@event4u/agent-config 9.29.0 → 9.30.0

package/src/scripts/check_corpus_staleness.ts

@@ -49,6 +49,7 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
+import { GateLedger } from './_lib/gate_ledger.js';
 import { runGateCli, runSelfTest } from './_lib/gate_self_test.js';
 import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
 
@@ -423,20 +424,32 @@ export interface RunResult {
     readonly corpora: number;
     /** CSVs actually opened, reported so "checked nothing" cannot read as clean. */
     readonly csvs: number;
+    /** Per-corpus completeness accounting — every discovered corpus reaches one outcome. */
+    readonly ledger: GateLedger;
 }
 
 export function run_checks(todayStamp: number, skillsDir: string = SKILLS_DIR): RunResult {
     const corpora = discover_corpora(skillsDir);
+    const ledger = new GateLedger('check_corpus_staleness');
+    ledger.plan(corpora.map((c) => c.slug));
     const findings: CorpusFinding[] = [];
     let csvs = 0;
     for (const corpus of corpora) {
-        findings.push(...check_staleness(corpus, todayStamp));
-        findings.push(...check_attribution_pin(corpus));
+        const found: CorpusFinding[] = [
+            ...check_staleness(corpus, todayStamp),
+            ...check_attribution_pin(corpus),
+        ];
         const csv = check_csv_integrity(corpus);
-        findings.push(...csv.findings);
+        found.push(...csv.findings);
         csvs += csv.opened;
+        findings.push(...found);
+        if (found.length > 0) {
+            ledger.fail(corpus.slug, `${String(found.length)} corpus finding(s)`);
+        } else {
+            ledger.complete(corpus.slug);
+        }
     }
-    return { findings, corpora: corpora.length, csvs };
+    return { findings, corpora: corpora.length, csvs, ledger };
 }
 
 const HELP = `check_corpus_staleness — offline staleness + CSV-integrity gate for the grounding corpora
@@ -651,6 +664,7 @@ export function main(argv: string[] = process.argv.slice(2)): number {
 
     // gate-coverage contract (src/config/gate-coverage.yml): corpora inspected.
     process.stdout.write(`scanned: ${String(result.corpora)}\n`);
+    result.ledger.report();
 
     if (result.findings.length > 0) {
         process.stdout.write(`❌  ${String(result.findings.length)} corpus finding(s):\n`);

package/src/scripts/check_detector_corpus.ts

@@ -28,6 +28,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import * as YAML from 'yaml';
 
+import { GateLedger } from './_lib/gate_ledger.js';
 import {
     type DefectFinding,
     type TurnSnapshot,
@@ -163,6 +164,22 @@ export function main(repoRoot: string = process.cwd()): number {
         roots: [CORPUS_REL],
     });
 
+    // Per-detector completeness: every registered detector AND every corpus
+    // entry reaches exactly one outcome, so a detector silently absent from the
+    // loop above could not read as a pass.
+    const ledger = new GateLedger(GATE);
+    const names = [...new Set([...Object.keys(DETECTORS), ...Object.keys(corpus)])].sort();
+    ledger.plan(names);
+    const failing = new Set(findings.map((f) => f.detector));
+    for (const name of names) {
+        if (failing.has(name)) {
+            ledger.fail(name, 'corpus finding(s) against this detector');
+        } else {
+            ledger.complete(name);
+        }
+    }
+    ledger.report();
+
     if (findings.length > 0) {
         process.stderr.write(`${GATE}: ${String(findings.length)} finding(s)\n\n`);
         for (const f of findings) {

package/src/scripts/check_gitignore_freshness.ts

@@ -17,6 +17,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
+import { GateLedger, LedgerUsageError } from './_lib/gate_ledger.js';
 import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
 
 const _HERE = fileURLToPath(import.meta.url);
@@ -108,15 +109,48 @@ function main(argv?: readonly string[]): number {
 
     const missing: string[] = [];
 
