@event4u/agent-config 16.4.0 → 17.0.0

package/dist/agent-src/contexts/execution/roadmap-process-loop-run.md

@@ -0,0 +1,253 @@
+# Roadmap-Process Loop — Branches (run)
+
+Branch-only body of [`roadmap-process-loop`](roadmap-process-loop.md), moved
+out verbatim so the core stays a single read. Each section below is loaded
+from the pointer line the core carries at the moved section's place, and only
+when a run reaches that branch; the Iron-Law fences stay in the core.
+
+## 5. Step loop
+
+   ```
+   parallel:
+     - view agents/roadmaps/<file>.md     (the step's section)
+     - view <files cited in the step text>
+     - codebase-retrieval (only if the step is vague)
+   ```
+
+   Anti-pattern: `view step` → think → `view file A` → think →
+   `view file B`. That's 3 round-trips for what should be 1.
+
+   Fire/no-fire pair (falsifiable — the discriminator is whether a
+   call's *input* depends on another call's *output*, never the count):
+
+   - **Fires (batch these):** a step says "update the hook, its test,
+     and the manifest entry" → `view src/scripts/hooks/foo_hook.ts` +
+     `view tests/scripts/foo_hook.test.ts` +
+     `view src/scripts/hook_manifest.yaml` are three independent reads
+     whose paths are all known BEFORE the first call — dispatch all
+     three in ONE parallel block. Issuing them serially is the
+     violation: each extra round-trip re-transmits the accumulated
+     context as input for zero new information.
+   - **Does NOT fire (stays serial):** `grep -rn "buildAdvisoryLine"
+     src/` → then `view <the file the grep found>`. The second call's
+     path IS the first call's output — batching would mean guessing the
+     path, and a guessed read is worse than a round-trip. Dependent
+     calls stay serial; only the independent remainder batches.
+
+   - **Council on** (toggled manually, or auto-enabled for the run by
+     an accepted execution contract — § 3) → invoke per
+     [`ai-council`](../../skills/ai-council/SKILL.md), integrate
+     convergence, proceed. Token spend was opted in (the contract
+     summary named the members). `high_impact` / `user_required`
+     classifications still escalate to the user per
+     [`ask-when-uncertain`](../../rules/ask-when-uncertain.md).
+   - **Second-model rung, when the class declares one**
+     (`decision_resolution.classes.<cls>.second_model`, UOTL Phase 4.1)
+     → one local vendor-CLI pass under subscription auth. **The rung is
+     MODEL-CARRIED: the key is declared and schema-validated, and no
+     TypeScript path reads it at runtime** — so "bounded by the
+     `cli_call_budget` counter" is what the rung must respect, never
+     something a booking consumer enforces (`cli_call_budget.ts` declares
+     its consumer set closed at two, and this is not one of them). Stated
+     rather than implied after R2 round 4 finding 4 found the coupling
+     asserted on three surfaces at once. Available
+     to `trivial` / `low_impact` / `medium_impact` only; the config
+     schema REFUSES the key on `high_impact` and `user_required`, so no
+     locked question can reach it.
+
+   - **No self-adversarial fallback.** With neither a council nor a
+     second-model rung available, the ambiguity halt STANDS. The gap is
+     never filled by the agent arguing both sides of the question to
+     itself: a monologue produces a verdict with no independent
+     observer, which is the failure
+     [`evaluator-independence`](../../rules/evaluator-independence.md)
+     exists over, and reads as convergence to whoever finds it later.
+     Halting costs one turn; a manufactured verdict costs the trust in
+     every other verdict the run produced.
+   - **A resolution taken WITHOUT contacting the user is recorded** —
+     `agent-config decision:memo write --run <id> …` (question, chosen
+     option, reasoning, resolver, confidence). The run's PR description
+     links the directory. Not a gate: the memo is what makes an
+     autonomous resolution reviewable after the fact, which is the
+     condition under which it is legitimate at all.
+
+   The failure this catches is quiet: "nothing to do here" reads identically to
+   "already done", and one of those is a closed step while the other is a lost
+   one. A step citing no paths is unaffected — there is nothing to check, and
+   inventing a doubt would fire this on every prose step.
+
+### 5b. Flip-guard — deterministic
+
+   (`git status --porcelain`, not `git diff` — a roadmap file that is
+   still **untracked**, e.g. in a fresh worktree, is invisible to
+   `git diff` and would false-halt; `--porcelain` reports both `M`
+   and `??`.)
