fix: close 29 records: declarations judged folder by folder, a benign config replace re-judged, home-deletion guard residuals, and a credential-store audit

.abcd/README.md

@@ -30,8 +30,11 @@ second home for the schemas:
 |---|---|---|
 | `config.json` | the ahoy surface (repo-scope config + `meta` setup block) | `development/brief/05-internals/03-configuration.md` |
 | `rules.json` | the rules loader (per-repo domain overrides) | itd-3; `AGENTS.md` § abcd rule loader |
-| `config/` | per-surface machine records (`identity.json`, `launch-payload.json`, `version-location.json`) | iss-62 / adr-28 / the version-location note |
+| `config/` | per-surface machine records (`identity.json`, `launch-payload.json`, `version-location.json`, `artefact.json`, `reading-presets.json`) | iss-62 / adr-28 / the version-location note |
+| `config/pii.json` (optional, absent here) | the redaction scanner's per-repo pattern override, read by every redacting write path and the privacy lint; absent, the bundled patterns apply | [`internal/README.md`](../internal/README.md) § `adapter/scanner/` |
+| `config/scripts-closure.json` (optional, absent here) | the pinned `scripts/` runtime closure the launch payload scopes that include to; absent, `scripts/` is included like any other path | `internal/core/launch/includes.go` (`defaultClosureFn`); no chapter states its schema |
 | `positioning.json` | the identity surface | `development/brief/04-surfaces/19-identity.md` |
 | `site.json`, `site-baseline.json` | the site renderer and its ratchet | the site surface chapter |
 | `docs-lint.json`, `record-lint.json` | the docs and record gates | the lint surface chapter |
 | `citations-baseline.json` | the citation-health baseline | the docs `cite` surface |
+| `prose-citations-baseline.json` | record-lint's `prose_citation_resolves` baseline (the unresolvable ids the record has ruled on) | `development/brief/05-internals/06-lint.md` |

.abcd/config/reading-presets.json

@@ -60,10 +60,10 @@
         "test"
       ],
       "window": {
-        "tokens_est": 1370000,
-        "measured_tokens_est": 1346832,
-        "measured_bytes": 5185304,
-        "measured_at": "a887092f79d847680e09a6f0a7a447bfb6f01749"
+        "tokens_est": 1380000,
+        "measured_tokens_est": 1358172,
+        "measured_bytes": 5228966,
+        "measured_at": "8fdf0d0330d3a15efc65ee3ad4f4c76cbc6f35df"
       }
     },
     "entailment": {
@@ -216,10 +216,10 @@
         "test"
       ],
       "window": {
-        "tokens_est": 1380000,
-        "measured_tokens_est": 1358267,
-        "measured_bytes": 5229331,
-        "measured_at": "24e78506b9e7d4471d9c9110d6217e6e5f2c4b88"
+        "tokens_est": 1390000,
+        "measured_tokens_est": 1367208,
+        "measured_bytes": 5263754,
+        "measured_at": "8fdf0d0330d3a15efc65ee3ad4f4c76cbc6f35df"
       }
     }
   }

.abcd/development/README.md

@@ -11,6 +11,7 @@ artefact type**, one canonical home per concept:
 | [`brief/`](brief) | The living canvas: what abcd IS (product … delivery) + the [glossary](brief/glossary). |
 | [`intents/`](intents) | Press-release intents — the WHY of each user-facing change. Lifecycle by directory: `disciplines/` `drafts/` `planned/` `shipped/` `superseded/`. |
 | [`specs/`](specs) | Specs (`spc-N`) — the HOW derived from an intent. Lifecycle by directory: `open/` `closed/`. |
+| [`agents/`](agents) | The agent prompts' operator statement and their prompt-version log; the prompts themselves are the repository's top-level `agents/`, which a harness loads whole (iss-110). |
 | [`principles/`](principles) | Distilled cross-cutting design principles (first-class — the lifeboat packs these). |
 | [`decisions/`](decisions) | ADRs (MADR) — ratified architecture decisions, one canonical home; plus `notes/`. |
 | [`roadmap/`](roadmap) | Sequencing: `phases/` + `rfcs/` (an accepted RFC produces an ADR). |

