@event4u/agent-config 9.32.0 → 9.33.0

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@event4u/agent-config",
     "mcpName": "io.github.event4u-app/agent-config",
-    "version": "9.32.0",
+    "version": "9.33.0",
     "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including \"zero runtime daemon\".",
     "license": "MIT",
     "private": false,

package/src/agent-src/scripts/roadmap_gates.ts

@@ -18,10 +18,34 @@
  * Blocking a pipeline on "the user has an open decision" would turn a
  * visibility aid into a second thing to fight.
  *
+ * `--reply` is the same projection shaped for the END OF A CHAT REPLY rather
+ * than a terminal pane, and it exists because the pull channel above is only
+ * read by someone who already knows to ask. Transcript forensics over three
+ * consumer sessions found five "what do I do now?" follow-ups, every one of
+ * them next to a blocker the agent HAD reported — as a file reference, as a
+ * bare option count, or as a choice of substitute work. What the same corpus
+ * also shows is that a tool's output gets carried into the reply verbatim
+ * (the dashboard's step count appears word-for-word inside eight option
+ * blocks). So the fix is not to make the agent format better from memory; it
+ * is to hand it the finished text. See ADR-222.
+ *
+ * Two properties carry the contract mechanically:
+ *   - Nothing owned by the user open ⇒ EMPTY output. "No blocker → no block"
+ *     stops being a judgement call, so the command is safe to call
+ *     unconditionally at reply-close.
+ *   - Exactly ONE blocker is rendered in full — the one that unblocks most.
+ *     Every other one is a single trailing line. The user is never handed a
+ *     flat list to weigh themselves.
+ *
+ * Labels are English like the rest of the CLI surface; the agent mirrors them
+ * into the user's language when it lifts them into a reply, exactly as it does
+ * for `Recommendation:` / `Empfehlung:`.
+ *
  * Invocation (from project root):
  *   ./agent-config gates            # decisions owned by the user
  *   ./agent-config gates --all      # every open blocker, grouped by owner
  *   ./agent-config gates --json     # machine-readable
+ *   ./agent-config gates --reply    # reply-close form; empty when none
  */
 
 import * as path from 'node:path';
@@ -209,6 +233,76 @@ function render(entries: readonly Entry[], all: boolean): string {
     return lines.join('\n') + '\n';
 }
 
+/**
+ * Reply-close form: the one blocking decision in full, the rest as one line.
+ *
+ * Deliberately narrower than `render()`. `Status` and `Owner` are roadmap-file
+ * metadata that a reader of a reply cannot act on, so they are dropped; what
+ * survives is what the user has to DO and how they will know it is done. The
+ * five-field shape stays where it is enforced — in the roadmap file — and does
+ * not follow the blocker into prose it would only pad.
+ *
+ * Returns '' when nothing is owned by the user, so the caller can append the
+ * result unconditionally and get silence when silence is correct.
+ */
+function renderReply(entries: readonly Entry[]): string {
+    const mine = entries.filter((e) => needsUser(e.blocker.owner));
+    if (mine.length === 0) {
+        return '';
+    }
+
+    // `collectEntries` already sorted by unblocking weight, so the first entry
+    // IS the one that matters most. Picking it here rather than asking the
+    // caller to choose is the point: a flat list is the failure mode.
+    const lead = mine[0] as Entry;
+    const rest = mine.slice(1);
+    const lines: string[] = [];
+
+    lines.push(`Blocked: ${lead.blocker.blocks} — ${lead.roadmapRel}`);
+
+    const steps = regroupTodo(lead.blocker.todo);
+    const doLabel = isLegacy(lead.blocker) ? 'Blocked until:' : 'Do:';
+    if (steps.length === 0) {
+        lines.push(
+            `${doLabel} (no steps recorded — the blocker entry needs a **What to do:** list)`,
+        );
+    } else if (steps.length === 1) {
+        lines.push(...wrap(`${doLabel} ${steps[0] as string}`, WIDTH, '    '));
+    } else {
+        // Emitted as authored, never re-numbered: real blocker entries already
+        // carry their own `1.` / `2.` markers (the CI-enforced `What to do:`
+        // shape), so adding our own would produce "1. 1. …". An entry that
+        // arrives unnumbered stays unnumbered — that is a fact about the
+        // roadmap entry, and papering over it here would hide it from the
+        // person who could fix it.
+        lines.push(`${doLabel}`);
+        for (const s of steps) {
+            lines.push(...wrap(`  ${s}`, WIDTH, '     '));
+        }
+    }
+    lines.push(...wrap(`Done when: ${lead.blocker.resolvedWhen}`, WIDTH, '    '));
+
+    if (rest.length > 0) {
+        // A count, not a roster. Naming all of them reproduces the exact
+        // failure this form exists to end — "zwölf Entscheidungen bei Dir …
+        // rund 850 Zeilen", which the transcript shows produced no decision at
+        // all. The one that blocks is written out above; the rest are one
+        // command away, and saying so is shorter than listing them and more
+        // honest than hiding them.
+        lines.push('');
+        lines.push(
+            ...wrap(
+                `${rest.length} other decision${rest.length !== 1 ? 's' : ''} also wait${rest.length === 1 ? 's' : ''} on you, ` +
+                    'none blocking this — `agent-config gates`.',
+                WIDTH,
+                '    ',
+            ),
+        );
+    }
+
+    return lines.join('\n') + '\n';
+}
+
 function renderJson(entries: readonly Entry[], all: boolean): string {
     const pick = all ? entries : entries.filter((e) => needsUser(e.blocker.owner));
     return (
@@ -270,18 +364,28 @@ function main(argv?: readonly string[]): number {
     const args = argv ?? process.argv.slice(2);
     const all = args.includes('--all');
     const json = args.includes('--json');
+    const reply = args.includes('--reply');
 