-    for (const e of entries) {
-        if (e.policy !== 'ignored') continue;
-        if (e.scope !== 'consumer' && e.scope !== 'both') continue;
-        // Carve-out negations (path starts with !) are separately tracked
-        if (e.path.startsWith('!')) continue;
-        if (!blockLines.has(e.path)) {
-            missing.push(e.path);
+    // Per-entry completeness. Three of the four decisions below used to be bare
+    // `continue`s, so an entry whose `policy`/`scope` line failed to parse read
+    // as "correctly out of scope" and the success line still counted the rest.
+    // Each is now a recorded outcome with a reason, and the count printed below
+    // is the ledger's, not a second independent filter over the same list.
+    const ledger = new GateLedger('check_gitignore_freshness');
+    try {
+        ledger.plan(entries.map((e) => e.path));
+
+        for (const e of entries) {
+            if (e.policy !== 'ignored') {
+                ledger.outOfScope(e.path, 'not_applicable_kind');
+                continue;
+            }
+            if (e.scope !== 'consumer' && e.scope !== 'both') {
+                ledger.outOfScope(e.path, 'not_applicable_kind');
+                continue;
+            }
+            // Carve-out negations (path starts with !) are separately tracked
+            if (e.path.startsWith('!')) {
+                ledger.outOfScope(e.path, 'declared_exemption');
+                continue;
+            }
+            if (!blockLines.has(e.path)) {
+                missing.push(e.path);
+                ledger.fail(e.path, 'absent from gitignore-block.txt');
+            } else {
+                ledger.complete(e.path);
+            }
         }
+    } catch (err) {
+        // A path listed twice in the manifest makes the denominator wrong in the
+        // direction that hides work, so the ledger refuses it. That is a manifest
+        // defect, not a missing gitignore line: exit 2 ("the gate could not run"),
+        // never 1.
+        if (err instanceof LedgerUsageError) {
+            process.stderr.write(`❌  ${path.relative(REPO_ROOT, MANIFEST)}: ${err.message}\n`);
+            return 2;
+        }
+        throw err;
     }
+    const tally = ledger.report();
 
     if (missing.length > 0) {
         process.stdout.write(
@@ -134,7 +168,7 @@ function main(argv?: readonly string[]): number {
 
     if (!quiet) {
         process.stdout.write(
-            `✅  gitignore-block.txt covers all ${entries.filter((e) => e.policy === 'ignored' && (e.scope === 'consumer' || e.scope === 'both')).length} consumer-scoped ignored paths.\n`,
+            `✅  gitignore-block.txt covers all ${tally.completed + tally.failed} consumer-scoped ignored paths.\n`,
         );
     }
     return 0;

package/src/scripts/check_hook_bundle_freshness.ts

@@ -44,6 +44,8 @@ import { fileURLToPath } from "node:url";
 
 import { parse as parseYaml } from "yaml";
 
+// Single-quoted on purpose: check_gate_completeness detects ledger adoption by this exact import form.
+import { GateLedger } from './_lib/gate_ledger.js';
 import { reportScanned } from "./_lib/scan_scope.js";
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
@@ -135,6 +137,24 @@ export function main(argv: string[] = process.argv.slice(2)): number {
       : {}),
   });
 
+  // Per-source completeness: every bundled source reaches exactly one outcome
+  // (fresh or stale), so a source silently dropped from the mtime sweep could
+  // not read as a pass. Nothing to plan when no self-hosted bundle exists.
+  if (!r.skipped) {
+    const ledger = new GateLedger("check_hook_bundle_freshness");
+    const sources = bundledSources(root);
+    ledger.plan(sources);
+    const staleSet = new Set(r.stale.map((s) => s.file));
+    for (const file of sources) {
+      if (staleSet.has(file)) {
+        ledger.fail(file, "source is newer than the built bundle");
+      } else {
+        ledger.complete(file);
+      }
+    }
+    ledger.report();
+  }
+
   // A gate that scans nothing must SAY it scanned nothing — a silent green
   // here is indistinguishable from a pass.
   if (r.skipped) {

package/src/scripts/check_kernel_prefix_stability.ts

@@ -39,6 +39,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
 
+// ledger-exempt: single folded-hash comparison — the ordered kernel bodies become ONE sha256 via compute_prefix, byte-compared against the single committed snapshot, so the gate has exactly one aggregate drift verdict and no per-rule outcome exists to record; a changed byte in any body is indistinguishable from a reorder by construction, which IS the invariant. The kernel-count scope floor is already asserted by assertScanned over dist/router.json.
 const _HERE = fileURLToPath(import.meta.url);
 const REPO_ROOT = path.resolve(path.dirname(_HERE), '..', '..');
 const ROUTER = path.join(REPO_ROOT, 'dist/router.json');

package/src/scripts/check_standing_rule_delivery.ts

@@ -114,7 +114,7 @@ export function reasonIsStated(reason: string): boolean {
 }
 
 /** One measured layer. */
-interface LayerMeasure {
+export interface LayerMeasure {
     readonly label: string;
     readonly dir: string;
     readonly files: number;
@@ -122,17 +122,66 @@ interface LayerMeasure {
     readonly exact: boolean;
 }
 
