@event4u/agent-config 9.14.0 → 9.16.0

package/src/scripts/check_portability.ts

@@ -8,7 +8,7 @@
  * same finding text, same scan scope and file-walk order. No behaviour
  * changes; latent bugs are replicated and flagged as divergence candidates.
  *
- * Scans dist/agent-src/ and .agent-src.uncondensed/ for project-specific
+ * Scans src/ and dist/agent-src/ for project-specific
  * references that violate package portability (the package must work in ANY
  * project).
  *
@@ -271,10 +271,25 @@ const ALLOWLIST: string[] = [
     'package repository', // "package repository" concept
     'src/scripts/mcp_server/', // MCP server module path (road-to-mcp-server.md Phase 1)
     String.raw`scripts\.mcp_server`, // MCP server Python module entrypoint
+    // ── Revealed 2026-08-02 when `src/` entered SCAN_DIRS (dead-root repair,
+    // road-to-renewal-foundation Phase 1). Both live under `src/templates/`,
+    // which is never projected into `dist/agent-src/`, so this gate had never
+    // seen them. Neither is a CONSUMER-project leak — they are the package's
+    // own published identifiers, which a consumer must type verbatim:
+    String.raw`plugin install agent-conf@`, // real marketplace install command
+    String.raw`\.event4u-bridge\.yml`, // real shipped anchor filename (src/scripts/install.ts, lint_agents_layout.ts)
 ];
 
-// Directories to scan (only package files, not project-specific agents/)
-const SCAN_DIRS = ['dist/agent-src', '.agent-src.uncondensed'];
+// Directories to scan (only package files, not project-specific agents/).
+//
+// DEAD-ROOT REPAIR (road-to-renewal-foundation Phase 1): the second entry was
+// `.agent-src.uncondensed`, deleted by ADR-051. The loops below `continue` on a
+// missing directory, so half this gate's declared corpus — the whole authoring
+// tree — was silently skipped. A project identifier authored in `src/` was only
+// ever caught once a condense run projected it into `dist/agent-src/`, i.e. one
+// step later than the gate claims to catch it. `src/` is the source of truth
+// now and is scanned directly.
+const SCAN_DIRS = ['src', 'dist/agent-src'];
 
 // Additional root-level files shipped by the package that must also stay
 // portable. These are read by agents working on the package itself and —
@@ -608,11 +623,20 @@ function check_cli_invocations(filepath: string): Violation[] {
     return violations;
 }
 
-function scan_all(root: string): { violations: Violation[]; detected: string[] } {
+function scan_all(root: string): {
+    violations: Violation[];
+    detected: string[];
+    scanned: number;
+} {
     const { patterns, detected } = _compile_patterns(root);
     const forbidden = _compile_forbidden_patterns();
     const allowlist = _compile_allowlist();
     const violations: Violation[] = [];
+    // Distinct files actually read, for the gate-coverage contract
+    // (src/config/gate-coverage.yml): a gate that inspected nothing has not
+    // passed. Counted as a set because the layer-3/4 passes revisit files the
+    // layer-1 pass already read.
+    const scannedFiles = new Set<string>();
 
     // Layer 1 + 2: full package content
     for (const scanDir of SCAN_DIRS) {
@@ -621,6 +645,7 @@ function scan_all(root: string): { violations: Violation[]; detected: string[] }
             continue;
         }
         for (const f of _rglobMdSorted(d)) {
+            scannedFiles.add(f);
             violations.push(...check_file(f, [...patterns, ...forbidden], allowlist));
         }
     }
@@ -629,6 +654,7 @@ function scan_all(root: string): { violations: Violation[]; detected: string[] }
     for (const rel of SCAN_ROOT_FILES) {
         const f = path.join(root, rel);
         if (_isFile(f)) {
+            scannedFiles.add(f);
             violations.push(...check_file(f, forbidden, allowlist));
         }
     }
@@ -664,7 +690,7 @@ function scan_all(root: string): { violations: Violation[]; detected: string[] }
         }
     }
 
