@event4u/agent-config 16.3.0 → 16.5.0

package/src/scripts/_lib/svg_urls.ts

@@ -0,0 +1,72 @@
+/**
+ * How a browser reads the URLs and names in an SVG, for the safety rules in
+ * `svg_rules.ts`: references decoded, controls stripped, CSS escapes resolved,
+ * and an element prefix stripped only where it is bound to the SVG namespace.
+ * Its own module so `svg_rules.ts` stays under the source-size ceiling.
+ */
+
+/** Prefixes the document binds to the SVG namespace (`xmlns:svg="…/2000/svg"`). */
+export function svgPrefixes(content: string): Set<string> {
+    const out = new Set<string>();
+    const re = /xmlns:([\w.-]+)\s*=\s*["']http:\/\/www\.w3\.org\/2000\/svg["']/gi;
+    let m: RegExpExecArray | null;
+    while ((m = re.exec(content)) !== null) out.add((m[1] ?? '').toLowerCase());
+    return out;
+}
+
+/** The SVG local name: `svg:script` is a `script` where `svg` is bound to SVG; `foo:script` is not. */
+export function localName(name: string, prefixes: ReadonlySet<string>): string {
+    const colon = name.indexOf(':');
+    return colon !== -1 && prefixes.has(name.slice(0, colon)) ? name.slice(colon + 1) : name;
+}
+
+/** Attributes read from the raw tag, unquoted values included — HTML parses those. */
+export function rawAttrs(raw: string): Record<string, string> {
+    const out: Record<string, string> = {};
+    const re = /([\w:.-]+)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>"'`=]+))/g;
+    let m: RegExpExecArray | null;
+    while ((m = re.exec(raw)) !== null) out[(m[1] ?? '').toLowerCase()] = m[2] ?? m[3] ?? m[4] ?? '';
+    return out;
+}
+
+/** Attributes whose value is followed as a URL. */
+export const URL_ATTRS = new Set(['href', 'xlink:href', 'src']);
+
+
+/** A URL that executes or opens a document when followed. */
+export const isActiveUrl = (raw: string): boolean => /^(javascript:|data:text\/html)/i.test(resolvedUrl(raw));
+
+const NAMED_URL_ENTITIES: Record<string, string> = {
+    colon: ':', sol: '/', tab: '\t', newline: '\n', period: '.', lpar: '(', rpar: ')', amp: '&',
+};
+
+/**
+ * The URL a browser would actually resolve from an attribute value: character
+ * references decoded, leading/trailing C0 controls and spaces stripped, tab and
+ * newline removed anywhere. The trailing `;` of a reference is optional on
+ * purpose: an `.svg` parsed as XML needs it, but the same graphic inlined in an
+ * HTML host is parsed by the HTML tokenizer, which decodes `&#106avascript:`
+ * too — over-reading XML here costs precision, under-reading HTML costs a miss.
+ * The raw value is attacker-chosen, so a scheme test
+ * against it is a test of one spelling — ` https:`, `ht\ttps:`, `&#106;avascript:`
+ * all load, and all passed.
+ */
+export function resolvedUrl(raw: string): string {
+    const decoded = raw.replace(/&(?:#x([0-9a-f]+)|#(\d+)|([a-z]+));?/gi, (m, hex, dec, name) => {
+        const cp = hex ? parseInt(hex, 16) : dec ? parseInt(dec, 10) : NaN;
+        if (!Number.isNaN(cp)) return cp <= 0x10ffff ? String.fromCodePoint(cp) : m;
+        return NAMED_URL_ENTITIES[(name as string).toLowerCase()] ?? m;
+    });
+    return decoded.replace(/^[\u0000- ]+|[\u0000- ]+$/g, '').replace(/[\t\n\r]/g, '');
+}
+
+/** CSS escapes decoded: `\\68 ` and `\\h` both read `h`. */
+export function cssUnescape(raw: string): string {
+    return raw.replace(/\\([0-9a-f]{1,6})\s?|\\(.)/gi, (m, hex, ch) => {
+        if (hex) {
+            const cp = parseInt(hex, 16);
+            return cp <= 0x10ffff ? String.fromCodePoint(cp) : m;
+        }
+        return ch as string;
+    });
+}

