@event4u/agent-config 17.0.0 → 17.2.0

package/src/scripts/_cli/cmd_update.ts

@@ -542,7 +542,7 @@ export async function main(argv: string[] | null = null, options: MainOptions =
         cache_warmer(latest);
     }
     _refresh_state(latest, latest, state_path);
-    _refresh_global_lockfile(latest, out);
+    _report_global_install(latest, out);
     return 0;
 }
 
@@ -556,30 +556,28 @@ function _relativeToOr(target: string, base: string): string {
 }
 
 /**
- * Update the global `installed.lock` if it exists.
+ * Name `agent-config upgrade` when the global install is older than the pin.
  *
- * Resolution prefers `~/.event4u/agent-config/installed.lock` and falls back to
- * the legacy `~/.config/agent-config/installed.lock`.
- *
- * Phase 1.6 — the lockfile is only present when the user has run a global
- * install; we never create one here, but we keep it in lockstep when `update`
- * flips the pin. Atomic write goes through `installed_lock.write_lockfile`.
+ * Read-only by design: `installed.lock` records what the global install
+ * deployed, and `upgrade` (plus its `--check` and unattended paths) reads it as
+ * the installed version. This command used to rewrite it to the pin, so after
+ * `update` the lock claimed a version no `npm install -g` had installed and
+ * `upgrade --check` reported "up to date" over the old binary.
  */
-function _refresh_global_lockfile(version: string, out: OutSink): void {
-    const read_path = installed_lock.lockfile_path();
-    const write_path = installed_lock.lockfile_write_path();
-    const existing = installed_lock.read_lockfile(read_path);
+function _report_global_install(version: string, out: OutSink): void {
+    const existing = installed_lock.read_lockfile(installed_lock.lockfile_path());
     if (existing === null) {
         return;
     }
     const recorded = (existing as unknown as Record<string, unknown>)['agent_config_version'];
-    const tools = [...(existing.tools ?? [])];
-    if (recorded === version && read_path === write_path) {
-        _print(out, `ℹ️  ${write_path} already records ${version}.`);
+    if (typeof recorded !== 'string' || !update_check._is_newer(version, _normalize(recorded))) {
         return;
     }
-    installed_lock.write_lockfile(version, tools, { path: write_path });
-    _print(out, `✅  Refreshed global lockfile at ${write_path}.`);
+    _print(
+        out,
+        `ℹ️  The global install is ${_normalize(recorded)}; this pin does not change it. ` +
+            `Run \`agent-config upgrade\` to install ${version} globally.`,
+    );
 }
 
 /** Read `version` from the package's own `package.json`. */

package/src/scripts/_lib/bench_ab_complexity.ts

@@ -62,7 +62,15 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 
 import { getParser, type TsNode } from '../code_graph/loader.js';
-import { EXT_LANG, type Lang } from '../code_graph/types.js';
+import { EXT_LANG } from '../code_graph/types.js';
+
+/**
+ * The languages whose node vocabulary below was read off a real parse. The
+ * engine indexes more; a language without a probed vocabulary would score 0
+ * silently, so it is not scored at all.
+ */
+type Lang = 'javascript' | 'typescript' | 'php';
+const SCORED: ReadonlySet<string> = new Set<Lang>(['javascript', 'typescript', 'php']);
 
 export interface FunctionComplexity {
     /** Declared name, or `<anon>` for an unnamed closure/arrow. */
@@ -349,7 +357,11 @@ function logicalOperands(root: TsNode, lang: Lang): TsNode[] {
 
 export function langForPath(relPath: string): Lang | null {
     const ext = path.extname(relPath).toLowerCase();
-    return (EXT_LANG as Record<string, Lang | undefined>)[ext] ?? null;
+    // `.vue` maps to typescript for the engine only after its template is
+    // blanked; scored raw here it would read markup as code.
+    if (ext === '.vue') return null;
+    const lang = (EXT_LANG as Record<string, string | undefined>)[ext];
+    return lang !== undefined && SCORED.has(lang) ? (lang as Lang) : null;
 }
 
