Three gates for what a session actually costs, all three configurable

.perry/config.md

@@ -14,32 +14,3 @@
 |---|---|---|---|---|---|---|---|
 | main | project | phase/ | — | — | — | — | V3 |
 | intake | queue | standing | new→triaged→in_progress→resolved | 6 | 5d | weekly | V3 |
-
-`intake` carries the work that ARRIVES — a defect an agent found mid-run, a
-sibling a sweep turned up, a review finding. It is not decomposed from a goal,
-it shows up, and its useful questions are queue questions: what has been
-waiting longest, how deep is the backlog, what keeps recurring.
-
-`main` carries the work that is DECOMPOSED — the phase, its KRs, the rows that
-serve them.
-
-Declared 2026-08-20 as the experiment in TASK-133. `Default rung` is V3 rather
-than queue mode's V2 default: an arriving row here is a code defect, and a
-resolution note is not evidence that it is fixed.
-
-## Why the state root is not `.`
-
-Perry's own `design/` directory is the **design lane skill**
-(`decide/SKILL.md`, `decide/state/design_TEMPLATE.md`), not a folder of design
-documents. Pointing the state root at the project root would make Perry claim
-its own source tree, and every lint run would report `decide/SKILL.md` as a
-malformed design doc.
-
-`okr/` and `pmo/` are lane skills for the same reason. `.perry/` stays at the
-project root: it holds this pointer, so it cannot sit behind it.
-
-This is the collision described in `perry/design/DESIGN-002-namespace-collision.md`
-— Perry is its own proof case, and this file is the escape hatch that document
-argues should be offered automatically rather than written by hand.
-
-See `schema/README.md § Where the files are`.

.perry/hook.md

@@ -73,3 +73,45 @@ be automated (TASK-015, TASK-018, TASK-024, TASK-026) already carry
 `Dispatch mode: manual` in their specs, which is the gate that actually holds —
 listing them here too would create a second copy to keep in sync, and Perry's
 own rule is one fact, one place.
+
+## Configuration notes
+
+> **Moved here from `.perry/config.md` on 2026-08-30 (TASK-233), verbatim.**
+> That file is a projection of `.perry/config.jsonl` now: `perry-config render`
+> rebuilds it from the store with no copy of it on disk, and what a store holds
+> is settings and track rows — never prose. Prose in the projection survives a
+> render only while a file is there to copy it out of, which is a guarantee
+> that ends the first time the file is deleted or a project is cloned without
+> it. This file is not rendered from anything, so it cannot lose them.
+> `reference/config.md § Prose in this file is layout` is the general rule.
+
+### What the two tracks carry
+
+`intake` carries the work that ARRIVES — a defect an agent found mid-run, a
+sibling a sweep turned up, a review finding. It is not decomposed from a goal,
+it shows up, and its useful questions are queue questions: what has been
+waiting longest, how deep is the backlog, what keeps recurring.
+
+`main` carries the work that is DECOMPOSED — the phase, its KRs, the rows that
+serve them.
+
+Declared 2026-08-20 as the experiment in TASK-133. `Default rung` is V3 rather
+than queue mode's V2 default: an arriving row here is a code defect, and a
+resolution note is not evidence that it is fixed.
+
+### Why the state root is not `.`
+
+Perry's own `design/` directory is the **design lane skill**
+(`decide/SKILL.md`, `decide/state/design_TEMPLATE.md`), not a folder of design
+documents. Pointing the state root at the project root would make Perry claim
+its own source tree, and every lint run would report `decide/SKILL.md` as a
+malformed design doc.
+
+`okr/` and `pmo/` are lane skills for the same reason. `.perry/` stays at the
+project root: it holds this pointer, so it cannot sit behind it.
+
+This is the collision described in `perry/design/DESIGN-002-namespace-collision.md`
+— Perry is its own proof case, and this file is the escape hatch that document
+argues should be offered automatically rather than written by hand.
+
+See `schema/README.md § Where the files are`.