+
+   **One deterministic self-fix, contract mode only.** A forgotten flip is the
+   one halt class whose repair is mechanical — the work is on disk, the step is
+   named, and the glyph follows from the outcome. Halting a contract run on it
+   spends a user contact to retype something the run can derive. So inside an
+   accepted contract the run may attempt the flip **once**, and only when all
+   four hold:
+
+   1. **The work is citable.** The step's landed change is identifiable in this
+      iteration's own output — a diff, a file path, a command result. No
+      evidence, no flip: that is a genuine halt, not a forgotten one.
+   2. **The glyph is unambiguous.** `[x]` only for a step whose evidence is
+      present and, where the step carries a `verify:` field, whose fresh green
+      run is in this reply. Anything that would be `[~]` or `[-]` is a
+      *disposition*, never a repair — those halt exactly as before, because a
+      deferral and a cancellation are decisions.
+   3. **Exactly one attempt, per run.** Not per step. A second forgotten flip
+      in the same run halts: one is a slip, two is a broken loop, and the
+      difference is the whole justification for allowing the first.
+   4. **The attempt is verified, then re-guarded.** Re-run the
+      `git status --porcelain` probe above after the flip. Still empty → halt
+      loudly as before. A self-fix that cannot prove itself is
+      indistinguishable from the failure it was repairing.
+
+   The attempt is recorded as a decision memo (§ 4 handling), so an auto-flip is
+   reviewable after the fact rather than invisible. **Kill criterion, from the
+   originating roadmap and repeated here because a flip is a write to the source
+   of truth: one wrong auto-flip removes this allowance** and returns the guard
+   to halt-always. Reversibility is the deletion of this block — the guard
+   underneath it never changed.
+
+   This guard is the deterministic counterpart to the rule's
+   pre-send self-check — it catches a forgotten flip per step, not
+   only at run end. It runs in every scope (`process-step`,
+   `process-phase`, `process-full`); the cost is one `git diff` per
+   step.
+
+   **`verify:` gate (when a step carries one).** If the step declares a
+   named `verify:` command (roadmap step-field convention, see
+   [`templates/roadmaps.md`](../../templates/roadmaps.md)), a `[x]` flip
+   additionally requires a **fresh green run of that exact command this
+   iteration** — its passing output present in this reply or an earlier
+   one this run. Flipping a `verify:`-bearing step to `[x]` without that
+   fresh green run is the same class of violation as a forgotten flip:
+   **halt loudly** ("step \<N\> flipped without its `verify:` run —
+   \`<cmd>\`"), do not auto-fix. This is a check on existing output, not a
+   new loop or a new script — the agent runs the step's own command, the
+   same way `think-before-action`'s `step → verify:` planning already
+   asks. Steps with no `verify:` field are governed by the flip-guard
+   above unchanged (agent-decidable exit/acceptance criteria remain the
+   default; `verify:` is the opt-in machine-checkable tightening).
+
+6. **Dashboard regen — fixed cadence** (§ 4). Run
+   `./agent-config roadmap:progress`:
+   - after the 5th, 10th, … closed step **of this run**, or when the
+     reply ends with closed steps pending regen;
+   - at a phase boundary — the boundary handler in § 5 wrapper / § 6
+     runs it;
+   - on any file-shape touch (rename / phase add / archive — Iron Law 1)
+     → run immediately regardless of cadence.
+
+   Skipped regens accumulate into the next due regen — the markdown
+   file is the source of truth between regens.
+7. Run quality pipeline if cadence is `per_step`.
+
+### 5d. Resuming a run whose previous session died
+
+A session above the recycle threshold and inside a running contract leaves a
+**deterministic checkpoint** at
+`agents/runtime/state/checkpoints/<run>.json` — open / done / parked counts,
+the next open step, and the commit the tree was on. Every field is recomputed
+from the roadmap on disk rather than summarised, which is what makes the next
+line possible.
+
+The first act of a resumed run is `agent-config run:supervise --verify <slug>`:
+it looks the checkpoint up **by roadmap slug**, re-verifies it against the
+current tree and prints the per-field report, naming any newer checkpoint file
+that does not read. Exit 1 means a field moved — a signal, not a halt (below).
