@event4u/agent-config 9.13.0 → 9.15.0

package/src/scripts/audit_user_type_axis.ts

@@ -8,19 +8,22 @@
  * split, byte-identical stdout summary, AND byte-identical generated
  * Markdown report. Stdlib-only — no YAML dependency.
  *
- * Two checks across `.agent-src.uncondensed/skills/`:
+ * Two checks across `src/skills/`:
  *
  *   1. Orphan values — every `recommended_for_user_types` value must have a
- *      `user-types/<value>.yml` config. Orphans are FATAL (exit 1).
+ *      `user-types/<value>.yml` config. Orphans are FATAL (exit 1), subject to
+ *      the recorded violation ratchet.
  *   2. Unused configs — every `user-types/*.yml` should be consumed by at
  *      least one skill. Unused configs are WARN-only (exit 0).
  *
- * NOTE: the retired Python implementation scans only the LEGACY `.agent-src.uncondensed/
- * skills/` root (not the 6.0.0-D `src/skills/` library). This twin replicates
- * that exact root for byte-identical parity. The report path is
- * `agents/reports/user-type-axis-audit.md` (matching the Python constant,
- * which differs from the docstring's `agents/runtime/reports/` mention —
- * latent bug replicated).
+ * NOTE: the retired Python implementation scanned only the pre-ADR-051 source
+ * container, and this twin inherited that root verbatim for byte parity — which
+ * meant it scanned nothing at all once the container was emptied. Repaired
+ * 2026-08-02 to `src/skills`; byte-parity with the .py is deliberately given up
+ * here, because parity with a scan of zero files is not a property worth
+ * keeping. The report path is `agents/reports/user-type-axis-audit.md`
+ * (matching the Python constant, which differs from the docstring's
+ * `agents/runtime/reports/` mention — latent bug replicated).
  *
  * Historical quirks are preserved deliberately — tests and downstream consumers pin the exact behaviour.
  */
@@ -29,11 +32,21 @@ import * as path from 'node:path';
 import process from 'node:process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
+import { SRC_SKILLS } from './_lib/agent_src.js';
+import { checkRatchet } from './_lib/gate_baseline.js';
+import { DeadScopeError, assertScanned } from './_lib/scan_scope.js';
+
 const _HERE = fileURLToPath(import.meta.url);
 
 // src/scripts/audit_user_type_axis.ts → parents[2] of the .py file is repo root.
 export const REPO_ROOT = path.resolve(path.dirname(_HERE), '..', '..');
-export const SKILLS_ROOT = path.join(REPO_ROOT, '.agent-src.uncondensed', 'skills');
+/**
+ * ADR-051 moved skill authoring to `src/skills`. This still named the retired
+ * container, so `_scan_skill_values()` took its `!_isDir` early return and the
+ * audit reported `used=0 orphans=0` — a clean verdict derived from reading
+ * nothing, with all 7 declared user types written off as "unused".
+ */
+export const SKILLS_ROOT = SRC_SKILLS();
 export const USER_TYPES_ROOT = path.join(REPO_ROOT, 'user-types');
 export const REPORT_PATH = path.join(REPO_ROOT, 'agents', 'reports', 'user-type-axis-audit.md');
 
