@event4u/agent-config 16.2.0 → 16.4.0

package/src/config/agents-paths.yml

@@ -267,3 +267,19 @@
   policy: ignored
   writer: Fastify wizard server (POST /api/v1/wizard/state)
   rationale: Step-transition crash-recovery; deleted on wizard finish; local-only
+
+# ---------------------------------------------------------------------------
+# Neighbour census caches
+# ---------------------------------------------------------------------------
+
+- path: /agents/reports/neighbour-overlap.json
+  scope: both
+  policy: ignored
+  writer: agent-config doctor neighbours (audit_skill_overlap cross-root mode)
+  rationale: Cross-root overlap pairs; carries each neighbour skill's ABSOLUTE path under the consumer's home directory
+
+- path: /agents/reports/neighbour-scan.json
+  scope: both
+  policy: ignored
+  writer: agent-config doctor neighbours (skill_origin shape-scan verdicts)
+  rationale: Shape-scan verdicts keyed by the consumer's own installed-skill inventory and per-file digests

package/src/config/assurance-capability-registry.json

@@ -62,10 +62,14 @@
       "axis": "self",
       "owner_surface": "src/skills/test-driven-development/SKILL.md",
       "projection": null,
-      "state": "available",
-      "rationale": "Was `projection: null` on the rationale that \"an observed failing test is a fact about a run, and no repository scan can recover it\". That held until 2026-08-26, when this entry's own `revisit_if` fired: `src/scripts/_lib/test_red_state.ts` now emits a durable RED-run record carrying the target, the observed failure CLASS, and a run identifier a later reader can cite. The classification stays the TDD skill's -- the store records the class the caller observed and never decides it, because a store that classified would be a second opinion competing with the contract. `projection` stays null on the contract's own terms: it names a grader DIMENSION, and `grade_target_readiness` reads a target repository, while this record is gitignored per-run state at `agents/runtime/state/test-results.json` on the machine that ran the test. An `axis: self` fact no shipped probe can read off a target is exactly the null case. Still owned by the RED -> GREEN -> REFACTOR cycle; what changed is that the cycle now leaves a trace.",
+      "state": "degraded",
+      "limitations": [
+        "the recorder is built and tested (22 tests) but no run produces its record — `test_red_state.ts`'s writer has no production caller, so `agents/runtime/state/test-results.json` is never populated outside a direct unit-test invocation",
+        "the caller belongs to `road-to-tdd-phase-guard.md`'s stub, which says \"No hook concern was registered\" — wiring it is that stub's to do, not this entry's"
+      ],
+      "rationale": "Was `projection: null` on the rationale that \"an observed failing test is a fact about a run, and no repository scan can recover it\". That held until 2026-08-26, when this entry's own `revisit_if` fired: `src/scripts/_lib/test_red_state.ts` now emits a durable RED-run record carrying the target, the observed failure CLASS, and a run identifier a later reader can cite. The classification stays the TDD skill's -- the store records the class the caller observed and never decides it, because a store that classified would be a second opinion competing with the contract. `projection` stays null on the contract's own terms: it names a grader DIMENSION, and `grade_target_readiness` reads a target repository, while this record is gitignored per-run state at `agents/runtime/state/test-results.json` on the machine that ran the test. An `axis: self` fact no shipped probe can read off a target is exactly the null case. Still owned by the RED -> GREEN -> REFACTOR cycle; what the module adds is a trace the cycle could leave -- `available` claimed the cycle already leaves one, which road-to-modules-that-something-calls.md Phase 2.4 found false: the writer has no caller, so nothing today leaves that trace.",
       "evidence": "src/scripts/_lib/test_red_state.ts + tests/scripts/test_red_state.test.ts (22 tests). The load-bearing half is the invalid set: a broken fixture, a test syntax error, a missing unrelated dependency and a runner fault are recorded and marked NOT a valid red, so a production edit cannot be cleared by a failure that was never about the behaviour under test. Sensitivity proven -- admitting `broken-fixture` to the valid set turns 4 of the 22 red.",
-      "revisit_if": "The record is gitignored per-run state, so it proves a red was observed on THIS machine and nothing about CI or another developer. Revisit if a cross-machine claim is ever wanted: that needs a tracked artefact, which is a different decision under ADR-124 and not this entry's to make. Also revisit if a consumer of the record starts fuzzy-matching targets -- exact match is what stops a red observed for one behaviour clearing an edit to another."
+      "revisit_if": "The record is gitignored per-run state, so it proves a red was observed on THIS machine and nothing about CI or another developer. Revisit if a cross-machine claim is ever wanted: that needs a tracked artefact, which is a different decision under ADR-124 and not this entry's to make. Also revisit if a consumer of the record starts fuzzy-matching targets -- exact match is what stops a red observed for one behaviour clearing an edit to another. Revisit to `available` when `road-to-tdd-phase-guard.md`'s caller lands and a run actually produces the record."
     },
     "mutation-sensitivity": {
       "axis": "target",

package/src/config/ci-local-parity.yml

@@ -168,6 +168,9 @@ ci_only:
   - id: check_release_surface_equality
     class: release
     reason: "shells out to `gh pr diff <n>` for a live release PR — there is no PR body to compare the CHANGELOG against on a local checkout"
+  - id: check_release_manifest_content
+    class: release
+    reason: "compares a release PR's manifests against its base; on any other branch the version fields do not move and the assertion is vacuous. `src/config/release-gate-locality.yml` gives it a `local:` command under the release-shape row, so `task release:verify` runs it on a release head before the PR exists"
   - id: check_release_highlights
     class: release
     reason: "requires `--version X.Y.Z` and derives evidence from a release span; exits 2 without one, so a local run gates nothing"

