@event4u/agent-config 16.3.0 → 16.4.0

package/src/config/gate-violation-baselines.json

@@ -1,6 +1,12 @@
 {
   "$comment": "Violation ratchet for gates whose dead scan root was repaired. A repair REVEALS pre-existing debt; it does not create it. Each entry records the count revealed at repair time — the gate fails only when its count RISES. Lowering a count is a normal commit; raising one is a defect. Entries expire: a baseline that has not dropped within 56 days of `landed` (or of `reaffirmed.date`) fails its gate, because a number that never moves is suppression with extra steps. Mechanism + rationale: src/scripts/_lib/gate_baseline.ts. Decision: AI council 2026-08-02, roadmap road-to-gates-that-can-fail blocker `dead-gate-finding-triage`.",
   "gates": {
+    "lint_blocker_citations": {
+      "count": 10,
+      "landed": "2026-10-06",
+      "falsifier": "./scripts-run src/scripts/lint_blocker_citations  # lists every miss; it fails when the count RISES above this entry",
+      "note": "Blocker citations (`path:line`) in the `## Blockers` section of active roadmaps and stubs whose file does not resolve, measured on main @ adaad0aa2 when the lint landed (road-to-parked-blockers-that-get-asked step 5.1, decision D3). All 10 are a bare basename or a partial path (`chairman.ts:71-76`, `archive/road-to-session-closeout.md:182`) that resolves neither from the repository root nor from the citing roadmap's directory; none is a line beyond the end of an existing file. A ratchet rather than a hard fail because line citations drift with every edit above them, so an existing miss is drift rather than a new defect. Each one clears by writing the citation repository-relative, or deleting it when its target is gone; the count only falls."
+    },
     "check_claims:non-inference": {
       "count": 40,
       "landed": "2026-08-26",
@@ -38,9 +44,9 @@
       "note": "The nine active non-draft roadmaps that predate the `relates:` requirement (road-to-agentic-engineering-assurance, road-to-component-library-lifecycle, road-to-council-evidence-integrity, road-to-frontend-fidelity-calibration, road-to-monorepo-scope-and-detection, road-to-observability-plate, road-to-role-scoped-spawn-profiles, road-to-skill-delivery-over-mcp, road-to-standing-payload-diet). This is a NEW obligation rather than a repaired scan root, and the ratchet is the point: `depends:` shipped in the template with nothing requiring it and measured 0 adoption, so requiring `relates:` retroactively across the estate would be an owner-reserved write with no analysis behind the edges it would have to invent (held as step 4.3, deferred). Clearing an entry here is one roadmap at a time: run `agent-config roadmap:context` on it, write the rows the probe surfaces, and lower the count."
     },
     "check_source_size_budget": {
-      "count": 17550,
-      "landed": "2026-10-05",
-      "note": "LOWERING 2026-10-05, 17,571 -> 17,550 — a lowering commit, and the gate asked for it BY NAME: it reported `ratchet is loose` and named 17,550; `check_source_size_budget.test.ts` then pins baseline == live total, so this is required rather than optional. The gain IS this branch's own work and it is a DEDUPLICATION, which this convention accepts: all five CliClient subclass constructors forwarded six option fields to super() by name, which is why a seventh (`consumer`) was silently dropped and every CLI call booked as `unknown`. Replacing the five field lists with `{ ...opts, model: ... }` removes 27 lines from src/scripts/ai_council/clients.ts (2,858 -> 2,831) against the +6 the consumer fix added, so the net is -21. No ceiling was edited and no file was split to game the metric. The count is tree-derived (line counts over src/**/*.ts) and container-independent, unlike the projection-surface gates whose local readings diverge. Verified with `npx tsc --noEmit` clean and the clients suite green in this checkout. PRIOR ENTRY: LOWERING 2026-10-05, 17,585 -> 17,571 — a lowering commit, and the gate asked for it BY NAME: it reported `ratchet is loose` and named 17,571. The gain IS this branch's own work and it is an EXTRACTION, which is the only shape this convention accepts: road-to-an-installed-layer-that-is-thinned step 1.1 adds a thinning call to the global deploy loop, and pays for those lines by moving `_resolve_global_rule_scope` out of `src/scripts/install.ts` into `src/install/globalRuleScope.ts` behind a same-signature wrapper, and removes the two imports the extraction orphaned (install.ts 5,180 -> 5,156). The user-global whitelist rows in `src/scripts/_lib/agent_settings.ts` push that file 1,499 -> 1,510, so the net is -5 rather than -15. No ceiling was edited and no file was split to game the metric. Verified by running the gate in this worktree after `npx tsc --noEmit` passed clean. PRIOR ENTRY: LOWERING 2026-10-02, 17,620 -> 17,592 — a lowering commit, and the gate asked for it BY NAME: it reported `ratchet is loose` and named 17,592. The gain IS this branch's own work, and it is a deduplication rather than a sweep. `GLOBAL_DEPLOY_SOURCES` was defined TWICE — in `src/scripts/install.ts` and in `src/install/wizard-plan.ts` — and the two copies were byte-identical across all 18 host rows, which is a duplicate that stays correct exactly until somebody edits one of them. road-to-rule-triggers-and-links-that-hold step 1.2 did that: it added `contexts/` and `guidelines/` to the install.ts copy and the wizard kept installing without them, so the deduplication is the fix for a defect this branch introduced, not an opportunistic tidy. install.ts now imports and re-exports the wizard-plan definition, so every caller is unchanged, and the file goes 5,231 -> 5,175 lines. Verified by running the gate in this worktree after `npm run typecheck` passed clean. PRIOR ENTRY: LOWERING 2026-10-02, 17,734 -> 17,620 — a lowering commit, and the gate asked for it BY NAME: it reported `ratchet is loose` and named 17,620 as the number to write. The gain is not this branch's own work; it is the net of the lanes that merged into main while this branch was in flight, which is exactly the case the clause below exists for — a tree that got smaller while a baseline stood still would let the gain be given back silently by the next change. Verified in a FRESH detached checkout of the pushed head rather than in the working worktree, because the first reading was taken in a tree that had not finished its base sync and reported the two numbers the other way round; the fresh checkout measures 17,620 against a 17,734 baseline over 1,582 scanned files. `landed` is refreshed deliberately, for the reason every entry below gives: checkRatchet returns `improved` BEFORE it evaluates staleness, so an entry left high while the tree measures lower would never expire at any age. PRIOR ENTRY: LOWERING 2026-10-01, 17,745 -> 17,734 — a lowering commit, and the gate asked for it by name. road-to-a-hook-bundle-with-one-yaml-reader 3.1 split the windsurf renderer out of `condense.ts` into the new under-cap `src/scripts/_lib/windsurf_render.ts`, and `strip_frontmatter` moved with it as the render's one non-trivial dependency. `condense.ts` went 2,728 -> 2,717 excess lines. The direction is honest about its own history: an earlier commit on this branch kept the renderer INLINE in `condense.ts` and CI caught it as 20 new violations — this entry is that fix, not a sweep, and the lowering is the by-product of putting the code where it belonged. Nothing was deleted: the renderer and the stripper are both still called, by TWO callers now rather than one, and `condense.ts` re-exports `strip_frontmatter` so no importer's path changed. The new module lands at 64 lines, far under its own cap, so it contributes zero excess. LOCAL READING, same discriminator every entry below uses: the gate walks authored source under `src/`, and the only untracked path `git status --porcelain -uall -- src` reports is that new module, committed in this same change — so a clean CI checkout of this commit measures the same 17,734. If CI reads anything else, CI's number is the correct one and this note is the record of why. `landed` is refreshed deliberately, for the reason the prior entry gives: checkRatchet returns `improved` BEFORE it evaluates staleness, so an entry left high while the tree measures lower would never expire at any age. PRIOR ENTRY: LOWERING 2026-09-30, 17,746 -> 17,745 — a lowering commit, and the gate asked for it by name. The direction is the surprising one again: this branch ADDED a feature to `install.ts` (an opt-in host env write) and that file came out SHORTER than it went in, 5,270 -> 5,269. The whole mechanism — the two-row allow table, the settings reader, the env-block builder and the bridge wrapper — lives in the new under-cap `src/scripts/_lib/host_env_write.ts`, so `install.ts` pays ONE import line and one expression for it; and the three-line `for` loop over healed plugin ids in the same function collapsed to one, which is inside the function the change already edits. The gain is a MOVE plus one tightening, never a deletion: nothing was dropped and nothing was swept. That module boundary is also the better one on its own terms — one place now owns which host variable this package may write, which is the question the owner decision of 2026-09-30 turns on. LOCAL READING, on the same discriminator every entry below uses: the gate walks authored source under `src/`, and `git status --porcelain -uall -- src` reported ZERO untracked files, so a clean CI checkout of this commit measures the same 17,745. If CI reads anything else, CI's number is the correct one and this note is the record of why. `landed` is refreshed deliberately: checkRatchet returns `improved` BEFORE it evaluates staleness, so an entry left at 17,746 while the tree measures 17,745 would never expire at any age. PRIOR ENTRY: LOWERING 2026-09-29, 17,748 -> 17,746 — a lowering commit, same doctrine as every entry below, and the gate asked for it by name. This branch ADDED two gate scripts, a guard and a shared lib under `src/`, so the direction is the surprising one and worth stating: the new files each land under their own cap and contribute zero EXCESS, while factoring the shell write shapes out of `block_kernel_rule_writes` into `_lib/shell_write_shapes.ts` moved lines out of a file that was over its cap and into one that is not. Net -2. LOCAL READING, on the same discriminator every entry below uses: the gate walks authored source under `src/`, and `git status --porcelain -uall -- src` reported ZERO untracked files, so a clean CI checkout of this commit measures the same 17,746. If CI reads anything else, CI's number is the correct one and this note is the record of why. `landed` is refreshed deliberately: checkRatchet returns `improved` BEFORE it evaluates staleness, so an entry left at 17,748 while the tree measures 17,746 would never expire at any age. PRIOR ENTRY: LOWERING 2026-09-29, 17,762 -> 17,748 — a lowering commit, same doctrine as every entry below, and the gate asked for it by name. Reporting the host traffic environment in `doctor` needed a new surface; rather than pay those lines against `src/scripts/_cli/cmd_doctor.ts`, already far over the cap, the whole network-posture block moved out into the new under-cap `src/scripts/_cli/doctor_network_posture.ts`, which is also where the new logic lives: one module owns which traffic variables exist, how each is read, and how an absent one is reported, so the unit is coherent rather than a line-count trim. cmd_doctor.ts 3,618 -> 3,604; total 17,762 -> 17,748. The gain is a MOVE, not a deletion — nothing was dropped and nothing was swept. `landed` is refreshed deliberately, for the reason the prior entries record: checkRatchet returns `improved` BEFORE it evaluates staleness, so an entry left at 17,762 while the tree measures 17,748 would never expire at any age, and the gate only ADVISES on a loose ratchet while `check_source_size_budget.test.ts` blocks — that asymmetry is what forces a lowering commit to carry its own baseline update. PRIOR ENTRY: LOWERING 2026-09-27, 17,765 -> 17,762 — the second half of the same repair, and a lowering for the same reason. Closing the remaining preservation defects needed lines in two over-cap files: `src/scripts/install.ts` (route the generated Claude Desktop marker through the tracker, hand the rule-rewrite its skip set) and `src/server/routes/wizard.ts` (surface the conflict count, stop reporting exit 3 as a failure). Both were paid from the same subject rather than from the ratchet: `_files_by_tool_from_bridges` joined its sibling in `src/install/manifestFiles.ts`, which now owns the whole per-tool inventory, and the wizard's exit-code semantics moved into `src/install/preserve.ts` beside `installDoneSummary`, which already lives there for this exact reason. install.ts 5,277 -> 5,270; wizard.ts 1,500 -> 1,504. PRIOR ENTRY: LOWERING 2026-09-27, 17,784 -> 17,765 — a lowering commit, same doctrine as the entry it replaces. Repairing the install-manifest digest loss needed new state in `_update_installed_tools_manifest` (a recorded-inventory read, a preserved-path index, a reconciliation call). Rather than pay that against `src/scripts/install.ts`, already 3,777 over the cap, the manifest file-inventory block (`_sha256_of_file`, `_file_entry`, `_files_by_tool_from_deploy` — 29 lines) moved out into the under-cap `src/install/manifestFiles.ts`, which is where the new logic lives too: one module now owns what the manifest's per-tool `files[]` holds, how it is read back, and how the two reconcile, so the unit is coherent rather than a line-count trim. install.ts 5,296 -> 5,277; total 17,784 -> 17,765. PRIOR ENTRY: LOWERING 2026-09-20, 17,858 -> 17,784 — a lowering commit, not a reconciliation, but measured under the same doctrine the four entries below carry: the committed number is the gate's own reading on the MERGED tree, taken after origin/main was merged into drain/headless-log-write rather than from either side. The branch's transaction-log write added 27 lines to `src/scripts/install.ts`, already 3,897 over the cap, taking the total to 17,885. Rather than pay that, the `json.dumps` byte-parity block (`jsonStrNoAscii`, `_jsonScalar`, `_dumpIndent`, `jsonDumpsIndent`, `jsonDumpsCompact` — 101 lines) moved out of `install.ts` into the under-cap `src/scripts/_lib/json_python_parity.ts`: pure, total functions of their input carrying no installer state, so the unit is coherent rather than a line-count trim. install.ts 5,397 -> 5,296; total 17,885 -> 17,784, a net -74 against the prior baseline. PRIOR ENTRY: MERGE RECONCILIATION 2026-09-14, 17,861 -> 17,858 — the FOURTH reconciliation of this entry, same doctrine as the three below: the committed number is the gate's own reading on the MERGED tree, never either side's. Neither branch earned the -3; it falls out of main having absorbed drain/release-head-field, whose `derive_head_prefill` extraction moved the span-to-prefill composition into an under-cap module. Taking this branch's 17,861 would have silently given that gain back. PRIOR ENTRY: MERGE RECONCILIATION 2026-09-13, 17,863 -> 17,861 — the THIRD reconciliation of this entry in one day, and re-measured on the merged tree rather than taken from either side, which is the only resolution that converges. drain/adversarial-verification reached 17,864 by paying for a `forge_protection` block and a cascade-base module entirely in files under the 1,500-line cap; the incoming reconciliation reached 17,863 from different work. Neither describes the merge. PRIOR ENTRY: MERGE RECONCILIATION 2026-09-13, 17,944/17,866 -> 17,863. drain/decision-closure and drain/breaking-line-contradiction each lowered from the SAME 17,947 base in parallel -- this branch to 17,944 (net -3: the ownership vocabulary, its two Iron-Law sets and the merged default-mode map moved out of ai_council/config.ts into ai_council/ownership_classes.ts, and the settings-rename block moved out of _lib/agent_settings.ts into _lib/settings_renamed_keys.ts, both UNDER the 1500 cap so both cost nothing) and main to 17,866. Taking either side alone is wrong in a different direction, which is the doctrine this entry already carries from 2026-09-03 and 2026-09-07: main's value silently discards this branch's earned -3, and this branch's value RAISES the baseline against main and weakens the gate. The committed number is neither -- it is the gate's own output on the MERGED tree, where both reductions apply. MAIN-SIDE ENTRY, carried so neither branch's record is lost: Lowered 17,947 -> 17,866 on 2026-09-13 by drain/breaking-line-contradiction, on this entry's own doctrine. The branch adds the BACKWARD half of the MIGRATION.md obligation -- a refusal for a major cut whose BREAKING section has no migration entry -- and writing it into release.ts came in at +61, because that file sits ~375 lines PAST the 1500 cap so every line there is one unit. Paid down rather than baselined, and the move was the coherent unit rather than the minimum one: BOTH refusals went, the new backward half and the pre-existing forward half (assert_scheduled_deprecations_clear), into _lib/release_migration_gate.ts at 184 lines and therefore UNDER the cap, so the pair and all their rationale now cost nothing. They moved on merit rather than only on arithmetic -- they are the two halves of one obligation, written eleven months apart, and release.ts held only the two call sites. parse_version stayed module-private in release.ts and the lib carries a two-line _minor_patch instead: exporting a private helper to serve one caller would widen the surface of the file the move exists to narrow. release.ts 1,875 -> 1,733: a branch that ADDED a pipeline refusal leaves the file eighty-one lines shorter than it found it. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports nothing staged and nothing untracked at this commit, so a clean CI checkout measures the same 17,866. