@event4u/agent-config 14.9.0 → 14.11.0

package/src/scripts/ai_council/quorum_wiring.ts

@@ -37,8 +37,9 @@ import {
     type QuorumCommand,
     type QuorumDispatch,
     type QuorumEventPhase,
+    type StanceAgreement,
 } from './events_log.js';
-import { evaluateQuorum, SOLO_FLOOR_MIN_PRESENT, type QuorumResult } from './quorum.js';
+import { evaluateQuorum, formatAttendanceCaveats, SOLO_FLOOR_MIN_PRESENT, withUnparsed, type QuorumResult } from './quorum.js';
 import { absentReasonFromCliFailure, classifyCliFailure } from './transport_resolver.js';
 
 type Dict = Record<string, unknown>;
@@ -117,6 +118,12 @@ export function _emitQuorumEvent(
          * absence is what the `false` on every line honestly records.
          */
         minPresent?: number;
+        /**
+         * Phase 3 — whether the seats agreed, when a stance tally ran.
+         * Omitted by every caller that ran none, which `appendQuorumEvent`
+         * records as `not_tallied` rather than as a bare `false`.
+         */
+        stanceAgreement?: StanceAgreement;
     },
 ): void {
     appendQuorumEvent({
@@ -128,6 +135,7 @@ export function _emitQuorumEvent(
         configuredTotal: ctx.configuredTotal ?? quorum.total,
         result: quorum,
         ...(ctx.minPresent !== undefined ? { minPresent: ctx.minPresent } : {}),
+        ...(ctx.stanceAgreement !== undefined ? { stanceAgreement: ctx.stanceAgreement } : {}),
         absent: absent.map(
             (a): QuorumAbsence => ({
                 member: String(a['member'] ?? ''),
@@ -154,9 +162,11 @@ export function _postRunQuorum(
     members: ExternalAIClient[],
     responses: CouncilResponse[],
     ai_cfg: Dict,
+    parse_outcomes?: ReadonlyMap<string, string>,
 ): { quorum: QuorumResult; absent: Dict[] } {
     const absent: Dict[] = [];
     let present = 0;
+    let unparsed = 0;
     for (let i = 0; i < members.length; i++) {
         const m = members[i] as ExternalAIClient;
         const r = responses[i];
@@ -167,7 +177,33 @@ export function _postRunQuorum(
         // banner printed `2/2 present` — a single-voice verdict presented as
         // convergence, on a paid run. An empty answer contributes nothing to a
         // quorum by definition, whatever the transport thought of it.
+        // Step 2.3 — the same argument, one rung further in. The byte check
+        // below settles "did the transport deliver anything"; it cannot settle
+        // "was what it delivered usable content", and a prose refusal passes it
+        // unchanged. So a member whose findings answer reached `parse_failed`
+        // is pulled out of `present` into its own bucket rather than folded
+        // into `N/N present`. It is NOT merged with the error cases: those are
+        // transport failures with an `AbsentReason` taxonomy the absent-member
+        // table renders, and re-labelling one of them `unparsed` would lose the
+        // auth/timeout/quota distinction. Hence the error branch below wins for
+        // a member that both errored and parsed badly — the transport failure
+        // is the stronger fact.
+        //
+        // `parse_outcomes` is optional because the run path derives it AFTER
+        // the post-run attendance event is emitted: the event stays a
+        // transport-level reading by design, and the rendered artefact is where
+        // AC-2 asks for the distinction. A caller with no map gets the exact
+        // pre-2.3 behaviour, key-for-key.
         if (r !== undefined && !r.error && r.text.trim() !== '') {
+            if (parse_outcomes?.get(m.name) === 'parse_failed') {
+                unparsed += 1;
+                absent.push({
+                    member: m.name,
+                    reason: 'unparsed',
+                    detail: 'answer present, no parser could read it',
+                });
+                continue;
+            }
             present += 1;
             continue;
         }
@@ -179,7 +215,46 @@ export function _postRunQuorum(
             detail: raw,
         });
     }
-    return { quorum: evaluateQuorum(members.length, present, _quorum_setting_from(ai_cfg)), absent };
+    return { quorum: evaluateQuorum(members.length, present, _quorum_setting_from(ai_cfg), unparsed), absent };
+}
+
+/**
+ * Which of the three agreement states a stance tally represents.
+ *
+ * `undefined` when no tally ran — the emitter records that as `not_tallied`,
+ * which is a fact ("nobody asked"), not a `false` that reads as disagreement.
+ * Returned as an optional rather than a nullable so the caller can spread it
+ * under `exactOptionalPropertyTypes`, where an explicit `undefined` and an
+ * absent key are different things.
+ */
+export function stanceAgreementOf(
+    tally: { consensus: unknown } | null,
+): StanceAgreement | undefined {
+    if (tally === null) {
+        return undefined;
+    }
+    return tally.consensus !== null ? 'consensus' : 'split';
+}
+
+/**
+ * Re-derive the rendered attendance line once the findings parser has spoken.
+ *
+ * Lives here rather than at the call site because it is the second half of the
+ * split `withUnparsed` documents: the post-run event stays a TRANSPORT-level
+ * reading so every rate over `events.log` keeps its denominator, and the
+ * rendered artefact is where AC-2 asks for the unparsed distinction. Counting
+ * `parse_failed` outcomes is the whole derivation; keeping it next to
+ * `_postRunQuorum` keeps both readings in one file.
+ */
+export function annotateRenderedQuorum(
+    quorum: QuorumResult | null,
+    parse_outcomes: ReadonlyMap<string, string> | null | undefined,
+): QuorumResult | null {
+    if (quorum === null || parse_outcomes === null || parse_outcomes === undefined) {
+        return quorum;
+    }
+    const unparsed = Array.from(parse_outcomes.values()).filter((o) => o === 'parse_failed').length;
+    return withUnparsed(quorum, unparsed);
 }
 
