fix(delivery): eliminate the fresh-mode eager-bundling regression (#323 T1/T2/T4)

[m2ux]

Closes the T1/T2/T4 half of #323 — the fresh-mode eager-bundling regression diagnosed in #322 — and unsticks the corpus-coupled tests that were red before it.

T3 is deliberately not here. It needs a design decision recorded as an ADR, and its acceptance criterion requires relaxing workers-need-full-delivery, which lives in the workflows corpus — so unlike T1/T2/T4 it is not a server-only change. #323 sequences it as a separate PR, and it is where the remaining ≈96k tokens/walk live.

T1 — gate the resources map on referenceMode

The collapse check was referenceMode && (deliveredHash(…) === hash || …), so under full delivery it could never fire: every linked resource body shipped in full, in every activity that linked it, with no later delivery to collapse against.

Under full delivery the map is no longer built. The linked ids go out as resource_refs instead, so the worker still learns exactly what to fetch (exact resource_id, #section included). No resource:<id> ledger key is written — those were written and never read — and no resource_fetched { bundled: true } history event claims a delivery that never happened.

T2 — bring resource bodies inside the eager budget

The technique loop honoured eagerBudgetChars; the resource loop had only a per-resource 80,000-char skip, no cumulative cap and no draw-down. An activity linking twenty 5KB resources inlined 100KB unbounded, so context_tokens did not bound the response — the stated purpose of the budget policy in src/config.ts.

Resource bodies now draw down the same spentChars counter as technique bodies, with the technique loop's stop-and-break semantics. Overflowed and oversized ids join resource_refs, so nothing linked becomes unreachable. Unchanged-reference markers stay free and never displace a body that still needs sending.

T4 — a fresh-mode arm on the ship gate

The July gate compared A0 (fresh, pre-change) against A3 (persistent, post-change), conflating a mode switch with a code change — its own ablation attributed −40.2% to the mode switch alone, and a +24.5% regression on the only mode production uses was invisible to it.

The A0 fixture now records its contextMode and corpus revision. A cross-mode comparison still reports but is banner-warned and can never pass --gate (verified: exit 3 even at --max-regression-pct=99). --gate [--max-regression-pct=N] exits 3 on a total-delivery-char regression; a corpus mismatch against the fixture's workflowsRev is warned in the scorecard.

Measurements

Corpus pinned at a1409d5b, context_mode: fresh, A0 = 1,355,532 chars:

	get_activity	total delivery
A0 reference	687,936	1,355,532
before	856,425 (+24.5%)	1,467,485 (+8.3%)
after	692,377 (+0.6%)	1,359,973 (+0.3%)

#323's falsifier — "if fresh-mode total is not within ~1% of 1,355,532, the attribution in #322 is wrong" — does not fire. The residual ≈4.4k on get_activity is 12 calls × the resource_refs list plus the reworded notes.

Persistent mode is preserved: get_resource chars (73,683), resource:* ledger keys (38) and unchanged-resource answers (63) are all identical; get_activity moves only by the note rewording (516,898 → 516,091).

Test fixes (second commit)

Twelve tests asserted on corpus content that has since moved. Each is fixed at the assertion, not loosened.

• mcp-server (4) — three fetched meta/activity-worker-prompt, deleted from the corpus → meta/bootstrap-protocol. The condition_not_met rejection test yielded analysis-confirmed, which no longer exists, so yield_checkpoint errored before the assertion → validate::local-validation-permission, verified unconditional (the rejection path needs a checkpoint declaring no condition; the sibling test's issue-verification is conditional and could not be reused).
• reference-delivery (3) — the mutation test anchored on the variable-binding capability's wording; it now anchors on the ## Capability heading, which is structural. The other two expected an activity_rules block on work-package, which declares only orchestrator-scoped rules.workflow and carries none: the shape test now asserts its absence, and the collapse behaviour moved to a new test against requirements-refinement, which declares both rules.activity and rules.universal. The ledger-key-shape test moved to the same workflow so one walk exercises all three key shapes, activity_rules:* included.
• fragment-resolver (2) — proved materialization by a transcribed sentence from the fragment body; it now reads the declared body out of workflow.yaml and asserts the loader inlined that, so it proves materialization without re-encoding corpus prose.
• e2e snapshots (6) — regenerated. The committed baselines predate several corpus releases (the analyse-challenge refactor, portfolio-lens removal, model-switch checkpoint removal). Regenerated against the corpus revision this repo records as its submodule pointer, and verified byte-identical against a pristine checkout of that pointer.

Known-failing until the corpus PR lands

Three corpus guard tests (fragments-guard, identifier-qualification, resource-anchors) fail here. They were already red on main — this PR takes the suite from 18 failures to 3 — and the defects are in the corpus, not the server. The companion corpus PR fixes all three. The submodule pointer is deliberately left untouched here so this PR does not smuggle in 23 commits of unrelated corpus evolution; bump it once the corpus PR merges and the suite is fully green.

Docs

docs/resource_resolution_model.md §12 is the authoritative home for the delivery contract and states the two shapes and the budget; docs/development.md documents --gate and, explicitly, that a persistent-only comparison is not a valid ship gate.

Refs #322, #323

🤖 Generated with Claude Code

[m2ux]

Companion corpus PR: #325 — it fixes the three corpus guard defects that leave fragments-guard, identifier-qualification and resource-anchors red here (all three were already red on main; this PR takes the suite from 18 failures to 3).

Merge #325 first, then bump the workflows submodule pointer on this branch for a fully green suite.