-    return { violations, detected };
+    return { violations, detected, scanned: scannedFiles.size };
 }
 
 function format_text(violations: Violation[], detected: string[]): string {
@@ -816,7 +842,7 @@ function parseArgs(argv: readonly string[]): ParsedArgs {
 function main(): number {
     const args = parseArgs(process.argv.slice(2));
 
-    let result: { violations: Violation[]; detected: string[] };
+    let result: { violations: Violation[]; detected: string[]; scanned: number };
     try {
         result = scan_all(args.root);
     } catch (e) {
@@ -825,7 +851,11 @@ function main(): number {
         return 3;
     }
 
-    const { violations, detected } = result;
+    const { violations, detected, scanned } = result;
+    // gate-coverage contract (src/config/gate-coverage.yml): one machine-readable
+    // count on stderr so `check_gate_coverage` can assert this gate read a real
+    // corpus. It scanned a deleted root for months and still exited 0.
+    process.stderr.write(`scanned: ${String(scanned)}\n`);
     if (args.format === 'json') {
         const payload = { detected, violations };
         process.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);

package/src/scripts/check_references.ts

@@ -452,9 +452,12 @@ function _extract_personas_frontmatter(text: string): Array<[number, string]> {
 
 function _find_suggestion(p: string, root: string): string {
     const name = path.basename(p);
+    // DEAD-ROOT REPAIR (road-to-renewal-foundation Phase 1): the middle entry
+    // was `.agent-src.uncondensed`, deleted by ADR-051. `src/` is the source of
+    // truth, so a file that exists only there produced no suggestion at all.
     for (const d of [
         path.join(root, 'dist/agent-src'),
-        path.join(root, '.agent-src.uncondensed'),
+        path.join(root, 'src'),
         path.join(root, 'agents'),
     ]) {
         if (_exists(d)) {
@@ -586,10 +589,15 @@ function check_file(filepath: string, artifacts: Artifacts, root: string): Broke
             } else {
                 // Strip leading ./ and try with prefixes
                 const ref = rawRef.replace(/^[./]+/, '');
+                // DEAD-ROOT REPAIR: `.agent-src.uncondensed` (ADR-051) never
+                // resolved, so a reference that only exists under the source of
+                // truth was reported BROKEN. `src/` and its category roots
+                // replace it.
                 for (const prefix of [
                     root,
                     path.join(root, 'dist/agent-src'),
-                    path.join(root, '.agent-src.uncondensed'),
+                    path.join(root, 'src'),
+                    path.join(root, 'src/agent-src'),
                 ]) {
                     if (_exists(path.join(prefix, ref))) {
                         resolved = true;
@@ -605,7 +613,7 @@ function check_file(filepath: string, artifacts: Artifacts, root: string): Broke
                     const rel = rawRef.slice('.augment/'.length);
                     for (const prefix of [
                         path.join(root, 'dist/agent-src'),
-                        path.join(root, '.agent-src.uncondensed'),
+                        path.join(root, 'src/agent-src'),
                     ]) {
                         if (_exists(path.join(prefix, rel))) {
                             resolved = true;
@@ -774,6 +782,10 @@ function check_memory_yaml(filepath: string, artifacts: Artifacts, root: string)
 function scan_all(root: string): BrokenRef[] {
     const artifacts = collect_artifacts(root);
     const broken: BrokenRef[] = [];
+    // gate-coverage contract (src/config/gate-coverage.yml): a machine-readable
+    // count of files actually read, so `check_gate_coverage` can assert this
+    // gate saw a real corpus rather than a moved root.
+    let scannedFiles = 0;
     for (const scanDir of SCAN_DIRS) {
         const d = path.join(root, scanDir);
         if (!_exists(d)) {
@@ -785,18 +797,22 @@ function scan_all(root: string): BrokenRef[] {
             if (SKIP_DIRS.some((skip) => f.startsWith(path.join(root, skip)))) {
                 continue;
             }
+            scannedFiles += 1;
             broken.push(...check_file(f, artifacts, root));
         }
     }
     const memoryDir = path.join(root, MEMORY_YAML_ROOT);
     if (_isDir(memoryDir)) {
         for (const f of _rglob(memoryDir, '.yml').sort()) {
+            scannedFiles += 1;
             broken.push(...check_memory_yaml(f, artifacts, root));
         }
         for (const f of _rglob(memoryDir, '.yaml').sort()) {
+            scannedFiles += 1;
             broken.push(...check_memory_yaml(f, artifacts, root));
         }
     }
+    process.stderr.write(`scanned: ${String(scannedFiles)}\n`);
     return broken;
 }
 