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises -- which is how CI found it: the gate exited 0 with a loose-ratchet warning and the test went red. PRIOR ENTRY: Lowered 17,959 -> 17,947 on 2026-09-11 by the findings-ledger branch, on this entry's own doctrine. The branch adds step 7 to release.ts, which sits ~326 lines PAST the 1500 cap so every line there is one unit, and it came in at +145. Paid down rather than baselined, in two moves. `settle_findings_ledger` and `_blocking_without_disposition` moved out of release.ts into _lib/release_findings_ingest.ts -- 95 lines, and that module is under the cap, so the step and its rationale now cost nothing. It moved on merit rather than only on arithmetic: the module already owns every message the step prints and every argv it builds, and release.ts held only the sequencing. Then the `--ci` fallback dispatch of the three tag-triggered workflows -- 24 lines of loop and warning with no reader elsewhere in step 10 -- moved into _lib/release_tag_dispatch.ts, also under the cap. release.ts 1,826 -> 1,814: a branch that ADDED a pipeline step leaves the file twelve lines shorter than it found it. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the branch's new src/ file staged and nothing untracked, so a clean CI checkout of this commit measures the same 17,947. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 17,963 -> 17,959 on 2026-09-09 by feat/cdd-fidelity-council, on the same shape as the entry below and with the same discriminator. The branch's src-link rewrite (a blind review found 253 of 268 links under dist/agent-src/guidelines/ dead, because condense.ts folded only the docs/ prefixes and never (../)+src/rules|skills) came in at +15 excess: condense.ts sits ~1,208 lines PAST the 1500 cap, so every line there is one unit. Paid down rather than baselined, in the way this entry's doctrine prescribes. `_rewrite_body_links` and its two regex constants moved out of condense.ts into _lib/guidelines_lane.ts, 151 lines and therefore UNDER the cap, so the function and its prose now cost nothing. It moved on merit rather than only on arithmetic: every rule the rewriter applies is a statement about which source tree projects where, which is that module's own subject, and condense.ts held it only because that is where the projector lives. condense.ts 2,712 -> 2,708 net, after the one import line and the one call-site rename -- a branch that ADDED a rewrite rule leaves the file four lines shorter than it found it. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the branch's new src/ files tracked and nothing untracked, so a clean CI checkout of this commit measures the same 17,959. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 17,973 -> 17,963 on 2026-09-08 by drain/graph-shipped-close. The branch registers five code-graph MCP tools (road-to-a-graph-that-is-shipped 4.1). Their five records and schemas are ~250 lines, and putting them in mcp_server/tools.ts -- which sits ~500 lines PAST the 1500 cap, so every line there is one unit -- would have cost ~250 excess. They live in mcp_server/graph_tools.ts instead (~280 lines, UNDER the cap, so they and their prose cost nothing), and tools.ts spreads them into ALLOWLIST in two lines: one import and one `...GRAPH_TOOLS,`. Those two were paid for rather than baselined, in the way this entry's doctrine prescribes: `_strip` and `_resolvePath` -- a whitespace trim and a tolerant realpath, generic by nature -- moved out of tools.ts into mcp_server/path_util.ts, also under the cap. They are imported under their original underscore names, so all 28 call sites are unchanged and a two-function move does not read as a sweep. tools.ts 2,025 -> 2,015: -12 from the extraction, +2 from the registration, net -10 for a branch that ADDED a feature. CORRECTED 2026-09-08 after an independent review checked the figure against the tree -- this sentence read '2,025 -> 2,013, net -12, against the +2 the registration needed', which states an intermediate file length as the final one and leaves the arithmetic (-12) and the conclusion (-10) describing different trees. `git show origin/main:...tools.ts | wc -l` is 2025 and the working tree is 2015. The TOTAL, 17,963, was always the gate's own output and is unchanged. Every other file this branch touches or creates -- code_graph/verbs.ts, code_graph/cli.ts, code_graph/build.ts, code_graph/detect.ts, code_graph/query.ts, code_graph/sqlite_store.ts, code_graph/types.ts, _lib/regression_neighbourhood.ts -- is under the 1500 ceiling before and after, so it contributes zero excess whatever it grew by. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the two new src/ files staged and nothing untracked, so a clean CI checkout of this commit measures the same 17,963. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 17,974 -> 17,973 on 2026-09-08 by drain/topology-c1. The branch adds a live-path emit to council_cli.ts, which sits 2,454 lines PAST the 1500 cap so every line there is one unit, and paid its own way down rather than raising the baseline, in the way this entry's doctrine prescribes. The twelve-line `all_responses` assembly (a spread, three conditionals and a push) moved out of council_cli.ts into ai_council/deliberation_metrics.ts::runCallsFrom, 353 lines and therefore UNDER the cap, so the six stage labels and their prose cost nothing. It moved on merit rather than only on arithmetic: 'which calls did this run make, and at which stage' is that module's own subject, and the CLI held the list only as a flat array with the stage boundaries implicit in the order -- both readings now come out of one walk, so the billing total and the attribution can never be computed over different sets. council_cli.ts 3,955 -> 3,954 net, after the two call lines, the import and the one payload key the feature needed. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the two new src/ files staged and nothing untracked, so a clean CI checkout of this commit measures the same 17,973. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 18,016 -> 17,974 on 2026-09-07 by fix/single-delivery-unconditional. SETTLED FIGURE, and it supersedes an intra-session 17,962 this same branch committed earlier — read the direction against MAIN, which is what the ratchet protects: main is 18,016, the branch leaves 17,974, net -42. The 17,962 was this branch's own low before a neutral review returned twelve findings; fixing them added a real mechanism to mcp_server and condense.ts (the flat-wrapper carriage gate the review showed was missing, plus its four-skip predicate), and condense.ts sits ~1,215 lines PAST the cap so each of those lines is one unit. Paid down first, in the way this entry's doctrine prescribes: _suggestSkillForTaskHandler and its 18-line docstring moved out of mcp_server/tools.ts (2,079 -> 2,025) into mcp_server/suggest_skill.ts, 72 lines and UNDER the cap, so its prose costs nothing. The residual +12 against the intra-session low is the gate's own output on the settled tree and is recorded rather than engineered away, because the alternative was extracting _nested_command_subpath and its two callers out of condense.ts - which needs MODULE_STATE, _relativeToPosix and _domains_command_logical passed in, a wider diff than the finding warrants and one no review asked for. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the three new src/ files staged and nothing untracked, so a clean CI checkout of this commit measures the same 17,974. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: MERGE RECONCILIATION 2026-09-07, 18,061/18,017 -> 18,016. drain/admissible-council-seats and fix/release-obligation-answerable each lowered from the SAME 18,062 base in parallel — main to 18,061 (net -1: curlJsonPost, the seat-status helpers and the per-seat config parsing moved out of the three over-ceiling council files) and the branch to 18,017 (net -45: the /dev/tty prompt helpers moved out of release.ts into _lib/tty_prompt.ts, 76 lines and UNDER the cap, taking release.ts 1871 -> 1826). Taking either side alone is wrong in a different direction, which is the reconciliation doctrine this entry already carried from 2026-09-03: main's value silently discards the branch's earned -45, and the branch's value RAISES the baseline against main and weakens the gate. The committed number is neither — it is the gate's own output on the MERGED tree, where both reductions apply, and it equals the arithmetic (18,062 - 45 - 1 = 18,016) rather than being reconciled by it. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports ZERO untracked files, so a clean CI checkout of this commit measures the same 18,016. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in the merge commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 18,062 -> 18,061 on 2026-09-07 by drain/admissible-council-seats. The branch's own additions to the three over-ceiling files (ai_council/config.ts, council_cli.ts, ai_council/clients.ts) came in at +96 excess and were paid down to -1 rather than baselined, in the four ways this entry's doctrine prescribes: `curlJsonPost` moved out of clients.ts into ai_council/api_transport.ts (UNDER the cap, so the prose and the three new provider shims cost nothing); the seat-status helpers moved out of council_cli.ts into ai_council/status_surface.ts, taking an orphaned doc comment with them; the three new per-seat config fields' parsing moved out of config.ts into ai_council/seat_policy.ts::parseSeatFields; and three prose blocks that the branch's own transport repair made FACTUALLY FALSE (the `openai` / `google-genai` Python-SDK claims, and a `_curlJsonPost` pointer to a function that had moved) were corrected and shortened in the same change. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports zero untracked files with the five new src/ files staged, so a clean CI checkout of this commit measures the same 18,061. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried here because tests/scripts/check_source_size_budget.test.ts:166 asserts baseline == live and therefore blocks where the gate only advises -- the lowering commit must carry its own baseline update. Lowered 18,068 -> 18,062 on 2026-09-06 by drain/host-enforcement-truth. Collapsing the five per-host binding constants in install.ts into src/scripts/hooks/host_lowering.yaml removed 29 lines from a file ~3,900 past the 1500 cap, where every line costs one excess; the journal's surface column and its extracted migration helper gave 23 back. Lowered 18,245 -> 18,230 on 2026-09-02 by drain/publication-integrity-option-a. Phase 2 Option A moved the authoring instruction out of the generator: release.ts, which sits ~530 lines PAST the 1500 cap so every line there costs one excess, loses the comment emission, a 16-line HEAD_DEFAULT doc block and its alias const, and gains a shorter writer docstring. The doc block moved to _lib/release_material.ts, which is 289 lines and therefore UNDER the cap, so the same prose now costs nothing. Net -15. The branch first came in at +8 and paid its own way down rather than raising the baseline. BRANCH-SIDE ENTRY: Lowered 17,947 -> 17,944 on 2026-09-13 by drain/decision-closure, on this entry's own doctrine and at the gate's own request. The branch's ownership-axis additions to ai_council/config.ts came in at +86 excess: that file sits ~700 lines PAST the 1500 cap, so every line there is one unit. Paid down rather than baselined, in one move. The eight ownership class names, the two Iron-Law sets, the merged default-mode map and the mode-check function moved out of config.ts into ai_council/ownership_classes.ts -- 91 lines, UNDER the cap, so the vocabulary and its prose now cost nothing. It moved on merit rather than only on arithmetic: the roadmap-side gate lint_decision_classes needs the same eight names and has no business importing the council's whole schema to learn them, and the loader now carries three lines where it carried twenty-four. config.ts 2,182 -> 2,179: a branch that ADDED an entire decision axis leaves the file three lines shorter than it found it. Every other src/ file this branch creates -- lint_decision_classes.ts, lint_roadmap_producers.ts, closure_scan.ts, council_record_shape.ts, scope_growth.ts, ownership_classes.ts -- is under the 1500 ceiling, so it contributes zero excess whatever it grew by. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the branch's new src/ files tracked and nothing untracked, so a clean CI checkout of this commit measures the same 17,944. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 17,959 -> 17,947 on 2026-09-11 by the findings-ledger branch, on this entry's own doctrine. The branch adds step 7 to release.ts, which sits ~326 lines PAST the 1500 cap so every line there is one unit, and it came in at +145. Paid down rather than baselined, in two moves. `settle_findings_ledger` and `_blocking_without_disposition` moved out of release.ts into _lib/release_findings_ingest.ts -- 95 lines, and that module is under the cap, so the step and its rationale now cost nothing. It moved on merit rather than only on arithmetic: the module already owns every message the step prints and every argv it builds, and release.ts held only the sequencing. Then the `--ci` fallback dispatch of the three tag-triggered workflows -- 24 lines of loop and warning with no reader elsewhere in step 10 -- moved into _lib/release_tag_dispatch.ts, also under the cap. release.ts 1,826 -> 1,814: a branch that ADDED a pipeline step leaves the file twelve lines shorter than it found it. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the branch's new src/ file staged and nothing untracked, so a clean CI checkout of this commit measures the same 17,947. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 17,963 -> 17,959 on 2026-09-09 by feat/cdd-fidelity-council, on the same shape as the entry below and with the same discriminator. The branch's src-link rewrite (a blind review found 253 of 268 links under dist/agent-src/guidelines/ dead, because condense.ts folded only the docs/ prefixes and never (../)+src/rules|skills) came in at +15 excess: condense.ts sits ~1,208 lines PAST the 1500 cap, so every line there is one unit. Paid down rather than baselined, in the way this entry's doctrine prescribes. `_rewrite_body_links` and its two regex constants moved out of condense.ts into _lib/guidelines_lane.ts, 151 lines and therefore UNDER the cap, so the function and its prose now cost nothing. It moved on merit rather than only on arithmetic: every rule the rewriter applies is a statement about which source tree projects where, which is that module's own subject, and condense.ts held it only because that is where the projector lives. condense.ts 2,712 -> 2,708 net, after the one import line and the one call-site rename -- a branch that ADDED a rewrite rule leaves the file four lines shorter than it found it. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the branch's new src/ files tracked and nothing untracked, so a clean CI checkout of this commit measures the same 17,959. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 17,973 -> 17,963 on 2026-09-08 by drain/graph-shipped-close. The branch registers five code-graph MCP tools (road-to-a-graph-that-is-shipped 4.1). Their five records and schemas are ~250 lines, and putting them in mcp_server/tools.ts -- which sits ~500 lines PAST the 1500 cap, so every line there is one unit -- would have cost ~250 excess. They live in mcp_server/graph_tools.ts instead (~280 lines, UNDER the cap, so they and their prose cost nothing), and tools.ts spreads them into ALLOWLIST in two lines: one import and one `...GRAPH_TOOLS,`. Those two were paid for rather than baselined, in the way this entry's doctrine prescribes: `_strip` and `_resolvePath` -- a whitespace trim and a tolerant realpath, generic by nature -- moved out of tools.ts into mcp_server/path_util.ts, also under the cap. They are imported under their original underscore names, so all 28 call sites are unchanged and a two-function move does not read as a sweep. tools.ts 2,025 -> 2,015: -12 from the extraction, +2 from the registration, net -10 for a branch that ADDED a feature. CORRECTED 2026-09-08 after an independent review checked the figure against the tree -- this sentence read '2,025 -> 2,013, net -12, against the +2 the registration needed', which states an intermediate file length as the final one and leaves the arithmetic (-12) and the conclusion (-10) describing different trees. `git show origin/main:...tools.ts | wc -l` is 2025 and the working tree is 2015. The TOTAL, 17,963, was always the gate's own output and is unchanged. Every other file this branch touches or creates -- code_graph/verbs.ts, code_graph/cli.ts, code_graph/build.ts, code_graph/detect.ts, code_graph/query.ts, code_graph/sqlite_store.ts, code_graph/types.ts, _lib/regression_neighbourhood.ts -- is under the 1500 ceiling before and after, so it contributes zero excess whatever it grew by. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the two new src/ files staged and nothing untracked, so a clean CI checkout of this commit measures the same 17,963. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 17,974 -> 17,973 on 2026-09-08 by drain/topology-c1. The branch adds a live-path emit to council_cli.ts, which sits 2,454 lines PAST the 1500 cap so every line there is one unit, and paid its own way down rather than raising the baseline, in the way this entry's doctrine prescribes. The twelve-line `all_responses` assembly (a spread, three conditionals and a push) moved out of council_cli.ts into ai_council/deliberation_metrics.ts::runCallsFrom, 353 lines and therefore UNDER the cap, so the six stage labels and their prose cost nothing. It moved on merit rather than only on arithmetic: 'which calls did this run make, and at which stage' is that module's own subject, and the CLI held the list only as a flat array with the stage boundaries implicit in the order -- both readings now come out of one walk, so the billing total and the attribution can never be computed over different sets. council_cli.ts 3,955 -> 3,954 net, after the two call lines, the import and the one payload key the feature needed. