@event4u/agent-config 14.6.0 → 14.7.0

package/dist/agent-src/contexts/execution/roadmap-process-loop.md

@@ -180,82 +180,85 @@ change in § 3a.
   `commit-policy` § NEVER ask about committing holds regardless of
   autonomy).
 
-### 3c. Runnable-work precondition — refuse a run with nothing to do
+### 3c. Capability screen — can the agent do this at all?
 
 ```
-A RUN WITH NO RUNNABLE OPEN STEP DOES NOT START.
-NAME THE BLOCKERS. CREATE NO BRANCH. WRITE NOTHING.
-THIS IS A PRECONDITION, NEVER A HALT — IT CANNOT FIRE MID-RUN.
+A RUN ALWAYS STARTS. THERE IS NO PREFLIGHT REFUSAL.
+PER OPEN STEP, ASK ONE QUESTION: CAN THE AGENT EXECUTE THIS AT ALL?
+YES → IT IS WORK. NO → IT IS THE ONLY KIND OF BLOCKER LEFT.
+WHO CONVENTIONALLY DOES A THING IS NOT A PROPERTY OF THE THING.
 ```
 
-Run once, at the end of the pre-scan, before any grant is exercised.
-
-**Runnable** is decided from the roadmap's own `## Blockers` section and nothing
-else. An open step is **not** runnable when a blocker satisfies all four:
-
-1. it exists in `## Blockers` **before this run started** — a blocker the run
-   itself authored does not count (see the gaming note below);
-2. its `Class:` is `2` (consent-once) or `3` (human-only) — classes `0` and `1`
-   are agent-runnable by construction and carry a `Run:` the agent executes,
-   per [`templates/roadmaps.md`](../../templates/roadmaps.md);
-3. its `Blocks:` field names this step, by phase-and-step identifier or by a
-   phase whose scope contains it;
-4. it names what would clear it.
-
-Every other open step is runnable. **No blocker citation → runnable**, and the
-default direction is deliberate: the failure this precondition must not have is
-refusing work an agent could have done.
-
-- **At least one runnable open step** → the run proceeds. It does *not* matter
-  how many steps are blocked; the blocked ones are skipped in place (never
-  flipped — see the terminal-outcomes section), and the run works the rest.
-- **Zero runnable open steps** → `blocked-preflight`. Report the roadmap, the
-  open-step count, and each blocker with its class and its clearing action.
-  Create no branch, write no state, take no grant.
-
-**A step this precondition judges non-runnable carries a `blocked-by:` marker on
-its own line.** The obligation is here because two mechanisms read blockedness
-from two different places and only one of them reads this section: `run-continuation`,
-the stop-slot concern that re-engages an autonomous run, decides open-vs-blocked
-from the inline `<!-- blocked-by: <id> -->` marker and never parses `## Blockers`
-at all. Without the marker a step that IS blocked per the four conditions above
-still counts as open work to the concern, which re-engages the agent into it every
-stop fire until the stall rung fires — the mechanism whose job is to detect a
-stall manufacturing one, which is the failure shape this file already records once
-for the roadmap-root split.
-
-Round 8 finding 7 caught the two predicates as disjoint. The fix is this coupling
-sentence rather than teaching the concern to parse `## Blockers`: a second
-implementation of the four conditions is a second thing to keep in step, and the
-one-line marker is checkable by eye at the step it belongs to. **The residual is
-real and is not papered over:** nothing enforces the pairing, so a `## Blockers`
-entry authored without its marker is caught by review or not at all.
-
-**Why a precondition and not a sixth halt.** The five halt conditions interrupt
-work that is still runnable; this decides whether any runnable work exists at
-all. Keeping them structurally separate is what preserves the forbidden-list's
-authority over mid-run stopping — an agent that may not stop for "this phase is
-large" also may not stop for "this feels human-gated". AI council 2026-08-19,
-2/2 convergent, explicitly on this point: *"keep this structurally separate from
-'five, and only five': the five are exceptional halts; `blocked` is an
-exhaustion-of-runnable-work terminal outcome."*
-
-**The gaming vector, named because it is the one thing that would make this
-worse than the gap it closes.** An agent meets a hard step, writes a `## Blockers`
-entry claiming Class 3, cites it, and stops — a comfort-stop wearing a citation.
-Condition 1 is the whole defence: a blocker must pre-date the run, which is
-checkable from git rather than from the agent's word. A blocker discovered
-mid-run is recorded (that is honest and useful) and does **not** make the step
-non-runnable in this run.
-
-**One imprecision, recorded rather than smoothed over.** The class taxonomy has
-four rows and none of them says *"waiting on time"* or *"waiting on another
-roadmap"*. A soak window and a cross-roadmap dependency are authored as `3`
-today, because absence of `Class:` already means `3` — so they are decidable but