+The slug, not the run id: a relaunched session has a NEW
+session id, so the run-id-keyed `readCheckpoint` cannot find the checkpoint the
+DYING session wrote, and this instruction named an unreachable path until the
+R2 review's finding 7. The slug is the one key a resumed run holds by
+definition, because claiming the same roadmap is what makes it a resume.
+
+The per-field report then names WHICH claim went stale, which is what a bare
+"stale/fresh" verdict cannot. **A disagreement is not an error**: work landing
+between the checkpoint and the resume is the normal case (a human committed, a
+sibling worktree moved, the dying session finished a step it never recorded),
+and the `actual` column is what to resume from. Treating progress as corruption
+would refuse every healthy resume.
+
+**The checkpoint carries a repository fingerprint too, not only roadmap counts.**
+`context_fingerprint` is the `roadmap:context --fingerprint` value the dying run
+last held. Every other field on the checkpoint reports **roadmap** drift; none
+reported **repository** drift, so a run resumed after a long gap trusted a context
+reading it never re-took — the exact staleness § 4's refresh exists to end,
+reappearing across the one boundary a mid-run cadence cannot see.
+
+A resumed run therefore re-probes and passes the fresh fingerprint to the
+verification — `run:supervise --verify <slug> --fingerprint <value>`. A disagreement forces a full re-probe and the § 5e reactions
+**before the first step**. A `null` or absent value on either side reads as *not
+known* and never as a disagreement — the same rule `head` already follows, and for
+the same reason: a false alarm on the field whose job is to say whether anything
+moved trains the reader to skip the line.
+
+`agent-config run:supervise --once` reports which runs died with open steps
+left. It never merges, pushes, or closes anything — that boundary is a named
+rejection, not a missing feature.
+
+### 5e. Context refresh — four reactions, enumerated and closed
+
+At each due point (§ 4 — fingerprint differs) re-probe and act. **These four rows
+are the whole set.** Nothing here is a halt: none of them appears on the halt list
+and none of them is a `blocked` outcome.
+
+| # | What the refresh found | Reaction |
+|---|---|---|
+| a | A PR touching my owned paths **merged** since the last refresh | Run `agent-config git:convention sync --base origin/<this branch's PR base>` now — already the documented resolution, only push-bound until this row existed. Re-read the current step's files, continue. |
+| b | An **open** PR touches my owned paths | Continue. Name the collision in the PR description and in the final report. **Never rebase onto a foreign branch.** |
+| c | A peer session shows `PATH OVERLAP` | Take disjoint steps first if ordering allows; otherwise name it and continue. The register is advisory, never a lock. |
+| d | The roadmap itself was **archived on `origin/main`** | Stop. The same **selection error** as § 1, detected late — not a halt, and no checkbox is flipped to reach it. |
+
+Deliberately NOT a drift-level taxonomy. A severity ladder over these four would
+invite a fifth row for every new shape of surprise, and the value here is that the
+set is closed: an agent that meets something outside it has met an ordinary step,
+not a new reaction.
+
+Row (a) is the one that changes behaviour mid-run rather than only reporting. Rows
+(b) and (c) exist to make the collision **visible in the artefact** — a run that
+silently produces a conflicting PR has spent the reviewer's time, not its own.
+
+### Forbidden non-halt reasons — agent-invented cautions
+
+The halt list above is **exhaustive**. An agent running `process-full` (or any
+wrapper) must **never** stop the run for a reason it invented that is not on
+that list. In particular these are NOT halt conditions and stopping for them is
+a violation of the command and the user's will:
+
+- "running low on context / token budget" — keep landing complete steps until
+  context actually runs out; never announce a boundary-stop by choice.
+- "quality would degrade / this deserves a fresh focused run later"
+- "avoid a PR pile-up" / "let the open PRs merge first"
+- "this phase is large / touches a deep subsystem"
+- "phase-checkpoints mode, so I'll checkpoint and wait" — under `process-full`
+  a phase boundary emits a non-blocking status line and the run **continues**;
+  the stop-and-wait reading of `phase-checkpoints` applies only to
+  `process-phase`.
+- **"this step looks human-gated"** — the `blocked` outcome above is reached by
+  the § 3c test, never by a judgement about how a step feels. A step with no
+  qualifying blocker citation is runnable, and writing the citation yourself does
+  not make it one. This entry exists because the terminal outcome is the single
+  most abusable thing on this page.
