@event4u/agent-config 9.20.0 → 9.22.0

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Bootstrap shim for the event4u agent-config suite. This plugin ships ONLY the dispatcher hooks plus one install-pointer skill — ALL content (skills, rules, commands) is installed via `npx -y @event4u/agent-config init`, which writes the file projection AND registers the same hooks in ~/.claude/settings.json. DEPRECATED as a content channel; kept so the marketplace listing stays discoverable and existing installs keep working hooks.",
-    "version": "9.20.0",
+    "version": "9.22.0",
     "keywords": [
       "agent-config",
       "skills",

package/CHANGELOG.md

@@ -294,6 +294,92 @@ Entry-shape contract: [`docs/contracts/CHANGELOG-conventions.md`](docs/contracts
 > that forces a new era split (`# Era: 9.19.x`, etc.) — see
 > [`docs/contracts/CHANGELOG-conventions.md § Era splits`](docs/contracts/CHANGELOG-conventions.md).
 
+## [9.22.0](https://github.com/event4u-app/agent-config/compare/9.21.0...9.22.0) (2026-08-05)
+
+### Release highlights
+
+<!-- Curated head: fill before merge, keep it under 10 lines, and leave `_none_` where it is genuinely the answer. The generated log below is unchanged. -->
+- **Behaviour changes:** _none_
+- **Default changes + migration:** _none_
+- **Security and correctness:** _none_
+- **Honest nulls:** _none_
+- **Known limitations:** _none_
+
+### Features
+
+* **worktree:** classify every worktree safe/review/live in one pass ([ac42fa6](https://github.com/event4u-app/agent-config/commit/ac42fa6c041db0343b6363472541a2fdf3815c3c))
+* **bench:** report which arm the dropped pairs came from ([9230102](https://github.com/event4u-app/agent-config/commit/9230102868bd25a20aa2e30e35a9e57d45c0051c))
+* **bench:** fail the sweep on an unproven arm, a swapped model, or an overrun ([490a5e5](https://github.com/event4u-app/agent-config/commit/490a5e5995db3e2f49676d7df5a0db41bf8e3926))
+* **bench:** record which model actually answered each run ([5ea6b60](https://github.com/event4u-app/agent-config/commit/5ea6b60cb850e10299fe66c4c9e8aa0fd612772f))
+* **bench:** the activation audit the invalid-nulls incident needed ([2630c48](https://github.com/event4u-app/agent-config/commit/2630c481b834b192c974cf828b72b2b3a3304b81))
+
+### Bug Fixes
+
+* **bench:** validate the sweep cap before probing for the host CLI ([4aee1d8](https://github.com/event4u-app/agent-config/commit/4aee1d8aa02598db80d0cad819fe85618558dc53))
+
+### Documentation
+
+* **roadmap:** promote worktree hygiene on the fired disk trigger, record the baseline ([78d5b7a](https://github.com/event4u-app/agent-config/commit/78d5b7ab2691b7cb75e094fa724e5a3eaa5d2f06))
+* **worktree:** route whole-checkout sweeps through the inventory mode ([3ba4c55](https://github.com/event4u-app/agent-config/commit/3ba4c556a7eee4256be3378bd67aa962b884dede))
+* **roadmap:** name why Measurement A cannot run, and correct my own scope ruling ([460dfb0](https://github.com/event4u-app/agent-config/commit/460dfb0c5e2d96e8deb831638684f501522661d2))
+* **bench:** withdraw the interactions degradation rule — measured, then falsified ([56d3fe3](https://github.com/event4u-app/agent-config/commit/56d3fe3b1433c69419a7d118c567ea2581a0a0d2))
+* **roadmap:** close the UI-track prerequisites and name the real blocker ([e8fa469](https://github.com/event4u-app/agent-config/commit/e8fa46953df5afacfb402a6d8468b44b72155191))
