@sabaiway/agent-workflow-kit 5.4.0 → 5.6.0

package/tools/gates-declaration.mjs

@@ -11,6 +11,7 @@ import { join, isAbsolute } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { fail, loadConfig, CONFIG_REL } from './orchestration-config.mjs';
 import { matchesCoverageProducer } from './coverage-producer.mjs';
+import { matchesSourceSizeGate } from './source-size-core.mjs';
 
 // The per-project declaration (strict JSON, hand-editable). cwd-relative — errors show a path the
 // user can open (the orchestration-config CONFIG_REL idiom).
@@ -174,7 +175,8 @@ export const coverageDeclarationDefects = (gates, projectDir) => {
       message:
         `${GATES_REL}: the canonical coverage checker (${checkers[0].id}) must be the LAST declared gate — ` +
         `${after.map((g) => g.id).join(', ')} would run after it consumed the lcov. REORDER the declaration by hand ` +
-        '(the gate itself is fine — this is an ORDERING refusal, and the fill is append-only, so it cannot reorder for you)',
+        '(the gate itself is fine — this is an ORDERING refusal about entries that are ALREADY declared: the fill ' +
+        'places a new entry before a trailing checker, but it never reorders what it did not write)',
     }];
   }
   if (!coverageProducerPrecedes(gates, index)) {
@@ -202,6 +204,16 @@ const REVIEW_DEPENDENT_CHECKS = ['review-state', 'commit-guard', 'coverage-check
 export const isReviewDependentGate = (gate, projectDir) =>
   REVIEW_DEPENDENT_CHECKS.some((check) => matchesCanonicalCheck(check, gate.cmd, projectDir));
 
+// isKitOwnedCheckerGate — is this gate one of the KIT's own checkers, rather than something the
+// project declared to verify itself? A separate question from review-dependence, and the two stopped
+// coinciding the moment a kit checker arrived that needs no receipt: the source-size gate is
+// deliberately in neither FINAL_CORE_CHECKS nor REVIEW_DEPENDENT_CHECKS, so every surface asking
+// "does this declaration verify the PROJECT?" through the review-dependent predicate alone read a
+// matrix of nothing but that gate as project verification. Three surfaces asked it, each knowing a
+// different half; this is the one home, so a future kit checker is added once.
+export const isKitOwnedCheckerGate = (gate, projectDir) =>
+  isReviewDependentGate(gate, projectDir) || matchesSourceSizeGate(gate.cmd, projectDir);
+
 // ── the pregate subset derivation (#66 / Decision 7 — ONE home for producer and factory) ─────
 
