@event4u/agent-config 14.6.0 → 14.7.0

package/src/scripts/check_single_delivery.ts

@@ -29,13 +29,36 @@
  *      correctness fact rather than a token fact, and it needs a different
  *      remedy, so it is never folded into the overlap number.
  *
- * REPORT BY DEFAULT, ENFORCE ON REQUEST — and that is not timidity. The
- * invariant is not true yet: `road-to-single-delivery` Phase 2, which makes the
- * producers write disjoint layers, is HALTED on blocker
- * `partition-requires-global-layer`. A blocking default would therefore red every
- * run on a defect nobody can currently fix, which teaches readers to ignore it —
- * the exact failure this estate has recorded twice already. Pass `--enforce` once
- * Phase 2 lands.
+ * REPORT BY DEFAULT, ENFORCE ON REQUEST — and that is not timidity. A blocking
+ * default would red every run on a defect a given machine may not be able to
+ * fix, which teaches readers to ignore it — the exact failure this estate has
+ * recorded twice already.
+ *
+ * The reason used to be that `road-to-single-delivery` Phase 2 was HALTED on
+ * blocker `partition-current-layer-undecidable`. That is no longer true and the
+ * sentence is corrected rather than left standing: the blocker reads
+ * `**Status:** resolved`, its roadmap is archived, and the partition shipped
+ * under ADR-236 Phase 2. What replaced the halt is a per-machine activation —
+ * the partition withholds artefacts only where the host layer is verified
+ * against `installed.lock`, so a machine whose install predates the fingerprint
+ * keeps the full projection BY DESIGN and the overlap this gate reports there is
+ * the fail-safe working, not a regression.
+ *
+ * WHERE THIS CHECK IS MEANINGFUL — read this before quoting one of its numbers
+ * (road-to-session-closeout 3.3). It is a DEVELOPER-MACHINE check. It reads two
+ * host layers off the filesystem, and in CI both are absent: a fresh checkout
+ * carries no `<project>/.claude/**` (zero tracked files under `.claude/`) and no
+ * `~/.claude/**` because no CI leg installs at user scope. So in CI this gate
+ * finds zero layers and has nothing to compare — which is reported as `absent`
+ * rather than as a pass, per the paragraph below, but is still not a statement
+ * about any developer's machine.
+ *
+ * How large that gap is, measured on ONE tree in ONE session on 2026-08-20:
+ * `check_standing_rule_delivery` read the same repository twice and reported
+ * 115 781 tok with one layer installed and 209 767 tok with two — a 1.8x
+ * difference produced entirely by which layers existed where. Any figure from
+ * this gate or that one describes the machine it ran on. Cite it with the layer
+ * counts attached, never as a repository property.
  *
  * A LAYER THAT DOES NOT EXIST IS NOT A PASS. Where a layer is absent there is no
  * overlap to find, and saying "invariant holds" would be a gate reading nothing
@@ -51,6 +74,17 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import { reportScanned } from './_lib/scan_scope.js';
 
+// ledger-exempt: this gate has no skip semantics to account for. `_lib/gate_ledger`
+// exists so a gate that PASSES OVER targets says which and why; here the target set
+// is four fixed artefact types, every one of them appears in the output, and a type
+// whose layer is missing is printed as `absent` rather than quietly dropped — see
+// the `absent` field and the `types_compared=N of 4` ledger line, which together
+// already carry what a per-target ledger would. Adding one would restate the render
+// in a second format, and the gate's own docstring warns that the degenerate pass
+// here is a marker with no argument behind it. If a future version gains a real skip
+// path — a type it declines to compare for a reason — this exemption is void and the
+// ledger is the right answer.
+
 const _HERE = fileURLToPath(import.meta.url);
 const REPO_ROOT = path.resolve(path.dirname(_HERE), '..', '..');
 
