@event4u/agent-config 9.18.1 → 9.20.0

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Bootstrap shim for the event4u agent-config suite. This plugin ships ONLY the dispatcher hooks plus one install-pointer skill — ALL content (skills, rules, commands) is installed via `npx -y @event4u/agent-config init`, which writes the file projection AND registers the same hooks in ~/.claude/settings.json. DEPRECATED as a content channel; kept so the marketplace listing stays discoverable and existing installs keep working hooks.",
-    "version": "9.18.1",
+    "version": "9.20.0",
     "keywords": [
       "agent-config",
       "skills",

package/CHANGELOG.md

@@ -294,6 +294,79 @@ Entry-shape contract: [`docs/contracts/CHANGELOG-conventions.md`](docs/contracts
 > that forces a new era split (`# Era: 9.19.x`, etc.) — see
 > [`docs/contracts/CHANGELOG-conventions.md § Era splits`](docs/contracts/CHANGELOG-conventions.md).
 
+## [9.20.0](https://github.com/event4u-app/agent-config/compare/9.19.0...9.20.0) (2026-08-04)
+
+### Release highlights
+
+<!-- Curated head: fill before merge, keep it under 10 lines, and leave `_none_` where it is genuinely the answer. The generated log below is unchanged. -->
+- **Behaviour changes:** _none_
+- **Default changes + migration:** _auto-derived, rewrite before merge:_ commits naming a default, migration or migrate in 14dc053, bb362a0.
+- **Security and correctness:** _none_
+- **Honest nulls:** _auto-derived, rewrite before merge:_ commits carrying an honest-null marker in ba77e6a.
+- **Known limitations:** _none_
+
+### Features
+
+* **gates:** read the archived round records nothing was reading ([89eea71](https://github.com/event4u-app/agent-config/commit/89eea712b89048a032dfccf8a3bdd41f565adacc))
+
+### Bug Fixes
+
+* **gates:** stop the remediation text pointing at the closed hole ([2dc9e0d](https://github.com/event4u-app/agent-config/commit/2dc9e0d91262864237e50268d8ea54dcce761a62))
+* **gates:** rows are live wherever they appear — close the fence fail-open ([ba77e6a](https://github.com/event4u-app/agent-config/commit/ba77e6a6f4cc5c31b9de4741ee30ccc41e126df7))
+
+### Documentation
+
+* **evidence:** close the blind-pass dispositions and correct a claim I made ([0398238](https://github.com/event4u-app/agent-config/commit/0398238d99f7451712e710204c86ab41f964de50))
+* **contracts:** 2.7 is enforced now, and says what it still does not check ([d0b3650](https://github.com/event4u-app/agent-config/commit/d0b365035dc314183dcb0e353a09e3e2c5420284))
+* **roadmap:** pin-then-migrate ordering; drop the index for a round-record check ([bb362a0](https://github.com/event4u-app/agent-config/commit/bb362a0b64a5e16a156d238c1acadded44f229aa))
+* **roadmap:** record the council verdict on the fence grammar ([3e0deff](https://github.com/event4u-app/agent-config/commit/3e0deff6256050aa23fe952707ab88bf7bc9647e))
+* **review:** give the blind-pass findings terminal statuses and a carrier ([667b81e](https://github.com/event4u-app/agent-config/commit/667b81e9fa44d892095a7b057a6407196aa429bf))
+
+### Tests
+
+* **gates:** pin every fence arrangement before the grammar migration ([14dc053](https://github.com/event4u-app/agent-config/commit/14dc053d51ac1e932ce4deeb50ffb2e07737bd84))
+
+### CI
+
+* **gates:** wire check_review_dispositions with a trippable floor ([9b03190](https://github.com/event4u-app/agent-config/commit/9b0319032494345fdcaad40ae79dbe3ea95f6fc8))
+
+Tests: 10995 (+23 since 9.19.0)
+
+## [9.19.0](https://github.com/event4u-app/agent-config/compare/9.18.1...9.19.0) (2026-08-04)
+
+### Release highlights
+
+<!-- Curated head: fill before merge, keep it under 10 lines, and leave `_none_` where it is genuinely the answer. The generated log below is unchanged. -->
+- **Behaviour changes:** _none_
+- **Default changes + migration:** _none_
+- **Security and correctness:** _none_
+- **Honest nulls:** _auto-derived, rewrite before merge:_ commits carrying an honest-null marker in 1c744c3.
+- **Known limitations:** _none_
+
+### Features
+
+* **gate-coverage:** ratchet the unhardened-gate count, armed at 189 and able to fail ([5d1564f](https://github.com/event4u-app/agent-config/commit/5d1564fe0dcbeb340c97f33a29245a54c43a8591))
+* **gate-coverage:** publish the asserted count from five gates, 17 -> 22 covered ([d228aa5](https://github.com/event4u-app/agent-config/commit/d228aa5cb5019dffe11c0e4606644630450d0816))
+
+### Bug Fixes
+
+* **roadmap:** repair the archived roadmap's own relative link ([ac85f3a](https://github.com/event4u-app/agent-config/commit/ac85f3a0fdefbbed74c50cc7049c5ffc72b408a8))
+* **census:** make the scan-scope census reproducible, and regenerate it ([1e539ee](https://github.com/event4u-app/agent-config/commit/1e539ee96efc1807663342e084c2a0e666eaf9bc))
+* **lint_handoffs:** stop the CI invocation resolving --quiet as the scan root ([6994781](https://github.com/event4u-app/agent-config/commit/6994781875f8d1d2feab6012ac7704e04232447e))
+* **gates:** name the fence hole, drop the dead sort ([16dace4](https://github.com/event4u-app/agent-config/commit/16dace44b7d468aaba95abf16ec79d65d9862db8))
+
+### Documentation
+
+* **roadmap:** close road-to-gates-that-can-fail, re-charter the adoption gap ([34ff10c](https://github.com/event4u-app/agent-config/commit/34ff10c0748ea7e1c4cfdb99f423c35bba1c9a98))
+* **claims:** register the exit-2 rate alarm in the Stage-A protocol ([4653841](https://github.com/event4u-app/agent-config/commit/46538415f7a59993aef7575f32cc84582a03126f))
+* **review:** unsteered post-merge blind pass — 5 findings, 1 critical ([1c744c3](https://github.com/event4u-app/agent-config/commit/1c744c395f8d1bb727be946f459ce5a498320b5d))
+
+### Chores
+
+* **census:** regenerate after merging origin/main ([239f141](https://github.com/event4u-app/agent-config/commit/239f1413b950455efbe379976ea34a67ff02d380))
+
+Tests: 10972 (+9 since 9.18.1)
+
 ## [9.18.1](https://github.com/event4u-app/agent-config/compare/9.18.0...9.18.1) (2026-08-04)
 