 /**
@@ -205,7 +280,9 @@ export function _format_quorum_line(q: QuorumResult, phase?: QuorumEventPhase):
     // a solo answer concludes, and nothing in the line distinguishes "both
     // members agreed" from "one member answered". The counts were always there;
     // what was missing is the word that stops a reader inferring convergence.
-    const degraded =
-        q.present < q.total ? `  ⚠️  DEGRADED — ${String(q.total - q.present)} member(s) did not answer; this is not convergence.` : '';
-    return `council:quorum · ${tag}${q.present}/${q.total} present, needed ${q.threshold} — ${verdict}.${degraded}`;
+    // Step 2.3 moved the wording into `formatAttendanceCaveats` so this line and
+    // its mirror in `orchestrator.ts` cannot drift apart, and added the
+    // present-unparsed clause there — see that function for why the two counts
+    // are disjoint.
+    return `council:quorum · ${tag}${q.present}/${q.total} present, needed ${q.threshold} — ${verdict}.${formatAttendanceCaveats(q)}`;
 }

package/src/scripts/ai_council/seating.ts

@@ -0,0 +1,211 @@
+/**
+ * Who is seated for a run, decided once and frozen.
+ *
+ * Selection today is config-static ask-all: every enabled member, every
+ * question, no per-question seating. This adds an OPTIONAL declaration of what
+ * a run wants from its seats, and computes the answer once.
+ *
+ * FAMILY DIVERSITY ONLY — no band ordering. `blocker: b-ladder-order-benchmark-spend`
+ * was resolved (b) on 2026-08-22: nothing in this tree establishes that a higher
+ * capability band reviews better, the archived benchmark substrate would have to
+ * be re-run to support it, and the council that would have decided otherwise had
+ * no quota. So `tier` keeps its single documented meaning — a capability rank
+ * read only as a chairman-selection input — and nothing here reads it. A seat
+ * declaration carries MISSION, never RANK.
+ *
+ * "Family" is the PROVIDER, not a capability band. For a council, diversity means
+ * independent providers: two Claude bands share a vendor, a training pipeline and
+ * a failure mode, so seating `opus` beside `sonnet` buys none of what a second
+ * opinion is for. (`MODEL_FAMILIES` in the orchestration-record hook enumerates
+ * Claude bands for a different purpose — token attribution — and is deliberately
+ * not reused here.)
+ *
+ * Absent declaration ⇒ today's behaviour, byte-identical. That is asserted by a
+ * test rather than intended.
+ */
+import type { MemberConfig } from './config.js';
+
+/** A member's provider family. The map key IS the provider in this config shape. */
+export function familyOf(member: MemberConfig): string {
+    return member.name;
+}
+
+/**
+ * Read the optional `seat_constraints:` block out of a raw council config.
+ *
+ * DELIBERATELY NOT A FIELD ON `CouncilConfig`, and the reason is a ratchet
+ * rather than a design preference. `config.ts` is 2,205 lines — 705 over the
+ * 1,500-line source-size line — and `check_source_size_budget` counts only the
+ * excess above that line, so the 39 lines this feature first added there were a
+ * straight +39 against a shrink-only baseline. The gate's own message is
+ * explicit that raising the baseline is "a defect, not a fix". Extraction is the
+ * sanctioned repair, and this file is 169 lines, so the same code costs nothing
+ * here.
+ *
+ * THE TRADE-OFF, stated rather than buried: validation moves from LOAD time to
+ * READ time. A malformed `min_families` no longer fails the moment the config
+ * is parsed; it fails when a caller asks for the constraints. Today that
+ * difference is unobservable — Phase 2 ships the DECLARATION and no caller