-mislabelled as human-only. A fifth class is a taxonomy change with a linter
-behind it (`lint_roadmap_blockers`) and is not made here.
-*Revisit-if:* a run is refused on a blocker whose real content is "wait", and
-the report reads wrong to the person holding it.
+**Rewritten by [ADR-237](../../../docs/decisions/ADR-237-end-to-end-execution-authority.md),
+which supersedes ADR-235.** This section used to be a *preflight refusal*: a run
+with no "runnable" open step created no branch and wrote nothing. That is gone.
+The invocation is a delegation, so the question is no longer *is this step
+runnable under current governance* but *is this step possible for the agent at
+all.*
+
+Run once at the end of the pre-scan, and again immediately before any `blocked`
+report.
+
+**The screen, in order:**
+
+1. **Can the agent execute it?** Through the filesystem, git, `gh`, an API, a
+   CLI, a tool, a model, a council — anything machine-executable. If yes, the
+   step is **work**. Stop here; no blocker citation changes that.
+2. **Is the authority already implied by the invocation?** For a `process-full`
+   run: branches, chunked commits, pushing that branch, opening and updating the
+   PR, reversible repository/branch settings, CI runs and re-runs, merge-base
+   updates, conflict resolution, project-local dependencies, and paid calls
+   inside the cumulative USD 25 ceiling. If yes → **run it**.
+3. **Is it on the EXCLUDED list?** Merging to a production trunk, deploying,
+   production data / secrets / IAM / DNS, bulk deletion outside the roadmap's
+   scope, an irreversible external action beyond the PR itself. Those keep their
+   own this-turn confirmation ([`non-destructive-by-default`](../../rules/non-destructive-by-default.md))
+   and are a **halt**, not a blocker.
+4. **Otherwise it is externally impossible**, and only then is it a blocker: a
+   credential that does not exist and cannot be created · a purchase beyond the
+   budget · physical hardware access · another person or organisation must act ·
+   a wait that is factually mandatory and unverifiable.
+
+**A `## Blockers` entry is evidence, never a verdict.** A `Class: 3` label on an
+action the agent can perform is a **defect in the roadmap**, and the run repairs
+the label rather than obeying it — recording what it did and why. Class `0`/`1`
+entries carry a `Run:` the agent executes, exactly as before. Class `2`
+(consent-once) is pre-cleared for the duration of a `process-full` run when the
+consent it wants is one the invocation already gave; a `2` asking for something
+the invocation did NOT give (an EXCLUDED action, a spend crossing) still reaches
+the owner.
+
+**No citation → work**, and the default direction is unchanged: the failure this
+screen must not have is declining work an agent could have done.
+
+**A step this screen judges externally impossible carries a `blocked-by:` marker
+on its own line.** The obligation is unchanged and its reason is unchanged: two
+mechanisms read blockedness from two different places and only one reads this
+section — `run-continuation`, the stop-slot concern that re-engages an autonomous
+run, decides open-vs-blocked from the inline `<!-- blocked-by: <id> -->` marker
+and never parses `## Blockers`. Without the marker a step that IS impossible
+still counts as open work to the concern, which re-engages the agent into it
+every stop fire until the stall rung fires — the mechanism whose job is to detect
+a stall manufacturing one. **The residual is real and is not papered over:**
+nothing enforces the pairing, so a `## Blockers` entry authored without its
+marker is caught by review or not at all.
+
+**The gaming vector inverted, and both directions are now named.** Under ADR-235
+the vector was an agent writing itself a Class-3 blocker to stop early; the
+defence was that a qualifying blocker must **pre-date the run**, checkable from
+git. That defence is kept for the narrow blocker set that remains. ADR-237 adds
+the opposite vector — an agent that keeps going past a spend ceiling or into an
+EXCLUDED action under cover of "the roadmap needed it" — and its defences are
+step 3 above being an enumerated list rather than a characterisation, and the
+ceiling being cumulative per run rather than per action.
+
+**One imprecision, inherited and now given a test.** The class taxonomy has no
+row for *"waiting on time"* or *"waiting on another roadmap"*; both are authored
+as `3` today because an absent `Class:` already means `3`. Under step 4 a wait is
+a blocker only when it is factually mandatory and unverifiable — a soak window a
+run can simply outlast, or a cross-roadmap dependency the run can satisfy itself,
+is work. The taxonomy still lacks the row; the mislabel now has a stated test
+instead of a default.
 
