@event4u/agent-config 15.0.0 → 16.0.0

package/src/scripts/_lib/standing_bound_ratchet.ts

@@ -3,38 +3,63 @@
  *
  * WHY THIS EXISTS
  * ---------------
- * `src/config/preamble-payload-budget.json` says of its grace ceiling: *"It may
- * never move UP."* `grace_ceiling_history` in the same file records it moving up
- * twice — 138,212 → 138,273 on 2026-09-02 and 138,273 → 138,490 on 2026-09-08 —
- * each with a careful prose justification. ADR-264 resolved that contradiction
- * against the practice: the sentence stands, the two raises are violations caused
- * by contradictory wording, and standing-rule growth needs a compensating
- * reduction elsewhere.
+ * `src/config/preamble-payload-budget.json` said of its grace ceiling: *"It may
+ * never move UP."* `grace_ceiling_history` in the same file recorded it moving
+ * up twice — 138,212 → 138,273 on 2026-09-02 and 138,273 → 138,490 on
+ * 2026-09-08 — each with a careful prose justification. ADR-264 resolved that
+ * contradiction against the practice: the sentence stands, the two raises are
+ * violations caused by contradictory wording, and standing-rule growth needs a
+ * compensating reduction elsewhere.
  *
  * That decision then had no enforcement. A sentence in a JSON string is not a
- * gate, and the file's own history is the evidence: nothing objected either time.
- * This module is the enforcement — and it is the ONLY thing
- * `road-to-a-standing-budget-with-headroom` step 1.3 ships, because the 128-token
- * Iron Law reserve that step designed was refused by an AI council 2/2 on
- * 2026-09-08. See ADR-265.
+ * gate, and the file's own history was the evidence: nothing objected either
+ * time. This module is the enforcement.
+ *
+ * WHAT IT BOUNDS NOW — AND WHY THE SUBJECT CHANGED
+ * -------------------------------------------------
+ * It used to bound one number, `ci_delivery.grace_ceiling`. That key is GONE
+ * (`road-to-delivery-for-every-host` 4.4): the ceiling is no longer stored, it
+ * is MEASURED at the base ref as `max(design_ceiling, base + active grants)`.
+ * A measured ceiling captures every merged reduction automatically, which a
+ * stored one never did.
+ *
+ * Moving the ceiling out of the config did not remove the need for a
+ * shrink-only bound — it moved the attack surface. Three numbers in the tree
+ * can still widen the effective ceiling without adding a single token of
+ * payload, and all three are now bounded:
+ *
+ *   · `design_ceiling`, derived from `baseline_tokens` × `headroom_pct`. It is
+ *     the FLOOR of the measured ceiling, so raising it raises the ceiling
+ *     directly. ADR-264's sentence applies to it verbatim.
+ *   · every existing exception's `granted_tokens` — enlarging a live grant is
+ *     a raise wearing a break-glass label.
+ *   · every existing exception's `watermark` — the watermark is what pins the
+ *     base while a grant is live, so raising it launders the grant into the
+ *     next base, which is precisely the failure the watermark exists to stop.
+ *
+ * A NEW exception id is deliberately NOT a violation: recording a fresh,
+ * approved, dated grant is the break-glass path working. Editing one that
+ * already existed is not.
  *
  * WHAT IT CANNOT DO, STATED PLAINLY
  * ---------------------------------
  * The change under review can edit this file. Both council seats named that as
- * the defect fatal to the reserve — "the checker, its imports, token census,
- * workflow, and status context are all part of the trusted computing base", so a
- * protected record read by an unprotected verifier grants nothing. It is fatal to
- * a mechanism that GRANTS budget and it is not fatal to one that only REFUSES,
- * which is the whole reason the reserve stayed unshipped and this ratchet did
- * not: disabling this check requires visibly editing it, and every gate in this
- * repository already rests on that same review. A ratchet whose only failure mode
- * is "someone deleted the ratchet" is strictly better than the sentence it
- * replaces, which had no failure mode because it did nothing.
+ * the defect fatal to a mechanism that GRANTS budget, and it is not fatal to
+ * one that only REFUSES: disabling this check requires visibly editing it, and
+ * every gate in this repository already rests on that same review. A ratchet
+ * whose only failure mode is "someone deleted the ratchet" is strictly better
+ * than the sentence it replaces, which had no failure mode because it did
+ * nothing. The 2026-09-10 verdict added one mitigation on top and named its
+ * limit in the same breath: CI runs this code AS IT EXISTS AT THE BASE REF, so
+ * a same-PR weakening cannot measure its own change — *"the mechanism does not
+ * prevent the exploit; it makes the exploit auditable."*
  */
 import { spawnSync } from 'node:child_process';
 