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the two new src/ files staged and nothing untracked, so a clean CI checkout of this commit measures the same 17,973. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 18,016 -> 17,974 on 2026-09-07 by fix/single-delivery-unconditional. SETTLED FIGURE, and it supersedes an intra-session 17,962 this same branch committed earlier — read the direction against MAIN, which is what the ratchet protects: main is 18,016, the branch leaves 17,974, net -42. The 17,962 was this branch's own low before a neutral review returned twelve findings; fixing them added a real mechanism to mcp_server and condense.ts (the flat-wrapper carriage gate the review showed was missing, plus its four-skip predicate), and condense.ts sits ~1,215 lines PAST the cap so each of those lines is one unit. Paid down first, in the way this entry's doctrine prescribes: _suggestSkillForTaskHandler and its 18-line docstring moved out of mcp_server/tools.ts (2,079 -> 2,025) into mcp_server/suggest_skill.ts, 72 lines and UNDER the cap, so its prose costs nothing. The residual +12 against the intra-session low is the gate's own output on the settled tree and is recorded rather than engineered away, because the alternative was extracting _nested_command_subpath and its two callers out of condense.ts - which needs MODULE_STATE, _relativeToPosix and _domains_command_logical passed in, a wider diff than the finding warrants and one no review asked for. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the three new src/ files staged and nothing untracked, so a clean CI checkout of this commit measures the same 17,974. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: MERGE RECONCILIATION 2026-09-07, 18,061/18,017 -> 18,016. drain/admissible-council-seats and fix/release-obligation-answerable each lowered from the SAME 18,062 base in parallel — main to 18,061 (net -1: curlJsonPost, the seat-status helpers and the per-seat config parsing moved out of the three over-ceiling council files) and the branch to 18,017 (net -45: the /dev/tty prompt helpers moved out of release.ts into _lib/tty_prompt.ts, 76 lines and UNDER the cap, taking release.ts 1871 -> 1826). Taking either side alone is wrong in a different direction, which is the reconciliation doctrine this entry already carried from 2026-09-03: main's value silently discards the branch's earned -45, and the branch's value RAISES the baseline against main and weakens the gate. The committed number is neither — it is the gate's own output on the MERGED tree, where both reductions apply, and it equals the arithmetic (18,062 - 45 - 1 = 18,016) rather than being reconciled by it. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports ZERO untracked files, so a clean CI checkout of this commit measures the same 18,016. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in the merge commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 18,062 -> 18,061 on 2026-09-07 by drain/admissible-council-seats. The branch's own additions to the three over-ceiling files (ai_council/config.ts, council_cli.ts, ai_council/clients.ts) came in at +96 excess and were paid down to -1 rather than baselined, in the four ways this entry's doctrine prescribes: `curlJsonPost` moved out of clients.ts into ai_council/api_transport.ts (UNDER the cap, so the prose and the three new provider shims cost nothing); the seat-status helpers moved out of council_cli.ts into ai_council/status_surface.ts, taking an orphaned doc comment with them; the three new per-seat config fields' parsing moved out of config.ts into ai_council/seat_policy.ts::parseSeatFields; and three prose blocks that the branch's own transport repair made FACTUALLY FALSE (the `openai` / `google-genai` Python-SDK claims, and a `_curlJsonPost` pointer to a function that had moved) were corrected and shortened in the same change. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports zero untracked files with the five new src/ files staged, so a clean CI checkout of this commit measures the same 18,061. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried here because tests/scripts/check_source_size_budget.test.ts:166 asserts baseline == live and therefore blocks where the gate only advises -- the lowering commit must carry its own baseline update. Lowered 18,068 -> 18,062 on 2026-09-06 by drain/host-enforcement-truth. Collapsing the five per-host binding constants in install.ts into src/scripts/hooks/host_lowering.yaml removed 29 lines from a file ~3,900 past the 1500 cap, where every line costs one excess; the journal's surface column and its extracted migration helper gave 23 back. Lowered 18,245 -> 18,230 on 2026-09-02 by drain/publication-integrity-option-a. Phase 2 Option A moved the authoring instruction out of the generator: release.ts, which sits ~530 lines PAST the 1500 cap so every line there costs one excess, loses the comment emission, a 16-line HEAD_DEFAULT doc block and its alias const, and gains a shorter writer docstring. The doc block moved to _lib/release_material.ts, which is 289 lines and therefore UNDER the cap, so the same prose now costs nothing. Net -15. The branch first came in at +8 and paid its own way down rather than raising the baseline.",
+      "count": 17516,
+      "landed": "2026-10-09",
+      "note": "LOWERING 2026-10-09, 17,550 -> 17,516 — the gate asked for it by name after `REMOVED_KEYS` and its once-per-run warning moved out of `src/scripts/_lib/agent_settings.ts` (1,510 lines) into `src/scripts/_lib/settings_removed_keys.ts`, so the settings-key retirement batch adds its registry entries in a file under the ceiling instead of growing the excess; the retirement itself also deletes legacy rename-map rows and the setup-hint settings read from `src/scripts/install.ts`. Earlier: LOWERING 2026-10-05, 17,571 -> 17,550 — a lowering commit, and the gate asked for it BY NAME: it reported `ratchet is loose` and named 17,550; `check_source_size_budget.test.ts` then pins baseline == live total, so this is required rather than optional. The gain IS this branch's own work and it is a DEDUPLICATION, which this convention accepts: all five CliClient subclass constructors forwarded six option fields to super() by name, which is why a seventh (`consumer`) was silently dropped and every CLI call booked as `unknown`. Replacing the five field lists with `{ ...opts, model: ... }` removes 27 lines from src/scripts/ai_council/clients.ts (2,858 -> 2,831) against the +6 the consumer fix added, so the net is -21. No ceiling was edited and no file was split to game the metric. The count is tree-derived (line counts over src/**/*.ts) and container-independent, unlike the projection-surface gates whose local readings diverge. Verified with `npx tsc --noEmit` clean and the clients suite green in this checkout. PRIOR ENTRY: LOWERING 2026-10-05, 17,585 -> 17,571 — a lowering commit, and the gate asked for it BY NAME: it reported `ratchet is loose` and named 17,571. The gain IS this branch's own work and it is an EXTRACTION, which is the only shape this convention accepts: road-to-an-installed-layer-that-is-thinned step 1.1 adds a thinning call to the global deploy loop, and pays for those lines by moving `_resolve_global_rule_scope` out of `src/scripts/install.ts` into `src/install/globalRuleScope.ts` behind a same-signature wrapper, and removes the two imports the extraction orphaned (install.ts 5,180 -> 5,156). The user-global whitelist rows in `src/scripts/_lib/agent_settings.ts` push that file 1,499 -> 1,510, so the net is -5 rather than -15. No ceiling was edited and no file was split to game the metric. Verified by running the gate in this worktree after `npx tsc --noEmit` passed clean. PRIOR ENTRY: LOWERING 2026-10-02, 17,620 -> 17,592 — a lowering commit, and the gate asked for it BY NAME: it reported `ratchet is loose` and named 17,592. The gain IS this branch's own work, and it is a deduplication rather than a sweep. `GLOBAL_DEPLOY_SOURCES` was defined TWICE — in `src/scripts/install.ts` and in `src/install/wizard-plan.ts` — and the two copies were byte-identical across all 18 host rows, which is a duplicate that stays correct exactly until somebody edits one of them. road-to-rule-triggers-and-links-that-hold step 1.2 did that: it added `contexts/` and `guidelines/` to the install.ts copy and the wizard kept installing without them, so the deduplication is the fix for a defect this branch introduced, not an opportunistic tidy. install.ts now imports and re-exports the wizard-plan definition, so every caller is unchanged, and the file goes 5,231 -> 5,175 lines. Verified by running the gate in this worktree after `npm run typecheck` passed clean. PRIOR ENTRY: LOWERING 2026-10-02, 17,734 -> 17,620 — a lowering commit, and the gate asked for it BY NAME: it reported `ratchet is loose` and named 17,620 as the number to write. The gain is not this branch's own work; it is the net of the lanes that merged into main while this branch was in flight, which is exactly the case the clause below exists for — a tree that got smaller while a baseline stood still would let the gain be given back silently by the next change. Verified in a FRESH detached checkout of the pushed head rather than in the working worktree, because the first reading was taken in a tree that had not finished its base sync and reported the two numbers the other way round; the fresh checkout measures 17,620 against a 17,734 baseline over 1,582 scanned files. `landed` is refreshed deliberately, for the reason every entry below gives: checkRatchet returns `improved` BEFORE it evaluates staleness, so an entry left high while the tree measures lower would never expire at any age. PRIOR ENTRY: LOWERING 2026-10-01, 17,745 -> 17,734 — a lowering commit, and the gate asked for it by name. road-to-a-hook-bundle-with-one-yaml-reader 3.1 split the windsurf renderer out of `condense.ts` into the new under-cap `src/scripts/_lib/windsurf_render.ts`, and `strip_frontmatter` moved with it as the render's one non-trivial dependency. `condense.ts` went 2,728 -> 2,717 excess lines. The direction is honest about its own history: an earlier commit on this branch kept the renderer INLINE in `condense.ts` and CI caught it as 20 new violations — this entry is that fix, not a sweep, and the lowering is the by-product of putting the code where it belonged. Nothing was deleted: the renderer and the stripper are both still called, by TWO callers now rather than one, and `condense.ts` re-exports `strip_frontmatter` so no importer's path changed. The new module lands at 64 lines, far under its own cap, so it contributes zero excess. LOCAL READING, same discriminator every entry below uses: the gate walks authored source under `src/`, and the only untracked path `git status --porcelain -uall -- src` reports is that new module, committed in this same change — so a clean CI checkout of this commit measures the same 17,734. If CI reads anything else, CI's number is the correct one and this note is the record of why. `landed` is refreshed deliberately, for the reason the prior entry gives: checkRatchet returns `improved` BEFORE it evaluates staleness, so an entry left high while the tree measures lower would never expire at any age. PRIOR ENTRY: LOWERING 2026-09-30, 17,746 -> 17,745 — a lowering commit, and the gate asked for it by name. The direction is the surprising one again: this branch ADDED a feature to `install.ts` (an opt-in host env write) and that file came out SHORTER than it went in, 5,270 -> 5,269. The whole mechanism — the two-row allow table, the settings reader, the env-block builder and the bridge wrapper — lives in the new under-cap `src/scripts/_lib/host_env_write.ts`, so `install.ts` pays ONE import line and one expression for it; and the three-line `for` loop over healed plugin ids in the same function collapsed to one, which is inside the function the change already edits. The gain is a MOVE plus one tightening, never a deletion: nothing was dropped and nothing was swept. That module boundary is also the better one on its own terms — one place now owns which host variable this package may write, which is the question the owner decision of 2026-09-30 turns on. LOCAL READING, on the same discriminator every entry below uses: the gate walks authored source under `src/`, and `git status --porcelain -uall -- src` reported ZERO untracked files, so a clean CI checkout of this commit measures the same 17,745. If CI reads anything else, CI's number is the correct one and this note is the record of why. `landed` is refreshed deliberately: checkRatchet returns `improved` BEFORE it evaluates staleness, so an entry left at 17,746 while the tree measures 17,745 would never expire at any age. PRIOR ENTRY: LOWERING 2026-09-29, 17,748 -> 17,746 — a lowering commit, same doctrine as every entry below, and the gate asked for it by name. This branch ADDED two gate scripts, a guard and a shared lib under `src/`, so the direction is the surprising one and worth stating: the new files each land under their own cap and contribute zero EXCESS, while factoring the shell write shapes out of `block_kernel_rule_writes` into `_lib/shell_write_shapes.ts` moved lines out of a file that was over its cap and into one that is not. Net -2. LOCAL READING, on the same discriminator every entry below uses: the gate walks authored source under `src/`, and `git status --porcelain -uall -- src` reported ZERO untracked files, so a clean CI checkout of this commit measures the same 17,746. If CI reads anything else, CI's number is the correct one and this note is the record of why. `landed` is refreshed deliberately: checkRatchet returns `improved` BEFORE it evaluates staleness, so an entry left at 17,748 while the tree measures 17,746 would never expire at any age. PRIOR ENTRY: LOWERING 2026-09-29, 17,762 -> 17,748 — a lowering commit, same doctrine as every entry below, and the gate asked for it by name. Reporting the host traffic environment in `doctor` needed a new surface; rather than pay those lines against `src/scripts/_cli/cmd_doctor.ts`, already far over the cap, the whole network-posture block moved out into the new under-cap `src/scripts/_cli/doctor_network_posture.ts`, which is also where the new logic lives: one module owns which traffic variables exist, how each is read, and how an absent one is reported, so the unit is coherent rather than a line-count trim. cmd_doctor.ts 3,618 -> 3,604; total 17,762 -> 17,748. The gain is a MOVE, not a deletion — nothing was dropped and nothing was swept. `landed` is refreshed deliberately, for the reason the prior entries record: checkRatchet returns `improved` BEFORE it evaluates staleness, so an entry left at 17,762 while the tree measures 17,748 would never expire at any age, and the gate only ADVISES on a loose ratchet while `check_source_size_budget.test.ts` blocks — that asymmetry is what forces a lowering commit to carry its own baseline update. PRIOR ENTRY: LOWERING 2026-09-27, 17,765 -> 17,762 — the second half of the same repair, and a lowering for the same reason. Closing the remaining preservation defects needed lines in two over-cap files: `src/scripts/install.ts` (route the generated Claude Desktop marker through the tracker, hand the rule-rewrite its skip set) and `src/server/routes/wizard.ts` (surface the conflict count, stop reporting exit 3 as a failure). Both were paid from the same subject rather than from the ratchet: `_files_by_tool_from_bridges` joined its sibling in `src/install/manifestFiles.ts`, which now owns the whole per-tool inventory, and the wizard's exit-code semantics moved into `src/install/preserve.ts` beside `installDoneSummary`, which already lives there for this exact reason. install.ts 5,277 -> 5,270; wizard.ts 1,500 -> 1,504. PRIOR ENTRY: LOWERING 2026-09-27, 17,784 -> 17,765 — a lowering commit, same doctrine as the entry it replaces. Repairing the install-manifest digest loss needed new state in `_update_installed_tools_manifest` (a recorded-inventory read, a preserved-path index, a reconciliation call). Rather than pay that against `src/scripts/install.ts`, already 3,777 over the cap, the manifest file-inventory block (`_sha256_of_file`, `_file_entry`, `_files_by_tool_from_deploy` — 29 lines) moved out into the under-cap `src/install/manifestFiles.ts`, which is where the new logic lives too: one module now owns what the manifest's per-tool `files[]` holds, how it is read back, and how the two reconcile, so the unit is coherent rather than a line-count trim. install.ts 5,296 -> 5,277; total 17,784 -> 17,765. PRIOR ENTRY: LOWERING 2026-09-20, 17,858 -> 17,784 — a lowering commit, not a reconciliation, but measured under the same doctrine the four entries below carry: the committed number is the gate's own reading on the MERGED tree, taken after origin/main was merged into drain/headless-log-write rather than from either side. The branch's transaction-log write added 27 lines to `src/scripts/install.ts`, already 3,897 over the cap, taking the total to 17,885. Rather than pay that, the `json.dumps` byte-parity block (`jsonStrNoAscii`, `_jsonScalar`, `_dumpIndent`, `jsonDumpsIndent`, `jsonDumpsCompact` — 101 lines) moved out of `install.ts` into the under-cap `src/scripts/_lib/json_python_parity.ts`: pure, total functions of their input carrying no installer state, so the unit is coherent rather than a line-count trim. install.ts 5,397 -> 5,296; total 17,885 -> 17,784, a net -74 against