 ## 4. Resolve cadences — read once, cache for the run
 
@@ -507,51 +510,68 @@ artifact drafting, council enablement), not safety.
 
 On halt: stop, surface state, do **not** auto-fix outside the failing step.
 
-### Terminal outcomes — `complete`, `blocked`, or a halt
-
-The halt list above answers *"what interrupts runnable work"*. It does not answer
-*"what does the run report when there is no runnable work left and the roadmap is
-not finished"*, and until this section there was no answer: the wrapper's stop
-condition was `count_open == 0` or a halt, so a roadmap whose remaining steps all
-need a human had **no legal stopping point**.
-
-That is not a hypothetical. Measured 2026-08-19 across the twelve most nearly
-complete roadmaps in the estate: **zero** could reach `count_open == 0` in one
-PR. Every remaining open step needed a human action — flip branch protection,
-delete committed evidence, authorise paid spend, install an absent binary, wait
-out a soak window, use the maintainer's own machine, or edit a file an armed host
-hook denies.
+### Terminal outcomes — `complete`, or a genuine external impossibility
+
+The halt list above answers *"what interrupts runnable work"*. This answers
+*"what does the run report when the roadmap is not finished and the remaining
+work is not the agent's to do"* — and under
+[ADR-237](../../../docs/decisions/ADR-237-end-to-end-execution-authority.md) that
+second set is much smaller than it looks.
+
+**The measurement that motivated the old answer, and the reading that replaced
+it.** Measured 2026-08-19 across the twelve most nearly complete roadmaps:
+**zero** could reach `count_open == 0` in one PR, because every remaining step
+needed "a human action" — flip branch protection, authorise paid spend, install a
+binary, wait out a soak window, edit a file a hook denies. The census was sound.
+The reading was not: it counted actions a human *conventionally* performs,
+without asking per action whether a human was **necessary**. Flipping a branch
+setting, pushing, opening a PR, re-running CI, updating a merge base, fixing a
+test, spending inside a budget — the agent can do all of it. That is remediation
+work, and a `process-full` invocation grants it.
 
 Three outcomes, and only one of them is success:
 
 | Outcome | When | What it reports |
 |---|---|---|
-| `complete` | `count_open == 0` | the roadmap is finished; archival check runs (§ 6) |
-| `blocked` | `count_open > 0` **and** no open step is runnable | the work that DID close, plus every blocker with its clearing action |
+| `complete` | `count_open == 0` and the PR is open | the roadmap is finished; archival check runs (§ 6) |
+| `blocked` | every remaining open step is **externally impossible** for the agent | the work that DID close, plus the specific impossibility |
 | a halt | one of the five conditions above fired | the halt, its evidence, and what remains |
 
+`blocked-preflight` **no longer exists** (ADR-237 § 4). A run always starts.
+
 ```
 `blocked` IS NEVER PRESENTED AS COMPLETION.
 count_open STAYS > 0. NO CHECKBOX IS FLIPPED TO [~] TO REACH IT.
 A PR OPENED ON A BLOCKED RUN IS LABELLED PARTIAL PROGRESS.
-REVALIDATE IMMEDIATELY BEFORE REPORTING IT — ONE RUNNABLE STEP LEFT REJECTS THE CLAIM.
+BEFORE REPORTING IT, ASK PER REMAINING STEP: CAN I DO THIS AT ALL?
+ONE STEP THE AGENT COULD HAVE EXECUTED REJECTS THE CLAIM.
 ```
 
