@event4u/agent-config 9.27.0 → 9.29.0

package/dist/ui/index.html

@@ -27,7 +27,7 @@
                 document.documentElement.setAttribute('data-theme', theme);
             })();
         </script>
-      <script type="module" crossorigin src="/assets/index-DmR0mbk4.js"></script>
+      <script type="module" crossorigin src="/assets/index-JDAF00bC.js"></script>
       <link rel="stylesheet" crossorigin href="/assets/index-jSfMW8_t.css">
     </head>
     <body>

package/docs/contracts/settings-classes.md

@@ -78,14 +78,35 @@ AND THE ASK FIRES ONLY WHEN THE USER'S OWN REQUEST NEEDS THE SETTING —
 NEVER AT A MOMENT THE AGENT CHOSE.
 ```
 
-**Half one — the conservative default.** A sparse settings file means *absent =
-default*. If a B key shipped with the permissive value as its default, then
-"never asked" and "answered yes" would be indistinguishable, and the ask would
-be decoration on a decision already made in the user's name. Under this
-invariant an unanswered B key is always the safe value, and the ask is the only
-path to the permissive one. `lint_settings_classes` enforces this half
-mechanically: a B row whose template default is not `false` / `""` / `0` / `[]`
-/ `null` / `{}` fails the build.
+**Half one — the conservative default.** If a B key shipped with the permissive
+value as its default, then "never asked" and "answered yes" would be
+indistinguishable, and the ask would be decoration on a decision already made in
+the user's name. Under this invariant an unanswered B key is always the safe
+value, and the ask is the only path to the permissive one.
+`lint_settings_classes` enforces this half mechanically: a B row whose template
+default is not `false` / `""` / `0` / `[]` / `null` / `{}` fails the build.
+
+> **There is no defaults layer, and this contract used to imply one.** The
+> sentence here previously read *"a sparse settings file means absent =
+> default"*. No code implements that: `_DEFAULTS` in
+> `src/scripts/_lib/agent_settings.ts` is `{}`, so the merged settings contain
+> exactly what some file set and nothing else. What makes half one hold is not a
+> defaults layer but the **reader** — each reader supplies its own fallback, and
+> the lint above guarantees the template value a reader is expected to mirror is
+> the conservative one.
+>
+> That distinction is load-bearing rather than pedantic, because the two are not
+> equivalent for every key. Nine keys are carved out in
+> [`src/shared/settingsCarveOut.ts`](../../src/shared/settingsCarveOut.ts) where
+> a reader deliberately resolves an absent key to something **other** than the
+> template default — `quality.local_auto_run` is the sharp one: the template
+> ships `false`, which ARMS a gate, and an absent key resolves to `true` at its
+> reader, which disarms it. Under a literal "absent = default" reading that key
+> would be safe, and it is not.
+>
+> `agent-config settings:get <key>` reports both facts — the value with the file
+> that set it, and the carve-out warning when absent is not the default. Use it
+> rather than reasoning from this contract about what an absent key does.
 
 **Half two — who picks the moment.** The council review below found the hole in
 half one: an agent free to choose *when* to ask can engineer consent. Asking
@@ -108,18 +129,51 @@ larger set; it is the set that passes both halves.
 | `personal.canary_name` | un-inferrable, and answering arms the session-degradation canary; one keypress to accept the prefill | `""` (canary dark) |
 | `memory.learn_on_session_end` | it turns on automatic memory writes at the end of every session — a standing write the user should authorise | `false` |
 
+## The one exception — `emergency.orchestration_halt`
+
+The always-on-orchestration doctrine (subagents, council, team) deletes every
+per-layer on/off setting: `subagents.enabled`, `subagents.auto`, and
+`subagents.host_capabilities` are gone from the template, and the layer
+activates on any capable host with an EMPTY settings file. One switch survives
+that deletion on purpose, and it is not the same shape wearing a different
+name.
+
+```
+ON-BY-DEFAULT, NOT OFF-BY-DEFAULT. ABSENT OR false MEANS THE STACK RUNS.
+ARMING THE HALT IS CEREMONY-FREE — INCIDENTS ARE URGENT.
+DISARMING IT REQUIRES A NON-EMPTY orchestration_halt_justification.
+INCIDENT-RESPONSE USE ONLY.
+```
+
+**Enforcement, stated honestly (`enforced_by: none`).** The settings file is
+hand-edited YAML — no machine sits on the write path, so the
+justification-on-disarm rule and any per-transition telemetry are
+MODEL-CARRIED conventions, not checked gates (the same honesty stance as
+`security-sensitive-stop`). What IS checked: readers treat only strict
+`true` as halted, and the `no-activation-gates` lint prevents the switch
+from ever growing activation siblings. An agent editing this key follows
+the convention; a human editing it is the owner exercising it.
