@event4u/agent-config 16.0.0 → 16.1.0

package/dist/agent-src/contexts/execution/auto-orchestration-activation.md

@@ -62,12 +62,53 @@ choice.
 ## Safety floors are never lifted
 
 Auto-dispatch never bypasses a floor. The cross-model judge Iron Law
-(`subagent-orchestration`), `verify-before-complete`, the N=3 autonomous
-budget, `scope-control`, and `non-destructive-by-default` all apply to
-auto-delegated work exactly as they do to in-session work.
+(`subagent-orchestration`), `verify-before-complete`, the fix-loop bound of
+`autonomous-execution`, `scope-control`, and `non-destructive-by-default` all
+apply to auto-delegated work exactly as they do to in-session work.
 `emergency.orchestration_halt: true` disables the layer for the duration of an
 incident; it never disables a floor.
 
+## Carriers — how the delegation obligation reaches a session
+
+Migrated out of `delegation-policy` on 2026-09-13 under the P4 pattern: the rule
+keeps the obligation, this page carries how it travels and what stays
+model-carried. The rule was re-sending all of it on every session and every
+spawn, and the standing-payload ceiling is measured per spawn.
+
+No host runs the tier-2 rule router, so that rule's triggers alone never load it.
+The obligation travels on three carriers instead:
+
+1. the always-loaded **AGENTS.md line** (delegate-by-default + end-review);
+2. the **`delegation-nudge`** concern on `user_prompt_submit` — runs
+   `classifyTask` on cheap prompt signals and injects a one-line verdict ONLY
+   when the classifier says `do-in-parallel` / `do-in-steps`, silence otherwise.
+   Delivery on `user_prompt_submit` is end-to-end verified;
+3. the **`end-review-nudge`** concern on `stop` — ONE `review_skipped` telemetry
+   line per mutating no-review session, verified. Its advisory line reaches the
+   dispatcher output, but host-side forwarding of stop-slot context to the model
+   is unverified, so the model-facing end-review carrier is the AGENTS.md line
+   plus this telemetry.
+
+The capability gate itself resolves from the committed host registry merged with
+a live environment probe in `src/scripts/_lib/host_capability.ts`
+(`probeHostCapabilities`) — capability is a fact about the host, never a settings
+override.
+
+**Never read a `false` capability as a host limitation without checking where it
+came from.** The registry holds one row, so on every other host all six fields are
+the all-false safe default — which records that *nobody answered*, not that the
+host cannot spawn. `agent-config routing:doctor [--platform <host>]` prints the
+value **and** its provenance per field (`registry` = a committed observation this
+repo made once · `live-probe` = established in this process · `default` = no
+answer). Run it before concluding delegation is unavailable here; the same-shaped
+wrong guess about the council is the incident
+[`council-availability`](../../rules/council-availability.md) exists for.
+
+What stays model-carried, honestly: the decomposition itself, the per-return
+verification, and every dispatch on hosts without hook slots. The nudges are
+advisory by design — whether they change behavior is measured by the telemetry,
+not assumed.
+
 ## Related
 
 - [`subagent-configuration`](../subagent-configuration.md) — model / parallelism keys.

package/dist/agent-src/contexts/execution/autonomy-mechanics.md

@@ -141,12 +141,14 @@ When the user later issues a **new** request — different ticket, different roa
 
 In doubt whether the new request inherits or needs fresh confirmation → fresh confirmation. The Hard Floor and [`scope-control`](../../rules/scope-control.md) gates apply to every task regardless.
 
-## Validation-loop budget — mechanics (N=3)
+## Validation-loop budget — mechanics
 
 Autonomous flows must not iterate indefinitely on the same validation target. **Validation target** = a single identifiable artefact: a file path, a lint rule ID, a test name, a CI sub-task name. Natural-language clustering ("the linter stuff") does **not** count as a target — agents will rename their way out of the budget.
 
 A "failed attempt" is an iteration that did not move the target from red to green. Tuning the tool around the target (e.g. growing an allowlist, loosening a threshold, suppressing a check) counts as an attempt — and is usually a sign the **tool**, not the content, is wrong.
 
+Bands, bound outcomes, reading a red: [`fix-loop-ladder`](fix-loop-ladder.md).
+
 ### Allowlist-growth antipattern — detail
 
 Crossing the 20-entry threshold counts as the 3rd validation-target failure for the linter in question, regardless of prior attempt count. The fix is a tool-shape change (heuristic tightening, scope narrowing, deletion), not more entries. Same logic for: warning-suppression lists growing past ~20, `// noqa` / `# type: ignore` sweeps over many files in one session, test `skip` / `xfail` bulk-adds to chase green.
@@ -161,7 +163,7 @@ Concrete tool mapping — verify with the narrowest tool that proves the target
 
 Where the objective is **countable** — findings closed, tests passing,
 occurrences remaining — the primary stop signal is **no progress** or a **new
-minimum**, and the N=3 iteration cap is the **backstop**. A counter alone cannot
+minimum**, and the fix-loop bound is the **backstop**. A counter alone cannot
 tell three attempts that each closed a finding from three that changed nothing.
 
