@event4u/agent-config 9.20.0 → 9.22.0

package/src/scripts/check_beta_review_markers.ts

@@ -19,6 +19,8 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
+import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
+
 const _HERE = fileURLToPath(import.meta.url);
 const ROOT = path.resolve(path.dirname(_HERE), '..', '..');
 const CONTRACTS_DIR = 'docs/contracts';
@@ -191,9 +193,28 @@ function main(): number {
     const args = parse_args(process.argv.slice(2));
     const todayOrdinal = _todayOrdinal();
     const violations: Violation[] = [];
-    for (const p of _globMdSorted(path.join(ROOT, CONTRACTS_DIR))) {
+    const contracts = _globMdSorted(path.join(ROOT, CONTRACTS_DIR));
+    for (const p of contracts) {
         violations.push(...check_one(p, todayOrdinal));
     }
+    // Count every contract read, not the `stability: beta` subset: over a moved
+    // `docs/contracts/` "no beta contracts" and "no contracts at all" produce
+    // the same clean line, and only the second is a dead gate. Exit 1 is the
+    // violation code; 3 stays reserved for the internal-error handler below.
+    try {
+        assertScanned({
+            gate: 'check_beta_review_markers',
+            scanned: contracts.length,
+            units: 'contract file(s)',
+            roots: [CONTRACTS_DIR],
+        });
+    } catch (exc) {
+        if (exc instanceof DeadScopeError) {
+            process.stderr.write(`❌  ${exc.message}\n`);
+            return 1;
+        }
+        throw exc;
+    }
     if (args.json) {
         process.stdout.write(JSON.stringify({ violations }, null, 2) + '\n');
     } else {

package/src/scripts/check_bridge_derivation.ts

@@ -25,6 +25,8 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
+import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
+
 const _HERE = fileURLToPath(import.meta.url);
 const REPO_ROOT = path.join(path.dirname(_HERE), '..', '..');
 
@@ -135,6 +137,17 @@ export function run(repoRoot: string): string[] {
     const before: Record<string, Record<string, string>> = {};
     for (const r of roots) before[r] = snapshot_tree(r);
 
+    // Both legs are diffs over these snapshots: with no bridge trees on disk
+    // there is nothing to diff and nothing to validate, and the check reports a
+    // fixpoint it never tested. Thrown, not returned — `errors` is the drift
+    // channel, and a dead scope is not drift.
+    assertScanned({
+        gate: 'check_bridge_derivation',
+        scanned: Object.values(before).reduce((n, snap) => n + Object.keys(snap).length, 0),
+        units: 'bridge entries',
+        roots: BRIDGE_ROOTS,
+    });
+
     // Regenerate in a child process so MODULE_STATE resolves exactly as the
     // real pipeline does (no partial in-process state). `--generate-tools`
     // covers the host trees; `--project-augment` covers `.augment` (it is
@@ -162,7 +175,15 @@ const isMain = process.argv[1] !== undefined && path.resolve(process.argv[1]) ==
 if (isMain) {
     const idx = process.argv.indexOf('--root');
     const root = idx !== -1 ? (process.argv[idx + 1] ?? REPO_ROOT) : REPO_ROOT;
-    const errors = run(root);
+    let errors: string[];
+    try {
+        errors = run(root);
+    } catch (exc) {
+        if (!(exc instanceof DeadScopeError)) throw exc;
+        // Exit 1 is this gate's only failure code.
+        process.stderr.write(`❌  ${exc.message}\n`);
+        process.exit(1);
+    }
     if (errors.length > 0) {
         for (const e of errors) process.stderr.write(`❌  ${e}\n`);
         process.exit(1);

package/src/scripts/check_bundle_path_leakage.ts

@@ -57,6 +57,8 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
+import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
+
 const _HERE = fileURLToPath(import.meta.url);
 const REPO = path.resolve(path.dirname(_HERE), '..', '..');
 
