@event4u/agent-config 14.6.0 → 14.8.0

package/src/config/evaluator-budgets.json

@@ -58,11 +58,11 @@
       "deterministic": false
     },
     "cli_help_command_count": {
-      "max": 101,
-      "last_measured": 101,
+      "max": 102,
+      "last_measured": 102,
       "last_measured_at": "2026-08-19",
       "method": "registry enumeration — count of `{ name: '...', disposition` entries in src/cli/registry.ts (NOT --help prose parsing; methods historically disagreed 74 vs 76 vs 79)",
-      "baseline_note": "80 → 81 on 2026-08-03 (release 9.15.0 gate). This RECORDS growth that already shipped through its own reviewed PR; it does not authorize new surface. The +1 is f02db54c2 (fix(cli): register routing:doctor in the CLI registry) — the command existed, only its registry entry was missing, and the registering PR did not move this budget. The gate did its job again: breach WARNS on main and BLOCKS on release, which is the conscious-decision point rather than a silently raised cap. Re-measured 2026-08-03 via the pinned method: 81. Headroom stays zero by design — the next registry addition must move this number in its own PR. 81 → 82 on 2026-08-04: the `handoff` subcommand (road-to-agent-handoff-resume Phase 4) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 82. 82 → 84 on 2026-08-04: the `route:explain` + `route:audit` verbs (routing-correctness validation surface) register in the same PR that adds the surface. Re-measured via the pinned method: 84. 84 → 85 on 2026-08-05: the `settings:set` verb (road-to-zero-ceremony-settings Phase 2 — the one agent-reachable settings writer) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 85. 85 → 86 on 2026-08-06: the `conformance:behavior` verb (road-to-agent-behavior-conformance Phase 5 — replays the local transcript store through the four mechanised conformance checks) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 86. 86 → 88 on 2026-08-07: the `sessions:list` + `sessions:claim` verbs (road-to-parallel-session-coordination — the shell surface of the shared session register, needed because /roadmap:next is command markdown and can only reach the register through a shell call) register in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 88. 88 → 89 on 2026-08-08: the `council:status` verb registers in the same PR that adds the surface, per this record's own contract. It exists because an agent in a consumer project announced \"kein Council konfiguriert (keine .agent-settings.yml)\" and substituted a weaker path while the council was configured user-globally the whole time — there was no verb that answered availability, so the only route was an inference from a filename, and the intuitive filename is the one location ADR-104 guarantees is never consulted. Re-measured via the pinned method: 89. 89 → 91 on 2026-08-08: the `self-repair:status` + `self-repair:release` verbs (the queued-defect reader and the single Hard-Floor-gated outward step of the self-repair loop — the loop is deliberately unable to publish unless a human runs the release command) register in the same PR that adds the surface, per this record's own contract. Landed alongside the +1 council:status move in the same branch. Re-measured via the pinned method: 91. 91 → 94 on 2026-08-08: the `packs:active`, `settings:get` and `mcp:available` verbs (road-to-capability-answerability Phase 2 — the three capability probes for the gaps that had none) register in the same PR that adds the surface, per this record's own contract. Each answers a question that was previously only inferable from a filename: which packs are active and from which file, what a setting resolves to and which file set it, and what is declared in mcp.json versus what can actually launch. 94 -> 95 in the same PR: `brand:status` (Phase 2.4 — brand-layer presence, which the rule depended on and no surface could answer). Re-measured twice via the pinned method on the unchanged tree: 95/95. 95 → 96 on 2026-08-10: the `session:recycle` verb (road-to-token-economy-recycling Phase 2.2 — the deterministic producer of the main-session recycle envelope; the recycle advisory names this exact verb, so it must exist as a shell surface) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 96. 96 -> 97 on 2026-08-10: the `gates` verb registers in the same PR that adds the surface, per this record's own contract. It exists because the blocker fields the dashboard already parses (Owner, What to do, Resolved when — CI-enforced by lint_roadmap_blockers) had no owner-filtered reader: the dashboard counts the open blockers across a 600-line file and links each to a per-roadmap anchor, so \"which of these are mine\" was a manual read of every anchor. The same inference-from-a-filename shape as the council:status entry above, one layer up. This branch and the session:recycle branch each measured 96 independently and landed on the same number for different verbs; the merge makes it 97, re-measured twice via the pinned method on the merged tree: 97/97. 