-/** Repo-relative path of the budget config the bound lives in. */
+/** Repo-relative path of the budget config the bounds live in. */
 export const BUDGET_CONFIG_PATH = 'src/config/preamble-payload-budget.json';
+/** Repo-relative path of the break-glass ledger the grant bounds live in. */
+export const EXCEPTIONS_CONFIG_PATH = 'src/config/preamble-payload-exceptions.json';
 
 /** Injection seam: run git, capture output, never throw on a non-zero exit. */
 export type GitRunner = (args: readonly string[], cwd: string) => {
@@ -48,28 +73,68 @@ export const realGit: GitRunner = (args, cwd) => {
     return { ok: r.status === 0, stdout: r.stdout ?? '', stderr: r.stderr ?? '' };
 };
 
+/** Named shrink-only numbers, keyed by a stable bound id. */
+export type BoundSet = Record<string, number>;
+
 export interface BoundsRatchetVerdict {
     ok: boolean;
     violations: string[];
-    /** The bound read at the base ref, or `null` when it could not be read. */
-    baseGraceCeiling: number | null;
+    /** The bounds read at the base ref, or `null` when they could not be read. */
+    baseBounds: BoundSet | null;
     /** The ref compared against, or `null` when none resolved. */
     baseRef: string | null;
     /** Why the comparison was skipped, when it was. Printed, never silent. */
     note: string | null;
     /**
-     * `false` means the bound could not be READ, not that it rose.
+     * `false` means the bounds could not be READ, not that one rose.
      *
      * Two refusals reach a caller with `ok: false` and they need opposite
-     * actions: a risen ceiling is fixed by lowering the addition, an
-     * unverifiable one by repairing the checkout. A completion review caught
-     * both being rendered as "ROSE", which would send an operator to shrink a
-     * rule over what was a fetch problem. Absent means verified — the only
-     * `ok: false` that predates this field is a genuine rise.
+     * actions: a risen bound is fixed by lowering the addition, an unverifiable
+     * one by repairing the checkout. A completion review caught both being
+     * rendered as "ROSE", which would send an operator to shrink a rule over
+     * what was a fetch problem.
      */
     verified: boolean;
 }
 
