@event4u/agent-config 16.2.0 → 16.4.0

package/dist/scripts/_lib/thin_rules.js

@@ -0,0 +1,535 @@
+/**
+ * The thin-projection MECHANISM, with no CLI entry of its own.
+ *
+ * Extracted from `src/scripts/project_thin_rules.ts` for
+ * `road-to-an-installed-layer-that-is-thinned` step 1.1, which needs the
+ * INSTALLER to apply the projector's own predicate to `~/.claude/rules`.
+ *
+ * THE EXTRACTION IS THE POINT, NOT TIDYING. `src/scripts/install.ts` is the
+ * `build:install-bundle` entry, and `check_installer_import_purity` fails the
+ * build when any module reachable from it carries a module-level
+ * `process.exit()` — including the guarded `if (isMain) process.exit(main())`
+ * shape, which that gate's own test names as "the real incident shape".
+ * `project_thin_rules.ts` carries exactly that at its foot, so the installer
+ * could not import it. The two live alternatives were both worse: a second
+ * implementation of the stub form inside `src/install/` is the duplicate-reader
+ * defect this repository has already paid for twice (the `lean_projection.mode`
+ * header records the latest), and moving the CLI instead would break every
+ * caller of `project_thin_rules --measure`.
+ *
+ * So the mechanism moves and the CLI stays. `project_thin_rules.ts` re-exports
+ * every name below, so no existing importer changes.
+ *
+ * Nothing here runs on import, nothing here writes, and nothing here calls
+ * `process.exit`. `measure`, `write_thin`, the JSON dumper and the CLI remain in
+ * `project_thin_rules.ts`.
+ */
+import { createHash } from 'node:crypto';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { lawText, ruleBody } from './rule_law_section.js';
+import { readConsequenceClass, stubLawIds, } from './rule_consequence_class.js';
+import { pathOnlyRuleIds, triggerlessRuleIds, } from './rule_injection.js';
+const _HERE = fileURLToPath(import.meta.url);
+/**
+ * The package root.
+ *
+ * FOUR levels up, not three: this module sits at `src/scripts/_lib/`, one
+ * directory deeper than the `src/scripts/<file>` the arithmetic was written for.
+ * Keeping the old `'..','..'` here would have resolved to `src/` and every
+ * default root below would have been silently wrong — the extraction's one
+ * genuine hazard, so it is stated rather than left to be noticed.
+ *
+ * Correct for a module READ FROM SOURCE. A bundled caller must hand its own
+ * package root over via {@link ThinRoots}; see that interface for why.
+ */
+export const REPO_ROOT = path.resolve(path.dirname(_HERE), '..', '..', '..');
+export const RULES_SOURCE = path.join(REPO_ROOT, 'dist/agent-src', 'rules');
+export const ROUTER = path.join(REPO_ROOT, 'dist', 'router.json');
+/** `sorted(dir.glob("*.md"))` — non-recursive, lexically sorted abs paths. */
+export function _globSortedMd(dir) {
+    let names;
+    try {
+        names = fs.readdirSync(dir);
+    }
+    catch {
+        return [];
+    }
+    const out = names.filter((n) => n.endsWith('.md')).map((n) => path.join(dir, n));
+    out.sort();
+    return out;
+}
+/** The always-full-bodied set — authoritative kernel list from the router. */
+export function kernel_ids(routerPath = ROUTER) {
+    const data = JSON.parse(fs.readFileSync(routerPath, 'utf-8'));
+    const kernel = data.kernel;
+    if (Array.isArray(kernel)) {
+        return new Set(kernel.map((x) => String(x)));
+    }
+    return new Set();
+}
+/**
+ * Tier rules the router gives NO trigger at all.
+ *
+ * These cannot be delivered on a match, so thinning them would remove a body
+ * that nothing can ever put back — a silent hole rather than a saving. They
+ * project full-bodied, and `measure` reports them by name so the residue is
+ * visible instead of being absorbed into the pointer count
+ * (road-to-trigger-delivered-rule-bodies 1.3).
+ */
+/**
+ * Rules whose ONLY triggers are path-shaped — reachable from `pre_tool_use`
+ * and from no other slot (road-to-delivery-for-every-host 3.2).
+ *
+ * They must never be thinned while the delivery concern is NOT bound on
+ * `pre_tool_use`, because a stub plus a slot nobody listens on is a rule that
+ * reaches the model at no scope at all. This is the same failure the
+ * `no_trigger_ids` exemption prevents, one step out: there the rule has nothing
+ * to match on, here it has nothing to match ON.
