@event4u/agent-config 16.5.0 → 17.0.0

package/src/config/host-injection-effect.json

@@ -5,7 +5,14 @@
     "host_version": null,
     "transcript": null,
     "date": "2026-09-10",
-    "reason": "UPDATED 2026-09-10. The premise of the earlier reason is now FALSE and the state is unchanged, which is the finding. That reason said the concern had emitted zero bytes in every session on record because `lean_projection.mode` resolved to `eager-all` throughout. It has now delivered: with `mode: delivery` set locally, a live Claude Code session (2.1.268) received 2 rule bodies / 7,685 B on `user_prompt_submit`, and later in the same session 4 bodies / 16,314 B. So delivery into a live model context is no longer the open question. AN INDEPENDENT READER — a fresh context that did not produce the turn — was given the transcript and a neutral three-way question, and returned ACTED, with a qualification it raised itself and which is why this row is NOT `observed-true`: \"the ACTED verdict rests on 'referring to its substance', not on 'doing something it asks for'\". The model quoted the injection's own byte count (a string the reader confirmed appears nowhere else in the transcript, so the reference is demonstrable) and treated the payload as an OBJECT OF STUDY. On the two delivered rules' actual obligations it returned NONE: no point in the turn surfaces a source discrepancy (`cross-source-consistency`) or classifies the prompt continuation-vs-interrupt (`user-interrupt-priority`). E3 asks for a model that VISIBLY ACTS ON a delivered body; citing that a body arrived is not that, and it is especially not that when the observed turn was one that had been WAITING for the delivery — which makes the reference cheap and is the K1 shape one layer further in. A STRUCTURAL LIMIT THE READER ALSO FOUND, and it bounds what any future attempt can prove: thinking blocks are recorded with length 0 in the transcript, so an internal application of a delivered rule is invisible by construction. Only externally visible behaviour can ever satisfy E3 here. The language pin delivered in the same payload is separately COINCIDENT rather than acted on — the prompt was German anyway, and the pin's own text concedes its trigger is not observable from the transcript. UPDATED 2026-09-11. The state is UNCHANGED and the update is the round that tried hardest to change it. Four ordinary-work turns carrying live deliveries were mechanically selected from the whole transcript store and each judged by a fresh reader on a neutral four-question prompt: one clean NONE, two UNCLEAR, and one NONE on a packet whose rule body was truncated (recorded as defective rather than repaired quietly). Condition 1 was satisfied TWICE, so the bar is not unreachable; condition 2 failed 4/4, and in one candidate the delivered clause that would have CHANGED the outcome went unfollowed while the clause the agent had independent reason to follow was honoured. Full round, method and limits: agents/evidence/analysis/e3-candidate-round-2026-09-11.md. An AI council (2/2 convergent, 2026-09-11) amended E3 prospectively rather than lowering it: a predeclared externally observable obligation class is the admissible witness set, the four conditions stand unchanged, and an eventual observed-true is CLASS-SCOPED — it may not admit this host wholesale for reasoning-only rules. unobserved stays a RESULT here, not a gap. SUPERSEDED THE SAME DAY, AND THE SUPERSESSION IS THE POINT. The enumeration that amendment called for found a confound that makes the four verdicts non-identifying: 106 of 106 `type: auto` rules already carry a byte-equivalent obligation body in the same session unconditionally — 89 in the user-global rule layer, 3 differing by a single blank line, and the 14 maintainer-scoped ones inline in the system prompt. All ten rules judged in the four candidates are body-identical across both channels. So the injected copy adds no text, removing the injection does not remove the body, and the intervention varies one copy versus two rather than absent versus present. The corpus explanation and duplicate exposure fit the four results equally and nothing in the round separates them. Council round 3 (2/2 present, same day) split on the label — anthropic not-measurable-as-specified, openai continue-only-in-a-clean-environment — and converged on the terms: suspend condition-2 judgement wherever a second copy of the obligation exists, record an exposure audit over every auto-loaded channel before admitting a candidate, and require injection to be the SOLE source of the tested body. The residual measurable set in this repository is empty."
+    "reason": "UPDATED 2026-09-10. The premise of the earlier reason is now FALSE and the state is unchanged, which is the finding. That reason said the concern had emitted zero bytes in every session on record because the lean-projection mode key resolved to `eager-all` throughout (that key was removed by ADR-293; the form is computed now). It has now delivered: with `mode: delivery` set locally, a live Claude Code session (2.1.268) received 2 rule bodies / 7,685 B on `user_prompt_submit`, and later in the same session 4 bodies / 16,314 B. So delivery into a live model context is no longer the open question. AN INDEPENDENT READER — a fresh context that did not produce the turn — was given the transcript and a neutral three-way question, and returned ACTED, with a qualification it raised itself and which is why this row is NOT `observed-true`: \"the ACTED verdict rests on 'referring to its substance', not on 'doing something it asks for'\". The model quoted the injection's own byte count (a string the reader confirmed appears nowhere else in the transcript, so the reference is demonstrable) and treated the payload as an OBJECT OF STUDY. On the two delivered rules' actual obligations it returned NONE: no point in the turn surfaces a source discrepancy (`cross-source-consistency`) or classifies the prompt continuation-vs-interrupt (`user-interrupt-priority`). E3 asks for a model that VISIBLY ACTS ON a delivered body; citing that a body arrived is not that, and it is especially not that when the observed turn was one that had been WAITING for the delivery — which makes the reference cheap and is the K1 shape one layer further in. A STRUCTURAL LIMIT THE READER ALSO FOUND, and it bounds what any future attempt can prove: thinking blocks are recorded with length 0 in the transcript, so an internal application of a delivered rule is invisible by construction. Only externally visible behaviour can ever satisfy E3 here. The language pin delivered in the same payload is separately COINCIDENT rather than acted on — the prompt was German anyway, and the pin's own text concedes its trigger is not observable from the transcript. UPDATED 2026-09-11. The state is UNCHANGED and the update is the round that tried hardest to change it. Four ordinary-work turns carrying live deliveries were mechanically selected from the whole transcript store and each judged by a fresh reader on a neutral four-question prompt: one clean NONE, two UNCLEAR, and one NONE on a packet whose rule body was truncated (recorded as defective rather than repaired quietly). Condition 1 was satisfied TWICE, so the bar is not unreachable; condition 2 failed 4/4, and in one candidate the delivered clause that would have CHANGED the outcome went unfollowed while the clause the agent had independent reason to follow was honoured. Full round, method and limits: agents/evidence/analysis/e3-candidate-round-2026-09-11.md. An AI council (2/2 convergent, 2026-09-11) amended E3 prospectively rather than lowering it: a predeclared externally observable obligation class is the admissible witness set, the four conditions stand unchanged, and an eventual observed-true is CLASS-SCOPED — it may not admit this host wholesale for reasoning-only rules. unobserved stays a RESULT here, not a gap. SUPERSEDED THE SAME DAY, AND THE SUPERSESSION IS THE POINT. The enumeration that amendment called for found a confound that makes the four verdicts non-identifying: 106 of 106 `type: auto` rules already carry a byte-equivalent obligation body in the same session unconditionally — 89 in the user-global rule layer, 3 differing by a single blank line, and the 14 maintainer-scoped ones inline in the system prompt. All ten rules judged in the four candidates are body-identical across both channels. So the injected copy adds no text, removing the injection does not remove the body, and the intervention varies one copy versus two rather than absent versus present. The corpus explanation and duplicate exposure fit the four results equally and nothing in the round separates them. Council round 3 (2/2 present, same day) split on the label — anthropic not-measurable-as-specified, openai continue-only-in-a-clean-environment — and converged on the terms: suspend condition-2 judgement wherever a second copy of the obligation exists, record an exposure audit over every auto-loaded channel before admitting a candidate, and require injection to be the SOLE source of the tested body. The residual measurable set in this repository is empty."
+  },
+  "_claude_thinned_layer_exposure": {
+    "state": "unobserved",
+    "host_version": null,
+    "transcript": null,
+    "date": "2026-10-19",
+    "reason": "road-to-an-installed-layer-that-is-thinned 2.4, measured 2026-10-19. A PROPERTY OF THE INSTALLED TREE, NOT A HOST VERDICT, so it is carried under an underscore key for the same reason `_cursor_md_tree_loaded` is: the `claude` row answers whether a delivered body visibly acted, and nothing here changes that answer or its `unobserved` state. What it changes is the premise that row's last paragraph rests on. That paragraph records why the residual measurable set for E3 is empty: 106 of 106 `type: auto` rules already carry a byte-equivalent obligation body in the same session unconditionally, so removing the injection removes no text and the intervention varies one copy against two rather than absent against present. THAT CONFOUND IS A PROPERTY OF THE EAGER-ALL INSTALLED LAYER, and an opted-in install does not have it. Staged against the real corpus at this branch (`dist/agent-src/rules`, 121 files) with the installer's own `thinInstalledRuleLayer`: 100 rules thinned, 21 kept full by `build_thin`'s own predicate (kernel, path-only, trigger-less). Of the 100 thinned, 78 are POINTER-ONLY — no obligation text of any kind remains in the installed layer, 223,427 source characters of body that the user-global channel no longer carries — and 22 are stub-plus-law, where the law section stays byte-copied in both channels and only the mechanics leave. So on an opted-in install the injected copy is the SOLE source of the tested body for 78 rules, which is exactly the condition council round 3 required before a candidate may be admitted, and the residual measurable set stops being empty for them. For the 22 it lifts for the mechanics and persists for the law; for the 21 it is unchanged. NOT ITSELF AN OBSERVATION: no session has been run on an opted-in install, and this row claims only that the confound is absent there, never that a delivery was seen to act. Admitting a candidate still needs the exposure audit and the four conditions E3 states, which `road-to-delivery-on-hook-hosts` owns. Reproduce: agents/evidence/analysis/installed-layer-normalised-measurement-2026-10-19.md names the staging method; the class split is `THIN_ENTRY_MARKER` present with and without `STUB_LAW_OPEN`."
   },
   "_cursor_md_tree_loaded": {
     "state": "unobserved",