@@ -336,6 +370,7 @@ export function main(argv?: readonly string[]): number {
     let globalRoot = path.join(os.homedir(), '.claude');
     let projectRoot = path.join(REPO_ROOT, '.claude');
     let enforce = false;
+    let quiet = false;
 
     const value = (i: number): string | null => {
         const v = args[i + 1];
@@ -354,13 +389,20 @@ export function main(argv?: readonly string[]): number {
             i += 1;
         } else if (a === '--enforce') {
             enforce = true;
+        } else if (a === '--quiet') {
+            // R2 finding: the full per-type table is ~30 lines, and preflight is a
+            // `silent: true` task. A gate that floods a quiet chain is a gate people
+            // learn to scroll past, which is the same end state as an unbound one.
+            quiet = true;
         } else if (a === '--help' || a === '-h') {
             process.stdout.write(
-                'usage: check_single_delivery [--global DIR] [--project DIR] [--enforce]\n' +
+                'usage: check_single_delivery [--global DIR] [--project DIR] [--enforce] [--quiet]\n' +
                     '\n' +
-                    'Reports by default and exits 0: the invariant is not true yet, because\n' +
-                    'road-to-single-delivery Phase 2 is halted on partition-requires-global-layer.\n' +
-                    '--enforce exits 1 on any overlap, and is what to register once Phase 2 lands.\n',
+                    'Reports by default and exits 0: the partition SHIPPED (ADR-236, Phase 2)\n' +
+                    'but activates per machine — only where a verified host layer exists, so a\n' +
+                    'checkout without one keeps the full projection BY DESIGN and reports overlap.\n' +
+                    '--enforce exits 1 on any overlap; registering it would fail every machine\n' +
+                    'that has not re-run `agent-config install`, which is why it stays opt-in.\n',
             );
             return 0;
         } else if (a !== undefined) {
@@ -379,7 +421,7 @@ export function main(argv?: readonly string[]): number {
     }
 
     const v = evaluate(globalRoot, projectRoot);
-    process.stdout.write(`${render(v, globalRoot, projectRoot)}\n`);
+    if (!quiet) process.stdout.write(`${render(v, globalRoot, projectRoot)}\n`);
     // Dead-scope assertion via the shared primitive rather than a hand-rolled
     // `scanned:` line: `check_gate_coverage`'s hardening ratchet accepts an
     // emitted line only from a gate registered in the enforced manifest, and this
@@ -451,9 +493,11 @@ export function main(argv?: readonly string[]): number {
     }
     process.stdout.write(
         `⚠️  check_single_delivery: ${detail}. Reported, not enforced — ` +
-            'road-to-single-delivery Phase 2 is halted on `partition-requires-global-layer`, ' +
-            'so this is a known-open defect rather than a regression. Re-run with --enforce ' +
-            'once the partition ships.\n',
+            'the partition shipped (ADR-236 Phase 2) but activates per machine: it withholds ' +
+            'artefacts only where the host layer is verified against `installed.lock`, so a ' +
+            'machine whose install predates the fingerprint keeps the full projection BY DESIGN ' +
+            'and this overlap is the fail-safe working. Run `agent-config install` to enable it ' +
+            'here; use --enforce where every machine is known to be verified.\n',
     );
     return 0;
 }