 **Do not remove the cap.** A no-progress signal is only as good as the metric
@@ -175,13 +177,13 @@ firing is `exhausted`, a repeating failure signature with budget left is
 [`terminal-states`](terminal-states.md). Collapsing them invites the wrong
 remedy, because raising a budget helps the first and never the second.
 
-Where the objective is NOT countable, the cap is the only signal and the N=3
-budget above applies unchanged.
+Where the objective is NOT countable, the cap is the only signal and the
+fix-loop bound above applies unchanged.
 
 ## Adaptive effort & stop (RDP)
 
 Scale effort to task difficulty, and stop when marginal evidence drops — coupled
-to the N=3 budget above, never replacing it. On a host with a native effort knob
+to the fix-loop bound above, never replacing it. On a host with a native effort knob
 (e.g. an `effort` parameter), the right move is to **set it high** for hard tasks
 rather than scaffold; the scaffold here is for a standard host **without** such a
 knob. The per-dimension uncertainty score (see
@@ -211,13 +213,11 @@ ladder on the same failing target**, not competing budgets:
    attempts, switch approach when the same signature repeats
    ([`context-hygiene`](../../rules/context-hygiene.md) "same failure
    signature twice → pivot").
-2. **The 3rd consecutive failed attempt on the target trips N=3**
-   (this file, above): 2 retries + the initial attempt ARE the three
-   attempts N=3 counts. Terminal action: STOP, surface the attempts,
-   ask the user.
-3. **Repeated N=3 cycles on the same task** escalate to
-   [`context-hygiene`](../../rules/context-hygiene.md)'s 3-Failure Rule:
-   state dump + recommend a fresh session.
+2. **The 3rd consecutive failed attempt closes band 1** — terminal for the BAND,
+   not the run: band 2 begins, a strategy shift is mandatory.
+3. **Repeated EPOCHS** — not attempts — escalate to
+   [`context-hygiene`](../../rules/context-hygiene.md)'s 3-Failure Rule. Three
+   failed strategies is evidence about the TASK.
 
 No artifact may mint a fourth budget or a stricter one-strike cap for the
 same subject; per-tool loop caps (`token-efficiency` >2 same-tool calls)
@@ -227,8 +227,8 @@ are a different subject (tool-call repetition, not fix attempts).
 otherwise fuzzy; operationalize it so it is checkable, not vibes: when **two
 consecutive investigative probes** (a read, a grep, a query) yield **no new
 load-bearing information** — nothing that changes the plan or the hypothesis —
-stop gathering and act on what you have (or ask). This is the diminishing-returns
-twin of the N=3 hard cap: N=3 stops fruitless *fixing*, this stops fruitless
+stop gathering and act on what you have (or ask). The fix-loop bound stops
+fruitless *fixing*; this stops fruitless
 *searching*. It never overrides the read-loop abort in
 [`context-hygiene`](../../rules/context-hygiene.md) — that is the hard ceiling;
 this is the earlier soft signal.
@@ -240,6 +240,6 @@ plan, an open question the context already answers, or a promise of
 unexecuted work ("I'll…", "next I will…"), do that work now with tool
 calls instead of ending the turn — this is what "the turn isn't done
 until it's done" means in practice. This checkpoint operates inside the
-existing bounds: the N=3 validation-loop budget and the Hard Floor
+existing bounds: the fix-loop validation budget and the Hard Floor
 still apply unchanged; the checkpoint closes out work already in scope,
 it never licenses continuing past either limit.