package/src/scripts/check_release_pr_shape.ts

@@ -24,6 +24,9 @@ const _HERE = fileURLToPath(import.meta.url);
 
 const ALLOWLIST_GLOBS = [
     'package.json',
+    // Lockfile version fields — bumped by release.ts set_lockfile_version in
+    // lockstep with package.json (road-to-gates-that-can-fail Phase 5).
+    'package-lock.json',
     'CHANGELOG.md',
     '.claude-plugin/marketplace.json',
     'src/packs/*/pack.yaml',
@@ -131,6 +134,16 @@ function check(files: readonly string[]): number {
         for (const f of bad) {
             process.stdout.write(`OUT-OF-SHAPE: ${f}\n`);
         }
+        process.stdout.write(
+            '\n' +
+                'A release PR may only contain the version-bump allowlist — the heavy\n' +
+                'test matrix skips on release/* heads, so code must not ride a release PR\n' +
+                '(docs/contracts/release-pr-gating.md § Mid-release fixes).\n' +
+                'Fix: land the files above on main via their own PR, then\n' +
+                '  git checkout release/X.Y.Z && git merge origin/main && git push\n' +
+                '— their release-PR diff becomes empty and this check goes green.\n' +
+                'Then resume with: task release -- --resume --yes\n',
+        );
         return 1;
     }
     process.stdout.write(

package/src/scripts/check_token_quality_golden.ts

@@ -41,7 +41,7 @@ import * as path from 'node:path';
 import process from 'node:process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
-import yaml from 'js-yaml';
+import * as yaml from 'js-yaml';
 
 const _HERE = fileURLToPath(import.meta.url);
 const REPO_ROOT = path.resolve(path.dirname(_HERE), '..', '..');

package/src/scripts/check_token_regression.ts

@@ -17,7 +17,9 @@
  *   - thin_rule_load     — thin_projection.thin_gpt
  *   - skill_descriptions — description_catalog.skills_core_source.tokens_gpt
  *   - command_descriptions — description_catalog.commands_core_source.tokens_gpt
- *   - mcp_schemas        — Σ mcp_tool_schemas[*].tokens_gpt
+ *   - mcp_schemas        — max mcp_tool_schemas[*].tokens_gpt (per-transport;
+ *                          a client connects over ONE transport, so Σ would
+ *                          double-bill the tools both transports serve)
  *
  * A baseline captured under a different `token_method` (e.g. proxy → exact)
  * is a legitimate reset, not a regression — the gate WARNS and asks for a
@@ -74,10 +76,15 @@ function _num(obj: unknown, ...keys: string[]): number {
 
 /** Extract the flat gated-metric map from a projection-cost report. */
 function extract_metrics(report: Json): Metrics {
+  // MAX, not Σ. The report keys one entry per SERVER-TRANSPORT pair, and a
+  // client connects over exactly one transport of a given server — summing
+  // `agent-config (stdio)` and `agent-config (worker)` would bill the 19
+  // shared tools twice and read as a regression the moment the transports were
+  // split apart. The gated metric is what the worst-case single client loads.
   const mcp = (report['mcp_tool_schemas'] as Json) ?? {};
   let mcp_total = 0;
   for (const server of Object.values(mcp)) {
-    mcp_total += _num(server, 'tokens_gpt');
+    mcp_total = Math.max(mcp_total, _num(server, 'tokens_gpt'));
   }
   return {
     token_method: String(report['token_method'] ?? 'unknown'),

package/src/scripts/condense.ts

@@ -35,15 +35,23 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import * as YAML from 'yaml';
 
