@event4u/agent-config 16.3.0 → 16.5.0

package/docs/contracts/settings-classes.md

@@ -55,10 +55,10 @@ verbatim, and this class must not become the precedent that erodes it.
 **It governs writes, not reads.** Every class is readable by everything. A C
 class does not hide a value; it refuses to let a non-human change it.
 
-**It governs writes, not asks.** Three settings ship an `ask` value in their own
-enum (`tokens.rich_skills`, `subagents.adversarial_council`,
-`decision_engine.on_block`). It was four until ADR-229 deleted
-`worktrees.mode`.
+**It governs writes, not asks.** Two settings ship an `ask` value in their own
+enum (`subagents.adversarial_council`, `decision_engine.on_block`). It was four
+until ADR-229 deleted `worktrees.mode`, and three until `tokens.rich_skills` was
+retired on 2026-10-09.
 Those are C-class here, and that is not a contradiction: the class says who may
 *persist* a new value; the `ask` value says what happens *at runtime* when the
 setting is already set to `ask`. A C-class key set to `ask` still produces a
@@ -95,9 +95,11 @@ backwards. Tests 1–7 ask *what can the attacker do*; test 8 asks *what can the
 attacker hide*. A settings write that erases the trail is not less severe than
 one that raises a budget — it is the one that makes the other invisible.
 
-`commands.suggestion.enabled` is the worked counter-example: it is a master
-switch, and it is **A**, because switching it off removes no gate, no spend, no
-authority, and no audit trail — it removes a convenience.
+`commands.suggestion.enabled` is the worked counter-example: it was a master
+switch, and it was **A**, because switching it off removed no gate, no spend, no
+authority, and no audit trail — it removed a convenience. (The key itself was
+retired on 2026-10-09 with its default as the fixed behavior; the reasoning
+about its class is what this paragraph keeps.)
 
 ## B eligibility — the invariant
 
@@ -212,7 +214,7 @@ could **soak** before it bound, and a concern that is off does not run, so the
 switch made the soak it was protecting impossible. What decides whether that
 gate fires is now what should have decided it from the start — each detector's
 own trigger conditions. A leftover block warns once and is ignored
-(`REMOVED_KEYS`, `src/scripts/_lib/agent_settings.ts`).
+(`REMOVED_KEYS`, `src/scripts/_lib/settings_removed_keys.ts`).
 
 One switch survives these deletions on purpose, and it is not the same shape
 wearing a different name.
@@ -245,10 +247,21 @@ dispatch runs, not WHETHER the layer exists, so they keep their own C rows.
 
 | Class | Keys |
 |---|---|
-| A — preference | 26 |
+| A — preference | 9 |
 | B — consent | 3 |
-| C — guarded | 126 |
-| **Total** | **155** |
+| C — guarded | 100 |
+| **Total** | **112** |
+
+<!-- derivable-retirement-2026-10-09 -->
+It fell to 112 on 2026-10-09 when `road-to-settings-classes-derivable-surface-stagnation` Phase 2 retired 46 `derivable` keys (17 A, 29 C) whose absence changes no effective default: every reader was removed with the key and left the old default as the only behavior, and each key carries a `REMOVED_KEYS` reason, so an older install that still sets one warns once and boots unchanged. By group: 2.1 output and tone — `telegraph.speak`, `tokens.rich_skills`, `personal.minimal_output`, `personal.play_by_play`, `personal.pr_comment_bot_icon`, `verbosity.intent_announcements`, `verbosity.preview_artifacts`, `verbosity.routine_confirmations`, `verbosity.post_action_reports`; 2.2 reasoning protocol switches — `reasoning.auto_gate`, `reasoning.components.orchestrator`, `reasoning.components.notes_first`, `reasoning.components.grounding`, `reasoning.components.intent`, `reasoning.components.complexity_first`, `reasoning.components.verifier_default`, `reasoning.components.prediction_tracking`, `reasoning.components.decision_ledger`, `reasoning.components.uncertainty_budget`; 2.3 roadmap cadence — `roadmap.skip_pre_run_gate`, `roadmap.dashboard_regen_cadence`; 2.4 command suggestion and PR creation — `commands.auto_detect`, `commands.suggestion.enabled`, `commands.suggestion.confidence_floor`, `commands.suggestion.cooldown_seconds`, `commands.suggestion.max_options`, `commands.create_pr.api_examples`, `commands.create_pr.ui_paths`, `commands.create_pr.api_paths`; 2.5 memory and knowledge sharing — `memory.cadence`, `memory.review_threshold`, `knowledge.global_sharing.redaction.enabled`, `knowledge.global_sharing.redaction.halt_on_trigger`, `knowledge.global_sharing.auto_promote_threshold`, `knowledge.global_sharing.freshness.hypothesis_after_days`, `knowledge.global_sharing.freshness.stale_after_days`; 2.6 hooks and engine — `hooks.concern_budget.max_per_event`, `hooks.concern_budget.hard_fail`, `decision_engine.surface_traces`, `decision_engine.on_block_fallback`, `explain.enable_last`; 2.7 remaining — `project.pr_template`, `pipelines.skill_improvement`, `consistency.cross_source`, `subagents.downshift`, `ai_team.suppress_setup_hint`. Selection and per-key evidence: `agents/evidence/analysis/settings-derivable-retirement-audit-2026-10-09.md`.
+<!-- /derivable-retirement-2026-10-09 -->
+
+It rose to 158 on 2026-10-06 when the `git:` section added three C keys —
+`commit_format`, `branch_pattern`, `update_strategy` — so a team's commit
+grammar, branch naming and base-sync operation can be declared once instead of
+measured per repository. All three are `policy`: each is a fact the repository or
+the forge could carry, and each row names why that carrier does not reach every
+install. None is `derivable`, so the anti-regrowth ratchet is untouched.
 
 It rose again on 2026-09-13 when `road-to-adversarial-verification-and-long-runs`
 Phase 0 added three C keys: `quality.local_auto_run_in_mission` (`consent` — it
@@ -380,11 +393,11 @@ the template, which is the drift this contract exists to prevent.
 
 | Disposition | Keys |
 |---|---|
-| derivable | 83 |
+| derivable | 37 |
 | un-inferrable | 10 |
 | consent | 48 |
-| policy | 14 |
-| **Total** | **155** |
+| policy | 17 |
+| **Total** | **112** |
 
 First measured 2026-08-12 at 140 leaves (derivable 88 · consent 38 ·
 un-inferrable 9 · policy 5), from the table below rather than predicted — the
@@ -395,8 +408,8 @@ keys were deleted the same day, which is where the −5 `derivable` comes from;
 held open rather than deleted.
 