+* **bench:** pre-register the UI-track tier and lane measurements ([3a8b601](https://github.com/event4u-app/agent-config/commit/3a8b6017965bc9eed189c1971f28a6212b9dc3d3))
+* **roadmap:** record prerequisite work that moves no checkbox ([ad3bd4e](https://github.com/event4u-app/agent-config/commit/ad3bd4e9903e81ef38e647a6cbddacbd95f4f282))
+
+Tests: 11091 (+57 since 9.21.0)
+
+## [9.21.0](https://github.com/event4u-app/agent-config/compare/9.20.0...9.21.0) (2026-08-05)
+
+### Release highlights
+
+<!-- Curated head: fill before merge, keep it under 10 lines, and leave `_none_` where it is genuinely the answer. The generated log below is unchanged. -->
+- **Behaviour changes:** _none_
+- **Default changes + migration:** _none_
+- **Security and correctness:** _none_
+- **Honest nulls:** _none_
+- **Known limitations:** _none_
+
+### Features
+
+* **gates:** take the unhardened-gate count to 0 and delete the ratchet entry ([e31690c](https://github.com/event4u-app/agent-config/commit/e31690c7330bb90ed813cc25ead2268da2971ea1))
+* **gates:** repoint lint_skill_tools at the .ts corpus and harden it ([694a729](https://github.com/event4u-app/agent-config/commit/694a729359e674953881a996af6079123e91a98d))
+* **gates:** fold bite-sized granularity into lint_roadmap_complexity ([08d9075](https://github.com/event4u-app/agent-config/commit/08d9075c978a6a76a250a74fe6377ad3b2c2d8a2))
+* **gates:** assert the scan scope of the last 57 gates — 61 → 4 ([5244b21](https://github.com/event4u-app/agent-config/commit/5244b21ea664db73a3a07c8ce717a2b43c4ba157))
+* **gates:** assert the scan scope of 54 more gates — 115 → 61 ([835fd54](https://github.com/event4u-app/agent-config/commit/835fd545649287574c9d74e3280302ca429b8d20))
+* **gates:** assert the scan scope of 48 tree-walking gates ([9cc51a2](https://github.com/event4u-app/agent-config/commit/9cc51a20c8d3d3c9f133d0bb8a94a322b90ee235))
+* **gates:** assert the scan scope of 28 more corpus gates ([f4e79e4](https://github.com/event4u-app/agent-config/commit/f4e79e4a8f7c90e27353693f42d27c1a70bbdac4))
+* **gates:** classify the corpusless gates by what they read ([c7a851b](https://github.com/event4u-app/agent-config/commit/c7a851becd7a77ff85c7c443c59ca45b91bc7ef3))
+* **gates:** assert the scan scope of five corpus gates ([7433f72](https://github.com/event4u-app/agent-config/commit/7433f72482c639bf88d01e58e093d7c57a608960))
+* **gates:** derive the conversion work-list instead of reading 189 gates ([b845e4d](https://github.com/event4u-app/agent-config/commit/b845e4df66e90b1d43a42f9fa55bb41457b4a1b5))
+* **scan-scope:** pair the scope assertion with the published count ([b8b2840](https://github.com/event4u-app/agent-config/commit/b8b2840d17466f0be5047fbaa98ed67751a93a70))
+
+### Bug Fixes
+
+* **gates:** read piped stdin whole — a gate that only broke on big diffs ([0e3e9cd](https://github.com/event4u-app/agent-config/commit/0e3e9cd4ca91c01c00d8c611a96db72b936952d8))
+* **gates:** clear the two preflight blockers the repairs introduced ([2683395](https://github.com/event4u-app/agent-config/commit/268339595ca2dd34b14a1a63abd6362fde7868fb))
+* **gates:** repair two dead scan roots the widened population revealed ([5b41c55](https://github.com/event4u-app/agent-config/commit/5b41c556bc245c4eb9da7506b4de449a3cde07b0))
+* **gates:** one definition of "a gate", and an honest denominator ([9f65efe](https://github.com/event4u-app/agent-config/commit/9f65efea7882d4c79f2e5f4c8fcefb0b521bcdde))