package/src/scripts/_lib/test_red_state.ts

@@ -10,6 +10,11 @@
  * This module is that emission, so the registry entry moves in the same change
  * rather than being left describing a gap that closed.
  *
+ * DATED 2026-10-06. The emission exists and is tested, but nothing calls it:
+ * this writer has no production caller, so the registry row was corrected back
+ * to `degraded` the same day. The caller belongs to the stub that owns it —
+ * whoever lands it sets the row back to `available`.
+ *
  * WHAT IT IS NOT. It is not a test runner, and it does not decide whether a
  * failure is a legitimate RED. The failure CLASSES belong to the TDD skill
  * (`src/skills/test-driven-development/SKILL.md`, Test-Red row) and this module

package/src/scripts/_lib/thin_rules.ts

@@ -284,15 +284,95 @@ function _title(s: string): string {
  * Exported so the WRITER and every DETECTOR share one definition. A gate that
  * re-spelled this string would drift from the writer silently, and the failure
  * would be invisible in exactly the direction that matters: a stub the gate
- * fails to recognise reads as a complete rule body.
+ * fails to recognise reads as a complete rule body. Two gates had done exactly
+ * that until step 2.1 of `road-to-a-thinned-layer-measured-in-one-unit`; both
+ * import this now.
+ *
+ * SHORTENED 2026-10-06 from 47 characters to 27 (step 2.2). It is paid once per
+ * stub and there were 89 stubs on the measured layer, so the sentence cost
+ * 4,183 characters of a 97,496-character standing total; at 27 it costs 2,403,
+ * a saving of 1,780 = 20 x 89.
+ *
+ * WHAT THE SHORTENING WAS NOT ALLOWED TO DO: drop the instruction. This is the
+ * only standing text in the whole layer that says what a stub is FOR — "load
+ * the body" occurs in no kernel rule and in neither root instruction file — so
+ * a bare token like `> thin` would have saved more and left nothing that could
+ * be followed. The decision record (D2, K6) rejected that explicitly: nothing
+ * in this repository can check whether an instruction nobody states is still
+ * obeyed.
+ *
+ * WHY IT MUST STAY LONG ENOUGH TO BE UNIQUE: {@link is_thin_entry} is a
+ * substring test over the whole file, so a marker short or generic enough to
+ * occur inside ordinary rule prose would make that rule read as a stub — and
+ * nine rule files carry blockquote lines. `thin_marker_unique_in_corpus.test.ts`
+ * runs the constant against every rule body in `src/rules/` and against every
+ * entry `build_thin` emits, in both directions, which is the check that bounds
+ * any further shortening.
  */
-export const THIN_ENTRY_MARKER = '> Routed rule — load the body on trigger-match.';
+export const THIN_ENTRY_MARKER = '> Load the body on a match.';
 
 /** Is this projected entry a pointer stub rather than a rule body? */
 export function is_thin_entry(text: string): boolean {
     return text.includes(THIN_ENTRY_MARKER);
 }
 