     const repoRoot = _resolveRepoRoot(process.cwd());
     const roadmapRoot = path.join(repoRoot, 'agents', 'roadmaps');
     if (!_isDir(roadmapRoot)) {
+        // `--reply` stays silent here too: a project without roadmaps has no
+        // blocker to hand over, and a reply-close line saying so would be the
+        // ceremony the form exists to avoid.
         process.stdout.write(
-            json ? '{"needsYou":0,"other":0,"blockers":[]}\n' : 'No roadmaps directory — nothing to report.\n',
+            reply
+                ? ''
+                : json
+                  ? '{"needsYou":0,"other":0,"blockers":[]}\n'
+                  : 'No roadmaps directory — nothing to report.\n',
         );
         return 0;
     }
 
     const entries = collectEntries(roadmapRoot);
-    process.stdout.write(json ? renderJson(entries, all) : render(entries, all));
+    process.stdout.write(
+        reply ? renderReply(entries) : json ? renderJson(entries, all) : render(entries, all),
+    );
     return 0;
 }
 
@@ -308,5 +412,5 @@ if (_isCliEntry()) {
     process.exitCode = main();
 }
 
-export { main, needsUser, regroupTodo, wrap, collectEntries, render, renderJson };
+export { main, needsUser, regroupTodo, wrap, collectEntries, render, renderJson, renderReply };
 export type { Entry };

package/src/agent-src/templates/scripts/ownership-map.example.yml

@@ -3,7 +3,7 @@
 # Copy this file to `.github/ownership-map.yml` (preferred) or
 # `agents/ownership-map.yml` and adapt the entries to your stack.
 # Omitting the file entirely is fine — routing falls back to the
-# generic role vocabulary from `reviewer-awareness`.
+# common role vocabulary in `skill:review-routing`.
 #
 # First match wins per file. List narrower globs before broader ones.
 