package/dist/agent-src/contexts/execution/decision-closure-execution.md

@@ -0,0 +1,93 @@
+# Decision Closure — Execution Side
+
+Loaded from [`roadmap-process-loop`](roadmap-process-loop.md) § 3-0 and
+§ 5a-residue. Planning closes what it can foresee; this is what the RUN does
+with the record it was handed, and with the residue planning could not see.
+
+```
+THE `## Decisions` TABLE IS READ BEFORE THE FIRST STEP, NOT WHEN A STEP TRIPS OVER IT.
+A ROW IN IT IS A CLOSED DECISION. NEVER RE-DERIVE ONE. NEVER RE-ASK ONE.
+A CLOSED DECISION REOPENS ONLY WHEN ITS `revisit if` CONDITION BECAME TRUE —
+NEVER BECAUSE A CONTEXT RESET LOST IT, AND NEVER BECAUSE THE ANSWER LOOKS ODD.
+```
+
+If the roadmap carries a `## Decisions` section, read it whole and cache it for
+the run alongside the cadences (§ 4). Each row is `ID | ownership | resolved by
+| decision | evidence | revisit if`, and the contract that governs it is
+rule 27 of [the roadmap template](../../templates/roadmaps.md).
+
+Three consequences during the run:
+
+1. **A step whose question is already a row executes on that row's answer.**
+   The decision was closed in planning; re-deriving it is the repeat the ask
+   census counts as a defect, and re-asking it is worse.
+2. **A `revisit if` condition that became true reopens exactly that row** —
+   resolve it again through the ownership ladder, append the new answer, and
+   say which condition fired. One reopen per row per run.
+3. **A decision NOT in the table is mid-run residue**, handled by § 5's residue
+   rule: technical residue resolves inline through the agent, an independent
+   session, the council or the team and is appended to `## Decisions` with the
+   step id; owner-owned residue is asked only when the step cannot progress,
+   and otherwise the step is parked while independent phases continue.
+
+No `## Decisions` section is not an error: a plan that closed everything inline
+carries none. It is a finding only when the plan ALSO carries an unresolved
+marker, which `lint_decision_classes` reds at authoring time rather than here.
+
+
+
+```
+A DECISION THE RUN MEETS MID-STEP IS ROUTED BY THE SAME TABLE THAT CLOSED THE
+PLAN. TECHNICAL RESIDUE RESOLVES INLINE AND IS APPENDED TO `## Decisions` WITH
+THE STEP ID. IT NEVER BECOMES A QUESTION, AND IT NEVER BECOMES A HALT.
+OWNER-OWNED RESIDUE ASKS **ONLY IF THE STEP CANNOT PROGRESS**. OTHERWISE THE
+STEP IS PARKED, INDEPENDENT PHASES CONTINUE, AND THE RUN COMES BACK TO IT.
+MISSION-LEVEL `BLOCKED` ONLY PER THE TERMINAL-OUTCOMES LIST BELOW.
+```
+
+Planning closed what it could foresee (§ 3-0). What is left is residue, and it
+is routed identically:
+
+| Residue | What happens |
+|---|---|
+| `deterministic`, `reversible-technical` | the agent decides and says why |
+| `contested-technical` | an independent session, then the council, then the team |
+| `critical-technical` | a provider-diverse council; the owner only where a typed op or an owner-reserved dimension is touched |
+| `spend-exhaustion` | pause and report — never a question |
+| `product-owned`, `business-owned`, `destructive-owned` | the step's progress decides: **blocked on it** → ask now, one question, record the answer · **not blocked** → park the step, continue elsewhere, return |
+
+Every resolution is appended to `## Decisions` **with the step id in the
+evidence column**, so a later reader can tell a decision planning closed from
+one the run met. `./scripts-run src/scripts/lint_decision_classes` validates
+the row.
+
+**Parking is not deferring.** A parked step keeps its `[ ]`, keeps its place in
+the count, and is returned to in the same run once the answer lands. It does
+**not** take `[~]`, which is a deferral by decision and would let the run reach
+`count_open == 0` on work nobody did.
+
+**Scope discovered mid-step is the other table** — agent-owned growth is done
+and recorded as a scope delta, council-owned growth routes through the ladder,
+and a larger unrelated opportunity becomes a follow-up artifact rather than
+expanding the mission. Both lists, closed:
+[`scope-growth-ownership`](../authority/scope-growth-ownership.md), with
+`./scripts-run src/scripts/scope_growth "<description>"` for a single item.
+
+
+## What `blocked-by:` may point at, after the retirement
+
+The marker itself is unchanged — `run-continuation` reads blockedness from it
+and from nothing else. What narrows is its contents.
+
+A `## Blockers` entry is the record of a decision the agent **correctly did not
+own**. An entry that declares `- **Ownership:**` must therefore name one of the
+three owner-owned classes: `product-owned`, `business-owned`,
+`destructive-owned`. A technical class there says a decision the ownership
+ladder could have closed was filed instead, and `lint_roadmap_blockers` reds
+it. The field is optional and the check is HARD rather than ratcheted, on the
+no-backlog-to-grandfather ground: it is new, so it fires on nothing in the tree
+today.
+
+A technical judgement call therefore has no file-shaped home. It routes back
+through the closure pass, resolves at the lowest rung that owns it, and lands
+as a `## Decisions` row.