+**Externally impossible — the whole list.** A required credential that does not
+exist and the agent cannot create · a purchase beyond the delegated budget ·
+physical hardware access · another person or organisation must act · a wait that
+is factually mandatory and cannot be simulated or verified.
+
+**Not externally impossible — every one of these is work.** An unprotected
+branch · a branch to create · a push · a PR to open · a repository or branch
+setting the agent can change · a workflow to start · CI to re-run · a merge base
+to update · conflicts · failing tests · local configuration · a paid call under
+the ceiling · "this could be risky" · "a maintainer should do this".
+
 The `[~]` prohibition is load-bearing and was the one point the council split on.
 Deferring a blocked step to `[~]` would let the run reach `count_open == 0` and
 report completion — laundering unfinished work through a glyph, which is exactly
 what Iron Law 3 of [`roadmap-progress-sync`](../../rules/roadmap-progress-sync.md)
 exists to catch on the archival side. So the boxes stay open and the outcome
-carries the truth instead.
-
-Revalidation is the second half of the same discipline: the runnable set is
-recomputed at the moment of reporting, because steps unblock during a run (a
-prerequisite closes, a `Run:` succeeds, a peer merges). If any open step is
-runnable, `blocked` is refused and the loop continues.
+carries the truth instead. **ADR-237 keeps this clause verbatim** — narrowing
+`blocked` makes it more important, not less, because a run with more authority
+has more ways to reach a clean-looking count.
 
-**Runnability is decided by the § 3c test**, unchanged — the same four conditions,
-including that a qualifying blocker must pre-date the run. A blocker the run
-authored is recorded and does not make a step non-runnable in that run.
+Revalidation is the second half of the same discipline: the set is recomputed at
+the moment of reporting, because steps unblock during a run (a prerequisite
+closes, a `Run:` succeeds, a peer merges, a setting the run itself changed). If
+any remaining step is one the agent could execute, `blocked` is refused and the
+loop continues.
 
 ### Forbidden non-halt reasons — agent-invented cautions
 
@@ -570,14 +590,25 @@ a violation of the command and the user's will:
   the stop-and-wait reading of `phase-checkpoints` applies only to
   `process-phase`.
 - **"this step looks human-gated"** — the `blocked` outcome above is reached by
-  the § 3c test over blockers that pre-date the run, never by a judgement about
-  how a step feels. A step with no qualifying blocker citation is runnable, and
-  writing the citation yourself does not make it one. This entry exists because
-  the terminal outcome is the single most abusable thing on this page.
+  the § 3c test, never by a judgement about how a step feels. A step with no
+  qualifying blocker citation is runnable, and writing the citation yourself does
+  not make it one. This entry exists because the terminal outcome is the single
+  most abusable thing on this page.
+- **"the branch is not protected" / "a branch must be created" / "a PR must be
+  opened" / "a GitHub setting must change" / "CI must be re-run" / "the merge
+  base needs updating" / "there are conflicts" / "tests fail"** — every one is
+  remediation work the invocation authorised (ADR-237 § 1). Do it.
+- **"a paid service is needed"** — authorised up to a cumulative USD 25 per run
+  (§ Spend in the wrapper). Uncertainty about the exact cost is explicitly NOT a
+  reason to ask.
+- **"a maintainer should do this"** when the agent can perform the same action
+  through git, `gh`, an API or a CLI. **Capability before role**: the role of the
+  person who conventionally does a thing is not a property of the thing.
 
 If the work genuinely cannot continue, it will be because one of the five real
-halt conditions fired, or because the runnable set is empty by the § 3c test —
-surface THAT, with the blockers named, not a manufactured caution.
+halt conditions fired, or because every remaining step is externally impossible
+by the § 3c test — surface THAT, with the specific impossibility named, not a
+manufactured caution and not a convention mistaken for a constraint.
 