agents/CHANGELOG.md → .abcd/development/agents/CHANGELOG.md

@@ -1,6 +1,6 @@
 # Agent prompt changelog
 
-Per [itd-5](../.abcd/development/intents/disciplines/itd-5-prompt-quality-additions.md),
+Per [itd-5](../intents/disciplines/itd-5-prompt-quality-additions.md),
 every `agents/*.md` prompt carries a `prompt_version` and a corresponding entry
 here recording the bump rationale (and, at `1.0.0` lock, the self-improvement
 pre-flight outcome and calibration-corpus delta).

agents/README.md → .abcd/development/agents/README.md

@@ -1,21 +1,30 @@
 # Agents
 
-Host-delegated agent prompt definitions. Each `*.md` file here is a **prompt**, not
-code: abcd's core does the deterministic work and hands the prompt to the host's
+Host-delegated agent prompt definitions live in the repository's top-level
+[`agents/`](../../../agents/). Each `*.md` file there is a **prompt**, not code:
+abcd's core does the deterministic work and hands the prompt to the host's
 subagent dispatch, which owns model choice, credentials, and execution and returns
 a structured result the core consumes (adr-25, host-delegated by default). The Go
 side never executes these prompts.
 
-## What lives here
+This page and the prompt-version log beside it live here, in the durable record,
+rather than in `agents/`: the harness registers every markdown file at the top of
+that directory as an agent, with no frontmatter requirement and no name
+exemption, so a readme or a changelog kept there is a spurious agent on every
+installed surface (iss-110). `TestPluginAgentSurfaceRegistersOnlyAgents` holds the
+directory to prompts alone.
 
-- `*.md` — one agent prompt per file, carrying itd-5 frontmatter (below).
-- `<name>/fixtures/` — per-agent fixtures. Every agent that reads untrusted input
-  carries at least one `injection-canary.json`.
-- `CHANGELOG.md` — one entry per agent per version bump (itd-5).
+## What lives where
 
-The layout is flat. A markdown file anywhere below the top level, outside a
-`fixtures/` directory, is a misfiled prompt, and record-lint's `agent_contract`
-rule refuses it rather than skipping it.
+- `agents/*.md` — one agent prompt per file, carrying itd-5 frontmatter (below).
+- `agents/<name>/fixtures/` — per-agent fixtures. Every agent that reads untrusted
+  input carries at least one `injection-canary.json`.
+- [`CHANGELOG.md`](CHANGELOG.md), beside this page — one entry per agent per
+  version bump (itd-5).
+
+The prompt layout is flat. A markdown file anywhere below the top level of
+`agents/`, outside a `fixtures/` directory, is a misfiled prompt, and
+record-lint's `agent_contract` rule refuses it rather than skipping it.
 
 The four M6 synthesis agents (itd-88) — dispatched by the `/abcd:disembark`
 orchestration sections:
@@ -34,7 +43,7 @@ the delegated path.
 
 ## The itd-5 contract
 
-Every agent prompt here conforms to [itd-5](../.abcd/development/intents/disciplines/itd-5-prompt-quality-additions.md),
+Every agent prompt in `agents/` conforms to [itd-5](../intents/disciplines/itd-5-prompt-quality-additions.md),
 the prompt-quality discipline, and record-lint's `agent_contract` rule enforces it
 (itd-151). The frontmatter fields:
 
@@ -53,7 +62,7 @@ the prompt-quality discipline, and record-lint's `agent_contract` rule enforces
 - **`capability_scope`** — an object `{ task_classes: [...], designed_for: "..." }`.
   `task_classes` is a **YAML inline list** (a block list of `- token` items would
   trip the future PQ005) of tokens drawn from the closed enum in
-  [`02-constraints/04-naming.md`](../.abcd/development/brief/02-constraints/04-naming.md)
+  [`02-constraints/04-naming.md`](../brief/02-constraints/04-naming.md)
   (`oracle_review`, `intent_audit`, `spec_planning`, `code_rescue`,
   `principle_distillation`, `lifeboat_packing`, `audit`, `lint`, `surface_render`,
   `cross_document_audit`, `cold_reading`). `designed_for` is a free-text one-liner for human readers
@@ -92,9 +101,10 @@ nothing resolvable.
 