+ *
+ * Stated as a PROPERTY rather than a list of ids. If the concern is ever bound
+ * on `pre_tool_use` again, this exemption is what should be reconsidered — not
+ * three names someone has to remember.
+ *
+ * WHAT THIS EXEMPTION DOES **NOT** COVER — recorded 2026-09-08, R2 finding 1,
+ * because the silence read as coverage. The predicate is `every` trigger
+ * path-shaped. A rule with BOTH path and non-path triggers is therefore THINNED,
+ * and its path-shaped half then has no carrier at all: the stub carries no
+ * frontmatter (`condense.ts` writes it with `_writeText`, bypassing
+ * `_emit_claude_rule`'s host-native `paths:` key), `pre_tool_use` lost the
+ * binding under owner ruling E2, and `user_prompt_submit` never populates
+ * `openFiles`. Measured over the current `dist/router.json`: **18 such rules**,
+ * all non-kernel and all thinned — augment-edit-discipline, design-fidelity,
+ * doc-screenshot-hygiene, domain-adoption-policy,
+ * framework-neutrality-in-generic-skills, image-likeness-and-rights,
+ * laravel-translations, lethal-trifecta-guard, linked-projects-onboarding-gate,
+ * low-impact-corpus-privacy-floor, markdown-safe-codeblocks, onboarding-gate,
+ * persona-governance, php-coding, provider-lifecycle-discipline,
+ * roadmap-ci-steps-policy, roadmap-progress-sync, settings-ask-protocol.
+ *
+ * They do NOT reach the model at no scope: every non-path route
+ * (keyword / phrase / command) still delivers the body through the concern, and
+ * on `claude-code` they never had a separate host-native path route to lose —
+ * `_claude_paths_plan` emits no `paths:` for a mixed-trigger rule on purpose, so
+ * under `eager-all` they loaded UNCONDITIONALLY. What is lost is the difference
+ * between unconditional and prompt-triggered: a session that touches a matching
+ * file and says nothing that matches gets nothing.
+ *
+ * The labelled corpus cannot see this and the endpoint says so rather than
+ * implying otherwise — `model_rule_injection --endpoints` (b) now publishes the
+ * shipped `user_prompt_submit` reach beside the pre-registered reading, and
+ * every one of these 18 has at least one prompt-matching positive, so none
+ * appears in its "reachable only via a path trigger" column.
+ *
+ * WHY THIS IS NOT WIDENED TO `some` HERE. Measured: exempting all 18 moves the
+ * thin rule layer 23,592 -> 39,921 GPT tok (+16,329, +69 %), which is a budget
+ * move of a magnitude no agent may take, and it would erase most of the saving
+ * the flip is licensed on. Restoring a path route needs either that exemption
+ * under a re-anchored baseline or a `pre_tool_use` binding under a raised slot
+ * cap — both owner-reserved, so the closure is tracked rather than taken here.
+ * ADR-267's Consequences section names the receiver.
+ */
+/**
+ * ONE spelling of the router-derived sets, shared with the injector (R2
+ * finding 11).
+ *
+ * `path_only_ids` and `no_trigger_ids` were each a second, hand-rolled
+ * implementation of `_lib/rule_injection.ts::pathOnlyRuleIds` /
+ * `triggerlessRuleIds` — verified identical over the current router at the time
+ * (symmetric difference empty), so drift risk rather than a live defect. It is
+ * exactly the hazard `THIN_ENTRY_MARKER`'s own comment argues against one
+ * screen below ("a gate that re-spelled this string would drift from the writer
+ * silently"), and the two consumers here are the PROJECTOR's exemption set and
+ * the INJECTOR's reachability set: they must not be able to disagree about which
+ * rules the delivery path can reach.
+ *
+ * The finding named `path_only_ids`. The defect-pattern sweep found the SECOND
+ * instance one function down — `no_trigger_ids` against `triggerlessRuleIds` —
+ * and it is delegated in the same change. Count: 2 of 2 duplicated
+ * router-derived sets in this file, 0 remaining.
+ */
+function _router(routerPath = ROUTER) {
+    return JSON.parse(fs.readFileSync(routerPath, 'utf-8'));
+}
+export function path_only_ids(routerPath = ROUTER) {
+    return pathOnlyRuleIds(_router(routerPath));
+}
+export function no_trigger_ids(routerPath = ROUTER) {
+    return new Set(triggerlessRuleIds(_router(routerPath)));
+}
+/**
+ * id → workspaces for every non-kernel router entry (router.json schema v2,
+ * road-to-request-scoped-rule-load Phase 1). Rules absent from the map (or
+ * with an empty list) fail safe: they stay in scope.