 ### Non-halt — gating notes, "optional" tags
 

package/dist/agent-src/rules/context-hygiene.md

@@ -93,6 +93,8 @@ one shape the loop test above systematically misses, in both of its clauses.
   available were wait, or stop and report, and 34 licensed neither more than 31
   did. **The discriminator is the decision, not the digits.**
 
+For CI, do not hand-write the loop: `ci_settle <pr>` (mechanics below).
+
 So state it separately: pick **one** waiter for the condition and let it finish.
 Where the harness re-invokes on completion, waiting costs nothing and polling
 costs a turn per expiry — and every stacked waiter is a turn that arrives *after*

package/dist/agent-src/rules/decision-revisit-gate.md

@@ -129,6 +129,9 @@ precedent-creates-no-authority clause: [`adr-layout § Reopen authority`](../doc
 
 ## See also
 
+- [`recurring-criticism`](recurring-criticism.md) — the **other entrance**: this
+  rule fires when a lock blocks a change, that one when the same criticism arrives
+  again. It reuses the five steps and the owner-reserved table below.
 - [`decision-review`](../skills/decision-review/SKILL.md) — the backward-audit
   procedure + the migrated gate mechanics.
 - [`ai-council`](../skills/ai-council/SKILL.md) — the re-evaluation mechanism;

package/dist/agent-src/rules/fix-what-you-see.md

@@ -0,0 +1,108 @@
+---
+type: "auto"
+tier: "2a"
+alwaysApply: false
+description: "Saw a red check or a real defect — fix it, whoever wrote it; if you cannot, ship a tracked follow-up roadmap in the same change. Ownership is never a disposition"
+# Due when a defect is OBSERVED, not on a clock: a turn that sees nothing owes
+# nothing; a turn that sees a red check owes a disposition.
+obligation_frequency: "per-event"
+routes_to:
+  - "guideline:agent-infra/active-remediation-mechanics"
+triggers:
+  - keyword: "failing"
+  - keyword: "fails"
+  - keyword: "broken"
+  - keyword: "regression"
+  - phrase: "is red"
+  - phrase: "ci failed"
+  - phrase: "ci is"
+  - phrase: "not my"
+  - phrase: "nicht mein"
+  - phrase: "someone else's"
+  - phrase: "whose test"
+workspaces: [engineering]
+packs: [engineering-base]
+enforced_by:
+  - "none"
+---
+
+# Fix What You See
+
+## The Iron Law
+
+```
+YOU SAW IT, YOU FIX IT — WHOEVER WROTE IT.
+"NOT MY CODE" / "NOT MY TEST" / "ANOTHER SESSION OWNS THAT FILE" IS NOT A
+DISPOSITION. CANNOT FIX IT NOW → A TRACKED FOLLOW-UP ROADMAP SHIPS IN THE
+SAME CHANGE. A CHAT MENTION IS NOT ONE EITHER, NOR A "KNOWN-OPEN" LINE IN A
+PR BODY. A RED CHECK IS NEVER HANDED BACK WITH ITS CAUSE NAMED AND UNFIXED.
+```
+
+**Saw it** = a red check already in front of you (test, lint, type, CI), or a
+defect you pass while working — in your diff, a neighbouring file, a file
+another agent or a parallel session wrote. The author is irrelevant.
+
+**Two dispositions, and only two:** fix it with its verification, or land a
+roadmap under `agents/roadmaps/` in the SAME change naming the defect, its
+evidence, and what closes it.
+
+**Read the red before fixing it, with the narrowest tool.** A CI job:
+`gh run view --job <id> --log-failed | grep -E '×|FAIL|Error'` — never the whole
+log into context, and never `--watch`'s exit code, which is 0 even on a failure.
+A local red: the test runner with a filter on the one failing name, `tsc
+--noEmit` for a type error, the linter scoped to the changed files. **Reproduce
+it before you believe your diagnosis** — an environment-dependent red reproduces
+under the condition, not on your machine's defaults.
+
+Match the probe to the surface, because a passing unit test is not evidence for
+a broken surface: an HTTP red is proven with `curl` against the running
+endpoint, a UI red with a Playwright spec, a runtime red with the debugger
+(`xdebug`, breakpoints) rather than by reading the diff again.
+
+**Prove the fix with the same tool that showed the red**, in the same change.
+For a guard or a concurrency fix, prove SENSITIVITY too: neutralise the mechanism,
+watch the test fail, restore it. A test never seen red has unknown sensitivity.
+
+## Bounds
+
+Removes *ownership* as an excuse, not the diff limit:
+[`minimal-safe-diff`](minimal-safe-diff.md) still caps the change — too large
+IS the roadmap case. A fix crossing
+[`non-destructive-by-default`](non-destructive-by-default.md) still stops and
+asks; the ask becomes the work, not the exit.
+
+**Does NOT fire:** user fenced the scope this turn · no falsifiable break (a
+preference, not a red) · already decided by the user.
+
+## Why separate from `active-remediation`
+
+That rule forbids ignoring a spotted issue and its ladder permits **note + ask**.
+Two properties made it insufficient, both measured 2026-08-20: it is `type: auto`
+on `refactor`/`legacy`/`cleanup` triggers — **none of which a failing CI job
+matches**, so it does not load when the obligation matters most — and its
+note-and-ask tier is what let a session name a red check's cause, name the
+file's author, and hand it back still red.
+
+Mechanics (fix-now size criteria, follow-up shape) stay there; this rule only
+deletes the two escapes.
+
+## Honest activation gap — this rule is `auto`, and it wanted to be `always`
+
+It shipped `auto` for a budget reason, not a design one, and the gap that leaves
+is exactly the one it was written to close: **a red check the agent sees in tool
+output triggers nothing.** Keyword triggers match the PROMPT. So the rule loads
+when a human says "CI is red" or "not my test", and does NOT load when a test
+run comes back red and nobody has said a word.
+
+`check_always_budget` is the reason: the extended always-budget sat at
+60,252 / 60,254 chars — **two characters of headroom** — and the cap is a
+ratchet that may only move down. The other nine always-rules are the kernel,
+which `block_kernel_rule_writes` denies agent writes to, so no room can be made
+from this side. A 2,332-char rule puts the total at 103.9 %.
+
+Closing the gap needs one of: the ext-cap ratchet opened deliberately (a
+maintainer decision, recorded), a kernel rule shortened to make room, or a
+`post_tool_use` carrier that notices a non-zero verification exit — the only
+option that would fire on tool output rather than on wording. Until then, `auto`
+plus this paragraph is the honest state: the obligation is real, its delivery is
+partial, and the partiality is named rather than implied away.