-function measureLayer(label: string, dir: string): LayerMeasure | null {
-    const layer = rule_layer_overlap.readRuleLayer(dir);
-    if (layer === null) return null;
-    const joined = [...layer.files.values()].join('\n');
-    const m = measure(joined);
+function measureFiles(label: string, dir: string, files: ReadonlyMap<string, string>): LayerMeasure {
+    const m = measure([...files.values()].join('\n'));
+    return { label, dir, files: files.size, tokens: m.tokens_gpt, exact: m.tokens_gpt_exact };
+}
+
+/**
+ * The one measurement both the gate (`main` below) and the doctor surface
+ * (`routing_doctor`) consume — per-layer rule tokens, the overlap between the
+ * two layers, and which input the numbers came from. Exported so the doctor
+ * reuses it instead of growing a second, drifting copy.
+ */
+export interface StandingDeliveryMeasure {
+    /** Which input produced the numbers — see `instructionsLoadedRecord`. */
+    readonly input: 'instructions-loaded' | 'filesystem';
+    readonly layers: readonly LayerMeasure[];
+    /** Sum over present layers — what the session receives under the host's no-dedup contract. */
+    readonly received_tokens: number;
+    /** Rules present in BOTH layers (basename match). */
+    readonly overlap_rules: number;
+    readonly duplicate_rules: number;
+    readonly divergent_rules: number;
+    /** Tokens of the project-layer copies of overlapping rules — the doubled delivery. */
+    readonly overlap_tokens: number;
+    readonly exact: boolean;
+}
+
+/** Measure both layers once. `null` when neither directory exists (nothing installed). */
+export function measureStandingDelivery(
+    global_dir: string,
+    project_dir: string,
+    record_path: string,
+): StandingDeliveryMeasure | null {
+    const g = rule_layer_overlap.readRuleLayer(global_dir);
+    const p = rule_layer_overlap.readRuleLayer(project_dir);
+    if (g === null && p === null) return null;
+    const layers: LayerMeasure[] = [];
+    if (g !== null) layers.push(measureFiles('global', global_dir, g.files));
+    if (p !== null) layers.push(measureFiles('project', project_dir, p.files));
+    let overlap_rules = 0;
+    let duplicate_rules = 0;
+    let divergent_rules = 0;
+    let overlap_tokens = 0;
+    if (g !== null && p !== null) {
+        const r = rule_layer_overlap.compareLayers(g.files, p.files);
+        overlap_rules = r.overlap.length;
+        duplicate_rules = r.duplicate.length;
+        divergent_rules = r.divergent.length;
+        if (r.overlap.length > 0) {
+            overlap_tokens = measure(r.overlap.map((n) => p.files.get(n) ?? '').join('\n')).tokens_gpt;
+        }
+    }
     return {
-        label,
-        dir,
-        files: layer.files.size,
-        tokens: m.tokens_gpt,
-        exact: m.tokens_gpt_exact,
+        input: fs.existsSync(record_path) ? 'instructions-loaded' : 'filesystem',
+        layers,
+        received_tokens: layers.reduce((n, l) => n + l.tokens, 0),
+        overlap_rules,
+        duplicate_rules,
+        divergent_rules,
+        overlap_tokens,
+        exact: layers.every((l) => l.exact),
     };
 }
 
@@ -185,10 +234,12 @@ export function main(argv: readonly string[] = process.argv.slice(2)): number {
         return 1;
     }
 