 `derivable` is the **deletion queue, not a deletion**: a row stays until the
-mechanism it names actually exists, so 83 measures work outstanding, not keys
-about to disappear. The count is expected to fall while `un-inferrable` does not
+mechanism it names actually exists, so its count measures work outstanding, not
+keys about to disappear. The count is expected to fall while `un-inferrable` does not
 — those 9 plus whatever survives re-examination in `consent` are the floor this
 surface has, and stating it is the point. `policy` is the smallest class and the
 only one whose action is a *move* rather than a keep or a delete: seven keys carry
@@ -489,8 +502,6 @@ Rows follow template order, so a diff against the template reads straight down.
 | `rule_loading_tier` | C | `__RULE_LOADING_TIER__` | legacy master switch for rule loading | derivable — `discipline_profile` supersedes it with a documented mapping (minimal→off, balanced→essential, full→full) |
 | `lean_projection.mode` | C | `delivery` | `thin` and `delivery` remove rule bodies from the agent's standing context. Two defaults, and this column carries the template one: the shipped template has said `delivery` since ADR-267, while the parser fallback for a value that resolves from no layer stays `eager-all` (ADR-267 decision 4) | derivable — `probe_host_compliance.ts` already computes the per-host thin/eager recommendation |
 | `lean_projection.hosts` | C | `[claude-code]` | decides WHICH hosts a thinning mode may thin, so an added id removes rule bodies from that host's context | policy — the value is a package-level decision the tree already holds: ADR-267 scopes the shipped `delivery` flip to `claude-code` alone. NOT `derivable`, and the distinction is the whole reason for this row: the mechanism that would compute an admissible host set, `admissibleUnderE3` in `src/scripts/_lib/injection_effect.ts`, admits **nothing** today — `src/config/host-injection-effect.json` carries 1 `observed-false` and 8 `unobserved` rows and no `observed-true` — so a derivation would yield `[]` rather than the shipped `[claude-code]`. Naming a mechanism that returns empty as the replacement would put a key in the deletion queue whose deletion would silently change the default. Move target: the ADR plus that census, once a host earns an `observed-true` row |
-| `telegraph.speak` | C | `false` | ships a rule body; a token-cost lever in both directions | derivable — the telegraph kill-criterion bench verdict is a package-level decision, not a per-install one |
-| `tokens.rich_skills` | C | `"on"` | token-spend lever | derivable — the skill's own `token_budget_class: rich` declaration plus the CI ceiling in `lint_token_budget_discipline.ts` |
 | `cost.budgets.daily` | C | `0` | rolling spend ceiling | consent |
 | `cost.budgets.weekly` | C | `0` | rolling spend ceiling | consent |
 | `cost.budgets.monthly` | C | `0` | rolling spend ceiling | consent |
@@ -502,22 +513,17 @@ Rows follow template order, so a diff against the template reads straight down.
 | `personal.ide` | C | `""` | names a binary the agent would execute | un-inferrable |
 | `personal.open_edited_files` | B | `false` | starts invoking that binary on every edit | consent |
 | `personal.rtk_installed` | A | `false` | auto-detected machine fact | derivable — the wizard's own two-stage PATH probe (`which rtk` plus an identity check), which already overwrites the key |
-| `personal.minimal_output` | A | `true` | reply-shape preference | derivable — `direct-answers` Iron Law 3 already fixes reply length per reply |
-| `personal.play_by_play` | A | `false` | narration preference | derivable — `direct-answers`' narration ban is the standing default; an in-turn request is the only thing that lifts it |
 | `personal.canary_name` | B | `""` | arms the session-degradation canary | un-inferrable |
-| `personal.pr_comment_bot_icon` | A | `false` | comment cosmetics | derivable — `no-decorative-emojis-in-git-surfaces` already forbids the icon in PR comments |
 | `personal.pr_progress_comments` | C | `false` | authorises unsolicited outbound comments on a PR | consent |
 | `personal.autonomy` | C | `auto` | suppresses confirmation questions | derivable — `no-cheap-questions`' mode-independent Pre-Send Self-Check decides per question |
 | `personal.user_type` | C | `"__USER_TYPE__"` | master axis filtering the projected surface | derivable — `profile.id` already carries the persona axis over a near-identical value set |
-| `verbosity.intent_announcements` | A | `false` | narration preference | derivable — `personal.play_by_play` already gates the narration carve-out this key sits under |
-| `verbosity.preview_artifacts` | C | `false` | removes pre-action review of commits, PRs, and branches | derivable — the Iron-Law gates already decide which artefacts need a pre-action look |
-| `verbosity.routine_confirmations` | C | `false` | removes confirmation prompts | derivable — `no-cheap-questions`' Pre-Send Self-Check already decides whether a confirmation carries a real trade-off |
 | `verbosity.offer_council_in_delivery` | A | `false` | offers a paid step; never takes it | derivable — `agent-config council:status`, which answers whether there is anything to offer |
-| `verbosity.post_action_reports` | A | `minimal` | size of a status block | derivable — `direct-answers` Iron Law 3 and the reply-close contract already fix the status block to ONE end-summary |
-| `project.pr_template` | C | `.github/pull_request_template.md` | filesystem path whose contents reach an outbound PR | derivable — GitHub's own PR-template resolution order; the key only caches a filesystem lookup |
 | `project.upstream_repo` | C | `""` | destination of outbound improvement PRs | derivable — the installed package's own `package.json` repository field |
 | `project.improvement_pr_branch_prefix` | A | `improve/agent-` | branch-name cosmetics | derivable — the repo's own branch-naming convention, observable from `git branch -r` |
 | `project.audience` | C | `public` | C-test 4 — it governs the agent's own reasoning discipline: `self` makes the § 8-pre demand gate inert. Who a project is built for is a fact only its maintainer knows, so the agent never infers it and never asks; hand-edit or the GUI write route. The default is today's behaviour, so an install that never sets it is unchanged | policy |
+| `git.commit_format` | C | `ticket-scope` | C-test 4 — it selects the grammar every commit the agent writes is held to. The conventional-commits-writing skill forbids adopting a measured convention without the user's answer, and an agent-writable key would be that adoption with the ask removed. The default is today's behaviour | policy — a repository fact the tree can carry instead (commitlint config, a `commit-msg` hook, `CONTRIBUTING.md` § Commits); the skill already ranks those above this key. Kept because a team convention spans repositories that do not yet carry one. A team declares it in `.git-convention.yml` at the repository root (ADR-283), read at `HEAD` over every developer layer, where either value is a declaration. The one agent write is creation: `git:convention init --yes` creates the file once after the user's yes this turn, never over an existing one; the class-C fence still refuses every direct write and edit (ADR-283 § Creation) |
+| `git.branch_pattern` | C | `{type}/{slug}` | C-test 4 — same reasoning as `git.commit_format`, for branch names | policy — NOT `derivable` from `git branch -r` as `project.improvement_pr_branch_prefix` is: a team that merges with `--delete-branch` leaves no merged branch on the remote to sample, so the observation is empty exactly where the convention is strictest. A team declares it in `.git-convention.yml` at the repository root (ADR-283), read at `HEAD` over every developer layer, where either value is a declaration. The one agent write is creation: `git:convention init --yes` creates the file once after the user's yes this turn, never over an existing one; the class-C fence still refuses every direct write and edit (ADR-283 § Creation) |
+| `git.update_strategy` | C | `merge` | C-test 4 — `rebase` makes the proposed base sync a history rewrite plus a `--force-with-lease` push. It authorises nothing (git-history-discipline still asks per rewrite), but an agent that could set it could choose which destructive operation it proposes next. The default is today's behaviour | policy — the forge's own branch rules (a required linear history) carry the same fact; kept because the rule set is not readable from every host. A team declares it in `.git-convention.yml` at the repository root (ADR-283), read at the commit a pull request is judged against, where either value is a declaration. `git:convention init` never writes this key (ADR-283 § Creation) |
 | `github.pr_reply_method` | A | `create_review_comment` | picks between two endpoints of one operation | derivable — the `auto` value already in the enum: the routing detects the working endpoint on first use and writes it back |