package/src/config/cost-parity-budget.json

@@ -0,0 +1,167 @@
+{
+    "_comment": "Committed target table for the road-to-cost-parity-* family (part 0, Phase 1). Registers what a session costs today, what the family is steering toward, and what the rule payload actually is PER HOST — the correction that matters most, because every diet target in the source drafts was set against one aggregate number that describes no host. Nothing here changes behaviour: no carrier ships for these thresholds (part 0 Phase 4.5), and no gate reads the target columns. What IS gated is the file's own shape — lint_budget_ownership rejects a row without a `source`, and rejects a `revised_from` without `revision_evidence`, so a number cannot enter or move without a traceable origin.",
+    "schema_version": 1,
+    "registered_at": "2026-08-10",
+    "owner": "maintainer",
+    "review_by": "2026-11-10",
+    "row_schema": {
+        "_comment": "Reading of part 0 § 1.2b: `schema_version` / `registered_at` / `owner` / `review_by` are FILE-level (as in every sibling budget file — a per-row copy would be four constants repeated N times), and every ROW carries `source` plus the three honest-null fields from § 1.3. The validator enforces exactly that split.",
+        "required_row_fields": ["id", "unit", "baseline", "source", "revisable", "revision_evidence", "revised_from"],
+        "honest_null_contract": "A target bends to a measurement, never to a preference. `revisable: true` says the number is revisable at all; `revised_from` records what it used to be once it moves; `revision_evidence` must then point at the evidence note that forced the move. The validator fails the file when `revised_from` is set and `revision_evidence` is empty — a revision without published evidence is the one form of drift this schema exists to refuse."
+    },
+    "measurement": {
+        "_comment": "Both measurement rules from part 0's Context are fields here, not prose: a rule that lives only in a paragraph is a rule the next author does not inherit.",
+        "measurement_date": "2026-08-10",
+        "commit": "c073d5732fb890bbf8b41ec879f62f651c7ba293",
+        "projection_regenerated": true,
+        "regeneration_command": "task sync && task generate-tools — verified no-op afterwards (git status clean), so the payload rows below measure the commit and not when someone last ran a generator",
+        "emitter_generation": "real, frontmatter-less projection files (25 of 110 .claude/rules entries carry a `paths:` block; the rest carry no frontmatter). NOT the older emitter that symlinked .claude/rules/* into dist/agent-src/rules/ and so inherited dist's full frontmatter. This is the THIRD variable behind the 92-vs-110 file-count spread: a projection count is a fact about which emitter last wrote the tree, on top of how stale that tree is.",
+        "carrier_divergence_admitted": false,
+        "carrier_divergence_reason": "report_carrier_divergence compares a globally installed carrier against the project projection on disk; both can be stale independently, so it measures relative cache staleness rather than any property of the source. It may diagnose a behind-the-times install; it may never gate a phase, and no row here is derived from it."
+    },
+    "session_cost_targets": [
+        {
+            "id": "median_final_context_tokens",
+            "unit": "billable input tokens of the last main-chain assistant record (per cc_transcript.ts)",
+            "baseline": 519349,
+            "interim": 300000,
+            "target": 200000,
+            "direction": "lower_is_better",
+            "source": "agents/evidence/analysis/token-economy-recycling-phase1.md:45 — median over 201 sessions with parseable final usage (:44) out of 205 non-empty (:10)",
+            "revisable": true,
+            "revision_evidence": "",
+            "revised_from": null
+        },
+        {
+            "id": "p90_final_context_tokens",
+            "unit": "billable input tokens of the last main-chain assistant record",
+            "baseline": 807937,
+            "interim": 550000,
+            "target": 400000,
+            "direction": "lower_is_better",
+            "source": "agents/evidence/analysis/token-economy-recycling-phase1.md:45 — same 201-session corpus",
+            "revisable": true,
+            "revision_evidence": "",
+            "revised_from": null
+        },
+        {
+            "id": "auto_compact_incidence",
+            "unit": "share of sessions with >= 1 auto-compaction event",
+            "baseline": 0.112,
+            "interim": 0.05,
+            "target": 0.0,
+            "direction": "lower_is_better",
+            "source": "agents/evidence/analysis/token-economy-recycling-phase1.md:59 — 23 of 205 sessions, 31 events (:60), all trigger:\"auto\"",
+            "revisable": true,
+            "revision_evidence": "",
+            "revised_from": null
+        },
+        {
+            "id": "late_early_per_call_cost_ratio",
+            "unit": "median billable input per call over the last 20 calls / the first 20 calls of a session",
+            "baseline": 2.1,
+            "interim": 1.6,
+            "target": 1.3,
+            "direction": "lower_is_better",
+            "source": "agents/evidence/analysis/token-economy-recycling-phase1.md:69-75 — 145 sessions with >= 200 main-chain calls; median early 279,859 vs late 594,985; p90 ratio 3.3x",
+            "revisable": true,
+            "revision_evidence": "",
+            "revised_from": null
+        }
+    ],
+    "payload_rows": [
+        {
+            "_comment": "Per host, never one number. The aggregate the source drafts dieted against (\"419 KB always-loaded layer\") describes no host that exists: it is the whole rule tree, and only 9 of 116 rules are type: always.",