+ */
+export function rule_workspaces_map(routerPath = ROUTER) {
+    const data = JSON.parse(fs.readFileSync(routerPath, 'utf-8'));
+    const map = new Map();
+    for (const tier of ['tier_1', 'tier_2']) {
+        const entries = data[tier];
+        if (!Array.isArray(entries))
+            continue;
+        for (const e of entries) {
+            const obj = e;
+            const ws = Array.isArray(obj.workspaces) ? obj.workspaces.map((w) => String(w)) : [];
+            map.set(String(obj.id), ws);
+        }
+    }
+    return map;
+}
+/**
+ * Whether a rule id survives a workspace scope. Kernel always survives;
+ * `scope === null` = legacy-all. An out-of-scope non-kernel rule is dropped
+ * entirely — neither body nor pointer line (the pointer floor shrinks with
+ * consumer scoping).
+ */
+export function id_in_scope(rule_id, scope, kernel, wsMap, fallback_ws = []) {
+    if (scope === null || kernel.has(rule_id)) {
+        return true;
+    }
+    // Router map first (schema v2); `type: manual` rules are reference-only
+    // and never emitted to the router — their frontmatter is the fallback.
+    const ws = wsMap.get(rule_id) ?? fallback_ws;
+    if (ws.length === 0) {
+        return true; // untagged / unknown → fail safe
+    }
+    return ws.some((w) => scope.includes(w));
+}
+/** `workspaces:` list parsed straight from a rule file's frontmatter. */
+export function fm_workspaces(text) {
+    const [fm] = split_frontmatter(text);
+    // Flow style: `workspaces: [a, b, c]`
+    const flow = /^workspaces:[ \t]*\[([^\]]*)\]/m.exec(fm);
+    if (flow) {
+        return flow[1]
+            .split(',')
+            .map((s) => s.trim().replace(/^["']|["']$/g, ''))
+            .filter((s) => s.length > 0);
+    }
+    // Block style; tolerate the list being the LAST frontmatter key.
+    const m = /^workspaces:[ \t]*\n((?:[ \t]+-[ \t]+.*(?:\n|$))+)/m.exec(fm);
+    if (!m) {
+        return [];
+    }
+    return [...m[1].matchAll(/-[ \t]+(\S+)/g)].map((x) => x[1]);
+}
+/** Return [frontmatter_including_fences, body]. Empty fm if none. */
+export function split_frontmatter(text) {
+    if (text.startsWith('---\n')) {
+        const end = text.indexOf('\n---\n', 4);
+        if (end !== -1) {
+            return [text.slice(0, end + 5), text.slice(end + 5)];
+        }
+    }
+    return ['', text];
+}
+function _description(fm) {
+    // re.search(r'^description:\s*"?(.+?)"?\s*$', fm, re.MULTILINE)
+    const m = /^description:\s*"?(.+?)"?\s*$/m.exec(fm);
+    return m ? m[1].trim() : '';
+}
+// How many trigger keywords/phrases to surface as the always-on match hint.
+const _TRIGGER_HINT_LIMIT = 6;
+/** A short, comma-joined sample of the rule's trigger keywords/phrases. */
+function _trigger_hint(fm) {
+    const hits = [];
+    // re.finditer(r'^\s*-\s*(?:keyword|phrase):\s*"?(.+?)"?\s*$', fm, re.MULTILINE)
+    const re = /^\s*-\s*(?:keyword|phrase):\s*"?(.+?)"?\s*$/gm;
+    let m;
+    while ((m = re.exec(fm)) !== null) {
+        hits.push(m[1].trim());
+        if (hits.length >= _TRIGGER_HINT_LIMIT) {
+            break;
+        }
+    }
+    return hits.join(', ');
+}
+/** Python `str.title()` — uppercase first alpha of each run, rest lowercase. */
+function _title(s) {
+    return s.replace(/[A-Za-z]+/g, (w) => w.charAt(0).toUpperCase() + w.slice(1).toLowerCase());
+}
+/**
+ * The marker that makes a projected entry recognisable as a stub.
+ *
+ * Exported so the WRITER and every DETECTOR share one definition. A gate that
+ * re-spelled this string would drift from the writer silently, and the failure
+ * would be invisible in exactly the direction that matters: a stub the gate
+ * fails to recognise reads as a complete rule body. Two gates had done exactly
+ * that until step 2.1 of `road-to-a-thinned-layer-measured-in-one-unit`; both
+ * import this now.