 | `delivery.merge` | C | `off` | C-test 1 — it is the configuration half of merge authority, resolved by ADR-268 section 3. An agent that could write it could grant itself the capability the key gates, which is the exact shape the C fence exists to refuse. `off` is today's behavior, so an install that never sets it is unchanged | consent |
 | `delivery.wait_for_ci` | C | `true` | C-test 1 — it authorises the run to keep spending time and tokens driving CI to a verdict rather than ending at push. A standing authorisation over the agent's own consumption is not a preference | consent |
@@ -532,24 +538,11 @@ Rows follow template order, so a diff against the template reads straight down.
 | `chat_history.text_limits.agent` | C | `5000` | cap on how much agent text is written to disk | consent |
 | `chat_history.text_limits.tool` | C | `200` | cap on how much tool payload is written to disk | consent |
 | `chat_history.text_limits.phase` | C | `200` | cap on how much phase text is written to disk | consent |
-| `pipelines.skill_improvement` | A | `true` | proposes a capture; the user still decides | derivable — the pipeline's own trigger condition; the capture is already a user-confirmed proposal |
 | `reasoning.enabled` | C | `true` | master switch for the agent's own reasoning discipline | derivable — the RDP gate's own task-triviality and host self-assessment signals already decide per turn |
-| `reasoning.auto_gate` | C | `true` | decides when that discipline engages | derivable — it only removes the RDP gate's host self-assessment signal, its cheapest and most situational input |
-| `reasoning.components.orchestrator` | C | `true` | a component of the agent's own discipline | derivable — the RDP gate's task signal (complex / multi-component vs trivial) |
-| `reasoning.components.notes_first` | C | `true` | a component of the agent's own discipline | derivable — the RDP gate's task signal; the notes file only exists once the gate engaged |
-| `reasoning.components.grounding` | C | `true` | a component of the agent's own discipline | derivable — `think-before-action`'s own info-gap condition, which `source-discovery-gate` already tests |
-| `reasoning.components.intent` | C | `true` | a component of the agent's own discipline | derivable — the RDP gate's host self-assessment signal |
-| `reasoning.components.complexity_first` | C | `true` | a component of the agent's own discipline | derivable — the RDP gate's task signal (a load-bearing unknown exists or it does not) |
-| `reasoning.components.verifier_default` | C | `true` | disabling it removes a verification step | derivable — the verifier's own structural-complexity gate |
-| `reasoning.components.prediction_tracking` | C | `true` | a component of the agent's own discipline | derivable — the RDP gate's task signal; a turn with no prediction to log produces no entry |
-| `reasoning.components.decision_ledger` | C | `true` | a component of the agent's own discipline | derivable — the escalation litmus in `notes-first-reasoning` (tactical to notes, durable to ADR) |
-| `reasoning.components.uncertainty_budget` | C | `true` | a component of the agent's own discipline | derivable — the RDP gate's task signal; the score feeds adaptive effort only where the gate already engaged |
-| `roadmap.skip_pre_run_gate` | C | `true` | disables a pre-run confirmation gate | derivable — the pre-run gate's own ambiguity condition; a genuine ambiguity prompts regardless |
-| `roadmap.quality_cadence` | C | `end_of_roadmap` | governs when verification runs | derivable — `quality.local_auto_run` decides whether local verification runs, and the `verify-before-complete` evidence gate decides the moment |
-| `roadmap.dashboard_regen_cadence` | A | `every_5_steps` | beat of a derived view | derivable — the dashboard is derived: `roadmap:progress` regenerates deterministically from the roadmap files |
+| `roadmap.quality_cadence` | C | `per_phase` | governs when verification runs. Two defaults: the template and the schema ship `per_phase` (since 2026-09-13), while the reader's prose fallback (`roadmap-process-loop` § 4) and the reference page still say `end_of_roadmap` — which is why the 2026-10-09 retirement left it in the queue. **Aligning them would not be enough to retire it** (council 2026-10-09, degraded 1/2): the reader honours `end_of_roadmap`, `per_phase` and `per_step` with distinct behaviour, so retirement also abolishes an explicit three-way control and a consumer who set `per_step` loses validation frequency they chose. Removing configurability is a separate product decision | derivable — `quality.local_auto_run` decides whether local verification runs, and the `verify-before-complete` evidence gate decides the moment |
 | `roadmap.horizon_weeks` | C | `0` | a non-zero value relaxes a lint's plate-token ban | policy |
-| `roadmap.gate_budget.max_cost_per_run_usd` | C | `5` | per-run spend ceiling on class-1 gate execution | consent |
-| `roadmap.gate_budget.max_cost_per_rolling_7d_usd` | C | `25` | rolling spend ceiling on class-1 gate execution | consent |
+| `roadmap.gate_budget.max_cost_per_run_usd` | C | `null` | per-run spend ceiling on class-1 gate execution; `null` = none (ADR-279) | consent |
+| `roadmap.gate_budget.max_cost_per_rolling_7d_usd` | C | `null` | rolling spend ceiling on class-1 gate execution; `null` = none (ADR-279) | consent |
 | `planning.closure_pass` | C | `true` | disables the plan-closure pass | derivable — the gate's own confidence conditions; a confident plan passes straight through |
 | `planning.risk_review` | C | `true` | disables the risk-register validator | derivable — `lint_plan_risk_register`'s own scope predicate (ready, non-draft plans only) |
 | `planning.completion_review` | C | `true` | disables the completion-review validator | derivable — `check_completion_review`'s own scope predicate, bound to the current diff hash |
@@ -561,13 +554,11 @@ Rows follow template order, so a diff against the template reads straight down.
 | `design.approximation.enabled` | C | `false` | lets a value change without a per-value confirmation; enabling it is a consumer-facing default flip | consent |
 | `design.approximation.tolerance.color` | C | `null` | decides which colour deviations may be taken silently | policy |
 | `design.approximation.tolerance.length` | C | `null` | decides which length deviations may be taken silently | policy |
-| `consistency.cross_source` | C | `"on"` | disables the cross-source discrepancy gate | derivable — the rule's own trigger condition; a discrepancy exists only when two present sources contradict |
 | `code_graph.consumer_index_paths` | C | `[]` | names where this project's OTHER tool writes a code-graph index, so it widens what the graph reader will load and trust | un-inferrable — the path belongs to a tool this package does not ship and cannot probe for; the built-in list is deliberately vendor-neutral, so only the operator knows where their index lands |
 | `screenshots.identity_allowlist` | C | `[]` | allowlist of identities that ship unredacted | consent |
 | `screenshots.forbid_terminal_capture` | C | `true` | kill-switch over the highest-leak capture path | consent |
 | `screenshots.data_bearing_gate` | C | `"on"` | the human-confirmation gate over a published egress | consent |
 | `code_style.docblocks` | A | `minimal` | code convention | derivable — the project's own linter/style config and the docblock density of the touched file, which `standards-from-config` reads off the tree |
-| `subagents.downshift` | C | `true` | routes to another model tier, which is spend and quality | derivable — the per-slice tier assignment in `auto-dispatch-classification`, which the orchestrator already computes per dispatch |
 | `subagents.quota_arbitrage` | C | `true` | spends from a separate quota pool | consent |
 | `subagents.model_map.lite` | C | `""` | names an external model endpoint | un-inferrable |
 | `subagents.model_map.medium` | C | `""` | names an external model endpoint | un-inferrable |
@@ -580,41 +571,23 @@ Rows follow template order, so a diff against the template reads straight down.
 | `ai_team.model` | C | `auto` | names an external model | un-inferrable |
 | `ai_team.allow_delegate` | C | `false` | grants an external tool write access to the repository | consent |
 | `ai_team.max_calls_per_day` | C | `50` | quota cap on a shared budget | consent |
-| `ai_team.suppress_setup_hint` | A | `false` | hint cosmetics | derivable — the hint's own precondition; `agent-config doctor --check team` already knows whether team mode is configured |
 | `ai_team.review_gate.managed` | C | `false` | governs an upstream review gate | consent |
 | `ai_team.review_gate.max_consecutive_blocks` | C | `3` | circuit-breaker threshold | derivable — the existing N=3 validation-loop budget in `autonomous-execution`, which already bounds consecutive failed attempts on one target |
 | `emergency.orchestration_halt` | C | `false` | the one audited incident switch over the always-on orchestration stack — see § The one exception above | consent |
 | `emergency.orchestration_halt_justification` | C | `""` | required non-empty before the halt may be lifted; an audit-trail field | consent |