+ * reads it yet — but it is a real change in when a bad config is caught, and
+ * whoever wires the first caller should call this at run start so the failure
+ * lands before any seat is used.
+ *
+ * Fails CLOSED on a malformed value rather than falling back to absent: a run
+ * that declared a diversity floor and silently got none is the exact silent
+ * fallback the degradation line exists to prevent.
+ */
+export function readSeatConstraints(raw: unknown, label = 'seat_constraints'): SeatConstraints {
+    if (raw === null || raw === undefined) return {};
+    if (typeof raw !== 'object' || Array.isArray(raw)) {
+        throw new TypeError(`${label} must be a mapping (got ${typeof raw}).`);
+    }
+    const block = (raw as Record<string, unknown>)['seat_constraints'] ?? raw;
+    if (block === null || block === undefined) return {};
+    if (typeof block !== 'object' || Array.isArray(block)) {
+        throw new TypeError(`${label} must be a mapping (got ${typeof block}).`);
+    }
+    const mf = (block as Record<string, unknown>)['min_families'];
+    if (mf === null || mf === undefined) return {};
+    if (typeof mf !== 'number' || !Number.isInteger(mf) || mf < 1) {
+        throw new TypeError(`${label}.min_families must be an integer >= 1 when set (got ${String(mf)}).`);
+    }
+    return { min_families: mf };
+}
+
+export interface SeatConstraints {
+    /**
+     * Minimum distinct provider families the run wants seated.
+     *
+     * Absent (or 1) ⇒ no constraint and no degradation line: ask-all, unchanged.
+     */
+    readonly min_families?: number;
+}
+
+export interface Seating {
+    /** The seated members, in deterministic config order. */
+    readonly seats: readonly MemberConfig[];
+    /** Distinct families actually seated. */
+    readonly families: readonly string[];
+    /**
+     * Exactly ONE line when the constraint could not be met, `null` otherwise.
+     *
+     * One line, not a wall: a degradation nobody reads is the same as a silent
+     * fallback, and N warnings is how a reader learns to skip the header.
+     */
+    readonly degraded: string | null;
+}
+
+/**
+ * Compute the seating once.
+ *
+ * Deterministic and side-effect-free: the same members and constraints always
+ * produce the same seats, which is what makes freezing it meaningful. Seating
+ * that changed between round 1 and round 3 would silently invalidate the
+ * anonymised-peer-reply contract the council skill depends on — a "reviewer B"
+ * in round 3 that is not the "reviewer B" of round 1 makes every cross-reference
+ * in the synthesis wrong while looking fine.
+ */
+export function resolveSeating(
+    members: readonly MemberConfig[],
+    constraints: SeatConstraints = {},
+): Seating {
+    const enabled = members.filter((m) => m.enabled);
+    const families = [...new Set(enabled.map(familyOf))];
+    const want = constraints.min_families ?? 1;
+
+    if (want <= 1 || families.length >= want) {
+        return { seats: enabled, families, degraded: null };
+    }
+    return {
+        seats: enabled,
+        families,
+        degraded:
+            `tier-degraded: asked for ${String(want)} model families, seated ${String(families.length)} ` +
+            `(${families.join(', ')}). The run proceeds with what is enabled — a council that refused to ` +
+            `convene on a diversity shortfall would fail closed on the common single-provider install, ` +
+            `which is worse than a stated shortfall.`,
+    };
+}
+
+/**
+ * Freeze a seating so a later config mutation cannot change it.
+ *
+ * Returns a structurally frozen snapshot. This is the mechanism behind "resolve