package/src/scripts/ci_settle.ts

@@ -0,0 +1,170 @@
+#!/usr/bin/env tsx
+/**
+ * Wait for a PR's checks to settle, and never report a verdict it did not read.
+ *
+ * WHY THIS EXISTS. Agents write this loop by hand, and the exit condition is
+ * the part that is easy to get wrong. Measured 2026-08-20:
+ *
+ *     until ! gh pr checks 1459 | grep -q "pending"; do sleep 60; done
+ *
+ * The API then failed. Its error text — `error connecting to api.github.com` —
+ * contains no `pending`, so the loop exited, the run reported a settle that had
+ * not happened, and the claim had to be retracted to the user in the next
+ * reply. The bug is not the sleep or the grep: it is that **absence of the word
+ * `pending` was treated as evidence of completion**, and an error is neither
+ * settled nor pending.
+ *
+ * The rule this encodes, and the reason it belongs in one place rather than in
+ * every agent's head: `not settled` and `settled` are different from `could not
+ * read`, and only the first two may end a wait.
+ *
+ * Exit codes: 0 = settled, every check succeeded (or was skipped) ·
+ *             1 = settled, at least one check failed ·
+ *             2 = did not settle within the budget, or the API could not be
+ *                 read — NEVER a verdict, and the reason is printed.
+ *
+ * Usage: ./scripts-run src/scripts/ci_settle <pr> [--timeout-min N] [--interval-sec N]
+ */
+
+import { spawnSync } from 'node:child_process';
+
+/** What one poll told us. `unreadable` is deliberately not a verdict. */
+export type PollState =
+    | { kind: 'unreadable'; reason: string }
+    | { kind: 'pending'; total: number; done: number }
+    | { kind: 'settled'; failing: string[]; total: number };
+
+/** Markers that mean the API did not answer — not that nothing is pending. */
+const _UNREADABLE_MARKERS = [
+    'error connecting to',
+    'could not resolve host',
+    'connection refused',
+    'timeout',
+    'timed out',
+    'bad gateway',
+    'service unavailable',
+    'rate limit',
+    'gh auth login',
+    'not logged into',
+    'HTTP 5',
+];
+
+/**
+ * Classify one `gh pr view --json statusCheckRollup` result.
+ *
+ * Pure, so the failure this file exists to prevent is testable without a
+ * network: feed it an API error and it must answer `unreadable`, never
+ * `settled`.
+ */
+export function classifyPoll(stdout: string, stderr: string, status: number | null): PollState {
+    const combined = `${stdout}\n${stderr}`.toLowerCase();
+    for (const marker of _UNREADABLE_MARKERS) {
+        if (combined.includes(marker.toLowerCase())) {
+            return { kind: 'unreadable', reason: marker };
+        }
+    }
+    if (status !== 0) {
+        return { kind: 'unreadable', reason: `gh exited ${String(status)}` };
+    }
+    let rows: { name?: string; conclusion?: string | null; status?: string | null }[];
+    try {
+        const parsed = JSON.parse(stdout) as { statusCheckRollup?: unknown };
+        const roll = parsed.statusCheckRollup;
+        if (!Array.isArray(roll)) {
+            return { kind: 'unreadable', reason: 'no statusCheckRollup in response' };
+        }
+        rows = roll as typeof rows;
+    } catch {
+        return { kind: 'unreadable', reason: 'unparseable JSON' };
+    }
+    if (rows.length === 0) {
+        // Zero checks is not "settled green" — a run that has not registered
+        // its checks yet looks exactly like this.
+        return { kind: 'pending', total: 0, done: 0 };
+    }
+    const terminal = (r: (typeof rows)[number]): boolean =>
+        typeof r.conclusion === 'string' && r.conclusion.length > 0;
+    const done = rows.filter(terminal).length;
+    if (done < rows.length) {
+        return { kind: 'pending', total: rows.length, done };
+    }
+    const bad = new Set(['FAILURE', 'TIMED_OUT', 'CANCELLED', 'ACTION_REQUIRED', 'STARTUP_FAILURE']);
+    const failing = rows
+        .filter((r) => bad.has(String(r.conclusion).toUpperCase()))
+        .map((r) => String(r.name ?? '?'));
+    return { kind: 'settled', failing, total: rows.length };
+}
+
+function poll(pr: string): PollState {
+    const r = spawnSync('gh', ['pr', 'view', pr, '--json', 'statusCheckRollup'], {
+        encoding: 'utf-8',
+        timeout: 60_000,
+    });
+    return classifyPoll(r.stdout ?? '', r.stderr ?? '', r.status);
+}
+
+function sleepSync(seconds: number): void {
+    // Deliberately synchronous: this is a CLI whose whole job is to block.
+    spawnSync(process.execPath, ['-e', `setTimeout(()=>{}, ${String(seconds * 1000)})`], {
+        timeout: (seconds + 5) * 1000,
+    });
+}
+
+export function main(argv: readonly string[]): number {
+    const positional = argv.filter((a) => !a.startsWith('--'));
+    const pr = positional[0];
+    if (pr === undefined) {
+        process.stderr.write('usage: ci_settle <pr> [--timeout-min N] [--interval-sec N]\n');
+        return 2;
+    }
+    const num = (flag: string, dflt: number): number => {
+        const i = argv.indexOf(flag);
+        if (i === -1) return dflt;
+        const v = argv[i + 1];
+        const n = v === undefined ? NaN : parseInt(v, 10);
+        return Number.isFinite(n) && n > 0 ? n : dflt;
+    };
+    const timeoutMin = num('--timeout-min', 45);
+    const intervalSec = num('--interval-sec', 60);
+
+    const deadline = Date.now() + timeoutMin * 60_000;
+    let unreadableStreak = 0;
+
+    for (;;) {
+        const state = poll(pr);
+        if (state.kind === 'settled') {
+            if (state.failing.length === 0) {
+                process.stdout.write(`ci_settle: SETTLED GREEN — ${String(state.total)} check(s)\n`);
+                return 0;
+            }
+            process.stdout.write(
+                `ci_settle: SETTLED RED — ${String(state.failing.length)} of ${String(state.total)} failing:\n` +
+                    state.failing.map((f) => `  ${f}\n`).join(''),
+            );
+            return 1;
+        }
+        if (state.kind === 'unreadable') {
+            unreadableStreak += 1;
+            process.stdout.write(
+                `ci_settle: could not read the API (${state.reason}) — NOT a verdict, still waiting ` +
+                    `[${String(unreadableStreak)}]\n`,
+            );
+        } else {
+            unreadableStreak = 0;
+            process.stdout.write(
+                `ci_settle: pending — ${String(state.done)}/${String(state.total)} settled\n`,
+            );
+        }
+        if (Date.now() >= deadline) {
+            process.stdout.write(
+                `ci_settle: DID NOT SETTLE within ${String(timeoutMin)} min — no verdict is claimed.\n`,
+            );
+            return 2;
+        }
+        sleepSync(intervalSec);
+    }
+}
+
+if (process.argv[1] !== undefined && process.argv[1].endsWith('ci_settle.ts')) {
+    process.exitCode = main(process.argv.slice(2));
+}