 | `onboarding.onboarded` | C | `false` | flipping it bypasses the onboarding gate | derivable — the wizard's own completion artefacts; the onboarding hook can read whether setup actually ran instead of trusting a self-reported flag |
-| `commands.auto_detect` | C | `enabled` | kill-switch for orchestrator auto-detection | derivable — the orchestrator's own confidence-tiered detection table plus the non-interactive TTY/CI probe |
-| `commands.suggestion.enabled` | A | `true` | a convenience layer; governs no gate and no spend | derivable — the suggester's own match-score threshold and cooldown; a prompt that matches nothing already produces silence |
-| `commands.suggestion.confidence_floor` | A | `0.6` | tuning of that convenience layer | derivable — the suggester's calibrated constant, with the existing per-command frontmatter override where one command needs a different bar |
-| `commands.suggestion.cooldown_seconds` | A | `600` | tuning of that convenience layer | derivable — the per-command cooldown tracker, which already reads session behaviour |
-| `commands.suggestion.max_options` | A | `4` | tuning of that convenience layer | derivable — the number of matches that clear the confidence floor, bounded by the numbered-options shape `user-interaction` fixes |
 | `commands.suggestion.blocklist` | C | `[]` | a deny-list | derivable — the same cooldown tracker that reads whether the user picks a suggestion; repeated non-selection is the signal a hand-maintained deny-list stands in for |
 | `commands.create_pr.preview_description` | C | `false` | removes pre-publish review of an outbound artefact | consent |
 | `commands.create_pr.detail_level` | A | `min` | verbosity of a generated body | derivable — the diff the command already reads (changed-file count and risk surface) |
-| `commands.create_pr.api_examples` | A | `true` | verbosity of a generated body | derivable — the command's own API-surface detection plus its grounded-source requirement |
 | `commands.create_pr.screenshots` | C | `false` | puts captured screenshots into a published PR body | consent |
-| `commands.create_pr.ui_paths` | C | `[]` | glob allowlist | derivable — the frontend-surface heuristic the PR-description flow already applies when the glob list is empty |
-| `commands.create_pr.api_paths` | C | `[]` | glob allowlist | derivable — the API-endpoint heuristic the same flow already applies as its documented empty-list fallback |
 | `continuity.auto_record` | C | `"on"` | arms an automatic producer on the normal session-end path | consent |
 | `continuity.run_checkpoints` | C | `"on"` | disabling it removes a recovery artifact a killed run resumes from | consent |
-| `memory.cadence` | C | `always` | suppressing the visibility line hides what the agent learned from the user | derivable — the hits/asks count the memory-visibility summary already computes; the line only exists when memory was consulted |
-| `memory.review_threshold` | A | `10` | when a review preview surfaces; governs no gate | derivable — the unreviewed-intake count `/memory load` already computes before rendering its preview |
 | `memory.redact_patterns` | C | `[]` | deny-list of secret and PII regexes | policy |
 | `memory.session_index` | A | `"off"` | injects a compact index at session start | derivable — the row cap and index cost the mechanism already computes; the flag only holds an unproven ship-criterion open |
 | `memory.learn_on_session_end` | B | `false` | turns on automatic memory writes at session end | consent |
 | `knowledge.global_sharing.enabled` | C | `true` | kill-switch over cross-project egress | consent |
 | `knowledge.global_sharing.allowed_tiers` | C | `[public]` | allowlist for that egress | consent |
-| `knowledge.global_sharing.redaction.enabled` | C | `true` | disabling it removes the redaction floor | derivable — the redaction scan's own match result; no violation means no-op, so the flag can only remove a floor on an already-authorised path |
-| `knowledge.global_sharing.redaction.halt_on_trigger` | C | `true` | disabling it removes halt-and-prompt | derivable — the violations list the redaction scan already returns; a non-empty list IS the halt condition |
-| `knowledge.global_sharing.auto_promote_threshold` | C | `2` | threshold governing that egress | derivable — the distinct-repo count the promotion candidates already compute; promotion stays suggest-only and human-confirmed |
-| `knowledge.global_sharing.freshness.hypothesis_after_days` | A | `90` | freshness heuristic on a card already shared | derivable — the age computation over the card's own `last_verified` provenance footer |
-| `knowledge.global_sharing.freshness.stale_after_days` | A | `180` | freshness heuristic on a card already shared | derivable — the same age computation; the cut-point is advisory because the card is a cache, never a source of truth |
-| `hooks.concern_budget.max_per_event` | C | `8` | budget cap on hook concerns | derivable — the gate's own constant over `hook_manifest.yaml`, with no consumer-situational input to read |
 | `hooks.concern_budget.tier1_concerns` | C | `[]` | allowlist of concerns permitted to fail closed | policy |
-| `hooks.concern_budget.hard_fail` | C | `false` | weakens the budget gate to warn-only | derivable — the gate's own `--strict` argv, which CI already passes to sibling gates |
 | `hooks.injection_scan.enabled` | C | `false` | the prompt-injection scanner | derivable — the scanner's own signature match on the tool envelope; warn-only and silent on no hit |
 | `hooks.rtk_wrap.enabled` | C | `false` | configures code that runs on every tool call | derivable — the live PATH and identity probe the hook already runs; silent when rtk is absent |
 | `hooks.design_slop.enabled` | C | `false` | configures code that runs on every tool call | derivable — the rule-registry match plus the hook's own per-signature silence cap |
@@ -624,15 +597,12 @@ Rows follow template order, so a diff against the template reads straight down.
 | `hooks.code_graph.enabled` | C | `false` | INERT since 2026-09-07 — the nudge it gated was replaced by `code-graph-context`, which reads no flag. The KEY stays registered because `docs/MIGRATION.md` commits to exactly that ("the surfaces stay registered and disabled"): removing it is a breaking change for any consumer who set it, and the row was briefly marked REMOVED, which left the template's own leaf unclassified. Classified, not deleted. | derivable — the index-detection probe the replacement hook already runs; no index means silence |
 | `hooks.suggestion_capture.enabled` | C | `false` | configures code that runs at every turn end and every prompt | consent |
 | `hooks.verify_before_complete.touched_file_quality` | C | `"off"` | C-test 1 — it decides whether the stop hook SPAWNS the project's own quality commands over the turn's edited files, so the cost it authorises is other people's processes on the operator's machine | consent — running a consumer's toolchain against their working tree is a thing to be permitted, not a fact the tree can derive. The three values are not a severity ladder the agent may climb: `shadow` records, `warn` adds one advisory line, and the flip from one to the other is the owner decision `road-to-touched-files-that-pass-their-own-tools` 2.3 defers |
-| `decision_engine.surface_traces` | C | `false` | the decision engine’s own black box; the agent must not be able to close it | derivable — the engine's own active-gate state; there is nothing to surface when no gate fired |
 | `decision_engine.min_confidence` | C | `"off"` | the confidence gate | derivable — the confidence band the scoring engine already computes at the plan phase |
 | `decision_engine.block_on_risk` | C | `"off"` | the risk-class gate | derivable — the risk class the engine already computes at the implement phase; the Hard Floor covers the irreversible end unconditionally |
 | `decision_engine.require_memory_hits` | C | `false` | a phase gate | derivable — the memory-hit count at the refine phase; its own template comment says the flag delays that soak |
 | `decision_engine.on_block` | C | `stop` | `warn` advances past a gate that fired | derivable — the non-interactive probe decides ask-versus-stop, and the fired gate's own action decides the rest |
 | `decision_engine.ask_timeout_seconds` | C | `30` | how long a fired gate waits before falling back | derivable — the same non-interactive probe: where nobody can answer there is nothing to wait for |
-| `decision_engine.on_block_fallback` | C | `stop` | fail-safe versus fail-open after that timeout | derivable — the same non-interactive detection; a gate that fires with no one to answer resolves fail-safe by construction |
 | `update_check.enabled` | C | `true` | a background safety check; disabling it pins the user to known-vulnerable code | consent |
-| `explain.enable_last` | A | `true` | a read-only diagnostics surface | derivable — the presence of a work-state trace to render; with no trace the command is already a no-op |
 | `legal_review_prep.acknowledged` | C | `false` | the consent gate; the safety floor requires the wizard checkbox | consent |
 | `legal_review_prep.require_council` | C | `true` | a fail-closed defence-in-depth gate | consent |
 