@@ -290,6 +292,30 @@ function parse_args(argv: readonly string[]): Options {
 function main(argv: readonly string[] = process.argv.slice(2)): number {
     const opts = parse_args(argv);
     const targets = opts.files.length > 0 ? opts.files : tracked_bundle_files();
+
+    // `git ls-files <untracked-root>` returns nothing, by design (BUNDLE_ROOTS
+    // lists roots that may not be tracked yet). That tolerance is also the
+    // failure mode: if `dist/install/` stopped being force-included, every root
+    // resolves empty and the gate prints "0 tracked bundle file(s) scanned"
+    // with exit 0. Deletion test: a repo that ships an install bundle always
+    // tracks at least one bundle file, so 0 is never success here.
+    // Exit 2 (usage/env) over 1 (leak found) — a dead scope means the gate
+    // could not run, not that it found a leak.
+    try {
+        assertScanned({
+            gate: 'check_bundle_path_leakage',
+            scanned: targets.length,
+            units: 'bundle file(s)',
+            roots: opts.files.length > 0 ? ['<explicit file arguments>'] : BUNDLE_ROOTS,
+        });
+    } catch (exc) {
+        if (exc instanceof DeadScopeError) {
+            process.stderr.write(`❌  ${exc.message}\n`);
+            return 2;
+        }
+        throw exc;
+    }
+
     const hits = scan_files(targets);
 
     if (hits.length > 0) {

package/src/scripts/check_ci_strict_superset.ts

@@ -38,6 +38,8 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
+import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
+
 const _HERE = fileURLToPath(import.meta.url);
 const REPO_ROOT = path.resolve(path.dirname(_HERE), '..', '..');
 const TASKFILE = path.join(REPO_ROOT, 'Taskfile.yml');
@@ -117,9 +119,25 @@ export function main(): number {
         (e) => !e.startsWith('- defer:') && e !== '- task: _ci-start' && e !== '- task: _ci-end',
     );
 
-    if (gateEntries.length === 0) {
-        process.stderr.write('❌  check_ci_strict_superset: `ci-strict` has no gate entries.\n');
-        return 1;
+    // Replaces the ad-hoc `gateEntries.length === 0` guard. Exit 2, not the 1 it
+    // returned: a task list with nothing in it means the gate could not verify
+    // the invariant — the documented meaning of 2, and what the two
+    // missing-task branches above already return — not that the invariant is
+    // violated. Counted after the wrapper filter on purpose: a `ci-strict` made
+    // of nothing but `_ci-start`/`_ci-end` is just as dead a scope.
+    try {
+        assertScanned({
+            gate: 'check_ci_strict_superset',
+            scanned: gateEntries.length,
+            units: 'ci-strict gate entr(y|ies)',
+            roots: ['Taskfile.yml (ci-strict.cmds)'],
+        });
+    } catch (err) {
+        if (err instanceof DeadScopeError) {
+            process.stderr.write(`❌  ${err.message}\n`);
+            return 2;
+        }
+        throw err;
     }
 
     if (gateEntries[0] !== DELEGATION) {

package/src/scripts/check_claims.ts

@@ -44,6 +44,7 @@ import {
     parse_exec_pointer,
     run_exec_evidence,
 } from './_lib/exec_evidence.js';
+import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
 
 const _FILE = fileURLToPath(import.meta.url);
 const _HERE = path.dirname(_FILE);
@@ -271,6 +272,27 @@ interface Finding {
 function main(argv: string[] = process.argv.slice(2)): number {
     const args = parse_args(argv);
     const ledger = load_ledger();
+    // The ledger is the corpus both passes depend on: markers resolve against
+    // it and the rot guard walks it. `load_ledger` returns an empty map for a
+    // missing docs/CLAIMS.md, and with no ledger there is nothing to declare
+    // dangling — so a moved ledger would print "0 markered claim(s) bound ·
+    // ledger 0 entries" and certify the anti-hype guardrail over nothing.
+    // Marker count is deliberately not the unit: a surface tree with zero
+    // markers is a legitimate state, an absent ledger never is.
+    try {
+        assertScanned({
+            gate: 'check_claims',
+            scanned: ledger.size,
+            units: 'ledger entry(s)',
+            roots: [LEDGER_REL],
+        });
+    } catch (exc) {
+        if (exc instanceof DeadScopeError) {
+            process.stderr.write(`❌  ${exc.message}\n`);
+            return 2;
+        }
+        throw exc;
+    }
     const markers = scan_markers();
     const findings: Finding[] = [];
 

package/src/scripts/check_cli_registry_budget_sync.ts

@@ -27,12 +27,20 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
+import { assertWatchlistResolves, DeadScopeError } from './_lib/scan_scope.js';
+
 const _HERE = fileURLToPath(import.meta.url);
 const REPO_ROOT = path.resolve(path.dirname(_HERE), '..', '..');
 