+ *
+ * SHORTENED 2026-10-06 from 47 characters to 27 (step 2.2). It is paid once per
+ * stub and there were 89 stubs on the measured layer, so the sentence cost
+ * 4,183 characters of a 97,496-character standing total; at 27 it costs 2,403,
+ * a saving of 1,780 = 20 x 89.
+ *
+ * WHAT THE SHORTENING WAS NOT ALLOWED TO DO: drop the instruction. This is the
+ * only standing text in the whole layer that says what a stub is FOR — "load
+ * the body" occurs in no kernel rule and in neither root instruction file — so
+ * a bare token like `> thin` would have saved more and left nothing that could
+ * be followed. The decision record (D2, K6) rejected that explicitly: nothing
+ * in this repository can check whether an instruction nobody states is still
+ * obeyed.
+ *
+ * WHY IT MUST STAY LONG ENOUGH TO BE UNIQUE: {@link is_thin_entry} is a
+ * substring test over the whole file, so a marker short or generic enough to
+ * occur inside ordinary rule prose would make that rule read as a stub — and
+ * nine rule files carry blockquote lines. `thin_marker_unique_in_corpus.test.ts`
+ * runs the constant against every rule body in `src/rules/` and against every
+ * entry `build_thin` emits, in both directions, which is the check that bounds
+ * any further shortening.
+ */
+export const THIN_ENTRY_MARKER = '> Load the body on a match.';
+/** Is this projected entry a pointer stub rather than a rule body? */
+export function is_thin_entry(text) {
+    return text.includes(THIN_ENTRY_MARKER);
+}
+/**
+ * What introduces a stub's body pointer. One writer, one reader.
+ *
+ * A BARE PATH SINCE 2026-10-06 (step 2.3 of
+ * `road-to-a-thinned-layer-measured-in-one-unit`). The pointer used to be a
+ * markdown link, ``Body: [`<id>`](<prefix><id>.md)``, whose link TEXT repeated
+ * the rule id the target already ends in. That cost `6 + len(id)` per stub over
+ * the bare form — 2,359 characters across the 89 stubs of the measured layer,
+ * 534 of it pure syntax and the rest the id written a second time.
+ *
+ * Nothing followed the link as a link. Under `delivery` the hook loads the body
+ * and never reads the pointer at all; under `thin` an agent reads the path. A
+ * markdown link renders in neither case, so the syntax bought rendering nobody
+ * was doing.
+ */
+export const THIN_BODY_POINTER_PREFIX = 'Body: ';
+/**
+ * The pointer, as the WRITER emits it — exported so a detector cannot re-spell
+ * it, which is the same drift {@link THIN_ENTRY_MARKER} documents one screen up
+ * and which two gates had already committed there.
+ *
+ * WHAT IT CAPTURES is the whole tail of the line from `Body: ` to its end, and
+ * that is the intended semantic rather than an accident of greediness: the
+ * writer emits the pointer LAST on its line, so the tail IS the path. A review
+ * round proposed a lazy `(.+?\.md)` to stop at the first `.md`; measured, it
+ * changes nothing, because `\s*$` forces the match to reach end of line either
+ * way and a lazy quantifier simply backtracks forward to the same place. The
+ * greedy form is kept and the property is pinned by a test, so the next reader
+ * meets the measurement instead of repeating the proposal.
+ *
+ * ANCHORED TO END OF LINE, NOT `\S+`. The pointer is the last thing on its
+ * line, and a package root may contain spaces; `\S+` would silently stop at the
+ * first one and report a well-formed pointer as missing.
+ *
+ * COMPOSED FROM {@link THIN_BODY_POINTER_PREFIX} rather than re-spelling it.
+ * The constant exists so a reader cannot hold its own copy, and a pattern six
+ * lines below it holding a literal `Body: ` would have broken that invariant in
+ * the file that states it.
+ */
+export const THIN_BODY_POINTER_RE = (() => {
+    const lit = THIN_BODY_POINTER_PREFIX.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    // THE LAST PREFIX ON THE LINE, NOT THE FIRST. `thin_entry` puts the rule's
+    // own `description` on the SAME line ahead of the pointer, so a description
+    // containing the literal `Body: ` used to start the match inside the
+    // description and capture it as part of the path — `has_body_pointer` stayed
+    // true while the extraction was wrong, which is a wrong assertion rather
+    // than a visible failure. Forbidding a second prefix inside the capture
+    // makes the first viable start the last occurrence, which is the pointer.
+    return new RegExp(`${lit}((?:(?!${lit}).)+\\.md)\\s*$`, 'm');
+})();
+/** Does this entry carry a body pointer the writer would recognise? */
+export function has_body_pointer(text) {
+    return THIN_BODY_POINTER_RE.test(text);
+}
+/**
+ * Where a stub tells a reader the body actually is.
