@event4u/agent-config 16.3.0 → 16.5.0

package/src/scripts/check_branch_freshness.ts

@@ -46,7 +46,9 @@
  * branch AS THE SERVER REPORTS IT (`ls-remote --symref`), then the local
  * `origin/HEAD`, then `main`. Every message names the base AND where it came
  * from, because "I checked main because that is the PR's base" and "I checked
- * main because I could not ask" must never print the same.
+ * main because I could not ask" must never print the same. An explicit
+ * `--base` given a blank value exits 2: an unset variable is not a request for
+ * the PR's base.
  *
  * The server symref matters for the same reason `remoteHead` exists: the local
  * `refs/remotes/origin/HEAD` is written at clone time and never refreshed, so
@@ -67,6 +69,9 @@ import { fileURLToPath } from "node:url";
 
 import { runGateCli, runSelfTest, type SelfTestCase } from "./_lib/gate_self_test.js";
 import { workspaceIdentity } from "./_lib/git_common_dir.js";
+import { describeRefusal, isRefusal, type GitConventionReading } from "./_lib/git_convention.js";
+import { baseValueError, parseBaseRef } from "./_lib/git_base_ref.js";
+import { makeTargetDeps, parseExactHeadSha, readCommittedConvention } from "./_lib/git_convention_carrier.js";
 import { reportScanned } from "./_lib/scan_scope.js";
 
 // ledger-exempt: single remote-ref probe — the entire scope is ONE ls-remote answer (0 or 1 refs) resolved to one aggregate ancestor verdict, and every empty path already publishes its reason via reportScanned allowEmpty; there is no per-target collection to account.
@@ -125,6 +130,8 @@ export type BaseSource =
 export interface BaseResolution {
   readonly base: string;
   readonly source: BaseSource;
+  /** The remote `base` is a branch on; absent means origin. */
+  readonly remote?: string;
   readonly pr?: number;
   /** Present iff an open PR against a different base could not be ruled out. */
   readonly unverified?: string;
@@ -270,6 +277,19 @@ export function explicitBase(argv: readonly string[]): string | null {
   return explicit;
 }
 
+/**
+ * The usage error for a `--base` given a blank value, in either spelling, or
+ * null. A missing value or one that is another flag stays `explicitBase`'s
+ * typo case.
+ */
+export function blankExplicitBase(argv: readonly string[]): string | null {
+  const joined = argv.find((a) => a.startsWith("--base="));
+  if (joined !== undefined) return baseValueError(joined.slice("--base=".length));
+  const flag = argv.indexOf("--base");
+  const value = flag < 0 ? undefined : argv[flag + 1];
+  return value === undefined || value.startsWith("--") ? null : baseValueError(value);
+}
+
 /** `--base` wins, then the open PR's base, then the repo default. */
 export function resolveBase(
   argv: readonly string[],
@@ -277,8 +297,11 @@ export function resolveBase(
   forge: (b: string) => ForgeAnswer = (b) => askForgeForBase(b),
 ): BaseResolution {
   const explicit = explicitBase(argv);
-  if (explicit !== null) {
-    return { base: explicit, source: "flag" };
+  const given = explicit === null ? null : parseBaseRef(explicit, configuredRemotes());
+  if (given !== null) {
+    return given.remote === "origin"
+      ? { base: given.branch, source: "flag" }
+      : { base: given.branch, source: "flag", remote: given.remote };
   }
   // There is deliberately no cheap short-circuit for "the branch looks like the
   // default". It was tried and reverted: it decided a VERDICT from
@@ -321,12 +344,25 @@ export function describeBase(r: BaseResolution): string {
 