+- **"the branch is not protected" / "a branch must be created" / "a PR must be
+  opened" / "a GitHub setting must change" / "CI must be re-run" / "the merge
+  base needs updating" / "there are conflicts" / "tests fail"** — every one is
+  remediation work the invocation authorised (ADR-237 § 1). Do it.
+- **"a paid service is needed"** — authorised inside the configured
+  `cost.budgets` windows, and with none configured there is no ceiling to be
+  outside of (§ Spend in the wrapper). A crossing of a configured window pauses
+  and reports; it does not ask. Uncertainty about the exact cost is explicitly
+  NOT a reason to ask.
+- **"a maintainer should do this"** when the agent can perform the same action
+  through git, `gh`, an API or a CLI. **Capability before role**: the role of the
+  person who conventionally does a thing is not a property of the thing.
+
+If the work genuinely cannot continue, it will be because one of the five real
+halt conditions fired, or because every remaining step is externally impossible
+by the § 3c test — surface THAT, with the specific impossibility named, not a
+manufactured caution and not a convention mistaken for a constraint.

package/dist/agent-src/contexts/execution/roadmap-process-loop-set.md

@@ -0,0 +1,212 @@
+# Roadmap-Process Loop — Branches (set)
+
+Branch-only body of [`roadmap-process-loop`](roadmap-process-loop.md), moved
+out verbatim so the core stays a single read. Each section below is loaded
+from the pointer line the core carries at the moved section's place, and only
+when a run reaches that branch; the Iron-Law fences stay in the core.
+
+### Ask before park — a user decision is put to the user, then parked
+
+`terminal-states.md` defines `blocked` to include "a decision only the user can
+make", and the marker below used to be written with no ask in between — so the
+decision ended up filed, correctly labelled, in a file nobody is watching. The
+ordering is the fix, not the label.
+
+- **Interactive host** — put the question, one at a time, per
+  [`ask-when-uncertain`](../../rules/ask-when-uncertain.md). An answer ends the
+  block and nothing is parked.
+- **The user declines to decide** — park with `| asked: yes`. The question WAS
+  put; the decline is why the step stays blocked.
+- **The ask times out** — the run ends `approval-required` (a state
+  `terminal-states.md` already defines), carrying the unanswered question
+  verbatim and its conservative option named as **not adopted**. Asked-and-
+  unanswered is not could-not-ask, so the marker still records `asked: yes`.
+- **Non-interactive context** (CI, a pipe, a hook, a headless run) — park with
+  `| asked: no — <reason>`. The reason is required: without it a later reader
+  cannot tell a declined decision from one that was never offered.
+
+The decision itself is `src/scripts/_lib/blocked_by_marker.ts` (`decideAsk`),
+so the ordering is testable rather than only described; `lint_roadmap_blockers`
+fails a user-decision annotation carrying no `asked:` field, and one saying
+`asked: no` with no reason.
+
+**A step this screen judges externally impossible carries a `blocked-by:` marker
+on its own line.** The obligation is unchanged; its reason has CHANGED, and the
+change is recorded rather than smoothed over. It used to be a runtime one:
+`run-continuation`, the stop-slot concern that re-engaged an autonomous run,
+decided open-vs-blocked from the inline
+`<!-- blocked-by: <id> [| asked: yes|no — <reason>] -->` marker and never parsed
+`## Blockers`, so a missing marker made an impossible step read as open work and
+re-engaged the agent into it every stop fire until the stall rung fired. That
+concern was withdrawn on its own pre-registered kill date
+(`road-to-what-was-built-and-never-ran` Phase 4), so **no mechanism now changes
+its behavior on this marker.** What survives is `lint_roadmap_blockers`, which
+validates every marker — its id must resolve to a declared blocker, and an
+`asked: no` must carry a reason — and the reader of the roadmap, for whom an
+impossible step that looks open is the same lie it always was. The paragraph
+below describes what the withdrawn mechanism did, kept because a successor would
+inherit the same problem:
+a stall manufacturing one. **The residual is real and is not papered over:**
+nothing enforces the pairing, so a `## Blockers` entry authored without its
+marker is caught by review or not at all.