 `agents/` is outside both the record-lint roots (`.abcd/development`) and the
 docs-lint roots (`docs`, `README.md`), so the per-file record and docs rules do not
-reach these files. The itd-5 contract is enforced instead by record-lint's
-dedicated `agent_contract` rule, which walks this tree directly (`agents_dir` in
-`.abcd/record-lint.json`) and holds each prompt to three things:
+reach the prompts. The itd-5 contract is enforced instead by record-lint's
+dedicated `agent_contract` rule, which walks that tree directly (`agents_dir` in
+`.abcd/record-lint.json`, with `changelog` naming the log beside this page) and
+holds each prompt to three things:
 
 1. **The trust-contract frontmatter.** Every prompt declares `prompt_version` (a
    semver) and `reads_untrusted_input` — the declaration is required of ALL of

.abcd/development/brief/00-meta.md

@@ -24,7 +24,7 @@ The brief is split across numbered folders rather than a single `README.md`. Rea
 
 1. **Concurrent editing** — multiple agents can work on different sections without serialising on one file.
 2. **Diff legibility** — `git log brief/04-surfaces/02-disembark.md` tracks the evolution of one command's design, not a whole-brief blob.
-3. **Agent context budget** — agents that need only one section can pull just that file (relevant to the [`05-internals/03-configuration.md`](05-internals/03-configuration.md) `maxAgentTokens` budget).
+3. **Agent context budget** — agents that need only one section can pull just that file (relevant to the `disembark.maxAgentTokens` budget, a staged key in [`05-internals/03-configuration.md`](05-internals/03-configuration.md) that no shipped code reads).
 4. **Reusable shape** — the same numbered-folder layout serves as a template for future projects (the lifeboat output shape mirrors this skeleton, see [`04-surfaces/02-disembark.md § 5`](04-surfaces/02-disembark.md#5-output-shape)).
 
 ## Naming convention

.abcd/development/brief/04-surfaces/08-abcd.md

@@ -61,7 +61,9 @@ itd-121). For a shipped intent the move is its fidelity-review state, read by
 the intent store's one reader of the review marker (itd-2609150819445595): an
 owed review names its receipt and the re-emit command; a shipped intent with no
 marker owes one too, and the re-emit mints its receipt; a dead-lettered review
-is reported unreviewed with its reason; an ingested one leaves nothing to do. A
+is reported unreviewed with its reason; an ingested one leaves nothing to do.
+For a ready planned intent, and for its open spec, the move is closing the spec,
+and it says that the close ships the intent when no open spec still names it. A
 positional on the namespace root is not a `show` sub-verb, so the form stays
 inside the naming discipline. For an issue id it also names the checkout and
 branch whose ledger it read, as every ledger verb does: a stderr line in the

.abcd/development/brief/04-surfaces/17-guard.md

@@ -122,6 +122,17 @@ than folded into either extreme. The three states — clean, repo layer dropped,
 no registry at all — are decided once, in the core, and every caller formats
 the same answer.
 