+
+The distinguishing test against "an activation gate under a new name": an
+activation gate is symmetric — flipping it either way costs the same nothing,
+and its purpose is to let a capability sit unused by default. This switch is
+asymmetric by convention — cheap to arm during an incident, costed (a stated
+reason) to disarm, never a silent preference. `subagents.downshift`, `subagents.quota_arbitrage`, and
+`subagents.model_map` are unaffected by the deletion — they tune HOW a
+dispatch runs, not WHETHER the layer exists, so they keep their own C rows.
+
 ## Counts
 
 | Class | Keys |
 |---|---|
 | A — preference | 27 |
 | B — consent | 3 |
-| C — guarded | 110 |
-| **Total** | **140** |
+| C — guarded | 107 |
+| **Total** | **137** |
 
 The total is every leaf in the template, where *leaf* means anything that is not
-a **non-empty** map. An empty map (`subagents.host_capabilities: {}`) is a real
-configurable value with a real default, so it is a leaf here — one row more than
+a **non-empty** map. An empty map (like the former `subagents.host_capabilities: {}`) is a real
+configurable value with a real default, so such keys count as leaves here — one row more than
 the template↔schema parity test walks, deliberately, because a key with no
 class is exactly what this contract exists to prevent.
 
@@ -208,27 +262,24 @@ Rows follow template order, so a diff against the template reads straight down.
 | `screenshots.forbid_terminal_capture` | C | `true` | kill-switch over the highest-leak capture path |
 | `screenshots.data_bearing_gate` | C | `"on"` | the human-confirmation gate over a published egress |
 | `code_style.docblocks` | A | `minimal` | code convention |
-| `subagents.enabled` | C | `true` | kill-switch for the whole subagent layer |
-| `subagents.auto` | C | `"on"` | dispatches work without asking |
 | `subagents.downshift` | C | `true` | routes to another model tier, which is spend and quality |
-| `subagents.budget_routing` | C | `ask` | the budget-aware routing gate |
 | `subagents.quota_arbitrage` | C | `true` | spends from a separate quota pool |
 | `subagents.model_map.lite` | C | `""` | names an external model endpoint |
 | `subagents.model_map.medium` | C | `""` | names an external model endpoint |
 | `subagents.model_map.high` | C | `""` | names an external model endpoint |
-| `subagents.host_capabilities` | C | `{}` | overrides the host capability manifest |
 | `subagents.implementer_model` | C | `""` | names an external model endpoint |
 | `subagents.judge_model` | C | `""` | names an external model endpoint |
 | `subagents.max_parallel` | C | `3` | parallelism cap, and therefore a spend rate |
 | `subagents.adversarial_council` | C | `"off"` | governs a paid verification step |
 | `worktrees.mode` | C | `ask` | standing permission for autonomous worktree creation |
-| `ai_team.enabled` | C | `false` | authorises paid external CLI calls |
 | `ai_team.model` | C | `auto` | names an external model |
 | `ai_team.allow_delegate` | C | `false` | grants an external tool write access to the repository |
 | `ai_team.max_calls_per_day` | C | `50` | quota cap on a shared budget |
 | `ai_team.suppress_setup_hint` | A | `false` | hint cosmetics |
 | `ai_team.review_gate.managed` | C | `false` | governs an upstream review gate |
 | `ai_team.review_gate.max_consecutive_blocks` | C | `3` | circuit-breaker threshold |
+| `emergency.orchestration_halt` | C | `false` | the one audited incident switch over the always-on orchestration stack — see § The one exception above |
+| `emergency.orchestration_halt_justification` | C | `""` | required non-empty before the halt may be lifted; an audit-trail field |
 | `onboarding.onboarded` | C | `false` | flipping it bypasses the onboarding gate |
 | `commands.auto_detect` | C | `enabled` | kill-switch for orchestrator auto-detection |
 | `commands.suggestion.enabled` | A | `true` | a convenience layer; governs no gate and no spend |

package/docs/guidelines/agent-infra/memory-access.md

@@ -50,9 +50,20 @@ as provisional (best-effort, agent-written, not human-reviewed).
 
 **Sharing boundary.** Curated YAML (`agents/memory/<type>/*.yml`) is
 **committed** — it is the team-shared layer. Raw intake
-(`agents/memory/intake/*.jsonl`) is **gitignored, local scratch** — only
-entries promoted to curated get shared. `retrieve()` still reads local
-intake (low-confidence tier); it just never reaches the team repo unpromoted.
