@event4u/agent-config 16.5.0 → 17.0.0

package/src/scripts/hooks/concern_failure_policy.ts

@@ -95,12 +95,12 @@ export function _is_blocking(concern: JsonObject): boolean {
  * it is honoured, however slow it was.
  *
  * THE ONE-RETRY ESCAPE, AND WHY THE STOP SLOT NEEDS IT.
- * `turn-end-gate` and `run-continuation` are `severity: blocking` on `stop`,
- * and `tests/hooks/concern_severity.test.ts` records the hazard in as many
- * words: a turn-end gate that fails closed "does not degrade, it wedges the
- * session". Neither carries `skip_on_refusal_retry`, so without this clause a
- * DETERMINISTIC crash in either would refuse every Stop, indefinitely, with no
- * escape the user can reach.
+ * `turn-end-gate` is `severity: blocking` on `stop` (`run-continuation` was too,
+ * until it was withdrawn), and `tests/hooks/concern_severity.test.ts` records
+ * the hazard in as many words: a turn-end gate that fails closed "does not
+ * degrade, it wedges the session". It carries no `skip_on_refusal_retry`, so
+ * without this clause a DETERMINISTIC crash in it would refuse every Stop,
+ * indefinitely, with no escape the user can reach.
  *
  * So the promotion is spent ONCE. On the retry the host itself marks
  * (`stop_hook_active`, read by `_is_refusal_retry`) a crash falls back to

package/src/scripts/hooks/concern_registry.ts

@@ -24,7 +24,6 @@
  *              fail-closed reduction unchanged)
  */
 
-import { main as chatHistoryMain } from '../chat_history.js';
 import { main as hotContextMain } from '../hot_context_hook.js';
 import { main as handoffContextMain } from '../handoff_context_hook.js';
 import { main as roadmapProgressMain } from '../roadmap_progress_hook.js';
@@ -55,6 +54,7 @@ import { main as blockKernelRuleWritesMain } from './block_kernel_rule_writes.js
 import { main as blockPlumbingWritesMain } from './block_plumbing_writes.js';
 import { main as blockConfigWeakeningMain } from './block_config_weakening.js';
 import { main as blockSpeakingInboxDirMain } from './block_speaking_inbox_dir.js';
+import { main as blockCredentialReadsMain } from './block_credential_reads.js';
 import { main as oneQuestionPerAskMain } from './one_question_per_ask_hook.js';
 import { main as rtkWrapMain } from './rtk_wrap_hook.js';
 import { _main as designPassMain } from './design_pass_hook.js';
@@ -81,18 +81,19 @@ import { main as sessionEolMain } from './session_eol_hook.js';
 import { main as subagentLedgerMain } from './subagent_ledger_hook.js';
 import { main as toolResultBytesMain } from './tool_result_bytes_hook.js';
 import { main as spawnGuardShadowMain } from './spawn_guard_shadow_hook.js';
+import { main as hostRateMarkerMain } from './host_rate_marker_hook.js';
 import { main as sourceFirstGateMain } from './source_first_gate_hook.js';
 import { main as interruptionLedgerMain } from './interruption_ledger_hook.js';
-import { main as runContinuationMain } from './run_continuation_hook.js';
 import { main as journalRecordMain } from './journal_record_hook.js';
 import { main as obligationSettleMain } from './obligation_settle_hook.js';
 
-/** A concern `main` — argv-taking or not; both shapes exist. */
-export type ConcernMain = (argv?: string[]) => number | undefined | void;
+import { LAZY_CONCERNS, loadLazyConcern } from './lazy_concern.js';
+import type { ConcernMain } from './concern_registry_types.js';
+
+export type { ConcernMain };
 