 /** The SHA the server reports for `<base>` right now — never a tracking ref. */
 export function remoteHead(base: string, remote = "origin"): string | null {
-  const out = git(["ls-remote", "--heads", remote, base]);
-  if (out === null || out === "") {
-    return null;
-  }
-  const sha = out.split(/\s+/)[0];
-  return sha !== undefined && /^[0-9a-f]{40}$/.test(sha) ? sha : null;
+  const state = remoteHeadState(base, remote);
+  return state.kind === "sha" ? state.sha : null;
+}
+
+/**
+ * `absent` is a remote that answered without the branch, which is a misspelled
+ * or deleted base; only a remote that did not answer is `unreachable`.
+ */
+export type RemoteHeadState = { kind: "sha"; sha: string } | { kind: "absent" } | { kind: "unreachable" };
+
+export function remoteHeadState(base: string, remote = "origin"): RemoteHeadState {
+  const out = git(["ls-remote", remote, `refs/heads/${base}`]);
+  if (out === null) return { kind: "unreachable" };
+  const sha = parseExactHeadSha(out, base);
+  return sha === null ? { kind: "absent" } : { kind: "sha", sha };
+}
+
+function configuredRemotes(): string[] {
+  return (git(["remote"]) ?? "").split("\n").map((r) => r.trim()).filter((r) => r !== "");
 }
 
 /**
@@ -525,6 +561,52 @@ function scanReport(scanned: number, allowEmpty?: string): void {
   });
 }
 
+/** Whether this checkout's task runner defines `push-ready`, the remedy only this package ships. */
+function definesPushReady(): boolean {
+  const root = git(["rev-parse", "--show-toplevel"]);
+  if (root === null || root === "") return false;
+  try {
+    return /^ {2}push-ready:/m.test(fs.readFileSync(path.join(root, "taskfiles", "dev.yml"), "utf8"));
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * What to do about a behind branch. A merge command is printed only under
+ * `merge`: under any other strategy, or one that cannot be read, a merge of the
+ * base is the commit the declaration excludes.
+ */
+export function behindRemedy(base: string, strategy: GitConventionReading | null, remote = "origin"): string[] {
+  if (strategy === null) {
+    return [
+      "    git.update_strategy was not read — the base's commit is not in this checkout, and",
+      "    this gate does not fetch to choose advice. Update the branch per the git-workflow",
+      "    skill's references/branch-update.md, then regenerate (./agent-config roadmap:progress)",
+      "    and re-run the gates before pushing.",
+    ];
+  }
+  if (!isRefusal(strategy.state) && strategy.value === "merge") {
+    return [
+      `    git fetch ${remote} && git merge ${remote}/${base}`,
+      "    ./agent-config roadmap:progress   # regenerate AFTER every merge, not only on conflict",
+      "    then re-run the gates before pushing.",
+      "",
+      "    The dashboard line is not optional housekeeping: the roadmap dashboard is a",
+      "    GENERATED file, so a merge that lands cleanly still leaves it describing",
+      "    neither side's roadmap set. A clean auto-merge of a generated file is still wrong.",
+    ];
+  }
+  const why = isRefusal(strategy.state)
+    ? `    git.update_strategy cannot be read — ${describeRefusal(strategy)}`
+    : `    git.update_strategy is \`${strategy.value ?? "?"}\` — the base is not merged in.`;
+  return [
+    why,
+    "    Update the branch per the git-workflow skill's references/branch-update.md,",
+    "    then regenerate (./agent-config roadmap:progress) and re-run the gates before pushing.",
+  ];
+}
+
 /**
  * @param forge Seam for the forge lookup. Production passes nothing and gets the
  * real `gh`. Tests MUST pass a stub: without this parameter the only way to
@@ -542,6 +624,12 @@ export function main(
     return selfTest(path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", ".."));
   }
   const quiet = argv.includes("--quiet");
+  const blank = blankExplicitBase(argv);
+  if (blank !== null) {
+    scanReport(0, "argument error");
+    console.error(`❌  check_branch_freshness: ${blank}`);
+    return 2;
+  }
 