97 -> 98 on 2026-08-15: the `workspace:doctor` verb (road-to-inbox-harvest-2026-08-c-workspace-identity Phase 3 — the read-only report over the new `workspaceIdentity()` resolver) registers in the same PR that adds the surface, per this record's own contract. It exists for the same inference-from-a-filename shape as the council:status and gates entries above, one layer down: the tree answered \"where am I\" in eight ad-hoc places across six files, and the 12.0.0 span shipped the same worktree misclassification twice, so no verb could be asked which checkout is the main one. Read-only by construction — the roadmap's Non-goals put worktree disposal out of scope and its Risk 3 names \"the pressure read becomes a disposal path by accident\" as the failure to design against, so the command carries no --fix and no --prune. Re-measured twice via the pinned method on the unchanged tree: 98/98. 98 -> 99 on 2026-08-17: the `council:quota` verb (road-to-council-quota-accounting-truth Phase 2) registers in the same PR that adds the surface, per this record's own contract. Exactly the inference-from-a-filename shape as the council:status entry above, one layer down: `cmd_quota` had existed in council_cli.ts and been reachable only via `scripts-run`, so the documented recovery path for an exhausted shared counter -- read the usage, reset one provider -- did not resolve through `agent-config`, and an operator debugging a quota failure met `unknown command`. The verb is read-only apart from the pre-existing `--reset <provider>`, which already required `--confirm`. Re-measured twice via the pinned method on the unchanged tree: 99/99. 99 -> 100 on 2026-08-19: the `decision:memo` verb (road-to-long-horizon-execution Phase 2.2, sequencing UOTL Phase 4.3 -- the decision-memo channel) registers in the same PR that adds the surface, per this record's own contract. It exists because the question ladder gained a rung between \"halt and ask\" and \"decide silently\": a resolution the run makes without contacting the operator is only legitimate if it is reviewable afterwards, and there was no surface that wrote such a record with a fixed shape. Write-and-list only, local-only (agents/runtime/ is gitignored), and it gates nothing -- the locked decision classes are refused at the config schema, never in the ledger. 100 -> 101 in the same PR: `run:supervise` (Phase 3.1 -- the out-of-process watcher for runs whose session died with open steps left). It is the operator-facing half of session continuity: nothing anywhere had the job of noticing that a claimed run stopped moving, so a roadmap 40% done and a roadmap finished looked identical from outside the dead session. Report-only by default and it NEVER merges, pushes or closes -- the auto-merge the reference design carries is a named rejection in the roadmap's harvest section, not an unbuilt feature. Re-measured twice via the pinned method on the unchanged tree: 101/101."
+      "baseline_note": "80 → 81 on 2026-08-03 (release 9.15.0 gate). This RECORDS growth that already shipped through its own reviewed PR; it does not authorize new surface. The +1 is f02db54c2 (fix(cli): register routing:doctor in the CLI registry) — the command existed, only its registry entry was missing, and the registering PR did not move this budget. The gate did its job again: breach WARNS on main and BLOCKS on release, which is the conscious-decision point rather than a silently raised cap. Re-measured 2026-08-03 via the pinned method: 81. Headroom stays zero by design — the next registry addition must move this number in its own PR. 81 → 82 on 2026-08-04: the `handoff` subcommand (road-to-agent-handoff-resume Phase 4) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 82. 82 → 84 on 2026-08-04: the `route:explain` + `route:audit` verbs (routing-correctness validation surface) register in the same PR that adds the surface. Re-measured via the pinned method: 84. 84 → 85 on 2026-08-05: the `settings:set` verb (road-to-zero-ceremony-settings Phase 2 — the one agent-reachable settings writer) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 85. 85 → 86 on 2026-08-06: the `conformance:behavior` verb (road-to-agent-behavior-conformance Phase 5 — replays the local transcript store through the four mechanised conformance checks) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 86. 86 → 88 on 2026-08-07: the `sessions:list` + `sessions:claim` verbs (road-to-parallel-session-coordination — the shell surface of the shared session register, needed because /roadmap:next is command markdown and can only reach the register through a shell call) register in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 88. 