+ *
+ * FIXED 2026-09-07: this pointed into the uncondensed source tree ADR-051
+ * retired — the literal path is deliberately NOT reproduced here, because
+ * `check_no_uncondensed_refs` matches the string and cannot tell a repair
+ * record from a live reference; `git log -S` on this file finds the old value.
+ * It exists in no checkout, so EVERY stub's fallback pointer
+ * resolved to nothing — invisible under `delivery`, where the hook loads the
+ * body from `dist/agent-src/rules` and never follows this link, and total under
+ * `thin`, where the pointer is the only path to the body there is.
+ *
+ * KNOWN LIMIT, stated rather than discovered later: one relative prefix cannot
+ * be right for every tree, because they sit at different depths — `.claude/rules`
+ * and `.cursor/rules` are two levels below the repo root and `.clinerules` is
+ * one. `../../` is correct for the first two, which are the only trees the
+ * shipped `lean_projection.hosts` default can thin. A stub in `.clinerules`
+ * needs an operator to have added `cline` to that list, and its pointer is off
+ * by one level. That is strictly better than the previous state, where the
+ * pointer was dead in all three, and it is recorded here so the remaining case
+ * is a known limit rather than a surprise.
+ */
+const BODY_LINK_PREFIX = '../../dist/agent-src/rules/';
+/**
+ * The absolute body-link prefix for a tree whose rules were installed OUT of the
+ * repository — `~/.claude/rules`, where no relative prefix can be right.
+ *
+ * The limit documented on {@link BODY_LINK_PREFIX} is a statement about trees at
+ * a KNOWN depth below a repo root. An installed layer has no such relation to
+ * the package at all: `~/.claude/rules/x.md` and `<pkg>/dist/agent-src/rules/x.md`
+ * share no common ancestor the installer may assume, so the only prefix that can
+ * resolve is one rooted at the package the install was made from. The installer
+ * knows that path (`package_root`), which is why this takes it rather than
+ * deriving it from `import.meta.url` — inside a bundled CLI that arithmetic
+ * yields the parent of the package, the same miss `lean_projection_mode`'s header
+ * records for the template read.
+ *
+ * KNOWN LIMIT, stated rather than found later: the pointer is as durable as the
+ * package directory it names. A global `npm i -g` install is durable; an `npx`
+ * run is not, and a stub written from an ephemeral package root points at a path
+ * that will not exist afterwards. That is strictly better than the project-
+ * relative prefix, which resolves from an installed layer NEVER, and under
+ * `delivery` the hook loads the body and does not follow this link at all.
+ */
+export function absoluteBodyLinkPrefix(packageRoot) {
+    return `${path.join(path.resolve(packageRoot), 'dist', 'agent-src', 'rules')}${path.sep}`;
+}
+/** Build the minimal progressive-disclosure pointer for a non-kernel rule. */
+export function thin_entry(rule_id, text, bodyLinkPrefix = BODY_LINK_PREFIX) {
+    const [fm] = split_frontmatter(text);
+    const desc = _description(fm);
+    const hint = _trigger_hint(fm);
+    const title = _title(rule_id.replace(/-/g, ' '));
+    const fires = hint ? ` Fires on: ${hint}.` : '';
+    return (`## ${title}\n` +
+        `${THIN_ENTRY_MARKER}${fires} ${desc} ` +
+        `${THIN_BODY_POINTER_PREFIX}${bodyLinkPrefix}${rule_id}.md\n`);
+}
+/**
+ * The marker that opens a stub's copied law block, and the one that closes it
+ * with the digest of what was copied.
+ *
+ * Exported for the same reason {@link THIN_ENTRY_MARKER} is: a detector that
+ * re-spelled either string would drift from the writer silently, and the
+ * failure would read as "this stub carries no law" — the one direction that
+ * matters.
+ */
+export const STUB_LAW_OPEN = '<!-- law: byte-copied from the rule, sha256 ';
+export const STUB_LAW_CLOSE = '<!-- /law -->';
+/** Short digest of a law text — the same function the stub writer and any reader use. */
+export function lawDigest(law) {
+    return createHash('sha256').update(law, 'utf-8').digest('hex').slice(0, 16);
+}
+/**
+ * Raised when a class member cannot carry its law and has not said so.
+ *
+ * The roadmap's own words: a class member whose law section is missing or over
+ * the ceiling FAILS the projection rather than shipping a shortened copy. The
+ * declared `no_stub` subset is the escape, and it costs a reason in the diff —
+ * which is the whole difference between an exception and a silent shrink.