 /** Cognitive complexity of every function unit in one source string. */

package/src/scripts/_lib/collector_record.ts

@@ -49,6 +49,7 @@ export const COLLECTOR_EVENTS = [
     'agent_error',
     'subagent_start',
     'subagent_stop',
+    'instructions_loaded',
 ] as const;
 export type CollectorEvent = (typeof COLLECTOR_EVENTS)[number];
 

package/src/scripts/_lib/council_settings_block.ts

@@ -16,8 +16,8 @@
  * `load_settings` does not hand `build_members` the config FILE — it hands it
  * this block. So a key the loader validates and this projection drops is
  * enforced at load and invisible at runtime. That has now happened to
- * `quorum`, to `quorum_min_present`, and to `fallback.api_on_quota` in turn;
- * each carries its own comment below. A new key belongs in BOTH places or in
+ * `quorum`, to `quorum_min_present`, to `fallback.api_on_quota`, and to a
+ * member's `base_url` route fields in turn; each carries its own comment below. A new key belongs in BOTH places or in
  * neither.
  */
 
@@ -48,6 +48,13 @@ export function synthesizeAiCouncilBlock(cfg: CouncilConfig): Dict {
         if (m.prompt_cache_ttl !== '5m') {
             entry['prompt_cache_ttl'] = m.prompt_cache_ttl;
         }
+        // Dropping these turned every configured `base_url` route into an
+        // unknown provider at `build_members`, so no free route was ever built.
+        if (m.route) {
+            entry['base_url'] = m.route.base_url;
+            entry['content_ceiling'] = m.route.declared_ceiling;
+            if (m.route.proof !== null) entry['billing_proof'] = { ...m.route.proof };
+        }
         members[name] = entry;
     }
     const advisors: Dict = {};

package/src/scripts/_lib/egress_rules.ts

@@ -198,7 +198,10 @@ export function pemMaskEnd(text: string, span: SpanBounds): number | null {
 
 // IBAN length per country (ISO 13616 registry), packed as `CCnn` pairs. A country
 // missing here leaves its IBANs unmasked, so the table errs towards inclusion.
-const IBAN_LENGTHS =
+// Checked 2026-10-22 against the registry's Release 103: all 89 countries and
+// lengths agree. The test pins this release to the table's digest.
+export const IBAN_REGISTRY_RELEASE = 103;
+export const IBAN_LENGTHS =
     'AD24AE23AL28AT20AZ28BA20BE16BG22BH22BI27BR29BY28CH21CR22CY28CZ24DE22DJ27DK18DO28EE20EG29ES24FI18FK18FO18FR27GB22GE22GI23GL18GR27GT28HN28HR21HU28IE22IL23IQ23IS26IT27JO30KW30KZ20LB28LC32LI21LT20LU20LV21LY25MC27MD24ME22MK19MN20MR27MT31MU30NI28NL18NO15OM23PK24PL28PS29PT25QA29RO24RS22RU33SA24SC31SD18SE24SI19SK24SM27SO23ST25SV28TL23TN24TR26UA29VA22VG24XK20YE30';
 
 export function isValidIban(value: string): boolean {

package/src/scripts/_lib/host_capability.ts

@@ -365,19 +365,24 @@ export function resolveHostCapabilities(
  * settings decision, so there is no override parameter here (that stays on
  * {@link resolveHostCapabilities} for back-compat callers only).
  *
- * The one probed fact today: `agent_teams` resolves `true` when
+ * Two probed facts today. `agent_teams` resolves `true` when
  * `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS` is set (any non-empty value) in the
  * process environment — the one host fact this repo can observe about Claude
  * Code's documented-but-unshipped-by-default multi-instance Agent Teams
  * primitive. A registry row can also carry `agent_teams: true` directly for a
  * host where it is unconditionally available; the two sources OR together —
- * a probe never turns a registry-granted capability back off.
+ * a probe never turns a registry-granted capability back off. `worker_resume`
+ * follows the same flag on `claude` only, because the by-name re-task was
+ * observed there under it and nowhere else.
  */
 export function probeHostCapabilities(hostId: string | null | undefined): HostCapabilityManifest {
     const base = resolveHostCapabilities(hostId);
     const flag = process.env.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS;
     const probedAgentTeams = typeof flag === 'string' && flag !== '';
-    return { ...base, agent_teams: base.agent_teams || probedAgentTeams };
+    // By-name resume was observed on claude only under this flag (cold-start
+    // 1.4, 2.1.306); council 2026-10-22 decision 1 made it a live probe.
+    const probedResume = probedAgentTeams && hostId === 'claude';
+    return { ...base, agent_teams: base.agent_teams || probedAgentTeams, worker_resume: base.worker_resume || probedResume };
 }
 
