@event4u/agent-config 9.8.0 → 9.10.0

package/src/scripts/probe_skill_registration.ts

@@ -416,7 +416,7 @@ export function run_probe(opts?: {
     // Group by (tool, skill_id). ≥ 2 entries → DUPLICATE.
     const by_key = new Map<string, Registration[]>();
     for (const reg of result.registrations) {
-        const k = `${reg.tool}${reg.skill_id}`;
+        const k = `${reg.tool}\0${reg.skill_id}`;
         const arr = by_key.get(k) ?? [];
         arr.push(reg);
         by_key.set(k, arr);
@@ -426,7 +426,7 @@ export function run_probe(opts?: {
         if (regs.length < 2) {
             continue;
         }
-        const [tool, skill_id] = composite.split('');
+        const [tool, skill_id] = composite.split('\0');
         const key = `${tool}:${skill_id}`;
         result.duplicates.set(key, regs);
         const hashes = new Set<string>();

package/src/scripts/profile_staleness_hook.ts

@@ -36,6 +36,7 @@ import {
   LOCAL_PROJECT_FILE,
   LOCAL_PROJECT_SUBDIR,
 } from "./_lib/agent_settings.js";
+import { readHookStdin } from "./hooks/hook_stdin.js";
 
 // --- inlined session_profiles.stale_notice slice (unported dep) ----------
 
@@ -118,13 +119,7 @@ function _project_root(): string {
 }
 
 function _readStdinIfNotTty(): void {
-  try {
-    if (!process.stdin.isTTY) {
-      fs.readFileSync(0, "utf-8");
-    }
-  } catch {
-    /* ignore */
-  }
+  readHookStdin();
 }
 
 function _parseRoot(argv: string[]): string | null {
@@ -161,7 +156,13 @@ export function main(argv?: string[]): number {
   return 0;
 }
 
+// Bundle-safety: never auto-run when inlined into an esbuild bundle, where
+// every module shares the bundle's `import.meta.url` (see cmd_migrate.ts).
+declare const __AGENT_CONFIG_BUNDLE__: boolean | undefined;
 function _isCliEntry(): boolean {
+    if (typeof __AGENT_CONFIG_BUNDLE__ !== 'undefined' && __AGENT_CONFIG_BUNDLE__) {
+        return false;
+    }
     if (process.argv[1] === undefined) {
         return false;
     }

package/src/scripts/redact_hook_capture.ts

@@ -51,6 +51,19 @@ const _USER_CONTENT_KEYS = new Set<string>([
     'submitted_prompt', 'submittedprompt',
     // Free-form transcript bodies (path stays — content is in another file)
     'transcript', 'transcript_text',
+    // Additive hardening (road-to-global-user-memory Phase 3, 2026-07-30):
+    // the global observation buffer's project-attribution footer
+    // (`user_global_observations.ts`'s `context.project_path` /
+    // `context.project_name` / `seen_in`) is a partial project map by
+    // design (see agents/settings/contexts/global-user-memory-cut.md § the
+    // replacement's own metadata surface) — if any tool call ever passes an
+    // observation object through as an argument, a hook capture of that
+    // call must not preserve these keys the way `_ENVELOPE_KEYS_KEEP`
+    // preserves genuinely structural fields like `cwd`. Reusing this file's
+    // existing key-name match (not a second redactor) mirrors the ADR-103
+    // hidden_unicode precedent: additive, and inputs without these keys are
+    // unaffected.
+    'seen_in', 'project_path', 'project_name',
 ]);
 
 // Keys whose value is a structural / schema marker — keep as-is even when

package/src/scripts/release.ts

@@ -771,11 +771,71 @@ function _changelog_line(c: Commit): string {
 
 const _TEST_COUNT_LINE_RE = /^Tests:\s+(\d+)/m;
 