88 → 89 on 2026-08-08: the `council:status` verb registers in the same PR that adds the surface, per this record's own contract. It exists because an agent in a consumer project announced \"kein Council konfiguriert (keine .agent-settings.yml)\" and substituted a weaker path while the council was configured user-globally the whole time — there was no verb that answered availability, so the only route was an inference from a filename, and the intuitive filename is the one location ADR-104 guarantees is never consulted. Re-measured via the pinned method: 89. 89 → 91 on 2026-08-08: the `self-repair:status` + `self-repair:release` verbs (the queued-defect reader and the single Hard-Floor-gated outward step of the self-repair loop — the loop is deliberately unable to publish unless a human runs the release command) register in the same PR that adds the surface, per this record's own contract. Landed alongside the +1 council:status move in the same branch. Re-measured via the pinned method: 91. 91 → 94 on 2026-08-08: the `packs:active`, `settings:get` and `mcp:available` verbs (road-to-capability-answerability Phase 2 — the three capability probes for the gaps that had none) register in the same PR that adds the surface, per this record's own contract. Each answers a question that was previously only inferable from a filename: which packs are active and from which file, what a setting resolves to and which file set it, and what is declared in mcp.json versus what can actually launch. 94 -> 95 in the same PR: `brand:status` (Phase 2.4 — brand-layer presence, which the rule depended on and no surface could answer). Re-measured twice via the pinned method on the unchanged tree: 95/95. 95 → 96 on 2026-08-10: the `session:recycle` verb (road-to-token-economy-recycling Phase 2.2 — the deterministic producer of the main-session recycle envelope; the recycle advisory names this exact verb, so it must exist as a shell surface) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 96. 96 -> 97 on 2026-08-10: the `gates` verb registers in the same PR that adds the surface, per this record's own contract. It exists because the blocker fields the dashboard already parses (Owner, What to do, Resolved when — CI-enforced by lint_roadmap_blockers) had no owner-filtered reader: the dashboard counts the open blockers across a 600-line file and links each to a per-roadmap anchor, so \"which of these are mine\" was a manual read of every anchor. The same inference-from-a-filename shape as the council:status entry above, one layer up. This branch and the session:recycle branch each measured 96 independently and landed on the same number for different verbs; the merge makes it 97, re-measured twice via the pinned method on the merged tree: 97/97. 97 -> 98 on 2026-08-15: the `workspace:doctor` verb (road-to-inbox-harvest-2026-08-c-workspace-identity Phase 3 — the read-only report over the new `workspaceIdentity()` resolver) registers in the same PR that adds the surface, per this record's own contract. It exists for the same inference-from-a-filename shape as the council:status and gates entries above, one layer down: the tree answered \"where am I\" in eight ad-hoc places across six files, and the 12.0.0 span shipped the same worktree misclassification twice, so no verb could be asked which checkout is the main one. Read-only by construction — the roadmap's Non-goals put worktree disposal out of scope and its Risk 3 names \"the pressure read becomes a disposal path by accident\" as the failure to design against, so the command carries no --fix and no --prune. Re-measured twice via the pinned method on the unchanged tree: 98/98. 98 -> 99 on 2026-08-17: the `council:quota` verb (road-to-council-quota-accounting-truth Phase 2) registers in the same PR that adds the surface, per this record's own contract. Exactly the inference-from-a-filename shape as the council:status entry above, one layer down: `cmd_quota` had existed in council_cli.ts and been reachable only via `scripts-run`, so the documented recovery path for an exhausted shared counter -- read the usage, reset one provider -- did not resolve through `agent-config`, and an operator debugging a quota failure met `unknown command`. The verb is read-only apart from the pre-existing `--reset <provider>`, which already required `--confirm`. Re-measured twice via the pinned method on the unchanged tree: 99/99. 99 -> 100 on 2026-08-19: the `decision:memo` verb (road-to-long-horizon-execution Phase 2.2, sequencing UOTL Phase 4.3 -- the decision-memo channel) registers in the same PR that adds the surface, per this record's own contract. It exists because the question ladder gained a rung between \"halt and ask\" and \"decide silently\": a resolution the run makes without contacting the operator is only legitimate if it is reviewable afterwards, and there was no surface that wrote such a record with a fixed shape. Write-and-list only, local-only (agents/runtime/ is gitignored), and it gates nothing -- the locked decision classes are refused at the config schema, never in the ledger. 