package/src/config/host-skill-frontmatter-keys.json

@@ -0,0 +1,56 @@
+{
+  "$comment": "Skill frontmatter keys each host documents, read from the host's own documentation. validate_frontmatter fails when a skill or command schema declares one of these keys as a package-owned key - a key the package gives its own meaning - because the host reads the key first and the package's meaning is lost (road-to-skills-that-arrive-when-called 1.2; the defect it guards is `context: large`, renamed to `context_window` in 1.1). A key the package declares WITH the host's meaning is listed under `passthrough` with the reason. A host entry past `expires` is reported as a warning: re-read the page, update `keys` and `read_date`, and move `expires` forward.",
+  "hosts": [
+    {
+      "host": "claude-code",
+      "url": "https://code.claude.com/docs/en/skills",
+      "read_date": "2026-10-16",
+      "expires": "2027-01-14",
+      "keys": [
+        "name",
+        "description",
+        "when_to_use",
+        "argument-hint",
+        "arguments",
+        "disable-model-invocation",
+        "user-invocable",
+        "allowed-tools",
+        "disallowed-tools",
+        "model",
+        "effort",
+        "context",
+        "agent",
+        "background",
+        "hooks",
+        "paths",
+        "shell",
+        "metadata",
+        "license",
+        "compatibility"
+      ]
+    },
+    {
+      "host": "agent-skills-spec",
+      "url": "https://agentskills.io/specification",
+      "read_date": "2026-10-16",
+      "expires": "2027-01-14",
+      "keys": [
+        "name",
+        "description",
+        "license",
+        "compatibility",
+        "metadata",
+        "allowed-tools"
+      ]
+    }
+  ],
+  "passthrough": {
+    "name": "The skill or command slug; the host reads it as the invocation name, which is the package's meaning.",
+    "description": "The trigger line; the host lists it, which is the package's meaning.",
+    "effort": "Declared as a verbatim passthrough to the host's effort knob (skill schema description).",
+    "user-invocable": "Declared as the host's own extension, used to keep a built-in name unshadowed.",
+    "compatibility": "Declared as the Agent Skills spec field with the spec's meaning; deprecated in the skill schema.",
+    "argument-hint": "Commands project as host skills; the hint is the host's argument hint.",
+    "disable-model-invocation": "Commands project as host skills; the flag is the host's own."
+  }
+}