+/**
+ * The bound map, derived identically from head and base configs.
+ *
+ * ONE function for both sides, on purpose: two derivations of one boundary is
+ * the drift shape that let the grace ceiling rise twice under a sentence
+ * forbidding it. `budget` and `exceptions` are parsed JSON, or `null` when the
+ * file is absent — an absent exceptions ledger contributes no bounds, which is
+ * correct: there are no grants to protect.
+ */
+export function boundsFrom(budget: unknown, exceptions: unknown): BoundSet | null {
+    const b = (budget ?? null) as Record<string, unknown> | null;
+    if (b === null) return null;
+    const baseline = Number(b['baseline_tokens']);
+    const headroom = Number(b['headroom_pct']);
+    if (!Number.isFinite(baseline) || !Number.isFinite(headroom)) return null;
+    // `design_ceiling` is the whole config-side bound now. The retained stored
+    // allowance stage 1 kept beside it was deleted in stage 2 (ADR-276), so a
+    // tree at or below design is bounded by this number and a tree above it is
+    // bounded by its own base measurement — neither of which lives in a field
+    // anyone can edit upward.
+    const out: BoundSet = { design_ceiling: Math.round(baseline * (1 + headroom / 100)) };
+
+    const ex = (exceptions ?? null) as Record<string, unknown> | null;
+    const list = ex === null ? null : ex['exceptions'];
+    if (Array.isArray(list)) {
+        for (const item of list) {
+            const e = (item ?? {}) as Record<string, unknown>;
+            const id = e['id'];
+            if (typeof id !== 'string' || id.trim() === '') continue;
+            const granted = Number(e['granted_tokens']);
+            const watermark = Number(e['watermark']);
+            if (Number.isFinite(granted)) out[`exception:${id}:granted_tokens`] = granted;
+            if (Number.isFinite(watermark)) out[`exception:${id}:watermark`] = watermark;
+        }
+    }
+    return out;
+}
+
 function showAtRef(git: GitRunner, repoRoot: string, ref: string, relPath: string): string | null {
     const r = git(['show', `${ref}:${relPath}`], repoRoot);
     return r.ok ? r.stdout : null;
@@ -78,29 +143,24 @@ function showAtRef(git: GitRunner, repoRoot: string, ref: string, relPath: strin
 /**
  * A condition that stops the comparison: skip when advisory, refuse when not.
  *
- * One helper for all four causes rather than four inline branches, so the
- * posture cannot drift between them — the failure this closes was four
- * independent `ok: true` returns that all had to be found before any of them
- * could be trusted.
+ * One helper for all causes rather than an inline branch each, so the posture
+ * cannot drift between them — the failure this closes was four independent
+ * `ok: true` returns that all had to be found before any of them could be
+ * trusted.
  */
-function unverified(
-    reason: string,
-    requireBase: boolean,
-    baseGraceCeiling: number | null,
-    baseRef: string | null,
-): BoundsRatchetVerdict {
+function unverified(reason: string, requireBase: boolean, baseRef: string | null): BoundsRatchetVerdict {
     if (requireBase) {
         return {
             ok: false,
             verified: false,
-            baseGraceCeiling,
+            baseBounds: null,
             baseRef,
-            note: `${reason}, so the shrink-only bound was NOT verified in this run`,
+            note: `${reason}, so the shrink-only bounds were NOT verified in this run`,
             violations: [
-                `the shrink-only bound could not be verified: ${reason}. This run is `
+                `the shrink-only bounds could not be verified: ${reason}. This run is `
                     + 'ENFORCING, so an unverifiable bound refuses rather than skips — an '
                     + 'unreadable base would otherwise grant budget on an infrastructure '
-                    + 'failure. This is NOT a ceiling rise: fix the checkout (a full fetch '
+                    + 'failure. This is NOT a bound rise: fix the checkout (a full fetch '
                     + 'of the base ref) rather than lowering the addition.',
             ],
         };
@@ -109,33 +169,29 @@ function unverified(
         ok: true,
         verified: false,
         violations: [],
-        baseGraceCeiling,
+        baseBounds: null,
         baseRef,
-        note: `${reason}, so the shrink-only bound was NOT verified in this run`,
+        note: `${reason}, so the shrink-only bounds were NOT verified in this run`,
     };
 }
 