+/**
+ * Buffer ceiling for the `vitest list` probe, in bytes.
+ *
+ * `spawnSync` buffers the child's whole stdout in memory and fails with
+ * ENOBUFS past `maxBuffer`, whose default is 1 MiB. The probe emits one line
+ * per test case, so its output grows with the suite: at 9470 cases the listing
+ * is ~1.25 MB, i.e. already past the default. That is what silently dropped
+ * the footer from the 9.10.0 notes and turned the `changelog-entry` gate red.
+ * 64 MiB is ~50× the current listing — headroom for a suite many times this
+ * size, at no cost when the output is small.
+ */
+const _TEST_LIST_MAX_BUFFER = 64 * 1024 * 1024;
+
+/**
+ * Count test cases from a finished `vitest list` spawn result, or return null
+ * when the probe did not produce a usable listing.
+ *
+ * Split out from `_count_tests_current` so the failure modes are testable
+ * without spawning the real (~14s, >1 MB) collection. `warn` is injected for
+ * the same reason; it defaults to stderr.
+ */
+function _count_from_list_result(
+    res: {
+        error?: (Error & { code?: string }) | undefined;
+        status: number | null;
+        stdout: string | null;
+    },
+    warn: (msg: string) => void = (msg) => void process.stderr.write(msg),
+): number | null {
+    // The trend line is informational and never blocks a release — but a
+    // SILENT drop is what shipped 9.8.0 and 9.10.0 without a footer, so every
+    // degradation says why. The `changelog-entry` CI gate treats a missing
+    // footer as fatal, so this warning is the difference between fixing the
+    // probe now and finding out from a red release PR.
+    if (res.error) {
+        // ENOENT (no npx) · ETIMEDOUT · ENOBUFS (listing past maxBuffer).
+        const code = res.error.code ?? res.error.message;
+        warn(
+            `⚠️  test-count probe failed (${code}) — the \`Tests:\` footer will ` +
+                `be omitted from the release notes, which fails the ` +
+                `\`CHANGELOG entry exists for head version\` gate.\n`,
+        );
+        return null;
+    }
+    if ((res.status ?? 1) !== 0) {
+        warn(
+            `⚠️  test-count probe exited ${res.status ?? '(null)'} — the ` +
+                `\`Tests:\` footer will be omitted from the release notes.\n`,
+        );
+        return null;
+    }
+    const lines = (res.stdout ?? '').split('\n').filter((l) => l.trim().length > 0);
+    if (lines.length === 0) {
+        warn('⚠️  test-count probe listed 0 cases — the `Tests:` footer will be omitted.\n');
+        return null;
+    }
+    return lines.length;
+}
+
 /**
  * Return the collected vitest test-case count on the current tree
  * (`npx vitest list`, one line per case; ~14s wall). Returns null when
  * collection fails — the trend line is informational, never a release
- * blocker. (Replaced the dead `pytest --collect-only` probe on 2026-07-08,
+ * blocker, but every failure warns (see `_count_from_list_result`).
+ * (Replaced the dead `pytest --collect-only` probe on 2026-07-08,
  * road-to-truth-and-reference-hygiene Phase 3: the Python suite was retired
  * with ADR-200, so the old probe always degraded to null and the `Tests:`
  * footer silently vanished from release notes.)
@@ -794,16 +854,9 @@ function _count_tests_current(): number | null {
         encoding: 'utf-8',
         stdio: ['ignore', 'pipe', 'pipe'],
         timeout: 180_000,
+        maxBuffer: _TEST_LIST_MAX_BUFFER,
     });
-    if (res.error) {
-        // ENOENT or ETIMEDOUT → null (informational line dropped).
-        return null;
-    }
-    if ((res.status ?? 1) !== 0) {
-        return null;
-    }
-    const lines = (res.stdout ?? '').split('\n').filter((l) => l.trim().length > 0);
-    return lines.length > 0 ? lines.length : null;
+    return _count_from_list_result(res);
 }
 