 ### Release highlights

package/dist/agent-src/templates/agents/agent-project-settings.example.yml

@@ -39,7 +39,7 @@ schema_version: 1
 # CI guard: a release bump of `package.json` must update this value
 # in lockstep — see scripts/check_template_pin_drift.ts (road-to-
 # portable-runtime-and-update-check P3.3).
-agent_config_version: "9.18.1"
+agent_config_version: "9.20.0"
 
 # --- Project identity ---
 project:

package/dist/discovery/deprecation-report.md

@@ -1,6 +1,6 @@
 # Discovery — Deprecation Report
 
-- Generated: `2026-08-04T15:34:05Z`
+- Generated: `2026-08-04T21:41:44Z`
 - Deprecated artefacts: **0**
 
 _None. Tree is clean._

package/dist/discovery/discovery-manifest.json

@@ -14402,7 +14402,7 @@
       "reason": "scaffold template for ticket-bundle tickets (ADR-101); carries no runtime frontmatter — emit-tickets fills it in per ticket"
     }
   ],
-  "generated_at": "2026-08-04T15:34:05Z",
+  "generated_at": "2026-08-04T21:41:44Z",
   "packs": [
     {
       "artefact_count": 117,

package/dist/discovery/discovery-manifest.json.sha256

@@ -1 +1 @@
-9221573649a81d2b695576370a341ecdcd2d64ba0246a685d3caaf4582a78ca8  discovery-manifest.json
+759c2227292efbd65092bc4a57aa783cb714db0e6d93a1a53f6f35ba940d32aa  discovery-manifest.json

package/dist/discovery/discovery-manifest.summary.md

@@ -1,6 +1,6 @@
 # Discovery Manifest — Summary
 
-- Generated: `2026-08-04T15:34:05Z`
+- Generated: `2026-08-04T21:41:44Z`
 - Scanner: `c24312e116f8`
 - Artefacts: **594**
 - Unassigned: **0**

package/dist/discovery/orphan-report.md

@@ -1,6 +1,6 @@
 # Discovery — Orphan Report
 
-- Generated: `2026-08-04T15:34:05Z`
+- Generated: `2026-08-04T21:41:44Z`
 - Orphan artefacts: **0**
 
 > An orphan is an artefact whose declared pack has no other members.

package/dist/discovery/packs.json

@@ -1,6 +1,6 @@
 {
   "checksum": "sha256:d766f7f17140ce6b648e68821c9403c0bf478609a1ea925e85501c5994002a05",
-  "generated_at": "2026-08-04T15:34:05Z",
+  "generated_at": "2026-08-04T21:41:44Z",
   "packs": [
     {
       "always_on": false,

package/dist/discovery/trust-report.md

@@ -1,6 +1,6 @@
 # Discovery — Trust Report
 
-- Generated: `2026-08-04T15:34:05Z`
+- Generated: `2026-08-04T21:41:44Z`
 - Workspaces tracked: **10**
 - Human-review-required artefacts: **3**
 

package/dist/discovery/workspaces.json

@@ -1,6 +1,6 @@
 {
   "checksum": "sha256:d766f7f17140ce6b648e68821c9403c0bf478609a1ea925e85501c5994002a05",
-  "generated_at": "2026-08-04T15:34:05Z",
+  "generated_at": "2026-08-04T21:41:44Z",
   "scanner_version": "c24312e116f8",
   "workspaces": [
     {

package/dist/mcp/registry-manifest.json

@@ -9,7 +9,7 @@
     "homepage": "https://event4u-app.github.io/agent-config",
     "name": "@event4u/agent-config",
     "repository": "https://github.com/event4u-app/agent-config",
-    "version": "9.18.1"
+    "version": "9.20.0"
   },
   "registries": [
     {

package/dist/mcp/server.json

@@ -9,12 +9,12 @@
       "transport": {
         "type": "stdio"
       },
-      "version": "9.18.1"
+      "version": "9.20.0"
     }
   ],
   "repository": {
     "source": "github",
     "url": "https://github.com/event4u-app/agent-config"
   },
-  "version": "9.18.1"
+  "version": "9.20.0"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@event4u/agent-config",
     "mcpName": "io.github.event4u-app/agent-config",
-    "version": "9.18.1",
+    "version": "9.20.0",
     "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including \"zero runtime daemon\".",
     "license": "MIT",
     "private": false,