+(`agents/memory/intake/*.jsonl`) is **gitignored, local scratch** in a
+consumer project — only entries promoted to curated get shared. `retrieve()`
+still reads local intake (low-confidence tier); it just never reaches the team
+repo unpromoted.
+
+> **Which repo you are in changes this one line.** In a **consumer project**
+> intake is gitignored — the shipped block in `src/config/gitignore-block.txt`
+> lists `/agents/memory/intake/`. In **this package's own repo** it is
+> **tracked** and union-merged, because here intake is part of the corpus
+> under test; `agents/memory/intake/README.md` says so ("Local + tracked").
+> Both are correct in their own context, and the sentence above states the
+> consumer one. Read unconditionally, it makes a maintainer treat tracked
+> intake files as a mistake, and it makes a consumer who follows the
+> directory's README commit raw signals by accident.
 
 ## The status helper
 

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@event4u/agent-config",
     "mcpName": "io.github.event4u-app/agent-config",
-    "version": "9.27.0",
+    "version": "9.29.0",
     "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including \"zero runtime daemon\".",
     "license": "MIT",
     "private": false,

package/src/agent-src/templates/AGENTS.md

@@ -1,11 +1,6 @@
 # {{project_name}}
 
-<!--
-  Fill placeholders or run `/agents init`, then delete this
-  comment. Iron Law — capability bullets, not path lists; paths rot.
-  Tool stubs (`CLAUDE.md`, `GEMINI.md`, `.cursorrules`) link here.
-  Anatomy + recipes: `.augment/contexts/contracts/agents-md-anatomy.md`.
--->
+<!-- Fill placeholders or run `/agents init`; delete after. Recipes: `.augment/contexts/contracts/agents-md-anatomy.md`. -->
 
 > {{project_description}}
 
@@ -13,16 +8,17 @@
 
 | Layer | Location | Edits |
 |---|---|---|
-| Installed package | `.augment/`, `dist/agent-src/` | hands-off — managed by `event4u/agent-config` |
-| Project layer | `agents/`, `agents/overrides/`, `.agent-settings.yml` | your customizations and config |
+| Installed package | `.augment/`, `dist/agent-src/` | managed by `event4u/agent-config` |
+| Project layer | `agents/`, `agents/overrides/`, `.agent-settings.yml` | your customizations |
 
 ## Pointers
 
-- **Filling out this AGENTS.md** — section templates, capability bullets, multi-agent entry flow, monorepo per-package layout: [`.augment/contexts/contracts/consumer-agents-md-guide.md`](.augment/contexts/contracts/consumer-agents-md-guide.md).
-- **Behavior rules (always active)** — [`.augment/rules/`](.augment/rules/). Kernel rules are **immutable** — never propose an edit; tighten-only via the override registry.
-- **Skills (on-demand expertise)** — domain skills surfaced by description; invoked when their trigger fires: [`.augment/skills/`](.augment/skills/).
-- **Commands (workflows)** — slash-commands the agent runs end-to-end (`/work`, `/implement-ticket`, `/commit`, `/create-pr`, …): [`.augment/commands/`](.augment/commands/).
+- **Filling out this AGENTS.md** — section templates, capability bullets, multi-agent entry flow, monorepo layout: [`consumer-agents-md-guide`](.augment/contexts/contracts/consumer-agents-md-guide.md).
+- **Behavior rules (always active)** — [`.augment/rules/`](.augment/rules/). Kernel rules are **immutable**; tighten only via the override registry.
+- **Skills (on-demand expertise)** — domain skills surfaced by description, invoked on trigger match: [`.augment/skills/`](.augment/skills/).
+- **Commands (workflows)** — slash-commands the agent runs end-to-end (`/work`, `/create-pr`, …): [`.augment/commands/`](.augment/commands/).
 - **Project-specific docs** — your own architecture notes, roadmaps, sessions, contexts: [`agents/`](agents/).
+- **Delegation & review** — dispatch independent-slice tasks to subagents instead of serial work; in a team (host-flag gated) the lead coordinates, teammates implement; a mutating session ends after a neutral cross-model review: [`delegation-policy`](.augment/rules/delegation-policy.md).
 
 ## Emergency triage — read this when nothing else is reachable
 

package/src/config/agent-settings.template.yml

@@ -231,7 +231,8 @@ cost:
     # separate tier cap — the global ceilings above still apply and the
     # budget-routing relation works purely off them. Set a value to cap one
     # tier (e.g. cheap: 10 keeps haiku-class delegation under $10/day-window
-    # of the ledger). Consumed by subagents.budget_routing below.