   // CI merges or refuses on the server; a second opinion here would be noise.
   if (process.env["CI"] === "true" || process.env["GITHUB_ACTIONS"] === "true") {
@@ -565,8 +653,11 @@ export function main(
   // positionally already selects the real `gh` — no branch needed here.
   const resolved = resolveBase(argv, branch, forge);
   const base = resolved.base;
+  const remote = resolved.remote ?? "origin";
+  const shown = `${remote}/${base}`;
 
-  if (branch === base) {
+  // Remote and branch together: local `main` is not `upstream/main`, which can be ahead of it.
+  if (branch === base && remote === "origin") {
     scanReport(0, `standing on ${base} itself — a branch cannot be behind itself`);
     return 0;
   }
@@ -577,49 +668,81 @@ export function main(
   if (resolved.unverified !== undefined) {
     process.stdout.write(
       `⚠️  check_branch_freshness: could not ask the forge for this branch's PR base ` +
-        `(${resolved.unverified}) — checking origin/${base}, the ${describeBase(resolved)}. ` +
+        `(${resolved.unverified}) — checking ${shown}, the ${describeBase(resolved)}. ` +
         "If an open PR targets a different base, THAT base is NOT verified here.\n",
     );
   }
 
-  const sha = remoteHead(base);
-  if (sha === null) {
+  const head = remoteHeadState(base, remote);
+  if (head.kind === "absent") {
+    // The remote answered, so this is not the offline case: passing it as NOT
+    // VERIFIED let a misspelled base (`origin/origin/main`) skip the check.
+    scanReport(1);
+    console.error(
+      `❌  check_branch_freshness: base \`${base}\` does not exist on ${remote} — ${describeBase(resolved)}. ` +
+        "Name a branch on the remote: `--base main` and `--base origin/main` are the same branch.",
+    );
+    return 1;
+  }
+  if (head.kind === "unreachable") {
     // Loud, not silent. An offline run has not verified the invariant, and a
     // gate that passes on an invariant it never evaluated is the false green
     // this repo keeps finding.
-    scanReport(0, `origin/${base} unreachable — reported NOT VERIFIED rather than green`);
+    scanReport(0, `${shown} unreachable — reported NOT VERIFIED rather than green`);
     process.stdout.write(
-      `check_branch_freshness: could not reach origin/${base} — NOT VERIFIED (offline?). ` +
+      `check_branch_freshness: could not reach ${shown} — NOT VERIFIED (offline?). ` +
         "Re-run before pushing.\n",
     );
     return 0;
   }
 
+  const sha = head.sha;
   scanReport(1);
   if (containsCommit(sha) === true) {
     if (!quiet) {
       process.stdout.write(
-        `✅  branch is current with origin/${base} (${sha.slice(0, 9)}) — ${describeBase(resolved)}\n`,
+        `✅  branch is current with ${shown} (${sha.slice(0, 9)}) — ${describeBase(resolved)}\n`,
       );
     }
     return 0;
   }
 