package/dist/agent-src/rules/no-roadmap-references.md

@@ -3,11 +3,6 @@ type: "auto"
 tier: "mechanical-already"
 description: "Linking transient files (agents/roadmaps/, agents/runtime/council/) from stable artifacts — both expire; promote findings"
 alwaysApply: false
-triggers:
-  - path_prefix: "agents/roadmaps/"
-  - path_prefix: "agents/runtime/council/questions/"
-  - path_prefix: "agents/runtime/council/responses/"
-  - path_prefix: "agents/runtime/council/sessions/"
 routes_to:
   - "skill:ai-council"
   - "skill:agent-docs-writing"

package/dist/agent-src/rules/recurring-criticism.md

@@ -0,0 +1,110 @@
+---
+type: "auto"
+tier: "2b"
+description: "The same criticism arriving again indicts the system, not only the item — reopen the disposition that dismissed it, resolve on evidence, never on the repetition count"
+alwaysApply: false
+triggers:
+  - phrase: "schon mehrfach"
+  - phrase: "schon wieder"
+  - phrase: "zum dritten mal"
+  - phrase: "wie oft noch"
+  - phrase: "wie oft soll ich"
+  - phrase: "immer noch nicht"
+  - phrase: "i already told you"
+  - phrase: "told you this"
+  - phrase: "how many times"
+  - phrase: "as i mentioned before"
+routes_to:
+  - "guideline:agent-infra/recurring-criticism-mechanics"
+  - "skill:skill-improvement-pipeline"
+workspaces: [agent-config-maintainer, engineering]
+packs: [meta]
+collision_ok:
+  "schon wieder": "active-remediation makes a user 'leave it' terminal against the AGENT re-raising a closed item; this rule fires only when the USER brings it back — a decision-maker reopening their own decision is not the nagging that rule prevents"
+obligation_frequency: "per-task"
+---
+
+# Recurring Criticism
+
+[`decision-revisit-gate`](decision-revisit-gate.md) has one entrance: the agent
+wants to act and a lock is in the way. This is the other — **the same criticism
+arrives again**, from the user or from a re-arrived artifact.
+
+## The Iron Law
+
+```
+THE SAME CRITICISM ARRIVING AGAIN IS EVIDENCE ABOUT THE SYSTEM,
+NOT ONLY ABOUT THE ITEM.
+REOPEN THE DISPOSITION THAT DISMISSED IT. NAME WHICH ASSUMPTION BROKE.
+NEVER RESOLVE IT ON THE REPETITION COUNT — RESOLVE IT ON EVIDENCE.
+CAPITULATING BECAUSE IT WAS SAID TWICE IS THE SAME FAILURE
+AS DISMISSING IT TWICE.
+A LEARNING THAT DOES NOT CONSTRAIN THE NEXT RUN IS NOT A LEARNING.
+NEVER BUY A HARDENING BY WEAKENING A SAFETY FLOOR.
+```
+
+**The repetition reverses the burden of proof.** The standing rule is: same
+mechanism, no new evidence → the lock applies. Recurrence *is* the new evidence —
+not that the item is right, that the disposition did not hold. Whoever keeps the
+lock now carries the argument. **Mechanism-match still runs first**: a complaint
+resembling the old one but testing a different mechanism is a new finding.
+
+**Resolve on evidence, never on the count.** Challenging a model's answer —
+including a correct one — reliably makes it capitulate and revise toward the
+perceived expectation rather than toward truth
+<!-- harvest:reflection-sycophancy-flipflop -->, so a rule reading "said twice" as
+proof of error would be that failure mode with a procedure attached. The
+repetition opens the question; it never answers it.
+
+## Exactly three outcomes
+