+    # of the ledger). Informational since the budget_routing key was removed
+    # (always-on orchestration): routing is judgment-ladder-driven.
     per_tier:
       cheap: null
       medium: null
@@ -743,60 +744,27 @@ code_style:
 
 # --- Subagent orchestration ---
 #
-# Controls model selection, parallelism, and AUTOMATIC orchestration for
-# subagent-based workflows (/do-and-judge, /do-in-steps, /judge, and the
-# auto-dispatch layer). Empty values fall back to the runtime defaults
-# described in .augment/contexts/subagent-configuration.md and
+# Always-on orchestration (road-to-always-on-orchestration Phase 1): the
+# subagent layer carries no per-run on/off setting. `subagents.enabled`,
+# `subagents.auto`, and `subagents.host_capabilities` were REMOVED — a fresh
+# install with this section untouched still activates auto-dispatch on any
+# host whose capability probe reports a subagent primitive. Capability is a
+# fact resolved from the host (registry + a live environment probe), never a
+# setting; the one surviving incident-only control is `emergency.
+# orchestration_halt` below. A leftover `subagents.enabled` / `subagents.auto`
+# / `subagents.host_capabilities` key from an older install is ignored (one
+# deprecation-warning line on load, per-key, per run).
+#
+# What remains below tunes HOW a delegated sub-task runs, never WHETHER the
+# layer exists. Empty values fall back to the runtime defaults described in
+# .augment/contexts/subagent-configuration.md and
 # .augment/contexts/execution/auto-orchestration-activation.md.
 subagents:
-  # Global master switch for the whole subagent layer.
-  # true (default) = the layer is available; false = fully disabled, the
-  # canonical kill-switch (no auto-dispatch, no model routing, in-session only).
-  enabled: true
-
-  # Automatic-dispatch mode:  off | ask | on
-  #
-  # off = never auto-dispatch; subagents only via an explicit command.
-  # ask = classify the task; when delegable, ask once before dispatching.
-  # on  = auto-dispatch delegable tasks without asking (surface the choice
-  #       in one line).
-  #
-  # SHIPPED default is `on` on hosts whose capability manifest reports
-  # `subagent_spawn: true`, and `off` on hosts without a subagent primitive.
-  # Auto-dispatch stays a no-op wherever the manifest reports
-  # `subagent_spawn: false`, regardless of this value.
-  #
-  # The default was `ask` until 2026-07-09, when it was flipped to `on` after a
-  # re-evaluation (agents/settings/contexts/orchestration-default-flip-verdict.md
-  # § 2026-07-09; ADR-117). The flip rests on a bounded-downside argument, NOT a
-  # passed benchmark: delegable slices are already cost-routed to the cheapest
-  # capable tier, classification fires only on real structural signals (never
-  # unstructured or tiny work), and every return is verified — so `on` cannot
-  # delegate frontier-priced or speculative work. `resolveShippedDefault()`
-  # remains the telemetry-driven DEMOTION gate: a measured regression demotes
-  # back to `ask`.
-  auto: "on"
-
   # Route delegable sub-tasks to the lowest-capable model tier (cost + speed
   # via model downshift). true (default) = downshift per declared model_tier;
   # false = every subagent runs on the session tier.
   downshift: true
 
-  # Budget-aware cheap-request delegation (docs/contracts/budget-routing.md).
-  # Picks the cheapest CLASSIFIER-ADEQUATE tier that has available budget
-  # (cost.budgets.per_tier above); cheap exhausted but strong funded → strong
-  # tier; everything exhausted → session model + notice. Work is never
-  # blocked to save money, and the session model is never switched — routing
-  # happens as delegation with a model override. DISTINCT from `downshift`
-  # above: downshift is the quality/cost trade-off knob, budget_routing is
-  # the resource-availability gate (council 2026-08-03).
-  #   ask  = (default) first budget-motivated downshift of a session asks once
-  #   auto = apply the relation silently (telemetry line per routed request)
-  #   off  = today's behavior; single-flip rollback — QUOTE it ("off") when
-  #          editing: bare off is YAML-1.1 boolean false (readers coerce, but
-  #          the quoted form is the unambiguous one, same as `auto: "on"`)
-  budget_routing: ask
-
   # Prefer a separate-quota-pool model for delegable sub-tasks WHERE the host
   # manifest reports `separate_quota_pool: true` (e.g. a subscription whose
   # Sonnet allowance is distinct from Opus). Optional bonus only — behaviour is
@@ -811,12 +779,6 @@ subagents:
     medium: ""
     high: ""
 
-  # Optional host-capability override (see
-  # .augment/contexts/execution/host-capability-manifest.md). Any field set
-  # here wins; any field omitted falls back to the all-false safe default.