package/src/scripts/condense.ts

@@ -251,7 +251,20 @@ function _stripChars(s: string, chars: string): string {
 // module-level CLI self-invoke into its bundle. Re-exported here because four
 // in-repo consumers import it from `condense.js`.
 export { rule_in_scope } from '../install/ruleInScope.js';
+// Re-exported for in-repo consumers; definitions moved beside emit_host_rules_cli.ts (Phase 5).
+export {
+    CLAUDE_PATHS_PATTERN_BUDGET,
+    _claude_paths_plan,
+    _escape_claude_bracket,
+    _expanded_pattern_count,
+    _has_non_path_trigger,
+    _is_unresolved_placeholder,
+    derive_trigger_globs,
+    type ClaudePathsPlan,
+} from '../install/claudePathsPlan.js';
 import { rule_in_scope } from '../install/ruleInScope.js';
+import { isExclusivelyPackageOnly, partitionActive, setPartitionAnnounce } from '../install/partitionEligibility.js'; // ADR-236
+import { _claude_paths_plan, derive_trigger_globs } from '../install/claudePathsPlan.js';
 
 const _HERE = path.dirname(fileURLToPath(import.meta.url)); // <repo>/src/scripts
 const _DEFAULT_PROJECT_ROOT = path.resolve(_HERE, '..', '..');
@@ -304,6 +317,7 @@ function _deriveState(root: string): ModuleState {
 }
 
 export const MODULE_STATE: ModuleState = _deriveState(_DEFAULT_PROJECT_ROOT);
+setPartitionAnnounce(success); // ADR-236: the mode line must be visible at the default level
 
 /**
  * Test seam — reassign one or more module-state fields, mirroring the pytest
@@ -1118,6 +1132,7 @@ function _scoped_rule_basenames(): string[] {
         // is its fourth consumer, after the router compiler, the dist writer, and
         // check_sync. Same predicate in all four; that is the point.
         .filter((p) => !skip_compile_disabled_rule(`rules/${path.basename(p)}`))
+        .filter((p) => !partitionActive(MODULE_STATE.PROJECT_ROOT) || isExclusivelyPackageOnly(p))
         .map((p) => path.basename(p))
         .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
 }
@@ -1322,32 +1337,6 @@ function _yaml_scalar(value: string): string {
     return JSON.stringify(value);
 }
 
-/**
- * Derive host-native activation globs from a rule's `triggers:` frontmatter
- * (road-to-request-scoped-rule-load Phase 2). `file_pattern` triggers map
- * verbatim; `path_prefix` triggers map to `<prefix>**`. Keyword / phrase /
- * command triggers produce no glob — those rules stay
- * description-activated (Cursor Agent-Requested / Windsurf model_decision).
- */
-export function derive_trigger_globs(meta: Record<string, unknown>): string[] {
-    const triggers = meta['triggers'];
-    if (!Array.isArray(triggers)) {
-        return [];
-    }
-    const globs: string[] = [];
-    for (const t of triggers) {
-        if (t === null || typeof t !== 'object' || Array.isArray(t)) continue;
-        const obj = t as Record<string, unknown>;
-        if (typeof obj['file_pattern'] === 'string' && obj['file_pattern']) {
-            globs.push(obj['file_pattern']);
-        } else if (typeof obj['path_prefix'] === 'string' && obj['path_prefix']) {
-            const prefix = obj['path_prefix'] as string;
-            globs.push(prefix.endsWith('/') ? `${prefix}**` : `${prefix}**`);
-        }
-    }
-    // De-dup, keep declaration order (deterministic output).
-    return [...new Set(globs)];
-}
 