+            "id": "src_rules_maintained",
+            "unit": "bytes across src/rules/*.md",
+            "baseline": 424896,
+            "files": 116,
+            "target_bytes": null,
+            "target_owner": "none — this is the maintained source, not a delivered payload; it shrinks only as a consequence of a diet elsewhere",
+            "source": "measured 2026-08-10 at commit c073d5732, post-regeneration (see `measurement`)",
+            "revisable": true,
+            "revision_evidence": "",
+            "revised_from": null
+        },
+        {
+            "id": "dist_agent_src_rules",
+            "unit": "bytes across dist/agent-src/rules/*.md",
+            "baseline": 420051,
+            "files": 115,
+            "target_bytes": null,
+            "target_owner": "none — the tracked projection source. It is the ONLY rule-payload figure that is stable across checkouts, because it is committed; every other row below is regenerated and therefore machine-dependent.",
+            "source": "measured 2026-08-10 at commit c073d5732, post-regeneration",
+            "revisable": true,
+            "revision_evidence": "",
+            "revised_from": null
+        },
+        {
+            "id": "augment_rules_payload",
+            "unit": "bytes across .augment/rules/*.md",
+            "baseline": 420051,
+            "files": 115,
+            "target_bytes": null,
+            "target_owner": "src/config/budgets.yml § standing_rule_delivery (total_cap_tokens 110000) already owns the delivered-rule ceiling. This family does not open a second, byte-denominated target for the same surface — a metric with two owners is a metric with none.",
+            "source": "measured 2026-08-10 at commit c073d5732, post-regeneration; mirrors dist/ by symlink",
+            "revisable": true,
+            "revision_evidence": "",
+            "revised_from": null
+        },
+        {
+            "id": "claude_rules_payload",
+            "unit": "bytes across .claude/rules/*.md",
+            "baseline": 339035,
+            "files": 110,
+            "target_bytes": null,
+            "target_owner": "src/config/budgets.yml § standing_rule_delivery — same ceiling, same reason as the augment row",
+            "source": "measured 2026-08-10 at commit c073d5732, post-regeneration; 25 of 110 files carry a `paths:` block, the rest none",
+            "revisable": true,
+            "revision_evidence": "",
+            "revised_from": null
+        },
+        {
+            "_comment": "CORRECTION to part 0's triage table, which recorded these two as \"~3 KB / ~0 KB\" and therefore as already-lean hosts needing no target. Re-measured post-regeneration they are 408 KB and 330 KB — a full payload each. The earlier reading is a stale-projection artefact of exactly the class measurement rule 1 warns about: both carriers are UNTRACKED and written only by `task generate-tools`, so a checkout that has not run it reads them as near-empty. Risk 3's mitigation (\"the lean hosts need no target\") does not survive the re-measure and is not encoded here.",
+            "id": "clinerules_payload",
+            "unit": "bytes across .clinerules/*.md",
+            "baseline": 417703,
+            "files": 111,
+            "target_bytes": null,
+            "target_owner": "unowned — a diet for this host belongs to the parked rule-payload part of this family, not to part 0",
+            "source": "measured 2026-08-10 at commit c073d5732, post-regeneration; untracked, generated by task generate-tools",
+            "revisable": true,
+            "revision_evidence": "",
+            "revised_from": null
+        },
+        {
+            "id": "windsurfrules_payload",
+            "unit": "bytes of the single .windsurfrules file",
+            "baseline": 338160,
+            "files": 1,
+            "target_bytes": null,
+            "target_owner": "unowned — see the clinerules row; same correction, same parked owner",
+            "source": "measured 2026-08-10 at commit c073d5732, post-regeneration; untracked, generated by task generate-tools",
+            "revisable": true,
+            "revision_evidence": "",
+            "revised_from": null
+        },
+        {
+            "id": "gemini_md_payload",
+            "unit": "bytes of GEMINI.md",
+            "baseline": 2982,
+            "files": 1,
+            "target_bytes": null,
+            "target_owner": "none — genuinely lean, and the only host in this table for which that is true. It is a pointer file, not a rule payload.",
+            "source": "measured 2026-08-10 at commit c073d5732, post-regeneration",
+            "revisable": true,
+            "revision_evidence": "",
+            "revised_from": null
+        }
+    ],
+    "anchors": {
+        "premium_band_tokens": 200000,
+        "rationale": "Above ~200k a session sits in the premium pricing band, which is why the median target is set there rather than at a round fraction of the baseline.",
+        "known_noise_problem": "187 of 205 observed sessions end at or above 200k, so a session-end hint at this threshold would fire on ~91% of sessions — a constant line, not an advisory. The 200k figure is a TARGET here and nothing else.",
+        "no_carrier_ships": "Part 0 § 4.5: no session-end advisory ships for this anchor. The existing 800k recycle threshold (src/config/recycle-threshold-budget.json) stays the only strong line, and any carrier for 200k is a separate, separately-argued change.",
+        "source": "agents/evidence/analysis/token-economy-recycling-phase1.md — session-final distribution (:45) over the 205-session corpus (:10)"
+    }
+}