 import {
+    _domains_command_logical,
     artefact_roots as _agent_src_artefact_roots,
     iter_all_sources as _agent_src_iter_all_sources,
     resolve_logical as _agent_src_resolve_logical,
     strip_source_prefix,
 } from './_lib/agent_src.js';
+// Import-safety note: `project_thin_rules` guards its CLI entry
+// (`_isCliEntry()` before `process.exit(main())`), so importing it here is
+// side-effect-free. condense.ts is bundled into the installer, where a bare
+// top-level `process.exit` would fire at consumer runtime — the documented
+// bundled-CLI-entry-guard landmine. Verified before wiring, not assumed.
+import { build_thin } from './project_thin_rules.js';
 import { build_claude_hook_matrix } from './_lib/claude_settings_hooks.js';
 import { is_claude_builtin_name } from './_lib/claude_builtin_names.js';
 import { project_settings_path, load_agent_settings } from './_lib/agent_settings.js';
 import { rule_is_compile_enabled } from './_lib/compile_time_toggles.js';
+import { resolve_rule_pack_scope } from './_lib/scoped_projection.js';
 import { info, success, flush_summary, resolve_level } from './_lib/script_output.js';
 import {
     TIER_TO_CLAUDE_MODEL as _TIER_TO_CLAUDE_MODEL,
@@ -987,13 +995,16 @@ export { _HRR_BANNER_MARKER };
 // (rule-router contract § Schema v2). Untagged rules fail safe: they ship.
 // ADR-040: projection-time filtering only, no runtime resolver.
 
-function _read_projection_list(key: string): string[] | null {
+function _read_projection_raw(key: string): unknown {
     const data = load_agent_settings({ project_path: MODULE_STATE.SETTINGS_FILE });
     const proj = data['projection'];
-    const value =
-        typeof proj === 'object' && proj !== null && !Array.isArray(proj)
-            ? (proj as Record<string, unknown>)[key]
-            : null;
+    return typeof proj === 'object' && proj !== null && !Array.isArray(proj)
+        ? (proj as Record<string, unknown>)[key]
+        : null;
+}
+
+function _read_projection_list(key: string): string[] | null {
+    const value = _read_projection_raw(key);
     if (Array.isArray(value) && value.length > 0) {
         return value.map((v) => String(v));
     }
@@ -1004,8 +1015,28 @@ function _read_rule_workspaces(): string[] | null {
     return _read_projection_list('rule_workspaces');
 }
 
+/** `runtime.active_packs` overlay, empty when unset (fresh-install default). */
+function _read_runtime_active_packs(): string[] {
+    const data = load_agent_settings({ project_path: MODULE_STATE.SETTINGS_FILE });
+    const rt = data['runtime'];
+    const value =
+        typeof rt === 'object' && rt !== null && !Array.isArray(rt)
+            ? (rt as Record<string, unknown>)['active_packs']
+            : null;
+    return Array.isArray(value) ? value.map((v) => String(v)) : [];
+}
+
+/**
+ * Pack scope for the rule layer. `rule_packs: auto` derives the active-pack
+ * set (the same one the skill/command prune uses) instead of a hand-typed id
+ * list; anything else keeps the historical list-or-inactive semantics.
+ */
 function _read_rule_packs(): string[] | null {
-    return _read_projection_list('rule_packs');
+    return resolve_rule_pack_scope(
+        _read_projection_raw('rule_packs'),
+        MODULE_STATE.PROJECT_ROOT,
+        _read_runtime_active_packs(),
+    );
 }
 
 /**
@@ -1044,11 +1075,19 @@ export function generate_rule_symlinks(): number {
 
     let thin_files: Record<string, string> | null = null;
     if (_lean_projection_mode() === 'thin') {
-        // The `project_thin_rules` twin is not ported (out of scope — thin mode
-        // is opt-in and not exercised by golden parity). Throw a clear error if
-        // a consumer actually enables it, mirroring an unmet import.
-        throw new Error(
-            'lean_projection.mode=thin requires project_thin_rules (not ported in condense.ts)',
+        // DEAD-SWITCH REPAIR (road-to-renewal-foundation Phase 2). This branch
+        // used to THROW: the port was skipped as "out of scope, not exercised by
+        // golden parity", which left a documented, settings-selectable mode that
+        // could only ever crash. `build_thin` was ported and has been present the
+        // whole time — the wiring was the only thing missing.
+        //
+        // Scope note: this repairs the SWITCH only. The default stays
+        // `eager-all`. Flipping it is parked behind the thin-projection honest
+        // null (thin win-rate 36.2% < the 48% pre-registered threshold), and
+        // nothing here disturbs that verdict — but a mode that throws cannot
+        // even be re-measured, which is why the repair earns its place alone.
+        thin_files = Object.fromEntries(
+            build_thin(MODULE_STATE.RULES_SOURCE, _read_rule_workspaces()),
         );
     }
 