+/**
+ * What introduces a stub's body pointer. One writer, one reader.
+ *
+ * A BARE PATH SINCE 2026-10-06 (step 2.3 of
+ * `road-to-a-thinned-layer-measured-in-one-unit`). The pointer used to be a
+ * markdown link, ``Body: [`<id>`](<prefix><id>.md)``, whose link TEXT repeated
+ * the rule id the target already ends in. That cost `6 + len(id)` per stub over
+ * the bare form — 2,359 characters across the 89 stubs of the measured layer,
+ * 534 of it pure syntax and the rest the id written a second time.
+ *
+ * Nothing followed the link as a link. Under `delivery` the hook loads the body
+ * and never reads the pointer at all; under `thin` an agent reads the path. A
+ * markdown link renders in neither case, so the syntax bought rendering nobody
+ * was doing.
+ */
+export const THIN_BODY_POINTER_PREFIX = 'Body: ';
+
+/**
+ * The pointer, as the WRITER emits it — exported so a detector cannot re-spell
+ * it, which is the same drift {@link THIN_ENTRY_MARKER} documents one screen up
+ * and which two gates had already committed there.
+ *
+ * WHAT IT CAPTURES is the whole tail of the line from `Body: ` to its end, and
+ * that is the intended semantic rather than an accident of greediness: the
+ * writer emits the pointer LAST on its line, so the tail IS the path. A review
+ * round proposed a lazy `(.+?\.md)` to stop at the first `.md`; measured, it
+ * changes nothing, because `\s*$` forces the match to reach end of line either
+ * way and a lazy quantifier simply backtracks forward to the same place. The
+ * greedy form is kept and the property is pinned by a test, so the next reader
+ * meets the measurement instead of repeating the proposal.
+ *
+ * ANCHORED TO END OF LINE, NOT `\S+`. The pointer is the last thing on its
+ * line, and a package root may contain spaces; `\S+` would silently stop at the
+ * first one and report a well-formed pointer as missing.
+ *
+ * COMPOSED FROM {@link THIN_BODY_POINTER_PREFIX} rather than re-spelling it.
+ * The constant exists so a reader cannot hold its own copy, and a pattern six
+ * lines below it holding a literal `Body: ` would have broken that invariant in
+ * the file that states it.
+ */
+export const THIN_BODY_POINTER_RE = (() => {
+    const lit = THIN_BODY_POINTER_PREFIX.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    // THE LAST PREFIX ON THE LINE, NOT THE FIRST. `thin_entry` puts the rule's
+    // own `description` on the SAME line ahead of the pointer, so a description
+    // containing the literal `Body: ` used to start the match inside the
+    // description and capture it as part of the path — `has_body_pointer` stayed
+    // true while the extraction was wrong, which is a wrong assertion rather
+    // than a visible failure. Forbidding a second prefix inside the capture
+    // makes the first viable start the last occurrence, which is the pointer.
+    return new RegExp(`${lit}((?:(?!${lit}).)+\\.md)\\s*$`, 'm');
+})();
+
+/** Does this entry carry a body pointer the writer would recognise? */
+export function has_body_pointer(text: string): boolean {
+    return THIN_BODY_POINTER_RE.test(text);
+}
+
 /**
  * Where a stub tells a reader the body actually is.
  *
@@ -356,7 +436,7 @@ export function thin_entry(
     return (
         `## ${title}\n` +
         `${THIN_ENTRY_MARKER}${fires} ${desc} ` +
-        `Body: [\`${rule_id}\`](${bodyLinkPrefix}${rule_id}.md)\n`
+        `${THIN_BODY_POINTER_PREFIX}${bodyLinkPrefix}${rule_id}.md\n`
     );
 }
 

package/src/scripts/_lib/touched_file_quality.ts

@@ -89,6 +89,22 @@ export interface QualityRun {
     readonly output_head: readonly string[];
     readonly skipped: SkipReason | null;
     readonly files: readonly string[];
+    /**
+     * Matched files the tool reported it declined to look at. A run where EVERY
+     * matched file is listed here and the tool exited 0 is a verdict about
+     * nothing, so `exit_code` is `null` for it — the readings page § 5(a) found
+     * that row recorded `0, skipped: null`, the exact shape of a pass. A field
+     * rather than a fifth `SkipReason` (D2): a partly-ignored run keeps its real
+     * exit code, and a skip reason cannot sit beside a verdict.
+     */
+    readonly ignored_files: readonly string[];
+    /**
+     * Type-check commands the resolver emitted that produced no verdict on this
+     * turn — unscoped, absent or mutating. Identical on every record of the turn,
+     * so ANY single row says that a `0` beside it was a lint verdict and not a
+     * type verdict (§ 5(b): `tsc --noEmit` is unscoped on every stop).
+     */
+    readonly typecheck_not_run: readonly string[];
     readonly at: string;
 }
 
@@ -112,8 +128,21 @@ interface ToolSpec {
      * the resolver's by exactly the flag that makes it read-only.
      */
     readonly check_form: boolean;
+    /**
+     * A line the tool prints, exit 0, for an input its own config ignores. Per
+     * row because the wording is the tool's (D1); a row without one reads no
+     * output as an ignore, which keeps the pre-existing behaviour rather than
+     * guessing at a message the tool might print.
+     */
+    readonly ignored_signal?: RegExp;
 }
 