package/src/config/gate-coverage.yml

@@ -40,13 +40,16 @@
 #                visible, or it repeats the sin it exists to catch.
 #   canary       optional mutation recipe (Phase 7) — see CANARY below
 #
-# COVERAGE — THE HONEST DENOMINATOR (re-measured 2026-08-05)
+# COVERAGE — THE HONEST DENOMINATOR (re-measured 2026-08-10)
 # ----------------------------------------------------------
-# 240 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`
+# 251 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`
 # (the count is computed, not asserted — `check_gate_coverage.count_gate_scripts`).
-# **32 of them emit the machine-readable `scanned: <N>` line under their
-# CI-identical argv, and all 31 are listed below.** The manifest is therefore
+# **33 of them emit the machine-readable `scanned: <N>` line under their
+# CI-identical argv, and all 33 are listed below.** The manifest is therefore
 # complete with respect to its own contract, and covers ~13 % of the population.
+# (The 2026-08-05 reading said "32 … and all 31 are listed": the two halves of
+# one sentence disagreed by one, which is the drift this paragraph exists to
+# make visible. Both are recounted above, not adjusted toward each other.)
 #
 # Two revisions of this header have now gone stale the same way. It claimed
 # "8 of 211", then "22 of 223" while 26 entries were listed. Both halves drift
@@ -98,7 +101,7 @@
 # which is the shape this repo tells a gate author to use — writes the line from
 # inside the library, so its own source never matches and the test cannot see it.
 # Live split: **1 unregistered gate emits the inline shape (`check_gate_coverage`
-# itself), and 175 of 244 gate scripts emit through the helper.** So for the
+# itself), and 205 of 251 gate scripts emit through the helper.** So for the
 # recommended shape the sentence above is false, and the list CAN fall behind.
 #
 # Not widened here, deliberately. Widening the regex to include the helper turns
@@ -557,6 +560,42 @@ gates:
       untouched original stayed clean. Floor at 450 against a live 503 leaves
       room for skill retirement without redding the change that retires one.
 
+  - id: lint_workflow_paths
+    argv: []
+    min_scanned: 20
+    corpus: "every workflow under .github/workflows (28 at baseline); the unit is the file, and each file's `paths:` / `paths-ignore:` entries are resolved against `git ls-files`"
+    status: enforced
+    canary:
+      class: undetected-antipattern
+      path: .github/workflows/zz-canary-workflow-paths.yml
+      content: |
+        name: Canary
+        on:
+          pull_request:
+            paths:
+              - "retired/tree/that/never/existed/**"
+        jobs:
+          noop:
+            runs-on: ubuntu-latest
+            steps:
+              - run: echo canary
+    note: >
+      Registered STRICT on day one for the same reason `lint_example_fences`
+      was, and on the same evidence standard: the classification pass ran
+      BEFORE the gate existed and returned **20 dead entries across 6 workflow
+      files**, each classified by hand into one of four causes — a tree retired
+      by ADR-051, a gitignored projection that can never appear in a diff, two
+      paths moved by the Python-to-TS migration, and bare root paths whose real
+      files sit under `src/`. All 20 were repaired in the change that added the
+      gate, so the corpus is verified empty rather than unexamined, and an
+      advisory gate over it could only ever be ignored. Floor at 20 against a
+      live 28 so retiring a workflow does not red the change that retires it.
+      Worth recording that the highest-severity hit was invisible to the hand
+      census and only the gate found it: `release-validation.yml` filtered on a
+      root `marketplace.json` that has never existed, so a version drift in the
+      real manifest did not re-trigger the `version-consistency` job whose
+      entire purpose is catching that drift.
+
   - id: check_depth_budget
     argv: []
     min_scanned: 140