 export function _emit_cursor_mdc(source: string, target: string): void {
     const [meta, body] = _parse_frontmatter(_readText(source));
@@ -1390,151 +1379,8 @@ export function _emit_windsurf_rule(source: string, target: string): void {
     _writeText(target, lines.join('\n'));
 }
 
-/**
- * A brace group the host expands, versus an agent-config placeholder that only
- * LOOKS like one.
- *
- * `path_prefix: "{module_root}/"` in `roadmap-ci-steps-policy` is resolved by
- * this suite from `modules.root_paths`. Emitted verbatim into a host `paths:`
- * list it is a brace group with no comma, which the host expands to the literal
- * string `{module_root}` — a pattern that matches no file. The rule would then
- * reach the model **never** instead of on-demand, and nothing would say so: the
- * probed contract records this exact degradation as silent
- * (`claude-code-rules-dir-contract.md` § constraints).
- *
- * Dropping the pattern is fail-safe in the one direction that matters. A rule
- * left with no pattern at all carries no `paths:` key and loads
- * unconditionally — the status quo, not a regression. A rule carrying a
- * no-op pattern is invisible.
- *
- * The discriminator is the comma, not a placeholder allowlist: `{ts,tsx}` is a
- * real alternation, `{module_root}` cannot be one.
- */
-export function _is_unresolved_placeholder(pattern: string): boolean {
-    for (const m of pattern.matchAll(/\{([^}]*)\}/g)) {
-        if (!(m[1] as string).includes(',')) {
-            return true;
-        }
-    }
-    return false;
-}
-
-/**
- * `[` opens a bracket expression for the host. An unparseable one makes that
- * pattern match nothing while the rule's other patterns keep working — so a
- * literal `[` in a trigger is escaped rather than trusted.
- */
-export function _escape_claude_bracket(pattern: string): string {
-    return pattern.replace(/\[/g, '\\[');
-}
-
-/**
- * Expanded-pattern cost of one glob: the product of its brace alternations.
- * The host budgets a rule's whole `paths:` list at 1,000 expanded patterns and
- * 4 MiB, and a list over budget is used UNEXPANDED — braces then match
- * literally, i.e. nothing. Counting keeps the emitter under the cliff instead
- * of discovering it as a silent no-op.
- */
-export function _expanded_pattern_count(pattern: string): number {
-    let n = 1;
-    for (const m of pattern.matchAll(/\{([^}]*)\}/g)) {
-        n *= (m[1] as string).split(',').length;
-    }
-    return n;
-}
-
-/** Host-documented budget for one rule's whole `paths:` list. */
-export const CLAUDE_PATHS_PATTERN_BUDGET = 1000;
-
-export interface ClaudePathsPlan {
-    /** Patterns to emit under `paths:`, in declaration order. */
-    globs: string[];
-    /** Patterns deliberately not emitted, with the reason a reader can act on. */
-    dropped: { pattern: string; reason: 'unresolved-placeholder' | 'over-budget' | 'mixed-triggers' }[];
-}
 
-/**
- * Does this rule declare any trigger that is NOT path-shaped?
- *
- * Load-bearing for `_claude_paths_plan` below, because one `triggers:` list
- * means two different things on two hosts. Cursor and Windsurf treat globs as
- * ADDITIVE — a rule with empty globs still reaches the agent through its
- * description (see `_emit_cursor_mdc`'s own comment). Claude Code treats
- * `paths:` as EXCLUSIVE: with it the rule loads on a path match; without it the
- * rule loads unconditionally. The emitter fed both semantics from one list, so
- * a rule that declared keywords *and* one path glob silently became
- * path-gated-only on Claude.
- */
-export function _has_non_path_trigger(meta: Record<string, unknown>): boolean {
-    const triggers = meta['triggers'];
-    if (!Array.isArray(triggers)) return false;
-    for (const t of triggers) {
-        if (t === null || typeof t !== 'object' || Array.isArray(t)) continue;
-        const obj = t as Record<string, unknown>;
-        if (typeof obj['keyword'] === 'string' && obj['keyword']) return true;
-        if (typeof obj['phrase'] === 'string' && obj['phrase']) return true;
-    }
-    return false;
-}
 