+One limit is not among those states, because it is never false: the guard's
+reach. The manifest's pre-tool-use matcher hands the hook the shell tool and
+the question tool and nothing else, so a call through any other tool never
+reaches the guard — a file the host's own tools write or edit, a command a tool
+from another extension runs — and nothing warns about it, since nothing
+failed. It is the guard's standing scope, not a degradation, and the `guard:`
+line does not report it. Whether the guard should adjudicate more than the
+shell is a separate question with a real cost: every further tool class needs
+its own hazard vocabulary, and a guard that refuses a tool it cannot reason
+about is worse than one that says plainly what it covers.
+
 The two callers part company on exactly that file, deliberately. **On the hook,
 the session keeps its protection:** the repo's overrides are dropped with a
 notice on stderr, the bundled hazards still decide, and a hazardous command is
@@ -241,7 +252,12 @@ bare interpreter inside a string, because a variable is how ordinary commands
 carry a program or a path between commands. A here-document body is data, but the substitutions the shell
 runs in a body whose delimiter is unquoted are read as commands, and such a body
 is read by the lines bash compares with its delimiter, joined across a trailing
-odd run of backslashes. A backtick's text is read after bash's own pass over
+odd run of backslashes. A body begins on the line after the one that opened
+it, and a command or process substitution still open at that line's end holds
+it back: the substitution's own lines run as commands, and the body begins on
+the line after it closes. A document a substitution opens and never reads is
+pending after the close in bash 5 and dropped in bash 3.2, which runs the
+lines it would cover, so that line is refused as an unterminated document. A backtick's text is read after bash's own pass over
 it, which drops a backslash before `$`, a backtick or a backslash (and, directly
 inside double quotes, a `"`), so an escaped substitution between backticks is
 read as the one bash runs. A payload that is wholly a substitution printing a
@@ -296,8 +312,34 @@ in or the one above it (`*`, `*/`, `.`, `..`, `./*`, `./*/`, `../*`, `.*`,
 `git clean`, because that directory is usually the repository and emptying a
 build directory the same way is ordinary work. Chained after a `cd` any
 recursive forced delete blocks, as above. The target is compared as written,
-before the shell expands it, so `$HOME` and `$PWD` are seen as those words
-although no other parameter expansion is.
+before the shell expands it, so `$HOME` and `$PWD` are seen as those words. It
+is first read the way bash reads its text: a backslash-newline inside a name
+is dropped (`$HO\⏎ME` is `$HOME`); each word a brace group makes keeps the
+variables its text holds, and a name runs on into the letters a list or a
+sequence places after it (`{$HOME,x}`, `$HOME/{.*,}`, `$HO{ME,}`,
+`$HO{M..M}E`); an expansion whose operator can leave the value as it is reads
+as the variable itself — a default, an assignment or an error message
+(`${HOME:-x}`), a trim or a pattern replacement (`${HOME%/}`, `${HOME#x}`,
+`${HOME/x/y}`), a substring, a case change, and a subscript read to its
+matching `]` with any text after it (`${HOME[x[0]]}`, `${HOME[0]]}`, which the
+bash 3.2 of macOS prints as the value); and an alternative, which prints its
+word or nothing, reads as that word as written (`${X:+$HOME}`, `${X:+/}`,
+`${X:+$HOME/*}`), including one the bash 3.2 of macOS reads at the first
+operator after a subscript (`${X[0]]:+$HOME}`). Unquoted, the alternative's
+word is split on whitespace and a substitution in it that prints nothing
+drops out, as bash splits and drops them (`${X:+$HOME }`,
+`${X:+$(true)$HOME}`). A trim that leaves the path above the home
+(`${HOME%/*}`) blocks as the home does. Each target is also compared as a path
+with its redundant separators taken out, since the kernel reads a run of
+slashes as one, a `.` segment as the directory itself and the root as its own
+parent (`//*`, `$HOME//`, `/./*`, `/../*`, `.//*`). A target that begins at
+the root or the home has each `..` folded into the directory before it, as
+the path reads lexically: `/tmp/../*` and `/tmp/x/../..` are the root, and a
+`..` past the home climbs to a directory that holds the home, so `~/..`,
+`~/../*` and `$HOME/../../*` read as the home and `~/../*/*` as `~/*`, while
+`~/../x` stays a sibling. The kernel reads a `..` otherwise only after a
+symlink, and the lexical reading is the one that blocks; a trailing `..` is
+folded too, though rm refuses it.
 