package/src/config/gate-coverage.yml

@@ -40,25 +40,43 @@
 #                visible, or it repeats the sin it exists to catch.
 #   canary       optional mutation recipe (Phase 7) — see CANARY below
 #
-# COVERAGE — THE HONEST DENOMINATOR (measured 2026-08-02)
-# ------------------------------------------------------
-# 211 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`.
-# **8 of them emit the machine-readable `scanned: <N>` line under their
-# CI-identical argv, and all 8 are listed below.** The manifest is therefore
-# complete with respect to its own contract, and covers ~4 % of the gate
-# population.
+# COVERAGE — THE HONEST DENOMINATOR (re-measured 2026-08-04)
+# ----------------------------------------------------------
+# 223 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`
+# (the count is computed, not asserted — `check_gate_coverage.count_gate_scripts`).
+# **22 of them emit the machine-readable `scanned: <N>` line under their
+# CI-identical argv, and all 22 are listed below.** The manifest is therefore
+# complete with respect to its own contract, and covers ~10 % of the population.
 #
-# The other ~203 are NOT covered, for one reason: rule 1. They print their count
+# The previous revision of this header claimed "8 of 211". Both halves had
+# drifted: entries were added without the header following, and the population
+# grew by 12. Numbers written in prose beside a mechanism that can compute them
+# is how a denominator goes stale — the population figure now comes from the
+# function, and the honest-denominator test bounds the drift.
+#
+# The other ~201 are NOT covered, for one reason: rule 1. They print their count
 # in prose ("111 file(s) scanned", "0 declarer(s)") or not at all, and a guard
 # that parses prose is the fragile thing being replaced. Padding this list with
 # them would manufacture exactly the false green the file exists to prevent.
 #
-# Closing the gap is one line per gate, not a new mechanism: a gate that already
-# computes its count for `_lib/scan_scope.assertScanned` need only also write
-# `scanned: <N>`. Seven gates are one line away today — they call `assertScanned`
-# / `assertWatchlistResolves` with a real count in hand: `audit_skill_overlap`,
-# `check_iron_law_prominence`, `check_safety_floor_untouched`, `lint_handoffs`,
-# `lint_namespace`, `lint_artefact_frontmatter`, `skill_linter` (listed).
+# THE "SEVEN GATES ONE LINE AWAY" NOTE IS DISCHARGED (2026-08-04). It named
+# `audit_skill_overlap`, `check_iron_law_prominence`, `check_safety_floor_untouched`,
+# `lint_handoffs`, `lint_namespace`, `lint_artefact_frontmatter`, `skill_linter`.
+# Five are now converted and listed below; `skill_linter` was already listed when
+# the note was written. `check_safety_floor_untouched` is deliberately NOT
+# converted: it is the one watch-list gate, so its "count" is the size of a fixed
+# guard list (4), not a corpus. A floor under a constant can never trip — that is
+# the false-count shape Phase 2 of the roadmap repaired, and re-introducing it
+# here to raise a coverage number would be the manufactured green this file
+# exists to prevent. It stays unlisted, named, with the reason.
+#
+# What remains is NOT one line per gate. For the ~201 the count would have to be
+# INVENTED (what is this gate's unit?) rather than published, and that judgement
+# is per-gate. It is tracked as a vulnerability ratchet — `gate-hardening:
+# unhardened-scan-scope` in src/config/gate-violation-baselines.json, which fails
+# on a RISE and targets 0 — and charter-owned by
+# `agents/roadmaps/road-to-gate-hardening-adoption.md`.
+#
 # `tests/scripts/check_gate_coverage.test.ts` fails the build the moment a gate
 # starts emitting the line without being registered here, so the list cannot
 # silently fall behind again (that omission is exactly how `check_site_links`
@@ -346,3 +364,80 @@ gates:
       from the CI invocation; nothing else changes at that switch. The entry
       stays registered so the guard reports this gate rather than skipping it
       silently.
+
+  - id: check_review_dispositions
+    argv: []
+    min_scanned: 7
+    corpus: "archived round records — `*-review.md` under agents/evidence/reviews/, excluding live `*.findings.md` (9 at baseline)"
+    status: enforced
+    note: >
+      Contract § 2.7. Unlike the R2 entry above, this floor is genuinely
+      trippable: the corpus is 9 frozen records and archived records are not
+      deleted, so a drop to 7 means the reviews root moved or the naming
+      convention drifted — not that the work went clean. That is precisely the
+      case rule 3 exists for. The gate reads the FROZEN records because R2
+      selects only artefacts in the CURRENT review scope, so a superseded round
+      renamed out of the `*.findings.md` glob is read by nothing at all — two
+      findings sat recorded as `open` in this repo's own corpus for a day
+      through exactly that gap.
+
+  # ---------------------------------------------------------------------------
+  # The five below close the gap this header named: they already called
+  # `_lib/scan_scope.assertScanned` with a real count and only had to PRINT it.
+  # The published number is not agent-derived — it is byte-identical to the value
+  # the gate's own dead-scope assertion already gates a red exit on, so there is
+  # no fresh judgement about "what a unit is" and no room for a count that drifts
+  # from what the gate inspected. That property is what made them convertible
+  # without per-gate adjudication; gates whose count would have to be INVENTED
+  # are deliberately NOT in this batch — see road-to-gate-hardening-adoption.
+  # Floors are ~87 % of the measured baseline: room for legitimate deletions,
+  # far above a collapse (rule 3).
+  # ---------------------------------------------------------------------------
+
+  - id: lint_handoffs
+    argv: ["--quiet"]
+    min_scanned: 250
+    corpus: "src/skills/*/SKILL.md (288 at baseline)"
+    status: enforced
+    note: >
+      The argv here is load-bearing, not decoration. Taskfile injects `--quiet`
+      (QUIET_FLAG) and this gate read `args[0]` as a positional path, so the CI
+      invocation resolved `--quiet` as its skills root, scanned 0 and exited 2 —
+      red in `task lint-handoffs`, green when probed bare. Fixed by filtering
+      flag-shaped args before the positional read. Registering it under the REAL
+      argv is what keeps that regression caught: a bare-probe entry would have
+      gone on passing over the broken invocation.
+
+  - id: lint_namespace
+    argv: ["--quiet"]
+    min_scanned: 540
+    corpus: "names across src/rules + src/skills + src/agent-src + src/domains/**/command.md (621 at baseline)"
+    status: enforced
+    note: >
+      Counts NAMES, not files — the scan-scope census counts files under the same
+      roots, so the two artefacts legitimately report different numbers here.
+
+  - id: lint_artefact_frontmatter
+    argv: ["--quiet"]
+    min_scanned: 540
+    corpus: "artefacts carrying frontmatter across the discovery roots (619 at baseline)"
+    status: enforced
+
+  - id: audit_skill_overlap
+    argv: ["--quiet", "--print-table", "--strict"]
+    min_scanned: 250
+    corpus: "src/skills/*/SKILL.md compared pairwise (288 at baseline)"
+    status: enforced
+    note: >
+      `--strict` is part of the CI invocation and can exit non-zero on a real
+      overlap finding. The guard reads the count independently of the exit code —
+      coverage and verdict are different questions.
+
+  - id: check_iron_law_prominence
+    argv: ["--quiet"]
+    min_scanned: 90
+    corpus: "src/rules/*.md (111 at baseline)"
+    status: enforced
+    note: >
+      Emits on stderr, not stdout: `--format json` owns this gate's stdout and a
+      count written there would corrupt the payload. The guard reads both streams.