+* **gate-coverage:** an unenforced `scanned:` line hardens nothing ([2873c91](https://github.com/event4u-app/agent-config/commit/2873c919d0245ca76a18f2315c768b9a9cb1e1ca))
+
+### Documentation
+
+* **roadmap:** close and archive road-to-gate-hardening-adoption ([d1497c5](https://github.com/event4u-app/agent-config/commit/d1497c5fc12f5475b683f27b42953cf2f448def8))
+* **roadmap:** file the four-gate blocker where the dashboard reads it ([7e0c8e9](https://github.com/event4u-app/agent-config/commit/7e0c8e9e369c29a7574c99f1ec453835e1ae44e9))
+* **roadmap:** close Phase 1 — the mechanically-safe conversions ([877859a](https://github.com/event4u-app/agent-config/commit/877859ac99e70a79630b201a025a474df156fe55))
+* **roadmap:** record the assert-first conversion contract ([613d478](https://github.com/event4u-app/agent-config/commit/613d47878252edfe8c5d225d73c1bed3fe6fb753))
+
+### Refactoring
+
+* **gates:** re-home the ADR-095 workspace boundary to ESLint ([2bc2483](https://github.com/event4u-app/agent-config/commit/2bc24833149cff33573a84c9dfbc973b5b3b5fe3))
+* **hooks:** rename verify_before_complete_hook off the gate prefix ([f57d969](https://github.com/event4u-app/agent-config/commit/f57d969c6c54e591060054f217a12d816d121116))
+
+### Chores
+
+* **tests:** drop a dead helper the lint scope only now reaches ([9b49d24](https://github.com/event4u-app/agent-config/commit/9b49d240140c9b6af28969c752f4757bf5580d98))
+
+Tests: 11034 (+39 since 9.20.0)
+
 ## [9.20.0](https://github.com/event4u-app/agent-config/compare/9.19.0...9.20.0) (2026-08-04)
 
 ### Release highlights

package/dist/agent-src/commands/worktree/cleanup.md

@@ -31,6 +31,23 @@ never force-removes.
 `git worktree list --porcelain` — target the worktree(s) named by the
 user, or every non-main worktree when asked to "clean up".
 
+For a whole-checkout sweep, get the classified set in one pass instead of
+running the per-worktree gate by hand:
+
+```bash
+./scripts-run src/scripts/worktree_cleanup_check inventory        # counts + review reasons
+./scripts-run src/scripts/worktree_cleanup_check inventory --plan # commands for the safe set
+```
+
+`safe` = on a branch, merged into the trunk, clean, in a conventional
+worktree root, and no git activity for 48 h. `review` carries its
+disqualifying reason; `live` means another session may hold it. The mode
+reports only — running the plan is a bulk deletion needing the user's
+explicit this-turn approval per
+[`non-destructive-by-default`](../../../rules/non-destructive-by-default.md).
+Present the safe set as a list and wait; a bulk sweep never inherits a
+single earlier approval.
+
 ### 2. Per candidate, run the gates IN ORDER
 
 Run the deterministic gate helper (edge-case-tested: detached HEAD,

package/dist/agent-src/commands/worktree/status.md

@@ -29,6 +29,12 @@ git worktree list --porcelain
 ```
 
 One report block per worktree (skip the main working tree unless asked).
+Above roughly a dozen worktrees a per-worktree block stops being readable —
+lead with the aggregate instead, then block only what the user asks about:
+
+```bash
+./scripts-run src/scripts/worktree_cleanup_check inventory
+```
 
 ### 2. Per worktree, gather
 

package/dist/agent-src/skills/worktree-lifecycle/SKILL.md

@@ -128,6 +128,28 @@ step (`scope-control`); never force-delete (`-D`) as part of cleanup.
 Cross-worktree scope-lock overlaps are scanned via
 `worktree_cleanup_check scope-overlap` (surfaced by `/worktree status`).