 /**
- * Compare the grace ceiling in this tree against the one at the base ref.
+ * Compare every shrink-only bound in this tree against the one at the base ref.
  *
  * TWO POSTURES, AND WHICH ONE APPLIES IS THE CALLER'S TO DECLARE.
  *
- * Advisory (the default, and what every caller got before `requireBase`): a
- * base ref or base config that cannot be read SKIPS, reported in both the human
- * and JSON output so it cannot pass for a check. That default is not laziness
- * and the original reasoning still holds — a shallow clone, a first commit and
- * a detached build all legitimately have no base, and a gate that reds on them
- * gets switched off, which is how a repository loses the enforcement it just
- * built.
+ * Advisory (the default): a base ref or base config that cannot be read SKIPS,
+ * reported in both the human and JSON output so it cannot pass for a check.
+ * That default is not laziness and the original reasoning still holds — a
+ * shallow clone, a first commit and a detached build all legitimately have no
+ * base, and a gate that reds on them gets switched off, which is how a
+ * repository loses the enforcement it just built.
  *
  * Enforcing (`requireBase: true`): the same conditions REFUSE. An AI council
  * (2/2, 2026-09-10) made this blocking for the move to a base-measured ceiling,
- * and the reason is that the asymmetry above inverts once the base ref stops
- * being a cross-check and becomes the ceiling itself. Today an unreadable base
- * costs a comparison; there it would grant an unbounded budget on an
- * infrastructure failure — the exact fail-open the reserve decision refused.
- * anthropic's wording was "replaced or mode-gated"; this is the mode gate, so
- * that no existing caller silently changes behaviour.
+ * because the asymmetry inverts once the base ref stops being a cross-check and
+ * becomes the ceiling itself. Today an unreadable base costs a comparison;
+ * there it would grant an unbounded budget on an infrastructure failure.
  *
  * The flag is the caller's rather than derived from `GITHUB_ACTIONS` here: this
  * module cannot tell an enforcing CI run from a diagnostic one on the same
@@ -154,67 +210,124 @@ export function assertBoundsDidNotRise(opts: {
      */
     requireBase?: boolean;
     /**
-     * The ceiling this run actually compares the payload against.
+     * The shrink-only numbers as they stand in THIS tree.
      *
-     * The CI step passes `--ceiling <grace_ceiling>`, so the effective bound can
-     * be raised either by editing the config or by passing a bigger number. Both
-     * arrive here as one value, which closes the second path without a second
-     * check.
+     * Passed in rather than re-read here so head and base go through
+     * `boundsFrom` from the caller's own configuration objects — including an
+     * effective value the caller may have taken from a flag rather than the
+     * file, which is the second path a bound could otherwise be widened by.
      */
-    headGraceCeiling: number;
+    headBounds: BoundSet;
 }): BoundsRatchetVerdict {
     const git = opts.git ?? realGit;
     const requireBase = opts.requireBase === true;
     if (opts.baseRef === null || opts.baseRef.trim() === '') {
-        return unverified('no base ref resolved', requireBase, null, null);
+        return unverified('no base ref resolved', requireBase, null);
     }
     const cfg = showAtRef(git, opts.repoRoot, opts.baseRef, BUDGET_CONFIG_PATH);
     if (cfg === null) {
-        return unverified(
-            `${BUDGET_CONFIG_PATH} could not be read at ${opts.baseRef}`,
-            requireBase,
-            null,
-            opts.baseRef,
-        );
+        return unverified(`${BUDGET_CONFIG_PATH} could not be read at ${opts.baseRef}`, requireBase, opts.baseRef);
     }
-    let baseGrace: number | null = null;
+    let baseBudget: unknown;
     try {
-        const parsed = JSON.parse(cfg) as Record<string, unknown>;
-        const delivery = (parsed['ci_delivery'] ?? {}) as Record<string, unknown>;
-        const n = Number(delivery['grace_ceiling']);
-        baseGrace = Number.isFinite(n) ? n : null;
+        baseBudget = JSON.parse(cfg);
     } catch {
+        return unverified(`${BUDGET_CONFIG_PATH} at ${opts.baseRef} is not parseable`, requireBase, opts.baseRef);
+    }
+    // An absent exceptions ledger at the base ref is normal — it did not exist
+    // before this mechanism landed, and a ref predating it has no grants to
+    // protect. An unparseable one is not, and refuses like a bad budget.
+    const exRaw = showAtRef(git, opts.repoRoot, opts.baseRef, EXCEPTIONS_CONFIG_PATH);
+    let baseExceptions: unknown = null;
+    if (exRaw !== null) {
+        try {
+            baseExceptions = JSON.parse(exRaw);
+        } catch {
+            return unverified(
+                `${EXCEPTIONS_CONFIG_PATH} at ${opts.baseRef} is not parseable`,
+                requireBase,
+                opts.baseRef,
+            );
+        }
+    }
+
+    const baseBounds = boundsFrom(baseBudget, baseExceptions);
+    if (baseBounds === null) {
         return unverified(
-            `${BUDGET_CONFIG_PATH} at ${opts.baseRef} is not parseable`,
+            `there are no shrink-only bounds at ${opts.baseRef} to ratchet against`,
             requireBase,
-            null,
             opts.baseRef,