 /** Keyed by the manifest's `script:` value (repo-relative path). */
 export const CONCERN_REGISTRY: Readonly<Record<string, ConcernMain>> = {
-    'src/scripts/chat_history.ts': chatHistoryMain as ConcernMain,
     'src/scripts/hot_context_hook.ts': hotContextMain as ConcernMain,
     'src/scripts/handoff_context_hook.ts': handoffContextMain as ConcernMain,
     'src/scripts/roadmap_progress_hook.ts': roadmapProgressMain as ConcernMain,
@@ -123,6 +124,7 @@ export const CONCERN_REGISTRY: Readonly<Record<string, ConcernMain>> = {
     'src/scripts/hooks/block_plumbing_writes.ts': blockPlumbingWritesMain as ConcernMain,
     'src/scripts/hooks/block_config_weakening.ts': blockConfigWeakeningMain as ConcernMain,
     'src/scripts/hooks/block_speaking_inbox_dir.ts': blockSpeakingInboxDirMain as ConcernMain,
+    'src/scripts/hooks/block_credential_reads.ts': blockCredentialReadsMain as ConcernMain,
     'src/scripts/hooks/one_question_per_ask_hook.ts': oneQuestionPerAskMain as ConcernMain,
     'src/scripts/hooks/rtk_wrap_hook.ts': rtkWrapMain as ConcernMain,
     'src/scripts/hooks/design_pass_hook.ts': designPassMain as ConcernMain,
@@ -150,8 +152,31 @@ export const CONCERN_REGISTRY: Readonly<Record<string, ConcernMain>> = {
     'src/scripts/hooks/subagent_ledger_hook.ts': subagentLedgerMain as ConcernMain,
     'src/scripts/hooks/tool_result_bytes_hook.ts': toolResultBytesMain as ConcernMain,
     'src/scripts/hooks/spawn_guard_shadow_hook.ts': spawnGuardShadowMain as ConcernMain,
+    'src/scripts/hooks/host_rate_marker_hook.ts': hostRateMarkerMain as ConcernMain,
     'src/scripts/hooks/source_first_gate_hook.ts': sourceFirstGateMain as ConcernMain,
     'src/scripts/hooks/interruption_ledger_hook.ts': interruptionLedgerMain as ConcernMain,
-    'src/scripts/hooks/run_continuation_hook.ts': runContinuationMain as ConcernMain,
     'src/scripts/hooks/journal_record_hook.ts': journalRecordMain as ConcernMain,
 };
+
+/**
+ * Every concern the dispatcher can run in-process: inlined in the table above,
+ * or loadable from a conditional chunk. The parity test asserts against THIS,
+ * not against `CONCERN_REGISTRY` alone — a lazy concern is still in-process on
+ * the fast path, and a parity check that could not see one would push the next
+ * extraction back into the bundle.
+ */
+export function isInProcessConcern(script: string): boolean {
+    return CONCERN_REGISTRY[script] !== undefined || LAZY_CONCERNS[script] !== undefined;
+}
+
+/**
+ * The concern's `main`, inlined or loaded from its chunk, or `null` when the
+ * dispatcher must fall back to the spawn path.
+ *
+ * The one resolver. The dispatcher and every test that drives a concern
+ * in-process go through it, so a concern moved into a chunk does not have to be
+ * found again at each call site.
+ */
+export function resolveConcernMain(script: string): ConcernMain | null {
+    return CONCERN_REGISTRY[script] ?? loadLazyConcern(script);
+}

package/src/scripts/hooks/concern_registry_types.ts

@@ -0,0 +1,11 @@
+/**
+ * The concern-invocation type, in a module that imports nothing.
+ *
+ * `hooks/lazy_concern.ts` needs the type and `concern_registry.ts` needs the
+ * loader, so the type cannot live in either without a cycle. It is five lines,
+ * so it gets its own file rather than a `import type` indirection nobody can
+ * follow.
+ */
+
+/** A concern `main` — argv-taking or not; both shapes exist. */
+export type ConcernMain = (argv?: string[]) => number | undefined | void;

package/src/scripts/hooks/delegation_nudge_hook.ts

@@ -97,12 +97,15 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { readHookStdin } from "./hook_stdin.js";
 import { load_agent_settings } from "../_lib/agent_settings.js";
 import { probeHostCapabilities } from "../_lib/host_capability.js";
-import type { ActivationInputs, Classification, TaskSignals } from "../_lib/auto_dispatch.js";
+import { inferSliceTier, type ActivationInputs, type Classification, type SliceType, type TaskSignals } from "../_lib/auto_dispatch.js";
+import { TIER_TO_CLAUDE_MODEL } from "../_lib/model_tier.js";
 import { classifyLadder, type LadderRung } from "../_lib/judgment_ladder.js";
 import { resolveSessionRole } from "../_lib/session_role.js";
 import { resolveSubagentRouting, type Tier } from "../_lib/subagent_routing.js";
 import { isSyntheticPrompt } from "../_lib/prompt_shape.js";
+import { handKindFromPrompt, type HandKind } from "../_lib/hand_kinds.js";
 import { EXIT_ALLOW, EXIT_WARN } from './exit_codes.js';
+import { councilConfigPath, freeRungFor } from "../ai_council/free_rung.js";
 