 export const unknownPregateExcludeIds = (gates, exclude) => {

package/tools/gates-init.mjs

@@ -45,11 +45,12 @@
 //     tool path (spaces survive; executes from the project root).
 //
 // Write discipline: preview (dry-run) is the DEFAULT and writes NOTHING — a declined offer leaves
-// the file byte-identical. `--apply` appends EXACTLY the consented entries (`--only <id>`
+// the file byte-identical. `--apply` writes EXACTLY the consented entries (`--only <id>`
 // repeatable) through the shared atomic-write core (tools/atomic-write.mjs — exclusive-create
-// tmp+rename, TOCTOU re-check, symlink STOPs): append-only, never modifies or removes an existing
-// entry, refuses id collisions, refuses a malformed declaration (never writes over what it cannot
-// parse). Deployment-gated: docs/ai presence (lstat, no-follow) on EVERY run; the
+// tmp+rename, TOCTOU re-check, symlink STOPs): ADD-ONLY (it never modifies, removes or reorders an
+// existing entry), refuses id collisions, refuses a malformed declaration (never writes over what it
+// cannot parse). WHERE a consented entry lands is a PLACEMENT rule, not a blind append — see
+// placeEntries below. Deployment-gated: docs/ai presence (lstat, no-follow) on EVERY run; the
 // .workflow-version == lineage-head stamp gate on --apply only (the velocity/gate-hook precedent).
 //
 // Exit codes: 0 done / dry-run; 1 precondition STOP (no deployment, stamp, symlink, malformed
@@ -60,10 +61,20 @@ import { join, resolve, dirname } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { discoverGateCandidates, EXPECTED_WORKFLOW_VERSION } from './velocity-profile.mjs';
 import { GATES_REL, validateDeclaration } from './run-gates.mjs';
-import { coverageDeclarationDefects, isReviewDependentGate } from './gates-declaration.mjs';
+import { canonicalCheckerGates, coverageDeclarationDefects, isKitOwnedCheckerGate } from './gates-declaration.mjs';
 import { COVERAGE_PRODUCER_BODY, matchesCoverageProducer } from './coverage-producer.mjs';
 import { loadConfig } from './orchestration-config.mjs';
 import { assertDocsAiDeployment, writeDocsAiFileAtomic, lstatNoFollow } from './atomic-write.mjs';
+// The source-size practice, through its PURE READ core only (D-18): this module asks whether the
+// practice is minted, never how to mint it — the checker's writer half stays outside the read graph.
+import {
+  INITIAL_ADOPTION_REASON,
+  SOURCE_SIZE_GATE_ID,
+  SOURCE_SIZE_TOOL_PATH,
+  escapeForLine,
+  isLineUnsafe,
+  loadSourceSizeConfig,
+} from './source-size-core.mjs';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const KIT_ROOT = resolve(HERE, '..');
@@ -95,9 +106,11 @@ export const TRUST_CHAIN_DISCLOSURE =
 const USAGE = `usage: gates-init [--dry-run | --apply] [--only <id>]... [--cwd <dir>] [--help]
 
 The consented FILL preview for the project's own docs/ai/gates.json (D9). Default is --dry-run:
-prints the derived { id, title, cmd } entries and writes NOTHING. --apply APPENDS exactly the
-consented entries (--only <id> selects a subset; append-only — existing entries are never
-modified or removed, an id collision is refused). The offer is CLOSED-WORLD: only a
+prints the derived { id, title, cmd } entries and writes NOTHING. --apply WRITES exactly the
+consented entries (--only <id> selects a subset; add-only — existing entries are never modified,
+removed or reordered, an id collision is refused). A consented entry lands at the END, except that
+a non-checker entry goes BEFORE a declaration's trailing canonical coverage checker, which must
+stay last. The offer is CLOSED-WORLD: only a
 terminating-class script name (test / lint / type-check / build — never release/publish/deploy,
 never watch/serve, never a write-mode variant) whose BODY is a member of the literal runner
 allowlist is offered, as the hook-free \`COREPACK_ENABLE_NETWORK=0 <pm> exec -- <body>\` form for
@@ -410,6 +423,77 @@ export const flowCheckCandidate = (cwd, deps = {}) => {
   }
 };
 