+ * once per run": the caller resolves at run start, freezes, and passes the
+ * snapshot down — so there is no path by which round 3 re-reads the config.
+ */
+export function freezeSeating(s: Seating): Seating {
+    return Object.freeze({
+        seats: Object.freeze([...s.seats]),
+        families: Object.freeze([...s.families]),
+        degraded: s.degraded,
+    });
+}
+
+/**
+ * Vendor sentinels and "latest in band" aliases — an id that cannot go stale.
+ *
+ * Read from the providers' own CLI surfaces on 2026-08-22, never from recall:
+ * `claude --help` documents 'fable', 'opus' and 'sonnet' as aliases for the
+ * latest model in their band, and `codex-default` is the openai transport's
+ * documented "let the CLI choose".
+ */
+export const ADMISSIBLE_SENTINELS: ReadonlySet<string> = new Set([
+    'codex-default',
+    'fable',
+    'opus',
+    'sonnet',
+    'haiku',
+]);
+
+export interface AdmissibilityResult {
+    readonly admissible: boolean;
+    readonly reason: string | null;
+}
+
+/**
+ * Is this member's `model:` id from an admissible SOURCE?
+ *
+ * THE CRITERION AS WRITTEN COULD NOT BE IMPLEMENTED, and the deviation is
+ * recorded here rather than papered over. The roadmap step says a declared seat
+ * "resolves through the shipped `model_tier` bands; a model id that no tier maps
+ * to is rejected at config load". But `TIER_TO_CLAUDE_MODEL`
+ * (`_lib/model_tier.ts:36-41`) maps tiers onto CLAUDE aliases only — there is no
+ * entry any `gemini-*`, `grok-*` or `sonar-*` id could resolve through. Taken
+ * literally, that rule rejects every non-anthropic member in the shipped starter
+ * config, i.e. it fails closed on a valid config.
+ *
+ * What the step is actually protecting is stated in its own title: "including
+ * the host's own recall". The failure mode is a plausible-sounding model id
+ * TYPED FROM MEMORY, which is indistinguishable from a real one at review time
+ * and would silently undo the pin refresh. So admissibility is checked against
+ * the SOURCE of the id, over the two things this tree can actually verify:
+ *
+ *   1. a vendor sentinel or documented "latest in band" alias — cannot go stale,
+ *      and read from the provider's own surface; or
+ *   2. a dated pin carrying a `verified_at` stamp — which records that a human
+ *      looked at the provider's surface on a named date, and which
+ *      `check_council_pin_staleness` ages out.
+ *
+ * An id that is neither is exactly the recall case: a bare dated id nobody
+ * recorded checking.
+ */
+export function checkModelAdmissibility(member: MemberConfig): AdmissibilityResult {
+    const id = member.model.trim().toLowerCase();
+    if (ADMISSIBLE_SENTINELS.has(id)) {
+        return { admissible: true, reason: null };
+    }
+    if (member.verified_at !== null && member.verified_at !== undefined) {
+        return { admissible: true, reason: null };
+    }
+    return {
+        admissible: false,
+        reason:
+            `members.${member.name}.model is '${member.model}' — a dated id with no verified_at stamp. ` +
+            `An id must come from a source this tree can check: a vendor sentinel or documented ` +
+            `"latest in band" alias (${[...ADMISSIBLE_SENTINELS].join(', ')} — see src/scripts/_lib/model_tier.ts ` +
+            `for the tier vocabulary these bands come from), or a pin carrying verified_at: "YYYY-MM-DD" ` +
+            `recorded from the provider's own surface. A model id remembered rather than read is not an ` +
+            `admissible source, and is indistinguishable from a real one at review time.`,
+    };
+}