AGENTS.md

@@ -54,6 +54,7 @@ the live project state is rooted at `perry/` through `.perry/config.md`.
 - Follow `work/reference/git-boundaries.md` for commit, push, PR, and merge
   authority. Never merge your own implementation.
 - Green on your own base is not green merged — `tests/merge-check --help`.
+- Calling a tool costs more than its output (52% of context vs 26%): cwd persists, so no `cd <repo> &&`; a long or repeated step goes in a scratchpad file, not the prompt. `perry-context-budget`.
 
 Keep this file under roughly 60 lines. It is the always-loaded startup protocol,
 not a second copy of `SKILL.md`, the dashboard, or the architecture record.

README.md

@@ -87,7 +87,7 @@ Don't start from a blank page — Perry can read what's already there:
 
 It reads your README, roadmap, git history, existing design notes, TODOs and issues, then **proposes** goals, tasks and decisions. Nothing is written until you say yes.
 
-**Adoption is a migration, and it is meant to happen once.** Perry used to adapt at runtime to whatever shape your files were already in, and that tolerance is where its bugs lived — two branches guessing differently about the same table and quietly losing a row between them. So it was traded away on purpose ([ADR-004](perry/decisions/ADR-004-mandatory-migration.md)). The rule now: **a project migrates to Perry's structure in order to use Perry's write features, and a project that will not migrate stays readable rather than drivable.**
+**Adoption writes Perry's own state, once.** Perry used to adapt at runtime to whatever shape your files were already in, and that tolerance is where its bugs lived — two branches guessing differently about the same table and quietly losing a row between them. So it was traded away on purpose ([ADR-004](perry/decisions/ADR-004-mandatory-migration.md)). The rule now: **`/perry adopt` reads what you already have as evidence and writes Perry's structure from it; it never rewrites your files in place.** ADR-004 also made every writer refuse a file nobody had declared conformant. That gate is deleted (`TASK-261`) — in 23 declarations it never once disagreed with the live check, so nothing now refuses a write for want of a declaration.
 
 Readable is not the consolation prize. `/perry diagnose` runs on any folder at all, and reading an unmigrated project is exactly how you decide whether to migrate it. And the migration owes you four things: the complete diff before anything is written, no lost rows or IDs, a restore point, and no step you did not ask for.
 
@@ -242,7 +242,6 @@ your-project/
 │   ├── phase/              the current stretch of work + saved snapshots
 │   ├── BOARD.md            open tasks, right now
 │   ├── journal/            what happened each day
-│   ├── DECISIONS.md        index of decisions
 │   ├── decisions/          one file per decision, with the reasoning
 │   ├── design/             design docs / RFCs
 │   ├── evidence/           proof that tasks were finished
@@ -317,7 +316,7 @@ Any language works for prose. Details, and how to switch later: [reference/i18n.
 
 **Can I use it for non-code projects?** Yes — research, writing, ops, business planning. Those are not a bolt-on: they are the [four modes](#four-kinds-of-work), each with its own horizon, throttle and triage. `/perry diagnose` recognises them from what's on your board.
 
-**Can Perry drive the board I already have?** Only after `/perry adopt` migrates it. Perry stopped bending at runtime to arbitrary file shapes ([ADR-004](perry/decisions/ADR-004-mandatory-migration.md)) — that flexibility was where its data-losing bugs came from. An unmigrated project stays readable and diagnosable; it is just not driven.
+**Can Perry drive the board I already have?** Not in place. `/perry adopt` reads it as evidence and writes Perry's own state alongside; Perry then drives that. Perry stopped bending at runtime to arbitrary file shapes ([ADR-004](perry/decisions/ADR-004-mandatory-migration.md)) — that flexibility was where its data-losing bugs came from. A project Perry has not adopted stays readable and diagnosable; it is just not driven.
 
 **What if my project already has a `design/` folder?** Nothing collides — Perry's own files live under `perry/` by default, so your `design/` stays yours. Setup checks for the collision before it writes anything, and only asks if you tell it to use the project root instead.
 