 /** Every manifest field that carries a capability answer (i.e. not `schema_version`). */
@@ -448,9 +453,9 @@ export function describeHostCapabilities(
         // A row entry claims the field whatever its value: an explicit
         // `false` in the table is an observation ("checked, absent"), which is
         // a different fact from the default's "nobody answered".
-        if (row !== undefined && typeof row[field] === 'boolean') {
+        if (row !== undefined && typeof row[field] === 'boolean' && !(row[field] === false && manifest[field] === true)) {
             sources[field] = 'registry';
-        } else if (field === 'agent_teams' && probedAgentTeams) {
+        } else if ((field === 'agent_teams' || (field === 'worker_resume' && hostId === 'claude')) && probedAgentTeams) {
             sources[field] = 'live-probe';
         } else {
             sources[field] = 'default';

package/src/scripts/_lib/identifier_redaction.ts

@@ -7,11 +7,47 @@
  * error and a context word is not required here. The rows' checksums still
  * hold — a number that fails Luhn is not a card, a string that fails mod-97 is
  * not an IBAN. The tag spelling and the counter keys are this consumer's.
+ *
+ * Without the context word a digit row must stand on its own shape, so the store
+ * tightens four rows where tree text measured false positives (PREREG (b), store
+ * reading): phone and card digits may not touch a letter on either side (a
+ * digit-led hex SHA is not a card) nor follow a decimal point, and a national
+ * number may not continue a `-` or `/` list (`ADR-046/047`); a leading `+` at a line start — a diff's added
+ * line — needs a grouped number (`+49 30 …`), a dotted quad is never a phone, and
+ * a North-American number keeps its context word unless it is written formatted,
+ * because a bare ten-digit integer (`2147483647`) has the same digits.
  */
 import { detect, type EgressRule, IDENTIFIER_RULES, replaceSpans } from './egress_rules.js';
 
-/** The identifier rows with every context requirement dropped. */
-export const STORAGE_IDENTIFIER_RULES: readonly EgressRule[] = IDENTIFIER_RULES.map(({ context: _context, ...rest }) => rest);
+/** Store patterns for the rows the shape alone cannot carry; the rest are the table's own. */
+const STORE_PATTERN: Readonly<Record<string, RegExp>> = {
+    'payment-card': /(?<![0-9A-Za-z.])[0-9](?:[ -]?[0-9]){12,18}(?![0-9A-Za-z])/g,
+    'phone-international':
+        /(?<![A-Za-z0-9+])(?:(?<!^|\n)|(?=\+[1-9][0-9]{0,2}[ (]))\+[1-9][0-9]{0,2}(?:[ ./-]?(?:\([0-9]{1,6}\)|(?=([0-9]{1,6}))\1)){1,5}(?![0-9A-Za-z])/g,
+    'phone-national': /(?<![A-Za-z0-9+(./-])(?:\(0[1-9][0-9]{1,4}\)|0[1-9][0-9]{1,4})(?:[ ./-]?(?=([0-9]{2,8}))\1){1,3}(?![0-9A-Za-z])/g,
+};
+
+const DOTTED_QUAD = /^\+?[0-9]{1,3}(?:\.[0-9]{1,3}){3}$/;
+
+/** A North-American number that is written as one: two separators, or a bracketed area code. */
+function isFormattedNanp(value: string): boolean {
+    return value.includes('(') || (value.match(/[ .-]/g) ?? []).length >= 2;
+}
+
+function storeRow(row: EgressRule): EgressRule[] {
+    const { context: _context, ...rest } = row;
+    if (row.rule === 'phone-nanp') {
+        // Two rows: the table's own with its context word, and a formatted shape without one.
+        return [row, { ...rest, rule: 'phone-nanp-formatted', validator: isFormattedNanp }];
+    }
+    const pattern = STORE_PATTERN[row.rule];
+    if (!pattern) return [rest];
+    if (row.rule === 'phone-international') return [{ ...rest, pattern, exclusions: [...(rest.exclusions ?? []), DOTTED_QUAD] }];
+    return [{ ...rest, pattern }];
+}
+
+/** The identifier rows as the stores read them: context dropped, except where shape alone is not evidence. */
+export const STORAGE_IDENTIFIER_RULES: readonly EgressRule[] = IDENTIFIER_RULES.flatMap(storeRow);
 