-  # Leave empty to let the agent resolve the manifest from host knowledge.
-  host_capabilities: {}
-
   # Model for implementer subagents (empty = same tier as the session model)
   implementer_model: ""
 
@@ -878,17 +840,23 @@ worktrees:
 
 # --- AI Team (cross-model strong-pair review — /team family) ---
 #
-# Governs the default-off `/team` capability family: one strong external
-# model (via the codex CLI, subscription-authed) reviews inside the repo —
-# the depth complement to the council's breadth. Schema + validation
-# contract: `docs/contracts/ai-team-config.md`. The loader
-# (`src/scripts/ai_team/config.ts`) rejects unknown keys fail-closed.
+# One strong external model (via the codex CLI, subscription-authed)
+# reviews inside the repo — the depth complement to the council's breadth.
+# Schema + validation contract: `docs/contracts/ai-team-config.md`. The
+# loader (`src/scripts/ai_team/config.ts`) rejects unknown keys fail-closed.
+#
+# Always-on orchestration (road-to-always-on-orchestration Phase 1, Step
+# 1.3): `/team` carries no per-run on/off setting — `enabled` was REMOVED.
+# A fresh install with this section untouched still surfaces `/team` when
+# the codex CLI resolves on $PATH AND some auth for it is detectable
+# (subscription login, API key, key file, or env key); otherwise every
+# invocation degrades with one clear "codex CLI not available" line
+# instead of a silent enabled:false refusal. Verify with `agent-config
+# doctor --check team`. The one surviving incident-only control is
+# `emergency.orchestration_halt` below. A leftover `enabled` key from an
+# older install is accepted and ignored (one deprecation-warning line on
+# load, per run).
 ai_team:
-  # Master switch. false (default) = /team commands are never suggested
-  # and every invocation refuses with an enable pointer; true = the
-  # family is live (individual gates below still apply).
-  enabled: false
-
   # Model handed to the codex CLI. 'auto' (default) = pass NO --model
   # flag, the codex CLI's own default applies — this tracks the
   # subscription's current strongest model instead of pinning a stale
@@ -897,8 +865,9 @@ ai_team:
 
   # Second opt-in for the ONLY wrapper that delegates write access
   # (/team:delegate → the plugin's native-Codex worker). false (default)
-  # = delegate refuses with an enable pointer even when ai_team.enabled
-  # is true. Both keys must be true before delegation is reachable.
+  # = delegate refuses even when /team itself is available. Availability
+  # (codex CLI installed + authenticated) is necessary but not
+  # sufficient — this key must ALSO be true before delegation is reachable.
   allow_delegate: false
 
   # Per-day cap on team calls. Team calls count into the EXISTING
@@ -934,6 +903,23 @@ ai_team:
     # Positive integer.
     max_consecutive_blocks: 3
 
+# --- Emergency orchestration halt (the one incident-only kill switch) ---
+#
+# NOT an activation gate — see docs/contracts/settings-classes.md § "The one
+# exception". The always-on orchestration stack (subagents, council, team)
+# has no per-layer on/off setting; this is the single audited switch that
+# survives, for incident response only.
+emergency:
+  # false (default) = the stack runs normally. Flipping this to true requires
+  # no ceremony — incidents are urgent. Flipping it back to false requires
+  # `orchestration_halt_justification` below to be a non-empty string; both
+  # transitions emit one telemetry line (enum/bool fields only).
+  orchestration_halt: false
+
+  # Required non-empty before `orchestration_halt` may return to false.
+  # Ignored while the halt is being armed (arming is ceremony-free).
+  orchestration_halt_justification: ""
+
 # --- Onboarding ---
 #
 # Tracks whether the initial setup flow (/onboard) has been completed

package/src/config/budgets.yml

@@ -14,3 +14,32 @@ augment_workspace_guidelines:
   total_cap_chars: 64000
   warn_threshold: 0.85
   fail_threshold: 0.95
+
+standing_rule_delivery:
+  # The rule bytes a Claude Code session actually receives, summed across BOTH
+  # layers the host loads (`~/.claude/rules/` and `<project>/.claude/rules/`) —
+  # gated by `check_standing_rule_delivery.ts`.
+  #
+  # Derivation, measured 2026-08-08 (exact BPE, cl100k_base, via
+  # `src/scripts/_lib/token_count.ts`) and recorded in
+  # `agents/evidence/analysis/standing-rule-delivery-topologies.md`:
+  #
+  #   both layers loaded  176,354 tok   ← the defect this gate catches
+  #   global layer alone  101,247 tok
+  #   project layer alone  75,107 tok
+  #
+  # So the useful band is 101,247 … 176,354: below it a complete single layer
+  # would fail, above it the doubled corpus would pass. 110,000 sits in that
+  # band with ~9% headroom over the larger single layer.