 
+**Whole-checkout sweeps.** Worktrees accumulate one per branch and are never
+removed on merge; `git worktree prune` only clears registrations whose
+directory is already gone, so it does nothing for the live ones. Classify the
+whole set in one pass rather than gate-checking by hand:
+
+```bash
+npx tsx node_modules/@event4u/agent-config/src/scripts/worktree_cleanup_check.ts inventory [repo] [--json|--plan]
+```
+
+`safe` requires all of: on a branch, merged into the trunk, clean, inside a
+conventional worktree root (`.claude/worktrees/` or `.worktrees/`), and no git
+activity for 48 h. `review` keeps its disqualifying reason so the next sweep
+starts from a shorter list; `live` means another session may hold it. A
+worktree outside the conventional roots is never `safe` — sitting beside the
+repo it can be mistaken for a sibling package, so its removal stays a
+judgement call.
+
+The mode reports only. `--plan` prints `git worktree remove` plus
+`git branch -d` (never `-D`) for the safe set; **running it is a bulk deletion
+needing the user's explicit this-turn approval**
+(`non-destructive-by-default`), which a single earlier approval never covers.
+
 ## Host-native mapping
 
 | Host capability | Use |

package/dist/agent-src/templates/agents/agent-project-settings.example.yml

@@ -39,7 +39,7 @@ schema_version: 1
 # CI guard: a release bump of `package.json` must update this value
 # in lockstep — see scripts/check_template_pin_drift.ts (road-to-
 # portable-runtime-and-update-check P3.3).
-agent_config_version: "9.20.0"
+agent_config_version: "9.22.0"
 
 # --- Project identity ---
 project:

package/dist/cli-delegate/{chunk-XGA2NTU4.js → chunk-3EWYC3YK.js}

@@ -457,6 +457,29 @@ function _pyJsonScalarAscii(value) {
   return _pyJsonScalar(value);
 }
 
+// src/scripts/_lib/scan_scope.ts
+var DeadScopeError = class extends Error {
+  gate;
+  constructor(gate, message) {
+    super(message);
+    this.name = "DeadScopeError";
+    this.gate = gate;
+  }
+};
+function assertScanned(opts) {
+  if (opts.scanned > 0) {
+    return;
+  }
+  if (opts.allowEmpty !== void 0 && opts.allowEmpty.trim() !== "") {
+    return;
+  }
+  const roots = opts.roots.length > 0 ? opts.roots.join(", ") : "(no root declared)";
+  throw new DeadScopeError(
+    opts.gate,
+    `${opts.gate}: scanned 0 ${opts.units} under ${roots} \u2014 the scan scope is dead or the root moved. A gate that read nothing has not passed. Repoint the root (prefer the shared resolver in _lib/agent_src.ts), or declare a justified \`allowEmpty\` reason if an empty corpus is genuinely expected.`
+  );
+}
+
 // src/scripts/lint_hidden_unicode.ts
 var CHECK = "hidden-unicode";
 var _BIDI = /* @__PURE__ */ new Set([
@@ -872,7 +895,9 @@ function main(argv = null) {
   const args = parse_args(argv ?? process.argv.slice(2));
   const findings = [];
   const flagged = /* @__PURE__ */ new Set();
+  let corpusFiles = 0;
   for (const sf of iter_corpus()) {
+    corpusFiles += 1;
     const hits = _scan(sf);
     for (const h of hits) {
       findings.push(h);
@@ -881,6 +906,21 @@ function main(argv = null) {
       flagged.add(sf.path);
     }
   }
+  try {
+    assertScanned({
+      gate: "lint_hidden_unicode",
+      scanned: corpusFiles,
+      units: "corpus file(s)",
+      roots: DEFAULT_SCAN_ROOTS
+    });
+  } catch (exc) {
+    if (exc instanceof DeadScopeError) {
+      process.stderr.write(`\u274C  ${exc.message}
+`);
+      return 1;
+    }
+    throw exc;
+  }
   const sourceFiles = _eligibleSourceFiles();