@@ -1146,6 +1185,9 @@ function _WINDSURF_WORKFLOWS_DIR(): string {
 function _CURSOR_COMMANDS_DIR(): string {
     return path.join(MODULE_STATE.PROJECT_ROOT, '.cursor', 'commands');
 }
+function _CLAUDE_COMMANDS_DIR(): string {
+    return path.join(MODULE_STATE.PROJECT_ROOT, '.claude', 'commands');
+}
 
 function _parse_frontmatter(content: string): [Record<string, unknown>, string] {
     if (!content.startsWith('---')) {
@@ -1566,6 +1608,92 @@ export function extract_description_from_md(content: string): string {
     return '';
 }
 
+/**
+ * The `commands/<sub>` path of a command source file, or `null` when it is a
+ * FLAT command (`commands/<name>.md`).
+ *
+ * A nested path is what Claude Code renders as `/cluster:sub`. Flat command
+ * FILES are not registered by Claude Code (probed ≤ 2.1.204 — see the
+ * flat-command mitigation in `install.ts`), which is why flat commands keep a
+ * skill wrapper and nested ones do not need one.
+ */
+function _nested_command_subpath(source_file: string): string | null {
+    const rel = _relativeToPosix(source_file, MODULE_STATE.PROJECT_ROOT);
+    const logical = _domains_command_logical(rel);
+    if (logical === null || !logical.startsWith('commands/')) {
+        return null;
+    }
+    const sub = logical.slice('commands/'.length).replace(/\.md$/, '');
+    return sub.includes('/') ? sub : null;
+}
+
+/**
+ * Project-scope `.claude/commands/<cluster>/<sub>.md` — the colon form.
+ *
+ * Before this, the package repo's own `.claude/` carried NO commands
+ * directory: every command reached Claude Code as a hyphen-named skill
+ * wrapper in `.claude/skills/`, while the colon form existed only in the
+ * user-global tree written by `install.ts`. Every clustered command was
+ * therefore listed TWICE for anyone with a global install
+ * (`roadmap-process-full` AND `roadmap:process-full`), costing 4,214 GPT tok
+ * of always-loaded catalog for zero added reach — measured 2026-08-02.
+ *
+ * Emitting the nested form here lets `generate_claude_commands` stop wrapping
+ * the clustered commands: one listing, same reachability, and reachability no
+ * longer depends on a global deploy having run. Claude Code dedupes project
+ * and user scope by name, so the two copies of `/cluster:sub` collapse.
+ *
+ * ADR-003 (colon canonical for clusters) and ADR-044 (flat commands stay
+ * hyphenated) both hold: flat commands are untouched and keep their wrapper.
+ */
+export function generate_claude_project_commands(
+    active_command_slugs: ReadonlySet<string> | null = null,
+): number {
+    if (!_isDir(path.join(MODULE_STATE.PROJECT_ROOT, 'src', 'domains'))) {
+        return 0;
+    }
+    const nested: Array<[string, string]> = [];
+    for (const [source_file, slug] of iterCommands()) {
+        if (active_command_slugs !== null && !active_command_slugs.has(slug)) {
+            continue;
+        }
+        const sub = _nested_command_subpath(source_file);
+        if (sub !== null) {
+            nested.push([source_file, sub]);
+        }
+    }
+
+    const target_root = _CLAUDE_COMMANDS_DIR();
+    const valid = new Set(nested.map(([, sub]) => `${sub}.md`));
+    // Sweep stale links first: a renamed or deleted command must not linger as
+    // a dangling `/cluster:sub`.
+    if (_exists(target_root)) {
+        for (const item of _rglobSorted(target_root, '*.md')) {
+            const rel = _relativeToPosix(item, target_root);
+            if (!valid.has(rel)) {
+                fs.unlinkSync(item);
+            }
+        }
+    }
+
+    let count = 0;
+    for (const [source_file, sub] of nested) {
+        const link = path.join(target_root, `${sub}.md`);
+        _mkdirp(path.dirname(link));