   console.error(
-    `❌  branch is BEHIND origin/${base} — the remote is at ${sha.slice(0, 9)}. ` +
+    `❌  branch is BEHIND ${shown} — the remote is at ${sha.slice(0, 9)}. ` +
       `(${describeBase(resolved)})`,
   );
   console.error("");
   console.error("    Pushing now opens a PR that may conflict, and worse: another branch");
   console.error("    may already have shipped what this one is implementing.");
   console.error("");
-  console.error(`    git fetch origin && git merge origin/${base}`);
-  console.error("    ./agent-config roadmap:progress   # regenerate AFTER every merge, not only on conflict");
-  console.error("    then re-run the gates before pushing.");
-  console.error("");
-  console.error("    The dashboard line is not optional housekeeping: the roadmap dashboard is a");
-  console.error("    GENERATED file, so a merge that lands cleanly still leaves it describing");
-  console.error("    neither side's roadmap set. A clean auto-merge of a generated file is still wrong.");
+  // Advice text never pays for a fetch: the measured commit is new on a behind
+  // branch, so reading the strategy there would fetch inside the push budget.
+  // Read it at that commit only if it is already local, else at the cached
+  // remote-tracking commit; with neither, the remedy is the generic pointer.
+  const localAt = [sha, `refs/remotes/${remote}/${base}`]
+    .map((ref) => git(["rev-parse", "--verify", "-q", `${ref}^{commit}`]))
+    .find((found): found is string => found !== null && found !== "");
+  const strategy = localAt === undefined
+    ? null
+    : (readCommittedConvention(process.cwd(), {
+        override: shown,
+        keys: ["update_strategy"],
+        fetch: false,
+        deps: { ...makeTargetDeps(process.cwd()), remoteSha: () => localAt },
+      }).readings.update_strategy as GitConventionReading);
+  // Read by the pre-push hook to print the exact BASE it refused for. Only a
+  // checkout that defines the task gets it: a consumer runs this script from
+  // node_modules, where the task does not exist and the line would not run.
+  // A strategy read as something other than merge would make the task refuse, so it
+  // is not offered then. An unread strategy keeps it: the task reads the strategy itself.
+  const mergeAllowed = strategy === null || (!isRefusal(strategy.state) && strategy.value === "merge");
+  if (definesPushReady() && mergeAllowed) {
+    console.error(`    task push-ready BASE=${remote === "origin" ? base : shown}   # integrate the base set, regenerate, verify, re-check`);
+    console.error("");
+  }
+  for (const line of behindRemedy(base, strategy, remote)) {
+    console.error(line);
+  }
   console.error("");
   console.error(
     "    This gate asks the REMOTE, not your tracking ref — a fetch from earlier in",

package/src/scripts/check_enforcement_coverage.ts

@@ -40,6 +40,11 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
 import { count as count_artefacts } from './update_counts.js';
 import { KERNEL_RULE_ID_SET } from './_lib/kernel_rules.js';
+import {
+    loadRuleObligations,
+    RULE_OBLIGATIONS_PATH,
+    type RuleObligationEntry,
+} from './_lib/rule_obligations.js';
 import {
     carrier_frequency_by_platform,
     covers,
@@ -128,6 +133,68 @@ export interface RuleCoverage {
     frequency_verdict: FrequencyVerdict;
     /** Hook-capable platforms where no declared carrier covers the obligation. */
     gap_platforms: string[];
+    /**
+     * Obligation-level credit, beside the rule-level `effective`.
+     *
+     * A rule-level `effective` credits every obligation of the rule for what one
+     * entry refuses. This credits only the ids an entry is bound to in
+     * `src/config/rule-obligations.json`. Nothing here changes `effective` or
+     * any summary field that existed before it.
+     */
+    obligation: ObligationCredit;
+}
+
+export interface ObligationCredit {
+    /** Ids the rule declares; empty for the kernel and for a rule with no entry. */
+    ids: string[];
+    /** Ids bound to at least one entry that resolves to something that can fail a build. */
+    blocking: string[];
+    /** Ids bound only to entries that fire and never refuse. */
+    observer: string[];
+    /**
+     * Entries that resolve to blocking or observer and carry NO binding. They
+     * keep the rule-level credit they always had and are reported here so the
+     * credit is visibly unscoped. Never counted as obligation-level coverage.
+     */
+    unbound_entries: string[];
+}
+
+/**
+ * Which of a rule's obligations its `enforced_by` entries actually carry.
+ *
+ * An entry absent from `bindings` is unbound. An entry bound to `[]` is a
+ * recorded finding that it refuses none of this rule's obligations; it is not
+ * unbound and credits nothing.
+ */
+export function obligation_credit(
+    declared: readonly string[],
+    resolutions: readonly Resolution[],
+    entry: RuleObligationEntry | undefined,
+): ObligationCredit {
+    const ids = entry?.obligations ?? [];
+    const bindings = entry?.bindings ?? {};
+    const blocking = new Set<string>();
+    const observer = new Set<string>();
+    const unbound: string[] = [];
+    declared.forEach((d, i) => {
+        const res = resolutions[i];
+        if (res === undefined) return;
+        const carries = BLOCKING.has(res) || res === 'observer';
+        if (!carries) return;
+        const bound = bindings[d];
+        if (bound === undefined) {
+            unbound.push(d);
+            return;
+        }
+        for (const id of bound) {
+            if (!ids.includes(id)) continue;
+            if (BLOCKING.has(res)) blocking.add(id);
+            else observer.add(id);
+        }
+    });
+    for (const id of blocking) observer.delete(id);
+    const order = (xs: Set<string>): string[] => ids.filter((id) => xs.has(id));
+    return { ids: [...ids], blocking: order(blocking), observer: order(observer), unbound_entries: unbound };
 }
 