 /** Counter key and tag per placeholder type; `CC` predates the table's `CARD`. */
 const TAG: Readonly<Record<string, string>> = { CARD: 'CC' };

package/src/scripts/_lib/price_freshness.ts

@@ -0,0 +1,112 @@
+/**
+ * A price row is evidence with a date, and it expires.
+ *
+ * `internal/bench/pricing.yaml` priced a `claude-haiku-5-5` leg with a row sourced
+ * 2026-05-14 for a former Haiku generation at 2.5x the served model's rate, and the
+ * cost verdict read it without complaint. A row now refuses to price when it is
+ * older than PRICE_MAX_AGE_DAYS, when it names no source model (nothing vouches for
+ * its generation), when its source model is an older generation than the served
+ * one, or when it belongs to another model family. A refusal is a reason string,
+ * never a zero price.
+ */
+import { load as yamlLoad } from 'js-yaml';
+
+export const PRICE_MAX_AGE_DAYS = 120;
+
+const FAMILIES = ['haiku', 'sonnet', 'opus', 'fable', 'mythos'] as const;
+
+/** USD per million tokens. */
+export interface Rates {
+    input: number;
+    output: number;
+    cache_write: number;
+    cache_read: number;
+}
+
+export interface PriceRow extends Rates {
+    /** Lookup key: a family (`haiku`) or a full model id (`claude-haiku-5-5`). */
+    tier: string;
+    /** ISO date the rates were read from `source`. */
+    sourced_on: string;
+    source?: string;
+    /** The model whose published rates these are. */
+    model?: string;
+}
+
+function familyOf(id: string): string | null {
+    const m = id.toLowerCase();
+    return FAMILIES.find((f) => m.includes(f)) ?? null;
+}
+
+/** `claude-haiku-5-5` → 5.5, `claude-fable-5` → 5; a trailing 8-digit date is not a minor. */
+export function modelGeneration(id: string): number | null {
+    const m = id.toLowerCase().match(/(?:haiku|sonnet|opus|fable|mythos)-(\d{1,2})(?:-(\d{1,2}))?(?![0-9])/);
+    if (!m) return null;
+    return Number(m[1]) + (m[2] === undefined ? 0 : Number(m[2]) / 10);
+}
+
+const DAY_MS = 86_400_000;
+
+export function priceRefusal(row: PriceRow, servedModel: string, asOf: Date): string | null {
+    const sourced = /^\d{4}-\d{2}-\d{2}$/.test(row.sourced_on) ? Date.parse(`${row.sourced_on}T00:00:00Z`) : Number.NaN;
+    if (Number.isNaN(sourced)) return `price row ${row.tier} carries no readable sourced_on date`;
+    const ageDays = Math.floor((asOf.getTime() - sourced) / DAY_MS);
+    if (ageDays > PRICE_MAX_AGE_DAYS) {
+        return `price row ${row.tier} is ${ageDays} days old (sourced ${row.sourced_on}), beyond the ${PRICE_MAX_AGE_DAYS}-day bound`;
+    }
+    const servedFamily = familyOf(servedModel);
+    if (servedFamily === null || familyOf(row.model ?? row.tier) !== servedFamily) {
