fire
 
 - The blocked change has no real benefit — the gate is not a lever to

package/dist/agent-src/templates/agents/agent-project-settings.example.yml

@@ -39,7 +39,7 @@ schema_version: 1
 # CI guard: a release bump of `package.json` must update this value
 # in lockstep — see scripts/check_template_pin_drift.ts (road-to-
 # portable-runtime-and-update-check P3.3).
-agent_config_version: "14.4.0"
+agent_config_version: "14.6.0"
 
 # --- Project identity ---
 project:

package/dist/cli-delegate/{chunk-ZPSXJTLI.js → chunk-P6LQDIWK.js}

@@ -213,6 +213,20 @@ var CAPSULE_SCHEMA_VERSION = 3;
 function isShortLine(value, max) {
   return typeof value === "string" && value.length > 0 && value.length <= max && !value.includes("\n");
 }
+function isPathRef(value) {
+  return typeof value === "string" && value.length > 0 && !/\s/.test(value);
+}
+function checkPathRefList(errors, field, value, max, required) {
+  checkList(errors, field, value, max, required);
+  if (!Array.isArray(value)) return;
+  if (value.some((x) => !isShortLine(x, max))) return;
+  const bad = value.filter((x) => !isPathRef(x));
+  if (bad.length === 0) return;
+  const shown = bad.slice(0, 3).map((x) => JSON.stringify(String(x))).join(", ");
+  errors.push(
+    `${field} carries ${bad.length} entr${bad.length === 1 ? "y" : "ies"} that are prose, not path refs: ${shown}${bad.length > 3 ? ", \u2026" : ""} \u2014 write the path (src/generated/api.ts, ../other-worktree/) or drop the entry; a sentence naming a file cannot be compared against a write target, and being comparable is the whole reason this is a field rather than a line of prose`
+  );
+}
 function checkList(errors, field, value, max, required) {
   if (value === void 0) {
     if (required) errors.push(`${field} is required`);
@@ -402,7 +416,7 @@ function validateRecycleEnvelope(input) {
   checkList(errors, "decisions", e["decisions"], MAX_LINE_CHARS, false);
   errors.push(...decisionTagErrors(e["decisions"]));
   checkList(errors, "constraints", e["constraints"], MAX_LINE_CHARS, false);
-  checkList(errors, "do_not_touch", e["do_not_touch"], MAX_REF_CHARS, false);
+  checkPathRefList(errors, "do_not_touch", e["do_not_touch"], MAX_REF_CHARS, false);
   checkList(errors, "open_worker_envelopes", e["open_worker_envelopes"], MAX_REF_CHARS, false);
   checkList(errors, "artifact_paths", e["artifact_paths"], MAX_REF_CHARS, false);
   checkList(errors, "suggested_skills", e["suggested_skills"], MAX_REF_CHARS, false);

package/dist/cli-delegate/cmd_conformance.js

@@ -4,7 +4,7 @@ import {
 } from "./chunk-F7DQWYR5.js";
 import {
   validateAssumption
-} from "./chunk-ZPSXJTLI.js";
+} from "./chunk-P6LQDIWK.js";
 import {
   ArgparseExit,
   STATUS_SYMBOLS,

package/dist/cli-delegate/cmd_handoff.js

@@ -21,7 +21,7 @@ import {
   scanEnvelopeDirectives,
   validateRecycleEnvelope,
   wrapAsPriorSessionData
-} from "./chunk-ZPSXJTLI.js";
+} from "./chunk-P6LQDIWK.js";
 import {
   _RAW_KEY_PREFIXES,
   hardenedSpawnEnv,

package/dist/cli-delegate/cmd_session_recycle.js

@@ -7,7 +7,7 @@ import {
 import {
   CAPSULE_SCHEMA_VERSION,
   validateRecycleEnvelope
-} from "./chunk-ZPSXJTLI.js";
+} from "./chunk-P6LQDIWK.js";
 import {
   atomic_write_json
 } from "./chunk-EJITJBJX.js";

package/dist/discovery/deprecation-report.md

@@ -1,6 +1,6 @@
 # Discovery — Deprecation Report
 
-- Generated: `2026-08-19T14:19:48Z`
+- Generated: `2026-08-20T10:01:02Z`
 - Deprecated artefacts: **0**
 
 _None. Tree is clean._