 /** Strength order — a rule is credited with its strongest resolving backstop. */
@@ -586,6 +653,10 @@ export function collect(): RuleCoverage[] {
     const reachable_ci = reachable_scripts(ci_corpus);
     const reachable_local = reachable_scripts(`${ci_corpus}\n${local_corpus}`);
 
+    const inventory = fs.existsSync(path.join(REPO_ROOT, RULE_OBLIGATIONS_PATH))
+        ? loadRuleObligations(REPO_ROOT).rules
+        : {};
+
     const out: RuleCoverage[] = [];
     for (const name of fs.readdirSync(RULES_DIR).sort()) {
         if (!name.endsWith('.md')) continue;
@@ -630,6 +701,7 @@ export function collect(): RuleCoverage[] {
             carrier_frequency,
             frequency_verdict: verdict,
             gap_platforms,
+            obligation: obligation_credit(declared, resolutions, inventory[id]),
         });
     }
     return out;
@@ -683,6 +755,53 @@ export interface Summary {
      * populations agree.
      */
     frames: DenominatorFrames;
+    /**
+     * The same coverage counted per obligation rather than per rule. Printed
+     * beside the rule counts, never instead of them, and no `--check` ratchet
+     * reads it: the roadmap that added it adds no failing condition.
+     */
+    obligations: ObligationSummary;
+}
+
+export interface ObligationSummary {
+    /** Ids declared across all rules. */
+    total: number;
+    /** Ids bound to an entry that can fail a build. */
+    blocking: number;
+    /** Ids bound only to an entry that fires and never refuses. */
+    observer: number;
+    /** Ids no entry is bound to: model-carried, or carried only by an unbound entry. */
+    not_bound: number;
+    /** Rules whose rule-level credit comes from at least one unbound entry. */
+    rules_with_unbound_entries: number;
+    /** Kernel rules: no ids by construction, counted at rule granularity. */
+    kernel_rules: number;
+    /** Non-kernel rules with no ids declared. */
+    rules_without_ids: number;
+}
+
+export function summarise_obligations(rows: readonly RuleCoverage[]): ObligationSummary {
+    // Rows built before the field existed (test fixtures, older JSON) count as carrying no ids.
+    const none: ObligationCredit = { ids: [], blocking: [], observer: [], unbound_entries: [] };
+    const of = (r: RuleCoverage): ObligationCredit => r.obligation ?? none;
+    let total = 0;
+    let blocking = 0;
+    let observer = 0;
+    for (const r of rows) {
+        total += of(r).ids.length;
+        blocking += of(r).blocking.length;
+        observer += of(r).observer.length;
+    }
+    return {
+        total,
+        blocking,
+        observer,
+        not_bound: total - blocking - observer,
+        rules_with_unbound_entries: rows.filter((r) => of(r).unbound_entries.length > 0).length,
+        kernel_rules: rows.filter((r) => KERNEL_RULE_ID_SET.has(r.id)).length,
+        rules_without_ids: rows.filter((r) => !KERNEL_RULE_ID_SET.has(r.id) && of(r).ids.length === 0)
+            .length,
+    };
 }
 
 export function summarise(rows: RuleCoverage[]): Summary {
@@ -710,6 +829,7 @@ export function summarise(rows: RuleCoverage[]): Summary {
                 r.declared.every((d) => d.startsWith('observer:maintainer-review')),
         ),
         frames: denominator_frames(rows.length),
+        obligations: summarise_obligations(rows),
     };
 }
 