+// The conditional SOURCE-SIZE candidate — keyed on the practice's own declaration rather than on a
+// recipe: the gate is offered ONLY over a MINTED docs/ai/source-size.json, because on any other
+// state the checker REFUSES by design (an absent config has no declared scope; an authored or
+// half-written one records nothing yet), and a declared gate that refuses is a matrix this preview
+// would have reddened on the user's behalf. The two states are told apart out loud: a project that
+// never declared the practice hears nothing (there is no offer to make), while one that authored it
+// and stopped short hears WHY the gate is not offered yet — the mint is the step it is missing.
+// A path is unrenderable when EITHER guard fires, and both are asked ONCE, before anything about
+// this candidate is printed. They are the same question wearing two coats: double-quoting cannot
+// survive a shell-active byte, and a line-unsafe byte cannot be printed at all — U+2028 quotes
+// perfectly and still breaks the line, so a surface screening only shell metacharacters lets it walk
+// into a declared gate cmd while reading as fully guarded.
+const unrenderableToolPath = (text) => isLineUnsafe(text) || DQ_UNSAFE_PATH_PATTERN.test(text);
+
+export const sourceSizeCandidate = (cwd, deps = {}) => {
+  const toolPath = deps.sourceSizeTool ?? SOURCE_SIZE_TOOL_PATH;
+  try {
+    const { state } = loadSourceSizeConfig(resolve(cwd), deps);
+    if (state === 'absent') return { candidate: null, note: null };
+    // Asked BEFORE the state branches: every branch below prints this path, so a check that only one
+    // of them performs is a guard the other silently lacks.
+    if (unrenderableToolPath(toolPath)) {
+      // The withheld path is NAMED, so it crosses the line-safety boundary before it is rendered —
+      // escaped rather than dropped, because two different paths must never print as the same one.
+      // The advice still follows the STATE: over an unminted record a hand-declared gate is red on
+      // every run, so pointing there would hand the reader their next failure as the way out.
+      const lane = state === 'minted'
+        ? 'declare the gate by hand'
+        : `mint the record first — run source-size-check.mjs --adopt --reason "${INITIAL_ADOPTION_REASON}" with the working directory set to this project, then declare the gate by hand`;
+      return {
+        candidate: null,
+        note:
+          `the source-size candidate was withheld: the resolved kit path cannot be rendered into a ` +
+          `command — it carries bytes that do not survive double-quoting, or a byte that cannot appear ` +
+          `in a printed line at all (${escapeForLine(toolPath)}) — ${lane}`,
+      };
+    }
+    if (state !== 'minted') {
+      // The named recovery is the reader's next keystroke, so it is a command they can actually run:
+      // the resolved absolute path and an explicit --cwd, carrying the reason a FIRST mint requires
+      // (recording a value for the first time is a raise, and the bare verb would refuse). The
+      // PROJECT path is screened by the same predicate — a rendered command naming a path the shell
+      // would read differently could run somewhere other than the project it names.
+      const project = resolve(cwd);
+      const recovery = unrenderableToolPath(project)
+        ? `run source-size-check.mjs --adopt --reason "${INITIAL_ADOPTION_REASON}" yourself, with the working directory set to this project (no command is printed: this project's path cannot be rendered into one)`
+        : `run node "${toolPath}" --adopt --reason "${INITIAL_ADOPTION_REASON}" --cwd "${project}"`;
+      return {
+        candidate: null,
+        note:
+          `the source-size candidate was withheld: the declared practice is not yet MINTED (${state}) — ` +
+          `the checker refuses until it records this tree, so declaring the gate now would red the matrix; ` +
+          `${recovery}, then re-run this preview`,
+      };
+    }
+    return {
+      candidate: {
+        id: SOURCE_SIZE_GATE_ID,
+        title: 'Source files within the declared size caps (the recorded ratchet)',
+        cmd: `node "${toolPath}" --check`,
+      },
+      note: null,
+    };
+  } catch (err) {
+    return {
+      candidate: null,
+      note: `the source-size practice config is unreadable (${err.message}) — the source-size candidate was not evaluated`,
+    };
+  }
+};
+
 // Every --only id must name an OFFERED entry — enforced in BOTH paths (dry-run and apply), before
 // any empty-offer shortcut, so a typo is a loud usage error, never a silent filter or a silent
 // "nothing to offer" success.
@@ -424,15 +508,16 @@ const assertOnlyIdsOffered = (offer, onlyIds = []) => {
   }
 };
 