package/docs/guidelines/agent-infra/active-remediation-mechanics.md

@@ -150,6 +150,45 @@ artifact exists because the issue is still owed, and "it failed one of six" is n
 something a later triage can act on. A deferral with no reason is the
 note-and-forget this rule already forbids, wearing an artifact's clothes.
 
+## fix-what-you-see — why a separate rule, and its activation gap
+
+Moved verbatim from [`fix-what-you-see`](../../../src/rules/fix-what-you-see.md)
+on 2026-10-06 to pay for the standing-payload cost of `neighbour-precedence`;
+the rule keeps a pointer here.
+
+### Why separate from `active-remediation`
+
+That rule forbids ignoring a spotted issue and its ladder permits **note + ask**.
+Two properties made it insufficient, both measured 2026-08-20: it is `type: auto`
+on `refactor`/`legacy`/`cleanup` triggers — **none of which a failing CI job
+matches**, so it does not load when the obligation matters most — and its
+note-and-ask tier is what let a session name a red check's cause, name the
+file's author, and hand it back still red.
+
+Mechanics (fix-now size criteria, follow-up shape) stay there; this rule only
+deletes the two escapes.
+
+### Honest activation gap — this rule is `auto`, and it wanted to be `always`
+
+It shipped `auto` for a budget reason, not a design one, and the gap that leaves
+is exactly the one it was written to close: **a red check the agent sees in tool
+output triggers nothing.** Keyword triggers match the PROMPT. So the rule loads
+when a human says "CI is red" or "not my test", and does NOT load when a test
+run comes back red and nobody has said a word.
+
+`check_always_budget` is the reason: the extended always-budget sat at
+60,252 / 60,254 chars — **two characters of headroom** — and the cap is a
+ratchet that may only move down. The other nine always-rules are the kernel,
+which `block_kernel_rule_writes` denies agent writes to, so no room can be made
+from this side. A 2,332-char rule puts the total at 103.9 %.
+
+Closing the gap needs one of: the ext-cap ratchet opened deliberately (a
+maintainer decision, recorded), a kernel rule shortened to make room, or a
+`post_tool_use` carrier that notices a non-zero verification exit — the only
+option that would fire on tool output rather than on wording. Until then, `auto`
+plus this paragraph is the honest state: the obligation is real, its delivery is
+partial, and the partiality is named rather than implied away.
+
 ## See also
 
 - [`active-remediation`](../../../src/rules/active-remediation.md) — the rule this file details (Iron Law + ladder + live-security carve-out).

package/docs/guidelines/agent-infra/context-hygiene-mechanics.md

@@ -69,7 +69,7 @@ If you need an ignored skill: read its SKILL.md directly, apply guidance, then a
 GitHub Copilot has no `PostToolUse` hook surface, so
 `scripts/context_hygiene_hook.ts` cannot run structurally and
 `agents/state/context-hygiene.json` is not maintained automatically
-(tool-call count, loop signal, freshness milestones at 20/40/60).
+(tool-call count, freshness milestones at 20/40/60).
 