 // Severity is taken from the EXIT CODE, not from the `decision` field in the
 // stdout payload — mirrors `language_mirror_hook.ts`'s own note (found the
@@ -330,16 +333,18 @@ export function resolveActivation(
 }
 
 /**
- * Tier recommendation for the (not-yet-inspected) slices: `resolveSubagentRouting`'s
- * first production caller. Conservative "lite, downshifted" default — the
- * concern has no per-slice type classification available at prompt-submit
- * time, so it recommends the cheapest starting point and lets the downshift
- * setting (shipped default: on) decide whether that survives.
+ * Tier recommendation for the slices, from the cheapest-sufficient table
+ * (`inferSliceTier`) and never from a default: an unknown slice kind is
+ * `inherit`, so the nudge cannot name a tier the table did not produce.
  */
-export function recommendSliceTier(downshift: boolean, separate_quota_pool: boolean): Tier {
+export function recommendSliceTier(
+  downshift: boolean,
+  separate_quota_pool: boolean,
+  sliceKind: SliceType = "unknown",
+): Tier {
   const decision = resolveSubagentRouting({
-    task_tier: "lite",
-    session_tier: "high",
+    task_tier: inferSliceTier({ slice_type: sliceKind }).tier,
+    session_tier: "inherit",
     downshift,
     quota_arbitrage: false,
     model_map: {},
@@ -348,6 +353,28 @@ export function recommendSliceTier(downshift: boolean, separate_quota_pool: bool
   return decision.tier;
 }
 
+const READ_ONLY_FANOUT_RE =
+  /\b(find|locate|search|grep|list|inventor(?:y|ise|ize)|enumerate|count|which files|where (?:is|are)|finde|suche|liste|z(?:ä|ae)hle|wo (?:ist|sind))\b/i;
+const MUTATING_RE =
+  /\b(fix|implement|edit|write|refactor|change|add|create|remove|delete|update|rename|migrate|build|move|replace|mach|bau|implementier\w*|(?:ä|ae)nder\w*|erstell\w*|l(?:ö|oe)sch\w*|f(?:ü|ue)g\w*|schreib\w*)\b/i;
+
+/**
+ * The slice kind a prompt names, deterministically: a read verb with no
+ * mutating verb is a read-only fan-out; everything else is `unknown`, which
+ * the table maps to `inherit`.
+ */
+export function sliceKindFromPrompt(prompt: string): SliceType {
+  return READ_ONLY_FANOUT_RE.test(prompt) && !MUTATING_RE.test(prompt) ? "read-only-fanout" : "unknown";
+}
+
+/**
+ * Median first-call written-or-uncached tokens of a subagent leg — a
+ * measurement, not a tuning knob. Re-take it in {@link LEG_COLD_START_SOURCE}
+ * and change it here; a test fails while the two disagree.
+ */
+export const LEG_COLD_START_UNCACHED_TOKENS = 182_257;
+export const LEG_COLD_START_SOURCE = "agents/evidence/analysis/subagent-cold-start-2026-10-14.md";
+
 /**
  * `rung` names the resolved judgment-ladder rung (2.4): `null` renders as
  * `rung-?` — this concern only ever calls it for a `subagent` verdict
@@ -359,9 +386,21 @@ export function buildNudgeLine(
   classification: Classification,
   sliceCount: number,
   tier: Tier,
+  sliceKind?: SliceType,
+  handKind?: HandKind,
 ): string {
   const unit = sliceCount === 1 ? "slice" : "slices";
   const rungLabel = rung === null ? "rung-?" : `rung-${rung}`;
+  // A pointer only: nothing is sent, and the return is a proposal the head verifies.
+  if (rung === 0.5 && handKind !== undefined) {
+    return (
+      `<delegation-nudge>rung-0.5: free rung. This slice is a typed \`${handKind}\` task and an unpaid ` +
+      "route is admissible — you may send it as ONE call via " +
+      `\`./scripts-run src/scripts/ask_transport --kind ${handKind} --content-class public-artifact "<slice>"\` ` +
+      `(public-artifact text only; project content stays on a paid route). The return is a proposal: ` +
+      `verify it before acting on it. Nothing was sent for you — ${classification.reason}.</delegation-nudge>`
+    );
+  }
   // Rung 0.5 (token-economy-dispatch 4.3): cite the sub-spawn ask path —
   // never a spawn recommendation for a question-shaped slice.
   if (rung === 0.5) {
@@ -403,11 +442,20 @@ export function buildNudgeLine(
   // Rung 1 (single bounded slice) carries no do-in-steps/do-in-parallel
   // mode of its own — `classification.mode` is `null` for that shape.
   const modeLabel = classification.mode ?? "single-slice";
+  // Advisory only, never a block.
+  const coldStart =
+    rung === 1
+      ? ` A leg starts cold (~${Math.round(LEG_COLD_START_UNCACHED_TOKENS / 1000)}k uncached tokens): ` +
+        "a slice of one to three direct reads does not amortise it."
+      : "";
+  // The per-call model value, only for a tier the table produced for a known kind.
+  const model = tier === "lite" && sliceKind !== undefined && sliceKind !== "unknown" ? TIER_TO_CLAUDE_MODEL[tier] : undefined;
+  const carrier = model ? ` Pass \`model: "${model}"\` on each Agent call (${sliceKind} slices earn lite).` : "";
   return (
     `<delegation-nudge>${rungLabel}: dispatch ${modeLabel} ` +
     `(${sliceCount} ${unit}, ${tier} tier recommended). Consider dispatching via ` +
     `subagent-orchestration instead of doing every slice in-session — ` +
-    `${classification.reason}.</delegation-nudge>`
+    `${classification.reason}.${carrier}${coldStart}</delegation-nudge>`
   );
 }
 