+The repetition proves the **system** failed <!-- harvest:recurrence-indicts-the-system -->;
+it does not prove the **decision** was wrong. Own analysis, from that split:
+
+| Outcome | What actually broke | Hardening means |
+|---|---|---|
+| The disposition was **wrong** | the decision | reverse it, record what would have caught it |
+| **Right, never recorded** | the record | make it durable + citable, with `revisit-if` |
+| **Right, recorded, unreachable** | reachability | move it onto a surface the next run reads |
+
+In all three the system failed — only in the first was the decision wrong. A
+resolution naming none of them is an unresolved recurrence.
+
+**Look up the earlier disposition before re-deriving anything, and name the store
+you checked** — addresses, the mechanism-is-the-defect classification, the
+hardening floor and the failure modes are in
+[`recurring-criticism-mechanics`](../docs/guidelines/agent-infra/recurring-criticism-mechanics.md).
+One line does not migrate, because acting on it wrong is silent: rejections live in
+analysis prose by design, so "I found nothing" means *prose was grepped*, never
+*nothing was decided*.
+
+## When NOT to fire
+
+- **A repeated task instruction**, not a criticism — that is an instruction, do it.
+- **Mechanism-match fails** — a resemblance is not a recurrence.
+- **The agent is the one repeating** — that is [`no-cheap-questions`](no-cheap-questions.md).
+- **Already resolved this task.** Once decided, it is decided.
+
+## Honest enforcement — `enforced_by: none`
+
+One narrow deterministic signal exists. `src/scripts/_lib/self_repair.ts` keeps one
+record per defect fingerprint with an `occurrences` counter and reopens a released
+record when the user re-reports it — literally this rule's trigger state — and the
+injected queue line now carries that number, so above 1 an agent sees it. Three
+limits: `agents/runtime/` is gitignored, so the store is one machine's and empty on
+a fresh checkout; it covers only defects the complaint detector matched, where a
+phrasing outside the added patterns is a paraphrase away from silence; and it is
+hook-carried, so on a host without the slot nothing fires.
+
+The rest is model-carried, named rather than implied: **nothing** observes whether
+the earlier disposition was opened, for rejections there is nothing structured to
+open, and no gate can tell a resolution that named one of the three outcomes from
+one that asserted it. Claiming the counter as coverage for any of that would
+inflate it, so it is not claimed — skipping this rule is caught by nothing.
+
+## See also
+
+- [`decision-revisit-gate`](decision-revisit-gate.md) — the other entrance; owns the five steps and the owner-reserved routing this rule reuses instead of restating. Separate file only because that one sits four lines under the 200-line cap.
+- [`self-repair-loop`](self-repair-loop.md) — the single-occurrence intake; this rule is what its `occurrences` counter is for.
+- [`active-remediation`](active-remediation.md) — the terminal "leave it" this rule does not override (see `collision_ok`).
+- [`/analyze:inbox`](../domains/analysis-workbench/analyze/inbox/command.md) § Phase 4c — the artifact-side detection that routes here.