package/src/scripts/ai_council/stance_tally.ts

@@ -218,6 +218,28 @@ export function tally_stances(
  * Render the **Vote Tally** verdict section: one line per option, the threshold,
  * and a cleared-or-escalated line. Deterministic — pure projection of the tally.
  */
+/**
+ * Tally the stance lines of a finished round, or `null` when tallying is off.
+ *
+ * Wraps the member-shape mapping so a caller does not re-derive it: an errored
+ * response has no stance line to read, and the member key is
+ * `provider:model` because that is what `parse_stance_line` records. Exists so
+ * ONE tally is computed per pass and reused — two tallies over the same
+ * responses are two chances to disagree, and the attendance event and the
+ * handoff envelope both consume this one.
+ */
+export function tallyFromResponses(
+    responses: ReadonlyArray<{ provider: string; model: string; text: string; error?: string | null }>,
+    enabled: boolean,
+): StanceTallyResult | null {
+    if (!enabled) {
+        return null;
+    }
+    return tally_stances(
+        responses.filter((r) => !r.error).map((r) => ({ member: `${r.provider}:${r.model}`, text: r.text })),
+    );
+}
+
 export function render_vote_tally(result: StanceTallyResult): string {
     const lines: string[] = ['### Vote Tally'];
     if (result.options.length === 0) {