@@ -883,6 +1003,16 @@ function main(argv: string[]): number {
     // source for that number: `check_enforcement_denominator` reds when a
     // tracked doc carries an enforcement count this resolver did not produce.
     lines.push(`  ${denominator_line(summary.frames)}`);
+    const ob = summary.obligations;
+    lines.push(
+        `  obligations: ${ob.blocking}/${ob.total} bound to a backstop that fails a CI build · ` +
+            `${ob.observer} observer · ${ob.not_bound} not bound — beside the rule counts, not instead of them`,
+    );
+    lines.push(
+        `  obligation frame: ${ob.rules_with_unbound_entries} rule(s) still credited by an unbound entry · ` +
+            `${ob.kernel_rules} kernel rule(s) at rule granularity · ${ob.rules_without_ids} rule(s) without ids ` +
+            `(${RULE_OBLIGATIONS_PATH})`,
+    );
 
     const gaps = rows.filter((r) => r.frequency_verdict === 'gap');
     if (gaps.length > 0) {

package/src/scripts/check_evaluator_budgets.ts

@@ -59,6 +59,10 @@ interface BudgetEntry {
     /** `false` for wall-clock metrics: they cannot be compared run-to-run,
      * so they are excluded from the drift check. Missing = deterministic. */
     deterministic?: boolean;
+    /** Repository paths (globs as the workflow `paths` filter writes them) the
+     * metric is measured from. Every one must trigger the umbrella, so the PR
+     * that moves the input is the PR that sees the budget. */
+    inputs?: string[];
 }
 interface BudgetsDoc {
     regression_pct: number;

package/src/scripts/check_finding_dispositions.ts

@@ -8,8 +8,8 @@
  *
  * The record is a COMMITTED ledger — `agents/evidence/release-findings/
  * <version>.json` — never the PR comment (council 2026-08-03: a comment is
- * mutable and unaudited; it is transport, not a record). Every blocking/high
- * finding in the ledger must carry a complete disposition
+ * mutable and unaudited; it is transport, not a record). Every blocking
+ * finding in the ledger (see `isBlocking`) must carry a complete disposition
  * `{status: fixed|false_positive|accepted_risk, commit (when fixed),
  * rationale, verified_by}`; the release workflow is red while one does not.
  *
@@ -95,10 +95,9 @@ export type DispositionStatus = (typeof DISPOSITION_STATUSES)[number];
  * to satisfy the requirement and the one that destroys it.
  *
  * It is deliberately NOT in {@link DISPOSITION_STATUSES}: a BLOCKING row may
- * never pass on it. `missing_dispositions` reads only the three, so a blocking
- * finding marked `still_open` reports as an unknown status and the gate stays
- * red — which is the behaviour a blocking finding that is still open should
- * have.
+ * never pass on it. `missing_dispositions` reports a blocking finding marked
+ * `still_open` with its own message and the gate stays red — which is the
+ * behaviour a blocking finding that is still open should have.
  *
  * `open` from the schema is absent on purpose. The schema documents it as the
  * INITIAL state, so counting it would make the tally reachable without anyone
@@ -272,21 +271,74 @@ function _clean_review_reason(artifact: Record<string, unknown>): string {
     );
 }
 