package/dist/agent-src/contexts/execution/fix-loop-ladder.md

@@ -0,0 +1,108 @@
+# The fix-loop ladder — bands, bound outcomes, and how to read a red
+
+`road-to-adversarial-verification-and-long-runs` Phase 4. The obligation lives in
+[`autonomous-execution`](../../rules/autonomous-execution.md) § Validation-loop
+budget; this page carries the bands, what happens at the bound, and the probe
+discipline each band starts from.
+
+**Its own file rather than a section of
+[`autonomy-mechanics`](autonomy-mechanics.md), and the reason is measured.** That
+page sat at 16,040 chars against a 16,000-char depth ceiling — marginally under by
+the gate's own measure — so adding ~5,600 chars of ladder to it crossed the
+ceiling and added a violation to a shrink-only ratchet. Splitting a distinct
+subject out is the repair the ratchet is asking for; raising the baseline would
+have been the defect it names.
+
+## The three bands, and what makes a band a band
+
+The bound was a hard cap of 3 whose remedy was *STOP. SURFACE. ASK USER FOR
+GUIDANCE.* It is now `execution.fix_loop_max` — default 10 — divided into three
+bands, and the division is the substance: a larger number alone would only buy
+more of the same attempt.
+
+| Attempts | What is required | What is NOT an attempt |
+|---|---|---|
+| 1-3 | root-cause, then a targeted fix | — |
+| 4-6 | a **mandatory strategy shift**: re-examine the assumptions, read the history, build a minimal reproduction, find the last known good state, check upstream docs and issues, or try an alternative implementation | repeating the previous approach with a smaller edit. That is the same attempt again, and it does not advance the band |
+| 7-10 | **independent escalation**: a second session, a provider-diverse reviewer, the council, the team with repository access, or a rollback of the slice | anything the same session can decide alone |
+
+## At the bound — five outcomes, in order, and none of them is a count
+
+```
+A COUNT IS NOT A REASON TO ASK. THE BOUND ENDS A STRATEGY, NEVER THE RUN.
+```
+
+1. **The escalation yielded a new strategy** → open a **new epoch**: the attempt
+   counter resets against the new strategy, because the thing the budget was
+   bounding is gone.
+2. **An independent phase can proceed** → continue it. A blocked target is not a
+   blocked run, and the run's other work does not wait on this one.
+3. **The residue is owner-owned** per the ownership table → **one** native ask,
+   naming the residue. This rung is reached by the OWNERSHIP test, never by the
+   count that got here.
+4. **An external prerequisite is objectively missing** — an absent credential, an
+   unreachable service, a decision only the forge can carry → `BLOCKED`, with the
+   evidence that establishes the absence.
+5. **Otherwise** → a new epoch. Running out of ideas is not one of the four above,
+   and converting it into an owner ask is the failure this ladder replaces.
+
+Council and team verdicts reached during band 3 append to the run's
+`## Decisions` — so the next epoch starts from a record rather than from the
+previous epoch's memory of it.
+
+**The allowlist-growth counter is a separate mechanism** with its own threshold
+and its own remedy (fix the tool's shape). It is not a band of this ladder, and
+crossing it does not advance the attempt count — it spends the whole bound for
+that target at once, which is a different statement.
+
+## Read the red before diagnosing it, with the narrowest probe
+
+An attempt that begins from a guess about the failure is not a band-1 attempt; it
+is the first of three that will be spent learning what band 1 was supposed to
+start from. So, before the fix:
+
+- **A CI red** is read with `gh run view --job <id> --log-failed`, filtered
+  (`| grep -E '×|FAIL|Error'`) — never the whole log into context, and **never**
+  `gh pr checks --watch`'s exit code, which is 0 on a failure and 1 when no
+  checks exist at all. Two different wrong answers from one number.
+- **The CI waiter is `ci_settle`**, and it is ONE waiter for the condition: its
+  LAST OUTPUT LINE is the verdict, and a run that reaches no verdict can still
+  exit 0. A hand-written poll loop beside it is the fleet
+  [`context-hygiene`](../../rules/context-hygiene.md) § Waiting is one
+  waiter forbids.
+- **A local red** is read with the runner filtered to the failing name — not the
+  suite, and not a meta-pipeline. Match the probe to the surface: `curl` or a
+  Playwright spec for an HTTP or UI red, the debugger for a runtime frame, the
+  test runner with a filter for a behavior.
+- **Reproduce before believing the diagnosis.** An environment-dependent red
+  reproduces under its condition, not on the machine's defaults.
+
+## The allowlist guard's host reach, and the two corrections it has taken
+
+Migrated out of `autonomous-execution` on 2026-09-13 (P4): the rule keeps the
+obligation, this page carries the host claim and its history. The rule was
+re-sending all of it on every session and every spawn.
+
+`block_config_weakening.ts` counts allowlist entries added per session, warns from
+5, and blocks past 20 — **on `claude` alone**, the one host that both binds
+`pre_tool_use` and honours a deny. It is *bound* on augment and cowork as well and
+ignored there: `host_semantics.ts` verifies claude alone, and both trampolines
+discard dispatcher output and `exit 0` unconditionally. Everywhere else the cap is
+model-carried and "enforced at tool-call time" is not a claim that can be made.
+
+**Corrected 2026-08-17, in both directions.** The sentence used to certify
+augment, claude and cowork as the enforcing set — an over-claim of two hosts — and
+to explain the rest with "the guard has nowhere to bind", which is false for
+cursor, cline and gemini, whose native pre-tool events `native_event_aliases`
+already maps onto `pre_tool_use`: there it is **unbound, not unbindable**. Only
+windsurf and copilot carry no alias row. The four states are tabulated once in
+[`hook-architecture-v1 § Which hosts carry pre_tool_use`](../../docs/contracts/hook-architecture-v1.md).
+
+The sibling rules `git-history-discipline` and `evaluator-independence` qualify
+the identical slot, so an unqualified claim in any of them would read as a
+guarantee the manifest does not give.
+
+## Related
+
+- [`autonomy-mechanics`](autonomy-mechanics.md) — the rest of the autonomy body: opt-in detection, task scope, probe efficiency, the retry-budget ladder.
+- [`terminal-states`](terminal-states.md) — `exhausted` vs `stagnated`, the two words the bound and a repeating signature report.