package/src/config/gate-violation-baselines.json

@@ -1,6 +1,11 @@
 {
   "$comment": "Violation ratchet for gates whose dead scan root was repaired. A repair REVEALS pre-existing debt; it does not create it. Each entry records the count revealed at repair time — the gate fails only when its count RISES. Lowering a count is a normal commit; raising one is a defect. Entries expire: a baseline that has not dropped within 56 days of `landed` (or of `reaffirmed.date`) fails its gate, because a number that never moves is suppression with extra steps. Mechanism + rationale: src/scripts/_lib/gate_baseline.ts. Decision: AI council 2026-08-02, roadmap road-to-gates-that-can-fail blocker `dead-gate-finding-triage`.",
   "gates": {
+    "gate-hardening:unhardened-scan-scope": {
+      "count": 189,
+      "landed": "2026-08-04",
+      "note": "Gate scripts under src/scripts (population 223, the lint_/check_/audit_ prefix set) that neither route through _lib/scan_scope nor emit the machine-readable 'scanned:' line — the gates that can still report success over a moved or empty root without saying so. This is a VULNERABILITY count, not a coverage percentage: it measures how much of the original defect class is still reachable, it RISES whenever a new gate is written without a scope assertion, and its target is 0. That direction is the whole point — an adoption-reach metric ('hardened gates must increase') can never regress and would be threshold-lowering wearing a ratchet's clothes (AI council 2026-08-04, anthropic/claude-sonnet-4-5 + openai/gpt-4o, convergent on scope decomposition plus this discriminator). Clearing it is the charter of road-to-gate-hardening-adoption; the 56-day non-stagnation clause applies unchanged, so a number that never drops fails this gate rather than hardening into configuration. NEW ENTRY, not a raised threshold: this records newly-measured pre-existing exposure at first measurement — nothing was loosened."
+    },
     "check_no_new_legacy_path:hardcoded-scan-roots": {
       "count": 51,
       "landed": "2026-08-02",

package/src/scripts/audit_skill_overlap.ts

@@ -499,6 +499,10 @@ export function main(argv: string[] | null = null): number {
         process.stderr.write(`❌  ${exc.message}\n`);
         return 3;
     }
+    // Gate-coverage contract (src/config/gate-coverage.yml rule 1): publish the
+    // asserted count machine-readably. Written to stderr, not stdout, because
+    // this audit's stdout carries the report body consumers read.
+    process.stderr.write(`scanned: ${String(skills.length)}\n`);
     const pairs = find_pairs(skills, args.threshold);
     const outDir = args.outDir ?? REPORT_DIR;
     const outJson = path.join(outDir, OUT_JSON_NAME);

package/src/scripts/check_completion_review.ts

@@ -416,8 +416,26 @@ function fenceParts(line: string): { ticks: number; info: string } | null {
  * So no arrangement of bare fences can hide a row — a swallowed `open` finding
  * needs a deliberate label, which is the authoring act that means "illustration".
  * Closing follows CommonMark (bare, and at least as many backticks as the
- * opener), which also makes a ```` ````-wrapped ``` block nest correctly. An
- * unterminated labelled opener skips nothing either and is itself a stray.
+ * opener), which also makes a ```` ````-wrapped ``` block nest correctly. A
+ * labelled opener with NO bare fence after it anywhere is a stray and skips
+ * nothing.
+ *
+ * KNOWN HOLE, still open — this function does NOT deliver the property the two
+ * paragraphs above imply (blind-pass findings 1-3, 2026-08-04). A labelled
+ * opener is closed by the first later bare fence ANYWHERE in the artefact, even
+ * one the author never meant as its closer: the lines between them are skipped,
+ * a live `open` row among them vanishes from `rows`, and because the opener was
+ * consumed `strays` stays empty so no `unbalanced-fence` fires. Reproduced; an
+ * unreviewed `open` finding passes. The remediation string this file prints for
+ * `unbalanced-fence` leads an author into exactly that arrangement.
+ *
+ * Not patched here on purpose: the obvious guard — a findings-shaped row inside
+ * a fenced region is a violation — fires on every artefact that quotes the
+ * template, including the skeleton `dispatch_r2_reviewer` writes, which carries
+ * an `open` row. The fix is a §2.2 grammar decision (declare illustrative
+ * regions explicitly, or move the safety check off fence pairing), recorded in
+ * the contract as open rather than replaced with a guard that reds every future
+ * artefact.
  */
 export function scanFences(lines: readonly string[]): FenceScan {
     const fenced = new Set<number>();
@@ -448,7 +466,10 @@ export function scanFences(lines: readonly string[]): FenceScan {
     if (open !== null) {
         strays.push(open.at + 1);
     }
-    strays.sort((a, b) => a - b);
+    // No sort: bare strays are only pushed while no opener is open, so they land
+    // in ascending line order, and the unterminated-opener push above is always
+    // the largest index. A sort here was dead code (blind-pass finding 5) —
+    // keeping it would imply an ordering hazard that cannot occur.
     return { fenced, strays };
 }
 