+        if (_existsOrSymlink(link)) {
+            fs.unlinkSync(link);
+        }
+        // path.relative, not a hand-counted `../` run: the nesting depth
+        // varies (2 and 3 segments both occur) and an off-by-one here writes
+        // a dangling link that still LOOKS right in `ls -l`.
+        const rel_target = path.relative(path.dirname(link), source_file);
+        fs.symlinkSync(rel_target, link);
+        count += 1;
+    }
+    info(`  ✅  Linked ${count} \`.claude/commands/**/*.md\` files (colon form)`);
+    return count;
+}
+
 export function generate_claude_commands(active_command_slugs: ReadonlySet<string> | null = null): number {
     if (!_isDir(path.join(MODULE_STATE.PROJECT_ROOT, 'src', 'domains'))) {
         process.stderr.write('  ⚠️  src/domains/ not found — skipping commands\n');
@@ -1597,6 +1725,15 @@ export function generate_claude_commands(active_command_slugs: ReadonlySet<strin
             skipped += 1;
             continue;
         }
+        // A clustered command already reaches Claude Code as `/cluster:sub`
+        // from `.claude/commands/` (generate_claude_project_commands). A
+        // hyphen wrapper on top would be a second listing of the same command
+        // — the double-listing this de-duplicates. Flat commands still need
+        // the wrapper: Claude Code does not register flat command FILES.
+        if (_nested_command_subpath(source_file) !== null) {
+            skipped += 1;
+            continue;
+        }
         // Never claim a `/name` that is a Claude Code built-in command or
         // bundled skill — a same-name entry shadows the built-in (e.g. a
         // `review` entry hides Claude Code's own /review). Nested
@@ -2144,6 +2281,11 @@ function _generate_tools_inner(
         generate_gemini_md();
     }
     const skills = _tool_active('claude-code') ? generate_claude_skills(skill_names) : 0;
+    // Colon form first: `generate_claude_commands` skips every command this
+    // one emitted, so the ordering is what keeps the two from double-listing.
+    const claude_cmds = _tool_active('claude-code')
+        ? generate_claude_project_commands(cmd_slugs)
+        : 0;
     const commands = _tool_active('claude-code') ? generate_claude_commands(cmd_slugs) : 0;
     const subagents = _tool_active('claude-code') ? generate_claude_subagents() : 0;
     const subagent_contexts = generate_subagent_host_contexts();
@@ -2157,7 +2299,8 @@ function _generate_tools_inner(
     const windsurf_wf = _tool_active('windsurf') ? generate_windsurf_workflows(cmd_slugs) : 0;
     const summary =
         `✅  generate-tools — rules=${rules} skills=${skills} ` +
-        `commands=${commands} subagents=${subagents} subagent_contexts=${subagent_contexts} plugin_cmd_skills=${plugin_cmd_skills} ` +
+        `claude_commands=${claude_cmds} command_skills=${commands} ` +
+        `subagents=${subagents} subagent_contexts=${subagent_contexts} plugin_cmd_skills=${plugin_cmd_skills} ` +
         `plugin_hooks=${plugin_hooks} ` +
         `personas=${personas} user_types=${user_types} ` +
         `cursor_mdc=${cursor_mdc} windsurf_rules=${windsurf_modern} ` +

package/src/scripts/cost/budget.mjs

@@ -10,7 +10,7 @@
 // Env: BUDGET_STORE, BUDGET_CONFIG, BUDGET_PERIOD={today|week|month|all}, BUDGET_QUIET=1
 
 import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
-import { dirname } from 'node:path';
+import { dirname, join } from 'node:path';
 
 const STORE = process.env.BUDGET_STORE || 'agents/cost-tracking/sessions.jsonl';
 const CONFIG = process.env.BUDGET_CONFIG || 'agents/cost-tracking/budget.json';
@@ -198,14 +198,89 @@ function cmdCheck() {
   if (hardStop) process.exit(1);
 }
 