         );
     }
-    if (baseGrace === null) {
-        return unverified(
-            `there is no ci_delivery.grace_ceiling at ${opts.baseRef} to ratchet against`,
-            requireBase,
-            null,
-            opts.baseRef,
+
+    const violations: string[] = [];
+    for (const [name, head] of Object.entries(opts.headBounds)) {
+        const base = baseBounds[name];
+        // A bound absent at the base is a NEW one — a freshly recorded grant,
+        // which is the break-glass path working rather than a rise.
+        if (base === undefined) continue;
+        if (head > base) violations.push(explain(name, base, head, opts.baseRef));
+    }
+
+    // DELETION CANNOT DISCHARGE DEBT. A grant that existed at the base and is
+    // gone at head was not repaid, it was erased — the 2026-09-11 council's
+    // blocking finding #3, and the one failure a shrink-only comparison misses
+    // by construction, because a removed number is not a smaller number.
+    // Only `exception:` bounds are checked for deletion: `design_ceiling` is
+    // always present, and the stored allowance that used to need an exemption
+    // here no longer exists.
+    const reportedDeletions = new Set<string>();
+    for (const name of Object.keys(baseBounds)) {
+        if (!name.startsWith('exception:')) continue;
+        if (opts.headBounds[name] !== undefined) continue;
+        const m = /^exception:(.+):(?:granted_tokens|watermark)$/.exec(name);
+        const id = m === null ? name : String(m[1]);
+        // One record carries two bounds; report the record once.
+        if (reportedDeletions.has(id)) continue;
+        reportedDeletions.add(id);
+        violations.push(
+            `standing-payload exception '${id}' existed at ${opts.baseRef} and is gone at head. A deleted ` +
+                'record is not a repaid one: repayment is established by the payload returning to the ' +
+                'watermark, and erasing the entry erases the debt along with the evidence of it. Mark it ' +
+                'repaid once the measurement supports that, or leave it in place.',
         );
     }
-    if (opts.headGraceCeiling > baseGrace) {
-        return {
-            ok: false,
-            verified: true,
-            baseGraceCeiling: baseGrace,
-            baseRef: opts.baseRef,
-            note: null,
-            violations: [
-                `the standing-payload grace ceiling rose from ${String(baseGrace)} to ` +
-                    `${String(opts.headGraceCeiling)} against ${opts.baseRef}. ` +
-                    `${BUDGET_CONFIG_PATH} says it may not move upward and ADR-264 decided that ` +
-                    'the sentence stands: standing-rule growth needs a compensating reduction ' +
-                    'elsewhere, not a bigger ceiling. Lower the addition, migrate the prose out of ' +
-                    'the standing rule, or reduce another standing asset by the same amount.',
-            ],
-        };
+
+    if (violations.length > 0) {
+        return { ok: false, verified: true, baseBounds, baseRef: opts.baseRef, note: null, violations };
+    }
+    return { ok: true, verified: true, violations: [], baseBounds, baseRef: opts.baseRef, note: null };
+}
+
+/** One refusal message per bound kind — a generic "a bound rose" sends the
+ *  reader nowhere, and the three kinds have three different fixes. */
+function explain(name: string, base: number, head: number, baseRef: string): string {
+    const rose = `rose from ${String(base)} to ${String(head)} against ${baseRef}`;
+    if (name === 'design_ceiling') {
+        return (
+            `the standing-payload design ceiling ${rose}. It derives from baseline_tokens × ` +
+            `headroom_pct in ${BUDGET_CONFIG_PATH}, and it is the FLOOR of the measured ceiling, so ` +
+            'raising it widens every future budget without adding a token of payload. ADR-264 decided ' +
+            'that standing-rule growth needs a compensating reduction elsewhere, not a bigger ceiling. ' +
+            'Lower the addition, migrate the prose out of the standing rule, or reduce another standing ' +
+            'asset by the same amount.'
+        );
+    }
+    const m = /^exception:(.+):(granted_tokens|watermark)$/.exec(name);
+    if (m !== null && m[2] === 'granted_tokens') {
+        return (
+            `standing-payload exception '${String(m[1])}' had its grant ${rose}. Enlarging a grant that ` +
+            'already exists is a ceiling raise wearing a break-glass label. Record a NEW approved, dated ' +
+            'exception instead, so the enlargement carries its own approver, reason and expiry.'
+        );
+    }
+    if (m !== null) {
+        return (
+            `standing-payload exception '${String(m[1])}' had its watermark ${rose}. The watermark pins the ` +
+            'base while the grant is live, and raising it launders the granted tokens into the next base — ' +
+            'which is exactly the failure the watermark exists to prevent. It is the payload measured ' +
+            'BEFORE the grant and does not change afterwards.'
+        );
     }
-    return { ok: true, verified: true, violations: [], baseGraceCeiling: baseGrace, baseRef: opts.baseRef, note: null };
+    return `the shrink-only bound '${name}' ${rose}, and ${BUDGET_CONFIG_PATH} says it may not move upward.`;
 }