-const REGISTRY_PATH = path.join(REPO_ROOT, 'src/cli/registry.ts');
-const BUDGETS_PATH = path.join(REPO_ROOT, 'src/config/evaluator-budgets.json');
-const RECORD_PATH = path.join(REPO_ROOT, 'agents/evidence/metrics/evaluator-measurements.json');
+/** The gate's entire scan scope: three named inputs, repo-relative. */
+const INPUTS = [
+    'src/cli/registry.ts',
+    'src/config/evaluator-budgets.json',
+    'agents/evidence/metrics/evaluator-measurements.json',
+] as const;
+const [REGISTRY_PATH, BUDGETS_PATH, RECORD_PATH] = INPUTS.map((rel) =>
+    path.join(REPO_ROOT, rel),
+) as [string, string, string];
 
 const METRIC = 'cli_help_command_count';
 
@@ -105,6 +113,27 @@ function _read_json(p: string): Record<string, unknown> {
 }
 
 function main(): number {
+    // No corpus to walk — the scope is the watch list above. The reads below
+    // already fail closed, but they surface an ENOENT for whichever path is read
+    // first; this names all three, and it keeps the `scanned:` line derived from
+    // what actually resolved instead of the literal 3 it used to print. Exit 2
+    // is the same fail-closed code those reads use: a gate that cannot read its
+    // inputs must not certify them.
+    let resolved: string[];
+    try {
+        resolved = assertWatchlistResolves({
+            gate: 'check_cli_registry_budget_sync',
+            candidates: INPUTS,
+            repoRoot: REPO_ROOT,
+        });
+    } catch (err) {
+        if (err instanceof DeadScopeError) {
+            process.stderr.write(`ERROR: ${err.message}\n`);
+            return 2;
+        }
+        throw err;
+    }
+
     let registrySource: string;
     let budgetsDoc: Record<string, unknown>;
     let recordDoc: Record<string, unknown>;
@@ -128,7 +157,7 @@ function main(): number {
         recorded: measurements?.[METRIC],
     });
 
-    process.stdout.write('scanned: 3\n');
+    process.stdout.write(`scanned: ${String(resolved.length)}\n`);
     if (findings.length > 0) {
         for (const f of findings) {
             process.stdout.write(`❌  ${METRIC} out of sync: ${f}\n`);

package/src/scripts/check_cluster_patterns.ts

@@ -31,7 +31,9 @@
  * a few contract rows point at full working commands that merely happen to
  * carry one nested sub-command, and those own no dispatch table.
  *
- * Exit codes: 0 = clean, 1 = pattern violations, 3 = internal error.
+ * Exit codes: 0 = clean, 1 = pattern violations, 3 = internal error (which now
+ * includes a dead scan scope — an unparseable cluster table — reported through
+ * `_lib/scan_scope` so the message names the root).
  */
 
 import * as fs from 'node:fs';
@@ -39,6 +41,7 @@ import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import { SRC_DOMAINS, command_slug, resolve_logical } from './_lib/agent_src.js';
+import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
 
 const _HERE = fileURLToPath(import.meta.url);
 // src/scripts/check_cluster_patterns.ts → two dirs up is the repo root.
@@ -369,10 +372,29 @@ function _relativeToRootOrAbs(p: string): string {
 }
 
 export function main(): number {
+    // The locked-clusters table IS the corpus — every row drives one dispatcher
+    // read. A renamed contract file or a renamed `## Locked clusters` heading
+    // parses zero rows, which used to exit 3 (internal error, advisory at call
+    // sites) rather than fail: a blind gate, not a broken one.
     const rows = load_cluster_table();
-    if (rows.length === 0) {
-        process.stderr.write(`❌  No clusters parsed from ${_relativeToRootOrAbs(CONTRACT)}\n`);
-        return 3;
+    try {
+        assertScanned({
+            gate: 'check_cluster_patterns',
+            scanned: rows.length,
+            units: 'locked-cluster row(s)',
+            roots: [_relativeToRootOrAbs(CONTRACT)],
+        });
+    } catch (exc) {
+        if (exc instanceof DeadScopeError) {
+            // Exit 3, not 1: this gate's CLI contract is pinned by its py2ts
+            // port, and an empty table was ALREADY loud here (3 is non-zero, and
+            // the Taskfile fails on any non-zero). Hardening means routing the
+            // check through the shared assertion so the message names the root —
+            // not renumbering an exit code that was never a silent green.
+            process.stderr.write(`❌  ${exc.message}\n`);
+            return 3;
+        }
+        throw exc;
     }
 