+ */
+export class StubLawError extends Error {
+    ruleId;
+    constructor(ruleId, message) {
+        super(message);
+        this.name = 'StubLawError';
+        this.ruleId = ruleId;
+    }
+}
+/** Characters of law a stub may carry — the hard ceiling `lint_rule_law_section` holds. */
+export const STUB_LAW_MAX_CHARS = 2_000;
+/**
+ * A stub that carries the rule's own law, byte for byte.
+ *
+ * The council rejected a compiled or summarised contract: a second
+ * authoritative representation of a rule is a new trust boundary whose
+ * omissions read as permission. So nothing here rewrites, truncates or
+ * reformats — the law text is `slice`d out of the source body and emitted
+ * verbatim, and the digest beside it is what makes "verbatim" checkable rather
+ * than asserted.
+ */
+export function thin_entry_with_law(rule_id, text, bodyLinkPrefix = BODY_LINK_PREFIX) {
+    const law = lawText(ruleBody(text));
+    if (law === null) {
+        throw new StubLawError(rule_id, `${rule_id} is a high-consequence class member with no law section — write one, or ` +
+            `record it under \`no_stub\` in src/config/rule-consequence-class.json with the reason`);
+    }
+    if (law.length > STUB_LAW_MAX_CHARS) {
+        throw new StubLawError(rule_id, `${rule_id} is a high-consequence class member whose law section is ${law.length} chars, ` +
+            `over the ${STUB_LAW_MAX_CHARS} ceiling — a stub never ships a shortened copy, so either ` +
+            'the law moves under the ceiling or the rule is recorded under `no_stub` in ' +
+            'src/config/rule-consequence-class.json with the reason');
+    }
+    return (thin_entry(rule_id, text, bodyLinkPrefix) +
+        `\n${STUB_LAW_OPEN}${lawDigest(law)} -->\n` +
+        `${law}\n` +
+        `${STUB_LAW_CLOSE}\n`);
+}
+/** Map {filename: thin_or_full_text} for every rule. Kernel stays full. */
+export function build_thin(rules_dir = RULES_SOURCE, scope = null, 
+/**
+ * Optional sink for the D3 diagnostic
+ * (road-to-delivery-for-every-host 2.2).
+ *
+ * An `auto` rule the router gives NO trigger is already kept full-bodied by
+ * `noTrigger` below, which is the substantive protection and predates this
+ * roadmap. What did not exist is any way to SEE it happen: the rule is
+ * silently exempted, so an author who removes a rule's last trigger gets a
+ * silently eager rule and no signal. The line makes the exemption audible.
+ */
+announce = null, 
+/**
+ * The high-consequence class. Defaults to the committed config; a caller
+ * may inject one so a fixture can drive the stub-law form without a tree.
+ */
+consequenceClass = null, 
+/**
+ * Where the router, the consequence class and the stub body links come from
+ * when the caller is NOT this repository's own projector.
+ *
+ * Every default below is derived from {@link REPO_ROOT}, which is
+ * `import.meta.url` four directories up. That is correct for a module read
+ * from `<pkg>/src/scripts/`, and wrong inside a bundled CLI, where the same
+ * arithmetic lands on the PARENT of the package — so a caller that knows the
+ * real package root hands it over instead of letting the module guess.
+ */
+roots = null) {
+    const routerPath = roots?.routerPath ?? (roots?.packageRoot === undefined
+        ? ROUTER
+        : path.join(roots.packageRoot, 'dist', 'router.json'));
+    const classRoot = roots?.packageRoot ?? REPO_ROOT;
+    const bodyLinkPrefix = roots?.bodyLinkPrefix ?? BODY_LINK_PREFIX;
+    const kernel = kernel_ids(routerPath);
+    const noTrigger = no_trigger_ids(routerPath);
+    const pathOnly = path_only_ids(routerPath);
+    const cls = consequenceClass ?? readConsequenceClass(classRoot);
+    const lawInStub = stubLawIds(cls);
+    const wsMap = scope !== null ? rule_workspaces_map(routerPath) : new Map();
+    const out = new Map();
+    for (const p of _globSortedMd(rules_dir)) {
+        const text = fs.readFileSync(p, 'utf-8');
+        const stem = path.basename(p).replace(/\.md$/, '');
+        if (!id_in_scope(stem, scope, kernel, wsMap, fm_workspaces(text))) {
+            continue; // out of workspace scope — no body, no pointer line
+        }
+        // A declared `no_stub` member keeps its whole body. Its law cannot be
+        // copied into a stub, and a stub with no law is exactly the shape the
+        // class exists to prevent for these rules — so the safe residue is the
+        // full text, not a pointer.