 The cooperative path: track turns and tool-loop signals from memory
 during the conversation and apply the suggest-a-new-chat / 3-failure

package/docs/guidelines/agent-infra/cross-source-consistency-mechanics.md

@@ -37,19 +37,17 @@ from a ticket/spec that carries a second source:
 4. **Classify confidence.** High = the sources plainly disagree, or the missing
    behavior is clearly load-bearing. Low = the "conflict" is a plausible
    re-reading, or the missing behavior may be intentionally out of scope.
-5. **Decide per the setting** (below), then **batch** every surviving discrepancy
-   into ONE question folded into this turn's single `ask-when-uncertain` prompt.
+5. **Batch** every surviving discrepancy into ONE question folded into this
+   turn's single `ask-when-uncertain` prompt.
 
-## Confidence-tiered noise control (`consistency.cross_source`)
+## Noise control
 
 The rule fires only under a real trade-off (it must pass the
-`no-cheap-questions` Pre-Send Self-Check). The setting tunes how aggressively:
-
-| Value | High-confidence discrepancy | Low-confidence discrepancy |
-|---|---|---|
-| `on` (default) | Surface + ask before proceeding. | Surface + ask (batched into the same question). |
-| `auto` | Surface + ask. | State as an explicit assumption and proceed (no question). |
-| `off` | No cross-source checking — legacy behavior. | No cross-source checking. |
+`no-cheap-questions` Pre-Send Self-Check). Every real discrepancy, high- or
+low-confidence, is surfaced and asked — batched into the same question. That
+is the fixed behavior since the `consistency.cross_source` key (which offered
+`auto` and `off`) was retired on 2026-10-09 with this, its default, as the only
+mode.
 
 Batching is the anti-noise mechanism: N discrepancies for one artefact become
 one numbered-options block, never N prompts. Plain vagueness (a single unclear

package/docs/guidelines/agent-infra/frontier-reasoning-operating-profile.md

@@ -141,8 +141,9 @@ is therefore **agent self-assessed**, never looked up (roadmap L10/L17):
 **One** constraint-light scaffold ships — no heavy/light content variants, since
 two variants would be a hidden model→band table. A standard host **expands it on
 request**. Two gates, both default-on: automatic (task signal + agent
-self-assessment) + the user `reasoning:` settings toggle (global + per-component
-+ hard off).
+self-assessment) + the user's `reasoning.enabled` hard off. The per-component
+toggles and `reasoning.auto_gate` were retired on 2026-10-09; the automatic gate
+decides per component.
 
 ## Notes template grounding
 

package/docs/guidelines/agent-infra/layered-settings.md

@@ -18,7 +18,7 @@ on user request.
 | File | Git | Scope | Owner | Example values |
 |---|---|---|---|---|
 | `.agent-project-settings.yml` | **committed** | team / repo | lead maintainer | `project.stack`, `quality.php.tools`, `memory.dogfood` |
-| `~/.event4u/agent-config/agent-settings.yml` | **n/a** (outside repo) | individual developer · cross-project | individual | `name`, `ide`, `rule_loading_tier`, `personal.bot_icon`, `personal.autonomy`, `memory.cadence` (legacy `~/.config/agent-config/agent-settings.yml` read as fallback) |
+| `~/.event4u/agent-config/agent-settings.yml` | **n/a** (outside repo) | individual developer · cross-project | individual | `name`, `ide`, `rule_loading_tier`, `personal.autonomy` — the full whitelist is `MERGEABLE_KEYS` in `scripts/_lib/agent_settings.ts` (legacy `~/.config/agent-config/agent-settings.yml` read as fallback) |
 | `agents/settings/.agent-settings.yml` | **gitignored** | individual developer · this project | individual | `personal.ide`, `personal.user_name`, `subagents.max_parallel`, `onboarding.onboarded` | <!-- ref-ignore -->
 
 > **Canonical location (ADR-038):** the developer file lives in the settings
@@ -27,6 +27,12 @@ on user request.
 > `.agent-settings.yml` is read as a **back-compat fallback** and is migrated
 > into the canonical location by `install` on the next run.
 
+The `git.*` keys (`commit_format`, `branch_pattern`, `update_strategy`) have a
+fourth home a team uses instead: `.git-convention.yml` at the repository root,
+committed, read over every file above (ADR-283). `update_strategy` is read from
+it at the commit a pull request is judged against, the other two at `HEAD`.
+The team file carries no `git.*` key.
+
 All three are YAML. Schemas:
 