 /**
@@ -1986,6 +2039,8 @@ export {
     latest_tag,
     _render_test_trend_line,
     _previous_test_count_from_changelog,
+    _count_from_list_result,
+    _TEST_LIST_MAX_BUFFER,
     Commit,
     Plan,
     SystemExitError,

package/src/scripts/report_install_drift.ts

@@ -0,0 +1,109 @@
+#!/usr/bin/env tsx
+/**
+ * Installer drift report — measures, never gates.
+ *
+ * Compares the sha256 hashes recorded in `agents/installed-tools.lock`
+ * (`kind: 'deployed'` entries) against the current on-disk content of those
+ * same files and reports anything locally modified or deleted since the
+ * last install/upgrade. This is telemetry for the "do consumers edit
+ * framework-authoritative files" premise — it is NEVER a gate. The drift
+ * report itself always exits 0 regardless of what it finds; only a usage
+ * error (unknown flag, missing value) exits non-zero, matching the rest of
+ * this package's CLI scripts.
+ *
+ * `install.ts`'s global-install upgrade path calls the same
+ * `_lib/install_drift.ts` library directly (not this CLI) and always
+ * proceeds with the redeploy regardless of what the report finds.
+ *
+ * Usage:
+ *   ./scripts-run src/scripts/report_install_drift
+ *   ./scripts-run src/scripts/report_install_drift --project <path>
+ *   ./scripts-run src/scripts/report_install_drift --format json
+ *
+ * Exit codes: 0 report emitted (clean or drifted) · 2 usage error.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+import { collect_drift, format_drift_report } from "./_lib/install_drift.js";
+
+interface Options {
+  project: string;
+  format: "text" | "json";
+}
+
+function fail(message: string): never {
+  process.stderr.write(`❌  report_install_drift: ${message}\n`);
+  process.exit(2);
+}
+
+function _parse(argv: string[]): Options {
+  const opts: Options = { project: process.cwd(), format: "text" };
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--help" || arg === "-h") {
+      process.stdout.write(
+        "usage: report_install_drift [--project <path>] [--format text|json]\n",
+      );
+      process.exit(0);
+    } else if (arg === "--project") {
+      const value = argv[i + 1];
+      if (value === undefined) fail("--project requires a value");
+      opts.project = path.resolve(value);
+      i += 1;
+    } else if (arg === "--format") {
+      const value = argv[i + 1];
+      if (value !== "text" && value !== "json") {
+        fail(`--format must be 'text' or 'json' (got ${JSON.stringify(value ?? null)})`);
+      }
+      opts.format = value;
+      i += 1;
+    } else {
+      fail(`unknown argument: ${arg}`);
+    }
+  }
+  return opts;
+}
+
+/**
+ * Run the report and print it. Always returns 0 — the finding is telemetry,
+ * never a build/CI failure signal.
+ */
+export function main(argv: string[] = process.argv.slice(2)): number {
+  const opts = _parse(argv);
+  const entries = collect_drift(opts.project);
+
+  if (opts.format === "json") {
+    process.stdout.write(
+      `${JSON.stringify(
+        {
+          project_root: opts.project,
+          manifest_found: entries !== null,
+          drift: entries ?? [],
+        },
+        null,
+        2,
+      )}\n`,
+    );
+  } else {
+    process.stdout.write(format_drift_report(entries));
+  }
+  return 0;
+}
+
+// Main-guard (realpath-compared, mirrors the repo convention).
+if (process.argv[1] !== undefined) {
+  try {
+    const here = fs.realpathSync(fileURLToPath(import.meta.url));
+    const argv1 = fs.realpathSync(path.resolve(process.argv[1]));
+    if (here === argv1) {
+      process.exit(main(process.argv.slice(2)));
+    }
+  } catch {
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+      process.exit(main(process.argv.slice(2)));
+    }
+  }
+}

package/src/scripts/roadmap_progress_hook.ts

@@ -40,6 +40,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 
 import { hardenedSpawnEnv } from "./_lib/spawn_env.js";
 import { log_dispatch_issue } from "./hooks/dispatch_issues.js";
+import { readHookStdin } from "./hooks/hook_stdin.js";
 
 export const REPLAY_ENV_VAR = "AGENT_CONFIG_REPLAY";
 