@@ -474,10 +495,18 @@ export function parseArtifact(text: string): ParsedArtifact {
         // LABELLED closed fence is illustrative content. A stray fence (bare, or
         // an unclosed opener) skips nothing (see scanFences) — the lines around
         // it are parsed, and the artefact is reported.
-        if (FENCE_RE.test(raw) || fences.fenced.has(i)) {
+        const trimmed = raw.trim();
+        // §2.2 row-liveness rule: fences govern the marker / honest-null / skip
+        // lines, which a fenced illustration may legitimately quote — but NOT
+        // findings rows. Hiding a marker or an honest-null fails CLOSED (the
+        // artefact reads as absent and the gate blocks); hiding a row fails OPEN
+        // (the finding silently ceases to exist). So the one line type whose
+        // concealment is dangerous is the one fences may not conceal, and a row
+        // is live wherever it appears. Only its own Status cell can excuse it.
+        const isCandidateRow = trimmed.startsWith('|');
+        if (FENCE_RE.test(raw) || (fences.fenced.has(i) && !isCandidateRow)) {
             continue;
         }
-        const trimmed = raw.trim();
         // Marker candidates must LOOK like the §2.1 HTML comment: prose that
         // merely mentions the grammar (`the \`completion-review:\` marker …`,
         // or a reviewer note quoting it in backticks — real artefacts in this
@@ -523,6 +552,12 @@ export function parseArtifact(text: string): ParsedArtifact {
             if (first === '#' || second === 'severity') {
                 continue; // header row
             }
+            // §2.2: `example` is the ONE illustrative marker. It is read from the
+            // Status cell of a six-cell row only — a short row cannot excuse
+            // itself, or `malformed-row` would become opt-out.
+            if (cells.length === 6 && (cells[4] ?? '').trim().toLowerCase() === 'example') {
+                continue;
+            }
             // EXACTLY six, per contract §2.2 — not `>= 6`. An over-long row is
             // as malformed as a short one and the surplus is usually the tell:
             // an unescaped `|` inside a cell (the shape §2.2 requires escaping)
@@ -776,8 +811,9 @@ function evaluate(input: EvalInput): Violation[] {
                 detail:
                     `${at}: stray \`\`\` fence — a bare fence delimits no region, and a labelled fence must ` +
                     'be closed. An artefact whose ``` fences do not resolve is malformed (contract §2.2). ' +
-                    'Label the opener (```markdown) and close it, or inline-escape an illustrative ```; ' +
-                    'the lines around a stray fence are still parsed, so any finding row there is validated too.',
+                    'Close the fence, or inline-escape an illustrative ```. NOTE: fences never hide a ' +
+                    'findings row — a row is live wherever it appears, and the ONLY way to mark one ' +
+                    'illustrative is the status `example` in its own Status cell.',
             });
         }
     }

package/src/scripts/check_gate_coverage.ts

@@ -49,6 +49,7 @@ import process from 'node:process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import * as yaml from 'js-yaml';
+import { checkRatchet } from './_lib/gate_baseline.js';
 import { runCountedProbe } from './_lib/counted_probe.js';
 
 const _HERE = fileURLToPath(import.meta.url);
@@ -318,14 +319,76 @@ export function main(argv: readonly string[]): number {
       `⚠️  ${String(pending.length)} gate(s) are listed but NOT enforced — this guard's coverage is partial by declaration.\n`,
     );
   }
+  const hardening = report_hardening_ratchet();
   if (failed.length > 0) {
     process.stdout.write(`❌  ${String(failed.length)} gate(s) failed the coverage floor.\n`);
     return 1;
   }
+  if (hardening !== 0) {
+    return hardening;
+  }
   process.stdout.write('✅  every enforced gate cleared its coverage floor.\n');
   return 0;
 }
 