package/src/scripts/_lib/turn_end_refusals.ts

@@ -41,15 +41,21 @@ import * as path from 'node:path';
 import { read_lockfile } from './installed_lock.js';
 
 /**
- * The four detectors, in the order the gate runs them.
+ * The five detectors, in the order the gate runs them.
  *
  * The roadmap's § 0 names three (A promissory, B language, C verification).
  * That was true of the draft and is not true of the tree: detector D
- * (`completion`) landed under round 7 § Phase 1 and runs in the same detector
- * list as the other three. Counting three would silently drop a detector's
+ * (`completion`) landed under round 7 § Phase 1, detector E
+ * (`pending-decision`) under road-to-a-question-that-survives-the-turn, and
+ * detector F (`untested`) on 2026-09-11 — all of which run in the same detector
+ * list as the first three. Counting three would silently drop a detector's
  * refusals, so the set is read off `DetectorId` in the gate rather than off the
  * prose.
  *
+ * F is the one that asks whether a change is TESTED rather than whether
+ * something ran: C is satisfied by `eslint`, which is how a feature with zero
+ * test lines passed every guard in that file.
+ *
  * This said "the same UNCONDITIONAL list" until 2026-08-18, which was wrong and
  * is worth naming rather than quietly rewording: `main()` runs A and D only when
  * no subagent dispatch is open. It does not change this set — every detector
@@ -63,6 +69,8 @@ export const DETECTOR_IDS = [
     'language',
     'verification',
     'completion',
+    'pending-decision',
+    'untested',
 ] as const;
 
 export type RefusalDetectorId = (typeof DETECTOR_IDS)[number];
@@ -138,10 +146,39 @@ export interface RefusalRecord {
     counts?: Partial<DetectorCounts>;
     /** Package version recorded at the most recent refusal, when readable. */
     agent_config_version?: string;
+    /**
+     * The host's own id for the prompt being processed at the most recent
+     * refusal, when the payload carries one.
+     *
+     * Recorded BESIDE `refused_turn`, never instead of it. The ordinal stays the
+     * re-entrancy key — its drift history is why both guard layers exist, and
+     * swapping the key of a wedge-critical guard on an axis nothing measures is
+     * a behaviour change dressed as a correction. What the pair buys is the
+     * measurement: two refusals carrying the same `refused_prompt_id` and
+     * different `refused_turn` are one prompt whose ordinal drifted, which is
+     * the failure this file's own header describes and which the ordinal alone
+     * cannot distinguish from two genuine turns.
+     */
+    refused_prompt_id?: string;
 }
 
+/**
+ * A zeroed counter per detector, DERIVED from `DETECTOR_IDS` rather than
+ * written out.
+ *
+ * It was an object literal of four keys until detector E landed, and the
+ * literal is what made adding a detector a silent arithmetic defect rather than
+ * a type error: `DetectorCounts` is `Record<RefusalDetectorId, number>`, the
+ * literal satisfied it for the union of the day, and a fifth id then read back
+ * as `undefined` — so every `+=` over it produced `NaN` and the whole rollup
+ * went quiet. The sibling test asserts that the id list and the gate's union
+ * agree; nothing asserted that the COUNTER covered the list, which is the half
+ * this construction removes the need to assert.
+ */
 export function emptyCounts(): DetectorCounts {
-    return { promissory: 0, language: 0, verification: 0, completion: 0 };
+    const out = {} as DetectorCounts;
+    for (const id of DETECTOR_IDS) out[id] = 0;
+    return out;
 }
 
 function isDetector(v: unknown): v is RefusalDetectorId {
@@ -174,6 +211,9 @@ export function parseRecord(raw: string): RefusalRecord | null {
     if (typeof o['agent_config_version'] === 'string') {
         rec.agent_config_version = o['agent_config_version'];
     }
+    if (typeof o['refused_prompt_id'] === 'string') {
+        rec.refused_prompt_id = o['refused_prompt_id'];
+    }
     const counts = o['counts'];
     if (typeof counts === 'object' && counts !== null && !Array.isArray(counts)) {
         const parsed: Partial<DetectorCounts> = {};
@@ -231,6 +271,7 @@ export function foldRefusal(
         turnOrdinal: number;
         at: string;
         version?: string | undefined;
+        promptId?: string | undefined;
     },
 ): RefusalRecord {
     const counts = prev === null ? emptyCounts() : countsOf(prev);
@@ -247,6 +288,12 @@ export function foldRefusal(
     else if (prev?.agent_config_version !== undefined) {
         rec.agent_config_version = prev.agent_config_version;
     }
+    // Not inherited from `prev` when this refusal carries none: the field
+    // describes THIS refusal's prompt, and carrying a previous one forward would
+    // read as an identity the payload never supplied.
+    if (input.promptId !== undefined && input.promptId !== '') {
+        rec.refused_prompt_id = input.promptId;
+    }
     return rec;
 }
 