+        const noStub = cls.no_stub[stem] !== undefined;
+        const full = kernel.has(stem) || noTrigger.has(stem) || pathOnly.has(stem) || noStub;
+        if (announce !== null && noTrigger.has(stem) && !kernel.has(stem)) {
+            announce(`D3: trigger-less auto rule ${path.basename(p)} — kept full-bodied, never thinned`);
+        }
+        if (announce !== null && pathOnly.has(stem) && !kernel.has(stem) && !noTrigger.has(stem)) {
+            announce(`E2: path-only auto rule ${path.basename(p)} — kept full-bodied; its only triggers ` +
+                `are path-shaped and the delivery concern is not bound on pre_tool_use`);
+        }
+        if (full) {
+            out.set(path.basename(p), text);
+            continue;
+        }
+        if (lawInStub.has(stem)) {
+            if (announce !== null) {
+                announce(`LAW: high-consequence rule ${path.basename(p)} — stub carries its own law section, byte-copied`);
+            }
+            out.set(path.basename(p), thin_entry_with_law(stem, text, bodyLinkPrefix));
+            continue;
+        }
+        out.set(path.basename(p), thin_entry(stem, text, bodyLinkPrefix));
+    }
+    return out;
+}
+//# sourceMappingURL=thin_rules.js.map

package/dist/scripts/_lib/windsurf_render.js

@@ -0,0 +1,60 @@
+/**
+ * The windsurf single-file surface, rendered — one renderer, two callers.
+ *
+ * `road-to-a-hook-bundle-with-one-yaml-reader` 3.1. `condense.generate_windsurfrules`
+ * WRITES `.windsurfrules`; the standing-payload census needs the same bytes to
+ * report windsurf's figure without reading that file, because it is an untracked
+ * generated projection and reading it published a number that tracked when the
+ * checkout last ran `task generate-tools` rather than anything about the tree.
+ *
+ * Both callers share THIS function. A second renderer living in the census would
+ * have measured a file nobody receives, which is Risk 3 of that roadmap.
+ *
+ * WHY A SEPARATE MODULE rather than an export from `condense.ts`: that file sits
+ * 1,228 lines over the 1,500-line cap `check_source_size_budget` ratchets, so
+ * every line added there is a new violation. Splitting the renderer out moves
+ * `condense.ts` DOWN. The file is small on purpose and carries only what the
+ * render needs.
+ *
+ * `strip_frontmatter` moved here with it — it is the render's one non-trivial
+ * dependency, it has exactly one caller left inside `condense.ts`, and leaving it
+ * behind would have meant either an import cycle or a second copy.
+ * `condense.ts` re-exports it, so `src/install/emit_host_rules_cli.ts` and every
+ * other importer keeps its path.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+/** Python `str.lstrip("\n")` — strip only leading newlines. Mirrors `condense._lstripNewlines`. */
+function lstripNewlines(s) {
+    return s.replace(/^\n+/, '');
+}
+/** Python `str.strip()` with no args — strip leading/trailing Unicode whitespace. Mirrors `condense._strip`. */
+function strip(s) {
+    return s.replace(/^\s+/u, '').replace(/\s+$/u, '');
+}
+/** Drop a leading `---` frontmatter block, if the content opens with one. */
+export function strip_frontmatter(content) {
+    if (content.startsWith('---')) {
+        const end = content.indexOf('---', 3);
+        if (end !== -1) {
+            content = lstripNewlines(content.slice(end + 3));
+        }
+    }
+    return content;
+}
+/**
+ * The exact bytes `generate_windsurfrules` writes, for a given rule set.
+ *
+ * `rulesSource` is a parameter rather than `condense.MODULE_STATE.RULES_SOURCE`
+ * so a caller can render a tree it names — the census renders the projection
+ * source directly, with no module state to set up.