-    const layers = [
-        measureLayer('global', path.join(os.homedir(), '.claude', 'rules')),
-        measureLayer('project', path.join(REPO_ROOT, '.claude', 'rules')),
-    ].filter((l): l is LayerMeasure => l !== null);
+    const measured = measureStandingDelivery(
+        path.join(os.homedir(), '.claude', 'rules'),
+        path.join(REPO_ROOT, '.claude', 'rules'),
+        instructionsLoadedRecord(REPO_ROOT),
+    );
+    const layers = measured?.layers ?? [];
 
     const scanned = layers.reduce((n, l) => n + l.files, 0);
     // Two zeroes that mean opposite things, and conflating them is how this gate
@@ -202,7 +253,7 @@ export function main(argv: readonly string[] = process.argv.slice(2)): number {
     // - **A layer directory that exists and holds no `.md`** — a projection that
     //   ran and produced nothing. That is blindness, not cleanliness, and it
     //   stays exit 3.
-    const no_layer_present = layers.length === 0;
+    const no_layer_present = measured === null;
     try {
         assertScanned({
             gate: PROG,
@@ -239,10 +290,7 @@ export function main(argv: readonly string[] = process.argv.slice(2)): number {
         return 0;
     }
 
-    const record = instructionsLoadedRecord(REPO_ROOT);
-    const input = fs.existsSync(record) ? 'instructions-loaded' : 'filesystem';
-    const total = layers.reduce((n, l) => n + l.tokens, 0);
-    const exact = layers.every((l) => l.exact);
+    const { input, received_tokens: total, exact } = measured;
 
     out(`${PROG} · input: ${input} · ${method_note()}\n`);
     if (input === 'filesystem') {
@@ -256,18 +304,11 @@ export function main(argv: readonly string[] = process.argv.slice(2)): number {
         out(`  ${l.label.padEnd(8)} ${String(l.files).padStart(4)} file(s)  ${String(l.tokens).padStart(8)} tok\n`);
     }
 
-    if (layers.length === 2) {
-        const g = rule_layer_overlap.readRuleLayer(layers[0]!.dir);
-        const p = rule_layer_overlap.readRuleLayer(layers[1]!.dir);
-        if (g !== null && p !== null) {
-            const r = rule_layer_overlap.compareLayers(g.files, p.files);
-            if (r.overlap.length > 0) {
-                out(
-                    `  overlap  ${String(r.overlap.length).padStart(4)} rule(s) in both layers `
-                        + `(${r.duplicate.length} duplicate, ${r.divergent.length} divergent)\n`,
-                );
-            }
-        }
+    if (measured.overlap_rules > 0) {
+        out(
+            `  overlap  ${String(measured.overlap_rules).padStart(4)} rule(s) in both layers `
+                + `(${measured.duplicate_rules} duplicate, ${measured.divergent_rules} divergent)\n`,
+        );
     }
 
     const pct = total / budget.total_cap_tokens;