@@ -228,6 +241,24 @@ export function _render_report(
 
 export function main(argv: string[]): number {
     const quiet = argv.includes('--quiet');
+    // Scope assertion: the orphan/unused verdict is a set difference against
+    // the skills corpus, so an unreadable corpus does not yield "no orphans",
+    // it yields a vacuous answer that looks identical to a clean one.
+    const scannedSkills = _isDir(SKILLS_ROOT) ? _rglobSkillMd(SKILLS_ROOT).length : 0;
+    try {
+        assertScanned({
+            gate: 'audit_user_type_axis',
+            scanned: scannedSkills,
+            units: 'skill file(s)',
+            roots: [_relativeToPosix(SKILLS_ROOT, REPO_ROOT)],
+        });
+    } catch (exc) {
+        if (!(exc instanceof DeadScopeError)) {
+            throw exc;
+        }
+        process.stderr.write(`❌  ${exc.message}\n`);
+        return 2;
+    }
     const declared = _declared_user_types();
     const byValue = _scan_skill_values();
     const used = new Set<string>(byValue.keys());
@@ -242,7 +273,8 @@ export function main(argv: string[]): number {
     if (!quiet) {
         process.stdout.write(
             `user-type-axis audit — declared=${declared.size} ` +
-                `used=${used.size} orphans=${orphans.size} unused=${unused.size}\n`,
+                `used=${used.size} orphans=${orphans.size} unused=${unused.size} ` +
+                `(${scannedSkills} skill file(s) scanned)\n`,
         );
         if (orphans.size > 0) {
             process.stdout.write('  FAIL orphans: ' + _sorted(orphans).join(', ') + '\n');
@@ -253,7 +285,22 @@ export function main(argv: string[]): number {
         process.stdout.write(`  report: ${_relativeToPosix(REPORT_PATH, REPO_ROOT)}\n`);
     }
 
-    return orphans.size > 0 ? 1 : 0;
+    if (orphans.size === 0) {
+        return 0;
+    }
+    const verdict = checkRatchet({
+        gate: 'audit_user_type_axis',
+        actual: orphans.size,
+        repoRoot: REPO_ROOT,
+    });
+    if (verdict.ok) {
+        if (!quiet) {
+            process.stdout.write(`⚠️   ${verdict.message}\n`);
+        }
+        return 0;
+    }
+    process.stderr.write(`❌  ${verdict.message}\n`);
+    return 1;
 }
 
 function _isCliEntry(): boolean {

package/src/scripts/bench_hook_latency.ts

@@ -12,12 +12,20 @@
  *     ./scripts-run src/scripts/bench_hook_latency            # measure + print
  *     ./scripts-run src/scripts/bench_hook_latency --gate     # enforce budget
  *     ./scripts-run src/scripts/bench_hook_latency --update   # record numbers
+ *     ./scripts-run src/scripts/bench_hook_latency --via-cli  # real consumer path
  *
  * Method (pinned so numbers reproduce):
- *   - N invocations per hook event (default 50, --runs N) of
- *     `node dist/hooks/dispatch.js --platform claude --event <e>` with a
- *     synthetic payload on stdin and a throwaway temp workspace as
- *     --project-dir (concern state lands there, never in the repo).
+ *   - N invocations per hook event (default 50, --runs N) with a synthetic
+ *     payload on stdin and a throwaway temp workspace as --project-dir
+ *     (concern state lands there, never in the repo). Two invocation paths:
+ *       default    — `node dist/hooks/dispatch.js --platform claude
+ *                    --event <e>` (the bare bundle).
+ *       --via-cli  — the EXACT command line `hooks/hooks.json` installs
+ *                    (bash wrapper + project-shim probe +
+ *                    `agent-config dispatch:hook … --native-event …
+ *                    --min-version 1`), i.e. the path consumers actually
+ *                    pay per hook event (road-to-hook-latency-repair
+ *                    Phase 1).
  *   - AGENT_CONFIG_REPLAY=1 (feedback-dir writes off — measures dispatch,
  *     not audit-trail I/O).
  *   - Wall-clock per invocation around spawnSync; p50/p95 per event.
@@ -25,11 +33,19 @@
  * Gate semantics (--gate):
  *   - pre_tool_use p95 must be ≤ budgets_ms.pre_tool_use.p95_ci
  *   - every event p95 must be ≤ budgets_ms.any_hook_event.p95_ci
- *   - when docs/hook-latency.json exists, a p95 regression beyond
- *     regression_gate.max_regression_pct fails.
+ *   - when docs/hook-latency.json exists AND its recorded invocation_path
+ *     matches this run's path, a p95 regression beyond
+ *     regression_gate.max_regression_pct fails (mismatched paths skip the
+ *     regression net — absolute budgets still bind).
  *   Budgets: src/config/hook-latency-budget.json (pre-registered, owner +
  *   review date — see the Phase-6 budget-ownership lint).
  *
+ * Baseline history (--baseline "<hardware class>"): appends this run to the
+ * `history` array in docs/hook-latency.json — invocation path, hardware
+ * class, per-event p50/p95 — WITHOUT touching the top-level results the
+ * regression net compares against. Used to commit the pre-fix CLI-path
+ * numbers before the Phase-2 levers landed.
+ *
  * Exit codes: 0 green · 1 budget/regression exceeded · 2 internal error.
  */
 import { spawnSync } from 'node:child_process';
@@ -37,9 +53,13 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { build_claude_hook_matrix } from './_lib/claude_settings_hooks.js';
 