+
+**The gaming vector inverted, and both directions are now named.** Under ADR-235
+the vector was an agent writing itself a Class-3 blocker to stop early; the
+defence was that a qualifying blocker must **pre-date the run**, checkable from
+git. That defence is kept for the narrow blocker set that remains. ADR-237 adds
+the opposite vector — an agent that keeps going past a spend ceiling or into an
+EXCLUDED action under cover of "the roadmap needed it" — and its defences are
+step 3 above being an enumerated list rather than a characterisation, and the
+ceiling being cumulative per run rather than per action.
+
+**One imprecision, inherited and now given a test.** The class taxonomy has no
+row for *"waiting on time"* or *"waiting on another roadmap"*; both are authored
+as `3` today because an absent `Class:` already means `3`. Under step 4 a wait is
+a blocker only when it is factually mandatory and unverifiable — a soak window a
+run can simply outlast, or a cross-roadmap dependency the run can satisfy itself,
+is work. The taxonomy still lacks the row; the mislabel now has a stated test
+instead of a default.
+
+### 3d. Set contract — one contract over an enumerated set
+
+A **set contract** is the ordinary contract screen rendered over a closed,
+ordered list of roadmaps instead of one. It grants
+[`autonomy-mechanics § Task-scope`](autonomy-mechanics.md)'s **set-scoped**
+shape, whose four conditions (enumerated before Accept · closed · ordered with
+independence declared · one Accept) are the authorization contract — this
+section is only the loop's side of it.
+
+**What the screen must print, per member.** Roadmap path, derived branch name,
+open-step count, artifact count from the pre-scan, and its dependency edges.
+One decision sheet spans the whole set: a question that applies to several
+members appears once, and its answer applies to all of them.
+
+**Dependency edges come from two sources, unioned.**
+
+| Source | Shape | Trust |
+|---|---|---|
+| Declared | `depends:` in the dependent roadmap's frontmatter — a list of roadmap slugs | authoritative; a declared edge is never overridden by the heuristic |
+| Inferred | **file overlap**: the intersection of the owned-path sets the two pre-scans derived | advisory; an inferred edge orders the members and marks them non-parallelizable, and is printed as inferred so the user can see why |
+
+The union feeds exactly two decisions and nothing else: **ordering** (a
+dependent member runs after its parent) and **parallelizability** (only members
+with no edge between them and disjoint owned paths are lane candidates). An
+inferred edge is deliberately allowed to be wrong in the conservative
+direction — a false edge costs serial execution, a missed edge costs a
+collision, so overlap resolves toward *serial*.
+
+#### Auto-continuity — the next member needs no new contact
+
+Under an accepted set contract, when a member closes **green** the loop pulls
+the next member whose dependencies are all satisfied and starts it without a
+new contact. Green means: its own final report ran, its quality cadence passed,
+and no halt class fired. Anything else is not green and does not continue —
+see failure isolation below.
+
+The default stays **this one only**: auto-continuity applies to
+`/roadmap:next` and to any wrapper reaching this section **only when the set
+option was chosen on the sheet**. A single-roadmap invocation is never widened
+into a set because more roadmaps happened to be open, which is condition 4 of
+the set-scoped shape read from the loop's side.
+
+#### Failure isolation — a regression halts its own member, not the set
+
+A quality regression, a failed verify probe, or a halt class firing inside one
+member terminates **that member** and leaves the rest of the set running:
+
+1. Record the member's outcome as halted, with the halt class and the evidence.
+2. Skip every member that declares a dependency on it — transitively. A
+   dependent member of a halted parent is *blocked*, not failed, and is
+   reported as such.
+3. Continue with the next independent member.
+4. Report every member's outcome in one final report at the end of the set.
+
+Two carve-outs, and they are the reason this is isolation rather than
+tolerance. A **Hard-Floor** stop and a **locked decision class** stop the whole
+set, not one member: both are about the user's authority rather than about the
+member's code, and continuing past them under a set contract would be exactly
+the "several authorizations from one Accept" failure the enumeration guards
+against. Likewise the **N=3 validation budget** is per validation target and is
+not reset by moving to the next member.
+
+#### Parallel lanes — shipped under the canonical brief
+
+Lanes are **shipped**, on the owner's decision of 2026-10-19. They were staged
+behind ten clean serial set runs; that gate was overtaken in practice — 285 lane
+runs happened outside it between 2026-10-01 and 10-19, under briefs each
+orchestrator improvised, and 17 of 207 drain lanes reached `count_open == 0`
+(`agents/evidence/analysis/drain-lanes-leave-roadmaps-partial-2026-10-19.md`).