-/**
- * Derive the host's `paths:` list for one rule, with every drop recorded.
- *
- * Kernel / always-apply rules get an EMPTY list on purpose: absent `paths:` is
- * how this host says "load unconditionally", which is exactly what an Iron-Law
- * rule needs. Scoping one would be a correctness regression dressed as a byte
- * saving — and the same contract notes path-scoped rules are not re-injected
- * after `/compact`, so an obligation that must survive compaction cannot be
- * path-scoped at all.
- */
-export function _claude_paths_plan(meta: Record<string, unknown>): ClaudePathsPlan {
-    const always_apply = Boolean(meta['alwaysApply'] || meta['type'] === 'always');
-    if (always_apply) {
-        return { globs: [], dropped: [] };
-    }
-    const globs: string[] = [];
-    const dropped: ClaudePathsPlan['dropped'] = [];
-
-    // A rule that ALSO declares keyword / phrase triggers gets no `paths:` at
-    // all, and therefore keeps loading unconditionally on Claude Code.
-    //
-    // Emitting `paths:` here would narrow the rule to a path match and discard
-    // every keyword the author wrote, because this host reads the list as the
-    // whole gate rather than as one way in. Measured before this guard: 25 of
-    // 110 projected rules carried `paths:` and 19 of them also carried keyword
-    // triggers — `design-fidelity` lost 21 of them, in exactly the pasted-
-    // screenshot and capability-URL handovers its own routing section names as
-    // the classes it exists to catch. Nothing in the tree recorded a decision
-    // to make that trade, which is why it is treated as a defect.
-    //
-    // The drop is REPORTED rather than silent, so a rule whose obligation
-    // really is path-bound is visible as a candidate for removing its keyword
-    // triggers — the narrowing then becomes an authoring decision instead of an
-    // emitter side effect. Cursor and Windsurf are untouched: globs are
-    // additive there, so the same rule keeps both routes.
-    if (_has_non_path_trigger(meta)) {
-        for (const raw of derive_trigger_globs(meta)) {
-            dropped.push({ pattern: raw, reason: 'mixed-triggers' });
-        }
-        return { globs, dropped };
-    }
-
-    let spent = 0;
-    for (const raw of derive_trigger_globs(meta)) {
-        if (_is_unresolved_placeholder(raw)) {
-            dropped.push({ pattern: raw, reason: 'unresolved-placeholder' });
-            continue;
-        }
-        const cost = _expanded_pattern_count(raw);
-        if (spent + cost > CLAUDE_PATHS_PATTERN_BUDGET) {
-            dropped.push({ pattern: raw, reason: 'over-budget' });
-            continue;
-        }
-        spent += cost;
-        globs.push(_escape_claude_bracket(raw));
-    }
-    return { globs, dropped };
-}
 
 /**
  * Emit a Claude Code rule carrying the host's OWN activation key.
@@ -1823,6 +1669,7 @@ function _render_native_model_md(src_md: string, tier: string): string {
 }
 
 export function generate_claude_skills(active_skill_names: ReadonlySet<string> | null = null): number {
+    if (partitionActive(MODULE_STATE.PROJECT_ROOT)) active_skill_names = new Set<string>();
     if (!_exists(MODULE_STATE.SKILLS_SOURCE)) {
         process.stderr.write('  ⚠️  dist/agent-src/skills/ not found — skipping skills\n');
         return 0;
@@ -1836,7 +1683,9 @@ export function generate_claude_skills(active_skill_names: ReadonlySet<string> |
         skills = skills.filter((s) => active_skill_names.has(s));
     }
     const skill_set = new Set(skills);
-    const command_slugs = new Set([...iterCommands()].map(([, slug]) => slug));
+    const command_slugs = partitionActive(MODULE_STATE.PROJECT_ROOT)
+        ? new Set<string>()
+        : new Set([...iterCommands()].map(([, slug]) => slug));
 