+  #
+  # This is NOT the coherence-followup's pre-registered ≤ 30k always-on figure.
+  # That one measures the always-HONOURED set, which a discipline profile trims;
+  # this measures the PROJECTED file set, which no profile trims
+  # (compile_router.ts:266-272 vs condense.ts:1092-1099). 101,247 → 30,000 needs
+  # `paths:` scoping plus the digest, not dedup.
+  total_cap_tokens: 110000
+  warn_threshold: 0.85
+  # Every raise needs a stated cause naming which rule added the tokens and why.
+  # `check_standing_rule_delivery` fails on an empty or placeholder reason, so a
+  # silent baseline bump is not available.
+  cap_raise_reason: 'initial cap — derived from the 2026-08-08 six-topology measurement (P0.3), never raised'

package/src/config/discovery/packs.yml

@@ -162,6 +162,17 @@
   size_class: small
   default_install: false
 
+- id: forensics
+  label: Forensic Evidence
+  description: Machine-derived release evidence from git history alone — hotspot risk (change frequency x complexity) and change-coupling analyzers; deterministic, read-only, advisory to the release findings pipeline.
+  workspaces: [engineering]
+  requires: [engineering-base]
+  trust_level_default: experimental
+  surface_tier: lab
+  domain: engineering
+  size_class: small
+  default_install: false
+
 - id: python
   label: Python
   description: Python-language patterns.

package/src/config/discovery/workspaces.yml

@@ -13,7 +13,7 @@
   description: Code, tests, CI, reviews, architecture.
   example_roles: [Developer, CTO, Tech Lead]
   default_packs: [engineering-base, git]
-  optional_packs: [php, laravel, symfony, javascript, typescript, react, nextjs, python, frontend-design, brand, analysis-workbench, scale-discipline, history-discipline]
+  optional_packs: [php, laravel, symfony, javascript, typescript, react, nextjs, python, frontend-design, brand, analysis-workbench, scale-discipline, history-discipline, forensics]
 
 - id: product
   label: Product

package/src/config/evaluator-budgets.json

@@ -58,11 +58,11 @@
       "deterministic": false
     },
     "cli_help_command_count": {
-      "max": 88,
-      "last_measured": 88,
-      "last_measured_at": "2026-08-07",
+      "max": 95,
+      "last_measured": 95,
+      "last_measured_at": "2026-08-08",
       "method": "registry enumeration — count of `{ name: '...', disposition` entries in src/cli/registry.ts (NOT --help prose parsing; methods historically disagreed 74 vs 76 vs 79)",
-      "baseline_note": "80 → 81 on 2026-08-03 (release 9.15.0 gate). This RECORDS growth that already shipped through its own reviewed PR; it does not authorize new surface. The +1 is f02db54c2 (fix(cli): register routing:doctor in the CLI registry) — the command existed, only its registry entry was missing, and the registering PR did not move this budget. The gate did its job again: breach WARNS on main and BLOCKS on release, which is the conscious-decision point rather than a silently raised cap. Re-measured 2026-08-03 via the pinned method: 81. Headroom stays zero by design — the next registry addition must move this number in its own PR. 81 → 82 on 2026-08-04: the `handoff` subcommand (road-to-agent-handoff-resume Phase 4) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 82. 82 → 84 on 2026-08-04: the `route:explain` + `route:audit` verbs (routing-correctness validation surface) register in the same PR that adds the surface. Re-measured via the pinned method: 84. 84 → 85 on 2026-08-05: the `settings:set` verb (road-to-zero-ceremony-settings Phase 2 — the one agent-reachable settings writer) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 85. 85 → 86 on 2026-08-06: the `conformance:behavior` verb (road-to-agent-behavior-conformance Phase 5 — replays the local transcript store through the four mechanised conformance checks) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 86. 86 → 88 on 2026-08-07: the `sessions:list` + `sessions:claim` verbs (road-to-parallel-session-coordination — the shell surface of the shared session register, needed because /roadmap:next is command markdown and can only reach the register through a shell call) register in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 88."