package/src/config/layer-form-brakes.json

@@ -0,0 +1,4 @@
+{
+  "_comment": "Release brake for the computed rule-layer form (road-to-a-setup-that-decides-itself step 3.4). Each row forces `full` for one host at one host version or one package version. Maintainer-owned operator rollback, never a consumer surface: no settings key, schema entry or wizard question reads or writes it. Loader and match rule: src/scripts/_lib/layer_form_decision.ts (`loadBrakes`, `brakeApplies`). An unreadable or malformed file holds the brake ON for every thinnable host.",
+  "rows": []
+}

package/src/config/layer-form-comparison-corpus.json

@@ -0,0 +1,42 @@
+{
+    "_comment": "The comparison set for `road-to-a-setup-that-decides-itself` step 0.2 — the cases Phase 5 reads when it compares today's full rule layer against the computed form. ONE MANIFEST, BY REUSE: the step's whole point is that no new frozen corpus is authored, so every present source names an artefact the tree already carries and a resolver that reads it. A source the tree does NOT carry is recorded as `absent` with the reason and the condition that reopens it, never swapped for whatever happened to be measurable — the form `road-to-skills-that-arrive-when-called` 5.1 used on 2026-10-20 for the same missing artefact. Read by src/scripts/_lib/layer_form_corpus.ts; checked by tests/scripts/layer_form_corpus.test.ts.",
+    "schema_version": 1,
+    "registered_at": "2026-10-20",
+    "owner": "maintainer",
+    "sources": [
+        {
+            "id": "routing-matrix",
+            "state": "present",
+            "resolver": "routing-matrix-yaml",
+            "path": "tests/eval/routing-matrix",
+            "what": "Per-rule positives and near-misses: a prompt and the skills it must reach. The near-miss half is what a thinned layer would regress first, which is why the matrix is the primary source rather than a supporting one."
+        },
+        {
+            "id": "trigger-corpus-train",
+            "state": "present",
+            "resolver": "routing-corpus-train-slice",
+            "path": "src/skills",
+            "what": "The train slice of the trigger corpus, through `loadTrainCases`. The sealed holdout is never opened: the partition is decided from the skill directory name before any file is read, so the seal is kept by refusal and not by filtering."
+        },
+        {
+            "id": "obligation",
+            "state": "present",
+            "resolver": "obligation-class",
+            "path": "src/config/rule-consequence-class.json",
+            "what": "The class the step adds: one case per rule that must fire under every input — every member of the consequence class, plus every rule whose frontmatter carries `tier: safety-floor`. These are the cases D2 fixes at a zero margin, so they are derived from the frontmatter that decides the class rather than listed here."
+        },
+        {
+            "id": "conformance",
+            "state": "absent",
+            "why": "`tests/conformance/` holds one set, `retrieval/`, and it validates the v1 retrieval ENVELOPE against its schema. It carries no prompt and no expectation, so it cannot be an arm of a comparison between two rule layers. Naming it the step's `conformance cases` would be the guess this step forbids.",
+            "reopens_when": "A conformance set exists whose rows carry a prompt and an adjudicated expectation — then it joins this manifest as a present source and Phase 5's primary reads it."
+        },
+        {
+            "id": "host-graded",
+            "state": "absent",
+            "why": "No artefact named `host-graded cases` exists in the tree. `road-to-a-setup-that-decides-itself` recorded that on 2026-10-16, and `road-to-skills-that-arrive-when-called` step 5.1 reached the same reading on 2026-10-20 and declared its own primary unmeasurable rather than substituting for it.",
+            "reopens_when": "A host-graded case set is committed — a set whose rows are graded by what a host actually did with them, not by an offline ranker. Until then Phase 5's primary reads the three present sources and says so."
+        }
+    ],
+    "what_this_does_not_bound": "The margin. D2 fixes it — zero regressions on the obligation source, at most one regressed case per hundred elsewhere, valid only under a powered pre-registration — and 5.1 freezes it before the first run. A manifest that also carried the margin would let a corpus edit move a threshold."
+}

package/src/config/loop-surfaces.yaml

@@ -30,25 +30,6 @@
 # DEFINED symbol, a `.md` target must be a token the file actually carries.
 # ---------------------------------------------------------------------------
 surfaces:
-  run_continuation_hook:
-    kind: code
-    bound_kind: code
-    cap: src/scripts/_lib/continuation_ladder.ts:MAX_ITERATIONS
-    no_progress: src/scripts/_lib/loop_guards.ts:stallSignal
-    success_stop: >-
-      continuation_ladder.ts:ladder returns 'complete' when openCount === 0 and
-      blockedCount === 0; run_continuation_hook.ts:main clears the run state.
-    checker: >-
-      run_continuation_hook.ts:scanOpenSteps re-scans the claimed roadmap every
-      fire. It never EXECUTES a step's verify line — it only prints it.
-    human_gate: >-
-      none. The nearest thing is printed prose in _continuationText; the
-      refusedThisTurn check defers to a quality gate, not to a person.
-    terminal_vocabulary: src/scripts/_lib/continuation_ladder.ts:TERMINAL_STATE_BY_ACTION
-    production_consumers:
-      - src/scripts/hooks/concern_registry.ts
-      - src/scripts/hook_manifest.yaml
-
   self_fix:
     kind: code
     bound_kind: code
@@ -112,11 +93,19 @@ surfaces:
     production_consumers:
       - src/domains/meta/README.md
 