@@ -415,9 +463,14 @@ export interface NudgeResult {
   classification: Classification;
   sliceCount: number;
   tier: Tier;
+  /** The slice kind the tier was read from (`unknown` → `inherit`). */
+  sliceKind: SliceType;
+  /** Set only for a rung-0.5 slice of a typed hand kind with an admissible unpaid route. */
+  handKind?: HandKind;
   /** The judgment-ladder rung this verdict resolved to (2.4) — 1 or 2 in
    *  production today: classifyPrompt returns null for every non-subagent
-   *  verdict including rung 0.5 (the carrier stays silent on questions);
+   *  verdict including rung 0.5 (the carrier stays silent on questions),
+   *  except a typed hand slice whose unpaid route an injected check admits;
    *  buildNudgeLine's 0.5 branch is vocabulary for orchestrator-facing
    *  surfaces and direct callers. */
   rung: LadderRung;
@@ -429,10 +482,20 @@ export interface NudgeResult {
  * verdict out of this concern's scope, activation gate closed, or an
  * internal error — all degrade to the same silent outcome).
  */
+export interface ClassifyOptions {
+  /**
+   * Whether an unpaid route would admit this kind. Injected so the verdict does
+   * not depend on what is configured; absent means no route, so the free rung
+   * stays silent.
+   */
+  freeRouteAdmissible?: (kind: HandKind) => boolean;
+}
+
 export function classifyPrompt(
   prompt: string,
   workspace_root: string,
   hostId: string | null | undefined,
+  opts: ClassifyOptions = {},
 ): NudgeResult | null {
   try {
     const { signals, sliceCountForLine } = extractTaskSignals(prompt);
@@ -476,13 +539,30 @@ export function classifyPrompt(
         classification: { delegable: false, action: "ask", mode: null, reason: ladder.reason },
         sliceCount: 0,
         tier: recommendSliceTier(downshift, separate_quota_pool),
+        sliceKind: "unknown",
         rung: ladder.rung,
       };
     }
+    // The one rung-0.5 exception to silence: a typed hand kind with an admissible
+    // unpaid route, which moves paid work off the head rather than adding a line.
+    if (ladder.rung === 0.5 && opts.freeRouteAdmissible !== undefined) {
+      const handKind = handKindFromPrompt(prompt);
+      if (handKind !== null && opts.freeRouteAdmissible(handKind)) {
+        return {
+          classification: { delegable: false, action: "ask", mode: null, reason: ladder.reason },
+          sliceCount: 0,
+          tier: recommendSliceTier(downshift, separate_quota_pool),
+          sliceKind: "unknown",
+          rung: ladder.rung,
+          handKind,
+        };
+      }
+    }
     if (ladder.verdict !== "subagent") {
       return null; // rung-0 script, rung-0.5 ask-transport, or ∅ user-ask/in-session
     }
-    const tier = recommendSliceTier(downshift, separate_quota_pool);
+    const sliceKind = sliceKindFromPrompt(prompt);
+    const tier = recommendSliceTier(downshift, separate_quota_pool, sliceKind);
     // Rung 1 (single bounded slice) has no explicit slice count of its own —
     // extractTaskSignals never produces one for that shape — so the line
     // always names it as exactly one slice.
@@ -493,7 +573,7 @@ export function classifyPrompt(
       mode: ladder.mode ?? null,
       reason: ladder.reason,
     };
-    return { classification, sliceCount, tier, rung: ladder.rung };
+    return { classification, sliceCount, tier, sliceKind, rung: ladder.rung };
   } catch {
     return null; // classifier/settings error → silence, never a crash-to-block
   }
@@ -545,7 +625,10 @@ export function main(): number {
   const root = _workspaceRoot(env);
   const platform = env["platform"];
   const hostId = typeof platform === "string" && platform ? platform : null;
-  const result = classifyPrompt(prompt, root, hostId);
+  // Read lazily: the council config is opened only on a rung-0.5 hand-kind slice.
+  const result = classifyPrompt(prompt, root, hostId, {
+    freeRouteAdmissible: (kind) => freeRungFor(root, kind, councilConfigPath()),
+  });
   if (!result) {
     return EXIT_ALLOW; // anti-canary default: no verdict → no output
   }
@@ -554,7 +637,14 @@ export function main(): number {
     `${JSON.stringify({
       decision: "warn",
       reason: `delegation-nudge: rung-${result.rung} verdict (${result.sliceCount} slices, ${result.tier} tier)`,
-      additional_context: buildNudgeLine(result.rung, result.classification, result.sliceCount, result.tier),
+      additional_context: buildNudgeLine(
+        result.rung,
+        result.classification,
+        result.sliceCount,
+        result.tier,
+        result.sliceKind,
+        result.handKind,
+      ),
     })}\n`,
   );
   return EXIT_WARN;