package/src/config/continuity-surface.json

@@ -125,7 +125,7 @@
             "axis": "persistent_continuity_artefacts",
             "disposition": "excluded",
             "locus": "src/scripts/_cli/cmd_analyze_session.ts:15",
-            "reason": "Turn and loop counters for the context-hygiene carrier. Read within a session to decide whether to warn; never read by a successor."
+            "reason": "Tool-call count and freshness milestones for the context-hygiene carrier; never read by a successor."
         },
         {
             "id": "council-probes.json",
@@ -211,6 +211,13 @@
             "locus": "src/scripts/bench_hook_injection.ts:42",
             "reason": "Hook-injection benchmark output. Measurement, not state."
         },
+        {
+            "id": "learning-dogfood.jsonl",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/memory_learn_hook.ts:191",
+            "reason": "One line per session-end learning run — wall time, signals in, lessons out. The two numbers the `memory.learn_on_session_end` flip condition names, recorded so a 30-day window can read a zero rather than a silence. Measurement about a session, never state a successor session reads: deleting it costs the window its history and costs no resume anything."
+        },
         {
             "id": "injection-turn",
             "axis": "persistent_continuity_artefacts",
@@ -236,7 +243,7 @@
             "id": "onboarding-gate.json",
             "axis": "persistent_continuity_artefacts",
             "disposition": "excluded",
-            "locus": "src/scripts/onboarding_gate_hook.ts:13",
+            "locus": "src/scripts/onboarding_gate_hook.ts:87",
             "reason": "Onboarding latch. Same class as the disclosure latch."
         },
         {
@@ -398,7 +405,7 @@
             "axis": "persistent_continuity_artefacts",
             "disposition": "excluded",
             "locus": "src/scripts/_lib/test_red_state.ts:2",
-            "reason": "Last test-run red state, read by the verification gates within a run."
+            "reason": "Last test-run red state. No production code currently writes or reads it — only this module's own unit test exercises the store; the registry row for this instrument (assurance-capability-registry.json, test-red-evidence) was corrected to degraded on 2026-10-06 for the same reason."
         },
         {
             "id": "tool-result-census.jsonl",

package/src/config/discovery/packs.yml

@@ -25,6 +25,14 @@
   label: Engineering Base
   description: Framework-neutral engineering hygiene — git, tests, reviews.
   workspaces: [engineering]
+  # Companion stacks and layers, never dependencies. This pack's skills are
+  # framework-neutral by contract and carry stack carve-out pointers ("Laravel
+  # → laravel-validation", "Next.js → nextjs-patterns") plus hand-offs into the
+  # design and product layers. `requires` is transitive and install-forcing, so
+  # declaring any of them would push the whole set into every engineering
+  # install; advisory is what the relationship actually is.
+  # D5 of road-to-gates-a-pull-request-can-hear (AI council 2026-10-07).
+  suggests: [php, laravel, symfony, nextjs, react, frontend-design, brand, product-basic]
   trust_level_default: core
   domain: engineering
   size_class: core
@@ -125,7 +133,9 @@
   description: Grounded design intelligence — design-knowledge corpus + BM25 grounding engine, design tokens, stack best-practice and chart/typography knowledge.
   workspaces: [engineering]
   requires: [engineering-base]
-  suggests: [react, nextjs]
+  # `brand` requires this pack, so the reverse edge can only be advisory: the
+  # design skills defer to a registered brand token where one exists.
+  suggests: [react, nextjs, brand]
   trust_level_default: professional
   domain: engineering
   size_class: medium
@@ -145,6 +155,9 @@
   description: Scale-safe persistence — index parity, bounded reads, migration safety, growth budgets, thin request path, durable async; deterministic pattern lints gate, heuristics advise.
   workspaces: [engineering]
   requires: [engineering-base]
+  # Sibling pack floor: audit tables fall under this pack's growth budget, so
+  # the two rules cross-reference. Advisory — either installs without the other.
+  suggests: [history-discipline]
   trust_level_default: experimental
   surface_tier: lab
   domain: engineering
@@ -205,6 +218,9 @@
   label: Finance Basic
   description: Cashflow, runway, basic forecasting.
   workspaces: [finance, founder]
+  # `finance-advanced` requires this pack; the reverse pointers (runway hands
+  # off to scenario modelling, unit economics to DCF) are therefore advisory.
+  suggests: [finance-advanced]
   trust_level_default: professional
   domain: finance
   risk_class: medium   # advisory (finance-safety-floor): not-financial-advice disclaimer