+/**
+ * Vulnerability ratchet — the count that must not RISE.
+ *
+ * This deliberately measures **defect exposure**, not adoption reach. A
+ * coverage-percentage ratchet ("hardened gates must increase") would be
+ * threshold-lowering in a ratchet's clothes: it tracks how far the fix has
+ * spread and can never regress, so it grades the solution instead of the
+ * problem. The number below is the opposite — how many gates could still exit 0
+ * over a moved root without saying so. It CAN regress (every new gate written
+ * without a scope assertion raises it) and the target stays 0.
+ *
+ * Recorded via the existing violation ratchet (`_lib/gate_baseline.ts`), so the
+ * 56-day non-stagnation clause applies unchanged: a count that never drops
+ * fails, because a frozen baseline is suppression with extra steps.
+ */
+export function report_hardening_ratchet(): number {
+  const unhardened = list_unhardened_gates();
+  const verdict = checkRatchet({
+    gate: 'gate-hardening:unhardened-scan-scope',
+    actual: unhardened.length,
+    repoRoot: REPO_ROOT,
+  });
+  process.stdout.write(`  ${verdict.ok ? '✅' : '❌'} ${verdict.message}\n`);
+  return verdict.ok ? 0 : 1;
+}
+
+/**
+ * Gate scripts that neither assert their scan scope nor publish a count — the
+ * population still able to report success over an empty corpus.
+ *
+ * A gate counts as hardened when it routes through `_lib/scan_scope` (the
+ * assertion that turns a zero scan into a red exit) OR emits the machine-
+ * readable `scanned:` line the coverage guard reads. Either one makes a dead
+ * root visible; neither is satisfiable by a gate that read nothing.
+ */
+export function list_unhardened_gates(dir = path.join(REPO_ROOT, 'src/scripts')): string[] {
+  let entries: string[];
+  try {
+    entries = fs.readdirSync(dir);
+  } catch {
+    return [];
+  }
+  const gates = entries.filter((f) => /^(lint|check|audit)_.*\.ts$/.test(f) && !f.endsWith('.d.ts'));
+  const out: string[] = [];
+  for (const f of gates) {
+    let src: string;
+    try {
+      src = fs.readFileSync(path.join(dir, f), 'utf8');
+    } catch {
+      continue;
+    }
+    const asserts = /assertScanned\(|assertWatchlistResolves\(/.test(src);
+    const emits = /(?:process\.(?:stdout|stderr)\.write|lines\.push)\(\s*`scanned: /.test(src);
+    if (!asserts && !emits) out.push(f.replace(/\.ts$/, ''));
+  }
+  return out.sort();
+}
+
 function spec_is_pending(s: GateSpec): boolean {
   return s.status === 'pending';
 }

package/src/scripts/check_iron_law_prominence.ts

@@ -277,6 +277,10 @@ export function main(argv?: readonly string[]): number {
         process.stderr.write(`❌  ${exc instanceof Error ? exc.message : String(exc)}\n`);
         return 2;
     }
+    // Gate-coverage contract (src/config/gate-coverage.yml rule 1): publish the
+    // asserted count machine-readably. Written to stderr because `--format json`
+    // owns stdout here — a count on stdout would corrupt the JSON payload.
+    process.stderr.write(`scanned: ${String(targets.length)}\n`);
 