100 -> 101 in the same PR: `run:supervise` (Phase 3.1 -- the out-of-process watcher for runs whose session died with open steps left). It is the operator-facing half of session continuity: nothing anywhere had the job of noticing that a claimed run stopped moving, so a roadmap 40% done and a roadmap finished looked identical from outside the dead session. Report-only by default and it NEVER merges, pushes or closes -- the auto-merge the reference design carries is a named rejection in the roadmap's harvest section, not an unbuilt feature. Re-measured twice via the pinned method on the unchanged tree: 101/101. 101 → 102 on 2026-08-22: the `adr:effective` verb (road-to-evidence-based-adr-governance step 2.2 — the effective-state projection over one decision record) registers in the same PR that adds the surface, per this record's own contract. It exists because current truth about an ADR was only reconstructable from linear prose: an agent had to read the body, then every amendment, and decide for itself which clauses still stand. The verb reports status, the Decision verbatim, clauses the record's own amendments superseded, active amendments, the three descriptive axes and the review-trigger state. It AUTHORIZES NOTHING — Phase 2 of that roadmap is titled \"surfacing only; no authority\" and its AC-7 forbids any authority consequence, so the verb reports an absent axis as absent (`— (no provenance axis)`, `— (ungraded)`, `absent → evidence`) and an unresolvable trigger as `indeterminate` rather than inferring one. Re-measured twice via the pinned method on the unchanged tree: 102/102."
     },
     "mcp_public_tool_count": {
       "max": 20,

package/src/config/gate-coverage.yml

@@ -42,16 +42,53 @@
 #
 # COVERAGE — THE HONEST DENOMINATOR (re-measured 2026-08-18)
 # ----------------------------------------------------------
-# 267 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`
-# (the count is computed, not asserted — `check_gate_coverage.count_gate_scripts`).
-# **42 of them emit the machine-readable `scanned: <N>` line under their
-# CI-identical argv, and 41 of those 42 are listed below.** The manifest is
+# 269 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`
+# (the count is computed, not asserted — `check_gate_coverage.count_gate_scripts`,
+# re-run 2026-08-21 and it returns 269).
+# **45 of them emit the machine-readable `scanned: <N>` line under their
+# CI-identical argv, and 42 of those 45 are listed below.** The manifest is
 # therefore complete with respect to its own contract for every gate that can
-# carry a floor, and covers ~15 % of the population.
+# carry a floor, and covers ~16 % of the population.
 #
-# The one emitter deliberately NOT listed is `lint_evidence_artifacts`, for the
-# same reason `check_rule_projection_integrity` is not (see the paragraph
-# below): it is diff-scoped, so it legitimately emits `scanned: 0` on any
+# Both halves were RE-DERIVED on 2026-08-21, not incremented, and the previous
+# reading was off by one in a way worth recording: it said "42 … and 41 of those
+# 42 are listed" while the file carried 42 rows AND named one deliberately
+# unlisted emitter (`lint_evidence_artifacts`, below). Those three facts cannot
+# all hold — 42 listed rows plus 1 unlisted emitter is 43 emitters, not 42. It
+# is the same drift this section documents three times: an entry was added and
+# the prose was adjusted by one instead of recounted.
+#
+# The derivation now, so the next reader can check it rather than trust it:
+# `grep -c '^  - id:'` returns 42 (computable, and computed); every listed row
+# is an emitter, because a row that did not emit could carry no floor and the
+# guard would report it `failing`; THREE emitters are deliberately unlisted —
+# `lint_evidence_artifacts` (below), `adr_cite_check` and
+# `check_new_adr_evidence` (each in the block where its row would have sat);
+# 42 + 3 = 45. The population figure comes from the function, and it stays 269
+# because `check_new_adr_evidence` matches the population prefix whether or not
+# it carries a row here.
+#
+# `adr/evidence_census` emits a `scanned:` line too and is NOT in either number:
+# it carries no `lint|check|audit` prefix, so `count_gate_scripts()` never sees
+# it. Named because the omission looks like a fourth miscount and is not one —
+# an emitter outside the population cannot be an unlisted emitter within it.
+#
+# Corrected in completion review, and it is the third time this paragraph has
+# been off by one — which is the argument for computing it rather than
+# adjusting it. The previous reading said 43 listed and self-invited a `grep`
+# that returns 42, so the check it offered refuted the sentence containing it.