 - Developer (project-local): [`agent-settings.md`](../../../src/agent-src/templates/agent-settings.md).
@@ -45,6 +51,12 @@ Lowest priority → highest priority:
 4. agents/settings/.agent-settings.yml                (developer file, gitignored; legacy repo-root .agent-settings.yml read as fallback — ADR-038) <!-- ref-ignore -->
 ```
 
+For the `git.*` keys, `.git-convention.yml` sits above all four layers when it
+sets a key, and either value there is a declaration; a key it does not set
+falls through to this order, read at the repository root rather than per
+directory. `agent-config git:convention show` prints the value in force and a
+differing checkout value as a candidate.
+
 Keys from higher layers win unless a lower layer marks them
 `locked` (team file only). The user-global file does **not** support
 `locked` — its purpose is cross-project comfort, never policy.

package/docs/guidelines/agent-infra/roadmap-progress-mechanics.md

@@ -224,7 +224,7 @@ Keep aligned with the dashboard counter in `scripts/update_roadmap_progress.ts`
 
 See [`guarded-baseline`](guarded-baseline.md).
 
-**Dashboard regen cadence — opt-in batching.** The checkbox flip is non-batchable. The **subprocess regen** (`./agent-config roadmap:progress`) is batchable per `roadmap.dashboard_regen_cadence` in `.agent-settings.yml` (`every_5_steps` default · `per_step` · `phase_boundary`). Run end, phase boundary, and any file-shape touch (rename / phase add / archive — Iron Law 1) always force an immediate regen regardless of cadence.
+**Dashboard regen cadence — fixed batching.** The checkbox flip is non-batchable. The **subprocess regen** (`./agent-config roadmap:progress`) batches to every 5th closed step — a fixed cadence since the `roadmap.dashboard_regen_cadence` key was retired on 2026-10-09 with that default as the behavior. Run end, phase boundary, and any file-shape touch (rename / phase add / archive — Iron Law 1) always force an immediate regen.
 
 **Blockers follow the same cadence as checkboxes.** Clearing a `## Blockers` entry (per `templates/roadmaps.md` rule 20) flips its `Status: resolved` and regenerates the dashboard in the same reply — Iron Law 1's "same response" obligation applies to blocker resolution exactly as it applies to a checkbox flip.
 

package/docs/guidelines/agent-infra/self-improvement-pipeline.md

@@ -1,8 +1,11 @@
 # Self-Improvement Pipeline
 
 Five-stage flow that turns real project experience into reviewed
-rule / skill / command / guideline changes. No autonomous self-edits;
-every upstream change ships via a human-reviewed PR.
+rule / skill / command / guideline changes. Self-modification is a goal
+(ADR-281): for a proposal scoped to the package the approval is the AI
+council's ratification record, and the user is its last rung; a change a
+user asked for keeps that user's approval as now. A passing record makes a
+change ready, not landed — every upstream change still ships via a PR.
 
 Referenced by `road-to-curated-self-improvement.md`. Consumed by the live
 artifacts — the `skill-improvement-trigger` rule and the existing skills
@@ -84,7 +87,11 @@ blocks — it does not hand a half-filled doc to the next stage.
 
 ### Stage 5 — Upstream
 
-- **Trigger:** gate passed AND a human approver signed off.
+- **Trigger:** gate passed AND, for a proposal scoped to the package, a
+  council ratification record whose `subject` matches the proposal's change
+  passed it (ADR-281); where the council cannot conclude, the user decides by
+  the route ADR-281 § 5 names. A proposal scoped to a consumer's own project
+  needs that user's approval, as before.
 - **Executor:** `upstream-contribute` skill. Refuses invocation if
   the proposal frontmatter is not `stage: gated`.
 - **Input:** gated proposal doc.

package/docs/guidelines/agent-infra/size-and-scope.md

@@ -221,6 +221,42 @@ Before creating or modifying:
 5. Is this entrypoint → AGENTS.md
 6. Is this behavior hint → copilot-instructions.md
 
+## Rich-class size band — moved from `token-budget-discipline`
+
+Moved verbatim from the rule on 2026-10-06 to pay for the standing-payload cost
+of `neighbour-precedence`; the rule keeps the band and a pointer here.
+
+### Candidate rich skills (justified, not exhaustive)
+
+These skills are approved `rich` by this roadmap's council:
+
+| Skill | Justification summary |
+|---|---|
+| `design-intelligence` | 11 corpus CSVs + 16 design-language prose specs + a 10-category checklist; grounded selection needs the full reference to avoid random corpus subsets |
+| `typography-system` | Modular-scale math + 6 worked example type systems; condensing to "use 1.25 ratio" produces agents that invent arbitrary px values |
+| `accessibility-auditor` | WCAG criteria are non-negotiable detail; every criterion has a testable condition + failure mode; compression loses the test procedures |
+| `design-system-capture` (Phase 6) | Writes + maintains DESIGN.md + PRODUCT.md; needs full templates + worked examples to generate useful artifacts |
+
+### The size band is measured, and only its ceiling is gated
+
+The `rich` band is **2,000–3,500 tokens** (ADR-217, `docs/decisions/ADR-217-rich-class-band-measured-and-enforced.md`).
+It was 2,000–5,000 and enforced by nothing until that record: measured with the
+exact BPE tokenizer, the largest rich artifact in the tree is 3,331 tokens, so
+the old ceiling described no artifact that existed. An unused permission costs
+nothing until someone uses it.
+
+`lint_token_budget_discipline.ts` gates the **ceiling** and publishes every rich
+artifact's size on the green path. It does **not** gate the floor, and that is a
+finding rather than an omission: running the check once surfaced a 1,931-token
+skill legitimately holding the class, because `rich` buys exemption from
+condensation — a claim about what compression would *lose*, not about file size.
+The published study supplies a degradation threshold, which is a ceiling.
+Nothing measures a minimum.
+
+Measurement is exact where `js-tiktoken` resolves and the character proxy where
+it does not; the gate says which, and a proxy reading within its own error
+margin of the ceiling is reported **unresolved** rather than classified.
+
 ---
 
 # Final principle

package/docs/guidelines/design-antipatterns.md

@@ -114,7 +114,7 @@ Within-project invariants + repetition caps. Override = declare the value in
 | V2 | Glassmorphism as decoration (`backdrop-blur` + `bg-white/10`) with no functional depth hierarchy | Model defaults to it for "premium feel"; result looks like 2021 Material You clip-art | Element genuinely sits above a complex, blurred background layer; use sparingly and only for top-level floating surfaces | craft-presumption | delete → reduce | static |
 | V3 | Ghost card: `border: 1px solid` + box-shadow ≥ 16px spread together | The combination creates visual noise — the ghost card signals no confident decision about depth | Choose either border OR shadow to indicate depth; never both on the same surface | invariant | delete → reduce | static |
 | V4 | Over-rounded small cards or badges: `border-radius` > 16px on elements < 200px wide | Excessive rounding on small surfaces looks toy-ish; standard cap is 12–16px | Pill shape (`border-radius: 9999px`) is intentional on single-line tags/chips only | craft-presumption | retune | static |
-| V5 | Hand-drawn or illustrated SVG icons mixed with crisp icon-system icons | Visual register collision; instantly reads as "generated asset" | Intentional illustrative section (hero illustration, empty-state art); isolate from the icon system | invariant | replace | render |