+/**
+ * ESLint 9's stylish report for an ignored input: the absolute path on its own
+ * line, then this indented warning. Pinned verbatim by the ignored-file fixture.
+ */
+const ESLINT_IGNORED = /^\s+\d+:\d+\s+warning\s+File ignored because of a matching ignore pattern\b/;
+
 const JS_EXTENSIONS = ['.js', '.jsx', '.mjs', '.cjs', '.ts', '.tsx', '.mts', '.cts'] as const;
 
 /**
@@ -124,7 +153,15 @@ const JS_EXTENSIONS = ['.js', '.jsx', '.mjs', '.cjs', '.ts', '.tsx', '.mts', '.c
  * and absence is what produces `skipped: unscoped`.
  */
 const SCOPED_FORMS: ReadonlyMap<string, ToolSpec> = new Map<string, ToolSpec>([
-    ['npx eslint .', { argv: ['npx', 'eslint'], extensions: JS_EXTENSIONS, check_form: false }],
+    [
+        'npx eslint .',
+        {
+            argv: ['npx', 'eslint'],
+            extensions: JS_EXTENSIONS,
+            check_form: false,
+            ignored_signal: ESLINT_IGNORED,
+        },
+    ],
     [
         'vendor/bin/phpstan analyse',
         { argv: ['vendor/bin/phpstan', 'analyse'], extensions: ['.php'], check_form: false },
@@ -153,6 +190,38 @@ const SCOPED_FORMS: ReadonlyMap<string, ToolSpec> = new Map<string, ToolSpec>([
  */
 const MUTATING_WITHOUT_CHECK_FORM: ReadonlySet<string> = new Set<string>([]);
 