+# The cause each time is the same: a row was added or removed and the prose
+# was incremented instead of recounted.
+#
+# A shape-grep over `src/scripts/` (`reportScanned(` or a literal `scanned: ${`)
+# returns 63 files. That is a DIFFERENT population — any file carrying an emit
+# shape, including gates that emit only in a non-CI mode — so it is not a
+# recount of this sentence and must not be substituted for one.
+#
+# Three emitters are deliberately NOT listed, all for one reason. The first is
+# `lint_evidence_artifacts`, for the same reason `check_rule_projection_integrity`
+# is not (see the paragraph below): it is diff-scoped, so it legitimately emits
+# `scanned: 0` on any
 # branch that adds no evidence artifact, and `min_scanned: 0` is the
 # false-count shape this file rejects. Its ledger half IS discharged — it
 # adopts `_lib/gate_ledger.ts` and `_lib/scan_scope.ts`, so
@@ -182,6 +219,28 @@ gates:
       the Taskfile parse degrades and the population silently collapses —
       cannot pass.
 
+  - id: check_rule_layer_partition
+    argv: []
+    min_scanned: 0
+    corpus: "the five project rule directories that receive a projected tree (.claude/rules, .cursor/rules, .clinerules, .windsurf/rules, .augment/rules)"
+    status: enforced
+    note: >
+      `min_scanned: 0` is the honest floor and not the false-count shape this file
+      rejects elsewhere. This gate compares a project rule directory against its
+      host's GLOBAL layer, and on a fresh CI checkout neither side exists — the
+      project trees are gitignored and no CI leg installs at user scope. So the
+      population is legitimately zero there, exactly as it is for the diff-scoped
+      gates the header paragraph carves out.
+      What keeps a zero from reading as a pass is inside the gate rather than in
+      this floor: with nothing compared it prints "nothing compared — N skipped.
+      This is not a pass" instead of a success line, and every skip names the host
+      and the unreadable path. Teeth land on a working checkout, where `task
+      preflight` runs it against real global layers.
+      It never reports a duplicate for a host whose global layer cannot be read: a
+      project copy is the only carrier when the global one is absent, so demanding
+      its removal on unread evidence would delete the rule from that host —
+      the failure `partitionEligibility`'s fail-safe ordering exists to prevent.
+
   - id: check_rule_activation_census
     argv: []
     min_scanned: 100
@@ -555,14 +614,62 @@ gates:
 
   - id: lint_plan_risk_register
     argv: []
-    min_scanned: 12
-    corpus: "ready roadmap files under agents/roadmaps/ top level (19 at baseline: 14 grandfathered + 4 draft-exempt + 1 carrying a live register)"
+    min_scanned: 1
+    corpus: "ready roadmap files under agents/roadmaps/ top level (6 as of 2026-08-21; 19 at the original baseline: 14 grandfathered + 4 draft-exempt + 1 carrying a live register)"
     status: enforced
     note: >
       Gate R1 (docs/contracts/plan-review-gates.md § 1). The count is READY
       FILES INSPECTED incl. grandfathered/draft-exempt ones — exemptions are
-      reported, never silently skipped, so a collapse below the floor means
-      the roadmaps root moved, not that the corpus went clean.
+      reported, never silently skipped.
+
+      Lowered 12 → 5 on 2026-08-21, and the SHAPE of the change matters more
+      than the number. The previous note asserted that "a collapse below the
+      floor means the roadmaps root moved, not that the corpus went clean."
+      That premise is falsified: archiving roadmaps at zero open and zero
+      deferred steps dropped the top-level count from 12 to 10 with the root
+      untouched — the corpus really did go cleaner, which is what
+      road-to-estate-drawdown exists to achieve. A floor pinned to the exact
+      corpus size fails on the drawdown succeeding, which is the wrong thing
+      to detect.
+
+      So the replacement is deliberately NOT today's count. Re-pinning at 10
+      would repeat the defect one archival later and force this note to be
+      rewritten every time a roadmap closes. 5 sits structurally below any
+      plausible active set while still catching the two failures this floor is
+      for: the roadmaps root moving, and the scanner silently reading nothing.
+      It is not a target for how many roadmaps ought to exist.