   for (const h of _scanSourceControlBytes(sourceFiles)) {
     findings.push(h);

package/dist/cli-delegate/cmd_handoff.js

@@ -6,7 +6,7 @@ import {
   readHookStdin,
   read_entries
 } from "./chunk-AIIUU73N.js";
-import "./chunk-XGA2NTU4.js";
+import "./chunk-3EWYC3YK.js";
 import {
   _RAW_KEY_PREFIXES,
   hardenedSpawnEnv

package/dist/cli-delegate/cmd_memory_get.js

@@ -2,7 +2,7 @@
 import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
 import {
   memory_get_v1
-} from "./chunk-XGA2NTU4.js";
+} from "./chunk-3EWYC3YK.js";
 import "./chunk-OY53J6II.js";
 import "./chunk-J55WI3RR.js";
 

package/dist/cli-delegate/cmd_route_audit.js

@@ -6,7 +6,7 @@ import {
 import {
   read_entries
 } from "./chunk-AIIUU73N.js";
-import "./chunk-XGA2NTU4.js";
+import "./chunk-3EWYC3YK.js";
 import {
   load_agent_settings
 } from "./chunk-HJ6DAJHR.js";

package/dist/discovery/deprecation-report.md

@@ -1,6 +1,6 @@
 # Discovery — Deprecation Report
 
-- Generated: `2026-08-04T21:41:44Z`
+- Generated: `2026-08-05T05:32:20Z`
 - Deprecated artefacts: **0**
 
 _None. Tree is clean._

package/dist/discovery/discovery-manifest.json

@@ -1977,7 +1977,7 @@
     },
     {
       "category": "command",
-      "checksum": "sha256:6efc669962a6f31d36731708ef37977505c8eaf29d4c9a6ef488037eed42ec1a",
+      "checksum": "sha256:e0e438bb85349bc013a609e6def8d70e7b749dcd97adff313d5db535987f7e95",
       "install": {
         "default": true,
         "removable": false
@@ -2055,7 +2055,7 @@
     },
     {
       "category": "command",
-      "checksum": "sha256:0e0fcdddceaa2fe3c2ef63f8a6557182f310da33a04cfb53199fb20cebed0f26",
+      "checksum": "sha256:68e5e30c2c90957615582840f804ce957bf1708319029b378ea97e384d05a1e8",
       "install": {
         "default": true,
         "removable": false
@@ -14220,7 +14220,7 @@
     },
     {
       "category": "skill",
-      "checksum": "sha256:66795187ffedce5896afb29d5c2794d7de0d55c7e2849b5bb001722bb0ba6975",
+      "checksum": "sha256:6031d5e7109a96a5a105ac91ea80c0df66d9934594a11d0c3efcf8b596cc48cf",
       "install": {
         "default": true,
         "removable": false
@@ -14259,7 +14259,7 @@
       "workspaces": []
     }
   ],
-  "checksum": "sha256:d766f7f17140ce6b648e68821c9403c0bf478609a1ea925e85501c5994002a05",
+  "checksum": "sha256:acdebb0b72b50f8026c14b11df8706155fb82ba5c44cff7fa47b6e019052d156",
   "deprecations": [
     {
       "key": "tier",
@@ -14402,7 +14402,7 @@
       "reason": "scaffold template for ticket-bundle tickets (ADR-101); carries no runtime frontmatter — emit-tickets fills it in per ticket"
     }
   ],
-  "generated_at": "2026-08-04T21:41:44Z",
+  "generated_at": "2026-08-05T05:32:20Z",
   "packs": [
     {
       "artefact_count": 117,

package/dist/discovery/discovery-manifest.json.sha256

@@ -1 +1 @@
-759c2227292efbd65092bc4a57aa783cb714db0e6d93a1a53f6f35ba940d32aa  discovery-manifest.json
+afd8d19ae939ff4cc011583591c8ae9f88601d301d808874f41cfb43f0d1122a  discovery-manifest.json

package/dist/discovery/discovery-manifest.summary.md

@@ -1,6 +1,6 @@
 # Discovery Manifest — Summary
 
-- Generated: `2026-08-04T21:41:44Z`
+- Generated: `2026-08-05T05:32:20Z`
 - Scanner: `c24312e116f8`
 - Artefacts: **594**
 - Unassigned: **0**

package/dist/discovery/orphan-report.md

@@ -1,6 +1,6 @@
 # Discovery — Orphan Report
 
-- Generated: `2026-08-04T21:41:44Z`
+- Generated: `2026-08-05T05:32:20Z`
 - Orphan artefacts: **0**
 
 > An orphan is an artefact whose declared pack has no other members.