+/**
+ * Resolver commands with no file-scoped form, unscoped ON PURPOSE (rule 3).
+ *
+ * Named so the parity test can tell a deliberate absence from `SCOPED_FORMS`
+ * apart from a resolver command nobody classified: every command the resolver
+ * emits is a scoped key, a mutating key, or on this list — or a test is red.
+ */
+export const UNSCOPED_ON_PURPOSE: readonly string[] = [
+    'npx tsc --noEmit',
+    'go vet ./...',
+    'cargo clippy',
+];
+
+/** The keys of `SCOPED_FORMS`, for the parity test. */
+export const SCOPED_FORM_COMMANDS: readonly string[] = [...SCOPED_FORMS.keys()];
+
+/** The keys of `MUTATING_WITHOUT_CHECK_FORM`, for the parity test. */
+export const MUTATING_COMMANDS: readonly string[] = [...MUTATING_WITHOUT_CHECK_FORM];
+
+/**
+ * Resolver commands whose verdict is a type verdict. `go vet` and `cargo clippy`
+ * both compile the package, so a type error stops them; ESLint, ruff and pint do
+ * not type-check, which is the whole of § 5(b).
+ */
+export const TYPE_CHECK_COMMANDS: ReadonlySet<string> = new Set<string>([
+    'npx tsc --noEmit',
+    'vendor/bin/phpstan analyse',
+    'mypy .',
+    'go vet ./...',
+    'cargo clippy',
+]);
+
 function extensionOf(file: string): string {
     const base = path.basename(file);
     const dot = base.lastIndexOf('.');
@@ -253,7 +322,7 @@ function defaultSpawn(
 export function runTouchedFileQuality(opts: RunOptions): QualityRun[] {
     const timeout_ms = opts.timeout_ms ?? DEFAULT_TIMEOUT_MS;
     const spawn = opts.spawn ?? defaultSpawn;
-    const out: QualityRun[] = [];
+    const out: Omit<QualityRun, 'typecheck_not_run'>[] = [];
     for (const plan of planQualityRuns(opts.commands, opts.files)) {
         if (plan.argv === null) {
             out.push({
@@ -263,6 +332,7 @@ export function runTouchedFileQuality(opts: RunOptions): QualityRun[] {
                 output_head: [],
                 skipped: plan.skipped,
                 files: [],
+                ignored_files: [],
                 at: now(),
             });
             continue;
@@ -282,17 +352,69 @@ export function runTouchedFileQuality(opts: RunOptions): QualityRun[] {
         // tool is a wrapper script whose own dependency is missing. Same meaning
         // as ENOENT for this module's purposes, and the same bucket in 2.1.
         const absent = enoent || status === 127;
+        const signal = SCOPED_FORMS.get(plan.source_command)?.ignored_signal;
+        const ignored =
+            absent || signal === undefined ? [] : ignoredFiles(output, signal, plan.files);
+        // Every matched file ignored AND exit 0: the tool looked at nothing, so
+        // there is no verdict to record. A non-zero exit over the same set stays,
+        // because a red the tool raised (a config crash, say) is real.
+        const nothingLooked = ignored.length === plan.files.length && status === 0;
         out.push({
             command: renderCommand(plan.argv),
             source_command: plan.source_command,
-            exit_code: absent ? null : status,
+            exit_code: absent || nothingLooked ? null : status,
             output_head: absent ? [] : headLines(output, OUTPUT_HEAD_LINES),
             skipped: absent ? 'absent' : null,
             files: plan.files,
+            ignored_files: ignored,
             at: now(),
         });
     }
-    return out;
+    // `no_files` is excluded: no file the type checker reads was touched, so
+    // there was nothing on this turn for it to have caught.
+    const typecheck_not_run = out
+        .filter(
+            (r) =>
+                TYPE_CHECK_COMMANDS.has(r.source_command) &&
+                r.exit_code === null &&
+                r.skipped !== 'no_files' &&
+                r.skipped !== null,
+        )
+        .map((r) => r.source_command);
+    return out.map((r) => ({ ...r, typecheck_not_run: [...typecheck_not_run] }));
+}
+
+/**
+ * The matched files the tool's output reports as ignored.
+ *
+ * The stylish report names the file on an unindented line and the warning on
+ * the indented lines under it, so a signal line is attributed to the last path
+ * line above it. A signal that cannot be attributed is attributed to the one
+ * matched file only when there is exactly one; otherwise it is dropped, so an
+ * unreadable report keeps today's behaviour instead of inventing an ignore.
+ */
+export function ignoredFiles(
+    output: string,
+    signal: RegExp,
+    files: readonly string[],
+): string[] {
+    const reported: string[] = [];
+    let unattributed = false;
+    let current: string | null = null;
+    for (const line of output.split(/\r\n|\r|\n/)) {
+        if (signal.test(line)) {
+            if (current === null) unattributed = true;
+            else reported.push(normalizePath(current));
+            continue;
+        }
+        if (line !== '' && !/^\s/.test(line)) current = line.trim();
+    }
+    const hit = files.filter((f) => {
+        const want = normalizePath(f);
+        return reported.some((r) => r === want || r.endsWith(`/${want}`));
+    });
+    if (hit.length === 0 && unattributed && files.length === 1) return [...files];
+    return hit;
 }
 
 /**
@@ -306,11 +428,25 @@ export function runTouchedFileQuality(opts: RunOptions): QualityRun[] {
 export const WARN_LINE_MAX_BYTES = 200;
 
 export function advisoryLine(runs: readonly QualityRun[]): string | null {
+    const ignored = [...new Set(runs.flatMap((r) => r.ignored_files))];
+    const ignoredPart =
+        ignored.length === 0
+            ? ''
+            : `ignored ${ignored[0] ?? ''}${ignored.length > 1 ? ` (+${String(ignored.length - 1)} more)` : ''}`;
     const failed = runs.find((r) => r.skipped === null && r.exit_code !== null && r.exit_code !== 0);
-    if (failed === undefined) return null;
+    if (failed === undefined) {
+        // Nothing failed. Silence is right when every file was looked at; when a
+        // file was ignored, silence would read as clean, so say what was not seen.
+        if (ignored.length === 0) return null;
+        return truncateToBytes(
+            `touched-file quality: no verdict, ${ignoredPart}`,
+            WARN_LINE_MAX_BYTES,
+        );
+    }
     const file = failed.files[0] ?? '(no file)';
     const more = failed.files.length > 1 ? ` (+${String(failed.files.length - 1)} more)` : '';
-    const line = `touched-file quality: ${failed.source_command} exited ${String(failed.exit_code)} on ${file}${more}`;
+    const tail = ignoredPart === '' ? '' : `; ${ignoredPart}`;
+    const line = `touched-file quality: ${failed.source_command} exited ${String(failed.exit_code)} on ${file}${more}${tail}`;
     return truncateToBytes(line, WARN_LINE_MAX_BYTES);
 }
 