package/src/scripts/hooks/design_pass_hook.ts

@@ -90,7 +90,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import { appendDischarge, stamp } from '../_lib/obligations.js';
 import { compareInputs } from '../_lib/probe_inputs.js';
 import { trigger_matches, type Trigger } from '../_lib/router_match.js';
-import { isUiPath, isUiTreePath } from '../_lib/ui_surface.js';
+import { HANDOVER_SHAPES, isUiPath, isUiTreePath } from '../_lib/ui_surface.js';
 import { loadDesignContext, scanFile } from '../lint_design_slop.js';
 import { readHookStdin } from './hook_stdin.js';
 import { CHUNK_BASENAME, loadSvgScan } from './svg_rules_loader.js';
@@ -239,7 +239,7 @@ export interface ConformanceOptions {
  * The file-based half of `src/rules/design-fidelity.md`'s `triggers:` set — the
  * shipped answer to "is this file a provided design handover?".
  *
- * COPIED AS A CONSTANT, MATCHED BY THE SHIPPED MATCHER. Reading and parsing the
+ * A CONSTANT (the shared `HANDOVER_SHAPES`), MATCHED BY THE SHIPPED MATCHER. Reading and parsing the
  * rule's frontmatter here would put a YAML load on `post_tool_use`, the hottest
  * slot this concern binds, and would depend on a rule path that differs between
  * this repository and an installed consumer. The drift that a constant invites
@@ -248,18 +248,14 @@ export interface ConformanceOptions {
  * and not here fails CI.
  *
  * THE HONEST REACH. Only the two HTML patterns are reachable through this
- * carrier. `.claude/design-system/` names JSON and token files, which
+ * carrier. Both path prefixes name JSON and token files, which
  * `isUiSurface` does not admit, so `main` returns before the verdict is
  * computed. Widening `isUiSurface` to admit them would change the UI-turn
  * denominator that the consultation-rate measurement is defined against, which
- * is a different decision than this one. The prefix stays for parity with the
- * rule and is stated as unreachable rather than quietly dropped.
+ * is a different decision than this one. The prefixes stay for parity with the
+ * rule and are stated as unreachable rather than quietly dropped.
  */
-export const HANDOVER_TRIGGERS: readonly Trigger[] = [
-    { file_pattern: '*design.html' },
-    { file_pattern: '*.dc.html' },
-    { path_prefix: '.claude/design-system/' },
-];
+export const HANDOVER_TRIGGERS: readonly Trigger[] = HANDOVER_SHAPES;
 