package/src/config/evaluator-budgets.json

@@ -33,13 +33,20 @@
       "max": 140,
       "last_measured": 127,
       "last_measured_at": "2026-07-27",
-      "method": "du -sm node_modules after `npm install --omit=dev <tarball>` in a clean project"
+      "method": "du -sm node_modules after `npm install --omit=dev <tarball>` in a clean project",
+      "inputs": [
+        "package.json",
+        "package-lock.json"
+      ]
     },
     "runtime_dep_count": {
       "max": 200,
       "last_measured": 187,
       "last_measured_at": "2026-07-27",
-      "method": "package-lock.json packages count (minus root) of the clean --omit=dev install"
+      "method": "package-lock.json packages count (minus root) of the clean --omit=dev install",
+      "inputs": [
+        "package-lock.json"
+      ]
     },
     "cli_version_cold_ms": {
       "max": 1500,
@@ -58,18 +65,24 @@
       "deterministic": false
     },
     "cli_help_command_count": {
-      "max": 110,
-      "last_measured": 110,
-      "last_measured_at": "2026-09-03",
+      "max": 111,
+      "last_measured": 111,
+      "last_measured_at": "2026-10-07",
       "method": "registry enumeration — count of `{ name: '...', disposition` entries in src/cli/registry.ts (NOT --help prose parsing; methods historically disagreed 74 vs 76 vs 79)",
-      "baseline_note": "80 → 81 on 2026-08-03 (release 9.15.0 gate). This RECORDS growth that already shipped through its own reviewed PR; it does not authorize new surface. The +1 is f02db54c2 (fix(cli): register routing:doctor in the CLI registry) — the command existed, only its registry entry was missing, and the registering PR did not move this budget. The gate did its job again: breach WARNS on main and BLOCKS on release, which is the conscious-decision point rather than a silently raised cap. Re-measured 2026-08-03 via the pinned method: 81. Headroom stays zero by design — the next registry addition must move this number in its own PR. 81 → 82 on 2026-08-04: the `handoff` subcommand (road-to-agent-handoff-resume Phase 4) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 82. 82 → 84 on 2026-08-04: the `route:explain` + `route:audit` verbs (routing-correctness validation surface) register in the same PR that adds the surface. Re-measured via the pinned method: 84. 84 → 85 on 2026-08-05: the `settings:set` verb (road-to-zero-ceremony-settings Phase 2 — the one agent-reachable settings writer) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 85. 85 → 86 on 2026-08-06: the `conformance:behavior` verb (road-to-agent-behavior-conformance Phase 5 — replays the local transcript store through the four mechanised conformance checks) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 86. 86 → 88 on 2026-08-07: the `sessions:list` + `sessions:claim` verbs (road-to-parallel-session-coordination — the shell surface of the shared session register, needed because /roadmap:next is command markdown and can only reach the register through a shell call) register in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 88. 88 → 89 on 2026-08-08: the `council:status` verb registers in the same PR that adds the surface, per this record's own contract. It exists because an agent in a consumer project announced \"kein Council konfiguriert (keine .agent-settings.yml)\" and substituted a weaker path while the council was configured user-globally the whole time — there was no verb that answered availability, so the only route was an inference from a filename, and the intuitive filename is the one location ADR-104 guarantees is never consulted. Re-measured via the pinned method: 89. 89 → 91 on 2026-08-08: the `self-repair:status` + `self-repair:release` verbs (the queued-defect reader and the single Hard-Floor-gated outward step of the self-repair loop — the loop is deliberately unable to publish unless a human runs the release command) register in the same PR that adds the surface, per this record's own contract. Landed alongside the +1 council:status move in the same branch. Re-measured via the pinned method: 91. 91 → 94 on 2026-08-08: the `packs:active`, `settings:get` and `mcp:available` verbs (road-to-capability-answerability Phase 2 — the three capability probes for the gaps that had none) register in the same PR that adds the surface, per this record's own contract. Each answers a question that was previously only inferable from a filename: which packs are active and from which file, what a setting resolves to and which file set it, and what is declared in mcp.json versus what can actually launch. 94 -> 95 in the same PR: `brand:status` (Phase 2.4 — brand-layer presence, which the rule depended on and no surface could answer). Re-measured twice via the pinned method on the unchanged tree: 95/95. 95 → 96 on 2026-08-10: the `session:recycle` verb (road-to-token-economy-recycling Phase 2.2 — the deterministic producer of the main-session recycle envelope; the recycle advisory names this exact verb, so it must exist as a shell surface) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 96. 96 -> 97 on 2026-08-10: the `gates` verb registers in the same PR that adds the surface, per this record's own contract. It exists because the blocker fields the dashboard already parses (Owner, What to do, Resolved when — CI-enforced by lint_roadmap_blockers) had no owner-filtered reader: the dashboard counts the open blockers across a 600-line file and links each to a per-roadmap anchor, so \"which of these are mine\" was a manual read of every anchor. The same inference-from-a-filename shape as the council:status entry above, one layer up. This branch and the session:recycle branch each measured 96 independently and landed on the same number for different verbs; the merge makes it 97, re-measured twice via the pinned method on the merged tree: 97/97. 97 -> 98 on 2026-08-15: the `workspace:doctor` verb (road-to-inbox-harvest-2026-08-c-workspace-identity Phase 3 — the read-only report over the new `workspaceIdentity()` resolver) registers in the same PR that adds the surface, per this record's own contract. It exists for the same inference-from-a-filename shape as the council:status and gates entries above, one layer down: the tree answered \"where am I\" in eight ad-hoc places across six files, and the 12.0.0 span shipped the same worktree misclassification twice, so no verb could be asked which checkout is the main one. Read-only by construction — the roadmap's Non-goals put worktree disposal out of scope and its Risk 3 names \"the pressure read becomes a disposal path by accident\" as the failure to design against, so the command carries no --fix and no --prune. Re-measured twice via the pinned method on the unchanged tree: 98/98. 98 -> 99 on 2026-08-17: the `council:quota` verb (road-to-council-quota-accounting-truth Phase 2) registers in the same PR that adds the surface, per this record's own contract. Exactly the inference-from-a-filename shape as the council:status entry above, one layer down: `cmd_quota` had existed in council_cli.ts and been reachable only via `scripts-run`, so the documented recovery path for an exhausted shared counter -- read the usage, reset one provider -- did not resolve through `agent-config`, and an operator debugging a quota failure met `unknown command`. The verb is read-only apart from the pre-existing `--reset <provider>`, which already required `--confirm`. Re-measured twice via the pinned method on the unchanged tree: 99/99. 99 -> 100 on 2026-08-19: the `decision:memo` verb (road-to-long-horizon-execution Phase 2.2, sequencing UOTL Phase 4.3 -- the decision-memo channel) registers in the same PR that adds the surface, per this record's own contract. It exists because the question ladder gained a rung between \"halt and ask\" and \"decide silently\": a resolution the run makes without contacting the operator is only legitimate if it is reviewable afterwards, and there was no surface that wrote such a record with a fixed shape. Write-and-list only, local-only (agents/runtime/ is gitignored), and it gates nothing -- the locked decision classes are refused at the config schema, never in the ledger. 100 -> 101 in the same PR: `run:supervise` (Phase 3.1 -- the out-of-process watcher for runs whose session died with open steps left). It is the operator-facing half of session continuity: nothing anywhere had the job of noticing that a claimed run stopped moving, so a roadmap 40% done and a roadmap finished looked identical from outside the dead session. Report-only by default and it NEVER merges, pushes or closes -- the auto-merge the reference design carries is a named rejection in the roadmap's harvest section, not an unbuilt feature. Re-measured twice via the pinned method on the unchanged tree: 101/101. 