 const REPO_ROOT = path.resolve(fileURLToPath(import.meta.url), '..', '..', '..');
 const BUNDLE = path.join(REPO_ROOT, 'dist', 'hooks', 'dispatch.js');
+const CLI_BIN = path.join(REPO_ROOT, 'dist', 'cli', 'agent-config.js');
+const SHIM = path.join(REPO_ROOT, 'agent-config');
+const MANIFEST_PATH = path.join(REPO_ROOT, 'src', 'scripts', 'hook_manifest.yaml');
 const BUDGET_PATH = path.join(REPO_ROOT, 'src', 'config', 'hook-latency-budget.json');
 const RESULTS_PATH = path.join(REPO_ROOT, 'docs', 'hook-latency.json');
 
@@ -52,6 +72,18 @@ const EVENTS: readonly string[] = [
     'session_end',
 ];
 
+/** snake_case hook event → the platform-native name hooks.json passes. */
+const NATIVE_EVENT: Readonly<Record<string, string>> = {
+    pre_tool_use: 'PreToolUse',
+    post_tool_use: 'PostToolUse',
+    user_prompt_submit: 'UserPromptSubmit',
+    stop: 'Stop',
+    session_start: 'SessionStart',
+    session_end: 'SessionEnd',
+};
+
+export type InvocationPath = 'bundle' | 'cli';
+
 interface EventResult {
     event: string;
     runs: number;
@@ -79,29 +111,49 @@ function syntheticPayload(event: string, workspace: string): string {
     });
 }
 
-export function benchEvent(event: string, runs: number, workspace: string): EventResult {
+/**
+ * The verbatim per-event command `hooks/hooks.json` installs — taken from
+ * build_claude_hook_matrix(), the SAME generator that writes hooks.json and
+ * the consumer settings entries, so the bench cannot drift from the
+ * installed command. The bench sets CLAUDE_PROJECT_DIR to the throwaway
+ * workspace (which carries a symlink to the repo shim, exactly the layout a
+ * shim-carrying project has), so the probe takes the same branch a consumer
+ * pays and concern state stays out of the repo.
+ */
+let _matrixCache: Record<string, string> | null = null;
+function hooksJsonCommand(event: string): string {
+    _matrixCache ??= build_claude_hook_matrix(MANIFEST_PATH);
+    const native = NATIVE_EVENT[event] ?? event;
+    const cmd = _matrixCache[native];
+    if (cmd === undefined) {
+        throw new Error(`no hook-matrix entry for ${event} (${native}) in ${MANIFEST_PATH}`);
+    }
+    return cmd;
+}
+
+export function benchEvent(
+    event: string,
+    runs: number,
+    workspace: string,
+    via: InvocationPath = 'bundle',
+): EventResult {
     const durations: number[] = [];
     const payload = syntheticPayload(event, workspace);
+    const command: [string, string[]] =
+        via === 'cli'
+            ? ['bash', ['-c', hooksJsonCommand(event)]]
+            : [
+                  process.execPath,
+                  [BUNDLE, '--platform', 'claude', '--event', event, '--project-dir', workspace],
+              ];
     for (let i = 0; i < runs; i += 1) {
         const started = performance.now();
-        const proc = spawnSync(
-            process.execPath,
-            [
-                BUNDLE,
-                '--platform',
-                'claude',
-                '--event',
-                event,
-                '--project-dir',
-                workspace,
-            ],
-            {
-                input: payload,
-                encoding: 'utf-8',
-                env: { ...process.env, AGENT_CONFIG_REPLAY: '1' },
-                timeout: 60000,
-            },
-        );
+        const proc = spawnSync(command[0], command[1], {
+            input: payload,
+            encoding: 'utf-8',
+            env: { ...process.env, AGENT_CONFIG_REPLAY: '1', CLAUDE_PROJECT_DIR: workspace },
+            timeout: 60000,
+        });
         const elapsed = performance.now() - started;
         if (proc.error) {
             throw new Error(`dispatch failed on ${event}: ${proc.error.message}`);
@@ -134,9 +186,35 @@ interface Budget {
     regression_gate: { max_regression_pct: number };
 }
 