package/src/scripts/check_static_layer_stability.ts

@@ -0,0 +1,154 @@
+#!/usr/bin/env node
+/**
+ * Static-layer stability lint (road-to-token-economy-cache Phase 2.2 — the
+ * hygiene half the Phase-1 null left standing; spike note:
+ * agents/settings/contexts/cache-injection-anatomy.md).
+ *
+ * The always-loaded layer is re-sent on every session and every spawn; a
+ * MACHINE-VOLATILE marker inside it (an absolute local path naming a real
+ * user, a session/run-id shape) is both a cache-stability hazard and a
+ * portability leak. Scope is deliberately NARROW and honest:
+ *
+ *   - scanned: dist/agent-src/rules/*.md EXCLUDING the kernel set (the
+ *     kernel prefix has its own byte-drift guard,
+ *     check_kernel_prefix_stability — no double coverage, roadmap Risk 8)
+ *   - flagged: absolute home paths (/Users/<name>/, /home/<name>/,
+ *     C:\Users\<name>\) and UUID-shaped run/session ids
+ *   - NOT flagged: dates in prose (stable content, not build-volatile) —
+ *     build-time volatility is already impossible for .md by the ADR-201
+ *     byte-exact projection (dist == rewrite(src)); this lint catches what
+ *     an AUTHOR pastes, which the projection faithfully preserves.
+ *
+ * Exit 0 green · 1 findings · 2 unusable. Dead-scope guarded via
+ * assertScanned. Self-test: tests/scripts/check_static_layer_stability.test.ts
+ * proves red on a fixture carrying a home path and a UUID.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
+
+declare const __AGENT_CONFIG_BUNDLE__: boolean | undefined;
+const _IN_BUNDLE = typeof __AGENT_CONFIG_BUNDLE__ !== 'undefined' && __AGENT_CONFIG_BUNDLE__;
+const REPO_ROOT = path.resolve(
+    path.dirname(fileURLToPath(import.meta.url)),
+    ...(_IN_BUNDLE ? ['..'] : ['..', '..']),
+);
+const RULES_DIR = path.join(REPO_ROOT, 'dist', 'agent-src', 'rules');
+const ROUTER = path.join(REPO_ROOT, 'dist', 'router.json');
+
+/** Machine-volatile shapes. Home paths anchor on the OS home prefix; the
+ *  UUID shape requires all five groups so ordinary hex constants stay quiet. */
+const HOME_PATH_RE = /(?:\/(?:Users|home)\/[A-Za-z][\w.-]*\/|[A-Za-z]:\\Users\\[A-Za-z][\w.-]*\\)/;
+const UUID_RE = /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/i;
+/** Per-line opt-out for a deliberate, justified exception. */
+const IGNORE_MARKER = 'static-layer-allow';
+
+export interface Finding {
+    file: string;
+    line: number;
+    kind: 'home-path' | 'uuid';
+    excerpt: string;
+}
+
+function kernelBasenames(routerPath: string): Set<string> {
+    try {
+        const router = JSON.parse(fs.readFileSync(routerPath, 'utf8')) as { kernel?: unknown };
+        if (Array.isArray(router.kernel)) {
+            return new Set(
+                router.kernel
+                    .filter((k): k is string => typeof k === 'string')
+                    .map((k) => (k.endsWith('.md') ? k : `${k}.md`)),
+            );
+        }
+    } catch {
+        /* fall through — an unreadable router means we scan everything (fail toward coverage) */
+    }
+    return new Set();
+}
+
+export function scan(opts: { rulesDir?: string; routerPath?: string } = {}): { findings: Finding[]; scanned: number } {
+    const rulesDir = opts.rulesDir ?? RULES_DIR;
+    const kernel = kernelBasenames(opts.routerPath ?? ROUTER);
+    const findings: Finding[] = [];
+    let scanned = 0;
+    const files = fs.existsSync(rulesDir) ? fs.readdirSync(rulesDir).filter((f) => f.endsWith('.md')) : [];
+    for (const f of files) {
+        if (kernel.has(f)) continue; // kernel prefix has its own drift guard
+        scanned += 1;
+        const text = fs.readFileSync(path.join(rulesDir, f), 'utf8');
+        const lines = text.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i] ?? '';
+            if (line.includes(IGNORE_MARKER)) continue;
+            if (HOME_PATH_RE.test(line)) {
+                findings.push({ file: f, line: i + 1, kind: 'home-path', excerpt: line.trim().slice(0, 120) });
+            } else if (UUID_RE.test(line)) {
+                findings.push({ file: f, line: i + 1, kind: 'uuid', excerpt: line.trim().slice(0, 120) });
+            }
+        }
+    }
+    return { findings, scanned };
+}
+
+export function main(argv: readonly string[]): number {
+    let rulesDir: string | undefined;
+    let routerPath: string | undefined;
+    for (let i = 0; i < argv.length; i++) {
+        if (argv[i] === '--rules-dir') rulesDir = argv[++i];
+        else if (argv[i] === '--router') routerPath = argv[++i];
+    }
+    const opts: Parameters<typeof scan>[0] = {
+        ...(rulesDir !== undefined ? { rulesDir } : {}),
+        ...(routerPath !== undefined ? { routerPath } : {}),
+    };
+    let result: ReturnType<typeof scan>;
+    try {
+        result = scan(opts);
+    } catch (err) {
+        process.stderr.write(`check_static_layer_stability: ${err instanceof Error ? err.message : String(err)}\n`);
+        return 2;
+    }
+    try {
+        assertScanned({
+            gate: 'check_static_layer_stability',
+            scanned: result.scanned,
+            units: 'non-kernel always-loaded rule file(s)',
+            roots: [rulesDir ?? RULES_DIR],
+        });
+    } catch (exc) {
+        if (exc instanceof DeadScopeError) {
+            process.stderr.write(`error: ${exc.message}\n`);
+            return 1;
+        }
+        throw exc;
+    }
+    for (const f of result.findings) {
+        process.stderr.write(
+            `❌  ${f.file}:${f.line} — ${f.kind} in the always-loaded layer (machine-volatile marker; re-sent on every spawn): ${f.excerpt}\n`,
+        );
+    }
+    if (result.findings.length > 0) {
+        process.stderr.write(
+            `check_static_layer_stability: ${result.findings.length} finding(s) across ${result.scanned} scanned file(s). ` +
+                `A deliberate exception carries '${IGNORE_MARKER}' on the line with its reason.\n`,
+        );
+        return 1;
+    }
+    process.stdout.write(`✅  check_static_layer_stability: ${result.scanned} non-kernel always-loaded file(s) clean\n`);
+    return 0;
+}
+
+function _isCliEntry(): boolean {
+    if (_IN_BUNDLE) return false;
+    if (process.argv[1] === undefined) return false;
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) return true;
+    try {
+        return fs.realpathSync(fileURLToPath(import.meta.url)) === fs.realpathSync(path.resolve(process.argv[1]));
+    } catch {
+        return false;
+    }
+}
+if (_isCliEntry()) process.exit(main(process.argv.slice(2)));