package/dist/agent-src/contexts/execution/plan-confidence-gate.md

@@ -12,7 +12,9 @@ this context carries the agent-side procedure.
 
 ## Activation
 
-Read `planning.challenge_on_create` from `.agent-settings.yml` once per task
+Read `planning.closure_pass` from `.agent-settings.yml` once per task
+(`planning.challenge_on_create` is the deprecated alias, accepted for one
+minor)
 and cache it. `true` or **missing key** → the gate is active. `false` → the
 gate is inert: proceed with the surface's normal flow, no marker line, no
 interview.
@@ -61,7 +63,7 @@ All four hold → emit **exactly one** marker line, then proceed with the
 surface's normal flow:
 
 ```
-> Confidence ≥ 95% — creating directly (planning.challenge_on_create)
+> Confidence ≥ 95% — creating directly (planning.closure_pass)
 ```
 
 No second marker, no summary of the assessment — one line, then the work.

package/dist/agent-src/contexts/execution/roadmap-process-loop.md

@@ -8,7 +8,30 @@ resolution, commit-step pre-scan, halt conditions, and archival check.
 The three command files are thin wrappers that bind only the **scope
 delta**.
 
-**Size budget:** ≤ 57,000 chars — restated from the original 4,000.
+**Size budget:** ≤ 62,000 chars — restated from 57,000, which the file had
+already outgrown before this edit.
+
+**Restated 2026-09-13, with the reason, because the contract below demands
+one.** The line read 57,000 and the file measured **57,906** on `origin/main`:
+the budget was already false, so the first honest act is to say so rather than
+to inherit it. What this change then added is halt-list CONTENT — the
+`BLOCKED` list aligned row-for-row with ADR-268 § 7, which gained a missing
+owner-owned-decision row, contradictory requirements, technical impossibility
+under the stated constraints and an authority crossing, and moved a failed
+first approach and dependency trouble to the not-blocked side. That list is
+read at the moment a run decides whether it may stop; behind a pointer it
+would be read later or not at all, which is the one place in this file where
+depth is the point.
+
+Everything about the change that is EXPLANATORY rather than decisive was moved
+out instead, to [`decision-closure-execution`](decision-closure-execution.md):
+the `## Decisions` row shape and reopen rule, the per-class mid-run residue
+table, and what `blocked-by:` may point at after the retirement. The file grew
+by 2.4k where a naive edit would have grown it by 7.6k.
+
+**Still a ratchet, and still enforced by nothing.** The next edit inherits
+62,000, not a license to keep restating. Splitting the halt list out is the
+real repair and it is a change of its own.
 
 The old figure described nothing: the file measured 47,115 bytes against it, a
 factor of 11.8, so it was a dead budget rather than a typo. Restated at the
@@ -143,6 +166,20 @@ does not fire.
 