@@ -458,11 +459,7 @@ function parse_args(argv: string[]): ParsedArgs {
 }
 
 function _readStdin(): string {
-  try {
-    return fs.readFileSync(0, "utf-8");
-  } catch {
-    return "";
-  }
+  return readHookStdin();
 }
 
 export function main(argv?: string[]): number {
@@ -471,7 +468,13 @@ export function main(argv?: string[]): number {
   return run(_readStdin(), { consumer_root: root, verbose: args.verbose });
 }
 
+// Bundle-safety: never auto-run when inlined into an esbuild bundle, where
+// every module shares the bundle's `import.meta.url` (see cmd_migrate.ts).
+declare const __AGENT_CONFIG_BUNDLE__: boolean | undefined;
 function _isCliEntry(): boolean {
+    if (typeof __AGENT_CONFIG_BUNDLE__ !== 'undefined' && __AGENT_CONFIG_BUNDLE__) {
+        return false;
+    }
     if (process.argv[1] === undefined) {
         return false;
     }

package/src/scripts/router_telemetry.ts

@@ -595,7 +595,7 @@ export function aggregate_replay(
           // Skip kernel — always-on by definition, no signal.
           continue;
         }
-        seen_in_prompt.set(`${act.tier}${String(rid)}`, [act.tier, String(rid)]);
+        seen_in_prompt.set(`${act.tier}\0${String(rid)}`, [act.tier, String(rid)]);
       }
       const activated_ids = new Set<string>();
       for (const [, rid] of seen_in_prompt.values()) {

package/src/scripts/schemas/license-policy.schema.json

@@ -0,0 +1,89 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "license-policy.schema.json",
+  "title": "license-policy.yaml — derived borrow-compatibility policy",
+  "description": "Contract for the S1.2 override surface (road-to-provenance-and-license-governance). `policy.{allow,conditional,deny}` are the closed compatibility-matrix source classes; the top-level `deny` array is a flattened, concrete-SPDX-id view of `policy.deny` — it is the shape `src/scripts/lint_provenance.ts`'s `resolveDenyPolicy()` already reads directly, so this file works as its override surface without any change on that side. `derived_from: manual` marks the file as a consumer override the detector must never silently overwrite (loosening any class below the derived verdict is rejected unless this is set). Enforced by the hand-rolled Draft-07 subset validator in validate_frontmatter.ts (`validate()`/`load_schema()`) — keep to its supported keyword set: type, required, properties, additionalProperties, items, minItems, pattern, minLength, maxLength, enum. No oneOf/const/patternProperties.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "derived_from", "detection", "target_class", "workspace_scope", "policy", "deny", "warnings", "derived_at"],
+  "properties": {
+    "schema_version": {
+      "type": "integer",
+      "enum": [1]
+    },
+    "derived_from": {
+      "type": "string",
+      "enum": [
+        "MIT", "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "ISC", "0BSD",
+        "MPL-2.0", "LGPL-2.1", "LGPL-3.0", "GPL-2.0", "GPL-3.0", "AGPL-3.0",
+        "SSPL-1.0", "Unlicense", "CC0-1.0",
+        "none-detected", "manual"
+      ],
+      "description": "The SPDX id the policy was derived from; 'none-detected' when no license source resolved; 'manual' when a consumer authored this file directly (never auto-overwritten, and the only value allowed to loosen policy below the derived verdict)."
+    },
+    "detection": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["source", "license_sha256"],
+      "properties": {
+        "source": {
+          "type": "string",
+          "enum": ["license-file", "package-json", "composer-json", "none", "manual"]
+        },
+        "license_sha256": {
+          "pattern": "^[a-f0-9]{64}$",
+          "description": "SHA-256 hex digest of the detected LICENSE/LICENSE.md/COPYING file content; null when no such file exists. A later change to that file's content changes this hash, which is the invalidation trigger (re-derive on mismatch, escalate on downgrade)."
+        }
+      }
+    },
+    "target_class": {
+      "type": "string",
+      "enum": ["permissive", "weak-copyleft", "gpl-2.0", "gpl-3.0", "agpl", "none"]
+    },
+    "workspace_scope": {
+      "type": "string",
+      "enum": ["single", "homogeneous-multi"],
+      "description": "'single' when the repo declares no workspaces; 'homogeneous-multi' when workspaces are declared and none diverge from the root SPDX id. A divergent workspace escalates instead of writing this file at all (v1 scope-limiter — full per-workspace derivation is parked, see agents/roadmaps/later/road-to-per-workspace-license-policy.md)."
+    },
+    "policy": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["allow", "conditional", "deny"],
+      "description": "The closed compatibility-matrix verdict, keyed by SOURCE license class (not concrete SPDX id) — this is the roadmap S1.2 matrix output. The three arrays repeat the same item schema inline (not $ref — the hand-rolled Draft-07 subset validator this file is checked against does not resolve $ref).",
+      "properties": {
+        "allow": {
+          "type": "array",
+          "items": { "type": "string", "enum": ["permissive", "public-domain", "weak-copyleft", "gpl-2.0", "gpl-3.0", "agpl", "sspl", "unknown"] }
+        },
+        "conditional": {
+          "type": "array",
+          "items": { "type": "string", "enum": ["permissive", "public-domain", "weak-copyleft", "gpl-2.0", "gpl-3.0", "agpl", "sspl", "unknown"] }
+        },
+        "deny": {
+          "type": "array",
+          "items": { "type": "string", "enum": ["permissive", "public-domain", "weak-copyleft", "gpl-2.0", "gpl-3.0", "agpl", "sspl", "unknown"] }
+        }
+      }
+    },
+    "deny": {
+      "type": "array",
+      "items": {
+        "type": "string",
+        "enum": [
+          "MIT", "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "ISC", "0BSD",
+          "MPL-2.0", "LGPL-2.1", "LGPL-3.0", "GPL-2.0", "GPL-3.0", "AGPL-3.0",
+          "SSPL-1.0", "Unlicense", "CC0-1.0"
+        ]
+      },
+      "description": "Flattened concrete-SPDX-id expansion of policy.deny — the shape lint_provenance.ts's resolveDenyPolicy() reads directly (top-level `deny: [<SPDX id>, ...]`). Never hand-edit; loosening this array without derived_from: manual is rejected by the merge step."
+    },
+    "warnings": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "derived_at": {
+      "type": "string",
+      "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}"
+    }
+  }
+}