+interface HistoryEntry {
+    recorded_at: string;
+    invocation_path: InvocationPath;
+    hardware: string;
+    node: string;
+    platform: string;
+    runs_per_event: number;
+    results: EventResult[];
+}
+
+interface ResultsDoc {
+    _comment?: string;
+    invocation_path?: InvocationPath;
+    results: EventResult[];
+    history?: HistoryEntry[];
+    [key: string]: unknown;
+}
+
 export function main(argv: string[] = process.argv.slice(2)): number {
     const gate = argv.includes('--gate');
     const update = argv.includes('--update');
+    const viaCli = argv.includes('--via-cli');
+    const via: InvocationPath = viaCli ? 'cli' : 'bundle';
+    const baselineIdx = argv.indexOf('--baseline');
+    const baselineHardware = baselineIdx >= 0 ? (argv[baselineIdx + 1] ?? null) : null;
+    if (baselineIdx >= 0 && (baselineHardware === null || baselineHardware.startsWith('--'))) {
+        process.stderr.write('bench_hook_latency: --baseline requires a "<hardware class>" label\n');
+        return 2;
+    }
     const runsIdx = argv.indexOf('--runs');
     const runs = runsIdx >= 0 ? Number.parseInt(argv[runsIdx + 1] ?? '50', 10) : 50;
 
@@ -146,6 +224,21 @@ export function main(argv: string[] = process.argv.slice(2)): number {
         );
         return 2;
     }
+    if (viaCli) {
+        // The CLI path exercises shim → dist/cli → bundle; a missing link
+        // would make the hooks.json probe silently `exit 0` and the bench
+        // would time bash startup instead of a dispatch.
+        if (!fs.existsSync(CLI_BIN)) {
+            process.stderr.write(
+                `bench_hook_latency: CLI missing at ${CLI_BIN} — run \`npm run build:cli\` first\n`,
+            );
+            return 2;
+        }
+        if (!fs.existsSync(SHIM)) {
+            process.stderr.write(`bench_hook_latency: repo shim missing at ${SHIM}\n`);
+            return 2;
+        }
+    }
     const budget = loadJson<Budget>(BUDGET_PATH);
     if (budget === null) {
         process.stderr.write(`bench_hook_latency: budget file missing/invalid at ${BUDGET_PATH}\n`);
@@ -155,11 +248,23 @@ export function main(argv: string[] = process.argv.slice(2)): number {
     const workspace = fs.mkdtempSync(path.join(os.tmpdir(), 'ac-hook-bench-'));
     const results: EventResult[] = [];
     try {
+        if (viaCli) {
+            // Stage the workspace like a real consumer project so the
+            // installed command's probes take the branch consumers pay:
+            //   - node_modules/@event4u/agent-config → the package (bundle
+            //     fast path candidate 1),
+            //   - ./agent-config shim → the CLI fallback (resolved through
+            //     the symlink; the shim self-resolves symlinks).
+            const scope = path.join(workspace, 'node_modules', '@event4u');
+            fs.mkdirSync(scope, { recursive: true });
+            fs.symlinkSync(REPO_ROOT, path.join(scope, 'agent-config'));
+            fs.symlinkSync(path.join(REPO_ROOT, 'src', 'scripts', 'agent-config'), path.join(workspace, 'agent-config'));
+        }
         for (const event of EVENTS) {
-            const r = benchEvent(event, runs, workspace);
+            const r = benchEvent(event, runs, workspace, via);
             results.push(r);
             process.stdout.write(
-                `${event.padEnd(20)} p50 ${String(r.p50_ms).padStart(5)} ms · p95 ${String(r.p95_ms).padStart(5)} ms · max ${String(r.max_ms).padStart(5)} ms (n=${r.runs})\n`,
+                `${event.padEnd(20)} p50 ${String(r.p50_ms).padStart(5)} ms · p95 ${String(r.p95_ms).padStart(5)} ms · max ${String(r.max_ms).padStart(5)} ms (n=${r.runs}, via ${via})\n`,
             );
         }
     } finally {
@@ -167,7 +272,8 @@ export function main(argv: string[] = process.argv.slice(2)): number {
     }
 