 ## 3. Pre-scan — execution contract or commit-step ask
 
+### 3-0. Read `## Decisions` — before any step, once per run
+
+```
+THE `## Decisions` TABLE IS READ BEFORE THE FIRST STEP, NOT WHEN A STEP TRIPS OVER IT.
+A ROW IN IT IS A CLOSED DECISION. NEVER RE-DERIVE ONE. NEVER RE-ASK ONE.
+A CLOSED DECISION REOPENS ONLY WHEN ITS `revisit if` CONDITION BECAME TRUE —
+NEVER BECAUSE A CONTEXT RESET LOST IT, AND NEVER BECAUSE THE ANSWER LOOKS ODD.
+```
+
+Read it whole and cache it for the run alongside the cadences (§ 4). No section
+is not an error — a plan that closed everything inline carries none. Row shape,
+the three consequences during a run, and the reopen rule:
+[`decision-closure-execution`](decision-closure-execution.md).
+
 ### 3a. Mode derivation ladder — first source wins
 
 ```
@@ -651,6 +688,19 @@ For each open step in the working set (scope-bound — see wrapper):
    A loop iteration that lands work without flipping its box is a
    rule violation. Do not save flips for the archive commit.
 
+### 5a-residue. Mid-run residue — the same ownership table, inline
+
+```
+A DECISION THE RUN MEETS MID-STEP IS ROUTED BY THE SAME TABLE THAT CLOSED THE
+PLAN. TECHNICAL RESIDUE RESOLVES INLINE AND IS APPENDED TO `## Decisions` WITH
+THE STEP ID. IT NEVER BECOMES A QUESTION, AND IT NEVER BECOMES A HALT.
+OWNER-OWNED RESIDUE ASKS **ONLY IF THE STEP CANNOT PROGRESS**. OTHERWISE THE
+STEP IS PARKED, INDEPENDENT PHASES CONTINUE, AND THE RUN COMES BACK TO IT.
+```
+
+Per-class routing, why parking is not deferring, and the scope-growth pointer:
+[`decision-closure-execution`](decision-closure-execution.md).
+
 ### 5b. Flip-guard — deterministic
 
    Before advancing to step 6, run:
@@ -884,16 +934,35 @@ BEFORE REPORTING IT, ASK PER REMAINING STEP: CAN I DO THIS AT ALL?
 ONE STEP THE AGENT COULD HAVE EXECUTED REJECTS THE CLAIM.
 ```
 
-**Externally impossible — the whole list.** A required credential that does not
-exist and the agent cannot create · a purchase beyond the delegated budget ·
-physical hardware access · another person or organisation must act · a wait that
-is factually mandatory and cannot be simulated or verified.
+**Externally impossible — the whole list**, aligned with ADR-268 § 7. A missing
+**owner-owned** decision — `product-owned`, `business-owned` or
+`destructive-owned`, and nothing else · a missing permission, secret or access ·
+a required credential that does not exist and the agent cannot create · a
+purchase beyond the delegated budget · physical hardware access · another person
+or organisation must act · a wait that is factually mandatory and cannot be
+simulated or verified · contradictory requirements · technical impossibility
+under the stated constraints · a needed crossing of a real authority boundary.
 
 **Not externally impossible — every one of these is work.** An unprotected
 branch · a branch to create · a push · a PR to open · a repository or branch
 setting the agent can change · a workflow to start · CI to re-run · a merge base
 to update · conflicts · failing tests · local configuration · a paid call under
-the ceiling · "this could be risky" · "a maintainer should do this".
+the ceiling · a failed first approach · dependency trouble · "this could be
+risky" · "a maintainer should do this".
+
+```
+A SOLVABLE ARCHITECTURAL AMBIGUITY IS NOT `BLOCKED`. IT IS A DECISION.
+A TECHNICAL JUDGEMENT CALL IS NEVER PARKED IN A FILE — IT ROUTES BACK THROUGH
+CLOSURE AND IS RESOLVED AT THE LOWEST RUNG THAT OWNS IT: EVIDENCE, CONVENTION,
+THE AGENT, AN INDEPENDENT SESSION, THE COUNCIL, THE TEAM.
+A COUNT IS NEVER A QUESTION — A BOUNDED LOOP'S BOUND TRIGGERS A STRATEGY CHANGE
+AND THE ESCALATION LADDER, NEVER AN OWNER QUESTION (ADR-268 § 7).
+```
+
+`blocked-by:` stays — it is how `run-continuation` reads blockedness — but a
+blocker entry is the record of a decision the agent **correctly did not own**;
+what it may point at narrows accordingly
+([`decision-closure-execution`](decision-closure-execution.md)).
 