package/src/scripts/bench_hook_latency.ts

@@ -580,6 +580,58 @@ export function perTurnComposite(
     };
 }
 
+/**
+ * A1.1 — append ONE composite reading to the durable store.
+ *
+ * The bench used to print the composite and discard it, which made
+ * `per_turn_composite.arming_precondition` ("at least 10 CI gate readings … from
+ * at least 2 distinct runner sessions") impossible to evaluate at all. This is
+ * the write half; `check_composite_arming.ts` is the read half.
+ *
+ * THE SESSION DISCRIMINATOR IS THE LOAD-BEARING FIELD, not the count. The
+ * precondition asks for two distinct runner SESSIONS because the instability it
+ * excludes was measured on ONE machine — a sibling metric read 44-157 % at n=12
+ * and 69-74 % at n=50 there — so twelve readings from one session is exactly the
+ * shape the floor rejects, and a bare counter cannot see the difference.
+ *
+ * A null composite is written as null rather than skipped. Dropping it silently
+ * would make the store's own length a lie about how many runs contributed, and
+ * the reader needs to distinguish "no run" from "a run whose slots were
+ * incomplete" — `perTurnComposite` returns null exactly because a composite over
+ * a subset reads LOW, and low is the direction that makes a ceiling look met.
+ */
+export function composeReadingRecord(
+    composite: { ms: number; parts: Record<string, number> } | null,
+    tool_calls: number,
+    env: NodeJS.ProcessEnv = process.env,
+): Record<string, unknown> {
+    // In CI a session is the workflow run on a given runner; locally it is the
+    // host plus the process's own start, so two consecutive local runs are
+    // distinguishable while one run's records stay grouped.
+    const ciRun = env['GITHUB_RUN_ID'];
+    const session =
+        ciRun !== undefined && ciRun !== ''
+            ? `gh-${ciRun}-${env['RUNNER_OS'] ?? os.platform()}-${env['GITHUB_RUN_ATTEMPT'] ?? '1'}`
+            : `local-${os.hostname()}-${String(process.pid)}`;
+    return {
+        composite_ms: composite === null ? null : composite.ms,
+        parts: composite === null ? null : composite.parts,
+        tool_calls,
+        session,
+        platform: `${os.platform()}-${os.arch()}`,
+        node: process.version,
+        commit: env['GITHUB_SHA'] ?? null,
+        run_id: ciRun ?? null,
+        recorded_at: new Date().toISOString(),
+    };
+}
+
+/** Append one JSONL record. Creates the file and its directory if absent. */
+export function appendReading(storePath: string, record: Record<string, unknown>): void {
+    fs.mkdirSync(path.dirname(storePath), { recursive: true });
+    fs.appendFileSync(storePath, `${JSON.stringify(record)}\n`, 'utf-8');
+}
+
 interface HistoryEntry {
     recorded_at: string;
     invocation_path: InvocationPath;
@@ -895,6 +947,16 @@ export function main(argv: string[] = process.argv.slice(2)): number {
             : perTurnComposite(results, compositeCfg.tool_calls ?? 10);
     if (compositeCfg !== undefined) {
         const calls = compositeCfg.tool_calls ?? 10;
+        // A1.1: persist the reading BEFORE the ceiling comparison below, so a run
+        // that fails the gate still contributes its number. A store that only
+        // gets the passing runs is biased in the direction that makes a ceiling
+        // look met, which is the same bias the null-composite rule guards.
+        const recIdx = argv.indexOf('--record-composite');
+        if (recIdx >= 0) {
+            const dest = argv[recIdx + 1] ?? path.join(REPO_ROOT, 'agents', 'evidence', 'hook-composite-readings.jsonl');
+            appendReading(dest, composeReadingRecord(composite, calls));
+            process.stdout.write(`recorded composite reading → ${path.relative(REPO_ROOT, dest)}\n`);
+        }
         if (composite === null) {
             process.stdout.write(
                 `ℹ️  per-turn composite not computed — a slot the definition needs is missing from this run\n`,

package/src/scripts/build_proof.ts

@@ -24,7 +24,11 @@ import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import { REPO, LEDGER_REL, load_ledger, pointer_unresolved } from './check_claims.js';
-import { collect as collectEnforcement, summarise as summariseEnforcement } from './check_enforcement_coverage.js';
+import {
+    collect as collectEnforcement,
+    denominator_line as enforcementDenominatorLine,
+    summarise as summariseEnforcement,
+} from './check_enforcement_coverage.js';
 import { collectSkillGaps } from './check_skill_gaps.js';
 import { loadRows as loadComparisonRows } from './check_comparison.js';
 import { computeStatus as domainSoundnessStatus } from './domain_soundness_status.js';
@@ -415,6 +419,13 @@ function render(): string {
                 `${s.local_only} local-only · ${s.undeclared} undeclared (no \`enforced_by\` yet).`,
         );
         L.push('');
+        // The denominator, WITH the frame that produced it. Until 2026-08-23 the
+        // tree published five figures for this one property because every one was
+        // quoted without saying which population it was taken over. This line is
+        // the single sanctioned statement of it, and `check_enforcement_denominator`
+        // reds when a published doc restates a count instead of citing this block.
+        L.push(`\`${enforcementDenominatorLine(s.frames)}\``);
+        L.push('');
         L.push('| Rule | Effective level | Declared backstop(s) |');
         L.push('|---|---|---|');
         const declared = rows