+  # bound_kind was `code` until 2026-10-14, pointing at MAX_ITERATIONS and
+  # STALL_WINDOW in _lib/continuation_ladder.ts. The only caller of that ladder,
+  # the run-continuation concern, was withdrawn on its own kill date, so the code
+  # bound had already stopped bounding anything; the owner then decided to
+  # remove the module. What bounds the loop now is prose: a roadmap's finite
+  # step list closes it (`count_open`), and a failure that repeats with budget
+  # left ends it as `stagnated` — both stated in the command. Reported, never
+  # red, which is the honest weight of a bound nothing executes.
   roadmap_process_loop:
     kind: prose
-    bound_kind: code
-    cap: src/scripts/_lib/continuation_ladder.ts:MAX_ITERATIONS
-    no_progress: src/scripts/_lib/continuation_ladder.ts:STALL_WINDOW
+    bound_kind: prose
+    cap: src/domains/product-basic/roadmap/process-full/command.md:count_open
+    no_progress: src/agent-src/contexts/execution/process-full-delivery.md:stagnated
     success_stop: >-
       count_open == 0 with the PR open. `blocked` is never presented as
       completion and no checkbox is flipped to reach it.
@@ -153,19 +142,22 @@ instruments:
   rejectedTacticRepeat:
     file: src/scripts/_lib/loop_guards.ts
     role: >-
-      Identity-keyed repeat suppression for run_continuation_hook. Catches what
-      the numeric stall detector cannot see: the same rejected tactic retried
-      while the surrounding prose changes every time.
+      Identity-keyed repeat suppression, built for the withdrawn
+      run_continuation_hook. Catches what a numeric stall detector cannot see:
+      the same rejected tactic retried while the surrounding prose changes every
+      time.
     status: experimental
     expires: '2026-12-12'
     note: >-
-      Deliberately not wired. Its only consumer would be the continuation hook,
-      and giving that hook a new refusal rung before it has demonstrably engaged
-      more than once reverses the order the evidence supports (roadmap Risk 2).
-      The observation it is waiting on is parked in
-      agents/roadmaps/later/road-to-run-continuation-observation.md. The expiry
-      is the date that question comes back, not a date this decision is
-      considered settled.
+      Deliberately not wired, and its prospective consumer is now GONE. It was
+      the continuation hook, withdrawn on its own pre-registered kill date by
+      road-to-what-was-built-and-never-ran Phase 4 — so the original reason for
+      not wiring it (do not give that hook a new refusal rung before it has
+      demonstrably engaged more than once) has been overtaken rather than
+      satisfied. The expiry stands unchanged at the date the question comes
+      back; what comes back with it is now whether this instrument has any
+      consumer at all, which no roadmap owns and which this entry does not
+      decide.
 
   compareTriggers:
     file: src/scripts/_lib/capsule_trigger.ts
@@ -189,17 +181,10 @@ instruments:
     note: Same input gap as compareTriggers — it consumes that function's output.
 
   # --- Live instruments, declared so the axis is shown NOT over-firing. ---
-  # All three are called only from inside their own declaring file. A predicate
-  # that counted importers alone would report every one of them dead; that is
-  # the false-positive class the occurrence criterion exists to remove.
-  detectUnavailableDependency:
-    file: src/scripts/_lib/loop_guards.ts
-    role: Scans a transcript tail for an unavailable-dependency signal.
-
-  DEPENDENCY_SCAN_BYTES:
-    file: src/scripts/_lib/loop_guards.ts
-    role: How much of a transcript tail the dependency scan reads.
-
+  # Called only from inside its own declaring file. A predicate that counted
+  # importers alone would report it dead; that is the false-positive class the
+  # occurrence criterion exists to remove. Two siblings, detectUnavailableDependency
+  # and DEPENDENCY_SCAN_BYTES, left on 2026-10-14 with the ladder that called them.
   StallSignal:
     file: src/scripts/_lib/loop_guards.ts
     role: The shape stallSignal returns — level plus the window it was read over.
@@ -209,7 +194,3 @@ instruments:
   stallSignal:
     file: src/scripts/_lib/loop_guards.ts
     role: Numeric non-advance detector — the open-step count over a window.
-
-  terminalStateFor:
-    file: src/scripts/_lib/continuation_ladder.ts
-    role: Maps a ladder action onto its RunTerminalState.

package/src/config/memory-twin-verdicts.yml

@@ -63,9 +63,17 @@ twins:
 
   - file: check_memory.ts
     mode: bounded
-    max_changed_lines: 18
+    max_changed_lines: 30
     verdict: dev-side-correct
     reason: >-
+      Raised 18 -> 30 on 2026-10-21 for case (a) a third time: the dev side builds
+      its inline-credential pattern with `assignmentPattern` from
+      `_lib/egress_rules.js` (one detector, road-to-one-detector-and-the-senders-we-own),
+      and the template keeps the literal it cannot import. The generated source and
+      flags are byte-identical to the literal, pinned by
+      tests/scripts/check_memory_redaction_twin.test.ts because this line bound
+      cannot see a regex that drifts in place; the 12 lines are the import and the
+      call shape. The portable half, `export const REDACTION_PATTERNS`, was ported.
       Reconciled 195 -> 18 on 2026-08-26. The template was a stale snapshot
       missing SEVEN validations the dev side had grown: the `priority` enum, the
       critical-stale SLA, the one-fact length limit, relative-date discipline,

package/src/config/metric-registry.yml

@@ -149,10 +149,17 @@ metrics:
   # "this change moved N bytes" could not be made at all: the tree measured
   # tokens well and bytes not at all, and no row here could have held one.
 
+  # Both census rows count the host's HOOK ENVELOPE — the serialised
+  # `tool_response` a post_tool_use hook receives — not what reached the model.
+  # For Edit and Write the hook envelope carries the whole original file: over 12
+  # local transcripts it was 19.5x the model-visible bytes (Bash 1.44x, Read
+  # within 0.1 %); the full corpus reads 17.2x for Edit and 23.2x for Write
+  # (agents/evidence/analysis/model-visible-bytes-2026-10-14.md). The payload
+  # that reached the model is `tool-result-payload-bytes` below.
   - id: tool-raw-bytes
     unit: bytes
     basis: measured
-    producer: src/scripts/hooks/tool_result_bytes_hook.ts (`raw_bytes`, per post_tool_use dispatch)
+    producer: src/scripts/hooks/tool_result_bytes_hook.ts (`raw_bytes`, the hook envelope, per post_tool_use dispatch)
     consumer: >-
       the `tool_result_bytes` stream registered in `src/config/hook-token-budget.json`,
       and the maintainer reading `agents/runtime/state/tool-result-census.jsonl`
@@ -170,11 +177,15 @@ metrics:
   - id: tool-delivered-bytes
     unit: bytes
     basis: measured
-    producer: src/scripts/hooks/tool_result_bytes_hook.ts (`delivered_bytes`, same record)
+    producer: src/scripts/hooks/tool_result_bytes_hook.ts (`delivered_bytes`, the hook envelope after any rewrite, same record)
     consumer: >-
       the same census reader, comparing it against `tool-raw-bytes` on the same
       line. Equal by construction today, because nothing in this tree rewrites
-      a tool result on its way to the model.
+      a tool result on its way back to the host: the egress stage changes only
+      the views concerns receive, and its contract
+      (docs/contracts/egress-placeholders-v1.md, per-mode table) sends no host
+      rewrite in any mode yet. Both count the hook envelope,
+      not what reached the model — its payload is `tool-result-payload-bytes`.
     decision: >-
       whether a result-rewriting mechanism, if one ever lands, reduced anything.
       A non-zero gap between the two columns is the reduction; no gap is no
@@ -184,6 +195,32 @@ metrics:
       and can only assert an improvement. The two columns exist now precisely
       so that claim is a measured delta later rather than a story.
 