 /** True when any of the paths this turn wrote is a provided design handover. */
 export function handoverTouched(paths: readonly string[]): boolean {
@@ -287,6 +283,16 @@ export function conformanceVerdict(root: string, opts: ConformanceOptions = {}):
             inputs?: unknown;
             dimensions?: { dimension: string; status: string; findings: number | null; reason?: string }[];
             findings?: { dimension?: string; probe_id?: string; expected?: string; observed?: string }[];
+            page_signature?: {
+                status?: string;
+                reason?: string;
+                widths?: {
+                    width?: string;
+                    leaves?: unknown[];
+                    arrangement?: unknown[];
+                    overflow?: { reference?: boolean; target?: boolean };
+                }[];
+            };
         };
 
         // Before anything is counted. A finding count measured against inputs
@@ -336,6 +342,32 @@ export function conformanceVerdict(root: string, opts: ConformanceOptions = {}):
                     `${addedElements.map((f) => f.probe_id ?? '?').join(', ')} — added, not ported`,
             );
         }
+        // ONE LINE, BELOW THE LINES THIS ALREADY PRINTS, and present only when
+        // the artefact carries the field — which is only when the reference
+        // collected no handle at all. The headline and the shadow-verdict trailer
+        // are byte-identical to what the same artefact without the field
+        // produces: this adds a line, it does not change one.
+        //
+        // The counts are per width and the overflow is a PAIR, never a change
+        // flag. A reader who is told "overflow changed" has to go and find out
+        // which way; a reader who is told `false/true` already knows.
+        const sig = a.page_signature;
+        if (sig) {
+            if (sig.status === 'read') {
+                const perWidth = (sig.widths ?? [])
+                    .map((w) => {
+                        const changed = (w.leaves?.length ?? 0) + (w.arrangement?.length ?? 0);
+                        return `${w.width}: ${changed} changed, overflow ${w.overflow?.reference}/${w.overflow?.target}`;
+                    })
+                    .join('; ');
+                parts.push(
+                    `  · page signature (the reference carried no handle, so the five rows above could ask ` +
+                        `nothing): ${perWidth} — kinds of leaf and of container, never nodes; not a finding`,
+                );
+            } else {
+                parts.push(`  · page signature: not available — ${sig.reason ?? 'no reason given'}`);
+            }
+        }
         parts.push(
             inputs.verdict === 'unchanged'
                 ? '  · inputs: unchanged since the probe ran'