     let failed = false;
-    const prior = loadJson<{ results: EventResult[] }>(RESULTS_PATH);
+    const prior = loadJson<ResultsDoc>(RESULTS_PATH);
+    const priorPath: InvocationPath = prior?.invocation_path ?? 'bundle';
     for (const r of results) {
         const anyCap = budget.budgets_ms.any_hook_event.p95_ci;
         const cap = r.event === 'pre_tool_use' ? budget.budgets_ms.pre_tool_use.p95_ci : anyCap;
@@ -177,7 +283,7 @@ export function main(argv: string[] = process.argv.slice(2)): number {
             );
             failed = true;
         }
-        if (gate && prior !== null) {
+        if (gate && prior !== null && priorPath === via) {
             const prev = prior.results.find((x) => x.event === r.event);
             if (prev !== undefined && prev.p95_ms > 0) {
                 const regressionPct = ((r.p95_ms - prev.p95_ms) / prev.p95_ms) * 100;
@@ -191,20 +297,45 @@ export function main(argv: string[] = process.argv.slice(2)): number {
             }
         }
     }
+    if (gate && prior !== null && priorPath !== via) {
+        process.stdout.write(
+            `ℹ️  regression net skipped — recorded baseline is via ${priorPath}, this run is via ${via}\n`,
+        );
+    }
 
-    if (update) {
-        const doc = {
-            _comment:
-                'Recorded hook-dispatch latency (bench_hook_latency --update). Method pinned in src/scripts/bench_hook_latency.ts; budgets in src/config/hook-latency-budget.json. Re-run from a fresh clone to reproduce.',
-            recorded_at: new Date().toISOString(),
-            node: process.version,
-            platform: `${os.platform()}-${os.arch()}`,
-            hardware_note: 'see hook-latency-budget.json hardware_reference — CI numbers are the gated ones',
-            runs_per_event: runs,
-            results,
-        };
+    if (update || baselineHardware !== null) {
+        const existing = prior ?? ({ results: [] } as ResultsDoc);
+        const history: HistoryEntry[] = existing.history ?? [];
+        if (baselineHardware !== null) {
+            history.push({
+                recorded_at: new Date().toISOString(),
+                invocation_path: via,
+                hardware: baselineHardware,
+                node: process.version,
+                platform: `${os.platform()}-${os.arch()}`,
+                runs_per_event: runs,
+                results,
+            });
+        }
+        const doc: ResultsDoc = update
+            ? {
+                  _comment:
+                      'Recorded hook-dispatch latency (bench_hook_latency --update). Method pinned in src/scripts/bench_hook_latency.ts; budgets in src/config/hook-latency-budget.json. Re-run from a fresh clone to reproduce. `history` entries (--baseline) are point-in-time records — the top-level results are the regression base.',
+                  recorded_at: new Date().toISOString(),
+                  node: process.version,
+                  platform: `${os.platform()}-${os.arch()}`,
+                  hardware_note:
+                      'see hook-latency-budget.json hardware_reference — CI numbers are the gated ones',
+                  invocation_path: via,
+                  runs_per_event: runs,
+                  results,
+                  ...(history.length > 0 ? { history } : {}),
+              }
+            : { ...existing, history };
         fs.writeFileSync(RESULTS_PATH, `${JSON.stringify(doc, null, 4)}\n`);
-        process.stdout.write(`recorded → ${path.relative(REPO_ROOT, RESULTS_PATH)}\n`);
+        process.stdout.write(
+            `recorded → ${path.relative(REPO_ROOT, RESULTS_PATH)}${update ? '' : ' (history entry only)'}\n`,
+        );
     }
 