+      "baseline_note": "80 → 81 on 2026-08-03 (release 9.15.0 gate). This RECORDS growth that already shipped through its own reviewed PR; it does not authorize new surface. The +1 is f02db54c2 (fix(cli): register routing:doctor in the CLI registry) — the command existed, only its registry entry was missing, and the registering PR did not move this budget. The gate did its job again: breach WARNS on main and BLOCKS on release, which is the conscious-decision point rather than a silently raised cap. Re-measured 2026-08-03 via the pinned method: 81. Headroom stays zero by design — the next registry addition must move this number in its own PR. 81 → 82 on 2026-08-04: the `handoff` subcommand (road-to-agent-handoff-resume Phase 4) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 82. 82 → 84 on 2026-08-04: the `route:explain` + `route:audit` verbs (routing-correctness validation surface) register in the same PR that adds the surface. Re-measured via the pinned method: 84. 84 → 85 on 2026-08-05: the `settings:set` verb (road-to-zero-ceremony-settings Phase 2 — the one agent-reachable settings writer) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 85. 85 → 86 on 2026-08-06: the `conformance:behavior` verb (road-to-agent-behavior-conformance Phase 5 — replays the local transcript store through the four mechanised conformance checks) registers in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 86. 86 → 88 on 2026-08-07: the `sessions:list` + `sessions:claim` verbs (road-to-parallel-session-coordination — the shell surface of the shared session register, needed because /roadmap:next is command markdown and can only reach the register through a shell call) register in the same PR that adds the surface, per this record's own contract. Re-measured via the pinned method: 88. 88 → 89 on 2026-08-08: the `council:status` verb registers in the same PR that adds the surface, per this record's own contract. It exists because an agent in a consumer project announced \"kein Council konfiguriert (keine .agent-settings.yml)\" and substituted a weaker path while the council was configured user-globally the whole time — there was no verb that answered availability, so the only route was an inference from a filename, and the intuitive filename is the one location ADR-104 guarantees is never consulted. Re-measured via the pinned method: 89. 89 → 91 on 2026-08-08: the `self-repair:status` + `self-repair:release` verbs (the queued-defect reader and the single Hard-Floor-gated outward step of the self-repair loop — the loop is deliberately unable to publish unless a human runs the release command) register in the same PR that adds the surface, per this record's own contract. Landed alongside the +1 council:status move in the same branch. Re-measured via the pinned method: 91. 91 → 94 on 2026-08-08: the `packs:active`, `settings:get` and `mcp:available` verbs (road-to-capability-answerability Phase 2 — the three capability probes for the gaps that had none) register in the same PR that adds the surface, per this record's own contract. Each answers a question that was previously only inferable from a filename: which packs are active and from which file, what a setting resolves to and which file set it, and what is declared in mcp.json versus what can actually launch. 94 -> 95 in the same PR: `brand:status` (Phase 2.4 — brand-layer presence, which the rule depended on and no surface could answer). Re-measured twice via the pinned method on the unchanged tree: 95/95."
     },
     "mcp_public_tool_count": {
       "max": 19,

package/src/config/gate-coverage.yml

@@ -90,6 +90,32 @@
 # silently fall behind again (that omission is exactly how `check_site_links`
 # reported green over a stale build for weeks).
 #
+# THAT BACKSTOP COVERS ONE OF THE TWO EMIT SHAPES — measured 2026-08-08 under
+# round-6 Phase 4.1, and corrected here rather than left as a claim the file
+# cannot support. The test's detector is a literal-source regex:
+# `/(?:process\.(?:stdout|stderr)\.write|lines\.push)\(\s*`scanned: \$\{/`. A gate
+# that emits through `_lib/scan_scope.ts` — `assertScanned()` / `reportScanned()`,
+# which is the shape this repo tells a gate author to use — writes the line from
+# inside the library, so its own source never matches and the test cannot see it.
+# Live split: **1 unregistered gate emits the inline shape (`check_gate_coverage`
+# itself), and 175 of 244 gate scripts emit through the helper.** So for the
+# recommended shape the sentence above is false, and the list CAN fall behind.
+#
+# Not widened here, deliberately. Widening the regex to include the helper turns
+# 175 gates into findings in one diff, and the paragraph below already states why
+# that is not a one-line-per-gate job: their unit would have to be INVENTED, which
+# is a per-gate judgement. `check_rule_projection_integrity` (conformance-round5
+# Phase 1.1/1.2) is a worked example of the blocker — it emits 330 through
+# `assertScanned`, but `agents/.agent-tools.yml` is `skip-worktree`-masked to
+# `tools: []` on a maintainer checkout, so the same gate legitimately emits 0
+# there. A real floor would red locally and a `min_scanned: 0` floor is the
+# false-count shape this file rejects, and `unavailable_exit` cannot express it
+# because the empty case must keep exiting 0 (it runs first in the pre-push
+# `preflight` chain and blocking there is what PR #1211 repaired). It is therefore
+# NOT registered, with the reason, rather than registered with a floor that cannot
+# hold. Its ledger half is discharged: it adopts `_lib/gate_ledger.ts`, so
+# `check_gate_completeness` already counts it as an adopter.