package/src/config/quorum-attendance-budget.json

@@ -0,0 +1,39 @@
+{
+    "_comment": "Pre-registered council ATTENDANCE metrics (road-to-inbox-harvest-2026-08-b Phase 1.4). Registered here rather than in roadmap prose because a roadmap is archived when it closes and a metric outlives it — the sibling budget files (hook-token-budget.json, recycle-threshold-budget.json) already carry the owner / review_by / honest-gap discipline this reuses. The instrument is the quorum_result line appendQuorumEvent writes to agents/runtime/council/events.log (schema v2); nothing here is measured yet, and no threshold is committed before data exists.",
+    "schema_version": 1,
+    "registered_at": "2026-08-10",
+    "owner": "maintainer",
+    "review_by": "2026-11-10",
+    "unit": "quorum_result event lines in agents/runtime/council/events.log",
+    "privacy": "a quorum_result line carries {phase, command, dispatch, verdict, threshold, configured_total, total, present, solo, absent[{member, reason}]} — counts, closed vocabularies, and member ids only. The type has no field able to hold free-form content, so the CLI's own `detail` string (provider error text, which can embed paths and prompt fragments) is dropped at the boundary rather than scrubbed.",
+    "phase_split": "A pass emits `pre_run` (build_members — who could be constructed) and, on the `run` path, `post_run` (_postRunQuorum — who actually returned a usable response). They disagree whenever a member constructs and then fails mid-flight, so a rate computed over both double-counts. A `pre_run` line is NOT evidence a pass ran: `command: estimate` is a spend-free preview, and a `run` / `debate` line is written before the `--confirm` gate (which defaults to false and returns before any provider call) and before the necessity and size-fit gates. A `post_run` line is the only line that proves providers were called — which is why every rate below is post_run-scoped, and why `command` exists at all.",
+    "attendance_rate": {
+        "definition": "of the members that entered the pass, how many answered: present / total per post_run pass. Bounded by 1 by construction (evaluateQuorum clamps present into [0, total]).",
+        "instrument": "quorum_result lines, phase=post_run, command=run, fields present + total",
+        "threshold": "none committed before data — baseline first, threshold at review date"
+    },
+    "roster_shortfall_rate": {
+        "definition": "how often the council shrank BEFORE the pass: share of post_run passes with total < configured_total, plus the size of the gap. This is the half attendance_rate cannot see — a pass with 3 configured, 2 failing to construct and 1 answering reads 1/1 = 100 % attendance and a shortfall of 2. Both numbers are needed and neither substitutes for the other; a single ratio over mixed rosters is the error this pair replaces.",
+        "instrument": "quorum_result lines, phase=post_run, command=run, configured_total vs total",
+        "threshold": "none committed before data — baseline first, threshold at review date",
+        "not_an_error": "total > configured_total is legitimate and not a shortfall: `--siblings` fans ONE enabled config entry into N clients, so the client roster can exceed the entry count. configured_total counts enabled config ENTRIES; total counts CLIENTS. Compare them for direction, never divide one by the other."
+    },
+    "solo_conclusion_rate": {
+        "definition": "share of post_run passes with `solo: true` — written by the isSoloConcluded predicate in quorum.ts, never re-derived from the numbers here, so one change to the rule cannot leave this definition stale. ceil(n/2) makes 1-of-2 a legitimate conclusion; this measures how often that legitimacy is used, not whether it should be. THREE cases carry solo: true and they are not the same finding — a degraded multi-member council (configured_total > 1), a council configured with one member (configured_total = 1, dispatch = full), and a deliberate --single dispatch (dispatch = single). Split on dispatch and configured_total before reading the rate.",
+        "instrument": "quorum_result lines, phase=post_run, command=run, field solo, split by dispatch + configured_total",
+        "threshold": "none committed before data. The quorum-solo-floor blocker pre-registers the three outcomes this rate decides between — a third CLI member, a gate-scoped min_present: 2, or a published null under 5 % — and that choice is made against real data, never ahead of it. It is decided on the degraded case only; a --single pass is the operator asking for one voice, not the council failing to assemble."
+    },
+    "absent_reason_distribution": {
+        "definition": "count per reason over absent[] entries — no_binary / no_auth / timeout / quota (AbsentReason) plus the two runtime fallbacks the CLI writes directly, `unavailable` (transport resolved to nothing) and `binary_missing` (a CLI client refused to construct). Distinguishes a council degraded by configuration from one degraded by provider behaviour, which have opposite fixes.",
+        "instrument": "quorum_result lines, absent[].reason, split by phase (a pre_run absence is configuration; a post_run absence is mid-flight). Excluding `command: estimate` is NOT sufficient: `run` and `debate` also reach construction and return at the `--confirm` gate, which defaults to false. The reliable filter is a pre_run line whose pass produced a matching post_run line; a pre_run line with no post_run partner reached construction and stopped there, whatever its command says.",
+        "threshold": "none committed before data — the distribution IS the finding at review date",
+        "merge_before_reading": "`no_binary` and `binary_missing` are two spellings of one condition — the CLI binary is unusable — written by different code paths (transport_resolver's static classification vs the CLI client's construction failure). They are recorded separately because that is what the tree emits, not because they are separate findings; merge them before reading the distribution, or the largest bucket is split in two."
+    },
+    "honest_null_consequence": "If the log accumulates and the solo-conclusion rate sits near zero, that is the published answer to the quorum-solo-floor blocker and 1.5 is cancelled against it — not quietly dropped. If attendance data never accumulates at all (nobody runs a metered council pass in the window), that is reported as an unmeasured metric at the review date, never as a passing one.",
+    "honest_gaps": [
+        "`lens` and `invocation` are empty on every pre_run line — neither is known at member-construction time — so any per-lens breakdown is post_run-only.",
+        "`command: debate` carries the pre_run half ONLY. There is no _postRunQuorum on the debate path, and defining `usable response` for a multi-round debate is a separate question this registration does not answer. So debate contributes to absent_reason_distribution and to nothing else: attendance_rate and solo_conclusion_rate cover the `run` path, and a reader must not read them as covering every metered pass.",
+        "A pre_run line proves construction happened, never that a pass followed — the `--confirm` gate (default false), the necessity gate and the size-fit gate all abort afterwards and nothing on the line records it. Any count over pre_run lines is an upper bound; pair it with a post_run line before treating it as a pass.",
+        "The CLI emit wiring itself has no test. The two modules are covered directly, but nothing exercises build_members / cmd_run / cmd_debate end-to-end against a captured log — and `_emitQuorumEvent` forwards no AppendEventOptions, so there is no target to capture into. Two defects in this file's first version (a `dispatch` written from the flag rather than the outcome, and a rate mixing config entries with clients) were found by review rather than by a test, which is what that gap costs."
+    ]
+}