     const slug_map = build_slug_map();

package/src/scripts/check_command_count_messaging.ts

@@ -8,7 +8,8 @@
  * 1 drift, 1 no-commands-dir via stderr), stdout/stderr split,
  * byte-identical messages, same canonical-count derivation
  * (iter_commands union), same per-file pattern checks in the same order.
- * No behaviour changes.
+ * No behaviour changes — except that the no-commands-dir stderr line now comes
+ * from `_lib/scan_scope` and names the empty roots; the exit code is unchanged.
  *
  * Sources canonical counts from the command frontmatter and fails when any
  * documented number drifts (README hero badge, getting-started browse line;
@@ -20,6 +21,7 @@ import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import { iter_commands } from './_lib/agent_src.js';
+import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
 
 const _HERE = fileURLToPath(import.meta.url);
 const ROOT = path.resolve(path.dirname(_HERE), '..', '..');
@@ -62,9 +64,23 @@ function _command_files(): string[] {
 
 function canonical_counts(): [number, number, number] {
     const files = _command_files();
-    if (files.length === 0) {
-        process.stderr.write('❌  no commands/ directory found under any artefact root\n');
-        process.exit(1);
+    try {
+        assertScanned({
+            gate: 'check_command_count_messaging',
+            scanned: files.length,
+            units: 'command file(s)',
+            roots: ['src/domains/*/**/command.md', 'src/agent-src/commands'],
+        });
+    } catch (exc) {
+        if (exc instanceof DeadScopeError) {
+            // Exit 1 stays — the documented "no commands dir" code, and the
+            // Taskfile fails on any non-zero, so this was never a silent green.
+            // The assertion replaces a bare "no commands/ directory found" with
+            // a message that names the roots that came back empty.
+            process.stderr.write(`❌  ${exc.message}\n`);
+            process.exit(1);
+        }
+        throw exc;
     }
     let total = 0;
     let shims = 0;

package/src/scripts/check_comparison.ts

@@ -20,6 +20,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import { parse as parseYaml } from 'yaml';
 
 import { REPO, pointer_unresolved } from './check_claims.js';
+import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
 
 const _HERE = fileURLToPath(import.meta.url);
 export const DATA_REL = 'docs/comparison.yaml';
@@ -71,6 +72,23 @@ export function findErrors(rows: Row[]): string[] {
 export function main(argv: string[] = process.argv.slice(2)): number {
     const quiet = argv.includes('--quiet');
     const rows = loadRows();
+    // `loadRows` returns [] for a missing or rows-less `docs/comparison.yaml`,
+    // so a renamed data file made this gate certify "all our_evidence pointers
+    // resolve" over zero rows — the falsifiability lock passing vacuously.
+    try {
+        assertScanned({
+            gate: 'check_comparison',
+            scanned: rows.length,
+            units: 'comparison row(s)',
+            roots: [DATA_REL],
+        });
+    } catch (exc) {
+        if (exc instanceof DeadScopeError) {
+            process.stderr.write(`❌  ${exc.message}\n`);
+            return 1;
+        }
+        throw exc;
+    }
     const errs = findErrors(rows);
     if (errs.length > 0) {
         process.stdout.write('❌ comparison-honesty:\n');

package/src/scripts/check_condensed_paths.ts

@@ -47,6 +47,8 @@ import process from 'node:process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import type * as YamlModule from 'yaml';
 
+import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
+
 // ESM-standard `require` shim. The bare `require` global is present when this
 // module is *imported* (tsx injects it) but absent when the module is the
 // directly-executed CLI entry, so resolve it explicitly here to preserve the
@@ -359,7 +361,26 @@ function main(): number {
     }
     const viols: Violation[] = [];
     const audited: Array<[string, IgnoreEntry]> = [];
-    for (const ruleFile of _globMdSorted(RULES_DIR)) {
+    const ruleFiles = _globMdSorted(RULES_DIR);
+    // The guard above only proves the directory node exists; an empty one still
+    // renders "clean (0 rules, 0 ignore(s) audited)". Exit 3 is the code that
+    // guard already uses for "there was nothing to check" — 1 means violations
+    // were found, which is a different claim.
+    try {
+        assertScanned({
+            gate: 'check_condensed_paths',
+            scanned: ruleFiles.length,
+            units: 'rule file(s)',
+            roots: ['dist/agent-src/rules'],
+        });
+    } catch (exc) {
+        if (exc instanceof DeadScopeError) {
+            process.stderr.write(`❌  ${exc.message}\n`);
+            return 3;
+        }
+        throw exc;
+    }
+    for (const ruleFile of ruleFiles) {
         const text = fs.readFileSync(ruleFile, 'utf-8');
         const [fm, body] = _split_frontmatter(text);
         const ignores: IgnoreEntry[] = fm !== null ? _parse_ignores(fm) : [];
@@ -383,7 +404,7 @@ function main(): number {
         process.stdout.write(`\n${viols.length} violation(s) in dist/agent-src/rules/\n`);
         return 1;
     }
-    const ruleCount = _globMdSorted(RULES_DIR).length;
+    const ruleCount = ruleFiles.length;
     if (!QUIET) {
         process.stdout.write(
             `✅  condensed-path check clean (${ruleCount} rules, ${audited.length} ignore(s) audited)\n`,