+  - id: tool-result-payload-bytes
+    unit: bytes
+    basis: measured
+    producer: >-
+      src/scripts/_lib/cc_transcript.ts (`scanToolResults`, per tool class,
+      joined to the `tool_use` name by id). Counts the PAYLOAD of each
+      `tool_result` block — its text strings and base64 image data — not the
+      serialised block: `type`, `tool_use_id`, `is_error` and JSON punctuation
+      are excluded, and a content member of any other kind is counted in
+      `unsupported_members`, never as bytes.
+    consumer: >-
+      the dated distribution under `agents/evidence/analysis/` that
+      `road-to-tool-results-that-leave-a-handle` and the placeholders roadmap
+      compare a reduction against, and any reader of a tool-result byte figure
+      checking which bytes it counted.
+    decision: >-
+      which tool classes are worth reducing at all. A class whose hook envelope
+      is large and whose payload is small (Edit, Write) has little to reduce on
+      the model side; the block structure the payload excludes is a per-result
+      overhead that does not grow with the payload, so it does not reorder the
+      classes.
+    absent: >-
+      the only tool-result byte figure is the hook envelope, which overstates
+      Edit and Write by an order of magnitude, and a reduction plan aims at
+      bytes the model never received.
+
   - id: transcript-bytes-per-token
     unit: bytes_per_token
     basis: measured

package/src/config/pack-size-budget.json

@@ -108,5 +108,20 @@
         "measured_at": "2026-09-10",
         "measured_on": "One machine, one clean checkout plus one detached worktree for the historical reconstruction. No CI reading of either surface exists and none can: check_pack_size has no .github invocation, only taskfiles/ci-fast.yml:846. Every figure here is a workstation reading. Node and npm as resolved by the repo's engines field (node >=20.11.0)."
     },
+    "built_surface_measurement_2026_10_17": {
+        "purpose": "Re-measure of the BUILT surface, taken because `check_pack_size` reds the required `Sync + Generate Tools Consistency` context on `main` itself at 8c90aad26 (run 39010428624): 13.703 measured against the 13.700 ceiling derived from built_surface_measurement_2026_09_10's 12.4548. The trunk is 3 KB past its own ceiling, so no branch can clear it by shrinking, and every open pull request inherits the red. built_surface_enforcement_2026_08_30 below already names a new dated key as the sanctioned revisit path, and its revisit-if condition — the built figure is re-measured — is met. AI council 2026-10-17, two seats, two rounds, quorum 2/2 concluded: no split on the three points this record acts on — a re-measure is warranted, 14.4989 is the defensible number rather than CI's 13.703, and the transition is OWNER-RESERVED, because the agent proposing the reset is the one it unblocks. The owner took it on 2026-10-17 and chose the first of the two options the seats split on: align CI before recording, and leave `max` alone. No ADR: this restores the already-documented full-build measurement method rather than redefining the built surface.",
+        "built": {
+            "packed_mb": 14.4989,
+            "unpacked_mb": 52.7129,
+            "entries": 3568,
+            "command": "npm run build && npm pack --dry-run --json --ignore-scripts   # full pristine build, every untracked dist/ subtree deleted first",
+            "note": "The surface a consumer downloads, and the figure the BUILT regression line now compares against; the derived ceiling is 15.9488 at regression_pct 10. Exact bytes: 14,498,927 packed over 3,568 entries, 52,712,868 unpacked. The previous record's 12.4548 was taken on 2026-09-10, and the five weeks since added ordinary product files — src/scripts/analysis_*.ts, source_adapters.ts, round_reservations.ts, src/install/ownershipLedger.ts and their built output. No stray artefact and no accidental inclusion was found, so there is no payload to trim instead of re-baselining."
+        },
+        "unbuilt_not_remeasured": "DELIBERATELY ABSENT, and the absence is the second half of the owner's decision. The unbuilt surface reads 12.053 MB over 3,309 entries against `budgets.packed_size_mb.max: 11.5` — a LATENT BREACH that CI does not exercise, because the required job now always packs a built tree and the built path compares against this record rather than against `max`. The council split on whether `max` moves in the same change; the owner took the position that it is an explicit absolute policy limit whose raise is a second decision, so `max` is untouched here and the breach is RECORDED rather than cured. Revisit-if: a job packs an unbuilt tree and reds on `max`, or a maintainer re-cuts the absolute cap.",
+        "reproducibility": "REQUIRED BY THE COUNCIL BEFORE THE RESET, AND PASSED — by two parties independently. Two pristine builds from one clean tree produced byte-identical pack manifests: 3,568 entries, 14,498,927 packed bytes, 52,712,868 unpacked, sorted-path-list sha256 e3257a4ca12d9cc9 in both runs. Each was taken after `git clean -xdf dist/` — which leaves the tracked dist/agent-src, dist/install and dist/router.json in place — followed by `npm run build`, and neither left the tracked tree dirty. Two earlier readings the same day, in a different checkout of the same content, produced the same 14.4989 over 3,568. Without that, a single reading is one observation and not a baseline.",
+        "ci_alignment": "THE REASON CI'S FIGURE AND THIS ONE DIFFERED, fixed in the same change rather than recorded as a gap. The Consistency job never ran a build, yet reached the gate with `dist/cli` present — enough for `payloadIsBuilt`, which keys on `dist/cli/**` alone — while `dist/mcp` and `dist/ui` were absent. It therefore measured 3,455 entries / 13.703 MB on a PARTIALLY built tree and compared that against a figure recorded from a FULL one. The 113-entry difference is a blind spot, not headroom, and both seats characterised it that way; recording CI's partial figure would have converted an accidental build omission into policy. The fix is `deps: [build-ts]` on the `check-pack-size` task in `taskfiles/ci-fast.yml`, NOT a step in the workflow — put in the task because the divergence is between CALLERS of this gate, not between CI and everything else: CI, `task ci` and a maintainer at a prompt now all measure the one surface `built.command` names. It also keeps the change out of `.github/workflows/consistency.yml`, which hosts the ADR-268 § 4 ratification gate and would have made a payload re-baseline a governance diff for no gain. CORRECTS A CLAIM IN THE 2026-09-10 RECORD: its `measured_on` states that `check_pack_size` has no .github invocation and that no CI reading can exist. It has had one since the gate was wired into consistency.yml, and that invocation is what produced the red this record answers.",
+        "measured_at": "2026-10-17",
+        "measured_on": "One machine, one clean checkout of origin/main at 8c90aad26, plus the earlier readings taken in a separate worktree of the same content. Node and npm as resolved by the repo's engines field (node >=20.11.0). From this change onward the required Consistency job also produces a CI reading of the built surface, which the 2026-09-10 record said was impossible."
+    },
     "built_surface_enforcement_2026_08_30": "How the two surfaces this file records are now ENFORCED, which until 2026-08-30 they were not. `check_pack_size` compared every payload against `budgets.packed_size_mb.max`, and that cap was measured on the UNBUILT tree — this file has said so since 2026-08-24 in `measurement_conditions` and in `built_surface_measurement_2026_08_24`, and the gate did not read it. Measured on the day this note was written: main packed 8.985 MB over 2715 entries with `--ignore-scripts` and passed; a branch adding six source files packed 9.922 over 2827 and failed `max: 9.1`. The 112-entry difference is `dist/cli` plus `dist/cli-delegate` — the build, not the diff. The gate now reads the payload it is judging (`payloadIsBuilt`, keyed on `dist/cli/**`, already used by the content classes for the same reason) and routes: an UNBUILT payload against `max` and the `last_measured` creep line, unchanged; a BUILT payload against `built_surface_measurement_*.built.packed_mb` with the same `regression_pct`. A built payload with no recorded built figure is a FINDING, not a pass — otherwise removing the record would silently disable the built path. What this does NOT do: it does not raise `max`, and it does not gate the built surface against an absolute cap. The built surface gets a regression line only, because no absolute figure for it was ever set by a maintainer and inventing one here would be exactly the invented number the `_comment` warns about. Revisit-if: a maintainer sets an absolute built cap, or the built figure is re-measured (add a new `built_surface_measurement_<date>` key — the newest is read, so no code changes)."
 }