101 → 102 on 2026-08-22: the `adr:effective` verb (road-to-evidence-based-adr-governance step 2.2 — the effective-state projection over one decision record) registers in the same PR that adds the surface, per this record's own contract. It exists because current truth about an ADR was only reconstructable from linear prose: an agent had to read the body, then every amendment, and decide for itself which clauses still stand. The verb reports status, the Decision verbatim, clauses the record's own amendments superseded, active amendments, the three descriptive axes and the review-trigger state. It AUTHORIZES NOTHING — Phase 2 of that roadmap is titled \"surfacing only; no authority\" and its AC-7 forbids any authority consequence, so the verb reports an absent axis as absent (`— (no provenance axis)`, `— (ungraded)`, `absent → evidence`) and an unresolvable trigger as `indeterminate` rather than inferring one. Re-measured twice via the pinned method on the unchanged tree: 102/102. 102 → 104 on 2026-08-22: the `council:grant-billing` + `council:revoke-billing` verbs (road-to-billing-cliff-gate Phase 2 — the run-scoped billing grant that lets `ai_council.fallback.api_on_quota: 'ask'` be answered once per run instead of once per seat) register in the same PR that adds the surface, per this record's own contract. The two are a pair by construction rather than by convenience: a grant that can be issued and not revoked would outlive its run, which is the failure the run-scoped TTL exists to prevent. Re-measured via the pinned method: 104. 104 -> 106 on 2026-08-23: the `ui:audit` + `ui:render` verbs (road-to-frontend-power E2.1 and E3.1 -- the two Class-A commands that give the frontend obligations an artefact a gate can read and a render a verdict can cite) register in the same PR that adds the surface, per this record's own contract. The two are a pair by construction rather than by convenience: `ui-audit-gate`'s enforced_by moved from `none` to a carrier in the same change, and that carrier reports `verification: degraded` whenever the render artefact is absent -- so an audit verb without a render verb would ship a gate that can never reach `verified`. Both are Class A under ADR-124: they terminate, their whole state is a rebuildable directory under agents/runtime/state/, and ui:render closes chromium in a `finally` on every path with no --serve, watch or cache for a resident browser to hide in. Re-measured via the pinned method on the unchanged tree: 106. 106 → 107 on 2026-08-23: the `roadmap:context` verb (road-to-roadmap-situational-awareness — the single live probe that answers what else is in flight before a roadmap is picked) registers in the same PR that adds the surface, per this record's own contract. Its branch measured 105 against a base of 104 and this branch measured 106 against the same base for `ui:audit` + `ui:render`; the merge makes it 107, re-measured on the merged tree via the pinned method (registry enumeration): 107. 107 → 108 on 2026-08-26: the `roadmap:set-step` verb (road-to-skill-ecosystem-runtime-enforcement Phase 6 — the single sanctioned writer of a checkbox glyph) registers in the same PR that adds the surface, per this record's own contract. It exists because the glyph is written today by whatever edits the file, and a concurrent writer destroys work SILENTLY: the loser of an overwrite receives no error. The verb carries an advisory lock, a line-anchored edit that cannot span entries even in principle, a step-count invariant asserted against the LIVE pre-write file rather than an in-memory snapshot, and a post-write survival check. Re-measured via the pinned method (registry enumeration) on the unchanged tree: 108. 108 → 109 on 2026-08-26: the `stubs:due` verb (road-to-inbox-harvest-2026-08-f-owner-decision-queue step 2.1 — the read-only reader over `agents/roadmaps/stubs/` frontmatter) registers in the same PR that adds the surface, per this record's own contract. It exists because step 1.2 backfills a `review_by:` date into 77 parked files, and an AI council (2026-08-26, 2/2) made the ordering a RULE rather than a preference: dates without a reader are strictly worse than no dates, because a stale date certifies attention nobody paid. The verb is read-only by construction — it authors nothing under `agents/roadmaps/stubs/`, so `check_no_stub_inventory_table` stays green and unmodified, and `roadmap:progress` consumes only its two COUNTS for the dashboard header (two integers, no rows, nothing for the deleted index tables to grow back from). Re-measured via the pinned method (registry enumeration) on the unchanged tree: 109. 109 → 110 on 2026-09-03: the `hooks:effect` verb (road-to-wired-instruments Phase 1.1 — the CLI entry for `hook_effect_doctor`) registers in the same PR that adds the surface, per this record's own contract. It exists because the probe and its five-state vocabulary were built, tested and reachable from nothing: `grep -rn 'hook_effect_doctor|hook_effect_probe' src Taskfile.yml .github` returned only the two modules themselves, and a closed roadmap recorded the wiring as landed at `src/scripts/hooks_doctor.ts:88`, a line that is the closing brace of a filesystem helper in a file with zero references to the probe. Deliberately NOT merged into `hooks:doctor`: that verb reads the MANIFEST (what is declared) and this one reads what happened (what took effect), and the probe's own header names merging them as the thing to avoid — a declaration report and an execution report are different instruments, and merging them makes the cheap one expensive. Read-only apart from a scratch root it removes in a `finally`. Re-measured via the pinned method (registry enumeration) on the unchanged tree: 110."
+      "inputs": [
+        "src/cli/registry.ts"
+      ],
+      "baseline_note": "80 → 81 on 2026-08-03 (release 9.15.0 gate). This RECORDS growth that already shipped through its own reviewed PR; it does not authorize new surface. The +1 is f02db54c2 (fix(cli): register routing:doctor in the CLI registry) — the command existed, only its registry entry was missing, and the registering PR did not move this budget. The gate did its job again: breach WARNS on main and BLOCKS on release, which is the conscious-decision point rather than a silently raised cap. Re-measured 2026-08-03 via the pinned method: 81. Headroom stays zero by design — the next registry addition must move this number in its own PR. 81 → 82 on 2026-08-04: the `handoff` subcommand (road-to-agent-handoff-resume Phase 4) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 82. 82 → 84 on 2026-08-04: the `route:explain` + `route:audit` verbs (routing-correctness validation surface) register in the same PR that adds the surface. Re-measured via the pinned method: 84. 84 → 85 on 2026-08-05: the `settings:set` verb (road-to-zero-ceremony-settings Phase 2 — the one agent-reachable settings writer) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 85. 85 → 86 on 2026-08-06: the `conformance:behavior` verb (road-to-agent-behavior-conformance Phase 5 — replays the local transcript store through the four mechanised conformance checks) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 86. 86 → 88 on 2026-08-07: the `sessions:list` + `sessions:claim` verbs (road-to-parallel-session-coordination — the shell surface of the shared session register, needed because /roadmap:next is command markdown and can only reach the register through a shell call) register in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 88. 88 → 89 on 2026-08-08: the `council:status` verb registers in the same PR that adds the surface, per this record's own contract. It exists because an agent in a consumer project announced \"kein Council konfiguriert (keine .agent-settings.yml)\" and substituted a weaker path while the council was configured user-globally the whole time — there was no verb that answered availability, so the only route was an inference from a filename, and the intuitive filename is the one location ADR-104 guarantees is never consulted. Re-measured via the pinned method: 89. 89 → 91 on 2026-08-08: the `self-repair:status` + `self-repair:release` verbs (the queued-defect reader and the single Hard-Floor-gated outward step of the self-repair loop — the loop is deliberately unable to publish unless a human runs the release command) register in the same PR that adds the surface, per this record's own contract. Landed alongside the +1 council:status move in the same branch. Re-measured via the pinned method: 91. 91 → 94 on 2026-08-08: the `packs:active`, `settings:get` and `mcp:available` verbs (road-to-capability-answerability Phase 2 — the three capability probes for the gaps that had none) register in the same PR that adds the surface, per this record's own contract. Each answers a question that was previously only inferable from a filename: which packs are active and from which file, what a setting resolves to and which file set it, and what is declared in mcp.json versus what can actually launch. 