+// --- Per-tier budget state (docs/contracts/budget-routing.md) -------------
+// v1 window for per-tier ceilings: rolling 24h for SPEND (ledger entries
+// tagged `tier:`). Pending reserves from tier-reserves.jsonl count only
+// within the shared reserve TTL — reserves are race protection, not spend
+// accounting. The TTL comes from src/config/budget-routing.json, the SAME
+// source acquireBudgetPermit reads, so the two readers cannot diverge
+// (external review 2026-08-03, Finding 1b).
+
+function loadReserveTtlMs() {
+  try {
+    const cfgPath = join(dirname(new URL(import.meta.url).pathname), '..', '..', 'config', 'budget-routing.json');
+    const raw = JSON.parse(readFileSync(cfgPath, 'utf-8'));
+    if (Number.isFinite(raw.reserve_ttl_ms)) return raw.reserve_ttl_ms;
+  } catch { /* fall through to the safe default below */ }
+  return 600000;
+}
+
+function loadPerTierCeilings() {
+  const out = { cheap: null, medium: null, strong: null };
+  if (!existsSync(SETTINGS)) return out;
+  let inPerTier = false;
+  for (const line of readFileSync(SETTINGS, 'utf-8').split('\n')) {
+    if (/^ {4}per_tier:/.test(line)) { inPerTier = true; continue; }
+    if (inPerTier) {
+      const m = line.match(/^ {6}(cheap|medium|strong):\s*([0-9.]+|null)\s*(#.*)?$/);
+      if (m) {
+        out[m[1]] = m[2] === 'null' ? null : Number(m[2]);
+        continue;
+      }
+      if (/^ {0,5}\S/.test(line)) inPerTier = false;
+    }
+  }
+  return out;
+}
+
+function cmdTier(rest) {
+  const tier = rest[0];
+  if (!['cheap', 'medium', 'strong'].includes(tier)) {
+    console.error('usage: budget.mjs tier {cheap|medium|strong}');
+    process.exit(2);
+  }
+  const dayMs = 24 * 3600 * 1000;
+  const now = Date.now();
+  const inWindow = (ts) => ts && (now - new Date(ts).getTime()) < dayMs;
+  const spent = loadSessions()
+    .filter((s) => s.tier === tier && inWindow(s.capturedAt || s.endedAt || s.ts))
+    .reduce((acc, s) => acc + (Number(s.total_cost_usd ?? s.cost_usd ?? 0) || 0), 0);
+  let reserved = 0;
+  const reserveTtl = loadReserveTtlMs();
+  const reservePath = join(dirname(STORE), 'tier-reserves.jsonl');
+  if (existsSync(reservePath)) {
+    for (const line of readFileSync(reservePath, 'utf-8').split('\n')) {
+      if (!line.trim()) continue;
+      try {
+        const e = JSON.parse(line);
+        if (e.tier === tier && e.status === 'pending' && (now - e.ts_ms) < reserveTtl) {
+          reserved += Number(e.est_usd || 0) || 0;
+        }
+      } catch { /* skip malformed line */ }
+    }
+  }
+  const ceiling = loadPerTierCeilings()[tier];
+  const available = ceiling === null ? true : spent + reserved < ceiling;
+  console.log(JSON.stringify({
+    tier,
+    window: 'rolling-24h',
+    reserve_ttl_ms: reserveTtl,
+    ceiling_usd: ceiling,
+    spent_usd: spent,
+    reserved_usd: reserved,
+    available,
+  }));
+}
+
 function main() {
   const [cmd, ...rest] = process.argv.slice(2);
   switch (cmd) {
     case 'set':   return cmdSet(rest);
     case 'get':   return cmdGet();
     case 'check': return cmdCheck();
+    case 'tier':  return cmdTier(rest);
     default:
-      console.error('usage: budget.mjs {set <usd>|get|check}');
+      console.error('usage: budget.mjs {set <usd>|get|check|tier <cheap|medium|strong>}');
       process.exit(2);
   }
 }