package/src/scripts/check_beta_review_markers.ts

@@ -42,6 +42,12 @@ const KEEP_RE = /^keep-beta-until:\s*(\d{4}-\d{2}-\d{2})\s*$/m;
  *   - a lapsed contract **in** the baseline  -> warning (inherited debt)
  *   - a lapsed contract **not** in it        -> ERROR   (a fresh lapse, today)
  *
+ * SUPERSEDED 2026-09-11 on the second line: a fresh lapse is a warning too, and
+ * the reason is at {@link LAPSED_SEVERITY_FRESH}. The council's choice of a
+ * ratchet over a flat error stands as the record of what was decided then; what
+ * changed is the owner's ruling that no date may red CI by itself. The baseline
+ * therefore labels rather than gates.
+ *
  * So new work is enforced immediately while the 86-contract cohort does not red
  * an arbitrary future PR whose author caused none of it. The cohort is real:
  * 44 of the 86 lapsed on the same day and 64 within four days, which is one past
@@ -116,7 +122,31 @@ export function _resetLapsedBaseline(): void {
  * whether this becomes an error is that roadmap's step 0.2 and is not taken here.
  */
 const LAPSED_SEVERITY_IN_BASELINE: 'error' | 'warning' = 'warning';
-const LAPSED_SEVERITY_FRESH: 'error' | 'warning' = 'error';
+/**
+ * A fresh lapse is a WARNING since 2026-09-11, by owner decision.
+ *
+ * It was an error, and the error said: this contract must still be beta,
+ * because a date passed. That is the one thing a date cannot establish.
+ * Stability is decided on observable criteria — active enforcement, consumer
+ * reliance, no known pending incompatible change — and none of them contains an
+ * elapsed-time term. `keep-beta-until` SCHEDULES A REVIEW. It does not prohibit
+ * promotion before that date, does not require continued beta after it, and
+ * must not turn CI red on its own.
+ *
+ * What this gate still errors on is unchanged and is the part that was never
+ * about time: a beta contract declaring NO disposition at all, one declaring
+ * two, and a window set further out than the maximum — a contract that says
+ * nothing about its own maturity, or parks the question indefinitely. Those are
+ * statements about missing or contradictory evidence, which CI may absolutely
+ * refuse. "The window expired" is not one of them.
+ *
+ * The inherited/fresh distinction stays in the REPORT because it still tells a
+ * reader which lapses are cohort debt and which arrived since. It no longer
+ * gates anything, so the frozen baseline is now a label rather than a ratchet;
+ * retiring it is the remaining step, recorded in
+ * `stubs/road-to-evidence-driven-stability.md`.
+ */
+const LAPSED_SEVERITY_FRESH: 'error' | 'warning' = 'warning';
 const SUPERSEDED_RE = /^superseded-by:\s*\S+\s*$/m;
 
 const MAX_REVIEW_WINDOW_DAYS = 90;
@@ -569,9 +599,10 @@ function main(): number {
         }
         if (upcoming.length > 0) {
             process.stdout.write(
-                `\nUpcoming FRESH lapses within ${String(args.horizon)} day(s) — advisory, ` +
-                    'exit code unchanged. These are absent from the frozen baseline, so each\n' +
-                    'becomes an ERROR on its date rather than an inherited warning:\n',
+                `\nReviews falling due within ${String(args.horizon)} day(s) — advisory, ` +
+                    'exit code unchanged, and it stays unchanged when the date passes:\n' +
+                    'the window schedules a maturity DECISION, it does not require continued\n' +
+                    'beta and it never reds CI on its own. Evidence decides; the date only asks:\n',
             );
             for (const u of upcoming) {
                 process.stdout.write(