-// The full offer: script entries + the conditional review-state / flow-check / coverage-check
-// candidates (coverage-check LAST — the `run-gates --final` declaration-shape rule requires the
-// checker as the last declared gate, so a whole-offer apply is final-ready by construction). The
-// pair keys on plan-execution.review reviewed/council OR a flow block (the P21 trio); flow-check
-// itself appears only under a flow block.
+// The full offer: script entries + the conditional review-state / flow-check / source-size /
+// coverage-check candidates (coverage-check LAST — the `run-gates --final` declaration-shape rule
+// requires the checker as the last declared gate, so a whole-offer apply is final-ready by
+// construction). The pair keys on plan-execution.review reviewed/council OR a flow block (the P21
+// trio); flow-check itself appears only under a flow block; source-size only over a minted practice.
 export const buildOffer = (cwd, deps = {}) => {
   const scripts = deriveScripts(cwd, deps);
   const rs = reviewStateCandidate(cwd, deps);
   const fc = flowCheckCandidate(cwd, deps);
+  const ss = sourceSizeCandidate(cwd, deps);
   const cc = coverageCheckCandidate(cwd, deps);
   // Decision 3 — the checker is never offered DEAD. The producer may come from this offer or from
   // a declaration the user already wrote by hand, so the rule reads the merged picture; a
@@ -462,7 +547,7 @@ export const buildOffer = (cwd, deps = {}) => {
   //   readable, no gate   → the claim and the advice both hold;
   //   readable, has gate  → a green matrix proves plenty and the user already declared their own.
   const declarationState =
-    existing.unreadable !== null ? 'unreadable' : existing.gates.some((gate) => !isReviewDependentGate(gate, cwd)) ? 'has-gate' : 'no-gate';
+    existing.unreadable !== null ? 'unreadable' : existing.gates.some((gate) => !isKitOwnedCheckerGate(gate, cwd)) ? 'has-gate' : 'no-gate';
   const noVerificationNote =
     scripts.entries.length > 0
       ? null
@@ -471,10 +556,10 @@ export const buildOffer = (cwd, deps = {}) => {
             ? `, and none is declared either, so a green matrix would prove only that the kit's own checkers ran; declare your own in ${GATES_REL}`
             : ''
         }`;
-  const candidates = [rs.candidate, fc.candidate, withholdCoverage ? null : cc.candidate].filter(Boolean);
+  const candidates = [rs.candidate, fc.candidate, ss.candidate, withholdCoverage ? null : cc.candidate].filter(Boolean);
   return {
     entries: [...scripts.entries, ...candidates],
-    notes: [...scripts.notes, noVerificationNote, unreadableNote, rs.note, fc.note, coverageNote].filter(Boolean),
+    notes: [...scripts.notes, noVerificationNote, unreadableNote, rs.note, fc.note, ss.note, coverageNote].filter(Boolean),
   };
 };
 
@@ -510,7 +595,7 @@ export const formatPreview = (offer, applyInvocation = null, { explicitOnly = fa
   return lines.join('\n');
 };
 
-// ── the existing declaration (append-only source) ──────────────────────────────────────
+// ── the existing declaration (the base every placement is computed against) ────────────
 const loadExistingDeclaration = (cwd, deps = {}) => {
   const read = deps.readFile ?? readFileSync;
   const lstat = deps.lstat ?? lstatSync;
@@ -572,7 +657,30 @@ const readStampValue = (cwd, deps = {}) => {
   }
 };
 
-// ── apply (append exactly the consented entries) ───────────────────────────────────────
+// ── the PLACEMENT rule (D-8) ───────────────────────────────────────────────────────────
+// WHERE a consented entry lands. A blind append made the fill unusable on exactly the declarations
+// it should serve best: the canonical coverage checker must be the LAST gate, so appending any
+// other entry after it produced a declaration the written-declaration validator correctly reds —
+// and the only way to consent to a new gate on a final-capable declaration was to hand-edit.
+//
+// The rule is one sentence: a non-checker entry goes BEFORE a trailing canonical checker, everything
+// else goes at the end. It is ADD-ONLY still — existing entries keep their relative order, none is
+// modified or removed; only the insertion point moves. A consented CHECKER stays after the trailing
+// one on purpose: two canonical checkers is a duplicate the validator must refuse by name, and
+// hiding that shape behind a clever placement would refuse it for the wrong reason.
+export const placeEntries = (existingGates, selected, projectDir) => {
+  const last = existingGates[existingGates.length - 1];
+  const isChecker = (gate) => canonicalCheckerGates([gate], projectDir).length === 1;
+  if (last === undefined || !isChecker(last)) return [...existingGates, ...selected];
+  return [
+    ...existingGates.slice(0, -1),
+    ...selected.filter((entry) => !isChecker(entry)),
+    last,
+    ...selected.filter(isChecker),
+  ];
+};
+
+// ── apply (write exactly the consented entries, each at its placement) ─────────────────
 export const applyFill = ({ cwd, onlyIds = [] }, deps = {}) => {
   assertDocsAiDeployment(cwd, deps, { stop, noun: 'a gate declaration', rel: GATES_REL });
   const stampValue = readStampValue(cwd, deps);
@@ -593,14 +701,14 @@ export const applyFill = ({ cwd, onlyIds = [] }, deps = {}) => {
   const collisions = selected.filter((e) => existingIds.has(e.id)).map((e) => e.id);
   if (collisions.length) {
     throw stop(
-      `id collision — already declared in ${GATES_REL}: ${collisions.join(', ')} (append-only: the ` +
+      `id collision — already declared in ${GATES_REL}: ${collisions.join(', ')} (add-only: the ` +
         `fill never modifies or removes an existing entry; pick the others with --only, or edit by hand)`,
     );
   }
 