the prior baseline. PRIOR ENTRY: MERGE RECONCILIATION 2026-09-14, 17,861 -> 17,858 — the FOURTH reconciliation of this entry, same doctrine as the three below: the committed number is the gate's own reading on the MERGED tree, never either side's. Neither branch earned the -3; it falls out of main having absorbed drain/release-head-field, whose `derive_head_prefill` extraction moved the span-to-prefill composition into an under-cap module. Taking this branch's 17,861 would have silently given that gain back. PRIOR ENTRY: MERGE RECONCILIATION 2026-09-13, 17,863 -> 17,861 — the THIRD reconciliation of this entry in one day, and re-measured on the merged tree rather than taken from either side, which is the only resolution that converges. drain/adversarial-verification reached 17,864 by paying for a `forge_protection` block and a cascade-base module entirely in files under the 1,500-line cap; the incoming reconciliation reached 17,863 from different work. Neither describes the merge. PRIOR ENTRY: MERGE RECONCILIATION 2026-09-13, 17,944/17,866 -> 17,863. drain/decision-closure and drain/breaking-line-contradiction each lowered from the SAME 17,947 base in parallel -- this branch to 17,944 (net -3: the ownership vocabulary, its two Iron-Law sets and the merged default-mode map moved out of ai_council/config.ts into ai_council/ownership_classes.ts, and the settings-rename block moved out of _lib/agent_settings.ts into _lib/settings_renamed_keys.ts, both UNDER the 1500 cap so both cost nothing) and main to 17,866. Taking either side alone is wrong in a different direction, which is the doctrine this entry already carries from 2026-09-03 and 2026-09-07: main's value silently discards this branch's earned -3, and this branch's value RAISES the baseline against main and weakens the gate. The committed number is neither -- it is the gate's own output on the MERGED tree, where both reductions apply. MAIN-SIDE ENTRY, carried so neither branch's record is lost: Lowered 17,947 -> 17,866 on 2026-09-13 by drain/breaking-line-contradiction, on this entry's own doctrine. The branch adds the BACKWARD half of the MIGRATION.md obligation -- a refusal for a major cut whose BREAKING section has no migration entry -- and writing it into release.ts came in at +61, because that file sits ~375 lines PAST the 1500 cap so every line there is one unit. Paid down rather than baselined, and the move was the coherent unit rather than the minimum one: BOTH refusals went, the new backward half and the pre-existing forward half (assert_scheduled_deprecations_clear), into _lib/release_migration_gate.ts at 184 lines and therefore UNDER the cap, so the pair and all their rationale now cost nothing. They moved on merit rather than only on arithmetic -- they are the two halves of one obligation, written eleven months apart, and release.ts held only the two call sites. parse_version stayed module-private in release.ts and the lib carries a two-line _minor_patch instead: exporting a private helper to serve one caller would widen the surface of the file the move exists to narrow. release.ts 1,875 -> 1,733: a branch that ADDED a pipeline refusal leaves the file eighty-one lines shorter than it found it. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports nothing staged and nothing untracked at this commit, so a clean CI checkout measures the same 17,866. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises -- which is how CI found it: the gate exited 0 with a loose-ratchet warning and the test went red. PRIOR ENTRY: Lowered 17,959 -> 17,947 on 2026-09-11 by the findings-ledger branch, on this entry's own doctrine. The branch adds step 7 to release.ts, which sits ~326 lines PAST the 1500 cap so every line there is one unit, and it came in at +145. Paid down rather than baselined, in two moves. `settle_findings_ledger` and `_blocking_without_disposition` moved out of release.ts into _lib/release_findings_ingest.ts -- 95 lines, and that module is under the cap, so the step and its rationale now cost nothing. It moved on merit rather than only on arithmetic: the module already owns every message the step prints and every argv it builds, and release.ts held only the sequencing. Then the `--ci` fallback dispatch of the three tag-triggered workflows -- 24 lines of loop and warning with no reader elsewhere in step 10 -- moved into _lib/release_tag_dispatch.ts, also under the cap. release.ts 1,826 -> 1,814: a branch that ADDED a pipeline step leaves the file twelve lines shorter than it found it. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the branch's new src/ file staged and nothing untracked, so a clean CI checkout of this commit measures the same 17,947. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 17,963 -> 17,959 on 2026-09-09 by feat/cdd-fidelity-council, on the same shape as the entry below and with the same discriminator. The branch's src-link rewrite (a blind review found 253 of 268 links under dist/agent-src/guidelines/ dead, because condense.ts folded only the docs/ prefixes and never (../)+src/rules|skills) came in at +15 excess: condense.ts sits ~1,208 lines PAST the 1500 cap, so every line there is one unit. Paid down rather than baselined, in the way this entry's doctrine prescribes. `_rewrite_body_links` and its two regex constants moved out of condense.ts into _lib/guidelines_lane.ts, 151 lines and therefore UNDER the cap, so the function and its prose now cost nothing. It moved on merit rather than only on arithmetic: every rule the rewriter applies is a statement about which source tree projects where, which is that module's own subject, and condense.ts held it only because that is where the projector lives. condense.ts 2,712 -> 2,708 net, after the one import line and the one call-site rename -- a branch that ADDED a rewrite rule leaves the file four lines shorter than it found it. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the branch's new src/ files tracked and nothing untracked, so a clean CI checkout of this commit measures the same 17,959. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 17,973 -> 17,963 on 2026-09-08 by drain/graph-shipped-close. The branch registers five code-graph MCP tools (road-to-a-graph-that-is-shipped 4.1). Their five records and schemas are ~250 lines, and putting them in mcp_server/tools.ts -- which sits ~500 lines PAST the 1500 cap, so every line there is one unit -- would have cost ~250 excess. They live in mcp_server/graph_tools.ts instead (~280 lines, UNDER the cap, so they and their prose cost nothing), and tools.ts spreads them into ALLOWLIST in two lines: one import and one `...GRAPH_TOOLS,`. Those two were paid for rather than baselined, in the way this entry's doctrine prescribes: `_strip` and `_resolvePath` -- a whitespace trim and a tolerant realpath, generic by nature -- moved out of tools.ts into mcp_server/path_util.ts, also under the cap. They are imported under their original underscore names, so all 28 call sites are unchanged and a two-function move does not read as a sweep. tools.ts 2,025 -> 2,015: -12 from the extraction, +2 from the registration, net -10 for a branch that ADDED a feature. CORRECTED 2026-09-08 after an independent review checked the figure against the tree -- this sentence read '2,025 -> 2,013, net -12, against the +2 the registration needed', which states an intermediate file length as the final one and leaves the arithmetic (-12) and the conclusion (-10) describing different trees. `git show origin/main:...tools.ts | wc -l` is 2025 and the working tree is 2015. The TOTAL, 17,963, was always the gate's own output and is unchanged. Every other file this branch touches or creates -- code_graph/verbs.ts, code_graph/cli.ts, code_graph/build.ts, code_graph/detect.ts, code_graph/query.ts, code_graph/sqlite_store.ts, code_graph/types.ts, _lib/regression_neighbourhood.ts -- is under the 1500 ceiling before and after, so it contributes zero excess whatever it grew by. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the two new src/ files staged and nothing untracked, so a clean CI checkout of this commit measures the same 17,963. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 17,974 -> 17,973 on 2026-09-08 by drain/topology-c1. The branch adds a live-path emit to council_cli.ts, which sits 2,454 lines PAST the 1500 cap so every line there is one unit, and paid its own way down rather than raising the baseline, in the way this entry's doctrine prescribes. The twelve-line `all_responses` assembly (a spread, three conditionals and a push) moved out of council_cli.ts into ai_council/deliberation_metrics.ts::runCallsFrom, 353 lines and therefore UNDER the cap, so the six stage labels and their prose cost nothing. It moved on merit rather than only on arithmetic: 'which calls did this run make, and at which stage' is that module's own subject, and the CLI held the list only as a flat array with the stage boundaries implicit in the order -- both readings now come out of one walk, so the billing total and the attribution can never be computed over different sets. council_cli.ts 3,955 -> 3,954 net, after the two call lines, the import and the one payload key the feature needed. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the two new src/ files staged and nothing untracked, so a clean CI checkout of this commit measures the same 17,973. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 18,016 -> 17,974 on 2026-09-07 by fix/single-delivery-unconditional. SETTLED FIGURE, and it supersedes an intra-session 17,962 this same branch committed earlier — read the direction against MAIN, which is what the ratchet protects: main is 18,016, the branch leaves 17,974, net -42. The 17,962 was this branch's own low before a neutral review returned twelve findings; fixing them added a real mechanism to mcp_server and condense.ts (the flat-wrapper carriage gate the review showed was missing, plus its four-skip predicate), and condense.ts sits ~1,215 lines PAST the cap so each of those lines is one unit. Paid down first, in the way this entry's doctrine prescribes: _suggestSkillForTaskHandler and its 18-line docstring moved out of mcp_server/tools.ts (2,079 -> 2,025) into mcp_server/suggest_skill.ts, 72 lines and UNDER the cap, so its prose costs nothing. The residual +12 against the intra-session low is the gate's own output on the settled tree and is recorded rather than engineered away, because the alternative was extracting _nested_command_subpath and its two callers out of condense.ts - which needs MODULE_STATE, _relativeToPosix and _domains_command_logical passed in, a wider diff than the finding warrants and one no review asked for. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the three new src/ files staged and nothing untracked, so a clean CI checkout of this commit measures the same 17,974. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: MERGE RECONCILIATION 2026-09-07, 18,061/18,017 -> 18,016. drain/admissible-council-seats and fix/release-obligation-answerable each lowered from the SAME 18,062 base in parallel — main to 18,061 (net -1: curlJsonPost, the seat-status helpers and the per-seat config parsing moved out of the three over-ceiling council files) and the branch to 18,017 (net -45: the /dev/tty prompt helpers moved out of release.ts into _lib/tty_prompt.ts, 76 lines and UNDER the cap, taking release.ts 1871 -> 1826). Taking either side alone is wrong in a different direction, which is the reconciliation doctrine this entry already carried from 2026-09-03: main's value silently discards the branch's earned -45, and the branch's value RAISES the baseline against main and weakens the gate. The committed number is neither — it is the gate's own output on the MERGED tree, where both reductions apply, and it equals the arithmetic (18,062 - 45 - 1 = 18,016) rather than being reconciled by it. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports ZERO untracked files, so a clean CI checkout of this commit measures the same 18,016. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in the merge commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 18,062 -> 18,061 on 2026-09-07 by drain/admissible-council-seats. The branch's own additions to the three over-ceiling files (ai_council/config.ts, council_cli.ts, ai_council/clients.ts) came in at +96 excess and were paid down to -1 rather than baselined, in the four ways this entry's doctrine prescribes: `curlJsonPost` moved out of clients.ts into ai_council/api_transport.ts (UNDER the cap, so the prose and the three new provider shims cost nothing); the seat-status helpers moved out of council_cli.ts into ai_council/status_surface.ts, taking an orphaned doc comment with them; the three new per-seat config fields' parsing moved out of config.ts into ai_council/seat_policy.ts::parseSeatFields; and three prose blocks that the branch's own transport repair made FACTUALLY FALSE (the `openai` / `google-genai` Python-SDK claims, and a `_curlJsonPost` pointer to a function that had moved) were corrected and shortened in the same change. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports zero untracked files with the five new src/ files staged, so a clean CI checkout of this commit measures the same 18,061. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried here because tests/scripts/check_source_size_budget.test.ts:166 asserts baseline == live and therefore blocks where the gate only advises -- the lowering commit must carry its own baseline update. Lowered 18,068 -> 18,062 on 2026-09-06 by drain/host-enforcement-truth. Collapsing the five per-host binding constants in install.ts into src/scripts/hooks/host_lowering.yaml removed 29 lines from a file ~3,900 past the 1500 cap, where every line costs one excess; the journal's surface column and its extracted migration helper gave 23 back. Lowered 18,245 -> 18,230 on 2026-09-02 by drain/publication-integrity-option-a. Phase 2 Option A moved the authoring instruction out of the generator: release.ts, which sits ~530 lines PAST the 1500 cap so every line there costs one excess, loses the comment emission, a 16-line HEAD_DEFAULT doc block and its alias const, and gains a shorter writer docstring. The doc block moved to _lib/release_material.ts, which is 289 lines and therefore UNDER the cap, so the same prose now costs nothing. Net -15. The branch first came in at +8 and paid its own way down rather than raising the baseline. BRANCH-SIDE ENTRY: Lowered 17,947 -> 17,944 on 2026-09-13 by drain/decision-closure, on this entry's own doctrine and at the gate's own request. The branch's ownership-axis additions to ai_council/config.ts came in at +86 excess: that file sits ~700 lines PAST the 1500 cap, so every line there is one unit. Paid down rather than baselined, in one move. The eight ownership class names, the two Iron-Law sets, the merged default-mode map and the mode-check function moved out of config.ts into ai_council/ownership_classes.ts -- 91 lines, UNDER the cap, so the vocabulary and its prose now cost nothing. It moved on merit rather than only on arithmetic: the roadmap-side gate lint_decision_classes needs the same eight names and has no business importing the council's whole schema to learn them, and the loader now carries three lines where it carried twenty-four. config.ts 2,182 -> 2,179: a branch that ADDED an entire decision axis leaves the file three lines shorter than it found it. Every other src/ file this branch creates -- lint_decision_classes.ts, lint_roadmap_producers.ts, closure_scan.ts, council_record_shape.ts, scope_growth.ts, ownership_classes.ts -- is under the 1500 ceiling, so it contributes zero excess whatever it grew by. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the branch's new src/ files tracked and nothing untracked, so a clean CI checkout of this commit measures the same 17,944. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 17,959 -> 17,947 on 2026-09-11 by the findings-ledger branch, on this entry's own doctrine. The branch adds step 7 to release.ts, which sits ~326 lines PAST the 1500 cap so every line there is one unit, and it came in at +145. Paid down rather than baselined, in two moves. `settle_findings_ledger` and `_blocking_without_disposition` moved out of release.ts into _lib/release_findings_ingest.ts -- 95 lines, and that module is under the cap, so the step and its rationale now cost nothing. It moved on merit rather than only on arithmetic: the module already owns every message the step prints and every argv it builds, and release.ts held only the sequencing. Then the `--ci` fallback dispatch of the three tag-triggered workflows -- 24 lines of loop and warning with no reader elsewhere in step 10 -- moved into _lib/release_tag_dispatch.ts, also under the cap. release.ts 1,826 -> 1,814: a branch that ADDED a pipeline step leaves the file twelve lines shorter than it found it. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the branch's new src/ file staged and nothing untracked, so a clean CI checkout of this commit measures the same 17,947. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 17,963 -> 17,959 on 2026-09-09 by feat/cdd-fidelity-council, on the same shape as the entry below and with the same discriminator. The branch's src-link rewrite (a blind review found 253 of 268 links under dist/agent-src/guidelines/ dead, because condense.ts folded only the docs/ prefixes and never (../)+src/rules|skills) came in at +15 excess: condense.ts sits ~1,208 lines PAST the 1500 cap, so every line there is one unit. Paid down rather than baselined, in the way this entry's doctrine prescribes. `_rewrite_body_links` and its two regex constants moved out of condense.ts into _lib/guidelines_lane.ts, 151 lines and therefore UNDER the cap, so the function and its prose now cost nothing. It moved on merit rather than only on arithmetic: every rule the rewriter applies is a statement about which source tree projects where, which is that module's own subject, and condense.ts held it only because that is where the projector lives. condense.ts 2,712 -> 2,708 net, after the one import line and the one call-site rename -- a branch that ADDED a rewrite rule leaves the file four lines shorter than it found it. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the branch's new src/ files tracked and nothing untracked, so a clean CI checkout of this commit measures the same 17,959. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 17,973 -> 17,963 on 2026-09-08 by drain/graph-shipped-close. The branch registers five code-graph MCP tools (road-to-a-graph-that-is-shipped 4.1). Their five records and schemas are ~250 lines, and putting them in mcp_server/tools.ts -- which sits ~500 lines PAST the 1500 cap, so every line there is one unit -- would have cost ~250 excess. They live in mcp_server/graph_tools.ts instead (~280 lines, UNDER the cap, so they and their prose cost nothing), and tools.ts spreads them into ALLOWLIST in two lines: one import and one `...GRAPH_TOOLS,`. Those two were paid for rather than baselined, in the way this entry's doctrine prescribes: `_strip` and `_resolvePath` -- a whitespace trim and a tolerant realpath, generic by nature -- moved out of tools.ts into mcp_server/path_util.ts, also under the cap. They are imported under their original underscore names, so all 28 call sites are unchanged and a two-function move does not read as a sweep. tools.ts 2,025 -> 2,015: -12 from the extraction, +2 from the registration, net -10 for a branch that ADDED a feature. CORRECTED 2026-09-08 after an independent review checked the figure against the tree -- this sentence read '2,025 -> 2,013, net -12, against the +2 the registration needed', which states an intermediate file length as the final one and leaves the arithmetic (-12) and the conclusion (-10) describing different trees. `git show origin/main:...tools.ts | wc -l` is 2025 and the working tree is 2015. The TOTAL, 17,963, was always the gate's own output and is unchanged. Every other file this branch touches or creates -- code_graph/verbs.ts, code_graph/cli.ts, code_graph/build.ts, code_graph/detect.ts, code_graph/query.ts, code_graph/sqlite_store.ts, code_graph/types.ts, _lib/regression_neighbourhood.ts -- is under the 1500 ceiling before and after, so it contributes zero excess whatever it grew by. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the two new src/ files staged and nothing untracked, so a clean CI checkout of this commit measures the same 17,963. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 17,974 -> 17,973 on 2026-09-08 by drain/topology-c1. The branch adds a live-path emit to council_cli.ts, which sits 2,454 lines PAST the 1500 cap so every line there is one unit, and paid its own way down rather than raising the baseline, in the way this entry's doctrine prescribes. The twelve-line `all_responses` assembly (a spread, three conditionals and a push) moved out of council_cli.ts into ai_council/deliberation_metrics.ts::runCallsFrom, 353 lines and therefore UNDER the cap, so the six stage labels and their prose cost nothing. It moved on merit rather than only on arithmetic: 'which calls did this run make, and at which stage' is that module's own subject, and the CLI held the list only as a flat array with the stage boundaries implicit in the order -- both readings now come out of one walk, so the billing total and the attribution can never be computed over different sets. council_cli.ts 3,955 -> 3,954 net, after the two call lines, the import and the one payload key the feature needed. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the two new src/ files staged and nothing untracked, so a clean CI checkout of this commit measures the same 17,973. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 18,016 -> 17,974 on 2026-09-07 by fix/single-delivery-unconditional. SETTLED FIGURE, and it supersedes an intra-session 17,962 this same branch committed earlier — read the direction against MAIN, which is what the ratchet protects: main is 18,016, the branch leaves 17,974, net -42. The 17,962 was this branch's own low before a neutral review returned twelve findings; fixing them added a real mechanism to mcp_server and condense.ts (the flat-wrapper carriage gate the review showed was missing, plus its four-skip predicate), and condense.ts sits ~1,215 lines PAST the cap so each of those lines is one unit. Paid down first, in the way this entry's doctrine prescribes: _suggestSkillForTaskHandler and its 18-line docstring moved out of mcp_server/tools.ts (2,079 -> 2,025) into mcp_server/suggest_skill.ts, 72 lines and UNDER the cap, so its prose costs nothing. The residual +12 against the intra-session low is the gate's own output on the settled tree and is recorded rather than engineered away, because the alternative was extracting _nested_command_subpath and its two callers out of condense.ts - which needs MODULE_STATE, _relativeToPosix and _domains_command_logical passed in, a wider diff than the finding warrants and one no review asked for. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports the three new src/ files staged and nothing untracked, so a clean CI checkout of this commit measures the same 17,974. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in this commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: MERGE RECONCILIATION 2026-09-07, 18,061/18,017 -> 18,016. drain/admissible-council-seats and fix/release-obligation-answerable each lowered from the SAME 18,062 base in parallel — main to 18,061 (net -1: curlJsonPost, the seat-status helpers and the per-seat config parsing moved out of the three over-ceiling council files) and the branch to 18,017 (net -45: the /dev/tty prompt helpers moved out of release.ts into _lib/tty_prompt.ts, 76 lines and UNDER the cap, taking release.ts 1871 -> 1826). Taking either side alone is wrong in a different direction, which is the reconciliation doctrine this entry already carried from 2026-09-03: main's value silently discards the branch's earned -45, and the branch's value RAISES the baseline against main and weakens the gate. The committed number is neither — it is the gate's own output on the MERGED tree, where both reductions apply, and it equals the arithmetic (18,062 - 45 - 1 = 18,016) rather than being reconciled by it. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports ZERO untracked files, so a clean CI checkout of this commit measures the same 18,016. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried in the merge commit because tests/scripts/check_source_size_budget.test.ts asserts baseline == live and therefore BLOCKS where the gate only advises. PRIOR ENTRY: Lowered 18,062 -> 18,061 on 2026-09-07 by drain/admissible-council-seats. The branch's own additions to the three over-ceiling files (ai_council/config.ts, council_cli.ts, ai_council/clients.ts) came in at +96 excess and were paid down to -1 rather than baselined, in the four ways this entry's doctrine prescribes: `curlJsonPost` moved out of clients.ts into ai_council/api_transport.ts (UNDER the cap, so the prose and the three new provider shims cost nothing); the seat-status helpers moved out of council_cli.ts into ai_council/status_surface.ts, taking an orphaned doc comment with them; the three new per-seat config fields' parsing moved out of config.ts into ai_council/seat_policy.ts::parseSeatFields; and three prose blocks that the branch's own transport repair made FACTUALLY FALSE (the `openai` / `google-genai` Python-SDK claims, and a `_curlJsonPost` pointer to a function that had moved) were corrected and shortened in the same change. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the 1500-line ceiling, and `git status --porcelain -uall -- src/` reports zero untracked files with the five new src/ files staged, so a clean CI checkout of this commit measures the same 18,061. If CI reads anything else, CI's number is the correct one and this note is the record of why. Carried here because tests/scripts/check_source_size_budget.test.ts:166 asserts baseline == live and therefore blocks where the gate only advises -- the lowering commit must carry its own baseline update. Lowered 18,068 -> 18,062 on 2026-09-06 by drain/host-enforcement-truth. Collapsing the five per-host binding constants in install.ts into src/scripts/hooks/host_lowering.yaml removed 29 lines from a file ~3,900 past the 1500 cap, where every line costs one excess; the journal's surface column and its extracted migration helper gave 23 back. Lowered 18,245 -> 18,230 on 2026-09-02 by drain/publication-integrity-option-a. Phase 2 Option A moved the authoring instruction out of the generator: release.ts, which sits ~530 lines PAST the 1500 cap so every line there costs one excess, loses the comment emission, a 16-line HEAD_DEFAULT doc block and its alias const, and gains a shorter writer docstring. The doc block moved to _lib/release_material.ts, which is 289 lines and therefore UNDER the cap, so the same prose now costs nothing. Net -15. The branch first came in at +8 and paid its own way down rather than raising the baseline.",
       "reason": "Lowered 17,585 -> 17,571 on 2026-10-05 by lane/installed-layer-thinned, and the gate asked for it BY NAME. The gain is this branch's own, through two extractions rather than a sweep: `_resolve_global_rule_scope` to `src/install/globalRuleScope.ts` and the thinning mechanism to `src/scripts/_lib/thin_rules.ts`. PRIOR REASON: Lowered 17,590 -> 17,585 on 2026-10-03 by drain/rule-carrier-phase1b-20261002, and the gate asked for it BY NAME: it reported `ratchet is loose` and named 17,585. The gain is INCIDENTAL rather than sought, and it comes from two files that sit past the 1500-line cap. `src/scripts/ai_council/clients.ts` (2,852 lines, 1,352 past) lost the 18-line doc comment and declaration of `OPENAI_CLI_VENDOR_DEFAULT`, which moved to a new `ai_council/vendor_defaults.ts` well under the cap, so those lines stopped being charged; the move itself was made to break an import edge costing 51,523 B of composed hook bundle, not to shed lines. `src/scripts/install.ts` (5,229 lines, 3,729 past) gained a three-line call site for the headless `.gitignore` block and NOT the 44-line function behind it, which was written into `_lib/gitignore_block.ts` instead — that placement was chosen when this gate reported +44 and said a ratchet only turns one way, and it is the better home anyway. Net across both: -5. LOCAL READING, on the same discriminator the entries above use: the gate walks authored source under src/, and a porcelain status over that root reports no untracked files, so a clean CI checkout of this commit measures the same 17,585. `landed` is refreshed deliberately — checkRatchet returns `improved` BEFORE it evaluates staleness, so an entry left at 17,590 while the tree measures 17,585 would never expire at any age. PRIOR ENTRY: Lowered 17,592 -> 17,590 on 2026-10-03 by drain/rule-carrier-phase1-20261002, and the gain was INCIDENTAL rather than sought. The branch replaced `condense.ts::_lean_projection_settings` — an eight-line private reader of `lean_projection.mode` and `.hosts` — with one call to the shared `resolveLeanProjection`, net -2 lines in a file that sits ~1,195 lines PAST the 1500 cap, so every line removed there is one excess removed. Nothing was deleted to make a number: the projector reads the same settings file it always read, and `task sync` plus `task generate-tools` produce zero changes under `dist/agent-src/`, which is how that roadmap's risk 2 (one mode resolver moves the projector) was discharged. The gate reported the tree at 17,590 against a baseline of 17,592 and asked for exactly this lowering, so the gain cannot be silently given back. LOCAL READING, ADMISSIBLE ON THE SAME DISCRIMINATOR THIS FILE'S OTHER ENTRIES USE: the gate walks `src/` only, and a porcelain status over that root reported no untracked files, so a clean CI checkout of this commit measures the same 17,590. If CI reads anything else, CI's number is the correct one and this note is the record of why. PRIOR ENTRY: Lowered 18,230 -> 18,209 on 2026-09-03 by drain/artifact-location. `doctor --strict` needed 16 lines of integration wiring in cmd_doctor.ts, which sits ~2,100 lines PAST the 1500 cap so every line there costs one excess. The branch first came in at +137 and paid its own way down rather than raising the baseline: the strict semantics, threshold, kill switch, payload helper and argv fragments moved to _cli/_doctor_strict.ts (~160 lines, under the cap, costs nothing), taking it to +15; then the 37-line drift renderer moved to _cli/_doctor_emit.ts. Net -21. The renderer was chosen deliberately: pure rendering, two dependencies, no argparse involvement and therefore none of the byte-parity risk the parser surface carries against the retired Python implementation; nothing outside cmd_doctor.ts imported it. An AI council on the residual split (a: raise by 15 / d: descope the feature); neither was taken, because a parallel branch demonstrated the same day that paying down is achievable in this codebase, which is the evidence the split lacked. This gate's own test comment prescribes it: a commit that splits a god-file lowers the excess and must carry the lowered baseline. MERGE RECONCILIATION 2026-09-03, 18,209 -> 18,205: drain/wired-instruments and drain/artifact-location each lowered from the SAME 18,230 base in parallel -- the branch to 18,226 (net -4, run_continuation_hook.ts's termination ladder moved to _lib/continuation_ladder.ts and runtime_journal.ts's prose to _lib/outcome_vocabularies.ts, both under the cap) and main to 18,209 (net -21, the doctor --strict split above). Taking either side alone is wrong in a different direction: main's value silently discards the branch's earned -4, and the branch's value RAISES the baseline against main and weakens the gate. The committed number is neither -- it is the gate's own output on the merged tree, where both reductions apply. THIS LOCAL READING IS ADMISSIBLE HERE, and the discriminator matters because this file's ci-parity:local-only entry records a 165 -> 164 lowering that was reverted for exactly the opposite case: that count depends on how the environment resolves the projection surface, whereas this gate walks only SOURCE_ROOTS = ['src'] (check_source_size_budget.ts:88) counting excess lines over the 1500 ceiling, and `git status --porcelain -uall -- src/` reported ZERO untracked files, so a clean CI checkout of this commit measures the same 18,205. If CI reads anything else, CI's number is the correct one and this note is the record of why. LOWERED 18,205 -> 18,193 on 2026-09-03 by fix/release-curation-ask. The change adds a fifth publication guard, and its own additions landed at +10 excess: release.ts 2,008 -> 2,018, every line of which is past the 1500 cap. Paid down rather than baselined, in the two ways this gate's doctrine prescribes. The guard's rationale (~13 lines of docstring, including why prMerged is a parameter rather than a call-site if) lives in release_publication.ts, 915 lines and therefore UNDER the cap, so the prose costs nothing; and the two pure text helpers _splitlines and _rstrip moved out of release.ts into release_env.ts (333 lines, also under the cap), taking release.ts to 1,996 -- 12 BELOW where it started. The branch came in at +10 and leaves at -12. Recorded while moving them: _splitlines is duplicated a third and fourth time at adoption_report.ts:106 and readme_linter.ts:418; collapsing all three onto one definition touches three modules and was left out of this change rather than done silently. LOWERED 18,193 -> 18,180 on 2026-09-03 by fix/release-branch-reuse. The step-1 branch decision -- twenty lines of if/else in release.ts -- became one call to checkout_release_branch in release_publication.ts, which is 1,019 lines and therefore UNDER the 1500 cap, so the twenty lines plus a ~35-line rationale now cost nothing. release.ts 1,996 -> 1,983, every one of those lines being past the cap. The drill grew 765 -> 918 for two new scenarios and the snapshot/restore that keeps them from writing the real CHANGELOG, and it is under the cap too. A change that adds a feature and lowers the excess is the shape this gate's doctrine asks for; the alternative was a +13 raise for logic that had no business in the god-file. LOWERED 18,180 -> 18,068 on 2026-09-05 by fix/release-gate-producer-parity. The change wires the governance-mix obligation into the writer and the two local guards and adds a release-gate locality registry; its own additions to release.ts landed at +19 excess, every one of those lines past the 1500 cap. Paid down rather than baselined, in the way this entry's doctrine prescribes: the 132-line test-count-trend unit (_TEST_COUNT_LINE_RE, _TEST_LIST_MAX_BUFFER, _count_from_list_result, _count_tests_current, _previous_test_count_from_changelog, _render_test_trend_line) moved from release.ts into release_publication.ts, which is under the cap and where it now belongs on merit rather than only on arithmetic -- the same diff makes the missing `Tests: N` footer a section-level publication blocker, so the writer that emits the footer and the guard that refuses its absence sit in one module. release.ts 1,983 -> 1,871. All four names are re-exported from release.ts, so tests/scripts/release.test.ts is unchanged. LOCAL READING, ADMISSIBLE ON THIS ENTRY'S OWN DISCRIMINATOR: the gate walks only SOURCE_ROOTS=['src'] counting excess over the ceiling, and `git status --porcelain -uall -- src/` reports ZERO untracked files with the two new src/ files staged, so a clean CI checkout of this commit measures the same 18,068. If CI reads anything else, CI's number is the correct one and this note is the record of why."