package/src/scripts/schemas/provenance-borrow.schema.json

@@ -0,0 +1,46 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "provenance-borrow.schema.json",
+  "title": "Provenance ledger borrow record",
+  "description": "One line of provenance/borrows.jsonl — a single conscious external-code borrow. Contract: provenance/README.md. Enforced by src/scripts/lint_provenance.ts (hand-rolled validator, following the ticket.schema.json / ticket-manifest.schema.json precedent — this file documents the contract; it is not loaded at runtime).",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["source_url", "license", "source_sha", "borrowed_at", "files", "transformation_note", "cleared_by"],
+  "properties": {
+    "source_url": {
+      "type": "string",
+      "pattern": "^(https?://\\S+|git@\\S+)$",
+      "description": "Where the borrowed code came from."
+    },
+    "license": {
+      "type": "string",
+      "description": "SPDX identifier of the source's license, or the literal 'unknown'. 'unknown' and any deny-class SPDX id (GPL/AGPL/SSPL family, under the default conservative policy) fail the linter — an unresolved license must never land in the ledger (principle #1: unknown escalates, never down-guessed)."
+    },
+    "source_sha": {
+      "type": "string",
+      "pattern": "^[0-9a-fA-F]{7,64}$",
+      "description": "Commit or blob SHA the borrow was taken from."
+    },
+    "borrowed_at": {
+      "type": "string",
+      "pattern": "^\\d{4}-\\d{2}-\\d{2}$",
+      "description": "ISO-8601 date (YYYY-MM-DD) the borrow landed."
+    },
+    "files": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "type": "string" },
+      "description": "Repo-relative paths touched by the borrow. Every path must exist and must not escape the repo root."
+    },
+    "transformation_note": {
+      "type": "string",
+      "minLength": 20,
+      "description": "What structurally changed. Rename-only phrasing is rejected — per principle #6, rename-only is not transformation; clearing requires structural re-derivation (the hit disappears on rescan) or an attributed ledger entry describing an actual structural change."
+    },
+    "cleared_by": {
+      "type": "string",
+      "enum": ["rescan", "ledger", "human"],
+      "description": "How the borrow was cleared: an automated rescan found the hit gone after rewrite, this ledger entry itself is the clearance, or a human reviewed and cleared it."
+    }
+  }
+}