package/src/config/procedure-core-budget.json

@@ -0,0 +1,21 @@
+{
+    "_comment": "Core size of the five run procedures (road-to-a-step-that-costs-what-it-changes 3.1). Branch-only material lives in sibling references under src/agent-src/contexts/execution/, each held under 16,000 chars by check_depth_budget. Each ceiling is the measured size on 2026-10-21 and only shrinks; read by tests/scripts/procedure_core_budget.test.ts.",
+    "schema_version": 1,
+    "registered_at": "2026-10-21",
+    "owner": "maintainer",
+    "review_by": "2027-04-21",
+    "cap_bytes": 15000,
+    "cores": {
+        "src/agent-src/contexts/execution/roadmap-process-loop.md": {
+            "ceiling": 16091,
+            "over_cap_reason": "The mandatory core (sections 1, 2, 3-0, 4, the section 5 step loop with the receipt, the 5b essentials, the halt list, the section 6 essentials) is about 12 KB, and the Iron-Law fences that must stay with their headings add about 3 KB; every further move costs a pointer line worth more than it saves. Under the 16,000-char depth ceiling, above the 15,000-byte target."
+        },
+        "src/domains/product-basic/roadmap/process-full/command.md": { "ceiling": 14969 },
+        "src/domains/git/pr/create/command.md": { "ceiling": 14997 },
+        "src/domains/git/pr/merge/command.md": {
+            "ceiling": 15698,
+            "over_cap_reason": "The needs-council clearance check stays in the core directly before `gh pr merge`: moved behind a pointer, the merge command read first and the check second, and a reader stopping at the core would merge without it. Its ~800 bytes are the overshoot."
+        },
+        "src/agent-src/contexts/execution/roadmap-execution-contract.md": { "ceiling": 14621 }
+    }
+}

package/src/config/profiles/minimal.ini

@@ -4,7 +4,7 @@
 ;
 ; Default profile. Ships rules, skills, and commands only — no runtime
 ; dispatcher, no tool adapters. See docs/customization.md for the full
-; profile description. scripts/install.py merges this file with
+; profile description. src/scripts/install.ts merges this file with
 ; config/agent-settings.template.ini to produce the user's .agent-settings.
 