package/src/scripts/check_consumer_scope_flip.ts

@@ -32,6 +32,7 @@ import * as path from 'node:path';
 import { parse as parseYaml } from 'yaml';
 
 import { excludedRuleBasenames, ruleScopeFromSettings } from '../install/rule_scope.js';
+import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
 
 export const RULES_DIR = 'dist/agent-src/rules';
 export const TEMPLATE = 'src/config/agent-settings.template.yml';
@@ -112,8 +113,26 @@ async function main(): Promise<number> {
     let legacyTok = 0;
     let scopedRules = 0;
     let scopedTok = 0;
-    for (const name of fs.readdirSync(RULES_DIR).sort()) {
-        if (!name.endsWith('.md')) continue;
+    // The shipped rule tree is the corpus the before/after evidence is measured
+    // over. An emptied `dist/agent-src/rules` keeps every verdict vacuously true
+    // — nothing excluded, nothing dropped — so `pass` stays true and the flip
+    // reports as "verified" against a zero-rule baseline (with a NaN delta).
+    const ruleFiles = fs.readdirSync(RULES_DIR).sort().filter((n) => n.endsWith('.md'));
+    try {
+        assertScanned({
+            gate: 'check_consumer_scope_flip',
+            scanned: ruleFiles.length,
+            units: 'projected rule file(s)',
+            roots: [RULES_DIR],
+        });
+    } catch (exc) {
+        if (exc instanceof DeadScopeError) {
+            process.stderr.write(`❌  ${exc.message}\n`);
+            return 1;
+        }
+        throw exc;
+    }
+    for (const name of ruleFiles) {
         const body = fs.readFileSync(path.join(RULES_DIR, name), 'utf-8');
         const tok = gpt_tokens(body).tokens;
         // legacy-all baseline mirrors the 2026-07-08 report: compat exclusion applies on both arms

package/src/scripts/check_council_config_location.ts

@@ -54,6 +54,8 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
+import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
+
 const QUIET = process.argv.includes('--quiet');
 
 // Agent-facing surfaces where council config must resolve to `.ai-council.yml`.
@@ -318,6 +320,24 @@ function find_path_violations(root: string): string[] {
 
 function main(): number {
     const root = process.cwd();
+    // PATH_CHECK_GLOBS is the superset of both passes, so its resolution is the
+    // whole corpus either check can see. Run from the wrong cwd — or after the
+    // council surfaces move — every glob resolves to nothing and the gate
+    // reports "clean". Exit 1 is its only failure code.
+    try {
+        assertScanned({
+            gate: 'check_council_config_location',
+            scanned: [...iter_files(root, PATH_CHECK_GLOBS)].length,
+            units: 'council-surface file(s)',
+            roots: PATH_CHECK_GLOBS,
+        });
+    } catch (exc) {
+        if (exc instanceof DeadScopeError) {
+            process.stderr.write(`❌  ${exc.message}\n`);
+            return 1;
+        }
+        throw exc;
+    }
     const findings = [...find_violations(root), ...find_path_violations(root)];
     if (findings.length) {
         process.stdout.write('❌  Council config-location violations:\n\n');

package/src/scripts/check_council_layout.ts

@@ -19,6 +19,8 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
+import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
+
 const _HERE = fileURLToPath(import.meta.url);
 
 const AGENTS_ROOT = 'agents';
@@ -88,6 +90,16 @@ function _isFile(p: string): boolean {
 
 function find_violations(root: string): string[] {
     const findings: string[] = [];
+    // `agents/` is resolved relative to the cwd, so a run from anywhere but the
+    // repo root walks nothing and reports a clean layout. Thrown, not returned —
+    // `findings` is the violation channel, and a dead scope is not a violation.
+    const descendants = _isDir(root) ? _rglobAllSorted(root) : [];
+    assertScanned({
+        gate: 'check_council_layout',
+        scanned: descendants.length,
+        units: 'agents/ entries',
+        roots: [AGENTS_ROOT],
+    });
     if (!_isDir(root)) {
         return findings;
     }
@@ -110,7 +122,7 @@ function find_violations(root: string): string[] {
     }
 