package/src/scripts/_lib/verification_command.ts

@@ -271,6 +271,28 @@ function segmentVerifies(rawWords: readonly string[]): boolean {
             // the old token-anywhere regex accepted it by accident and neither
             // explicit list named it, so the union seeding missed it too.
             return rest.some((a) => a === 'test' || a.startsWith('--test'));
+        case 'agent-config':
+            // NEITHER `ui:render` NOR `xmllint` verifies here, and the first
+            // half of that was true, then false, and is true again.
+            //
+            // Step 3.5 of `road-to-svg-with-a-witness` taught this predicate
+            // `ui:render --profile asset`, reasoning that it is the one
+            // subcommand which opens the delivered file in a real engine. Step
+            // 2.1(b) of `road-to-svg-review-followups` removed it again on
+            // review claim C2, which is narrower than the first argument and
+            // refutes it: the turn-end gate's TRANSCRIPT path matches a command
+            // and never sees an exit code, so a call that rendered nothing —
+            // the ordinary case on a machine with no Playwright, where the
+            // command also exited 0 until the same day — discharged the
+            // obligation from its text alone.
+            //
+            // What replaces it reads the RENDER instead of the call:
+            // `hooks/svg_obligation.ts` matches a manifest to the file's own
+            // digest, and accepts a renderer-absent manifest only together with
+            // a clean static witness on those same bytes. `xmllint --noout`
+            // stays out for its original reason (S6): a file can parse and
+            // still be the wrong picture.
+            return false;
         case 'scripts-run': {
             // `./scripts-run src/scripts/lint_x` verifies; `…/rule_activation_census`
             // writes a report and asserts nothing, which is why this keys on the
@@ -322,3 +344,40 @@ const _WIDE_CANDIDATE_RE =
 export function mightBeVerification(command: string): boolean {
     return _WIDE_CANDIDATE_RE.test(command);
 }
+
+/**
+ * `agent-config ui:render … --profile asset`, by shape.
+ *
+ * Moved here from `hooks/svg_obligation.ts` by finding 3 of this change's
+ * SECOND completion review: two detectors need it and one of them is in
+ * `_lib`, so a hook module was the wrong home. Re-exported there, so no
+ * caller moved.
+ */
+export function isAssetRenderCommand(command: string): boolean {
+    return /\bui:render\b/.test(command) && /--profile[= ]\s*asset\b/.test(command);
+}
+
+/**
+ * Did this command ATTEMPT to verify something — as opposed to: did it produce
+ * a verdict this gate may read?
+ *
+ * The distinction is the whole point, and the first review round and the
+ * second each saw one half of it. Round one (claim C2) was right that
+ * `isVerificationCommand` must NOT learn the asset render: the transcript path
+ * never sees an exit code, so the command's TEXT would have discharged the SVG
+ * obligation on a machine where the render produced nothing. Round two
+ * (finding 3) was right that removing it left detector C — "did any
+ * verification command follow the last edit" — unable to see the one command
+ * this package PRESCRIBES for an `.svg`, so the prescribed turn was refused.
+ *
+ * Both hold because they are about different detectors. Detector C asks
+ * whether the author tried; it is satisfied by `eslint` and must be satisfied
+ * by a render too. The SVG obligation asks what the render FOUND, and still
+ * reads the manifest and the file's digest — an attempt that produced nothing
+ * discharges nothing there, with a far better reason than detector C's.
+ *
+ * So: one predicate per question, and `isVerificationCommand` is unchanged.
+ */
+export function isVerificationAttempt(command: string): boolean {
+    return isVerificationCommand(command) || isAssetRenderCommand(command);
+}