   const merged = {
     _README: existing.outcome === 'loaded' && existing.readme !== undefined ? existing.readme : templateReadme(deps),
-    gates: [...existingGates, ...selected],
+    gates: placeEntries(existingGates, selected, cwd),
   };
   validateDeclaration(merged); // every written declaration passes the runner's validator, always
   // Decision 4 — the coverage invariant is enforced on the declaration that GETS WRITTEN, not on
@@ -610,7 +718,11 @@ export const applyFill = ({ cwd, onlyIds = [] }, deps = {}) => {
   if (defects.length) throw stop(`${defects[0].message} — nothing was written`);
   const body = `${JSON.stringify(merged, null, 2)}\n`;
   const { writtenPath } = writeDocsAiFileAtomic(cwd, GATES_REL, body, deps, { stop, noun: 'a gate declaration' });
-  return { outcome: 'written', writtenPath, appended: selected.map((e) => e.id), notes: offer.notes };
+  const placed = selected.map((e) => e.id);
+  // `appended` is the DEPRECATED alias of `placed`, carrying the same array: this result is a public
+  // tools/ payload, and dropping a field an external consumer reads would make a placement rule a
+  // BREAKING change. The name is the only thing that was ever wrong — the value never was.
+  return { outcome: 'written', writtenPath, placed, appended: placed, notes: offer.notes };
 };
 
 // ── CLI ────────────────────────────────────────────────────────────────────────────────
@@ -670,7 +782,7 @@ export const main = (argv = process.argv.slice(2), deps = {}) => {
       for (const note of result.notes) log(`  note: ${note}`); // the user learns WHY (same note as the preview)
       return EXIT_OK;
     }
-    log(`[agent-workflow-kit] appended ${result.appended.length} consented gate(s) to ${GATES_REL}: ${result.appended.join(', ')}`);
+    log(`[agent-workflow-kit] declared ${result.placed.length} consented gate(s) in ${GATES_REL}: ${result.placed.join(', ')}`);
     for (const note of result.notes) log(`  note: ${note}`); // a mixed offer never silently omits what was screened
     log(`[agent-workflow-kit] ${TRUST_CHAIN_DISCLOSURE}`);
     return EXIT_OK;

package/tools/procedures.mjs

@@ -5,7 +5,8 @@
 // steps LIVE from the installed agent-workflow-engine (references/procedures.md — AD-016 live read, no
 // bundled mirror), reads the per-project, hand-edited config (docs/ai/orchestration.json), runs the
 // read-only backend detector, and prints the activity's steps VERBATIM + the resolved effective recipe
-// per slot (default = Reviewed-when-a-backend-is-ready, Council on request, slot-aware incl. Delegated).
+// per slot (default = Reviewed-when-a-backend-is-ready, Council on request, slot-aware incl. Delegated),
+// plus the project's DECLARED source-size practice when it declares one (D-17 U1).
 //
 // Invariants (mirror recipes.mjs): pure-where-possible, READ-ONLY (never writes, never commits, never
 // runs a subscription CLI). The deterministic resolution lives in the kit (resolveActivityRecipe), not
@@ -44,6 +45,10 @@ import { AUTONOMY_REL, loadAutonomy, resolveAutonomy, isSparseSeedConfig } from
 // acyclic — pinned by test/read-graph-purity.test.mjs (FLOW-READ-GRAPH-PURITY).
 import { resolveFlowStorePath, readFlowStore } from './flow-store-read.mjs';
 import { CHAIN_KIND } from './flow-record.mjs';
+// The declared source-size practice (D-17 U1), read through the practice's PURE READ core — never
+// source-size-check.mjs, which owns the writer half: this advisor is a read root of
+// test/read-graph-purity.test.mjs, and the core exists so a surface can ask without reaching a writer.
+import { SOURCE_SIZE_CONFIG_REL, SOURCE_SIZE_WHY, loadSourceSizeConfig, practiceFacts } from './source-size-core.mjs';
 export { CONFIG_REL };
 