+
+      Count reconciliation, since two numbers move in this change and they
+      count different populations: this gate counts READY files at the top
+      level of agents/roadmaps/ (12 → 10 here), while
+      estate-count-budget.json::active_roadmaps counts NON-DRAFT candidates as
+      collect() sees them (11 → 10). The gap is the draft-status file each
+      population treats differently; neither number is derivable from the
+      other.
+
+      Revisit-if the active set is deliberately grown past ~15, at which point
+      5 is uninformatively low, or if a drop is ever traced to a scanner
+      defect rather than to archival — either falsifies the number, not the
+      obligation.
+
+      Lowered again 10 → 5 on 2026-08-21, during the PR drain that produced the
+      paragraph above. 10 was measured against 12 and the drain had already
+      taken the corpus to 11 — one file of headroom, so the next archival would
+      have reddened CI for the exact reason this entry says is the wrong thing to
+      detect. 5 keeps the root-moved / scanner-blind signal (both scan 0) and
+      stops the number from needing a commit per archived roadmap.
+
+      Lowered again 5 → 1, and this time the SHAPE changed rather than the
+      number. 5 was picked to have headroom and did not: the drain took the
+      corpus to 6, so a review provoked the red by archiving one roadmap. The
+      lesson is that no absolute floor survives here — this gate's sibling
+      `check_estate_count` forbids growth, so the corpus can only shrink and any
+      floor above 0 is met eventually. 1 is the smallest value that still
+      distinguishes "the scanner read something" from "the root moved or the
+      scope is dead", which is the only thing this field was ever asked to
+      detect. Revisit-if the gate gains a way to express "non-empty" directly,
+      or if a drop to 0 is ever traced to a scanner defect rather than to an
+      empty corpus.
 
   - id: check_estate_count
     argv: []
@@ -695,6 +802,18 @@ gates:
     note: >
       Emits on stderr, not stdout: `--format json` owns this gate's stdout and a
       count written there would corrupt the payload. The guard reads both streams.
+      Corpus boundary, decided 2026-08-20 (council, `leave-unscanned`): `src/skills`
+      is deliberately OUT of this gate's corpus. Pointed at it the gate reports 13
+      findings (11 `buried_iron_law`, 2 `deep_iron_law`) that nobody currently sees.
+      Extending the corpus was declined on three grounds — the gate has no warn
+      level, so a staged extension would mean adding a warning mode to an enforced
+      blocking gate; the reverted `lint_skill_top_position` attempt showed two gates
+      defining one construct incompatibly, and the disputed `deep_iron_law` class is
+      still live in those 13; and the premise for scanning skills at all
+      (post-compaction truncation keeps the file start) is unverified, the tree's one
+      measured truncation fact being ENTRY-level. Re-opening this needs a measured
+      reason plus the reported-and-baselined ratchet, not a path added to `argv`.
+      See `agents/roadmaps/archive/road-to-context-fidelity.md` § Phase 3.
 
   - id: check_cli_registry_budget_sync
     argv: []
@@ -955,3 +1074,92 @@ gates:
     # an already-listed file that GREW while the file COUNT stayed at one. That
     # last case is what pins the metric as excess lines rather than a file count;
     # a count-based ratchet passes it, and this gate must not.
+
+  # check_new_adr_evidence is DELIBERATELY NOT REGISTERED here, following this
+  # file's own two precedents rather than breaking them.
+  #
+  # It is diff-scoped: its corpus is the set of decision records ADDED on the
+  # branch (`git diff --diff-filter=A` over `docs/decisions/ADR-*.md` and
+  # `docs/adrs/<area>/NNNN-*.md`), so ZERO is the honest reading on almost every
+  # run and any floor above 0 reds every branch that adds no ADR. A
+  # `min_scanned: 0` row is the false-count shape this file's header rejects in
+  # as many words, and `lint_evidence_artifacts` and
+  # `check_rule_projection_integrity` both hit this exact wall and resolved it by
+  # staying unregistered. A row was written first and then withdrawn: the
+  # argument for it was that a registered gate at least runs under CI-identical
+  # argv, and that is real but it is not worth being the one instance that
+  # introduces the shape two neighbours were excluded to avoid. Three precedents
+  # agreeing is a convention; two agreeing and one defecting is drift.