     if (failed) return 1;

package/src/scripts/build_mcp_catalog.ts

@@ -135,7 +135,18 @@ export function _buildEntries(): CatalogEntryOut[] {
             description: STUB_MARKER + stub.description,
             side_effect: stub.side_effect,
             implemented_on: [],
-            input_schema: stub.input_schema,
+            // A stub ships an EMPTY schema on purpose. `input_schema` exists to
+            // tell a client how to CALL the tool, and no transport permits that
+            // for a stub: the Worker answers with the not_implemented envelope
+            // and stdio never registers it (`REGISTRY` in mcp_server/tools.ts).
+            // A populated schema is therefore always-loaded context that can
+            // never be acted on — 665 GPT tok across the 12 stubs, measured
+            // 2026-08-02. `stub.input_schema` stays in STUB_TOOLS as the design
+            // record for the day the tool is wired; it is simply not shipped
+            // until then. The stub-envelope contract's "byte-identical apart
+            // from implemented_on" promise still holds — both transports read
+            // this same file.
+            input_schema: {},
         });
     }
 

package/src/scripts/check_always_budget.ts

@@ -36,7 +36,42 @@ const RULES_DIR = path.join(REPO_ROOT, 'dist/agent-src', 'rules');
 const SRC_PREFIX = '.agent-src.uncondensed/';
 const COMP_PREFIX = 'dist/agent-src/';
 
+/**
+ * TWO BUDGETS, TWO DIMENSIONS (road-to-renewal-foundation Phase 1; council
+ * 2026-08-02 option B, 2/2).
+ *
+ * `TOTAL_CAP` governs the **raw** dimension — the always-loaded kernel rule
+ * bodies themselves. That is the dimension this cap was calibrated for and the
+ * only one it ever actually enforced: until the dead-root repair in this same
+ * change, `srcToCondensed()` resolved every `load_context` entry to a path that
+ * could not exist, so the walker counted ZERO context files and `ext` always
+ * equalled `raw`. The gate printed a confident `60.1%` of a dimension it was
+ * not measuring.
+ *
+ * `EXT_TOTAL_CAP` governs the **extended** dimension — raw plus the transitive
+ * closure of `load_context` / `load_context_eager` (depth ≤ 2). It is seeded at
+ * the FIRST REAL MEASUREMENT, taken 2026-08-02 after the repair, and is a hard
+ * gate (the council rejected an advisory cycle: an advisory number creates no
+ * pressure and just defers the collision).
+ *
+ * The seed is a baseline of revealed debt, NOT a target and NOT an approval.
+ * It exists so the number is visible and ratcheted; it may only move DOWN. The
+ * Phase 2 token work of this roadmap is what pays it down.
+ *
+ * Deliberately NOT done: raising `TOTAL_CAP` to swallow the ext number. That
+ * would silently redefine the kernel budget to ~2× what the maintainer approved
+ * and remove exactly the pressure Phase 2 exists to apply.
+ *
+ * Deliberately DEFERRED: splitting lazy `load_context` from eager
+ * `load_context_eager` (only the latter is unconditionally always-loaded). The
+ * distinction is real and encoded in the schema, but narrowing an aggregate on
+ * a semantic argument is a separate decision from repairing its measurement —
+ * and it cannot claim the "live and green" protection the house discriminator
+ * grants an enforced contract, because this dimension was never enforced.
+ */
 const TOTAL_CAP = 49_000;
+const EXT_TOTAL_CAP = 60_254;
+const EXT_MEASURED_AT = '2026-08-02';
 const WARN_THRESHOLD = 0.8;
 const FAIL_THRESHOLD = 0.9;
 