+#
 # CANARY (road-to-gates-that-can-fail Phase 7)
 # --------------------------------------------
 # Coverage proves a gate READ something. It cannot prove the gate can still FAIL.

package/src/config/gate-violation-baselines.json

@@ -2,9 +2,9 @@
   "$comment": "Violation ratchet for gates whose dead scan root was repaired. A repair REVEALS pre-existing debt; it does not create it. Each entry records the count revealed at repair time — the gate fails only when its count RISES. Lowering a count is a normal commit; raising one is a defect. Entries expire: a baseline that has not dropped within 56 days of `landed` (or of `reaffirmed.date`) fails its gate, because a number that never moves is suppression with extra steps. Mechanism + rationale: src/scripts/_lib/gate_baseline.ts. Decision: AI council 2026-08-02, roadmap road-to-gates-that-can-fail blocker `dead-gate-finding-triage`.",
   "gates": {
     "check_no_new_legacy_path:hardcoded-scan-roots": {
-      "count": 49,
-      "landed": "2026-08-04",
-      "note": "Lines under src/scripts/**/*.{ts,mts,mjs} that pass the retired `.agent-src.uncondensed` directory into `path.join(...)` — a filesystem path CONSTRUCTED against the tree ADR-051 abandoned, which is the exact shape of all 14 dead gates. Deliberately narrow so the number is signal, not noise: 236 raw mentions under src/scripts → 147 string-literal lines → 67 path-constructing lines when the pass was written, after exempting src/scripts/_lib/agent_src.ts (the shared resolver, whose job IS owning the constant — gates that route through it survived the move). Detectors holding the literal as data to match, strip, or print are not counted, and no prose, docs, tests or fixtures are read: that full-tree shape was measured at 44 files / 213 hits and rejected as the wrong lint (see the note in check_no_new_legacy_path.ts::find_offenders). Recorded at 58 rather than 67 because Phase 1's scan-root repairs were landing on this branch while the pass was being written and had already removed 9 — a baseline above the truth silently permits new violations. This count goes to ZERO as the remaining repairs land; every repair is a lowering commit. Lowered 56→51 by the road-to-renewal-foundation Phase 1 dead-root sweep (check_always_budget, check_portability, check_references, lint_framework_leakage, lint_agents_md). Lowered 51→49 by the gate-hardening adoption PR: skill_collision_clusters and skill_overlap were repointed at the live skills tree via the shared resolver — two gates that had been reading the retired container and scoring 0 of 288 skills."
+      "count": 48,
+      "landed": "2026-08-09",
+      "note": "Lines under src/scripts/**/*.{ts,mts,mjs} that pass the retired `.agent-src.uncondensed` directory into `path.join(...)` — a filesystem path CONSTRUCTED against the tree ADR-051 abandoned, which is the exact shape of all 14 dead gates. Deliberately narrow so the number is signal, not noise: 236 raw mentions under src/scripts → 147 string-literal lines → 67 path-constructing lines when the pass was written, after exempting src/scripts/_lib/agent_src.ts (the shared resolver, whose job IS owning the constant — gates that route through it survived the move). Detectors holding the literal as data to match, strip, or print are not counted, and no prose, docs, tests or fixtures are read: that full-tree shape was measured at 44 files / 213 hits and rejected as the wrong lint (see the note in check_no_new_legacy_path.ts::find_offenders). Recorded at 58 rather than 67 because Phase 1's scan-root repairs were landing on this branch while the pass was being written and had already removed 9 — a baseline above the truth silently permits new violations. This count goes to ZERO as the remaining repairs land; every repair is a lowering commit. Lowered 56→51 by the road-to-renewal-foundation Phase 1 dead-root sweep (check_always_budget, check_portability, check_references, lint_framework_leakage, lint_agents_md). Lowered 51→49 by the gate-hardening adoption PR: skill_collision_clusters and skill_overlap were repointed at the live skills tree via the shared resolver — two gates that had been reading the retired container and scoring 0 of 288 skills. Lowered 49→48 by road-to-rule-delivery-integrity P2.2: score_skill_selection was repointed at the live skills tree via the shared resolver. It is the same shape as the two gates lowered before it — a scorer reading the retired container and scoring 0 of 288 skills — and here the consequence was sharper than a dead gate: the roadmap's pre-registered selection-accuracy criteria would have been compared against a baseline of silent zeros."
     },
     "audit_user_type_axis": {
       "count": 1,