94 -> 95 in the same PR: `brand:status` (Phase 2.4 — brand-layer presence, which the rule depended on and no surface could answer). Re-measured twice via the pinned method on the unchanged tree: 95/95. 95 → 96 on 2026-08-10: the `session:recycle` verb (road-to-token-economy-recycling Phase 2.2 — the deterministic producer of the main-session recycle envelope; the recycle advisory names this exact verb, so it must exist as a shell surface) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 96. 96 -> 97 on 2026-08-10: the `gates` verb registers in the same PR that adds the surface, per this record's own contract. It exists because the blocker fields the dashboard already parses (Owner, What to do, Resolved when — CI-enforced by lint_roadmap_blockers) had no owner-filtered reader: the dashboard counts the open blockers across a 600-line file and links each to a per-roadmap anchor, so \"which of these are mine\" was a manual read of every anchor. The same inference-from-a-filename shape as the council:status entry above, one layer up. This branch and the session:recycle branch each measured 96 independently and landed on the same number for different verbs; the merge makes it 97, re-measured twice via the pinned method on the merged tree: 97/97. 97 -> 98 on 2026-08-15: the `workspace:doctor` verb (road-to-inbox-harvest-2026-08-c-workspace-identity Phase 3 — the read-only report over the new `workspaceIdentity()` resolver) registers in the same PR that adds the surface, per this record's own contract. It exists for the same inference-from-a-filename shape as the council:status and gates entries above, one layer down: the tree answered \"where am I\" in eight ad-hoc places across six files, and the 12.0.0 span shipped the same worktree misclassification twice, so no verb could be asked which checkout is the main one. Read-only by construction — the roadmap's Non-goals put worktree disposal out of scope and its Risk 3 names \"the pressure read becomes a disposal path by accident\" as the failure to design against, so the command carries no --fix and no --prune. Re-measured twice via the pinned method on the unchanged tree: 98/98. 98 -> 99 on 2026-08-17: the `council:quota` verb (road-to-council-quota-accounting-truth Phase 2) registers in the same PR that adds the surface, per this record's own contract. Exactly the inference-from-a-filename shape as the council:status entry above, one layer down: `cmd_quota` had existed in council_cli.ts and been reachable only via `scripts-run`, so the documented recovery path for an exhausted shared counter -- read the usage, reset one provider -- did not resolve through `agent-config`, and an operator debugging a quota failure met `unknown command`. The verb is read-only apart from the pre-existing `--reset <provider>`, which already required `--confirm`. Re-measured twice via the pinned method on the unchanged tree: 99/99. 99 -> 100 on 2026-08-19: the `decision:memo` verb (road-to-long-horizon-execution Phase 2.2, sequencing UOTL Phase 4.3 -- the decision-memo channel) registers in the same PR that adds the surface, per this record's own contract. It exists because the question ladder gained a rung between \"halt and ask\" and \"decide silently\": a resolution the run makes without contacting the operator is only legitimate if it is reviewable afterwards, and there was no surface that wrote such a record with a fixed shape. Write-and-list only, local-only (agents/runtime/ is gitignored), and it gates nothing -- the locked decision classes are refused at the config schema, never in the ledger. 100 -> 101 in the same PR: `run:supervise` (Phase 3.1 -- the out-of-process watcher for runs whose session died with open steps left). It is the operator-facing half of session continuity: nothing anywhere had the job of noticing that a claimed run stopped moving, so a roadmap 40% done and a roadmap finished looked identical from outside the dead session. Report-only by default and it NEVER merges, pushes or closes -- the auto-merge the reference design carries is a named rejection in the roadmap's harvest section, not an unbuilt feature. Re-measured twice via the pinned method on the unchanged tree: 101/101. 101 → 102 on 2026-08-22: the `adr:effective` verb (road-to-evidence-based-adr-governance step 2.2 — the effective-state projection over one decision record) registers in the same PR that adds the surface, per this record's own contract. It exists because current truth about an ADR was only reconstructable from linear prose: an agent had to read the body, then every amendment, and decide for itself which clauses still stand. The verb reports status, the Decision verbatim, clauses the record's own amendments superseded, active amendments, the three descriptive axes and the review-trigger state. It AUTHORIZES NOTHING — Phase 2 of that roadmap is titled \"surfacing only; no authority\" and its AC-7 forbids any authority consequence, so the verb reports an absent axis as absent (`— (no provenance axis)`, `— (ungraded)`, `absent → evidence`) and an unresolvable trigger as `indeterminate` rather than inferring one. Re-measured twice via the pinned method on the unchanged tree: 102/102. 102 → 104 on 2026-08-22: the `council:grant-billing` + `council:revoke-billing` verbs (road-to-billing-cliff-gate Phase 2 — the run-scoped billing grant that lets `ai_council.fallback.api_on_quota: 'ask'` be answered once per run instead of once per seat) register in the same PR that adds the surface, per this record's own contract. The two are a pair by construction rather than by convenience: a grant that can be issued and not revoked would outlive its run, which is the failure the run-scoped TTL exists to prevent. Re-measured via the pinned method: 104. 104 -> 106 on 2026-08-23: the `ui:audit` + `ui:render` verbs (road-to-frontend-power E2.1 and E3.1 -- the two Class-A commands that give the frontend obligations an artefact a gate can read and a render a verdict can cite) register in the same PR that adds the surface, per this record's own contract. The two are a pair by construction rather than by convenience: `ui-audit-gate`'s enforced_by moved from `none` to a carrier in the same change, and that carrier reports `verification: degraded` whenever the render artefact is absent -- so an audit verb without a render verb would ship a gate that can never reach `verified`. Both are Class A under ADR-124: they terminate, their whole state is a rebuildable directory under agents/runtime/state/, and ui:render closes chromium in a `finally` on every path with no --serve, watch or cache for a resident browser to hide in. Re-measured via the pinned method on the unchanged tree: 106. 106 → 107 on 2026-08-23: the `roadmap:context` verb (road-to-roadmap-situational-awareness — the single live probe that answers what else is in flight before a roadmap is picked) registers in the same PR that adds the surface, per this record's own contract. Its branch measured 105 against a base of 104 and this branch measured 106 against the same base for `ui:audit` + `ui:render`; the merge makes it 107, re-measured on the merged tree via the pinned method (registry enumeration): 107. 107 → 108 on 2026-08-26: the `roadmap:set-step` verb (road-to-skill-ecosystem-runtime-enforcement Phase 6 — the single sanctioned writer of a checkbox glyph) registers in the same PR that adds the surface, per this record's own contract. It exists because the glyph is written today by whatever edits the file, and a concurrent writer destroys work SILENTLY: the loser of an overwrite receives no error. The verb carries an advisory lock, a line-anchored edit that cannot span entries even in principle, a step-count invariant asserted against the LIVE pre-write file rather than an in-memory snapshot, and a post-write survival check. Re-measured via the pinned method (registry enumeration) on the unchanged tree: 108. 108 → 109 on 2026-08-26: the `stubs:due` verb (road-to-inbox-harvest-2026-08-f-owner-decision-queue step 2.1 — the read-only reader over `agents/roadmaps/stubs/` frontmatter) registers in the same PR that adds the surface, per this record's own contract. It exists because step 1.2 backfills a `review_by:` date into 77 parked files, and an AI council (2026-08-26, 2/2) made the ordering a RULE rather than a preference: dates without a reader are strictly worse than no dates, because a stale date certifies attention nobody paid. The verb is read-only by construction — it authors nothing under `agents/roadmaps/stubs/`, so `check_no_stub_inventory_table` stays green and unmodified, and `roadmap:progress` consumes only its two COUNTS for the dashboard header (two integers, no rows, nothing for the deleted index tables to grow back from). Re-measured via the pinned method (registry enumeration) on the unchanged tree: 109. 