 rule_loading_tier=minimal

package/src/config/project-tree-form.json

@@ -0,0 +1,24 @@
+{
+    "_comment": "The rule-layer form the PROJECT tree is built with, per host — evidence metadata, never a user-configurable policy. ADR-293 removed `lean_projection.mode`, and the shipped template was where the project tree got its `delivery`. This record carries that value instead, with the evidence ADR-267 measured for it, so the key's removal does not silently flip a tree whose form was decided on data. IT IS NOT A SETTINGS KEY IN DISGUISE: it is package-owned, ships in the repository, has no consumer-writable layer and no cascade, and `modeExplicit` stays false for it exactly as it did for the template — nothing here is read as a consumer's consent. PRECEDENCE: any VALID OBSERVED verdict from the layer-form decision function supersedes this record for that host; the record is what stands while that function can only answer `delivery-unobserved`. Read by src/scripts/_lib/project_tree_form.ts; checked by tests/scripts/project_tree_form.test.ts.",
+    "schema_version": 1,
+    "registered_at": "2026-10-20",
+    "owner": "maintainer",
+    "superseded_by": "a valid observed layer-form verdict for the same host — see projectTreeForm() in src/scripts/_lib/project_tree_form.ts",
+    "retire_when": "step 3.6 of road-to-a-setup-that-decides-itself routes the project tree through the decision function on an observed effect row; this file goes with it, and until then its absence would be a silent default change rather than a simplification",
+    "hosts": {
+        "claude-code": {
+            "form": "delivery",
+            "basis": "ADR-267",
+            "corpus": "tests/eval/routing-matrix",
+            "evidence": "internal/bench/reports/thin-inject-2026-09-08.md — carries this reading and the later 591/591 taken after CAP_BYTES was lowered; the bar is zero unequal deliveries, which both meet",
+            "measured_on": "2026-09, the frozen routing-matrix corpus",
+            "measured": {
+                "deliveries_byte_equal": "616/616",
+                "labelled_rules_reachable": "101/101",
+                "near_misses_fired": "0/212"
+            }
+        }
+    },
+    "hosts_note": "A host with no row here gets the full form, which is what an absent key always meant (ADR-267 decision point 4). Adding a row is a claim that THAT host's delivery was measured, so a row with no `measured` block is refused by the reader rather than read as a default.",
+    "what_this_does_not_bound": "The INSTALLED layer. `~/.claude/rules` belongs to the machine and is decided by the layer-form decision function plus the install receipt's pin; nothing in this file reaches it. The two were one key before ADR-293 and that was the defect."
+}

package/src/config/reach-channels.yml

@@ -130,7 +130,7 @@ channels:
           darwin: brew install node@22
           linux: "os-baseline: distro or NodeSource nodejs package — version tracks the chosen channel, no pin meaningful here"
           win32: "os-baseline: winget package OpenJS.NodeJS.LTS — version tracks the LTS line, no pin meaningful here"
-          default: "os-baseline: any Node runtime at or above this package's engines floor (>=20.11.0) already on PATH"
+          default: "os-baseline: any Node runtime at or above this package's engines floor (>=22.6.0) already on PATH"
 
   # Single-page read. Same two candidates as `rss`: curl fetches the bytes;
   # Node covers the case where the extraction step runs in-process.
@@ -156,7 +156,7 @@ channels:
           darwin: brew install node@22
           linux: "os-baseline: distro or NodeSource nodejs package — version tracks the chosen channel, no pin meaningful here"
           win32: "os-baseline: winget package OpenJS.NodeJS.LTS — version tracks the LTS line, no pin meaningful here"
-          default: "os-baseline: any Node runtime at or above this package's engines floor (>=20.11.0) already on PATH"
+          default: "os-baseline: any Node runtime at or above this package's engines floor (>=22.6.0) already on PATH"
 
   # Discussion search over the public Hacker News search API. Keyless, and
   # the endpoint returns JSON directly — one candidate is enough.
@@ -198,7 +198,7 @@ channels:
           darwin: brew install node@22
           linux: "os-baseline: distro or NodeSource nodejs package — version tracks the chosen channel, no pin meaningful here"
           win32: "os-baseline: winget package OpenJS.NodeJS.LTS — version tracks the LTS line, no pin meaningful here"
-          default: "os-baseline: any Node runtime at or above this package's engines floor (>=20.11.0) already on PATH"
+          default: "os-baseline: any Node runtime at or above this package's engines floor (>=22.6.0) already on PATH"
 
   - id: twitter-oembed
     description: Single public tweet read through the platform's own oEmbed endpoint, credential-free.

package/src/config/reach-prescriptions-intake.yml

@@ -172,7 +172,7 @@ os_baseline:
     os_baseline: true
     rationale: >-
       A Node runtime is this package's own execution baseline
-      (package.json engines >=20.11.0), so any environment that can run the
+      (package.json engines >=22.6.0), so any environment that can run the
       validator already has it. The one platform where a pin IS meaningful —
       Homebrew's versioned major-line formula — carries a real pin
       (`brew install node@22`), verified below; the remaining platforms track