package/src/scripts/evaluator_umbrella.sh

@@ -23,8 +23,12 @@
 #   9. npx smoke            first-touch paths (--version, --help, mcp initialize)
 #   6-8 feed src/scripts/check_evaluator_budgets.ts against
 #   src/config/evaluator-budgets.json (owner + review date lint-enforced).
+#  8b. record publish     with UMBRELLA_RECORD=1, writes the measurement set to
+#                         agents/evidence/metrics/evaluator-measurements.json so
+#                         drift is visible in a diff the day it lands
 #
 # Usage: bash src/scripts/evaluator_umbrella.sh [--skip-pack <tarball>]
+#        UMBRELLA_RECORD=1 bash src/scripts/evaluator_umbrella.sh   # nightly
 set -euo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
@@ -166,9 +170,38 @@ console.log(JSON.stringify(m, null, 1));' \
   "$MEASURE_TMP" "$UNPACKED_BYTES" "$NM_MB" "$DEP_COUNT" "$CLI_MS" "$MCP_MS" "$CLI_COUNT" "$MCP_TOOLS" \
   "$COLD_START_MS" "$COLD_START_CONDITIONS"
 
-step "budget gate (absolute + >regression_pct creep)"
+# The budget gate runs BEFORE the record is refreshed, so the comparison is
+# fresh-vs-committed. Refreshing first would make every drift check trivially
+# green (road-to-gates-that-can-fail Phase 5).
+step "budget gate (absolute + >regression_pct creep + drift vs the committed record)"
 ./scripts-run src/scripts/check_evaluator_budgets --measurements "$MEASURE_TMP"
 
+# ------------------------------------------------- 8b. publish the record
+# With UMBRELLA_RECORD=1 (the nightly sets it) the measurement set is written
+# to a COMMITTED artifact, so budget drift is visible the day it lands instead
+# of at the next release — `cli_help_command_count` drifted 74 → 80 against a
+# value frozen at 79 with nobody seeing it. It lives under agents/evidence/,
+# the repo's committed-evidence tree, and NOT under src/config/, which ships:
+# this is maintainer evidence with nightly churn, not consumer runtime config,
+# and keeping it out of the tarball also keeps evaluator-budgets.json (the
+# policy) reviewable on its own. Sorted keys + fixed indent so a moved number
+# is a one-line diff.
+if [[ "${UMBRELLA_RECORD:-0}" == "1" ]]; then
+  step "publish the measurement record (agents/evidence/metrics/)"
+  RECORD_PATH="$ROOT/agents/evidence/metrics/evaluator-measurements.json"
+  mkdir -p "$(dirname "$RECORD_PATH")"
+  RUN_URL=""
+  if [[ -n "${GITHUB_REPOSITORY:-}" && -n "${GITHUB_RUN_ID:-}" ]]; then
+    RUN_URL="${GITHUB_SERVER_URL:-https://github.com}/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"
+  fi
+  node src/scripts/record_evaluator_measurements.mjs \
+    --measurements "$MEASURE_TMP" \
+    --out "$RECORD_PATH" \
+    --sha "$(git rev-parse HEAD 2>/dev/null || echo '')" \
+    --run-url "$RUN_URL" \
+    --conditions "$COLD_START_CONDITIONS"
+fi
+
 # ------------------------------------------------------------- 9. npx smoke
 step "first-touch smoke (installed bin)"
 "$CLI_BIN" --version >/dev/null

package/src/scripts/generate_capability_matrix.ts

@@ -109,6 +109,14 @@ const _FN_SPEC: Record<string, FnSpec> = {
         artifact: 'commands',
         cells: { 'claude-code': 'native', augment: 'native' },
     },
+    // The colon form (`/cluster:sub`) in the project tree. Same artifact and
+    // the same native cell as the hyphen wrapper above — the two split the
+    // command population between them (nested here, flat there); this is not
+    // an added surface.
+    generate_claude_project_commands: {
+        artifact: 'commands',
+        cells: { 'claude-code': 'native' },
+    },
     generate_claude_subagents: {
         artifact: 'subagents',
         cells: { 'claude-code': 'native' },