     const all_violations: Violation[] = [];
     for (const p of targets) {

package/src/scripts/check_review_dispositions.ts

@@ -0,0 +1,188 @@
+#!/usr/bin/env tsx
+/**
+ * Archived-review disposition check (contract §2.7 + §2.2).
+ *
+ * Gate R2 selects only artefacts relevant to the CURRENT review scope (§2.6),
+ * and superseded rounds are renamed out of the `*.findings.md` glob on purpose.
+ * The consequence nobody noticed until it bit: **no validator reads archived
+ * round records at all**, so a finding left `open` after it was fixed is caught
+ * by nothing. That is exactly how two fixed findings sat recorded as `open` for
+ * a day in this repo's own corpus.
+ *
+ * This closes that gap with the smallest mechanism that covers the observed
+ * failure: archiving a round asserts the round is CLOSED, so every row in an
+ * archived record must carry a terminal status and a non-empty Reason/Ref.
+ *
+ * Deliberately NOT the disposition index with stable ids that was originally
+ * proposed. That design assumed dispositions live OUTSIDE the round records;
+ * measured across the corpus, they do not — records are terminal in place. An
+ * index would be a second artefact to keep in sync, and therefore a new drift
+ * source, guarding a failure mode that has not occurred. Trigger to revisit: a
+ * disposition that genuinely cannot be recorded in the round record itself.
+ *
+ * Scope: `*-review.md` under the reviews root, excluding `*.findings.md` (those
+ * are live artefacts and belong to `check_completion_review`).
+ *
+ * Reference SHAPE is deliberately NOT checked, and that was a measurement, not
+ * a preference. The first draft resolved a `fixed` ref via `rev-parse` and a
+ * `deferred` ref via a path probe. Run against the real corpus it produced 8
+ * blocks — every one of them a pre-existing archived record whose reference is
+ * prose describing the change, or a carrier named by bare slug. None of the 8
+ * was the failure this gate exists to catch. Archived records are frozen
+ * (§2.7), so a shape rule cannot be satisfied retroactively without editing
+ * them; a gate whose only output is unfixable blocks is the gate that gets
+ * switched off. Trigger to revisit: a review round where an unresolvable
+ * reference actually hid a disposition, on a record written AFTER this gate
+ * shipped and therefore fixable at source.
+ *
+ * Exit codes (contract §6): 0 = pass, 1 = policy violation (including a DEAD
+ * SCAN SCOPE — a gate that read nothing has not passed), 2 = internal error
+ * (the CALLER applies degraded advisory mode). `scanned:` is emitted on EVERY
+ * exit path, exit 2 included.
+ */
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+import { DeadScopeError, assertScanned } from './_lib/scan_scope.js';
+import { parseArtifact } from './check_completion_review.js';
+
+const REVIEWS_ROOT = 'agents/evidence/reviews';
+const TERMINAL = new Set(['fixed', 'accepted-risk', 'deferred']);
+
+export interface Violation {
+    kind: string;
+    file: string;
+    detail: string;
+}
+
+/** An archived record: a `*-review.md` that is not a live `*.findings.md`. */
+export function isArchivedRecord(rel: string): boolean {
+    const base = rel.replace(/\\/g, '/').split('/').pop() ?? '';
+    return base.endsWith('-review.md') && !base.endsWith('.findings.md');
+}
+
+export interface CheckOptions {
+    repo: string;
+}
+
+/** Contract §2.7: every row of an archived record is terminal, with its reference. */
+export function checkRecord(rel: string, text: string, _opts: CheckOptions): Violation[] {
+    const violations: Violation[] = [];
+    const parsed = parseArtifact(text);
+    for (const row of parsed.rows) {
+        const where = `row ${row.index} (line ${String(row.line)})`;
+        if (row.status === 'open') {
+            violations.push({
+                kind: 'open-in-archived-record',
+                file: rel,
+                detail:
+                    `${where}: status \`open\` in an ARCHIVED record. Renaming a round out of the ` +
+                    '`*.findings.md` glob asserts it is closed, so every row must already be terminal ' +
+                    '(`fixed` / `accepted-risk` / `deferred`) — contract §2.7.',
+            });
+            continue;
+        }
+        if (!TERMINAL.has(row.status)) {
+            violations.push({
+                kind: 'bad-status',
+                file: rel,
+                detail: `${where}: unknown status \`${row.status}\` — expected fixed / accepted-risk / deferred.`,
+            });
+            continue;
+        }
+        if (row.reasonRef.trim() === '') {
+            violations.push({
+                kind: 'missing-reference',
+                file: rel,
+                detail: `${where}: status \`${row.status}\` requires a Reason/Ref, which is empty.`,
+            });
+        }
+    }
+    return violations;
+}
+
+export function main(argv?: readonly string[]): number {
+    const args = argv ?? process.argv.slice(2);
+    let repo = process.cwd();
+    let root = REVIEWS_ROOT;
+    let quiet = false;
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i] as string;
+        if (a === '--repo') repo = args[++i] as string;
+        else if (a === '--reviews-root') root = args[++i] as string;
+        else if (a === '--quiet') quiet = true;
+        else if (a === '-h' || a === '--help') {
+            process.stdout.write('usage: check_review_dispositions [--repo PATH] [--reviews-root PATH] [--quiet]\n');
+            process.stdout.write('scanned: 0\n');
+            return 0;
+        }
+    }
+
+    const abs = path.resolve(repo, root);
+    let files: string[] = [];
+    try {
+        files = fs
+            .readdirSync(abs, { withFileTypes: true })
+            .filter((e) => e.isFile() && isArchivedRecord(e.name))
+            .map((e) => path.join(root, e.name))
+            .sort();
+    } catch {
+        // Absent root: report it as a DEAD SCOPE below rather than a clean pass.
+        files = [];
+    }
+
+    try {
+        assertScanned({
+            gate: 'check_review_dispositions',
+            scanned: files.length,
+            units: 'archived review record(s)',
+            roots: [root],
+        });
+    } catch (exc) {
+        // A dead scan scope is a POLICY violation (exit 1), never an internal
+        // error: exit 2 is warn-and-allow at every call site, so a moved reviews
+        // root would silently degrade this gate to advisory.
+        process.stdout.write('scanned: 0\n');
+        process.stderr.write(`❌  ${exc instanceof DeadScopeError ? exc.message : String(exc)}\n`);
+        return 1;
+    }
+
+    const violations: Violation[] = [];
+    let scanned = 0;
+    try {
+        for (const rel of files) {
+            const text = fs.readFileSync(path.resolve(repo, rel), 'utf-8');
+            scanned += 1;
+            violations.push(...checkRecord(rel, text, { repo }));
+        }
+    } catch (exc) {
+        process.stdout.write(`scanned: ${String(scanned)}\n`);
+        process.stderr.write(
+            `❌  check_review_dispositions: internal error after ${String(scanned)} record(s): ` +
+                `${exc instanceof Error ? exc.message : String(exc)}\n`,
+        );
+        return 2;
+    }
+
+    if (violations.length > 0) {
+        process.stdout.write(`❌  ${String(violations.length)} disposition violation(s):\n\n`);
+        for (const v of violations) {
+            process.stdout.write(`  ${v.kind} — ${v.file}\n    │ ${v.detail}\n`);
+        }
+    } else if (!quiet) {
+        process.stdout.write(`✅  Archived review records all terminal (${String(scanned)} record(s) scanned).\n`);
+    }
+    process.stdout.write(`scanned: ${String(scanned)}\n`);
+    return violations.length > 0 ? 1 : 0;
+}
+
+const _HERE = fileURLToPath(import.meta.url);
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) return false;
+    return import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href || process.argv[1] === _HERE;
+}
+if (_isCliEntry()) {
+    process.exit(main());
+}

package/src/scripts/dispatch_r2_reviewer.ts

@@ -535,6 +535,9 @@ function reviewerPrompt(args: {
         '- Severity ∈ {`critical`, `high`, `medium`, `low`}, rows sorted descending',
         '  by severity (ties keep authoring order).',
         '- Initial status of every finding: `open`.',
+        '- A row is LIVE wherever it appears — a code fence around it changes',
+        '  nothing. If you quote the template as an illustration, its Status cell',
+        '  must be exactly `example`, or the gate reads it as a real finding.',
         '- 0 findings → replace the table with exactly this honest-null line',
         '  (contract §2.3):',
         '',

package/src/scripts/lint_artefact_frontmatter.ts

@@ -359,6 +359,10 @@ function main(argv?: readonly string[]): number {
         process.stderr.write(`❌  ${exc.message}\n`);
         return 2;
     }
+    // Gate-coverage contract (src/config/gate-coverage.yml rule 1): publish the
+    // asserted count machine-readably, before the verdict branches, so a run
+    // that finds errors still reports the corpus it read.
+    process.stdout.write(`scanned: ${String(artefacts.length)}\n`);
     const allErrs: string[] = [];
     for (const p of artefacts) {
         allErrs.push(..._check_one(p, wsIds, packIds, quarantine));