README_cn.md

@@ -89,7 +89,7 @@ git clone https://github.com/ranjiao/Perry.git ~/perry && ~/perry/setup
 
 它会读你的 README、路线图、git 历史、已有的设计笔记、TODO 和 issue，然后**提议**目标、任务和决策。你不点头，它什么都不写。
 
-**adopt 是一次迁移，只做一次。** 以前 Perry 会在运行时迁就你原有的文件格式。它的 bug 大多出在这里：两处代码对同一张表的读法不一致，中间悄悄丢掉一行。所以这份灵活性被有意放弃了，理由记在 [ADR-004](perry/decisions/ADR-004-mandatory-migration.md)。现在的规矩是：**要用 Perry 的写入能力，项目就得先迁到 Perry 的结构；不迁的项目仍然可读，但 Perry 不会去驱动它。**
+**adopt 写出 Perry 自己的状态，只做一次。** 以前 Perry 会在运行时迁就你原有的文件格式。它的 bug 大多出在这里：两处代码对同一张表的读法不一致，中间悄悄丢掉一行。所以这份灵活性被有意放弃了，理由记在 [ADR-004](perry/decisions/ADR-004-mandatory-migration.md)。现在的规矩是：**`/perry adopt` 把你已有的东西当证据读，据此写出 Perry 的结构；它不会就地改写你的文件。** ADR-004 当初还让每个写工具拒绝未被声明合规的文件，那道门禁已经删除（`TASK-261`）—— 23 次声明里它一次都没和实时检查产生过分歧，现在没有任何写入会因为缺一份声明被拒。
 
 「可读」不是安慰奖。`/perry diagnose` 在任何目录上都能跑，而读一个没迁移的项目，恰恰是你判断该不该迁的依据。迁移本身欠你四件事：动手之前先给出完整 diff、不丢任何一行和任何一个 ID、留一个可回退的还原点、以及绝不做你没让它做的事。
 
@@ -244,7 +244,6 @@ your-project/
 │   ├── phase/              当前阶段 + 历史快照
 │   ├── BOARD.md            此刻的开放任务
 │   ├── journal/            每天发生了什么
-│   ├── DECISIONS.md        决策索引
 │   ├── decisions/          一个决策一个文件，含推理过程
 │   ├── design/             设计文档 / RFC
 │   ├── evidence/           任务做完的凭据
@@ -319,7 +318,7 @@ Perry 本身是英文写的，你的项目不必是。首次配置时它会记
 
 **能用在非代码项目上吗？** 能 —— 研究、写作、运维、业务规划都行。这不是外挂上去的：它们就是[四种 mode](#四种工作形态)，各有各的收尾条件、节奏控制和 triage 问法。`/perry diagnose` 会从你板子上的样子把它们认出来。
 
-**Perry 能直接驱动我现有的板子吗？** 得先用 `/perry adopt` 迁一次。Perry 已经不再在运行时迁就任意文件格式了（[ADR-004](perry/decisions/ADR-004-mandatory-migration.md)）—— 那份灵活性正是它丢数据的那类 bug 的来源。没迁的项目仍然可读、可以 diagnose，只是不被驱动。
+**Perry 能直接驱动我现有的板子吗？** 不是就地驱动。`/perry adopt` 把它当证据读，在旁边写出 Perry 自己的状态，之后 Perry 驱动的是后者。Perry 已经不再在运行时迁就任意文件格式了（[ADR-004](perry/decisions/ADR-004-mandatory-migration.md)）—— 那份灵活性正是它丢数据的那类 bug 的来源。没被 adopt 过的项目仍然可读、可以 diagnose，只是不被驱动。
 
 **我的项目已经有** **`design/`** **目录了怎么办？** 不会撞上 —— Perry 自己的文件默认就在 `perry/` 下面，你的 `design/` 还是你的。setup 在写任何东西之前先查一遍冲突，只有你坚持要用项目根目录时它才会问。
 

SKILL.md

@@ -70,11 +70,11 @@ The table is that sentence applied to a file list. It is a **file-ownership** co
 |---|---|---|
 | **`goals`** (`goals/`) | `OKR.md` — **including `## Commitments`** — and `phase/<NNN>-<slug>.md` | weekly tasks, handed to `work` |
 | **`work`** (`work/`) | `BOARD.md` (incl. `## Intake`, `## Cadence`), `journal/`, `PROJECT_STATE.md`, `evidence/`, `weekly/`, `handoff/`, **`.perry/agents.jsonl` → `.perry/roles/`** | KR attribution edges, handed to `goals` |
-| **`decide`** (`decide/`) | `design/<DESIGN-ID>-<slug>.md`, **`DECISIONS.md` and `decisions/`** | implementation tasks on lock, handed to `work` |
+| **`decide`** (`decide/`) | `design/<DESIGN-ID>-<slug>.md` and **`decisions/`** | implementation tasks on lock, handed to `work` |
 