package/src/scripts/hooks/dispatch_hook.ts

@@ -47,7 +47,7 @@ import {
 } from "./state_io.js";
 import { log_dispatch_issue, fix_hint } from "./dispatch_issues.js";
 import { shapeAndRecord, type ConcernMessage } from "./injection_budget.js";
-import { CONCERN_REGISTRY, type ConcernMain } from "./concern_registry.js";
+import { resolveConcernMain, type ConcernMain } from "./concern_registry.js";
 import {
   setHookStdinOverride,
   clearHookStdinOverride,
@@ -56,6 +56,7 @@ import { emitFor, type PermissionDecision, type Severity } from "./host_semantic
 import { _concern_permission_verdict, _payload_tool_name, _permission_for } from "./permission_gate.js";
 export { _concern_permission_verdict, _payload_tool_input, _payload_tool_name, _permission_for, _working_tree_root } from "./permission_gate.js";
 import { _concern_body_classes, planPayloadShapes } from "./payload_stub.js";
+import { attributeRefusal, egressInjection, egressViewFor, runEgressStage } from "./egress_stage.js";
 import { resolveSessionRole, type SessionRole } from "../_lib/session_role.js";
 import { stdinReadFailure, denyOnStdinFailure } from './stdin_failure_policy.js';
 export { stdinReadFailure, denyOnStdinFailure, _is_fail_closed_blocking } from './stdin_failure_policy.js';
@@ -678,8 +679,8 @@ function _run_concern(concern: ConcernDef, envelope: JsonObject): RunResult {
   // In-process fast path — the default whenever the concern is in the
   // static registry (all manifest concerns; parity is CI-enforced).
   if (process.env["AGENT_CONFIG_HOOKS_ISOLATED"] !== "1") {
-    const inproc = CONCERN_REGISTRY[String(concern["script"])];
-    if (inproc !== undefined) {
+    const inproc = resolveConcernMain(String(concern["script"]));
+    if (inproc !== null) {
       return _run_concern_inproc(inproc, concern, envelope);
     }
   }
@@ -1276,12 +1277,11 @@ export function main(argv?: string[]): number {
   // Per-concern `tools:` filter (see _concern_matches_tool). Applied here so it
   // is one place, after the envelope exists and before any concern is spawned.
   const tool_name = _payload_tool_name(envelope);
-  // Payload opt-in (step 2.1). There are at most FOUR distinct envelope shapes
-  // per dispatch (keep neither / input / result / both), so they are memoised
-  // by keep-set: concerns sharing a declaration share one clone, and building
-  // one per concern would re-pay the allocation the stub exists to avoid.
-  // `present` is the set of body classes this event actually carries — empty on
-  // every non-tool event, which is why those pay nothing at all.
+  // The egress stage (ADR-285) builds the placeholder view before any concern
+  // runs; `egressViewFor` decides which concern gets which view.
+  const egress = runEgressStage(envelope);
+  // What the concerns inject back into the session passes the engine too (3.5).
+  const injected = egressInjection(String(envelope["workspace_root"] || process.cwd()));
   // Payload opt-in (step 2.1). One planner owns the whole decision — which
   // classes are present, which any concern loses, the single measurement pass,
   // and the at-most-four envelope shapes — so the loop below reads a shape
@@ -1293,12 +1293,13 @@ export function main(argv?: string[]): number {
   const shapes = planPayloadShapes(
     envelope,
     keep_by_concern.map(([, keep]) => keep),
+    egress.placeholder,
   );
   for (const [concern, keep_classes] of keep_by_concern) {
     if (!_concern_matches_tool(concern, tool_name)) {
       continue;
     }
-    const concern_envelope = shapes.shapeFor(keep_classes);
+    const concern_envelope = shapes.shapeFor(keep_classes, egressViewFor(concern));
     const stubs_served = shapes.stubsFor(keep_classes);
     // What was actually SERVED, not what was declared. Recording the
     // declaration made the record wrong in both directions on a body-less
@@ -1365,7 +1366,7 @@ export function main(argv?: string[]): number {
         : "";
     const message = [stated, extra].filter(Boolean).join("\n\n");
     if (message) {
-      concern_messages.push({ rc, text: message, def: concern });
+      concern_messages.push({ rc, text: attributeRefusal(String(concern["name"]), rc === EXIT_BLOCK, injected(message)), def: concern });
     }
     if (
       args.event === "session_start" &&
@@ -1373,7 +1374,7 @@ export function main(argv?: string[]): number {
       typeof reply["context"] === "string" &&
       (reply["context"] as string).trim()
     ) {
-      context_blocks.push((reply["context"] as string).trim());
+      context_blocks.push(injected((reply["context"] as string).trim()));
     }
     feedback_entries.push({
       concern: String(concern["name"]),