package/src/scripts/_cli/cmd_doctor.ts

@@ -90,6 +90,8 @@ import * as installed_tools from '../_lib/installed_tools.js';
 import * as user_global_paths from '../_lib/user_global_paths.js';
 import * as global_deploy_inventory from '../_lib/global_deploy_inventory.js';
 import { censusDuplicateScope } from '../_lib/duplicate_scope_census.js';
+import * as preamble_byte_census from '../preamble_byte_census.js';
+import * as dispatch_economy_report from '../dispatch_economy_report.js';
 import { git_common_dir } from '../_lib/git_common_dir.js';
 import * as sync_gitattributes from '../sync_gitattributes.js';
 import {
@@ -3244,6 +3246,7 @@ interface Options {
     check: string | null;
     trace_root: boolean;
     context: boolean;
+    anatomy: boolean;
     repair: string | null;
 }
 
@@ -3254,13 +3257,15 @@ const PROG = 'agent-config doctor';
 // terminal width; golden tests assert the `usage:` token + exit code only.
 const USAGE =
     `usage: ${PROG} [-h] [--project PROJECT] [--json] [--ci] [--check ID]\n` +
-    '                           [--trace-root] [--context] [--repair ID]\n';
+    '                           [--trace-root] [--context] [--anatomy]\n' +
+    '                           [--repair ID]\n';
 
 const _STORE_TRUE_FLAGS: Record<string, keyof Options> = {
     '--json': 'json',
     '--ci': 'ci',
     '--trace-root': 'trace_root',
     '--context': 'context',
+    '--anatomy': 'anatomy',
 };
 
 const _VALUE_FLAGS: Record<string, keyof Options> = {
@@ -3283,6 +3288,7 @@ function _parse(argv: string[]): Options {
         check: null,
         trace_root: false,
         context: false,
+        anatomy: false,
         repair: null,
     };
 
@@ -3408,6 +3414,65 @@ function _run_context(opts: Options): number {
     return 0;
 }
 