+        return `price row ${row.tier} is not of the family of served model ${servedModel}`;
+    }
+    if (!row.model) return `price row ${row.tier} names no source model, so nothing vouches for its generation`;
+    const rowGen = modelGeneration(row.model);
+    const servedGen = modelGeneration(servedModel);
+    if (rowGen === null || servedGen === null) return `cannot read the generation of ${row.model} or ${servedModel}`;
+    if (servedGen > rowGen) {
+        return `price row ${row.tier} is sourced for generation ${rowGen} (${row.model}); served model ${servedModel} is generation ${servedGen}`;
+    }
+    return null;
+}
+
+/** The served model's own row first, then its family's; the first refusal is reported. */
+export function selectPrice(rows: readonly PriceRow[], servedModel: string, asOf: Date): { price: Rates; row: PriceRow } | { refusal: string } {
+    const id = servedModel.toLowerCase();
+    const family = familyOf(id);
+    const candidates = [...rows.filter((r) => r.tier.toLowerCase() === id), ...rows.filter((r) => family !== null && r.tier.toLowerCase() === family)];
+    if (candidates.length === 0) return { refusal: `no price row for served model ${servedModel}` };
+    let first: string | null = null;
+    for (const row of candidates) {
+        const why = priceRefusal(row, servedModel, asOf);
+        if (why === null) {
+            return { price: { input: row.input, output: row.output, cache_write: row.cache_write, cache_read: row.cache_read }, row };
+        }
+        first ??= why;
+    }
+    return { refusal: first! };
+}
+
+function isoDate(v: unknown): string {
+    if (v instanceof Date) return v.toISOString().slice(0, 10);
+    return typeof v === 'string' ? v : '';
+}
+
+/** Rows of a `pricing.yaml` document; a row without a tier is skipped. */
+export function parsePriceRows(yamlText: string): PriceRow[] {
+    const doc = yamlLoad(yamlText) as { models?: unknown } | null;
+    const models = Array.isArray(doc?.models) ? (doc.models as Record<string, unknown>[]) : [];
+    const rows: PriceRow[] = [];
+    for (const m of models) {
+        if (!m || typeof m['tier'] !== 'string') continue;
+        rows.push({
+            tier: m['tier'],
+            ...(typeof m['model'] === 'string' ? { model: m['model'] } : {}),
+            sourced_on: isoDate(m['sourced_on']),
+            ...(typeof m['source'] === 'string' ? { source: m['source'] } : {}),
+            input: Number(m['input']),
+            output: Number(m['output']),
+            cache_write: Number(m['cache_write']),
+            cache_read: Number(m['cache_read']),
+        });
+    }
+    return rows;
+}