+| V5 | Hand-drawn or illustrated SVG icons mixed with crisp icon-system icons | Visual register collision; instantly reads as "generated asset" | Intentional illustrative section (hero illustration, empty-state art); isolate from the icon system. A genuinely missing glyph is authored under [`svg-authoring`](../../src/skills/svg-authoring/SKILL.md) against the incumbent set's own grid | invariant | replace | render |
 | V6 | Repeating diagonal stripes as a background texture | A cliché background default; reads as generated CSS art | Brand explicitly uses pattern backgrounds (e.g., a textile brand); document the stripe definition | style-preference | delete | static |
 | V7 | Nested cards: a card inside a card inside a card | Depth hierarchy collapses; user cannot parse elevation intent | A truly three-level hierarchy (e.g., project → board → card); ensure each level has distinct visual weight | invariant | delete → reduce | render |
 | V9 | Noise or grain texture laid over a gradient as a "premium" surface default | The visual sibling of V6's diagonal stripes — a generated-CSS-art texture reached for to make a flat gradient look considered, applied because it is available rather than because the surface needed a texture | The texture is part of a documented brand surface treatment (a print-inspired or analog-photographic identity) with the grain opacity defined as a token, not chosen per surface | style-preference | delete | render |

package/docs/guidelines/php/git.md

@@ -34,6 +34,11 @@ hotfix/DEV-999/critical-payment-bug
 - Always include the Jira ticket ID when one exists
 - Use kebab-case for the description part
 - Keep branch names short but descriptive
+- The shape above is this guideline's convention; the agent renders branches from `git.branch_pattern` per [`commit-subject`](../../../src/skills/git-workflow/references/commit-subject.md).
+- A team declares `git.branch_pattern`, `git.commit_format` and
+  `git.update_strategy` in `.git-convention.yml` at the repository root, committed
+  so every checkout, worktree and CI run reads the same value; there either value
+  is a declaration. `agent-config git:convention show` prints what is in force.
 
 ## Commit Messages
 
@@ -68,9 +73,14 @@ that is not better classified as `build`, `ci`, or `docs`.
 
 Use a scope when it adds clarity. Good scopes:
 
-- Jira ticket ID: `DEV-1234`
+- Jira ticket ID: placed per [`commit-subject`](../../../src/skills/git-workflow/references/commit-subject.md) § Placing the ticket
 - Module/area: `api`, `auth`, `skills`, `rules`, `ci`, `frontend`, `linter`
 
+Under `git.commit_format: ticket-conventional` the ticket leads the subject and is
+**never** in the scope (`DEV-1234 feat(exporter-models): …`); tooling that parses
+subjects (commitlint, release automation, changelog generators) must be
+configured for that prefixed form.
+
 Do not add a scope if it adds no value. `fix(core): fix typo` → just `fix: fix typo`.
 
 ### Description rules
@@ -157,7 +167,10 @@ Before writing the commit message:
 
 ## Pull Requests
 
-- PR title follows commit message format: `feat(DEV-1234): short description`
+- PR title per [`commit-subject`](../../../src/skills/git-workflow/references/commit-subject.md) § A title that becomes a commit
+- Bring the branch up to date per `git.update_strategy` — merge the base in
+  (default) or rebase onto `origin/main` and push with `--force-with-lease`;
+  see `git-workflow` › `references/branch-update.md`
 - Fill in the PR template (checklist, description, testing notes)
 - Link the Jira ticket in the PR description
 - Ensure all quality gates pass before requesting review

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@event4u/agent-config",
     "mcpName": "io.github.event4u-app/agent-config",
-    "version": "16.3.0",
+    "version": "16.5.0",
     "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including the counts in these badges.",
     "license": "MIT",
     "private": false,
@@ -80,7 +80,7 @@
     "scripts": {
         "build:cli": "tsc -p tsconfig.json && chmod +x dist/cli/agent-config.js",
         "build:install-bundle": "esbuild src/scripts/install.ts --bundle --platform=node --format=esm --target=node20 --define:__AGENT_CONFIG_BUNDLE__=true --outfile=dist/install/install.mjs --banner:js=\"import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);\"",
-        "build:hooks": "esbuild src/scripts/hooks/dispatch_entry.ts --bundle --platform=node --format=esm --target=node20 --define:__AGENT_CONFIG_BUNDLE__=true --outfile=dist/hooks/dispatch.js --banner:js=\"import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url); const __acPath = require('node:path'); const __acFs = require('node:fs'); const __acUrl = require('node:url'); const __acReal = (p) => { try { return __acFs.realpathSync(p); } catch { return p; } }; const __acSelf = __acReal(__acUrl.fileURLToPath(import.meta.url)); if (process.argv[1] !== undefined && __acReal(__acPath.resolve(process.argv[1])) === __acSelf) { globalThis.__AC_HOOKS_BUNDLE_DIRECT = true; process.argv = [process.argv[0], __acSelf + '.__direct__', ...process.argv.slice(2)]; }\" && node src/scripts/write_bundle_digest.mjs",
+        "build:hooks": "esbuild src/scripts/hooks/dispatch_entry.ts --bundle --platform=node --format=esm --target=node20 --define:__AGENT_CONFIG_BUNDLE__=true --outfile=dist/hooks/dispatch.js --banner:js=\"import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url); const __acPath = require('node:path'); const __acFs = require('node:fs'); const __acUrl = require('node:url'); const __acReal = (p) => { try { return __acFs.realpathSync(p); } catch { return p; } }; const __acSelf = __acReal(__acUrl.fileURLToPath(import.meta.url)); if (process.argv[1] !== undefined && __acReal(__acPath.resolve(process.argv[1])) === __acSelf) { globalThis.__AC_HOOKS_BUNDLE_DIRECT = true; process.argv = [process.argv[0], __acSelf + '.__direct__', ...process.argv.slice(2)]; }\" && node src/scripts/write_bundle_digest.mjs && npm run build:hook-chunks",
         "build:mcp-bundle": "esbuild src/scripts/mcp_server/__main__.ts --bundle --platform=node --format=esm --target=node20 --define:__AGENT_CONFIG_BUNDLE__=true --outfile=dist/mcp/server.mjs --banner:js=\"import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url); const __acPath = require('node:path'); const __acFs = require('node:fs'); const __acUrl = require('node:url'); const __acReal = (p) => { try { return __acFs.realpathSync(p); } catch { return p; } }; const __acSelf = __acReal(__acUrl.fileURLToPath(import.meta.url)); if (process.argv[1] !== undefined && __acReal(__acPath.resolve(process.argv[1])) === __acSelf) { globalThis.__AC_MCP_BUNDLE_DIRECT = true; process.argv = [process.argv[0], __acSelf + '.__direct__', ...process.argv.slice(2)]; }\"",
         "clean:cli-delegate": "rm -rf dist/cli-delegate",
         "build:delegates": "npm run clean:cli-delegate && npm run build:cli-delegate && npm run build:agent-src-delegate && npm run build:delegate-aux",
@@ -100,7 +100,8 @@
         "lint:publint": "publint",
         "prepack": "npm run build && npm run build:discovery && npm run build:mcp-manifest && node src/scripts/prepack-check.mjs",
         "prepublishOnly": "./scripts-run src/scripts/check_release_includes_discovery",
-        "prepare": "[ -d .git ] && bash src/scripts/install-hooks.sh || true"
+        "prepare": "[ -d .git ] && bash src/scripts/install-hooks.sh || true",
+        "build:hook-chunks": "esbuild src/scripts/_lib/svg_rules.ts --bundle --platform=node --format=cjs --target=node20 --outfile=dist/hooks/svg_rules.chunk.cjs && node src/scripts/write_bundle_digest.mjs dist/hooks/svg_rules.chunk.cjs"
     },
     "publishConfig": {
         "access": "public",