package/dist/discovery/packs.json

@@ -1,6 +1,6 @@
 {
-  "checksum": "sha256:d766f7f17140ce6b648e68821c9403c0bf478609a1ea925e85501c5994002a05",
-  "generated_at": "2026-08-04T21:41:44Z",
+  "checksum": "sha256:acdebb0b72b50f8026c14b11df8706155fb82ba5c44cff7fa47b6e019052d156",
+  "generated_at": "2026-08-05T05:32:20Z",
   "packs": [
     {
       "always_on": false,

package/dist/discovery/trust-report.md

@@ -1,6 +1,6 @@
 # Discovery — Trust Report
 
-- Generated: `2026-08-04T21:41:44Z`
+- Generated: `2026-08-05T05:32:20Z`
 - Workspaces tracked: **10**
 - Human-review-required artefacts: **3**
 

package/dist/discovery/workspaces.json

@@ -1,6 +1,6 @@
 {
-  "checksum": "sha256:d766f7f17140ce6b648e68821c9403c0bf478609a1ea925e85501c5994002a05",
-  "generated_at": "2026-08-04T21:41:44Z",
+  "checksum": "sha256:acdebb0b72b50f8026c14b11df8706155fb82ba5c44cff7fa47b6e019052d156",
+  "generated_at": "2026-08-05T05:32:20Z",
   "scanner_version": "c24312e116f8",
   "workspaces": [
     {

package/dist/hooks/dispatch.js

@@ -8170,6 +8170,29 @@ function _pyJsonScalarAscii(value) {
   return _pyJsonScalar(value);
 }
 
+// src/scripts/_lib/scan_scope.ts
+var DeadScopeError = class extends Error {
+  gate;
+  constructor(gate, message) {
+    super(message);
+    this.name = "DeadScopeError";
+    this.gate = gate;
+  }
+};
+function assertScanned(opts) {
+  if (opts.scanned > 0) {
+    return;
+  }
+  if (opts.allowEmpty !== void 0 && opts.allowEmpty.trim() !== "") {
+    return;
+  }
+  const roots = opts.roots.length > 0 ? opts.roots.join(", ") : "(no root declared)";
+  throw new DeadScopeError(
+    opts.gate,
+    `${opts.gate}: scanned 0 ${opts.units} under ${roots} \u2014 the scan scope is dead or the root moved. A gate that read nothing has not passed. Repoint the root (prefer the shared resolver in _lib/agent_src.ts), or declare a justified \`allowEmpty\` reason if an empty corpus is genuinely expected.`
+  );
+}
+
 // src/scripts/lint_hidden_unicode.ts
 var CHECK = "hidden-unicode";
 var _BIDI = /* @__PURE__ */ new Set([
@@ -8585,7 +8608,9 @@ function main(argv = null) {
   const args = parse_args(argv ?? process.argv.slice(2));
   const findings = [];
   const flagged = /* @__PURE__ */ new Set();
+  let corpusFiles = 0;
   for (const sf of iter_corpus()) {
+    corpusFiles += 1;
     const hits = _scan(sf);
     for (const h of hits) {
       findings.push(h);
@@ -8594,6 +8619,21 @@ function main(argv = null) {
       flagged.add(sf.path);
     }
   }
+  try {
+    assertScanned({
+      gate: "lint_hidden_unicode",
+      scanned: corpusFiles,
+      units: "corpus file(s)",
+      roots: DEFAULT_SCAN_ROOTS
+    });
+  } catch (exc) {
+    if (exc instanceof DeadScopeError) {
+      process.stderr.write(`\u274C  ${exc.message}
+`);
+      return 1;
+    }
+    throw exc;
+  }
   const sourceFiles = _eligibleSourceFiles();
   for (const h of _scanSourceControlBytes(sourceFiles)) {
     findings.push(h);
@@ -14983,7 +15023,7 @@ if (isCliEntry3) {
   process.exit(main11(process.argv.slice(2)));
 }
 
-// src/scripts/verify_before_complete_hook.ts