+  #
+  # It is NOT unwatched. `task check-new-adr-evidence` and the
+  # `New accepted ADRs disclose their evidence` step in rule-backstops.yml both
+  # run it, so a broken gate fails there.
+  #
+  # And it is NOT unproven, which is the part a floor could never have supplied.
+  # This gate's normal reading is zero added records — precisely the state where
+  # a working gate and a completely broken one emit identical output
+  # (`scanned: 0`, green), so no floor separates them at any value. `--self-test`
+  # does: seven cases, four rejecting, each building a throwaway repo and driving
+  # the real CLI with `--base <sha>`, including the case an `authority_basis:
+  # owner_intent` escape must NOT buy (that field governs authority, never
+  # disclosure). Sabotage-verified — with the `## Evidence` check removed the
+  # self-test exits 1 and names the two cases that stopped firing.
+  #
+  # What is LOST, stated rather than implied: no minimum scan is held against
+  # this gate by this manifest, so a change that silently narrowed its path
+  # regexes to nothing would pass here. The self-test is what catches that, and
+  # it is a test rather than a manifest floor — it runs when someone runs it.
+
+  # adr/evidence_census is DELIBERATELY NOT REGISTERED here either, for the
+  # same structural reason and with a different cost.
+  #
+  # `matchesGatePattern` classifies on a name PREFIX
+  # (`lint|check|audit|skill|verify_`) and `evidence_census.ts` carries neither,
+  # so a row here would red `gate_population.test.ts` exactly as the
+  # `adr_cite_check` row did. The block below weighs the three fixes for that
+  # case and they apply unchanged: widening the pattern, renaming the script, or
+  # inverting the classification to be manifest-driven.
+  #
+  # What is DIFFERENT, and better than the adr_cite_check case: the census is not
+  # unwatched. `task check-adr-evidence-census` regenerates it to a temp path and
+  # diffs against the committed artifact, wired in the `ci` chain and as the
+  # `ADR evidence census up to date` step in rule-backstops.yml, so a corpus that
+  # drifted from the artifact fails there instead of here. The census emits a
+  # `scanned:` line and adopts the ledger, so what is lost is only the MINIMUM
+  # SCAN FLOOR — a change that narrowed its corpus to zero AND regenerated the
+  # artifact to match would pass both. Stated rather than implied, because the
+  # drift check is a byte-comparison and byte-agreement on an empty corpus is
+  # still agreement. Closing it properly is the same rename, in the same change
+  # that renames adr_cite_check.
+
+  # adr_cite_check is DELIBERATELY NOT REGISTERED here, and the reason is a
+  # disagreement between two gates over the same file rather than an oversight.
+  #
+  # The script is gate-shaped by behaviour: it emits one `scanned:` line, adopts
+  # the ledger, asserts its scan scope, and runs in CI as `ADR citations resolve`
+  # (rule-backstops.yml) plus `task check-adr-citations`. So it certifies
+  # something and can lie about it, which is this manifest's own criterion.
+  #
+  # But `gate_population.matchesGatePattern` classifies structurally, on a NAME
+  # PREFIX (`lint|check|audit|skill|verify_`), and `adr_cite_check.ts` carries
+  # `check` as a suffix. Registering it made `gate_population.test.ts` red:
+  # "manifest lists adr_cite_check, population does not". The two gates read the
+  # same file and disagree.
+  #
+  # Three fixes were weighed and each was worse than the gap:
+  #   - widening the pattern to a `_check$` suffix pulls in four unrelated
+  #     scripts (bench_drift_check, worktree_cleanup_check, update_check,
+  #     cmd_settings_check), forcing them into the ledger contract and reddening
+  #     the completeness ratchet for work nobody asked for;
+  #   - renaming the script to `check_adr_citations.ts` is the convention-conform
+  #     answer and touches 26 files, including archived review artefacts and a
+  #     committed diff.patch that must not be rewritten;
+  #   - manifest-driven classification is explicitly rejected by
+  #     gate_population.ts's own header (a new gate lands before anyone
+  #     registers it, so that inverts the real dependency).
+  #
+  # So the row is dropped and the floor is unregistered. What is LOST is stated
+  # rather than implied: the gate runs, but nothing holds it to a minimum scan,
+  # so a future change that silently narrowed its corpus to zero would pass. The
+  # honest close is the rename, in its own change, where 26 files of churn are
+  # the subject rather than a side effect.