package/src/scripts/check_suppression_hygiene.ts

@@ -117,6 +117,24 @@ export interface SuppressionSpec {
      * migration to content anchors visible instead of aspirational.
      */
     driftKey?: { positionField: string; anchorField: string };
+    /**
+     * Accept this baseline as absent at the base ref — for the ONE change that
+     * introduces it, then removed.
+     *
+     * Without it a brand-new baseline is a permanent red: the ratchet compares
+     * against `origin/main`, where the file does not exist yet, and
+     * `ratchet_base_ref` is deliberately fail-closed there because
+     * absent-at-base and mistyped-path look identical from inside. Setting it
+     * makes the verdict `new_baseline` rather than growth, so the bootstrap
+     * entries are not each reported as a new hole.
+     *
+     * Remove the flag once the introducing commit is an ancestor of the base
+     * ref — leaving it set would silently accept a later mistyped path. That
+     * removal is **enforced, not remembered**: the scan below fails when the
+     * flag is set and the baseline already resolves at the base ref, so the
+     * flag closes itself one merge after it was needed.
+     */
+    newInThisChange?: boolean;
     /** Why this list exists at all — printed with the count, so absence is visible. */
     what: string;
 }
@@ -199,6 +217,19 @@ export const SUPPRESSION_INVENTORY: readonly SuppressionSpec[] = [
         growth: 'requires_falsifier',
         what: 'per-gate known-debt counts',
     },
+    {
+        // The root IS the list — a bare array of rule filenames, so entries are
+        // content-keyed by construction and cannot drift on line numbers.
+        // `forbidden` growth is the whole point: this baseline exists so a NEW
+        // rule cannot join the silent set, and `lint_rule_enforcement_declaration`
+        // additionally fails when an entry stops being undeclared, so the list is
+        // shrink-only from both directions.
+        file: 'src/config/rule-enforcement-baseline.json',
+        listKey: null,
+        tier: 'string_list',
+        newInThisChange: true,
+        what: 'rules predating the enforced_by-declaration ratchet',
+    },
 ];
 
 export interface SuppressionFinding {
@@ -367,7 +398,24 @@ export function main(): number {
                 baseRef,
                 repoRoot: REPO_ROOT,
                 entriesOf: (parsed) => entriesOfSpec(spec, parsed),
+                ...(spec.newInThisChange === true ? { allowNewBaseline: true } : {}),
             });
+            // Self-closing bootstrap flag. `newInThisChange` exists for the ONE
+            // change that introduces a baseline, and the comment on the field says
+            // to remove it afterwards — which is exactly the kind of instruction
+            // that gets forgotten, because nothing goes red when it is ignored and
+            // a stale flag silently accepts a later mistyped path. So the check
+            // closes itself: once the baseline resolves at the base ref, the
+            // verdict is no longer `new_baseline`, and keeping the flag is a
+            // finding rather than a note in someone's follow-up list.
+            if (spec.newInThisChange === true && comparison.verdict !== 'new_baseline') {
+                const detail =
+                    `\`newInThisChange\` is still set, but the baseline now resolves at ${baseRef} — ` +
+                    'the flag has served its purpose and must be removed from SUPPRESSION_INVENTORY. ' +
+                    'Leaving it set makes a future mistyped path pass as a new baseline forever.';
+                ledger.fail(spec.file, detail);
+                findings.push({ file: spec.file, entry: '(whole file)', kind: 'uninventoried', detail });
+            }
         } catch (exc) {
             if (exc instanceof BaseRefUnavailableError) {
                 ledger.fail(spec.file, exc.message);