     },
     "ci-parity:local-only": {
@@ -75,9 +81,9 @@
       "note": "All 18 are `handoff_tier_mismatch`: a senior-tier skill links to a peer whose frontmatter carries no `tier` (reported as tier='unset') — e.g. build-buy-partner → adr-create, customer-research → po-discovery, gated-reach → threat-modeling. This is a tier-metadata backfill backlog on the LINKED-TO skills, not a broken link. The one genuinely dangling link revealed by the same repair (competitive-positioning → a non-existent ../analyze-reference-repo/SKILL.md; it is a command, not a skill) was FIXED in the repairing commit rather than baselined. Clearing this entry means backfilling `tier` on the linked-to skills, or deciding that `tier: unset` on a link target is not a violation and narrowing the rule."
     },
     "lint_pack_boundaries": {
-      "count": 203,
-      "landed": "2026-10-01",
-      "note": "Markdown links between source artefacts that cross a pack boundary the source pack's `requires` graph does not reach — revealed when the scan root moved off the deleted packages/ tree to the live corpus (0 -> 753 artefacts scanned). Each is a link that dangles for a consumer who installs the source pack without the target's. Judged real drift rather than an over-strict gate because it is long-tailed — no single systematic cause — unlike the lint_artefact_frontmatter case, where one required shape had 0-of-288 adoption. Fix per finding: add the edge to packs.yml requires, retarget the link, or move the artefact; where none of the three fits because the edge would run from a base pack into a narrower one, drop the link and keep the artefact name as prose. 2026-10-01, 337 -> 203 and `landed` refreshed: the gate's largest recorded class (engineering-base -> meta, 73 at the time) was never drift. `meta` is `always_on: true`, which `config/packs.resolve_active_packs` seeds into every projection before expanding any selection, so a link into it cannot dangle and the premise above does not hold for it. The allow rule now reads `core` plus every always-on pack rather than the hard-coded `core` alone — one-way, a link OUT of an always-on pack is still reported. That removed 141 of 379; a further 35 occurrences were de-linked at source, clearing every link added since the 2026-08-02 baseline. Delta, per-link introducing commits and the five readings: agents/evidence/analysis/pack-boundary-delta-2026-10-01.md. KNOWN LIMITATION, named rather than left behind the numeric drop (council review 2026-10-01, the reviewer's highest-leverage ask): for a link that runs from a BASE pack into a NARROWER one — engineering-base -> react, meta -> git, frontend-design -> brand — none of the three fixes above is available, and that is a mismatch between this gate's rule and the pack schema rather than a backlog. `requires` is the only edge type the resolver expands, and it is transitive and install-forcing, so declaring base -> narrow would push the narrow pack into every install of the base; `suggests` is advisory and this gate does not read it. Retargeting needs an in-pack equivalent that does not exist, and moving the artefact changes which install ships it. So the cross-reference is dropped and the artefact named in prose, which is why a reader will find named-but-unlinked siblings in these files. Closing the mismatch properly needs a schema decision — an advisory edge this gate reads, or an exemption for base packs — and that is a product call, not cleanup."
+      "count": 120,
+      "landed": "2026-10-09",
+      "note": "Markdown links between source artefacts that cross a pack boundary the source pack's `requires` graph does not reach — revealed when the scan root moved off the deleted packages/ tree to the live corpus (0 -> 753 artefacts scanned). Each is a link that dangles for a consumer who installs the source pack without the target's. Judged real drift rather than an over-strict gate because it is long-tailed — no single systematic cause — unlike the lint_artefact_frontmatter case, where one required shape had 0-of-288 adoption. Fix per finding: add the edge to packs.yml requires, retarget the link, or move the artefact; where none of the three fits because the edge would run from a base pack into a narrower one, drop the link and keep the artefact name as prose. 2026-10-01, 337 -> 203 and `landed` refreshed: the gate's largest recorded class (engineering-base -> meta, 73 at the time) was never drift. `meta` is `always_on: true`, which `config/packs.resolve_active_packs` seeds into every projection before expanding any selection, so a link into it cannot dangle and the premise above does not hold for it. The allow rule now reads `core` plus every always-on pack rather than the hard-coded `core` alone — one-way, a link OUT of an always-on pack is still reported. That removed 141 of 379; a further 35 occurrences were de-linked at source, clearing every link added since the 2026-08-02 baseline. Delta, per-link introducing commits and the five readings: agents/evidence/analysis/pack-boundary-delta-2026-10-01.md. KNOWN LIMITATION, named rather than left behind the numeric drop (council review 2026-10-01, the reviewer's highest-leverage ask): for a link that runs from a BASE pack into a NARROWER one — engineering-base -> react, meta -> git, frontend-design -> brand — none of the three fixes above is available, and that is a mismatch between this gate's rule and the pack schema rather than a backlog. `requires` is the only edge type the resolver expands, and it is transitive and install-forcing, so declaring base -> narrow would push the narrow pack into every install of the base; `suggests` is advisory and this gate does not read it. Retargeting needs an in-pack equivalent that does not exist, and moving the artefact changes which install ships it. So the cross-reference is dropped and the artefact named in prose, which is why a reader will find named-but-unlinked siblings in these files. Closing the mismatch properly needs a schema decision — an advisory edge this gate reads, or an exemption for base packs — and that is a product call, not cleanup. 2026-10-01 -> 2026-10-09, 203 -> 120: the KNOWN LIMITATION named above is closed rather than carried. D5 of road-to-gates-a-pull-request-can-hear (AI council 2026-10-07, anthropic + openai, 2/2, $0.00; adopted 2026-10-08 under the owner's delegation of council-decidable questions) chose option (a): `suggests` in packs.yml is an advisory, non-installing, ONE-HOP, ONE-WAY edge that this gate now reads as permitting a link. It is never expanded transitively — that would give it the install-forcing reach `requires` has, which is the property the decision depends on it not having. 83 links are permitted by it, and the split is MEASURED rather than enumerated by hand — an earlier revision of this note enumerated it and got both halves wrong, which is why the number below is the gate's own output. 73 sit on edges this change ADDED: engineering-base -> laravel 31, -> frontend-design 12, -> symfony 4, -> php 4, -> nextjs 4, -> react 2, -> brand 2, -> product-basic 1; the multi-pack source engineering-base+frontend-design -> brand 3 and -> frontend-design 2; frontend-design -> brand 3; finance-basic -> finance-advanced 4; scale-discipline -> history-discipline 1. The other 10 sit on `suggests` edges that ALREADY EXISTED and that the gate simply did not read: laravel -> frontend-design 3, product-basic -> product-discovery 3, brand -> ai-image 2, react -> frontend-design 1, frontend-design -> react 1. Reverting only this change's packs.yml additions therefore yields 193, not 203 — measured, not derived; 203 returns only if the gate also stops reading `suggests` at all. `--show-permitted` lists them with the permitting edge named, so an advisory permit is visible rather than silent. THE CONDITION THE COUNCIL ATTACHED WAS MET BEFORE THE DROP: all 203 links were classified documentation-reference / optional-integration / load-bearing, and only safely-degrading ones are permitted. 4 of 203 (2.0%) are load-bearing, under the >20% figure one seat named as the abort threshold. That figure is the THIRD reading: a second pass said 3.0%, and an independent adversarial review found its line attribution wrong — the locator gave every repeated occurrence of a link the FIRST match's line and basis, so 34 rows cited a sentence that was not theirs. Re-located per occurrence, one of the six fell away under the page's own rule. Every correction has moved the number down, which is worth stating plainly rather than treating as reassurance. 2 of the 4 sat on a now-permitted edge (corpus-grounding, tailwind-engineer) and were remediated BEFORE the edge was declared, so no permitted link is load-bearing as it stands: corpus-grounding gained an engine-scoped ATTRIBUTION.md beside the code the MIT notice covers, because that engine ships in engineering-base while the corpus ships in frontend-design, and tailwind-engineer now states that without frontend-design its rule is checked by reading rather than by a linter. The classification table marks both rows `load-bearing (remediated)` with the basis, so the evidence and the claim agree. The other 2 are NOT permitted and remain inside the 120. KNOWN BLIND SPOT, measured on 2026-10-09 rather than reasoned about: a link planted on a pack pair joined by an advisory edge leaves the count at 120 and exits 0 at any headroom — the permit is per EDGE, so the ratchet cannot see it. The permitted COUNT therefore prints on every run including `--quiet` (the planted link moved it 83 -> 84), which is the only standing signal that the set is growing. There is no ratchet on it. A link on an UNDECLARED pair still reads 121 and exits 1, measured the same day. Per-link table, both classifier readings and the sampling error rate: agents/evidence/analysis/pack-boundary-link-classification-2026-10-09.md."
     },
     "lint_provenance_vocabulary:permanence-language": {
       "count": 5,
@@ -86,10 +92,14 @@
       "falsifier": "./scripts-run src/scripts/lint_provenance_vocabulary"
     },
     "lint_settings_classes:derivable-surface": {
-      "count": 83,
-      "landed": "2026-08-12",
-      "note": "Anti-regrowth ratchet for the settings disposition axis. 83 of 134 template leaves are classified `derivable` — the mechanism can decide from the situation, so the key should not exist — and each names the replacement that would decide instead (`lint_settings_classes` rejects the bare label, which is what keeps the class from becoming a synonym for \"inconvenient to keep\"). This is a DELETION QUEUE, not 83 deletions: a row stays until the mechanism it names actually exists, and deleting a key ahead of its mechanism is a silently-changed default rather than a simplification. Shrink-only from here, which is the anti-regrowth half — a NEW key classified `derivable` raises the number and reds, so a key whose answer the situation already carries cannot be added at all. The 56-day non-stagnation clause is the other half and is wanted here rather than tolerated: a queue that never drains is a stated direction nobody is walking. The queue opened at 88 of 140 on 2026-08-12 and drained to 83 of 134 the same day: six keys had no reader whatsoever (telegraph.speak_scope, chat_history.max_size_kb, chat_history.on_overflow, quality.wait_for_remote_ci, screenshots.data_bearing_gate, legal_review_prep.consented_at), five of them `derivable` and one a `consent` row reclassified because a published-egress confirmation is a Hard Floor no setting may lift. An unread key is the only deletion that cannot silently change a default, which is why that batch went first. The classification itself is docs/contracts/settings-classes.md.",
-      "falsifier": "./scripts-run src/scripts/lint_settings_classes"
+      "count": 37,
+      "landed": "2026-10-09",
+      "note": "Anti-regrowth ratchet for the settings disposition axis. 83 of 134 template leaves are classified `derivable` — the mechanism can decide from the situation, so the key should not exist — and each names the replacement that would decide instead (`lint_settings_classes` rejects the bare label, which is what keeps the class from becoming a synonym for \"inconvenient to keep\"). This is a DELETION QUEUE, not 83 deletions: a row stays until the mechanism it names actually exists, and deleting a key ahead of its mechanism is a silently-changed default rather than a simplification. Shrink-only from here, which is the anti-regrowth half — a NEW key classified `derivable` raises the number and reds, so a key whose answer the situation already carries cannot be added at all. The 56-day non-stagnation clause is the other half and is wanted here rather than tolerated: a queue that never drains is a stated direction nobody is walking. The queue opened at 88 of 140 on 2026-08-12 and drained to 83 of 134 the same day: six keys had no reader whatsoever (telegraph.speak_scope, chat_history.max_size_kb, chat_history.on_overflow, quality.wait_for_remote_ci, screenshots.data_bearing_gate, legal_review_prep.consented_at), five of them `derivable` and one a `consent` row reclassified because a published-egress confirmation is a Hard Floor no setting may lift. An unread key is the only deletion that cannot silently change a default, which is why that batch went first. The classification itself is docs/contracts/settings-classes.md. DRAIN 2026-10-09, 83 -> 74 (road-to-settings-classes-derivable-surface-stagnation step 2.1): the nine output-and-tone keys (personal.minimal_output, personal.play_by_play, personal.pr_comment_bot_icon, the four verbosity leaves preview_artifacts / routine_confirmations / post_action_reports / intent_announcements, telegraph.speak, tokens.rich_skills) were retired with every reader rewritten to the old default, each registered in REMOVED_KEYS (src/scripts/_lib/settings_removed_keys.ts) so a leftover value warns once and is ignored. DRAIN 2026-10-09, 74 -> 64 (step 2.2): reasoning.auto_gate and the nine reasoning.components.* switches retired; rdp-gate.md's task and host signals decide per component, reasoning.enabled stays the hard off. DRAIN 2026-10-09, 64 -> 62 (step 2.3): roadmap.skip_pre_run_gate and roadmap.dashboard_regen_cadence retired; roadmap.quality_cadence moved back to the queue because it has two defaults (template per_phase, reader fallback end_of_roadmap). DRAIN 2026-10-09, 62 -> 54 (step 2.4): commands.auto_detect, the four commands.suggestion knobs (enabled, confidence_floor, cooldown_seconds, max_options) and commands.create_pr.api_examples / ui_paths / api_paths retired; the suggester loader now reads only blocklist. DRAIN 2026-10-09, 54 -> 47 (step 2.5): memory.cadence, memory.review_threshold and the five knowledge.global_sharing redaction / promotion / freshness leaves retired; load_global_sharing_config now merges only enabled and allowed_tiers, and the hook settings loader no longer reads memory.cadence. DRAIN 2026-10-09, 47 -> 42 (step 2.6): hooks.concern_budget.max_per_event / hard_fail, decision_engine.surface_traces / on_block_fallback and explain.enable_last retired; the decision_engine parser still accepts the two engine keys so a leftover does not reject the whole block. DRAIN 2026-10-09, 42 -> 37 (step 2.7): project.pr_template, pipelines.skill_improvement, consistency.cross_source, subagents.downshift and ai_team.suppress_setup_hint retired; the ai_team loader accepts the last one as a deleted key so the template's leftover line never fails /team. Phase 2 retired 46 of the 47 selected keys; roadmap.quality_cadence stayed in the queue because it has two defaults.",
+      "falsifier": "./scripts-run src/scripts/lint_settings_classes",
+      "reaffirmed": {
+        "date": "2026-10-09",
+        "reason": "Re-read all 83 rows today rather than re-stamping the date, and the re-reading is why the count did not move: not one of the 83 keys is drainable, and the reason is the same in every case. Method, because the obvious one is wrong here. A grep for the dotted literal suggested about 25 keys with zero or near-zero hits. Every one of those 25 was then checked against its owning module individually, and every one had a real reader. The literal grep misses them because TypeScript consumers read nested settings by object access (settings.hard_fail, this._settings.on_block_fallback) rather than restating the path, and because rule, context and command consumers name the key only in prose (\"Read `X` from `.agent-settings.yml`\"). A zero from the dotted grep is a property of the grep, not of the tree. The root cause, stated once: in every one of the 83 rows the named replacement mechanism WAS built, and the old key was never retired from its original consumer. The replacement is additive, not substitutive. Two shapes. Real code still reads it - decision_engine.* is a complete wired gate across work_engine/scoring/decision_engine.ts and hooks/builtin/decision_gate.ts; hooks.concern_budget.hard_fail is read by lint_hook_concern_budget.ts:235 through its own YAML walker; commands.suggestion.* is wired through four files under command_suggester/. Or an instruction-only artefact still says to read it - the nine reasoning.* rows are named explicitly as Signal 1 in rdp-gate.md, in the same file whose Signals 2 and 3 are the cited replacement. One row is a different case and is recorded so nobody re-derives it: hooks.code_graph.enabled genuinely has no code reader, but docs/MIGRATION.md carries an explicit compatibility commitment to keep the surface registered and disabled. Deleting it would break a stated promise rather than a default. The precedent this is measured against: the queue opened at 88 on 2026-08-12 and drained to 83 the same day, taking exactly the six keys that had no reader anywhere. An unread key is the only deletion that cannot silently change a default. Re-run today, the remaining 83 contain no new unread key. What would actually lower this number is therefore not a cleanup but a decision: retire one side of a coexisting old/new mechanism pair, which is a behaviour change. The largest coherent group is the nine reasoning.* rows, all in rdp-gate.md, where the replacement signals demonstrably already run beside the setting. That is the owner call and is not taken here. Reaffirmed on the owner word after the drain was attempted and yielded zero, with the per-key evidence produced first. The clause asks for a re-read and got one; it did not get a date."