+What ships is not those runs but the contract that replaces them: the canonical
+brief in `/roadmap:process-full` § Lanes, the finish-first order of
+`roadmap_drain_queue`, and the cap below. (The AI council was asked; only one
+seat could answer, it favoured keeping lanes staged, and without convergence the
+decision went to the owner.)
+
+**Provisional, and re-decided on a measurement, not a date.** A later two-seat round read the
+change as inside `road-to-agent-throughput-recovery` AC-3, which held lane
+changes until that roadmap's Phase 2 verdict. The owner's decision stands as a
+recorded exception to that hold (D10 there), not a lifting of it: step 2.3 of
+that roadmap compares two-lane against one-lane drains on cost, rate-limit
+pauses, conflicts, follow-up fixes and roadmaps archived, and a negative or
+split result goes back to the council. Until then the cap stays at two and is
+never raised. The shape:
+
+- **Cap: two lanes** in the first iteration — a recorded decision
+  (`decision 2026-08-20`, AI council 2/2 on the `autonomy-defaults-sheet`
+  fork), chosen over the configured `subagents.max_parallel` because a
+  collision at two lanes is diagnosable and one at N is not. Reversible: the
+  cap is one number in the set contract, and raising it after the first ten
+  clean parallel runs is strictly cheaper than recovering from a lost branch.
+- **Candidate test:** no dependency edge in either direction, and disjoint
+  owned paths.
+- **Isolation:** the existing worktree scope lock
+  ([`worktree-lifecycle`](../../skills/worktree-lifecycle/SKILL.md)).
+- **Coordination:** session-register roadmap claims (`sessions:claim`), read by
+  `roadmap_drain_queue`, so two sessions never take the same roadmap.
+- **Delivery:** one branch and one PR per lane, opened only when its roadmap's
+  last step is done.
+- **Immediate removal:** a single scope-lock collision with data loss.
+- **Refusal report:** every lane report carries the fixed field
+  `classifier_refusals` (an empty list when none) — a report without it is
+  malformed, never "clean". At drain end the orchestrator batches every lane's
+  field into ONE envelope (§ Host-classifier refusals).
+
+## 4. Resolve cadences — read once, cache for the run
+
+**Dashboard regen cadence** — fixed, not a setting (the
+`roadmap.dashboard_regen_cadence` key was retired on 2026-10-09 with its
+default as the behavior): `./agent-config roadmap:progress` runs every
+5th closed step, at every phase boundary and at reply end.
+
+`process-step` always regens at step end. Any file-shape touch (rename / phase add / archive — Iron Law 1
+of [`roadmap-progress-sync`](../../rules/roadmap-progress-sync.md))
+forces an immediate regen regardless of cadence. The checkbox flip
+itself is **never** batchable — only the subprocess.
+
+### Context refresh — a comparison, not a third cadence key
+
+There is **no `roadmap.context_refresh_cadence` setting**, deliberately. The
+refresh trigger is derived:
+
+```bash
+agent-config roadmap:context --fingerprint   # cheap: one rev-parse + one gh call
+```
+
+At every phase boundary (and at run end), take the fingerprint and compare it
+with the one § 1's probe returned. **Differs → re-probe in full** and apply the
+reaction table in § 5e. **Same → nothing moved; continue without paying for a
+probe.** Cache the new value as the run's baseline either way.
+
+The fingerprint covers `origin/main` **and the head SHA of every open PR**. The
+second half is the case a `main`-only trigger misses: a peer pushing to their own
+PR branch mid-run can add a file that now overlaps this run's owned paths while
+`origin/main` has not moved at all.
+
+Why a comparison and not a knob: `docs/contracts/settings-classes.md` classifies
+a fixed-beat flag as `derivable` — "the mechanism itself can decide, from the
+situation, better than a flag can" — behind a ratchet whose count may only fall.
+A cadence enum was implemented, refused by `lint_settings_classes`, and replaced
+by this; the full reasoning, the options rejected, and what the substitution costs
+are in `agents/evidence/analysis/situational-awareness-cadence-key-decision.md`.
+Turning the refresh off is a one-line revert of this subsection, which is the same
+reversibility a `cadence: off` value would have bought.