package/src/scripts/hooks/egress_engine_loader.ts

@@ -0,0 +1,125 @@
+/**
+ * Loads the egress engine (`_lib/egress_engine.ts`) on demand.
+ *
+ * WHY A CHUNK. The engine is about 19 KB of `dist/hooks/dispatch.js`, the one
+ * bundle every hook event loads, while the egress stage's shipped mode is `off`
+ * and never touches it. With 3 KB of headroom under the bundle ceiling and
+ * 12–15 KB of engine growth queued, an AI council of two providers chose on
+ * 2026-10-18 to emit the engine as `egress_engine.chunk.cjs` beside the bundle
+ * rather than raise the ceiling — the shape `svg_rules_loader.ts` set.
+ *
+ * WHY THIS ONE IS STRICTER THAN THE SVG LOADER. A missing SVG rule set costs a
+ * lint finding; a missing egress engine would let content through unscanned.
+ * So a chunk is refused when its digest does not match its sidecar, when there
+ * is no sidecar to match, and when its `ENGINE_SCHEMA` is not the one this
+ * loader was built against — a correctly digested chunk of another release is
+ * a load failure, never stale rules. Every failure is a value, never a throw,
+ * and each caller decides what an unavailable engine means for it: the stage
+ * withholds bodies in `protect` and `strict` and records the miss in
+ * `observe`; the subagent capsule rejects the envelope.
+ *
+ * WHY `require` AND THE COMPUTED SPECIFIER — see `svg_rules_loader.ts`: a
+ * concern is synchronous, and a literal specifier would be inlined by esbuild,
+ * which is the cost this exists to avoid.
+ */
+import * as fs from 'node:fs';
+import { createRequire } from 'node:module';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import type * as Engine from '../_lib/egress_engine.js';
+import { verifyBundle } from './bundle_integrity.js';
+
+/** The engine's exports. Type-only, so no engine byte reaches the bundle. */
+export type EgressEngine = typeof Engine;
+
+/** The schema this loader accepts. Must equal `ENGINE_SCHEMA` in the engine. */
+export const EXPECTED_ENGINE_SCHEMA = 2;
+
+export const ENGINE_CHUNK_BASENAME = 'egress_engine.chunk.cjs';
+
+export type EngineLoad =
+    | { readonly ok: true; readonly engine: EgressEngine }
+    | { readonly ok: false; readonly reason: 'missing' | 'digest' | 'schema' | 'invalid' };
+
+declare const __AGENT_CONFIG_BUNDLE__: boolean | undefined;
+
+function isBundled(): boolean {
+    return typeof __AGENT_CONFIG_BUNDLE__ !== 'undefined' && __AGENT_CONFIG_BUNDLE__;
+}
+
+/** Where the engine loads from: the sibling chunk when bundled, the source module otherwise. */
+export function engineSpecifier(selfUrl: string, bundled: boolean): string {
+    const selfPath = fileURLToPath(selfUrl);
+    const dir = path.dirname(selfPath);
+    if (bundled) return path.join(dir, ENGINE_CHUNK_BASENAME);
+    const ext = selfPath.endsWith('.ts') ? '.ts' : '.js';
+    return path.join(dir, '..', '_lib', `egress_engine${ext}`);
+}
+
+/**
+ * From source the engine is TypeScript whose imports name `.js` siblings, which
+ * a plain `require` cannot resolve outside a `tsx` process (a test runner, for
+ * one). `tsx`'s own require resolves them; the specifier is computed so esbuild
+ * never pulls `tsx` into the bundle, where this branch is not taken. Without
+ * `tsx` the plain require fails on such a module, which is `invalid`: the
+ * source path is a development path, and it fails closed like every other.
+ */
+function sourceRequire(req: NodeJS.Require): (id: string, from: string) => unknown {
+    try {
+        const api = req(['tsx', 'cjs', 'api'].join('/')) as { require?: (id: string, from: string) => unknown };
+        if (typeof api.require === 'function') return api.require;
+    } catch {
+        // tsx absent: a plain require is the only reader left.
+    }
+    return (id: string) => req(id);
+}
+
+/**
+ * The uncached load; `bundled` is a test seam, the hook path never passes it.
+ *
+ * Every step — resolving the specifier, the existence check, the digest, the
+ * load, the export check — runs inside one conversion boundary, so the function
+ * returns a value on every path. `missing` means the chunk file itself is
+ * absent; once it exists, anything its load throws (a dependency it cannot
+ * resolve included) is `invalid`.
+ */
+export function loadEgressEngineUncached(selfUrl: string = import.meta.url, bundled: boolean = isBundled()): EngineLoad {
+    try {
+        const specifier = engineSpecifier(selfUrl, bundled);
+        if (!fs.existsSync(specifier)) return { ok: false, reason: 'missing' };
+        // No sidecar, a malformed one or a mismatch: the chunk is not the one built.
+        if (bundled && verifyBundle(specifier).state !== 'ok') return { ok: false, reason: 'digest' };
+        let mod: Record<string, unknown>;
+        try {
+            const req = createRequire(selfUrl);
+            mod = (bundled ? req(specifier) : sourceRequire(req)(specifier, fileURLToPath(selfUrl))) as Record<string, unknown>;
+        } catch {
+            return { ok: false, reason: 'invalid' };
+        }
+        if (mod['ENGINE_SCHEMA'] !== EXPECTED_ENGINE_SCHEMA) return { ok: false, reason: 'schema' };
+        for (const name of ['detect', 'replaceValues', 'scanText', 'TokenScope', 'EgressRefusedError', 'tallyText', 'injectText', 'replaceJson']) {
+            if (typeof mod[name] !== 'function') return { ok: false, reason: 'invalid' };
+        }
+        if (!Array.isArray(mod['EGRESS_RULES'])) return { ok: false, reason: 'invalid' };
+        return { ok: true, engine: mod as unknown as EgressEngine };
+    } catch {
+        return { ok: false, reason: 'invalid' };
+    }
+}
+
+const cache = new Map<string, EngineLoad>();
+
+/** The engine or why it is unavailable; cached per process, failures included. */
+export function loadEgressEngine(selfUrl: string = import.meta.url): EngineLoad {
+    const hit = cache.get(selfUrl);
+    if (hit !== undefined) return hit;
+    const load = loadEgressEngineUncached(selfUrl);
+    cache.set(selfUrl, load);
+    return load;
+}
+
+/** Test seam: forget every cached load. Never called by the hook path. */
+export function _resetEgressEngineCache(): void {
+    cache.clear();
+}