 The `[~]` prohibition is load-bearing and was the one point the council split on.
 Deferring a blocked step to `[~]` would let the run reach `count_open == 0` and

package/dist/agent-src/guidelines/agent-infra/active-remediation-mechanics.md

@@ -93,6 +93,63 @@ Update stale idioms to the version the project **actually runs** — but only wh
 - Subordinate to `no-cheap-questions` (self-check items 3 & 14 — real trade-off, not a disguised continuation/commit ask), `autonomous-execution` (the end-of-session batch must not read as "shall I continue?"), `user-interaction`, `ask-when-uncertain` (one batched prompt = one question).
 - Threshold to surface at all: a **real, nameable** improvement with a concrete benefit. Cosmetic nitpicks with no trade-off → drop silently. The live-security carve-out is the only case that interrupts or overrides autonomy.
 
+## The other axis — who owns the growth
+
+The ladder above sizes a change: *is this small and aligned enough to do now.*
+It does not say **whose decision it is**, and both must clear before work
+happens inline — something small and council-owned is still not the agent's to
+decide, and something agent-owned and large is still bounded by
+`minimal-safe-diff`.
+
+Three closed lists answer the ownership half: six agent-owned kinds (done
+inline, recorded as a scope delta in the PR body, never asked about), four
+council-owned (routed through the ownership ladder, reaching the owner in none
+of them), and two owner-owned. Anything matching none of them is not scope
+growth at all — it is a follow-up artifact, and the mission does not expand to
+hold it.
+
+Full enumeration: [`scope-growth-ownership`](../../contexts/authority/scope-growth-ownership.md).
+One item classifies deterministically with
+`./scripts-run src/scripts/scope_growth "<description>"`; `unknown` is a real
+verdict there, never a fallback to the cheapest rung.
+
+## Inside a mission — the middle rung becomes an artifact
+
+`road-to-adversarial-verification-and-long-runs` 6.1. The ladder's middle rung is
+**note + ask**, and inside an autonomous mission there is nobody to ask. Left
+unreplaced the rung collapses in one of two bad directions, and both are failures
+this suite already names: every spotted issue becomes a fix (the scope creep
+[`minimal-safe-diff`](minimal-safe-diff-mechanics.md) exists to stop), or every
+one becomes silence (the look-away `active-remediation` exists to stop).
+
+So under a mission the middle rung is **emit a follow-up artifact and leave the
+code alone**.
+
+**What may ride along at all** — nine kinds, and the list is closed:
+characterization tests · regression tests · a small adjacent bug · naming · types
+· robustness · local dead code · simplifying code the mission already touched ·
+testability.
+
+**Six criteria, ALL of which must hold** for one of those to ride along: local to
+the path the mission is already touching · small · low blast radius · clearly
+correct · testable in the same commit · carries no new product decision.
+
+```
+THE SIX ARE AND-ED, NEVER SCORED.
+A SCORED VERSION LETS A LARGE CHANGE BUY ITS WAY IN WITH FIVE CHEAP YESES,
+WHICH IS HOW A BOY-SCOUT RULE BECOMES A REFACTOR LICENCE.
+```
+
+The **characterisation is the agent's judgement; the DECISION is mechanical** —
+`_lib/rides_along.ts` takes the six booleans and returns the rung, so the same
+inputs always land the same way and a later reader can check the call rather than
+re-litigate the taste.
+
+**A deferral states every reason it was deferred**, not the first one it hit. The
+artifact exists because the issue is still owed, and "it failed one of six" is not
+something a later triage can act on. A deferral with no reason is the
+note-and-forget this rule already forbids, wearing an artifact's clothes.
+
 ## See also
 
 - [`active-remediation`](../../rules/active-remediation.md) — the rule this file details (Iron Law + ladder + live-security carve-out).

package/dist/agent-src/guidelines/agent-infra/evaluator-independence-mechanics.md

@@ -86,6 +86,108 @@ point: this rule exists because a process that *looked* followed produced
 fabricated evidence, and claiming coverage it does not have would repeat that.
 