 // ── argument + override parsing (usage errors → exit 2) ─────────────────────────────
@@ -361,6 +366,49 @@ const flowHalvesAdvice = (flow, probe) => {
   ];
 };
 
+// ── the declared source-size practice (D-17 U1) ────────────────────────────────────
+// A practice the agent meets only when a gate refuses is a practice learned too late: the caps, their
+// reason and the plan-time rung ride EVERY named-activity render, so the layout is cut to them while
+// the plan is being written. Composed from the project's live declaration, never from constants here.
+// Each config state speaks as itself: ABSENT renders NOTHING (a project that declares no practice must
+// not be handed invented limits); AUTHORED and INCOMPLETE render the declared caps plus the honest
+// "nothing is recorded yet" line — both are pre-mint states, and treating INCOMPLETE as MINTED would
+// report a half record as the whole tree's debt; MINTED renders the recorded counts too.
+// A config that cannot be read renders ONE loud line carrying the reader's own message and the render
+// still completes: the exit code for a broken source-size config belongs to the practice's own
+// checker (exit 2 there, and its declared gate reds the matrix on it), while THIS tool's exit
+// contract is about its own config and the engine.
+
+export const DECLARED_PRACTICE_HEADER = `Declared source-size practice (${SOURCE_SIZE_CONFIG_REL}) — known BEFORE the code is written:`;
+
+const declaredPracticeAdvice = (cwd, readFile, lstat) => {
+  let declaration;
+  try {
+    declaration = loadSourceSizeConfig(cwd, { readFile, lstat });
+  } catch (err) {
+    return [`Declared source-size practice: UNREADABLE — ${(err && err.message) || err} — fix ${SOURCE_SIZE_CONFIG_REL} by hand; a declared practice is never guessed around.`];
+  }
+  if (declaration.state === 'absent') return [];
+  const facts = practiceFacts(declaration.config);
+  // The two pre-mint states share a LANE (the ratchet holds nothing, the mint step is next) but not a
+  // FACT: an incomplete file carries half the machine record, so "no size is recorded" would be a
+  // plain untruth about it — it names the missing half instead. Neither ever prints minted counts.
+  // The mint step is named, not rendered: on a project path that does not survive double-quoting the
+  // checker deliberately withholds a paste-ready command, and this advisor never re-decides that.
+  const unmintedRecord = declaration.state === 'incomplete'
+    ? `  recorded: PARTIAL — the machine record is half-written (missing ${declaration.missingMachineKeys.map((key) => `"${key}"`).join(', ')}), so the ratchet holds nothing yet; run \`source-size-check.mjs --check\` for the mint step.`
+    : '  recorded: NOTHING YET — the caps are declared but no size is recorded, so the ratchet holds nothing; run `source-size-check.mjs --check` for the mint step.';
+  return [
+    DECLARED_PRACTICE_HEADER,
+    `  caps: ${facts.maxLines} lines · ${facts.maxLineBytes} bytes per line, over ${facts.roots} declared root(s).`,
+    declaration.state === 'minted'
+      ? `  recorded: ${facts.recordedFiles} file(s) carry a recorded size (debt, not permission) · aggregate ${facts.aggregateLines} line(s), EXACT — growth takes a reasoned bump, never free headroom.`
+      : unmintedRecord,
+    `  why: ${SOURCE_SIZE_WHY}`,
+    '  at plan time: every Step that CREATES a file names the file and its single responsibility, and the planned layout fits these caps — the gate is the backstop, never the teacher.',
+  ];
+};
+
 // The verbatim per-backend DRIVING CONTRACT block (M-contract): the exact invocation descriptor(s),
 // the closed flag set, the grounding note, the round-2/continue delta, and the guarded passthrough
 // tiers — every descriptor printed VERBATIM from the registry mirror of the bridge manifest
@@ -397,7 +445,7 @@ const contractLines = ({ cmd, contract, settings }) => {
   return lines;
 };
 