+export const MEDIUM_SECURITY_BLOCKS_AFTER = '16.3.0';
+
+function semverParts(v: string): [number, number, number] | null {
+    const m = /^v?(\d+)\.(\d+)\.(\d+)/.exec(v.trim());
+    return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
+}
+
+/** True unless `release` parses and is at or before the cutoff. */
+export function mediumSecurityBinds(release: string | null): boolean {
+    if (release === null) return true;
+    const r = semverParts(release);
+    const cut = semverParts(MEDIUM_SECURITY_BLOCKS_AFTER) as [number, number, number];
+    if (r === null) return true;
+    for (let i = 0; i < 3; i++) {
+        const a = r[i] as number;
+        const b = cut[i] as number;
+        if (a !== b) return a > b;
+    }
+    return false;
+}
+
 /**
- * Mirrors self_review_gate.classifyBlocking — security/claim × critical/high,
- * MINUS anything the tree disproved.
- *
- * The `contradicted` clause is not a second policy; it is the same one, and
- * the mirror has to carry it or the two gates disagree: the review would stop
- * counting a disproved deletion claim as blocking while the release kept
- * demanding a disposition for it. A `contradicted` value is written only by
- * `annotateContradicted`, which checks the claim against
- * `git diff --name-status base...HEAD` AND the working tree.
+ * self_review_gate.classifyBlocking (security/claim × critical/high) PLUS
+ * security × medium, MINUS anything the tree disproved.
+ *
+ * Deliberately STRICTER than the merge gate, and the asymmetry is load-bearing
+ * rather than drift — do not re-mirror it. The merge gate asks whether a change
+ * may enter trunk while work is still integrating; this gate asks whether a
+ * known risk may ship to users without an accountable decision. 16.3.0 shipped
+ * a medium security finding that had already been open in 16.2.0 with nobody
+ * required to decide it, so a medium security finding needs a disposition here
+ * while it stays advisory at merge. `accepted_risk` with a rationale satisfies
+ * it; `still_open` does not. `claim × medium` stays advisory in both.
+ * Council 2026-10-07 (claude-sonnet-4-5 + codex, 2/2 concluded, option a,
+ * release gate only). Revisit if medium security findings routinely receive
+ * formulaic `accepted_risk` over three consecutive releases, or exceed about
+ * ten per release.
+ *
+ * The widening is prospective: it binds releases after
+ * {@link MEDIUM_SECURITY_BLOCKS_AFTER}, the last one published before the
+ * decision. A release already shipped cannot be made to wait, and re-gating it
+ * would leave exactly two outcomes for a medium security row that is genuinely
+ * still open — a red trunk, or an `accepted_risk` written only to turn it
+ * green, which is the relabelling this gate exists to refuse. Without a release
+ * (a reported finding, a test) the wider rule applies.
+ *
+ * The cutoff orders by version, not by publication date: a maintenance release
+ * on an older line (a 16.2.x cut after the decision) sits at or before the
+ * cutoff and is exempt. The council ratified the prospective cutoff and this
+ * documented exemption on 2026-10-07 (2/2); cutting a maintenance line is the
+ * condition that reopens it.
+ *
+ * The `contradicted` clause is shared with the merge gate, and has to be or the
+ * two disagree: the review would stop counting a disproved deletion claim as
+ * blocking while the release kept demanding a disposition for it. A
+ * `contradicted` value is written only by `annotateContradicted`, which checks
+ * the claim against `git diff --name-status base...HEAD` AND the working tree.
  */
-export function isBlocking(f: Pick<LedgerFinding, 'kind' | 'severity' | 'contradicted'>): boolean {
+export function isBlocking(
+    f: Pick<LedgerFinding, 'kind' | 'severity' | 'contradicted'>,
+    release: string | null = null,
+): boolean {
     if ((f.contradicted ?? '').trim() !== '') {
         return false;
     }
+    if (f.kind === 'security' && f.severity === 'medium' && mediumSecurityBinds(release)) {
+        return true;
+    }
     return (