+// src/scripts/before_complete_hook.ts
 import fs19 from "node:fs";
 import path18 from "node:path";
 import { fileURLToPath as fileURLToPath13, pathToFileURL as pathToFileURL9 } from "node:url";
@@ -19005,6 +19045,22 @@ function main27() {
   for (const f of walkDir(scanDir, /\.(html|htm|css|scss|sass|less|vue|svelte|astro|jsx|tsx|md|mdx)$/i)) {
     if (!ignoreGlobs.some((g) => f.includes(g.replace("**", "")))) files.push(f);
   }
+  try {
+    assertScanned({
+      gate: "lint_design_slop",
+      scanned: files.length,
+      units: "design source file(s)",
+      // Absolute: --dir may point outside the cwd (or outside any repo).
+      roots: [scanDir]
+    });
+  } catch (exc) {
+    if (exc instanceof DeadScopeError) {
+      process.stderr.write(`\u274C  ${exc.message}
+`);
+      process.exit(1);
+    }
+    throw exc;
+  }
   const findings = [];
   for (const fp of files) {
     const rel = path37.relative(process.cwd(), fp);
@@ -19461,7 +19517,7 @@ var CONCERN_REGISTRY = {
   "src/scripts/roadmap_progress_hook.ts": main9,
   "src/scripts/onboarding_gate_hook.ts": main10,
   "src/scripts/context_hygiene_hook.ts": main11,
-  "src/scripts/verify_before_complete_hook.ts": main12,
+  "src/scripts/before_complete_hook.ts": main12,
   "src/scripts/minimal_safe_diff_hook.ts": main13,
   "src/scripts/injection_scan_hook.ts": main14,
   "src/scripts/memory_learn_hook.ts": main15,

package/dist/mcp/registry-manifest.json

@@ -3,13 +3,13 @@
     "artefact_count": 594,
     "scanner_version": "c24312e116f8"
   },
-  "generated_at": "2026-08-04",
+  "generated_at": "2026-08-05",
   "package": {
     "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) \u2014 every claim machine-checked, including \"zero runtime daemon\".",
     "homepage": "https://event4u-app.github.io/agent-config",
     "name": "@event4u/agent-config",
     "repository": "https://github.com/event4u-app/agent-config",
-    "version": "9.20.0"
+    "version": "9.22.0"
   },
   "registries": [
     {

package/dist/mcp/server.json

@@ -9,12 +9,12 @@
       "transport": {
         "type": "stdio"
       },
-      "version": "9.20.0"
+      "version": "9.22.0"
     }
   ],
   "repository": {
     "source": "github",
     "url": "https://github.com/event4u-app/agent-config"
   },
-  "version": "9.20.0"
+  "version": "9.22.0"
 }

package/dist/mcp/server.mjs

@@ -9362,6 +9362,35 @@ var init_security_lint = __esm({
   }
 });
 
+// src/scripts/_lib/scan_scope.ts
+function assertScanned(opts) {
+  if (opts.scanned > 0) {
+    return;
+  }
+  if (opts.allowEmpty !== void 0 && opts.allowEmpty.trim() !== "") {
+    return;
+  }
+  const roots = opts.roots.length > 0 ? opts.roots.join(", ") : "(no root declared)";
+  throw new DeadScopeError(
+    opts.gate,
+    `${opts.gate}: scanned 0 ${opts.units} under ${roots} \u2014 the scan scope is dead or the root moved. A gate that read nothing has not passed. Repoint the root (prefer the shared resolver in _lib/agent_src.ts), or declare a justified \`allowEmpty\` reason if an empty corpus is genuinely expected.`