+      }
     },
     "check_no_external_sources:shape-block": {
       "count": 148,
@@ -109,10 +119,40 @@
       "note": "Parked roadmaps under agents/roadmaps/later/ carrying no `review_by:` in their frontmatter. NOT a dead-scan-root repair — the obligation is NEW (road-to-observed-learning-signal step 3.4), so every pre-existing parked roadmap lacks it by construction and 68 of 82 is the count at introduction rather than revealed debt. A hard-zero gate was refused on this repository's own recorded ground: a gate that fails its own tree on 68 files the landing change did not cause is reverted rather than adopted. Shrink-only from here, which is the property that matters: a NEWLY parked roadmap must carry `review_by` or this reds immediately. Clearing an entry is one roadmap at a time — read what the park is waiting on, pick a date a human would actually honour, and lower the count. The figure is the gate's own output on this branch (`--json`, class `review-by`), and the same 68 was measured independently over a tree that had grown by one file since the roadmap's own pin, which is why the roadmap's stated floor and this entry agree."
     },
     "lint_roadmap_later_disposition:wake-condition": {
-      "count": 18,
-      "landed": "2026-09-07",
+      "count": 17,
+      "landed": "2026-10-09",
       "falsifier": "./scripts-run src/scripts/lint_roadmap_later_disposition  # the ratchet line names the current count; it fails when the count RISES above this entry",
-      "note": "Parked roadmaps carrying no machine-readable wake condition — neither a structured three-part `entry_condition` (what / when / who) nor one of the four unambiguous body phrases. REVEALED rather than created: until 2026-09-07 the gate short-circuited on the frontmatter status word (`if (status !== 'later' && !RESUME_RE.test(body))`), so 63 of 82 parked roadmaps passed with no resume text present at all, and `trigger` was in RESUME_RE so 11 more passed on a prose mention of the word. Measured after the correction and after migrating the three pre-contract scalar `entry_condition` fields to the mapping form: 19 before the migration, 18 after. Shrink-only from here: a NEWLY parked roadmap must carry a real wake condition. A malformed `entry_condition` is deliberately OUTSIDE this ratchet and fails hard at zero — a scalar or a blank part is a defect the author introduced in the change that wrote it, not inherited debt."
+      "note": "Parked roadmaps carrying no machine-readable wake condition — neither a structured three-part `entry_condition` (what / when / who) nor one of the four unambiguous body phrases. REVEALED rather than created: until 2026-09-07 the gate short-circuited on the frontmatter status word (`if (status !== 'later' && !RESUME_RE.test(body))`), so 63 of 82 parked roadmaps passed with no resume text present at all, and `trigger` was in RESUME_RE so 11 more passed on a prose mention of the word. Measured after the correction and after migrating the three pre-contract scalar `entry_condition` fields to the mapping form: 19 before the migration, 18 after. Shrink-only from here: a NEWLY parked roadmap must carry a real wake condition. A malformed `entry_condition` is deliberately OUTSIDE this ratchet and fails hard at zero — a scalar or a blank part is a defect the author introduced in the change that wrote it, not inherited debt. 2026-10-09, 18 -> 17: `road-to-a-graph-that-feeds-the-gate` was parked with a STRUCTURED `entry_condition` (what / when / who), so it joins the compliant set rather than the baselined one. Its wake condition is a non-zero positive stratum in the pre-registered corpus — re-measured 2026-10-09 and still 0 on all three arms, which is why the park is an accrual wait and not a deferral."
+    },
+    "report_installed_rule_links:kinds:claude-code:rules": {
+      "count": 114,
+      "landed": "2026-10-06",
+      "falsifier": "./scripts-run src/scripts/report_installed_rule_links --kinds all --host claude-code  # the `kind: rules` line prints the live count and this entry as its baseline",
+      "note": "Links inside installed Claude Code rules that point at nothing the install carries, counted per kind for the first time on 2026-10-06 — a starting point, not a regression. 114 rather than the rule reading's 115 because the per-kind split moves the one `docs/` target into the non-projected row. REPORT-ONLY: nothing fails on this number yet (road-to-installed-links-of-every-kind D2); whether a kind count should ever fail a build is decided after one release of readings. Shrink-only: lower it when a repair lands; repairs belong to road-to-rule-triggers-and-links-that-hold."
+    },
+    "report_installed_rule_links:kinds:claude-code:skills": {
+      "count": 296,
+      "landed": "2026-10-06",
+      "falsifier": "./scripts-run src/scripts/report_installed_rule_links --kinds all --host claude-code  # the `kind: skills` line prints the live count and this entry as its baseline",
+      "note": "Links inside installed Claude Code skills (every `.md` under a skill, resolved from its own installed directory) that point at nothing the install carries, of 1752 deployable links, counted for the first time on 2026-10-06 — a starting point, not a regression. `docs/` and ADR targets are excluded and live in the non-projected entry. REPORT-ONLY (road-to-installed-links-of-every-kind D2). Shrink-only: lower it when a repair lands."
+    },
+    "report_installed_rule_links:kinds:claude-code:commands": {
+      "count": 441,
+      "landed": "2026-10-06",
+      "falsifier": "./scripts-run src/scripts/report_installed_rule_links --kinds all --host claude-code  # the `kind: commands` line prints the live count and this entry as its baseline",
+      "note": "Links inside installed Claude Code commands that point at nothing the install carries, of 891 deployable links, counted for the first time on 2026-10-06 — a starting point, not a regression. `docs/` and ADR targets are excluded and live in the non-projected entry. REPORT-ONLY (road-to-installed-links-of-every-kind D2). Shrink-only: lower it when a repair lands."
+    },
+    "report_installed_rule_links:kinds:claude-code:non-projected": {
+      "count": 314,
+      "landed": "2026-10-06",
+      "falsifier": "./scripts-run src/scripts/report_installed_rule_links --kinds all --host claude-code  # the `kind: non-projected` line prints the live count and this entry as its baseline",
+      "note": "Links from installed Claude Code rules, skills and commands into `docs/` or an ADR file — trees no install carries, so every one is dead by construction and is kept apart from the deployable counts. Counted for the first time on 2026-10-06. REPORT-ONLY (road-to-installed-links-of-every-kind D2). Shrink-only: a link removed or replaced by an installed target lowers it."
+    },
+    "report_installed_rule_links:kinds:augment:contexts": {
+      "count": 107,
+      "landed": "2026-10-06",
+      "falsifier": "./scripts-run src/scripts/report_installed_rule_links --kinds all --host augment  # the `kind: contexts` line prints the live count and this entry as its baseline",
+      "note": "Links inside installed contexts that point at nothing the install carries, of 447 deployable links. Recorded for augment because it is the only host whose plan deploys `contexts/`; Claude Code's reading for the kind is `not installed`, which is an absence, not a zero. Counted for the first time on 2026-10-06. REPORT-ONLY (road-to-installed-links-of-every-kind D2). Shrink-only: lower it when a repair lands."
     }
   },
   "retired": {

package/src/config/gitignore-block.txt

@@ -171,3 +171,22 @@
 # Written by POST /api/v1/wizard/state between step transitions, deleted
 # on POST /api/v1/wizard/finish. Local-only crash-recovery aid.
 /.agent-config/wizard-state.json
+
+# Agent config — neighbour-census caches, written by `agent-config doctor
+# neighbours` into the otherwise-TRACKED `agents/reports/` directory. Named
+# here because that placement is what makes them a leak rather than a nuisance:
+# every other file in that directory is a committed report, so a broad staging
+# of the directory is the normal thing to do and would publish
+#
+#   · each neighbour skill's ABSOLUTE source path, which is rooted at the
+#     consumer's home directory and therefore carries their account name
+#     (`/Users/<name>/.claude/skills/...`), and
+#   · the consumer's full installed-skill inventory with per-file digests.
+#
+# Both are derived and disposable: rollback is `rm`, and the next
+# `doctor neighbours` run rebuilds them from the census digest. Neither has
+# ever been tracked in this repository or shipped in a release, so this entry
+# ignores them going forward and unstages nothing — see this file's header on
+# why an entry here is never a tracked -> untracked transition.
+/agents/reports/neighbour-overlap.json
+/agents/reports/neighbour-scan.json

package/src/config/hook-bundle-budget.json

@@ -7,7 +7,7 @@
     "max_bytes": 1550000,
     "max_bytes_derivation": "Measured 1,514,715 bytes on origin/main at 213d87055 (the gate's own reading, APFS-cloned node_modules so no worktree path artefacts). The ceiling is that reading plus ~2.3 % of headroom, rounded to 1,550,000, on the same doctrine as the 2026-10-01 registration: a bundle is rebuilt from source on every run, so an esbuild minor that renames symbols moves the figure by hundreds of bytes with no change to this tree, and a ceiling one byte above the reading would red on that. Composition is healthy at this reading and was checked rather than assumed: one YAML package (258,833 bytes) and 1,238,525 bytes of own source, so the growth is own code, not a re-entered dependency. The 1,564,211-byte pre-swap regression this roadmap closed still cannot reappear under it.",
     "shrink_only": true,
-    "shrink_only_note": "A RAISE needs a recorded reason in `raise_log` below naming what was added and why it could not be avoided; the gate prints the rule but cannot enforce it, because a raise and a lowering are the same edit to a number. The enforcement is review reading `raise_log`, and an empty log beside a raised ceiling is the finding.",
+    "shrink_only_note": "A RAISE needs a recorded reason in `raise_log` below naming what was added and why it could not be avoided. Enforced since road-to-a-ratification-fence-that-follows-its-imports 3.2: the gate reads `max_bytes` at the base revision, and a working value above it fails unless `raise_log` gained an entry whose `to` equals the new value. A lowering needs no entry. This file is also on the ratification gate's watched set, so a raise carries a record as well as a log entry.",
     "raise_log": [
         {
             "date": "2026-10-01",

package/src/config/release-gate-locality.yml

@@ -55,7 +55,8 @@ workflow: .github/workflows/release-validation.yml
 
 jobs:
   release-shape:
-    local: 'git diff --name-only origin/main...HEAD | ./scripts-run src/scripts/check_release_pr_shape --files -'
+    # Two steps in one job: the file-name shape, then the manifest content.
+    local: 'git diff --name-only origin/main...HEAD | ./scripts-run src/scripts/check_release_pr_shape --files - && ./scripts-run src/scripts/check_release_manifest_content --base origin/main'
     verify: true
     # The assertion is about a RELEASE PR's diff — every ordinary branch fails
     # it by construction, so running it off a release branch would teach a

package/src/config/routing-coverage-seed.json

@@ -9,12 +9,12 @@
         "skills": "src/skills/*/evals/triggers.json over src/skills/*/SKILL.md."
     },
     "seed": {
-        "rules": 0.9623,
-        "skills": 0.3746
+        "rules": 0.9626,
+        "skills": 0.4147
     },
     "seed_provenance": {
-        "rules": "102 covered of 106 routed rules on 2026-09-13; was 101 of 105 on 2026-09-08 and 94 of 105 (tier-1 21/24, tier-2 73/81) on 2026-08-25.",
-        "skills": "112 of 299 skills carry evals/triggers.json on 2026-10-04; was 111 on 2026-10-02, 107 on 2026-10-01, 103 earlier that day, 102 on 2026-09-30, 101 on 2026-09-19 and 100 on 2026-08-30.",
+        "rules": "103 covered of 107 routed rules on 2026-10-06; was 102 of 106 on 2026-09-13, 101 of 105 on 2026-09-08 and 94 of 105 (tier-1 21/24, tier-2 73/81) on 2026-08-25.",
+        "skills": "124 of 299 skills carry evals/triggers.json on 2026-10-10; was 123 on 2026-10-09, 119 on 2026-10-07, 118 after the third growth of 2026-10-06, 115 after the second growth that day, 114 earlier that day, 112 on 2026-10-04, 111 on 2026-10-02, 107 on 2026-10-01, 103 earlier that day, 102 on 2026-09-30, 101 on 2026-09-19 and 100 on 2026-08-30.",
         "finding": "The gap between the two seeds IS the roadmap defect D1, quantified. The rules surface is ~90% covered by a deterministic corpus that can fail a PR; the skills surface -- the one production routes on -- is far lower and is covered only by a harness that is advisory only, never gating (rule_trigger_eval.ts:4). The figure is deliberately not restated here (corrected 2026-10-01): it read `25%` against a seed that had since moved to 0.3445, which is the same count-drift this file's own history entries keep repairing one field away. The live value is `seed.skills`, two keys above."
     },
     "history": [
@@ -51,7 +51,7 @@
             "scope": "rules",
             "from": 0.9619,
             "to": 0.9623,
-            "reason": "road-to-adversarial-verification-and-long-runs Phase 1.1 added `test-first` as a routed rule, which moved the DENOMINATOR from 105 to 106 -- the ratio-falls-two-ways case this file's own _comment names, and the one that is a defect to record rather than repair. The repair is the corpus file, not the seed: `tests/eval/routing-matrix/test-first.yaml` landed in the same change (101 -> 102 of 106), so the ratio ROSE across a denominator increase rather than merely holding. The rule is trigger-less by design, so its positives describe the situations it governs rather than strings that summon it, and its near-misses are its own \u00a7 Does NOT fire set. The seed follows the gain because this file's test asserts seed == live measurement in both directions; it may never be LOWERED."
+            "reason": "road-to-adversarial-verification-and-long-runs Phase 1.1 added `test-first` as a routed rule, which moved the DENOMINATOR from 105 to 106 -- the ratio-falls-two-ways case this file's own _comment names, and the one that is a defect to record rather than repair. The repair is the corpus file, not the seed: `tests/eval/routing-matrix/test-first.yaml` landed in the same change (101 -> 102 of 106), so the ratio ROSE across a denominator increase rather than merely holding. The rule is trigger-less by design, so its positives describe the situations it governs rather than strings that summon it, and its near-misses are its own § Does NOT fire set. The seed follows the gain because this file's test asserts seed == live measurement in both directions; it may never be LOWERED."
         },
         {
             "date": "2026-09-19",
@@ -86,7 +86,7 @@
             "scope": "skills",
             "from": 0.3579,
             "to": 0.3712,
-            "reason": "road-to-stacks-beyond-php steps 1.2 and 1.4 authored FOUR corpus files (107 -> 111 of 299) for quality-tools, test-driven-development, api-testing and test-performance. Same shape as both 2026-10-01 entries and for the same reason: that lane adds one ecosystem-keyed paragraph to three skill bodies and two reference bodies under a fourth, and check_routing_coverage requires a corpus for every skill a diff touches \u2014 so the files are the gate's own remedy rather than a coverage push. Each carries exemplars in DE and EN, near-misses naming the neighbour that actually owns the adjacent job rather than easy negatives, and counterexamples for the two directions its vocabulary over-claims, with the case class declared per query. The seed rises so the gain cannot be given back silently; it may never be LOWERED. The partition split is 2 holdout / 2 train by name hash \u2014 quality-tools at 0x20 = 32 and test-performance at 0x10 = 16 seal; test-driven-development at 0x47 = 71 and api-testing at 0x67 = 103 train \u2014 so BOTH published train-side measurements are re-taken here on the terms the 2026-10-01 entries set for a train-side growth: routing-body-signal-verdict.json (verdict unchanged in kind, still `harmful`, false activation +7.35 pp against the +2.0 pp guard) and delivery-set-measurement-2026-08-31.json. The holdout pin gains two sealed rows with its ordering claim NOT extended to them, for the reason the 19th row already established: a row authored today predates nothing."