 
+## The audited failure, in full
+
+Migrated out of the rule on 2026-09-13 under the same P4 pattern the rest of this
+page follows: the rule keeps the obligation, this page carries the record. The
+rule was re-sending all of it on every session and every spawn.
+
+Measured, once, at maximum cost (conformance audit 2026-08-06):
+
+> The agent dispatched a "blind reviewer" over its own change. It wrote that
+> reviewer's prompt itself, put **"NO-FINDINGS is expected and welcome"** into it,
+> and narrowed the scope to four files it chose. The reviewer returned
+> NO-FINDINGS. That honest-null was committed as **binding gate evidence**. An
+> unsteered pass over the same delta later found 5 findings, one of them
+> critical, already live on the trunk.
+
+The agent's own retro named it exactly, in the maintainer's own words:
+
+*DE: "Die Fabrikation lag nicht im Weglassen des Reviews — sie lag in meinem Prompt. Ich habe die Antwort vorgeladen und dann als Evidenz verbucht." · EN: "The fabrication was not in skipping the review — it was in my prompt. I pre-loaded the answer and then booked it as evidence."*
+
+The review ran. The process was followed. The evidence was manufactured anyway.
+
+## The softer form — why the phrase list cannot see it
+
+The Iron Law forbids **authoring the verdict** into an evaluator's prompt. There
+is a weaker move that evades it while doing the same work, and it is the one an
+orchestrator reaches for without noticing: **stating an expectation**.
+
+*"NO-FINDINGS is expected"* is a prediction, not a verdict — and it steered a real
+review into an honest-null that five findings on the trunk later refuted. A prompt
+that says what the author thinks the answer is has authored the answer, whatever
+grammatical mood it used. The guard's pre-loaded-verdict detector is a PHRASE
+list, so it catches recurrences of known steering wording and not steering as
+such; this distinction is the gap it cannot close, which is why the obligation is
+stated in the rule rather than delegated to the detector.
+
+## Tests are evaluators — levels, workflow, and the weakening ladder
+
+`road-to-adversarial-verification-and-long-runs` Phase 2. The rule states the
+obligation; this section carries the detail it points at.
+
+### The five levels
+
+| Level | Author | What it actually buys |
+|---|---|---|
+| **L0** | the same agent, same session | nothing against self-confirmation. **Fallback only** — permitted when no other route exists, and then said out loud. |
+| **L1** | another session, same model | a fresh context. **Not** a different judgement: with one provider configured this is the same model reviewing its own work, holding a label that says otherwise. |
+| **L2** | another model | different training, different blind spots. The first level that buys a genuinely second opinion. |
+| **L3** | another provider | independent training data, independent failure modes, independent incentives. |
+| **L4** | a multi-provider council or team | L3 plus disagreement that is visible rather than averaged away. |
+
+**Critical behavior — security, authority, data loss, merge control — targets
+L3 or L4 wherever two providers are configured.** Wherever, not always: with one
+provider the honest ceiling is L2, and the level is read from `agent-config
+council:status`'s actual provider count rather than assumed from a config file
+that may describe an intention.
+
+### The workflow
+
+```
+acceptance behaviour → INDEPENDENT AUTHOR → RED evidence → implementer → GREEN
+→ INDEPENDENT VALIDATOR
+```
+
+Five arrows, and the two capitalised roles are the ones that may not be the
+implementer. **RED evidence** is not ceremony: a test never shown red has unknown
+sensitivity, so a suite that was green from the first run has proven nothing
+about the code and everything about the assertions being vacuous.
+
+### What an implementer may never do silently
+
+Weaken an assertion · delete a failing test · skip or `xfail` it · loosen a
+threshold · change fixture semantics to fit the code.
+
+Each of these is a legitimate change *sometimes*, which is exactly why the
+prohibition is on doing it **silently** rather than on doing it. Where the test
+genuinely looks wrong, the ladder is: **evidence** (what the test asserts, what
+the code does, why they disagree) → **independent test review** → **council or
+team** → change only after an independent verdict.
+
+**The owner is not the arbiter.** Routing this to the owner converts a technical
+disagreement the tree can settle into an interrupt only the owner can clear, and
+it is the same count-to-an-ask move the recovery ladder removes.
+
+### Test-quality validation — one question, before delivery
+
+*Would these tests fail under plausible wrong implementations?* An independent
+instance answers it, looking for: tautologies · algorithm duplication (the test
+re-implements the thing it is testing, so both are wrong together) · snapshot
+overuse · missing boundary and error cases · over-mocking (the mock, not the
+code, is what passes) · expectations changed to fit the code · a test never shown
+red.
+
+The validator's **identity and provider go into the evidence**. An unattributed
+validation is not one — it cannot be checked for the independence it claims, and
+`evaluator-independence`'s own recorded failure is exactly a verdict nobody could
+trace back to the prompt that produced it.
+
+This is deliberately **not** mutation-testing infrastructure (K3 of that
+roadmap). Mutation testing is the industrial form of the same question; one
+independent instance asking it in prose is the cheap first form, and shipping the
+cheap form now beats deferring the question until the infrastructure exists.
+
 ## See also
 
 - [`evaluator-independence`](../../rules/evaluator-independence.md) — the rule this page carries the argument for.