+  );
+}
+var DeadScopeError;
+var init_scan_scope = __esm({
+  "src/scripts/_lib/scan_scope.ts"() {
+    "use strict";
+    DeadScopeError = class extends Error {
+      gate;
+      constructor(gate, message) {
+        super(message);
+        this.name = "DeadScopeError";
+        this.gate = gate;
+      }
+    };
+  }
+});
+
 // src/scripts/lint_hidden_unicode.ts
 import * as fs7 from "node:fs";
 import * as path7 from "node:path";
@@ -9549,7 +9578,9 @@ function main(argv = null) {
   const args = parse_args(argv ?? process.argv.slice(2));
   const findings = [];
   const flagged = /* @__PURE__ */ new Set();
+  let corpusFiles = 0;
   for (const sf of iter_corpus()) {
+    corpusFiles += 1;
     const hits = _scan(sf);
     for (const h of hits) {
       findings.push(h);
@@ -9558,6 +9589,21 @@ function main(argv = null) {
       flagged.add(sf.path);
     }
   }
+  try {
+    assertScanned({
+      gate: "lint_hidden_unicode",
+      scanned: corpusFiles,
+      units: "corpus file(s)",
+      roots: DEFAULT_SCAN_ROOTS
+    });
+  } catch (exc) {
+    if (exc instanceof DeadScopeError) {
+      process.stderr.write(`\u274C  ${exc.message}
+`);
+      return 1;
+    }
+    throw exc;
+  }
   const sourceFiles = _eligibleSourceFiles();
   for (const h of _scanSourceControlBytes(sourceFiles)) {
     findings.push(h);
@@ -9608,6 +9654,7 @@ var init_lint_hidden_unicode = __esm({
   "src/scripts/lint_hidden_unicode.ts"() {
     "use strict";
     init_security_lint();
+    init_scan_scope();
     CHECK = "hidden-unicode";
     _BIDI = /* @__PURE__ */ new Set([
       8234,
@@ -14000,35 +14047,6 @@ var init_release_scope = __esm({
   }
 });
 
-// src/scripts/_lib/scan_scope.ts
-function assertScanned(opts) {
-  if (opts.scanned > 0) {
-    return;
-  }
-  if (opts.allowEmpty !== void 0 && opts.allowEmpty.trim() !== "") {
-    return;
-  }
-  const roots = opts.roots.length > 0 ? opts.roots.join(", ") : "(no root declared)";
-  throw new DeadScopeError(
-    opts.gate,
-    `${opts.gate}: scanned 0 ${opts.units} under ${roots} \u2014 the scan scope is dead or the root moved. A gate that read nothing has not passed. Repoint the root (prefer the shared resolver in _lib/agent_src.ts), or declare a justified \`allowEmpty\` reason if an empty corpus is genuinely expected.`
-  );
-}
-var DeadScopeError;
-var init_scan_scope = __esm({
-  "src/scripts/_lib/scan_scope.ts"() {
-    "use strict";
-    DeadScopeError = class extends Error {
-      gate;
-      constructor(gate, message) {
-        super(message);
-        this.name = "DeadScopeError";
-        this.gate = gate;
-      }
-    };
-  }
-});
-
 // src/scripts/skill_linter.ts
 var skill_linter_exports = {};
 __export(skill_linter_exports, {

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@event4u/agent-config",
     "mcpName": "io.github.event4u-app/agent-config",
-    "version": "9.20.0",
+    "version": "9.22.0",
     "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including \"zero runtime daemon\".",
     "license": "MIT",
     "private": false,