package/src/scripts/lint_handoffs.ts

@@ -362,7 +362,13 @@ export function validate_handoff_artifact(text: string): string[] {
 
 export function main(argv?: readonly string[]): number {
     let skills_dir = SKILLS_DIR;
-    const args = argv ?? process.argv.slice(2);
+    // Positional-only: flags are NOT paths. Before this filter the CI invocation
+    // (`lint_handoffs --quiet`, injected by Taskfile's QUIET_FLAG) resolved
+    // `--quiet` as the skills root, scanned 0 files and exited 2 — the gate was
+    // red under the exact argv CI runs while green when probed bare. That is the
+    // inverse of this suite's dead-scope defect and the reason gate-coverage
+    // rule 2 pins CI-identical argv.
+    const args = (argv ?? process.argv.slice(2)).filter((a) => !String(a).startsWith('-'));
     if (args.length > 0 && String(args[0]).endsWith('HANDOFF.md')) {
         // artifact mode — validate the workflow-resume file's required fields
         const text = fs.readFileSync(_resolve(args[0] as string), 'utf-8');
@@ -399,6 +405,12 @@ export function main(argv?: readonly string[]): number {
         process.stderr.write(`❌  ${exc.message}\n`);
         return 2;
     }
+    // Gate-coverage contract (src/config/gate-coverage.yml rule 1): publish the
+    // count the assertion above just validated. Emitted before the verdict
+    // branches so a run WITH violations still reports its corpus — coverage and
+    // verdict are different questions — and outside the QUIET guard, because CI
+    // passes --quiet and a count only visible without it is not a count.
+    process.stdout.write(`scanned: ${String(scanned)}\n`);
 
     const violations = lint(skills_dir);
     if (violations.length === 0) {

package/src/scripts/lint_namespace.ts

@@ -347,6 +347,11 @@ function main(argv?: readonly string[]): number {
         process.stderr.write(`❌  ${exc.message}\n`);
         return 2;
     }
+    // Gate-coverage contract (src/config/gate-coverage.yml rule 1): publish the
+    // asserted count machine-readably. The human line below is quiet-suppressed
+    // and only prints on the clean path; this one prints on both, because a gate
+    // that found issues still scanned its corpus.
+    process.stdout.write(`scanned: ${String(checked)}\n`);
     if (issues) {
         process.stderr.write(`BASELINE: ${issues} issue(s) across ${checked} name(s)\n`);
         return 1;

package/src/scripts/sweep_dead_scan_roots.ts

@@ -372,7 +372,7 @@ export function analyze(src: string, repoRoot: string): Analysis {
     const confirmed: Finding[] = [];
     const unproven: Finding[] = [];
     const roots = new Map<string, string>();
-    const missing = (rel: string): boolean => !fs.existsSync(path.join(repoRoot, rel));
+    const missing = (rel: string): boolean => !rootExists(repoRoot, rel);
 
     for (const [rel, e] of found) {
         roots.set(rel, [...e.names].join(',') || '(inline)');
@@ -549,12 +549,46 @@ export function censusOnlyRoots(src: string, repoRoot: string): Map<string, stri
         if (rel === '' || rel.startsWith('..')) continue;
         // `node_modules/.bin/tsx` is a tool path a gate SPAWNS, not a corpus it reads.
         if (rel === 'node_modules' || rel.startsWith('node_modules/')) continue;
-        if (!fs.existsSync(path.join(repoRoot, rel))) continue; // the safety filter — see the doc comment
+        if (!rootExists(repoRoot, rel)) continue; // the safety filter — see the doc comment
         if (!out.has(rel)) out.set(rel, '(census-only)');
     }
     return out;
 }
 
+/**
+ * Does a declared root exist, independent of checkout shape?
+ *
+ * A plain `existsSync` answers differently in a linked git worktree, where
+ * `.git` is a FILE containing `gitdir: …` rather than a directory — so a root
+ * like `.git/HEAD` resolves in a clone and vanishes in a worktree. The census
+ * has to "match a fresh run" to be worth committing, and a report whose rows
+ * depend on which checkout generated it cannot. Resolving `.git/*` through the
+ * real git directory makes the two agree.
+ */
+export function resolveRoot(repoRoot: string, rel: string): string {
+    if (rel === '.git' || rel.startsWith('.git/')) {
+        const gitPath = path.join(repoRoot, '.git');
+        try {
+            if (fs.statSync(gitPath).isFile()) {
+                // `gitdir: <abs-or-relative path>` — the worktree's real git dir.
+                const m = /^gitdir:\s*(.+)$/m.exec(fs.readFileSync(gitPath, 'utf8'));
+                const target = m?.[1]?.trim();
+                if (target !== undefined && target !== '') {
+                    const gitDir = path.isAbsolute(target) ? target : path.join(repoRoot, target);
+                    return rel === '.git' ? gitDir : path.join(gitDir, rel.slice('.git/'.length));
+                }
+            }
+        } catch {
+            /* fall through to the plain join — a missing .git is genuinely absent */
+        }
+    }
+    return path.join(repoRoot, rel);
+}
+
+export function rootExists(repoRoot: string, rel: string): boolean {
+    return fs.existsSync(resolveRoot(repoRoot, rel));
+}
+
 /** Directories never worth walking for a unit count. */
 const COUNT_SKIP: ReadonlySet<string> = new Set(['node_modules', '.git', '.venv', '__pycache__']);
 
@@ -578,7 +612,7 @@ export interface RootCount {
  * a container migration shows up as a diff instead of as silence.
  */
 export function countUnits(repoRoot: string, rel: string): RootCount {
-    const abs = path.join(repoRoot, rel);
+    const abs = resolveRoot(repoRoot, rel);
     let st: fs.Stats;
     try {
         st = fs.statSync(abs);