109 → 110 on 2026-09-03: the `hooks:effect` verb (road-to-wired-instruments Phase 1.1 — the CLI entry for `hook_effect_doctor`) registers in the same PR that adds the surface, per this record's own contract. It exists because the probe and its five-state vocabulary were built, tested and reachable from nothing: `grep -rn 'hook_effect_doctor|hook_effect_probe' src Taskfile.yml .github` returned only the two modules themselves, and a closed roadmap recorded the wiring as landed at `src/scripts/hooks_doctor.ts:88`, a line that is the closing brace of a filesystem helper in a file with zero references to the probe. Deliberately NOT merged into `hooks:doctor`: that verb reads the MANIFEST (what is declared) and this one reads what happened (what took effect), and the probe's own header names merging them as the thing to avoid — a declaration report and an execution report are different instruments, and merging them makes the cheap one expensive. Read-only apart from a scratch root it removes in a `finally`. Re-measured via the pinned method (registry enumeration) on the unchanged tree: 110. 110 → 111 on 2026-10-07: the `git:convention` verb (road-to-a-git-convention-that-reaches-every-checkout step 1.2) registers in the same PR that adds the surface, per this record's own contract. It exists because a consumer project has neither `scripts-run` nor `node_modules`, so the `agent-config` binary is the only code an installed command reaches, and `settings:get` reports a settings file that does not parse as \"not set\" — the reading that turned a declared `rebase` into a merge. The verb reports each git.* key with its value, source file and one of five states, exits 1 when a key cannot be read, and takes its subcommands from one table so later git surfaces are rows under this verb rather than new verbs. Read-only. Re-measured via the pinned method (registry enumeration) on the unchanged tree: 111."
     },
     "mcp_public_tool_count": {
-      "max": 25,
-      "last_measured": 25,
-      "last_measured_at": "2026-09-09",
+      "max": 26,
+      "last_measured": 26,
+      "last_measured_at": "2026-10-01",
       "method": "tools/list length on the stdio server (post-ADR-132: implemented tools only)",
-      "baseline_note": "19 → 20 on 2026-08-17 (release 13.0.0 gate). The +1 is 866bd9861 (feat(mcp): recover what the host dropped — real ranker tool + a route to it, road-to-inbox-harvest-2026-08-d-runtime-skill-routing Phase 4): `suggest_skill_for_task` was promoted from a discovery STUB to a real ALLOWLIST entry and removed from STUB_TOOLS. Worth stating precisely, because the consumer-visible NAME did not grow — the stub already published that name and its `task` + `limit` input schema, which the promotion carried over verbatim. What grew is the count of tools tools/list actually returns, which is exactly what this metric measures post-ADR-132: implemented tools only. Same shape as the cli_help_command_count history above — this RECORDS growth that already shipped through its own reviewed PR (866bd9861 is on main), it does not authorize new surface. The registering PR did not move this budget, so the gate did its job: the breach warned on main and blocked on the release ref, which is the conscious-decision point rather than a silently raised cap. Re-measured twice via the pinned method on a freshly built dist/mcp/server.mjs: 20/20. Headroom stays zero by design — the next tool that leaves STUB_TOOLS must move this number in its own PR. 20 → 25 on 2026-09-09 (release 14.23.0 gate). The +5 are `graph_impact`, `graph_tests_for`, `graph_dead`, `graph_query` and `graph_path` — 9452f29b4 (feat(mcp): five graph tools, the pinned install hint, and the skill description; road-to-a-graph-that-is-shipped Phase 4.1), which is on main. They are the agent-facing readers of the code graph: the roadmap Risk-Register rank 1 is \"the install grows and the graph is still unread\", and an agent that has to shell out to reach a verb will not, so the tools ARE the mitigation rather than a convenience. Same shape as every entry above — this RECORDS growth that already shipped through its own reviewed PR; it does not authorize new surface. The registering PR did not move this budget, so the gate did its job again: the breach warned on main and BLOCKED on the release ref, which is the conscious-decision point rather than a silently raised cap. The move is +25%, over the 10% creep rule, and that is the intended reading: five tools in one commit is a surface decision, not creep. Re-measured three times via the pinned method on a freshly built dist/mcp/server.mjs: 25/25/25, the returned name set differing from the 20-tool set by exactly the five graph_* entries. Headroom stays zero by design — the next tool that leaves STUB_TOOLS must move this number in its own PR."
+      "inputs": [
+        "src/scripts/mcp_server/**"
+      ],
+      "baseline_note": "19 → 20 on 2026-08-17 (release 13.0.0 gate). The +1 is 866bd9861 (feat(mcp): recover what the host dropped — real ranker tool + a route to it, road-to-inbox-harvest-2026-08-d-runtime-skill-routing Phase 4): `suggest_skill_for_task` was promoted from a discovery STUB to a real ALLOWLIST entry and removed from STUB_TOOLS. Worth stating precisely, because the consumer-visible NAME did not grow — the stub already published that name and its `task` + `limit` input schema, which the promotion carried over verbatim. What grew is the count of tools tools/list actually returns, which is exactly what this metric measures post-ADR-132: implemented tools only. Same shape as the cli_help_command_count history above — this RECORDS growth that already shipped through its own reviewed PR (866bd9861 is on main), it does not authorize new surface. The registering PR did not move this budget, so the gate did its job: the breach warned on main and blocked on the release ref, which is the conscious-decision point rather than a silently raised cap. Re-measured twice via the pinned method on a freshly built dist/mcp/server.mjs: 20/20. Headroom stays zero by design — the next tool that leaves STUB_TOOLS must move this number in its own PR. 20 → 25 on 2026-09-09 (release 14.23.0 gate). The +5 are `graph_impact`, `graph_tests_for`, `graph_dead`, `graph_query` and `graph_path` — 9452f29b4 (feat(mcp): five graph tools, the pinned install hint, and the skill description; road-to-a-graph-that-is-shipped Phase 4.1), which is on main. They are the agent-facing readers of the code graph: the roadmap Risk-Register rank 1 is \"the install grows and the graph is still unread\", and an agent that has to shell out to reach a verb will not, so the tools ARE the mitigation rather than a convenience. Same shape as every entry above — this RECORDS growth that already shipped through its own reviewed PR; it does not authorize new surface. The registering PR did not move this budget, so the gate did its job again: the breach warned on main and BLOCKED on the release ref, which is the conscious-decision point rather than a silently raised cap. The move is +25%, over the 10% creep rule, and that is the intended reading: five tools in one commit is a surface decision, not creep. Re-measured three times via the pinned method on a freshly built dist/mcp/server.mjs: 25/25/25, the returned name set differing from the 20-tool set by exactly the five graph_* entries. Headroom stays zero by design — the next tool that leaves STUB_TOOLS must move this number in its own PR. 25 → 26 on 2026-10-01: the +1 is `graph_node` (road-to-a-graph-that-feeds-the-gate step 3.1), and this entry moves in the SAME PR that adds the surface, which is what every entry above asks of the next one. Why a sixth graph tool rather than an argument on one of the five: the five all answer about a NEIGHBOURHOOD (`graph_query`, `graph_path`, `graph_impact`) or about a SET (`graph_dead`, `graph_tests_for`), and none answers the question an agent asks first — where does this symbol live, who reaches it, what does it reach, how connected is it — which had to be assembled from two calls plus a file read. It walks the edge maps `affected` already walks, so it adds a view and not an index. It is also the one graph tool that REFUSES rather than guesses: it resolves on the exact tiers of the existing seed ladder (node id, then label) and returns a refusal naming the candidates when a label is ambiguous or nothing matches exactly, because free-text retrieval is the row the graph measurably lost (`docs/CLAIMS.md` code-graph-retrieval-null) and every field it returns is a statement about ONE node. Re-measured twice via the pinned method on a freshly built dist/mcp/server.mjs: 26/26, the returned name set differing from the 25-tool set by exactly `graph_node`. Headroom stays zero by design."
     }
   }
 }