     _mkdirp(MODULE_STATE.CLAUDE_SKILLS_DIR);
     const auto = _read_model_auto_switch() === 'auto';
@@ -1997,6 +1846,7 @@ export function generate_claude_project_commands(
 }
 
 export function generate_claude_commands(active_command_slugs: ReadonlySet<string> | null = null): number {
+    if (partitionActive(MODULE_STATE.PROJECT_ROOT)) active_command_slugs = new Set<string>();
     if (!_isDir(path.join(MODULE_STATE.PROJECT_ROOT, 'src', 'domains'))) {
         process.stderr.write('  ⚠️  src/domains/ not found — skipping commands\n');
         return 0;

package/src/scripts/council_cli.ts

@@ -63,6 +63,7 @@ import {
     plan_advisor_swap,
 } from './ai_council/advisors.js';
 import { format_install_hints } from './ai_council/cli_hints.js';
+import { renderSubHelp } from './ai_council/cli_help.js';
 import {
     type AdvisorConfig,
     type CouncilConfig,
@@ -2507,6 +2508,7 @@ function cmd_run(
     const [extra_calls, extra_usd] = _consensus_cost_delta(ai_cfg, question.mode, estimates, billable.length);
     const [ch_calls, ch_usd] = _chairman_cost_delta(ai_cfg, estimates);
     const [pr_extra_calls, pr_extra_usd] = _peer_review_cost_delta(ai_cfg, args, estimates, billable.length);
+    if (!args.confirm) _stdout('council:run · DRY PASS — estimate only, no seat is contacted. Add --confirm to run.\n');
     _stdout(
         `council:run · mode=${question.mode} · members=${members.length} ` +
             `(billable=${billable.length})\n`,
@@ -3728,10 +3730,8 @@ function _parseArgs(argv: string[]): Args {
     const rest = argv.slice(1);
     const usage = _usageFor(first);
     const { positionals, opts, requiredOpts } = _specsFor(first);
-
-    // Sub-help.
     if (rest.includes('-h') || rest.includes('--help')) {
-        _stdout(usage);
+        _stdout(renderSubHelp(first, usage, { positionals, opts, requiredOpts }));
         process.exitCode = 0;
         throw new _ArgExit();
     }

package/src/scripts/dispatch_r2_reviewer.ts

@@ -51,6 +51,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 // (validator → dispatcher for the scope hash, dispatcher → validator for
 // relevance) is safe: neither module calls the other at module-evaluation
 // time, and each CLI entry guard only fires for its own argv[1].
+import { isAcceptanceCriteriaHeading } from './_lib/ac_heading.js';
 import { gitEnv } from './_lib/git_env.js';
 import { completionReviewDisabled } from './_lib/planning_settings.js';
 import { artifactRelevance } from './check_completion_review.js';
@@ -492,20 +493,11 @@ export function extractAcceptanceCriteria(roadmapText: string): string {
     const lines = roadmapText.split('\n');
     let start = -1;
     for (let i = 0; i < lines.length; i++) {
-        // Case-insensitive, and NOT anchored at the end of the line.
-        //
-        // Case first: the tree carries both `## Acceptance Criteria` and
-        // `## Acceptance criteria`; a case-sensitive match silently extracted
-        // nothing for the latter (found by the zcs-close R2 review, 2026-08-09).
-        //
-        // The end-anchor was the same defect wearing a different mask, and it was
-        // LIVE: `\s*$` rejected a heading carrying a qualifier, so
-        // `## Acceptance criteria (per phase, on promotion to ready)` and
-        // `## Acceptance criteria (anti-dump — the review-s own rule)` extracted
-        // nothing. Two roadmaps, measured 2026-08-18 — and they had been counted
-        // as "declares no criteria" by the very census that motivated this fix,
-        // which is how a matcher tuned to its own measurement hides its misses.
-        if (/^##\s+acceptance criteria\b/i.test(lines[i] as string)) {
+        // Case-insensitive and NOT end-anchored — both of those were live misses
+        // here (case: zcs-close R2 review 2026-08-09; the `(per phase, …)` qualifier:
+        // measured 2026-08-18). The predicate now lives in `_lib/ac_heading`, which
+        // records all three instances of the defect and why it is shared.
+        if (isAcceptanceCriteriaHeading(lines[i] as string)) {
             start = i;
             break;
         }