@@ -63,16 +98,36 @@ const TREND_LOG = path.join(REPO_ROOT, '.github', 'budget-trend.jsonl');
 const TREND_LOG_MAX_RECORDS = 500;
 const TOLERANCE_BAND = 0.02;
 const PER_RULE_CAP = 6_000;
-const TOP3_CAP = Math.trunc(TOTAL_CAP / 2);
+// Top-3 is an EXT measure, so it is capped against the ext budget, not the raw
+// one. Seeded 2026-08-02 at the measured 37,855 rather than the derived
+// EXT_TOTAL_CAP/2 (30,127): the derived value was never met and would fail on
+// day one, which is a baseline the gate cannot hold. Ratchet — moves DOWN only.
+const TOP3_CAP = 37_855;
 const MAX_DEPTH = 2;
 const MAX_CONTEXTS_PER_RULE = 3;
 
 const RECOVERY_BAND_ENABLED = true;
 const BASELINE_FILE = path.join(REPO_ROOT, '.github', 'budget-baseline.txt');
 
+/**
+ * Per-rule EXT ceilings, reseeded 2026-08-02 at the first real measurement.
+ *
+ * The previous values (`non-destructive-by-default` 7,908 · `scope-control`
+ * 8,550) were ~2× those rules' raw sizes, which is why they are evidence the
+ * ext dimension once counted contexts — but they have been unenforceable for as
+ * long as the resolver was broken, so they describe a tree that no longer
+ * exists. Reseeding them to the measured values is a baseline of revealed debt,
+ * not an approval: these are ratchets and may only move DOWN.
+ *
+ * `commit-policy` and `verify-before-complete` are new entries for the same
+ * reason — they breach the 6,000 per-rule cap only now that their context
+ * closures are actually counted.
+ */
 const KNOWN_PER_RULE_BREACHES: Record<string, number> = {
-    'non-destructive-by-default.md': 7_908,
-    'scope-control.md': 8_550,
+    'scope-control.md': 19_332,
+    'non-destructive-by-default.md': 9_657,
+    'commit-policy.md': 8_866,
+    'verify-before-complete.md': 7_140,
 };
 
 const PROG = 'check_always_budget.py';
@@ -198,11 +253,51 @@ function loadContextPaths(filePath: string): string[] {
     return out;
 }
 
-function srcToCondensed(entry: string): string {
-    if (entry.startsWith(SRC_PREFIX)) {
-        return path.join(REPO_ROOT, COMP_PREFIX + entry.slice(SRC_PREFIX.length));
+/**
+ * Resolve one `load_context` entry to the projected file it names.
+ *
+ * DEAD-ROOT REPAIR (road-to-renewal-foundation Phase 1). This used to be:
+ *
+ *     if (entry.startsWith(<retired authoring root>)) → dist/agent-src/<rest>
+ *     else                                             → REPO_ROOT/<entry>
+ *
+ * The retired authoring root was deleted by ADR-051, so the first branch was
+ * unreachable. The second branch was wrong for every real entry: `load_context`
+ * values are relative to the file that declares them
+ * (`../contexts/execution/autonomy-mechanics.md` from a rule in
+ * `dist/agent-src/rules/`), never repo-root-relative. Joining them to the repo
+ * root produced `<repo>/contexts/…`, which never exists — and `walkContexts`
+ * silently `continue`s on a missing path.
+ *
+ * Net effect: the transitive-context dimension of this budget counted ZERO
+ * files while the gate printed a confident percentage. It reported ~60% of a
+ * cap it was not measuring, and would have reported the same had every rule
+ * pulled in a megabyte of context.
+ *
+ * `skill:` / `guideline:` entries are scheme references, not paths — they have
+ * no file to size and are skipped explicitly rather than by accidental
+ * existsSync failure.
+ *
+ * @param entry the raw frontmatter value
+ * @param fromFile absolute path of the file that declared it
+ * @returns absolute path, or `null` when the entry names no file
+ */
+function resolveContextEntry(entry: string, fromFile: string): string | null {
+    const trimmed = entry.trim();
+    if (trimmed === '' || /^[a-z][a-z0-9+.-]*:/i.test(trimmed)) {
+        // `skill:foo`, `guideline:bar/baz`, or any other scheme reference.
+        return null;
+    }
+    if (trimmed.startsWith(SRC_PREFIX)) {
+        // Legacy authoring-root form, kept so a stale entry still resolves to
+        // its projected twin instead of silently counting zero.
+        return path.join(REPO_ROOT, COMP_PREFIX + trimmed.slice(SRC_PREFIX.length));
     }
-    return path.join(REPO_ROOT, entry);
+    if (trimmed.startsWith(COMP_PREFIX) || path.isAbsolute(trimmed)) {
+        return path.resolve(REPO_ROOT, trimmed);
+    }
+    // The real shape: relative to the declaring file's directory.
+    return path.resolve(path.dirname(fromFile), trimmed);
 }
 