package/src/scripts/_lib/production_reach.ts

@@ -0,0 +1,194 @@
+/**
+ * Which `src/` symbols a production entry reaches (road-to-a-tick-the-shipped-path-earns 3.1).
+ *
+ * Static and name-level, the same reading as `dispatch_import_closure`: relative specifiers only,
+ * dynamic `import()` not followed. A symbol counts as reached when some module
+ * in the closure imports it BY NAME from its defining module (or imports that
+ * module whole), or when the defining module is itself an entry. Reaching the
+ * module is not enough — `egress_normalize.ts` is in the closure for one regex
+ * while `detectNormalized` has no production importer, and that is the case
+ * this exists to see.
+ */
+import { spawnSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+export const ENTRIES_CONFIG_REL = 'src/config/production-entries.json';
+
+export interface ReachTree {
+    list(): readonly string[];
+    read(rel: string): string | null;
+}
+
+/** The checkout under `root`: tracked plus untracked-not-ignored files. */
+export function worktreeOf(root: string): ReachTree {
+    let files: string[] | null = null;
+    return {
+        list() {
+            if (files === null) {
+                const res = spawnSync('git', ['ls-files', '--cached', '--others', '--exclude-standard'], {
+                    cwd: root,
+                    encoding: 'utf-8',
+                    maxBuffer: 64 * 1024 * 1024,
+                });
+                files = res.status === 0 ? res.stdout.split('\n').filter((l) => l !== '') : [];
+            }
+            return files;
+        },
+        read(rel) {
+            const abs = path.join(root, rel);
+            return fs.existsSync(abs) && fs.statSync(abs).isFile() ? fs.readFileSync(abs, 'utf-8') : null;
+        },
+    };
+}
+
+/** A commit's tree, read from objects — for replaying an old range. */
+export function commitTreeOf(root: string, ref: string): ReachTree {
+    const ls = spawnSync('git', ['ls-tree', '-r', '--name-only', ref], { cwd: root, encoding: 'utf-8', maxBuffer: 64 * 1024 * 1024 });
+    const files = ls.status === 0 ? ls.stdout.split('\n').filter((l) => l !== '') : [];
+    const present = new Set(files);
+    return {
+        list: () => files,
+        read(rel) {
+            if (!present.has(rel)) return null;
+            const res = spawnSync('git', ['show', `${ref}:${rel}`], { cwd: root, encoding: 'utf-8', maxBuffer: 64 * 1024 * 1024 });
+            return res.status === 0 ? res.stdout : null;
+        },
+    };
+}
+
+export function globToRegExp(glob: string): RegExp {
+    let re = '';
+    for (let i = 0; i < glob.length; i += 1) {
+        const c = glob[i] as string;
+        if (c === '*' && glob[i + 1] === '*') {
+            re += glob[i + 2] === '/' ? '(?:.*/)?' : '.*';
+            i += glob[i + 2] === '/' ? 2 : 1;
+        } else if (c === '*') re += '[^/]*';
+        else re += c.replace(/[.+?^${}()|[\]\\]/g, '\\$&');
+    }
+    return new RegExp(`^${re}$`);
+}
+
+/** Resolve a `.js` specifier from `fromRel` to the source it names in `tree`. */
+function resolve(tree: ReachTree, fromRel: string, spec: string): string | null {
+    const base = path.posix.join(path.posix.dirname(fromRel), spec);
+    for (const c of [base.replace(/\.js$/, '.ts'), base, `${base}.ts`, `${base}/index.ts`]) {
+        const norm = path.posix.normalize(c);
+        if (tree.read(norm) !== null) return norm;
+    }
+    return null;
+}
+
+/** `{ a, b as c }` → `['a', 'b']`; `* as ns` and a default import → `['*']`. */
+export function importedNames(clause: string): string[] {
+    const names: string[] = [];
+    const braces = /\{([^}]*)\}/.exec(clause);
+    if (braces) {
+        for (const part of (braces[1] as string).split(',')) {
+            const name = part.trim().replace(/^type\s+/, '').split(/\s+as\s+/)[0]?.trim();
+            if (name) names.push(name);
+        }
+    }
+    const outside = clause.replace(/\{[^}]*\}/, '');
+    if (/\*\s+as\s+\w+/.test(outside) || /^\s*(?:type\s+)?[A-Za-z_$][\w$]*\s*(?:,|$)/.test(outside)) names.push('*');
+    return names;
+}
+
+export interface ModuleImport {
+    readonly target: string;
+    readonly names: readonly string[];
+}
+
+/** Every relative import of `rel`, resolved, with the names it takes. */
+export function moduleImports(tree: ReachTree, rel: string): ModuleImport[] {