package/src/scripts/capture_skill_catalogue.ts

@@ -434,11 +434,32 @@ function runLimitsMode(): number {
 /** The package's two projection-mode counts, one walk. Shared by both modes. */
 function projectionModeCounts(): ProjectionModeCounts {
     const stats = scoped_projection_stats(REPO, iter_skills());
+    // The tier split is a per-machine runtime artefact (gitignored), so absent is
+    // the normal state and must read as "unmeasured", never as zero.
+    let tierACount: number | null = null;
+    let tierBCount: number | null = null;
+    const tiersFile = path.join(REPO, 'agents', 'runtime', 'state', 'skill-tiers.json');
+    if (fs.existsSync(tiersFile)) {
+        try {
+            const parsed = JSON.parse(fs.readFileSync(tiersFile, 'utf-8')) as {
+                tier_a?: unknown;
+                tier_b?: unknown;
+            };
+            if (Array.isArray(parsed.tier_a) && Array.isArray(parsed.tier_b)) {
+                tierACount = parsed.tier_a.length;
+                tierBCount = parsed.tier_b.length;
+            }
+        } catch {
+            /* a malformed split is an absent split — never a partial count */
+        }
+    }
     return {
         scoped: stats.projected,
         legacyAll: stats.total,
         prunedUnderScoped: stats.pruned,
         activePacks: stats.active_packs,
+        tierACount,
+        tierBCount,
     };
 }
 

package/src/scripts/check_always_budget.ts

@@ -29,6 +29,7 @@ import process from 'node:process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import YAML from 'yaml';
 
+import { asOf } from './_lib/as_of.js';
 import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
 
 // src/scripts/check_always_budget.ts → parents[2] is the repo root
@@ -435,7 +436,7 @@ function recordTrend(totalExt: number, sizes: Array<[string, number, number]>):
 
 /** datetime.now(timezone.utc).isoformat(timespec="seconds") → ...+00:00. */
 function isoSeconds(): string {
-    const d = new Date();
+    const d = asOf();
     const pad = (v: number): string => String(v).padStart(2, '0');
     return (
         `${d.getUTCFullYear()}-${pad(d.getUTCMonth() + 1)}-${pad(d.getUTCDate())}` +

package/src/scripts/check_augmentignore.ts

@@ -24,6 +24,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
+import { asOfMs } from './_lib/as_of.js';
 import { assertWatchlistResolves, DeadScopeError } from './_lib/scan_scope.js';
 
 const QUIET = process.argv.slice(2).includes('--quiet');
@@ -76,7 +77,7 @@ function check(): number {
     }
 
     const mtimeMs = fs.statSync(target).mtimeMs;
-    const age_days = (Date.now() - mtimeMs) / 86400000;
+    const age_days = (asOfMs() - mtimeMs) / 86400000;
     if (age_days > STALE_DAYS) {
         notes.push(
             `ℹ️  .augmentignore is ${Math.trunc(age_days)} days old (threshold: ${STALE_DAYS}) — ` +

package/src/scripts/check_beta_review_markers.ts

@@ -19,6 +19,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
+import { asOf } from './_lib/as_of.js';
 import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
 
 const _HERE = fileURLToPath(import.meta.url);
@@ -185,7 +186,7 @@ function parse_args(argv: readonly string[]): ParsedArgs {
 
 /** Today's date as an ordinal, in local time (mirrors date.today()). */
 function _todayOrdinal(): number {
-    const now = new Date();
+    const now = asOf();
     return _dateOrdinal(now.getFullYear(), now.getMonth() + 1, now.getDate());
 }