-**Two changes from the previous contract** — `DECISIONS.md` + `decisions/` moved from `work` to `decide`, and `OKR.md § Commitments` became explicitly `goals`. **The lane names and the directories now agree**, an edit needing no second signature because the ownership set above is byte-identical across it. Both accounts: `reference/hand-off-contract.md`.
+**Two changes from the previous contract** — `decisions/` + its then-index moved from `work` to `decide`, and `OKR.md § Commitments` became explicitly `goals`. **The lane names and the directories now agree**, an edit needing no second signature because the ownership set above is byte-identical across it. Both accounts: `reference/hand-off-contract.md`.
 
-**What "only writer" forbids.** A lane needing a change in another lane's file **asks in chat and stops** — it does not write and apologise, and not "just this once" because the other lane is not loaded. Three cases that must refuse: `goals` writing `BOARD.md`; `work` writing `DECISIONS.md`; `decide` writing `journal/`.
+**What "only writer" forbids.** A lane needing a change in another lane's file **asks in chat and stops** — it does not write and apologise, and not "just this once" because the other lane is not loaded. Three cases that must refuse: `goals` writing `BOARD.md`; `work` writing `decisions/`; `decide` writing `journal/`.
 
 ## Mandatory first move: combined snapshot
 
@@ -86,7 +86,7 @@ Always run this first. Steps −2 to 3 are ordering-critical; the rest is `refer
 
 0. **Auto-update check**: run `bash "$PERRY_HOME/bin/perry-update-check"`. It is throttled to once per 7 days; surface output verbatim. OpenCode and Codex may run this bounded check synchronously.
 
-1. **Read `.perry/config.md`** for document language, chat language and repo layout. If absent and any state file exists, prompt for first-time setup. **Everything rendered from here uses the chat language**; files use `Document language`. Contract: `reference/i18n.md`.
+1. **Read `.perry/config.jsonl`**, else `.perry/config.md`, for document language, chat language and repo layout. If neither exists and a state file does, prompt for first-time setup. **Everything rendered from here uses the chat language**; files use `Document language`. Contract: `reference/i18n.md`.
 
 2. **Check for an interrupted run, but only after recovery safety — before anything else reads project state.**
 
@@ -192,9 +192,9 @@ Moves every path Perry claims under a new state root and rewrites `State root:`
 
 ## Configuration
 
-`.perry/config.md` is where a project's preferences live; every lane and script reads it. First-time setup creates it. Field **names** stay English in every language, because this file declares the language and must be readable before it is known. An optional `## Tracks` table turns on `pipeline` / `queue` / `inquiry` mode; absent means one implicit `main` track, mode `project`.
+`.perry/config.md` projects `.perry/config.jsonl`; prose belongs in `.perry/hook.md`. First-time setup creates both. Field **names** stay English in every language, because this file declares the language and must be readable before it is known. An optional `## Tracks` table turns on `pipeline` / `queue` / `inquiry` mode; absent means one implicit `main` track, mode `project`.
 
-The field list and the four subjects with consequences worth reading before you change them are `reference/config.md`: **repo layout** (single, or the two-repo PMO ↔ code split), **state root** (`perry` is what setup writes; the *code* fallback is still the project root and must stay that way), **tracks**, and the **conformance gate** (enforces — never run `perry-conform declare` for the user; adoption proposes, the user declares).
+The field list and the three subjects with consequences worth reading before you change them are `reference/config.md`: **repo layout** (single, or the two-repo PMO ↔ code split), **state root** (`perry` is what setup writes; the *code* fallback is still the project root and must stay that way), and **tracks**. The ADR-004 **conformance gate** was a fourth; it is deleted (`TASK-261`) — nothing refuses a write now.
 
 ## Style rules