         (f.kind === 'security' || f.kind === 'claim') &&
         (f.severity === 'critical' || f.severity === 'high')
@@ -299,10 +351,13 @@ export function isBlocking(f: Pick<LedgerFinding, 'kind' | 'severity' | 'contrad
  * Empty rationale / verified_by is a hygiene violation (waiver precedent:
  * "empty string = hygiene violation"); status `fixed` requires a commit.
  */
-export function missing_dispositions(findings: readonly LedgerFinding[]): string[] {
+export function missing_dispositions(
+    findings: readonly LedgerFinding[],
+    release: string | null = null,
+): string[] {
     const problems: string[] = [];
     for (const f of findings) {
-        if (!isBlocking(f)) {
+        if (!isBlocking(f, release)) {
             continue;
         }
         const label = `${f.finding_id} (${f.severity} ${f.kind}: ${f.title})`;
@@ -311,6 +366,10 @@ export function missing_dispositions(findings: readonly LedgerFinding[]): string
             problems.push(`${label}: no disposition status`);
             continue;
         }
+        if (status === 'still_open') {
+            problems.push(`${label}: still_open does not satisfy a blocking finding — fix it, disprove it, or accept the risk with a reason`);
+            continue;
+        }
         if (!(DISPOSITION_STATUSES as readonly string[]).includes(status)) {
             problems.push(`${label}: unknown status ${JSON.stringify(status)}`);
             continue;
@@ -359,15 +418,18 @@ export interface DispositionTally {
  * direction: a typo surfaces as a row the line says is unadjudicated, rather
  * than disappearing into a count that reads as finished.
  */
-export function disposition_tally(findings: readonly LedgerFinding[]): DispositionTally {
+export function disposition_tally(
+    findings: readonly LedgerFinding[],
+    release: string | null = null,
+): DispositionTally {
     let blockingTotal = 0;
     let blockingDispositioned = 0;
     let nonBlockingTotal = 0;
     let nonBlockingTerminal = 0;
     for (const f of findings) {
-        if (isBlocking(f)) {
+        if (isBlocking(f, release)) {
             blockingTotal++;
-            if (missing_dispositions([f]).length === 0) {
+            if (missing_dispositions([f], release).length === 0) {
                 blockingDispositioned++;
             }
             continue;
@@ -540,10 +602,11 @@ export function resolve_release_status(release: string): ReleaseStatus {
 export function unrecorded_findings(
     reported: ReadonlyArray<Pick<LedgerFinding, 'finding_id' | 'severity' | 'kind' | 'title' | 'contradicted'>>,
     ledger: readonly LedgerFinding[],
+    release: string | null = null,
 ): string[] {
     const known = new Set(ledger.map((f) => f.finding_id));
     return reported
-        .filter((f) => isBlocking(f) && !known.has(f.finding_id))
+        .filter((f) => isBlocking(f, release) && !known.has(f.finding_id))
         .map((f) => `${f.finding_id} (${f.severity} ${f.kind}: ${f.title}) reported by the self-review but not in the ledger`);
 }
 
@@ -773,10 +836,10 @@ function main(argv: readonly string[]): number {
         throw exc;
     }
 
-    const problems = missing_dispositions(ledger.findings);
+    const problems = missing_dispositions(ledger.findings, release);
     if (pr) {
         const reported = parse_comment_findings(_gh_comment_bodies(pr));
-        problems.push(...unrecorded_findings(reported, ledger.findings));
+        problems.push(...unrecorded_findings(reported, ledger.findings, release));
     }
 
     if (problems.length === 0) {
@@ -790,7 +853,7 @@ function main(argv: readonly string[]): number {
             n === 0
                 ? `✅  no recorded findings for ${release} (ledger ${fs.existsSync(ledgerPath) ? 'empty' : 'absent'})${suffix}\n`
                 : `✅  ${String(n)} recorded finding(s) for ${release} — ` +
-                      `${disposition_summary(disposition_tally(ledger.findings))}${suffix}\n`,
+                      `${disposition_summary(disposition_tally(ledger.findings, release))}${suffix}\n`,
         );
         return 0;
     }