+/**
+ * `--anatomy` — the injection anatomy, rendered from measurements that already
+ * exist. Composes `preamble_byte_census` (what occupies the always-loaded
+ * preamble) with `dispatch_economy_report` (what the dispatch legs cost). It
+ * takes NO new measurement and adds no threshold: both sources are advisory
+ * reports and stay advisory here.
+ *
+ * Neither module runs anything at import time — `preamble_byte_census` gained
+ * the `__AGENT_CONFIG_BUNDLE__` guard for exactly this import, since inside the
+ * `build:cli-delegate` bundle its old entry check would have matched whenever
+ * this command was invoked directly.
+ */
+function _run_anatomy(opts: Options): number {
+    const census = preamble_byte_census;
+    const economy = dispatch_economy_report;
+
+    const byteCensus = census.buildReport(census.parseArgs([]));
+
+    // The economy half reads transcripts and a registration file; either can be
+    // absent on a consumer machine. An absent half is reported as absent, never
+    // as a zero — a fabricated zero is the failure both source reports already
+    // refuse to make.
+    let economyReport: ReturnType<typeof economy.buildReport> | null = null;
+    let economyError: string | null = null;
+    try {
+        economyReport = economy.buildReport({
+            root: economy.DEFAULT_PROJECTS_ROOT,
+            auditDir: path.join(process.cwd(), economy.DEFAULT_AUDIT_DIR),
+            maxAgeDays: 14,
+        });
+    } catch (err) {
+        economyError = err instanceof Error ? err.message : String(err);
+    }
+
+    if (opts.json) {
+        print(
+            _jsonDumpsIndentAscii(
+                {
+                    preamble_byte_census: byteCensus,
+                    dispatch_economy: economyReport,
+                    dispatch_economy_unavailable: economyError,
+                } as unknown as Dict,
+                2,
+            ),
+        );
+        return 0;
+    }
+
+    print('── injection anatomy ─────────────────────────────────────────');
+    print(census.renderText(byteCensus));
+    print('');
+    print(
+        economyReport !== null
+            ? economy.renderText(economyReport)
+            : `dispatch-economy report unavailable: ${economyError}`,
+    );
+    return 0;
+}
+
 function _run_repair(opts: Options): number {
     const target = opts.repair;
     if (target === 'wizard-state') {
@@ -3464,6 +3529,9 @@ function main(argv: string[] | null = null): number {
     if (opts.context) {
         return _run_context(opts);
     }
+    if (opts.anatomy) {
+        return _run_anatomy(opts);
+    }
     let project_root: string;
     let origin: string;
     try {

package/src/scripts/_cli/cmd_session_recycle.ts

@@ -73,6 +73,7 @@ interface ParsedArgv {
     message?: string;
     file?: string;
     template?: boolean;
+    verify?: boolean;
 }
 
 export function parseArgv(argv: readonly string[]): ParsedArgv {
@@ -81,6 +82,8 @@ export function parseArgv(argv: readonly string[]): ParsedArgv {
         const a = argv[i] as string;
         if (a === '--template') {
             parsed.template = true;
+        } else if (a === '--verify') {
+            parsed.verify = true;
         } else if (a === '--file') {
             const value = argv[i + 1];
             if (!value) return { ok: false, message: '--file requires a path' };
@@ -102,7 +105,7 @@ export function parseArgv(argv: readonly string[]): ParsedArgv {
  */
 export function runSessionRecycle(
     input: string,
-    opts: { cwd: string; now?: Date },
+    opts: { cwd: string; now?: Date; verify?: boolean },
 ): RecycleResult {
     const out: string[] = [];
     const err: string[] = [];
@@ -171,6 +174,15 @@ export function runSessionRecycle(
         };
     }
 
+    // `--verify` stops HERE: every rejection above has already run, and the
+    // only thing skipped is the write. Validating through a different path
+    // than the one that writes would make the check a second implementation
+    // to keep in sync — the failure this suite refuses elsewhere.
+    if (opts.verify === true) {
+        out.push(`recycle envelope VALID — ${bytes} bytes, not written (--verify).`);
+        return { code: 0, out, err };
+    }
+
     const target = path.join(projectRoot, RECYCLE_ENVELOPE_REL);
     try {
         atomic_write_json(target, envelope);
@@ -193,9 +205,10 @@ export function main(argv: string[] = process.argv.slice(2)): number {
     const parsed = parseArgv(argv);
     if (!parsed.ok) {
         const usage = [
-            'usage: agent-config session:recycle [--file <envelope.json>] [--template]',
+            'usage: agent-config session:recycle [--file <envelope.json>] [--template] [--verify]',
             '  --file <path>   read the envelope JSON from a file (default: stdin)',
             '  --template      print a skeleton envelope and exit',
+            '  --verify        validate only — same rejections, no write',
         ].join('\n');
         if (parsed.message === 'usage') {
             process.stdout.write(`${usage}\n`);
@@ -225,7 +238,10 @@ export function main(argv: string[] = process.argv.slice(2)): number {
         return 2;
     }
 
-    const result = runSessionRecycle(input, { cwd: process.cwd() });
+    const result = runSessionRecycle(input, {
+        cwd: process.cwd(),
+        ...(parsed.verify === true ? { verify: true } : {}),
+    });
     for (const line of result.out) process.stdout.write(`${line}\n`);
     for (const line of result.err) process.stderr.write(`${line}\n`);
     return result.code;