package/src/config/roadmap-step-size-baseline.json

@@ -0,0 +1,118 @@
+{
+    "_comment": "Roadmap steps over the 150-word cap on 2026-10-21, held so the cap applies to new steps only (road-to-a-step-that-costs-what-it-changes 3.2). Read by lint_roadmap_complexity via src/scripts/_lib/roadmap_step_size.ts. SHRINK-ONLY: never add a key — split the step instead; delete a key once its step fits or its roadmap is archived.",
+    "schema_version": 1,
+    "registered_at": "2026-10-21",
+    "owner": "maintainer",
+    "review_by": "2027-04-21",
+    "held": [
+        "road-to-a-cold-start-paid-once.md#1.4",
+        "road-to-a-cold-start-paid-once.md#2.5",
+        "road-to-a-cold-start-paid-once.md#2.6",
+        "road-to-a-cold-start-paid-once.md#3.1",
+        "road-to-a-cold-start-paid-once.md#3.3",
+        "road-to-a-cold-start-paid-once.md#4.4",
+        "road-to-a-release-that-says-whether-it-needs-you.md#2.1",
+        "road-to-a-release-that-says-whether-it-needs-you.md#4.2",
+        "road-to-a-release-that-says-whether-it-needs-you.md#4.3",
+        "road-to-a-retro-the-merge-runs.md#0.2",
+        "road-to-a-retro-the-merge-runs.md#1.5",
+        "road-to-a-retro-the-merge-runs.md#3.7",
+        "road-to-a-retro-the-merge-runs.md#5.1",
+        "road-to-a-setup-that-decides-itself.md#0.1",
+        "road-to-a-setup-that-decides-itself.md#0.2",
+        "road-to-a-setup-that-decides-itself.md#1.1",
+        "road-to-a-setup-that-decides-itself.md#1.2",
+        "road-to-a-setup-that-decides-itself.md#3.1",
+        "road-to-a-setup-that-decides-itself.md#3.3",
+        "road-to-a-setup-that-decides-itself.md#3.6",
+        "road-to-a-setup-that-decides-itself.md#4.3",
+        "road-to-a-setup-that-decides-itself.md#4.4",
+        "road-to-a-setup-that-decides-itself.md#4.6",
+        "road-to-a-setup-that-decides-itself.md#4.6b",
+        "road-to-a-setup-that-decides-itself.md#4.8",
+        "road-to-agent-throughput-recovery.md#0.1",
+        "road-to-agent-throughput-recovery.md#1.1",
+        "road-to-agent-throughput-recovery.md#1.3",
+        "road-to-agent-throughput-recovery.md#2.1",
+        "road-to-agent-throughput-recovery.md#2.3",
+        "road-to-agent-throughput-recovery.md#3.2",
+        "road-to-agent-throughput-recovery.md#4.1",
+        "road-to-agent-throughput-recovery.md#4.3",
+        "road-to-agent-throughput-recovery.md#4.4",
+        "road-to-agent-throughput-recovery.md#4.5",
+        "road-to-agent-throughput-recovery.md#5.2",
+        "road-to-an-installed-layer-that-is-thinned.md#3.2",
+        "road-to-an-installed-layer-that-is-thinned.md#3.3",
+        "road-to-an-installed-layer-that-is-thinned.md#3.4",
+        "road-to-an-installed-layer-that-is-thinned.md#4.1",
+        "road-to-an-update-that-installs-itself-only-when-it-is-safe.md#2.1",
+        "road-to-an-update-that-installs-itself-only-when-it-is-safe.md#4.1",
+        "road-to-an-update-that-installs-itself-only-when-it-is-safe.md#4.5",
+        "road-to-authority-routing-mechanism.md#3.1",
+        "road-to-authority-routing-mechanism.md#6.1",
+        "road-to-authority-routing-mechanism.md#7.1",
+        "road-to-corpus-refresh-cadence-shape.md#1.1",
+        "road-to-corpus-refresh-cadence-shape.md#1.2a",
+        "road-to-corpus-refresh-cadence-shape.md#1.2b",
+        "road-to-corpus-refresh-cadence-shape.md#1.2c",
+        "road-to-corpus-refresh-cadence-shape.md#1.2d",
+        "road-to-decision-closure.md#0.1",
+        "road-to-decision-closure.md#2.2",
+        "road-to-decision-closure.md#4.2",
+        "road-to-one-detector-and-the-senders-we-own.md#0.3",
+        "road-to-one-detector-and-the-senders-we-own.md#0.4",
+        "road-to-one-detector-and-the-senders-we-own.md#1.1",
+        "road-to-one-detector-and-the-senders-we-own.md#1.2",
+        "road-to-one-detector-and-the-senders-we-own.md#2.1",
+        "road-to-one-detector-and-the-senders-we-own.md#2.2",
+        "road-to-one-detector-and-the-senders-we-own.md#2.2b",
+        "road-to-one-detector-and-the-senders-we-own.md#2.3",
+        "road-to-one-detector-and-the-senders-we-own.md#2.4",
+        "road-to-one-detector-and-the-senders-we-own.md#3.1",
+        "road-to-placeholders-on-the-wire.md#0.1",
+        "road-to-placeholders-on-the-wire.md#2.1",
+        "road-to-self-modification-that-a-council-must-pass.md#1.1",
+        "road-to-self-modification-that-a-council-must-pass.md#1.2",
+        "road-to-self-modification-that-a-council-must-pass.md#1.4",
+        "road-to-self-modification-that-a-council-must-pass.md#1.5",
+        "road-to-self-modification-that-a-council-must-pass.md#2.1",
+        "road-to-self-modification-that-a-council-must-pass.md#2.2",
+        "road-to-self-modification-that-a-council-must-pass.md#2.3",
+        "road-to-self-modification-that-a-council-must-pass.md#2.4",
+        "road-to-self-modification-that-a-council-must-pass.md#2.5",
+        "road-to-self-modification-that-a-council-must-pass.md#2.6",
+        "road-to-self-modification-that-a-council-must-pass.md#2.7",
+        "road-to-self-modification-that-a-council-must-pass.md#2.8",
+        "road-to-self-modification-that-a-council-must-pass.md#2.9",
+        "road-to-self-modification-that-a-council-must-pass.md#3.1",
+        "road-to-self-modification-that-a-council-must-pass.md#3.2",
+        "road-to-self-modification-that-a-council-must-pass.md#3.4",
+        "road-to-self-modification-that-a-council-must-pass.md#4.1",
+        "road-to-self-modification-that-a-council-must-pass.md#4.2",
+        "road-to-self-modification-that-a-council-must-pass.md#4.3",
+        "road-to-self-modification-that-a-council-must-pass.md#5.2",
+        "road-to-self-modification-that-a-council-must-pass.md#5.3",
+        "road-to-self-modification-that-a-council-must-pass.md#6.1",
+        "road-to-self-modification-that-a-council-must-pass.md#6.2",
+        "road-to-svg-witness-provenance.md#1.1",
+        "road-to-svg-witness-provenance.md#1.2",
+        "road-to-tool-results-that-leave-a-handle.md#1.4",
+        "road-to-typed-grants-that-persist.md#1.4",
+        "road-to-typed-grants-that-persist.md#1.7",
+        "road-to-typed-grants-that-persist.md#2.1",
+        "road-to-typed-grants-that-persist.md#2.2",
+        "road-to-typed-grants-that-persist.md#2.3",
+        "road-to-typed-grants-that-persist.md#3.1",
+        "road-to-typed-grants-that-persist.md#3.2",
+        "road-to-typed-grants-that-persist.md#3.3",
+        "road-to-typed-grants-that-persist.md#3.4",
+        "road-to-typed-grants-that-persist.md#4.1",
+        "road-to-typed-grants-that-persist.md#4.2",
+        "road-to-typed-grants-that-persist.md#4.3",
+        "road-to-typed-grants-that-persist.md#4.4",
+        "road-to-typed-grants-that-persist.md#5.1",
+        "road-to-typed-grants-that-persist.md#5.3",
+        "road-to-typed-grants-that-persist.md#6.1",
+        "road-to-typed-grants-that-persist.md#6.2"
+    ]
+}