+    const source = (tree.read(rel) ?? '').replace(/\/\*[\s\S]*?\*\//g, '').replace(/(^|[^:])\/\/.*$/gm, '$1');
+    const out: ModuleImport[] = [];
+    const re = /\b(import|export)\s+(?:type\s+)?((?:(?!\b(?:import|export)\b)[^;'"])*?)\bfrom\s*['"](\.{1,2}\/[^'"]+)['"]|\bimport\s*['"](\.{1,2}\/[^'"]+)['"]/g;
+    let m: RegExpExecArray | null;
+    while ((m = re.exec(source)) !== null) {
+        const spec = (m[3] ?? m[4]) as string;
+        const target = resolve(tree, rel, spec);
+        if (target === null) continue;
+        out.push({ target, names: m[4] !== undefined ? [] : importedNames(m[2] ?? '') });
+    }
+    return out;
+}
+
+/** Entries from the committed config: the fixed list plus every script an entry source names. */
+export function productionEntries(tree: ReachTree): string[] {
+    const raw = tree.read(ENTRIES_CONFIG_REL);
+    if (raw === null) return [];
+    const cfg = JSON.parse(raw) as { entries?: string[]; entry_sources?: string[] };
+    const entries = new Set((cfg.entries ?? []).filter((e) => tree.read(e) !== null));
+    const sources = (cfg.entry_sources ?? []).map(globToRegExp);
+    for (const file of tree.list()) {
+        if (!sources.some((re) => re.test(file))) continue;
+        for (const m of (tree.read(file) ?? '').matchAll(/(?:src\/)?scripts\/([A-Za-z0-9_/.-]+?)(?:\.ts)?(?![A-Za-z0-9_/.-])/g)) {
+            const candidate = `src/scripts/${m[1] as string}.ts`;
+            if (tree.read(candidate) !== null) entries.add(candidate);
+        }
+    }
+    return [...entries].sort();
+}
+
+/**
+ * Exports the module's own code also uses — named again after their declaration.
+ * A reached module's `main` runs its helpers without importing them, so a helper
+ * a concern calls is reached; one only its test calls is not.
+ */
+export function usedExports(source: string): string[] {
+    const code = source.replace(/\/\*[\s\S]*?\*\//g, '').replace(/(^|[^:])\/\/.*$/gm, '$1');
+    const out: string[] = [];
+    for (const m of code.matchAll(/\bexport\s+(?:declare\s+)?(?:async\s+)?(?:function\*?|const|let|class|interface|type|enum)\s+([A-Za-z_$][\w$]*)/g)) {
+        const name = m[1] as string;
+        const uses = code.match(new RegExp(`(?<![\\w$.])${name.replace(/\$/g, '\\$')}(?![\\w$])`, 'g'))?.length ?? 0;
+        if (uses >= 2) out.push(name);
+    }
+    return out;
+}
+
+export interface Reach {
+    readonly entries: ReadonlySet<string>;
+    readonly modules: ReadonlySet<string>;
+    /** `<module>#<name>`; `<module>#*` when a closure module takes it whole. */
+    readonly symbols: ReadonlySet<string>;
+}
+
+export function productionReach(tree: ReachTree, extra: readonly string[] = []): Reach {
+    const entries = new Set([...productionEntries(tree), ...extra.filter((e) => tree.read(e) !== null)]);
+    const modules = new Set<string>();
+    const symbols = new Set<string>();
+    const queue = [...entries];
+    while (queue.length > 0) {
+        const rel = queue.shift() as string;
+        if (modules.has(rel)) continue;
+        modules.add(rel);
+        for (const name of usedExports(tree.read(rel) ?? '')) symbols.add(`${rel}#${name}`);
+        for (const imp of moduleImports(tree, rel)) {
+            for (const n of imp.names) symbols.add(`${imp.target}#${n}`);
+            if (!modules.has(imp.target)) queue.push(imp.target);
+        }
+    }
+    return { entries, modules, symbols };
+}
+
+/** The `src/` symbols a test takes, and whether production reaches at least one. */
+export function testReaches(tree: ReachTree, reach: Reach, testRel: string): { taken: string[]; reached: string[] } {
+    const taken: string[] = [];
+    const reached: string[] = [];
+    for (const imp of moduleImports(tree, testRel)) {
+        if (!imp.target.startsWith('src/') || /\.test\.ts$/.test(imp.target)) continue;
+        for (const n of imp.names.length ? imp.names : ['*']) {
+            const key = `${imp.target}#${n}`;
+            taken.push(key);
+            const hit =
+                reach.entries.has(imp.target) ||
+                reach.symbols.has(key) ||
+                reach.symbols.has(`${imp.target}#*`) ||
+                (n === '*' && reach.modules.has(imp.target));
+            if (hit) reached.push(key);
+        }
+    }
+    return { taken, reached };
+}