package/src/config/gate-coverage.yml

@@ -52,12 +52,12 @@
 #                of them.
 #   canary       optional mutation recipe (Phase 7) — see CANARY below
 #
-# COVERAGE — THE HONEST DENOMINATOR (re-measured 2026-09-29)
+# COVERAGE — THE HONEST DENOMINATOR (re-measured 2026-10-01)
 # ----------------------------------------------------------
-# 345 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`
+# 347 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`
 # (the count is computed, not asserted — `check_gate_coverage.count_gate_scripts`,
 # re-run on the tree carrying these rows.)
-# **107 rows are listed below**, so the manifest covers 107/345 = 31.0 % of the
+# **109 rows are listed below**, so the manifest covers 109/347 = 31.4 % of the
 # population, and is complete for every gate that can carry a floor. The row
 # count is `grep -c '^  - id:'`, recomputed here rather than incremented.
 #
@@ -1496,6 +1496,30 @@ gates:
       cannot survive a collapse: at that point the gate's own `reportScanned`
       fires first. (Set to 50 in the first version, corrected on an R2 finding.)
 
+  - id: check_verify_expectation_delta
+    argv: []
+    min_scanned: 0
+    corpus: "the `verify:` clauses a change ADDS under agents/roadmaps/ — a set difference against the base ref, not a file set, which is why the floor is 0: a change touching no roadmap legitimately adds none, and a floor above 0 would fail every unrelated pull request. The denominator the gate reports is added clauses, so a change that adds ten to one file scanned ten things."
+    status: enforced
+    no_canary_reason: >
+      A canary cannot express this gate's violation. The violation is a property
+      of the DIFF — a clause that was ADDED without an expectation — so a file
+      planted in the tree is, from the gate's point of view, a clause somebody
+      added, which is either a true positive (and the canary is indistinguishable
+      from the thing it is meant to detect) or, once committed on main, invisible
+      forever. The negative control is the gate's own `--self-test`, run as its
+      own CI step: 10 cases, 4 rejecting — an added bare clause, a bare clause
+      among expectation-carrying siblings, a `cat` command asked for an oracle
+      despite a weak exit status, and an `./path/script.ts` invocation that the
+      pointer carve-out must NOT exempt — plus six ACCEPT cases pinning what must
+      not fire (an expectation in either form, the prose MANUAL form, a backticked
+      file pointer with and without a `:line` suffix, and a bare clause already at
+      base). One limit is stated rather than implied: the already-at-base case
+      does not exercise context-line handling, because under `--unified=0` the
+      unchanged clause does not appear in the patch at all; the unit test
+      `reads ADDED lines only` is what pins that. Same class as
+      check_estate_count's diff-scoped half.
+
   - id: check_static_parity
     argv: ["--quiet"]
     min_scanned: 20
@@ -3017,6 +3041,47 @@ gates:
       exits 1 with "scanned 0 read surface(s)" rather than certifying a table it
       never compared.
 