-const formatHuman = ({ activity, section, slots, warnings, plans, autonomy, flowHalves }) => {
+const formatHuman = ({ activity, section, slots, warnings, plans, autonomy, flowHalves, declaredPractice }) => {
   const lines = [
     section,
     '',
@@ -417,6 +465,7 @@ const formatHuman = ({ activity, section, slots, warnings, plans, autonomy, flow
   const advice = reviewLoopAdvice(slots, activity);
   if (advice.length) lines.push('', ...advice);
   lines.push('', ...costLanesAdvice());
+  if (declaredPractice.length) lines.push('', ...declaredPractice);
   if (warnings.length) {
     lines.push('', 'warnings:');
     for (const w of warnings) lines.push(`  ⚠ ${w}`);
@@ -424,7 +473,7 @@ const formatHuman = ({ activity, section, slots, warnings, plans, autonomy, flow
   return lines.join('\n');
 };
 
-const buildJson = ({ activity, section, slots, configSource, warnings, plans, autonomy, flowHalves }) => ({
+const buildJson = ({ activity, section, slots, configSource, warnings, plans, autonomy, flowHalves, declaredPractice }) => ({
   activity,
   section,
   slots: Object.fromEntries(
@@ -439,6 +488,9 @@ const buildJson = ({ activity, section, slots, configSource, warnings, plans, au
   costLanes: costLanesAdvice(),
   // ADDITIVE (AD-044 Plan 4): the per-activity autonomy block, structured (empty when unresolvable).
   autonomy: autonomyAdvice(activity, autonomy),
+  // ADDITIVE (D-17 U1): the SAME composed lines the human render prints — one array, two renders, so
+  // a scripted reader and a human can never be told different things about the declared practice.
+  declaredPractice,
   // CONDITIONAL (flow P8): the armed-halves block rides ONLY a flow-carrying config — the unarmed
   // JSON key set stays byte-exact (unarmed neutrality outranks the additive-key precedent).
   ...(flowHalves == null ? {} : { flowHalves }),
@@ -461,6 +513,12 @@ ${CONFIG_REL} + the read-only backend detector, and prints both. A per-run
 --override <slot>=<recipe> (repeatable) overrides the configured/default recipe for that slot.
 Read-only: never writes, never commits, never runs a subscription CLI.
 
+Also prints the project's DECLARED source-size practice (${SOURCE_SIZE_CONFIG_REL}) when it declares
+one — the caps, what is recorded, why the practice exists, and the plan-time rung — as the
+declaredPractice block (--json: the same lines under "declaredPractice"). A project with no such
+file renders nothing; a file that cannot be read renders ONE loud UNREADABLE line and still exits 0
+(the practice's own checker owns the exit code for its config).
+
 Exit codes: 0 success (an unsatisfiable override degrades loudly, still 0);
             2 usage (unknown activity / bad --override); 1 config or engine error
             (incl. a malformed ${AUTONOMY_REL} — the advisory still renders, the exit flips).`;
@@ -515,9 +573,10 @@ export const main = (argv, ctx = {}) => {
     // unarmed project keeps byte-identical output (human AND JSON) and never pays the store probe.
     const flowProbe = ctx.flowProbe ?? defaultFlowProbe;
     const flowHalves = config?.flow == null ? null : flowHalvesAdvice(config.flow, flowProbe(cwd));
+    const declaredPractice = declaredPracticeAdvice(cwd, readFile, lstat);
     const stdout = json
-      ? JSON.stringify(buildJson({ activity, section, slots, configSource, warnings, plans, autonomy, flowHalves }), null, 2)
-      : formatHuman({ activity, section, slots, warnings, plans, autonomy, flowHalves });
+      ? JSON.stringify(buildJson({ activity, section, slots, configSource, warnings, plans, autonomy, flowHalves, declaredPractice }), null, 2)
+      : formatHuman({ activity, section, slots, warnings, plans, autonomy, flowHalves, declaredPractice });
     if (autonomy?.error) {
       return { code: 1, stdout, stderr: `procedures: malformed ${AUTONOMY_REL} — ${autonomy.error}` };
     }