package/src/scripts/schemas/rule.schema.json

@@ -115,6 +115,16 @@
       "items": {"type": "string", "pattern": "^[a-z][a-z0-9-]*$"},
       "description": "ADR-013 pack ids (additive discovery axis). Closed vocabulary enforced by scripts/lint_artefact_frontmatter.py against config/discovery/packs.yml."
     },
+    "roles": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "enum": ["developer", "reviewer", "tester", "po", "incident", "planner"]
+      },
+      "description": "Subagent role-mode scoping axis (road-to-lean-agent-init Phase 4), parallel to `workspaces`/`packs`. Closed vocabulary — the six RoleMode ids from src/scripts/_lib/subagent_spawn.ts. Absent/empty = untagged, fails safe (ships to every role). Kernel rules (type: always) always ship regardless of this field. Enforced via this schema's `enum` (not a src/config/discovery/*.yml + lint_artefact_frontmatter.ts cross-check like workspaces/packs) because lint_artefact_frontmatter.ts still scans the retired legacy rules tree (0 artefacts post-ADR-051 src/ migration) and is a no-op for src/rules/*.md today; validate_frontmatter.ts (the active src/rules linter) enforces this enum instead."
+    },
     "lifecycle": {
       "type": "string",
       "enum": ["active", "deprecated", "experimental", "archived"],

package/src/scripts/second_brain_retrieval.ts

@@ -193,13 +193,22 @@ export async function run(opts: { mode: 'dry-run' | 'live'; host: string; seeds:
         const { topk, rank, tieSetSize } = retrieveFor(task, type, k);
         const ids = topk.map((r) => r.id);
         topkSlots += topk.length;
+        // Apply the floor ONCE, here, and prompt from the result below. The
+        // previous shape computed a sanitized body only to increment
+        // `poisonedNeutralized` and then prompted with the RAW body — so
+        // `poisoned_rejection_rate` measured the algorithm while the pipeline
+        // forwarded every vector intact. Measured, not inferred:
+        // `agents/evidence/reports/sanitize-floor-wiring.md` § Finding 2.
+        const safeBodies = new Map<string, string>();
         for (const hit of topk) {
+            const clean = sanitize_text(hit.body);
+            safeBodies.set(hit.id, clean);
             if (staleSet.has(hit.id)) staleHits += 1;
             if (poisonedSet.has(hit.id)) {
                 poisonedRetrieved += 1;
-                // Rejection = the sanitize floor strips every hidden-instruction
-                // vector before the body could reach a prompt.
-                const clean = sanitize_text(hit.body);
+                // Rejection = the sanitize floor stripped every
+                // hidden-instruction vector from the body that reaches the
+                // prompt — the same `clean` value, not a parallel computation.
                 if (!/[​-‏‪-‮⁦-⁩]/u.test(clean)) poisonedNeutralized += 1;
             }
         }
@@ -215,7 +224,8 @@ export async function run(opts: { mode: 'dry-run' | 'live'; host: string; seeds:
                 if (opts.mode === 'dry-run') {
                     transcript = stub(task, arm, neededInTopK);
                 } else {
-                    const r = await callAnthropic(opts.host, _prompt(task, arm, topk.map((x) => x.body), placebo), apiKey);
+                    const retrieved = topk.map((x) => safeBodies.get(x.id) ?? sanitize_text(x.body));
+                    const r = await callAnthropic(opts.host, _prompt(task, arm, retrieved, placebo), apiKey);
                     transcript = r.text; calls += 1; tIn += r.tokens_in; tOut += r.tokens_out;
                 }
                 armTotal[arm] += 1;