     // 2. Council artefacts in non-canonical subdirectories.
-    for (const p of _rglobAllSorted(root)) {
+    for (const p of descendants) {
         if (!_isFile(p) || !is_council_artefact(path.basename(p))) {
             continue;
         }
@@ -144,7 +156,15 @@ function _posix(p: string): string {
 
 function main(argv: readonly string[]): number {
     const quiet = argv.includes('--quiet');
-    const findings = find_violations(AGENTS_ROOT);
+    let findings: string[];
+    try {
+        findings = find_violations(AGENTS_ROOT);
+    } catch (exc) {
+        if (!(exc instanceof DeadScopeError)) throw exc;
+        // Exit 1 is this gate's only failure code.
+        process.stderr.write(`❌  ${exc.message}\n`);
+        return 1;
+    }
     if (findings.length > 0) {
         process.stdout.write('❌  Council layout violations:\n\n');
         for (const f of findings) {

package/src/scripts/check_council_references.ts

@@ -40,6 +40,7 @@ import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import { artefact_roots, strip_source_prefix } from './_lib/agent_src.js';
+import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
 
 const QUIET = process.argv.includes('--quiet');
 
@@ -284,7 +285,14 @@ function* _iter_files(roots: readonly string[]): Generator<string> {
 
 function main(): number {
     const violations: Array<[string, number, string]> = [];
-    for (const p of _iter_files(_scan_roots())) {
+    const roots = _scan_roots();
+    // Counted before the allowlist filter — the question is what the walk
+    // reached, not what survived it. Every scan root is skipped when absent, so
+    // a relocated `docs/` or `agents/` leaves the linter reporting "no forbidden
+    // references" over an empty corpus. Exit 1 is its only failure code.
+    let scanned = 0;
+    for (const p of _iter_files(roots)) {
+        scanned += 1;
         const rel = p.split(path.sep).join('/');
         if (_is_allowlisted(rel)) {
             continue;
@@ -293,6 +301,20 @@ function main(): number {
             violations.push([p, ln, ref]);
         }
     }
+    try {
+        assertScanned({
+            gate: 'check_council_references',
+            scanned,
+            units: 'durable artefact file(s)',
+            roots,
+        });
+    } catch (exc) {
+        if (exc instanceof DeadScopeError) {
+            process.stdout.write(`❌  ${exc.message}\n`);
+            return 1;
+        }
+        throw exc;
+    }
 
     if (violations.length === 0) {
         if (!QUIET) {

package/src/scripts/check_dependency_floors.ts

@@ -37,6 +37,8 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
+import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
+
 const REPO_ROOT = path.resolve(fileURLToPath(import.meta.url), '..', '..', '..');
 
 /**
@@ -137,9 +139,23 @@ export function main(argv: readonly string[] = process.argv.slice(2)): number {
         process.stderr.write(`❌  dependency floors: cannot read ${manifestPath}: ${String(err)}\n`);
         return 2;
     }
-    if (Object.keys(dependencies).length === 0) {
-        process.stderr.write('❌  dependency floors: no runtime dependencies found — gate would pass vacuously\n');
-        return 2;
+    // Replaces the ad-hoc "gate would pass vacuously" guard with the shared
+    // assertion — same condition, same exit code (2 = the manifest yielded no
+    // corpus, vs 1 = a floor violates the rule), now counted on the unfiltered
+    // read rather than on what `evaluate` judges.
+    try {
+        assertScanned({
+            gate: 'check_dependency_floors',
+            scanned: Object.keys(dependencies).length,
+            units: 'runtime dependency floor(s)',
+            roots: ['package.json#dependencies'],
+        });
+    } catch (err) {
+        if (err instanceof DeadScopeError) {
+            process.stderr.write(`❌  ${err.message}\n`);
+            return 2;
+        }
+        throw err;
     }
     const errors = evaluate(dependencies);
     if (asJson) {