package/tools/receipt-deadline.mjs

@@ -5,7 +5,9 @@
 // ARRIVAL: a newline-terminated parseable receipt line from the dispatched backend starting
 // at/after the watermark offset, or — PREFERRED whenever a dispatch nonce is supplied and its
 // finding manifest exists — the nonce-matched manifest (the manifest is minted atomically BEFORE
-// the receipt append, so its presence is the stronger dispatch-identity signal).
+// the receipt append, so its presence is the stronger dispatch-identity signal). "Receipt line" is
+// decided POSITIVELY, by the minimal core below: a delegation-ledger line carries a `backend` too,
+// and a review waiter waits for a REVIEW answer (D10).
 //
 // Watermark semantics (P6/P18, split by surface): the PERSISTED dispatch-ledger watermark stays
 // the plain byte-length integer; THIS RUNNER additionally binds the receipts-file PREFIX
@@ -32,10 +34,30 @@ export const DEADLINE_POLL_MS = 5000;
 
 // The one contract sentence, doc-parity-bound into references/modes/receipt-deadline.md — the
 // arrival-not-satisfaction split is the tool's identity and must not drift in the mode doc.
-export const RECEIPT_DEADLINE_CONTRACT = 'satisfaction is receipt ARRIVAL past the watermark — a strictly-newer parseable receipt line from the dispatched backend (or its nonce-matched finding manifest, preferred when present) — never obligation satisfaction';
+export const RECEIPT_DEADLINE_CONTRACT = 'satisfaction is receipt ARRIVAL past the watermark — a strictly-newer parseable REVIEW receipt line from the dispatched backend (or its nonce-matched finding manifest, preferred when present), never a delegation-ledger line that merely names the same backend — never obligation satisfaction';
 
 const sha256 = (buf) => createHash('sha256').update(buf).digest('hex');
 
+// The receipts store and the delegation ledger are different files with different schemas, but both
+// are JSONL beside the git dir and both carry a `backend` — so a ledger line reaching this store
+// would satisfy a waiter that matched on the backend alone (D10). The rule is therefore POSITIVE,
+// not a blacklist of foreign kinds: a blacklist goes stale the moment the other family grows a kind,
+// and the two errors are not symmetric — an unrecognised line costs a TIMEOUT that names its
+// watermark (loud), while a false ARRIVED answers a review dispatch with something that is not a
+// review. This is the MINIMAL core every review receipt carries and no delegation record can: the
+// kinds that carry `backend` (dispatch, return) have no `verdict`, and the kind that carries
+// `verdict` (fold) has no `backend`. `fingerprint` must be PRESENT but may be null — an empty
+// fingerprint is legal in some receipt modes, so requiring a value would refuse a real receipt.
+const REVIEW_RECEIPT_SCHEMA = 1;
+
+const isReviewReceiptLine = (parsed, backend) =>
+  parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)
+  && parsed.schema === REVIEW_RECEIPT_SCHEMA
+  && parsed.backend === backend
+  && typeof parsed.artifact === 'string' && parsed.artifact.length > 0
+  && typeof parsed.verdict === 'string' && parsed.verdict.length > 0
+  && Object.hasOwn(parsed, 'fingerprint');
+
 // Every read rides the kit's ONE race-free reader (flow-store-read's no-follow/non-block
 // discipline): store identity is never resolved through a link, a FIFO can never block the
 // bounded wait, and an invalid-UTF-8 store refuses (a byte-unstable store cannot carry a prefix
@@ -97,7 +119,7 @@ export const pollArrival = ({ path, watermark, prefixHash, backend, nonce = null
     } catch {
       continue; // a malformed line never satisfies — and never masks a later valid one
     }
-    if (parsed && typeof parsed === 'object' && parsed.backend === backend) {
+    if (isReviewReceiptLine(parsed, backend)) {
       return { state: 'satisfied', reason: `a receipt line from backend "${backend}" arrived past watermark offset ${watermark} (${path})` };
     }
   }