package/src/scripts/_lib/quota_parked.ts

@@ -60,7 +60,9 @@ export function markerFile(repoRoot: string, runId: string): string {
  *
  * Idempotent on the timestamp: a second park inside one run keeps the original
  * `parked_at` and merges the provider set, so "when did this run first hit the
- * cliff" survives a round that parks twice.
+ * cliff" survives a round that parks twice. A host park is the exception: it
+ * sets its own `source` and refreshes `parked_at`, since the host's rate window
+ * starts at its own signal, not at an earlier council park.
  */
 export function writeQuotaParked(
     repoRoot: string,
@@ -71,12 +73,13 @@ export function writeQuotaParked(
 ): QuotaParkedMarker {
     const file = markerFile(repoRoot, runId);
     const existing = readMarker(file);
+    const host = source === 'host';
     const merged = [...new Set([...(existing?.providers ?? []), ...providers])].sort();
     const marker: QuotaParkedMarker = {
         run_id: runId,
         providers: merged,
-        parked_at: existing?.parked_at ?? now().toISOString(),
-        source: existing?.source ?? source,
+        parked_at: (host ? null : existing?.parked_at) ?? now().toISOString(),
+        source: host ? source : (existing?.source ?? source),
     };
     fs.mkdirSync(path.dirname(file), { recursive: true });
     fs.writeFileSync(file, `${JSON.stringify(marker, null, 2)}\n`, 'utf8');
@@ -106,20 +109,7 @@ export function clearQuotaParked(repoRoot: string, runId: string): void {
  * per parked run, so the scan is cheap by construction.
  */
 export function findQuotaParked(repoRoot: string, sessionId: string): QuotaParkedMarker | null {
-    const direct = readMarker(markerFile(repoRoot, sessionId));
-    if (direct !== null) return direct;
-    let names: string[];
-    try {
-        names = fs.readdirSync(path.join(repoRoot, QUOTA_PARKED_DIR_REL));
-    } catch {
-        return null;
-    }
-    for (const name of names) {
-        if (!name.endsWith('.json')) continue;
-        const m = readMarker(path.join(repoRoot, QUOTA_PARKED_DIR_REL, name));
-        if (m !== null && m.run_id === sessionId) return m;
-    }
-    return null;
+    return readMarker(markerFile(repoRoot, sessionId)) ?? allMarkers(repoRoot).find((m) => m.run_id === sessionId) ?? null;
 }
 
 /** The plan's rolling rate window; a host marker older than this no longer describes it. */
@@ -127,20 +117,19 @@ export const HOST_RATE_WINDOW_MS = 5 * 3_600_000;
 
 /** True when a host-sourced marker was parked inside the rate window ending at `nowMs`. */
 export function recentHostMarker(repoRoot: string, nowMs: number = Date.now(), windowMs: number = HOST_RATE_WINDOW_MS): boolean {
-    let names: string[];
+    return allMarkers(repoRoot).some((m) => {
+        const age = nowMs - Date.parse(m.parked_at);
+        return m.source === 'host' && age >= 0 && age < windowMs;
+    });
+}
+
+function allMarkers(repoRoot: string): QuotaParkedMarker[] {
+    const dir = path.join(repoRoot, QUOTA_PARKED_DIR_REL);
     try {
-        names = fs.readdirSync(path.join(repoRoot, QUOTA_PARKED_DIR_REL));
+        return fs.readdirSync(dir).flatMap((n) => (n.endsWith('.json') ? (readMarker(path.join(dir, n)) ?? []) : []));
     } catch {
-        return false;
-    }
-    for (const name of names) {
-        if (!name.endsWith('.json')) continue;
-        const m = readMarker(path.join(repoRoot, QUOTA_PARKED_DIR_REL, name));
-        if (m === null || m.source !== 'host') continue;
-        const at = Date.parse(m.parked_at);
-        if (Number.isFinite(at) && nowMs - at >= 0 && nowMs - at < windowMs) return true;
+        return [];
     }
-    return false;
 }
 
 function readMarker(file: string): QuotaParkedMarker | null {