 /** Return [set of context files counted, list of depth-violation chains]. */
@@ -214,8 +309,9 @@ function walkContexts(rule: string): [Set<string>, Array<[string, string]>] {
     while (stack.length > 0) {
         const [node, depth, chain] = stack.pop() as [string, number, string];
         for (const entry of loadContextPaths(node)) {
-            const comp = srcToCondensed(entry);
+            const comp = resolveContextEntry(entry, node);
             const newChain = `${chain} → ${entry}`;
+            if (comp === null) continue;
             if (depth + 1 > MAX_DEPTH) {
                 violations.push([ruleName, newChain]);
                 continue;
@@ -473,8 +569,16 @@ function main(): number {
     // sizes.sort(key=lambda x: -x[2]) — stable descending by ext.
     sizes.sort((a, b) => b[2] - a[2]);
     let totalExt = 0;
-    for (const s of sizes) totalExt += s[2];
-    const pct = totalExt / TOTAL_CAP;
+    let totalRaw = 0;
+    for (const s of sizes) {
+        totalRaw += s[1];
+        totalExt += s[2];
+    }
+    // TOTAL_CAP is the RAW budget (see the two-budgets note at the top); the
+    // extended dimension has its own seeded cap.
+    const pct = totalRaw / TOTAL_CAP;
+    const extPct = totalExt / EXT_TOTAL_CAP;
+    const extBreach = totalExt > EXT_TOTAL_CAP;
     let top3 = 0;
     for (const s of sizes.slice(0, 3)) top3 += s[2];
     const top3Breach = top3 > TOP3_CAP;
@@ -503,6 +607,7 @@ function main(): number {
     const failing =
         (pct >= FAIL_THRESHOLD && !inTolerance && !inRecoveryBand && pct < 1.0) ||
         pct > 1.0 + TOLERANCE_BAND ||
+        extBreach ||
         overPerRule.length > 0 ||
         grewOverCeiling.length > 0 ||
         top3Breach ||
@@ -532,9 +637,15 @@ function main(): number {
 
     const out: string[] = [];
     out.push(
-        `${status}  always-rule extended budget: ${comma(totalExt)} / ` +
+        `${status}  always-rule raw budget: ${comma(totalRaw)} / ` +
             `${comma(TOTAL_CAP)} chars (${fixed(pct * 100, 1)}%) across ${rules.length} rule(s)`,
     );
+    out.push(
+        `      extended (raw + load_context closure): ${comma(totalExt)} / ` +
+            `${comma(EXT_TOTAL_CAP)} chars (${fixed(extPct * 100, 1)}%)` +
+            `${extBreach ? '  ❌ over the seeded ext cap' : ''}` +
+            `  — ratchet seeded at the first real measurement ${EXT_MEASURED_AT}; may only move DOWN`,
+    );
     out.push(
         `      thresholds: warn ${fixed(WARN_THRESHOLD * 100, 0)}% · ` +
             `fail ${fixed(FAIL_THRESHOLD * 100, 0)}% · ` +