+ */
+export function render_windsurfrules(rulesSource, rules) {
+    const parts = ['# Auto-generated from dist/agent-src/rules/ — do not edit directly\n'];
+    for (const rule of rules) {
+        const content = strip_frontmatter(fs.readFileSync(path.join(rulesSource, rule), 'utf-8'));
+        parts.push(`---\n\n${strip(content)}\n`);
+    }
+    return parts.join('\n') + '\n';
+}
+//# sourceMappingURL=windsurf_render.js.map

package/dist/scripts/condense.js

@@ -33,6 +33,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import * as YAML from 'yaml';
 import { _domains_command_logical, artefact_roots as _agent_src_artefact_roots, iter_all_sources as _agent_src_iter_all_sources, resolve_logical as _agent_src_resolve_logical, strip_source_prefix, } from './_lib/agent_src.js';
 import { rewriteProjectedBodyLinks } from './_lib/guidelines_lane.js';
+import { render_windsurfrules, strip_frontmatter } from './_lib/windsurf_render.js';
 // Import-safety note: `project_thin_rules` guards its CLI entry
 // (`_isCliEntry()` before `process.exit(main())`), so importing it here is
 // side-effect-free. condense.ts is bundled into the installer, where a bare
@@ -40,7 +41,7 @@ import { rewriteProjectedBodyLinks } from './_lib/guidelines_lane.js';
 // bundled-CLI-entry-guard landmine. Verified before wiring, not assumed.
 import { build_thin } from './project_thin_rules.js';
 import { build_claude_hook_matrix } from './_lib/claude_settings_hooks.js';
-import { describeDroppedHosts, normalizeLeanProjectionMode, resolveLeanProjectionHosts, thinsHost, writesThinFiles } from './_lib/lean_projection_mode.js';
+import { describeDroppedHosts, resolveLeanProjection, thinsHost, writesThinFiles } from './_lib/lean_projection_mode.js';
 import { is_claude_builtin_name } from './_lib/claude_builtin_names.js';
 import { project_settings_path, load_agent_settings } from './_lib/agent_settings.js';
 import { rule_is_compile_enabled } from './_lib/compile_time_toggles.js';
@@ -385,15 +386,14 @@ function _read_projection_scope_dedup() {
     return false;
 }
 function _lean_projection_settings() {
-    const data = load_agent_settings({ project_path: MODULE_STATE.SETTINGS_FILE });
-    const lean = data['lean_projection'];
-    const obj = typeof lean === 'object' && lean !== null && !Array.isArray(lean)
-        ? lean
-        : {};
-    return {
-        mode: normalizeLeanProjectionMode(obj['mode'] ?? ''),
-        hosts: resolveLeanProjectionHosts(obj['hosts']),
-    };
+    // Step 1.2 of `road-to-a-rule-carrier-that-works-outside-the-repo`: this is
+    // now the shared resolver rather than one of three private readers. The
+    // INPUT is unchanged — `MODULE_STATE.SETTINGS_FILE` is still the file, so
+    // the projector's answer is the answer it always gave — and only the code
+    // that interprets it is shared. That is risk 2 of the roadmap's register
+    // ("making the hook agree with the projector could also move the
+    // projector") discharged by construction instead of by a test alone.
+    return resolveLeanProjection({ settingsPath: MODULE_STATE.SETTINGS_FILE });
 }
 // --- hashing -----------------------------------------------------------------
 export function apply_path_rewriter(relative_path) {
@@ -677,15 +677,9 @@ function _filter_tool_dirs(mapping) {
     }
     return out;
 }
-export function strip_frontmatter(content) {
-    if (content.startsWith('---')) {
-        const end = content.indexOf('---', 3);
-        if (end !== -1) {
-            content = _lstripNewlines(content.slice(end + 3));
-        }
-    }
-    return content;
-}
+// Moved to `_lib/windsurf_render.ts` beside its one remaining caller here and
+// the census that renders through it; re-exported so every importer's path holds.
+export { strip_frontmatter };
 // ── Path rewriter (P1 of road-to-path-fixes.md) ───────────────────────────
 // Kept byte-identical to check_condensation.ts::_rewritePaths (the two MUST
 // agree — see ADR-200 note). Mirrors condense.py::_rewrite_paths.
@@ -1086,14 +1080,8 @@ export function generate_windsurfrules() {
     // on `.windsurf/rules`. Without this line removing the per-run filter regressed
     // it 13 → 113: the per-run filter had been covering it by accident.
     const rules = partition_rules_for_dir('.windsurf/rules', _scoped_rule_basenames());
-    const parts = ['# Auto-generated from dist/agent-src/rules/ — do not edit directly\n'];
-    for (const rule of rules) {
-        const p = path.join(MODULE_STATE.RULES_SOURCE, rule);
-        const content = strip_frontmatter(_readText(p));
-        parts.push(`---\n\n${_strip(content)}\n`);
-    }
     const output = path.join(MODULE_STATE.PROJECT_ROOT, '.windsurfrules');
-    _writeText(output, parts.join('\n') + '\n');
+    _writeText(output, render_windsurfrules(MODULE_STATE.RULES_SOURCE, rules));
     info(`  ✅  Generated .windsurfrules (${rules.length} rules)`);
     return rules.length;
 }