package/src/scripts/_lib/verify_clause.ts

@@ -126,25 +126,35 @@ function lastMatch(re: RegExp, text: string): RegExpExecArray | null {
  * carries `(?!`)`: a label followed by a backtick is the delimited form, which
  * branch one already owns.
  *
- * The tail is capped at a single non-space token on purpose. A caller may hand
- * this parser a whole step BLOCK already joined into one line, so "the rest of
- * the line" can mean "the rest of the step" — and a step that continues after
- * its verify clause would then push the expectation away from the end anchor
- * and lose it silently. The cost is that a regex expectation here may not
- * contain a space; `/[1-9]/` and `/unfalsifiable-verify/` are the shapes in
- * use, and a space-bearing expectation loses its arrow loudly (it parses as no
- * expectation) rather than half-matching.
+ * The tail is bounded by the EXPECTATION'S OWN DELIMITERS, not by the end of
+ * the line. A caller may hand this parser a whole step BLOCK already joined
+ * into one line, so "the rest of the line" can mean "the rest of the step": an
+ * end-anchored tail would lose the expectation of any step that carries prose
+ * after its clause. A slash-delimited regex therefore runs to the first
+ * UNESCAPED closing `/` — one not preceded by an odd number of backslashes —
+ * that is followed by whitespace or the end of the text, and an exit code is
+ * one non-space token; both self-terminating, so the step may continue and
+ * `-> /[1-9]/ and then note the result` still yields `[1-9]`.
  *
- * THE CAP IS THIS FORM'S, NOT THE GRAMMAR'S — said plainly because an earlier
- * revision of this comment implied otherwise. The annotation form is
- * `$`-anchored through {@link VERIFY_ARROW_SOURCE} and DOES keep `-> /a b/`;
- * this form does not. The two agree on every space-free expectation, which is
- * every expectation in the tree. Both directions are pinned by test, so closing
- * the gap is a deliberate act against a failing assertion rather than a silent
- * drift — which is the failure the WHY ONE PARSER note above exists to prevent,
- * and it applies to this module's own two readers first.
+ * The word UNESCAPED is load-bearing and was added on 2026-10-11 (step 1.1 of
+ * `road-to-svg-review-followups`, review claim C4). The tail used to be a lazy
+ * `\/.*?\/(?=\s|$)`, which stops at ANY `/` followed by a space — so a clause
+ * ending in ``-> /a\/ b/`` was cut at the escaped slash and parsed to the
+ * regex source `a\`. A pattern that deliberately matches a path separator is
+ * exactly the case that spells it `\/`, and the truncation was silent: a
+ * shorter regex is still a regex, so nothing reported the loss.
+ *
+ * It was capped at a single non-space token until 2026-10-11, which cost this
+ * form every expectation containing a space: `-> /Icon-only button/` parsed as
+ * a clause with NO expectation, and nothing reported the loss — the step simply
+ * read as unfalsifiable. The two forms now agree on every expectation rather
+ * than only the space-free ones; {@link VERIFY_ARROW_SOURCE} stays the single
+ * `$`-anchored decision about what an expectation IS, and this regex decides
+ * only where the tail ENDS. A bare word stays refused by the constant, so
+ * widening the boundary widened no grammar.
  */
-const BACKTICKED_RE = /(?:`verify:`|verify:(?!`))\s*`([^`]+)`[ \t]*((?:->|→)[ \t]*\S+)?/g;
+const BACKTICKED_RE =
+    /(?:`verify:`|verify:(?!`))\s*`([^`]+)`[ \t]*((?:->|→)[ \t]*(?:\/(?:[^\\/]|\\.)*\/(?=\s|$)|\S+))?/g;
 
 /** Prose after the label. The MANUAL form; the body is bounded separately. */
 const PROSE_RE = /(?:`verify:`|verify:(?!`))[ \t]*/g;

package/src/scripts/_lib/worker_budget.ts

@@ -9,7 +9,7 @@
  * error on the wrong rung, not diligence.
  *
  * Composes with — replaces nothing:
- * - the N=3 validation-loop budget (`autonomous-execution`),
+ * - the `execution.fix_loop_max` validation-loop budget (`autonomous-execution`),
  * - the ADR-109 / `subagent-response-contract` body + 4-status envelope
  *   (`subagent-steering`): the partial result rides as the body of a
  *   `BLOCKED` envelope with `budget_hit: true` as the escalation flag.