package/dist/agent-src/rules/roadmap-progress-sync.md

@@ -29,7 +29,7 @@ ANY ROADMAP TOUCH → REGENERATE THE DASHBOARD, SAME RESPONSE.
 NO EXCEPTIONS. NO "I'LL DO IT AT THE END". NO BATCHING ACROSS TURNS.
 ```
 
-Roadmap touch = create / rename / delete / move file, add/rename/remove a phase, OR flip any checkbox (`[ ]` ↔ `[x]` ↔ `[~]` ↔ `[-]`). Regen command: `./agent-config roadmap:progress`. Archive (`git mv` → `archive/`) the moment `count_open == 0` — same response.
+Roadmap touch = create / rename / delete / move file, add/rename/remove a phase, OR flip any checkbox (`[ ]` ↔ `[x]` ↔ `[~]` ↔ `[-]`). Regen command: `./agent-config roadmap:progress` — it passes `--archive`, so a roadmap at `count_open == 0` with no deferred item and no open blocker is `git mv`'d to `archive/` by the same run, not reported for someone to do later. `--check` never archives, and the PostToolUse hook never archives (contract + the council's recorded dissent: the `--archive` block in `update_roadmap_progress.ts`).
 
 ## Iron Law 2 — real-time checkbox cadence (autonomous execution)
 

package/dist/agent-src/rules/rule-type-governance.md

@@ -2,8 +2,6 @@
 type: "auto"
 tier: "2a"
 description: "Creating/editing rules, or auditing rule types — decides when a rule should be always vs auto"
-triggers:
-  - path_prefix: "src/rules/"
 routes_to:
   - "guideline:agent-infra/rule-type-governance"
 workspaces: [agent-config-maintainer]

package/dist/agent-src/rules/self-repair-loop.md

@@ -52,6 +52,16 @@ work, not a notification:
    the user's call, per
    [`non-destructive-by-default`](non-destructive-by-default.md).
 
+**When the line says the record has recurred, step 2 changes target.** The store
+keeps one record per fingerprint and increments it, so a repeat does not raise
+`count` — the line now carries the newest record's `occurrences` instead, and
+above 1 it is the only deterministic "this came back" signal in the session. A
+recurrence means the *earlier* fix or dismissal did not hold, so the surface that
+failed is the one that let it be closed prematurely, not only the one that let the
+behaviour happen. Resolve it through
+[`recurring-criticism`](recurring-criticism.md) — which also states the part that
+matters most here: resolve on evidence, never on the repetition count.
+
 ## Correct openly, never silently
 
 Reported by the user → redo the task properly in the same turn, visibly, saying
@@ -84,6 +94,13 @@ The user is criticising the **code**, not the agent's conduct; the fingerprint
 is already an open record (the hook increments it); or a one-off caused by
 information the agent could not have had — note it, do not queue it.
 
+**The already-an-open-record case suppresses a duplicate QUEUE ENTRY, never the
+response.** Read on its own the clause above inverts into "it came back, so do
+nothing new", which is the opposite of what a repeat means. The counter exists
+precisely so a recurrence is visible without a second entry: no new record, and a
+**stronger** obligation — [`recurring-criticism`](recurring-criticism.md) fires,
+because the earlier disposition demonstrably did not hold.
+
 ## Enforcement
 
 The hook is `fail_closed: false` and always exits 0: it records, it never

package/dist/agent-src/rules/skill-quality.md

@@ -2,8 +2,6 @@
 type: "auto"
 tier: "mechanical-already"
 description: "Creating/editing/reviewing skills — minimum quality standard; every skill executable, validated, self-contained"
-triggers:
-  - path_prefix: "src/skills/"
 routes_to:
   - "guideline:agent-infra/skill-quality-checklist"
 workspaces: [agent-config-maintainer]