+            "reason": "road-to-stacks-beyond-php steps 1.2 and 1.4 authored FOUR corpus files (107 -> 111 of 299) for quality-tools, test-driven-development, api-testing and test-performance. Same shape as both 2026-10-01 entries and for the same reason: that lane adds one ecosystem-keyed paragraph to three skill bodies and two reference bodies under a fourth, and check_routing_coverage requires a corpus for every skill a diff touches — so the files are the gate's own remedy rather than a coverage push. Each carries exemplars in DE and EN, near-misses naming the neighbour that actually owns the adjacent job rather than easy negatives, and counterexamples for the two directions its vocabulary over-claims, with the case class declared per query. The seed rises so the gain cannot be given back silently; it may never be LOWERED. The partition split is 2 holdout / 2 train by name hash — quality-tools at 0x20 = 32 and test-performance at 0x10 = 16 seal; test-driven-development at 0x47 = 71 and api-testing at 0x67 = 103 train — so BOTH published train-side measurements are re-taken here on the terms the 2026-10-01 entries set for a train-side growth: routing-body-signal-verdict.json (verdict unchanged in kind, still `harmful`, false activation +7.35 pp against the +2.0 pp guard) and delivery-set-measurement-2026-08-31.json. The holdout pin gains two sealed rows with its ordering claim NOT extended to them, for the reason the 19th row already established: a row authored today predates nothing."
         },
         {
             "date": "2026-10-04",
@@ -94,6 +94,48 @@
             "from": 0.3712,
             "to": 0.3746,
             "reason": "road-to-corpus-refresh-cadence-shape step 1.2b authored ONE corpus file for `api-design` (111 -> 112 of 299). Same shape as the 2026-10-01 entry this roadmap's 1.2a wrote, and for the same reason: that step re-checked the skill's grounding corpus against RFC 9110/9457/7396/8288, which edited src/skills/api-design/data/, and check_routing_coverage requires a corpus for every skill a diff touches -- so the file is the gate's own remedy rather than a coverage push. Ten cases: five exemplars including the 'expose this as an endpoint' phrasing the skill's own description names and one German, three near-misses -- api-endpoint for implementing an already-designed route and api-testing for covering one, both named in that skill's SKILL.md 'Do NOT use when' block, plus openapi for documenting an existing endpoint set, which it does not name and which is included because it runs over the same endpoint list immediately after design -- and two counterexamples, one guarding the 'API' homonym (consuming a third-party interface rather than designing ours). The seed rises so the gain cannot be given back silently; it may never be LOWERED. The partition is TRAIN, not holdout: sha256('api-design')[0:2] is 0xbb = 187, above the holdout ceiling of 51, which is why BOTH published train-side measurements are re-taken here on the terms the 2026-10-01 and 2026-10-02 entries set for a train-side growth -- routing-body-signal-verdict.json and delivery-set-measurement-2026-08-31.json -- and why the holdout pin is NOT touched: its sealed rows are unchanged by a train-side addition, and re-taking it would publish the same measurement under a newer date, which is a freshness claim nothing earned. ONE entry was removed from trigger_eval_grandfather.json (192 -> 191): `api-design` was NOT red on main -- on main it ships no corpus at all, and check_trigger_eval_presence fires only on an allowlist entry whose skill HAS one, so its entry went stale the moment this change added the corpus. That red is created here and removed here, in the same change. FOUR further entries are red on that gate and are deliberately left alone, with the reason named rather than inherited silently: api-testing, quality-tools, test-driven-development and test-performance all carry a corpus on origin/main already, verified by listing that tree, so their stale allowlist entries are pre-existing debt from the 2026-10-02 growth rather than anything this change created. The gate is bound in no workflow, so none of the five blocks a pull request."
+        },
+        {
+            "date": "2026-10-06",
+            "scope": "skills",
+            "from": 0.3813,
+            "to": 0.3846,
+            "reason": "A CI-fix pass completing `road-to-a-spend-bound-only-where-one-was-set` (drain lane `drain/spend-bound-where-set-20261006`) authored ONE corpus file for `ai-council` (114 -> 115 of 299). Same shape as the 2026-10-04 entry above and for the same reason: the branch edited that skill's `SKILL.md` and two reference bodies while removing the standing default spend ceiling, and check_routing_coverage requires a corpus for every skill a diff touches -- so the file is the gate's own remedy rather than a coverage push. Six cases: three exemplars including one German (`hol dir eine zweite, neutrale Meinung...`), two near-misses naming the two siblings the skill's own See-also section points at -- subagent-orchestration (in-process fan-out, no outside model) and /team (one strong model going deep in the repo, not a breadth poll) -- and one counterexample, an unrelated roadmap-authoring ask. The seed rises so the gain cannot be given back silently; it may never be LOWERED. The partition is TRAIN, not holdout: sha256('ai-council')[0:2] is 0x53 = 83, above the holdout ceiling of 51, which is why BOTH published train-side measurements are re-taken here on the terms the 2026-10-04 entry sets for a train-side growth -- routing-body-signal-verdict.json (verdict unchanged in kind, still `harmful`, false activation +6.91 pp against the +2.0 pp guard) and delivery-set-measurement-2026-08-31.json -- and why the holdout pin is NOT touched beyond its SET-SHA256: its sealed rows are unchanged by a train-side addition, and re-taking the ordering claim would publish the same measurement under a newer date, which is a freshness claim nothing earned. ONE entry was removed from trigger_eval_grandfather.json: `ai-council` was NOT red on main -- on main it ships no corpus at all, and check_trigger_eval_presence fires only on an allowlist entry whose skill HAS one, so its entry went stale the moment this change added the corpus. That red is created here and removed here, in the same change. The four pre-existing reds the 2026-10-04 entry names (api-testing, quality-tools, test-driven-development, test-performance) are untouched -- still pre-existing debt from the 2026-10-02 growth, not anything this change created. The gate is bound in no workflow, so none of the five blocks a pull request."
+        },
+        {
+            "date": "2026-10-06",
+            "scope": "rules",
+            "from": 0.9623,
+            "to": 0.9626,
+            "reason": "road-to-neighbours-that-pull-their-weight step 2.1 added `neighbour-precedence` as a routed rule, moving the DENOMINATOR from 106 to 107. The repair is the corpus file, not the seed: `tests/eval/routing-matrix/neighbour-precedence.yaml` landed in the same change (102 -> 103 of 107), so the ratio rose across a denominator increase. The seed follows the gain because this file's test asserts seed == live measurement in both directions; it may never be LOWERED."
+        },
+        {
+            "date": "2026-10-06",
+            "scope": "skills",
+            "from": 0.3846,
+            "to": 0.3946,
+            "reason": "feat/git-convention-settings, which adds the git.* convention settings (commit_format, branch_pattern, update_strategy), authored THREE corpus files (115 -> 118 of 299) for conventional-commits-writing, jira-integration and merge-conflicts. Same shape as the 2026-10-01 four-corpus entry and for the same reason: the branch edits those three skill bodies, and check_routing_coverage requires a corpus for every skill a diff touches, so the files are the gate's own remedy rather than a coverage push. Each carries four exemplars including one German, three near-misses naming the neighbour that owns the adjacent job, and one counterexample, with the case class declared per query. The seed rises so the gain cannot be given back silently; it may never be LOWERED. The partition split is 2 holdout / 1 train by name hash -- conventional-commits-writing at 0x2f = 47 and merge-conflicts at 0x25 = 37 seal; jira-integration at 0x93 = 147 trains -- so BOTH published train-side measurements are re-taken here on the terms the 2026-10-04 entry sets for a train-side growth: routing-body-signal-verdict.json (verdict unchanged in kind, still `harmful`, false activation +6.85 pp against the +2.0 pp guard) and delivery-set-measurement-2026-08-31.json. The holdout pin gains two sealed rows and a new SET-SHA256, with its ordering claim NOT extended to them. THREE entries were removed from trigger_eval_grandfather.json (188 -> 185), none red on main beforehand: check_trigger_eval_presence fires only on an allowlist entry whose skill HAS a corpus, so each went stale the moment this change added one, and each red is created and removed in the same change."
+        },
+        {
+            "date": "2026-10-07",
+            "scope": "skills",
+            "from": 0.3946,
+            "to": 0.398,
+            "reason": "Correction of the 2026-10-06 entry above, which is right about its three files and silent about a fourth. The same branch (feat/git-convention-settings) later added `src/skills/using-git-worktrees/evals/triggers.json` in its own commit without moving the seed, so the tree held 119 corpus files against a seed of 118/299 and this file's own test (seed == live measurement) read red. Recounted on 2026-10-07: 119 of 299 (`src/skills/*/evals/triggers.json`), so the branch added FOUR corpus files in all (115 -> 119): conventional-commits-writing, jira-integration, merge-conflicts and using-git-worktrees. The seed rises to the live value; it may never be LOWERED. sha256('using-git-worktrees')[0:2] is 0xba = 186, above the holdout ceiling of 51, so the growth is TRAIN-side and both train-side measurements are re-taken in this change -- routing-body-signal-verdict.json (verdict unchanged in kind, still `harmful`, false activation +6.79 pp against the +2.0 pp guard, train corpora 91 -> 92) and delivery-set-measurement-2026-08-31.json -- while the holdout pin is untouched. ONE entry was removed from trigger_eval_grandfather.json: `using-git-worktrees` went stale when its corpus landed, a red this branch created and removes here."
+        },
+        {
+            "date": "2026-10-09",
+            "scope": "skills",
+            "from": 0.398,
+            "to": 0.4114,
+            "reason": "The settings-key retirement (#2274) edited four corpus-less skills -- command-routing, feature-planning, po-discovery and source-discovery -- and check_routing_coverage requires every touched skill to carry a corpus, so each gained evals/triggers.json (119 -> 123 of 299). The seed rises to the live value; it may never be LOWERED. All four name hashes are above the holdout ceiling of 51, so the growth is TRAIN-side and both train-side measurements are re-taken in this change -- routing-body-signal-verdict.json (verdict unchanged in kind, still `harmful`, false activation +6.61 pp against the +2.0 pp guard, train corpora 92 -> 96) and delivery-set-measurement-2026-08-31.json -- while the holdout pin's sealed set is untouched. FOUR entries were removed from trigger_eval_grandfather.json: each went stale when its corpus landed."
+        },
+        {
+            "date": "2026-10-10",
+            "scope": "skills",
+            "from": 0.4114,
+            "to": 0.4147,
+            "reason": "road-to-corpus-refresh-cadence-shape step 1.2c re-checked the `database` grounding corpus against PostgreSQL 18 and MySQL 9.7 reference documentation, which edited src/skills/database/data/, and check_routing_coverage requires a corpus for every skill a diff touches (123 -> 124 of 299). Same shape as the 2026-10-01 and 2026-10-04 entries this roadmap's 1.2a and 1.2b wrote, and for the same reason: the file is the gate's own remedy rather than a coverage push. Ten cases: five exemplars including the bare 'this query is slow' phrasing the skill's own description names verbatim and one German, three near-misses -- ORM model work and a migration-only ask, both named in that skill's 'Do NOT use when' block, plus schema-review for a persistence-rule review, which it does not name and which is included because it reads as a database question -- and two counterexamples guarding the 'database' homonym (a vector store as an embedding index, and a hosting/billing question). The seed rises to the live value; it may never be LOWERED. The partition is TRAIN, not holdout: sha256('database')[0:2] is 0x35 = 53, above the holdout ceiling of 51, so BOTH published train-side measurements are re-taken here on the terms the 2026-10-04 and 2026-10-09 entries set -- routing-body-signal-verdict.json (verdict unchanged in kind, still `harmful`, false activation +6.75 pp against the +2.0 pp guard, train corpora 96 -> 97) and delivery-set-measurement-2026-08-31.json -- while the holdout pin's sealed set is untouched, because re-taking it would publish the same measurement under a newer date. ONE entry was removed from trigger_eval_grandfather.json: `database` was NOT red on main -- on main it ships no corpus at all, and check_trigger_eval_presence fires only on an allowlist entry whose skill HAS one, so its entry went stale the moment this change added the corpus. That red is created here and removed here."
         }
     ]
 }

package/src/config/rule-law-ceilings.json

@@ -1,6 +1,12 @@
 {
-    "_comment": "Per-rule law-section and body ceilings (road-to-rule-laws-that-can-stand Phase 1). SHRINK-ONLY on every axis: an id may LEAVE `missing`, never join it; a recorded exception is a ceiling the rule may fall below and never rise above. Raising one to clear a red is the config-weakening move this repo blocks by construction — `--write-baseline` refuses to raise, it only re-records the smaller of old and current. A rule at its exception is not thereby correct, only not worse. Regenerate with `lint_rule_law_section --write-baseline`; never hand-edit the counts, but DO hand-edit `owner`, `review` and `reason` — those are the review contract and the generator only seeds them.",
+    "_comment": "Per-rule law-section and body ceilings (road-to-rule-laws-that-can-stand Phase 1) plus the trigger-presence baseline (road-to-an-installed-layer-that-is-thinned step 3.4). Two different guarantees, not one: `law_exceptions` and `body_exceptions` are numeric ceilings `--write-baseline` structurally refuses to raise (it re-records the SMALLER of old and current, never the current alone) — a rule at its exception is not thereby correct, only not worse. `missing` and `no_trigger` are LIST membership: an id SHOULD only leave, never join, but that is a review convention the generator does not enforce by construction — `--write-baseline` re-records every id that currently fails presence/trigger, full stop, so a newly-broken rule is swept in exactly like a genuinely-fixed one is swept out. The `stale-baseline-entry` finding makes a fixed id visible for removal; nothing makes a newly-broken id visible for refusal except a human reading the diff. Regenerate with `lint_rule_law_section --write-baseline`; never hand-edit the counts, but DO hand-edit `owner`, `review` and `reason` — those are the review contract and the generator only seeds them.",
     "measured_at_commit": "30f7d21f6",
+    "no_trigger": [
+        "no-roadmap-references",
+        "rule-type-governance",
+        "skill-quality",
+        "source-confidentiality"
+    ],
     "missing": [
         "architecture",
         "artifact-drafting-protocol",
@@ -66,19 +72,19 @@
             "reason": "Two layers (code borrows and the knowledge/harvest layer) each with its own law, plus the no-CI-detector honesty section recording a measured gate decision."
         },
         "context-hygiene": {
-            "chars": 8320,
+            "chars": 8283,
             "owner": "agent-config-maintainer",
             "review": "2026-12-01",
             "reason": "Carries the freshness ladder, the 3-failure rule, loop detection and the 15/25 read-loop rule, each with its own self-check. Already migrated once into context-hygiene-mechanics and re-grew."
         },
         "decision-revisit-gate": {
-            "chars": 8566,
+            "chars": 8408,
             "owner": "agent-config-maintainer",
             "review": "2026-12-01",
             "reason": "The largest rule in the tree. Carries the five-step gate, the two descriptive axes, the owner-reserved table and an honest-enforcement section. Phase 1.4 of road-to-rule-laws-that-can-stand names it as a first mover for the load_context split."
         },
         "design-fidelity": {
-            "chars": 8777,
+            "chars": 8635,
             "owner": "agent-config-maintainer",
             "review": "2026-12-01",
             "reason": "Carries the artefact-maturity axis, the fidelity-mode table and the routing matrix. Phase 1.4 names it as a first mover."
@@ -90,10 +96,10 @@
             "reason": "Three laws plus the deferred-item resolution procedure and the later/PR-gate dispositions. The dispositions are mechanism, not obligation, and are the load_context candidate."
         },
         "settings-ask-protocol": {
-            "chars": 8099,
+            "chars": 8058,
             "owner": "agent-config-maintainer",
             "review": "2026-12-01",
-            "reason": "Carries the four slots, the seven keys, the non-interactive rule and the consent-verdict contract. The key inventory is reference material and is the load_context candidate."
+            "reason": "Carries the four slots, the five keys, the non-interactive rule and the consent-verdict contract. The key inventory is reference material and is the load_context candidate."
         }
     }
 }