package/src/scripts/adr/regenerate_index.ts

@@ -187,11 +187,26 @@ export function scan(d: string): [Row[], Row[], string[]] {
  * A scope with no refs renders as `—`: a qualifier on nothing is not a
  * supersession, and printing the prose alone would read as one.
  */
+/**
+ * Escape a `|` for safety inside a Markdown table cell. The free-text scope
+ * fields this feeds (`supersedes_scope` / `superseded_scope`) routinely quote
+ * a table row from the record they describe — and a quoted row has its own
+ * `|` column separators, verbatim, in the frontmatter prose. Unescaped, that
+ * splits the generated row into extra columns rather than rendering the quote
+ * (found live in ADR-230's and ADR-279's own rows, both quoting the same
+ * table cell from ADR-230 § Decision). `refs` itself is never escaped: it is
+ * always an `ADR-NNN` token list this generator produces or validates, never
+ * free text.
+ */
+function escapeCell(text: string): string {
+    return text.replaceAll('|', '\\|');
+}
+
 export function supersessionCell(refs: string | undefined, scope: string | undefined): string {
     const r = (refs ?? '').trim();
     if (r === '' || r === '—') return '—';
     const s = (scope ?? '').trim();
-    return s === '' || s === '—' ? r : `${r} (${s})`;
+    return s === '' || s === '—' ? r : `${r} (${escapeCell(s)})`;
 }
 
 /** Mirror `row(r)`. */

package/src/scripts/ai_council/config.ts

@@ -291,8 +291,8 @@ export interface CostBudgetConfig {
     readonly max_output_tokens: number;
     readonly max_calls: number;
     readonly max_total_usd: number;
-    /** Rolling 24h cap. 0 disables it — and disabling it also disables the spend
-     * ledger, since the orchestrator only appends an entry while a cap is live. */
+    /** Rolling 24h cap. 0 disables it. The spend ledger is written either way
+     * (ADR-279); this value decides only whether the total is compared. */
     readonly daily_limit_usd: number;
 }
 
@@ -1020,7 +1020,7 @@ function _build_debate(d: Dict): DebateConfig {
     if (!_isDict(d)) {
         throw new CouncilConfigError('`debate` must be a mapping.');
     }
-    const cap = _pyFloat(_get(d, 'max_cost_usd', 5.0));
+    const cap = _pyFloat(_get(d, 'max_cost_usd', 0.0)); // 0 = no refusal cap (ADR-279)
     if (cap < 0) {
         throw new CouncilConfigError(
             `debate.max_cost_usd must be >= 0 (got ${_pyRepr(_f(cap))}; ` +
@@ -1671,10 +1671,10 @@ function _build_cost_budget(d: Dict): CostBudgetConfig {
         throw new CouncilConfigError('`cost_budget` must be a mapping.');
     }
     const cb: CostBudgetConfig = {
-        max_input_tokens: _pyInt(_get(d, 'max_input_tokens', 500_000)),
-        max_output_tokens: _pyInt(_get(d, 'max_output_tokens', 200_000)),
-        max_calls: _pyInt(_get(d, 'max_calls', 50)),
-        max_total_usd: _pyFloat(_get(d, 'max_total_usd', 20.0)),
+        max_input_tokens: _pyInt(_get(d, 'max_input_tokens', 0)), // 0 = unbounded (ADR-279)
+        max_output_tokens: _pyInt(_get(d, 'max_output_tokens', 0)), // 0 = unbounded (ADR-279)
+        max_calls: _pyInt(_get(d, 'max_calls', 50)), // fan-out, not money — kept
+        max_total_usd: _pyFloat(_get(d, 'max_total_usd', 0.0)), // 0 = unbounded (ADR-279)
         daily_limit_usd: _pyFloat(_get(d, 'daily_limit_usd', 0.0)),
     };
     const fields: Array<[keyof CostBudgetConfig, boolean]> = [