 What an allow still does not see is a hazard that never reaches command position
 at all: a word that is wholly a command substitution or a variable standing
@@ -306,7 +348,15 @@ message or a branch name is spelled every day; a delete target printed whole by
 substitution (`rm -rf $(echo /)`), which is read by its known text because that
 is how an everyday delete names what it removes (`rm -rf $(find . -name
 '*.pyc')`); a target spelled any other way than the words above (`rm -rf
-"$DIR"/*` with `DIR` unset, `rm -rf /?*`); one behind a wrapper flag the per-wrapper
+"$DIR"/*` with `DIR` unset, `rm -rf /?*`), a default's own word, which bash
+prints only when the variable is unset (`rm -rf ${DIR:-$HOME}`, and
+`${X[0]]-$HOME}`, which the bash 3.2 of macOS reads as a default after the
+subscript), a `..` after a symlink, which is read past lexically (a link to
+the root under a named directory), or after a segment holding a variable,
+which is not folded (`/tmp/$X/../../*` is the root with `X` unset), a `..`
+past the home followed by a glob other than `*` (`~/../?*`, as `/?*`), an
+alternative nested more than three deep, and a substring of `$PWD` that
+prints the root (`${PWD:0:1}`), which warns as `$PWD` does; one behind a wrapper flag the per-wrapper
 table does not name; a REST
 path an entry names by its root segment when the host serves that API under a
 prefix; an IFS the shell already holds when the line starts, or gains during the line

.abcd/development/brief/04-surfaces/README.md

@@ -270,8 +270,8 @@ or removed without the same edit here fails the record gate.
 
 **This documentation lives here rather than in `commands/README.md` because the
 loader registers every markdown file under `commands/` as a slash command** — with
-no frontmatter requirement and no name exemption, as `agents/README.md`
-registering as an agent independently shows (iss-110). A readme beside the verbs
+no frontmatter requirement and no name exemption, exactly as the agent loader
+treats `agents/` (iss-110). A readme beside the verbs
 is therefore a spurious `/abcd:README` on every installed surface (iss-160), and
 the only reliable fix is a home outside the auto-discovery root.
 

.abcd/development/brief/05-internals/05-prompt-quality.md

@@ -30,7 +30,7 @@ so the per-file rules do not reach it; this rule walks the tree directly from th
 non-markdown files, and the README and changelog stems. It is configured as a
 blocker, so it runs on every `make record-lint`, every `make preflight` and the CI
 record gate. The operator-facing statement of the same contract is
-[`agents/README.md`](../../../../agents/README.md).
+[`agents/README.md`](../../agents/README.md) in the durable record.
 
 What it enforces on every invocation:
 
@@ -45,7 +45,8 @@ What it enforces on every invocation:
 - On the same prompt: `agents/<name>/fixtures/injection-canary.json`, present, a
   regular file and non-empty. An empty file or a symlink is refused, because a
   canary that asserts nothing reports the contract met without testing it.
-- A `### <agent> <version>` entry in `agents/CHANGELOG.md` for every prompt's
+- A `### <agent> <version>` entry in the prompt-version log,
+  [`agents/CHANGELOG.md`](../../agents/CHANGELOG.md) in the durable record, for every prompt's
   current version. This half needs no git, so a new prompt with no entry and a
   bumped version with no entry both fail.
 
@@ -97,7 +98,7 @@ gated on the research files besides, which do not exist for any shipped agent.
 ## The itd-5 additions
 
 - **`prompt_version` frontmatter (ships).** Every prompt carries a semver, and
-  `agents/CHANGELOG.md` records each bump with a one-line rationale. A new prompt
+  The prompt-version log (`.abcd/development/agents/CHANGELOG.md`) records each bump with a one-line rationale. A new prompt
   normally starts at `0.1.0`; the four review and research prompts enter the
   changelog at `0.2.0` instead, the bump that first gave them the untrusted-input
   contract. Bump rules, semver-adapted: MAJOR for a behaviour-breaking output