+  - id: check_hook_bundle_composition
+    argv: []
+    ci_invocation: .github/workflows/consistency.yml
+    min_scanned: 150
+    corpus: >
+      modules esbuild inlines into `dist/hooks/dispatch.js` — 276 at baseline,
+      read from the metafile of a build this gate performs rather than from the
+      untracked bundle on disk. The floor sits at 150 because the dispatcher's
+      concern chain alone accounts for most of that graph and the figure moves by
+      ones as a concern is added or a dependency dropped; a reading below it means
+      the entry point moved or the build produced a stub, not that half the hook
+      layer was deleted. Note the floor is a MODULE count while the gate's own
+      bound is a BYTE count — deliberately two different units, because a bundle
+      can collapse to a stub at constant byte size only by also collapsing its
+      module graph, and neither number alone sees both failures.
+    status: enforced
+    no_canary_reason: >-
+      the canary contract is create-only and this gate's corpus is a BUILD
+      OUTPUT, not a tree. A planted file under `src/` is in scope only if
+      something imports it, and a planted file under `dist/hooks/` is read by
+      nothing here — the gate builds its own bundle to a temporary directory
+      precisely so no on-disk artefact can steer its verdict. Both violations it
+      has are properties of that build: a second YAML package contributing bytes,
+      and a byte count over the committed ceiling. Discrimination is proven by
+      `--self-test` instead (4 cases, 3 rejecting: a second YAML reader, a bundle
+      one byte over the ceiling, and a metafile with no entry-point output — the
+      last being the build-produced-nothing case, which must exit non-zero rather
+      than certify a composition of 0 bytes). Proven additionally against the
+      REAL artefact rather than only against fixtures: run over the metafile of
+      the pre-swap bundle, both findings fire with the measured figures
+      (`js-yaml` 95,846 B beside `yaml` 258,839 B, 1,563,576 bytes against a
+      1,500,000 ceiling), which is the regression this gate was built for seen
+      red on the bytes that actually shipped.
+    note: >
+      road-to-a-hook-bundle-with-one-yaml-reader 1.3 + 2.1. Its two siblings are
+      local-only by construction (`dist/hooks/` is untracked, so CI has no bundle
+      to read); this one is not, because it builds the bundle it measures. What it
+      deliberately does NOT claim is anything about latency — the wall-clock axis
+      is `src/config/hook-latency-budget.json` and no number here is derived from
+      it.
+
   - id: check_enforcement_matrix
     argv: ["--quiet"]
     ci_invocation: .github/workflows/consistency.yml
@@ -3164,3 +3229,73 @@ gates:
       asserted in BOTH places — it was credited to `--self-test` before it was
       actually there, which a review caught and which is why the assertion now
       exists rather than the sentence being softened.
+  - id: lint_workflow_security
+    argv: ["--strict"]
+    min_scanned: 25
+    corpus: "workflow files under .github/workflows/ — `*.yml` then `*.yaml`, the two globs the gate scans in that order (35 today). The floor is 25 because workflows are consolidated and split routinely, so a handful leaving is normal, while a glob that stopped matching or a directory that moved reads far below it. Counting FILES and not findings is the point: this gate legitimately reports zero findings, so a floor over findings would be the false-count shape this file rejects."
+    status: enforced
+    ci_invocation: .github/workflows/consistency.yml
+    canary:
+      class: contract-violation
+      path: .github/workflows/zz-canary-workflow-security.yml
+      content: |
+        name: zz canary — planted by check_gate_coverage --canary; never ships
+        on:
+          pull_request_target:
+        jobs:
+          build:
+            runs-on: ubuntu-latest
+            steps:
+              - uses: actions/checkout@0000000000000000000000000000000000000000
+                with:
+                  persist-credentials: false
+                  ref: ${{ github.event.pull_request.head.sha }}
+    note: >-
+      road-to-gates-a-pull-request-can-hear 2.1. Until 2026-10-07 the CI
+      invocation carried no `--strict`, so a planted HIGH was reported and the
+      gate still exited 0, and this row carried a no_canary_reason saying so.
+      The AI council (anthropic + openai, 2/2, both choosing option a) decided on
+      2026-10-07 to run the step under `--strict`; the tier assignment of the
+      2026-06-13 lock is unchanged, MEDIUM stays advisory. The recipe above is a
+      `pull_request_target` workflow checking out the untrusted head ref — a HIGH
+      — and `--self-test` (5 cases, 3 rejecting) still pins the tier split from
+      the other side: a MEDIUM under `--strict` must PASS.
+  - id: lint_pack_boundaries
+    argv: ["--quiet"]
+    min_scanned: 600
+    corpus: "source artefacts the shared resolver yields (`_lib/agent_src.iter_artefacts` over skills, rules, agent-src and domains), counted as FILES — 833 on 2026-10-09, of which 139 sit outside any pack's scope and are still counted because they were read. The floor is 600 because artefacts are merged and retired routinely, while a resolver that stopped yielding a root drops by hundreds at once: skills alone are over half the corpus. The violation COUNT is not what this floor guards; that is the ratchet in src/config/gate-violation-baselines.json, which fails the run when it rises above the recorded baseline."
+    status: enforced
+    ci_invocation: .github/workflows/consistency.yml
+    no_canary_reason: >-
+      A create-only canary cannot discriminate reliably on a ratchet. The gate
+      fails only when the live violation count rises ABOVE the recorded baseline,
+      so a planted violation reads red only while the count sits at the baseline:
+      once real fixes lower the count and nobody lowers the baseline, any fixed
+      plant smaller than that headroom reads green and the ledger would call a
+      live gate dead. Measured once by hand on 2026-10-07 at count == baseline
+      (203): one planted `founder-strategy` -> `gtm-marketing` link read 204 and
+      exited 1. That reading is kept as the historical record and is NO LONGER
+      REPRODUCIBLE as written: the baseline is 120 since 2026-10-09, so a reader
+      re-running it measures against a number that no longer exists. Re-measured
+      on 2026-10-09 at count == baseline (120): one planted
+      `founder-strategy` -> `gtm-marketing` link reads 121 and exits 1. The same
+      pass found the ratchet's second blind spot and it is named here rather
+      than left to the next reader: a link on a pack pair joined by an advisory
+      `suggests` edge is PERMITTED, so it does not raise the count at all and
+      exits 0 at any headroom. The permitted COUNT prints on every run,
+      `--quiet` included, which is the signal that set is growing; there is no
+      ratchet on it. Discrimination is proven instead by `--self-test` (7 cases,
+      4 rejecting), which runs the real CLI over fixture roots where the ratchet
+      is not consulted, so any violation exits 1 whatever the repository's
+      headroom: an undeclared cross-pack link and an artefact with no resolvable
+      pack exit 1, an empty corpus exits 2, and a link declared through
+      `requires`, a link inside one pack, and a link an advisory `suggests` edge
+      permits all pass — the last paired with its denial, the same link without
+      the edge, which exits 1. Seen red deliberately on 2026-10-07 by making the
+      allow rule accept every link: the cross-pack case alone fails, 4/5.
+    note: >-
+      road-to-gates-a-pull-request-can-hear 3.1. Until this row the gate ran only
+      under the local `task ci`, which no workflow invokes, so a pull request that
+      added a cross-pack link got no red check from anything. The step in
+      consistency.yml runs it with this argv; `--self-test` proves the CLI still
+      rejects an undeclared link, an unresolved pack and an empty corpus.