docs/architecture.md is 62 commits stale and now states things that are false

[myselfsiddharth]

Context

docs/architecture.md states its own derivation point: "Derived from code at commit 6ad7151 (main, 2026-07-25)." main is now 62 commits past that. The document is the designated wiring diagram — CONTRIBUTING points new contributors at it and it is the only doc that owns the chain — so its staleness is load-bearing in a way a stale spec is not.

These are not judgement calls about emphasis. Each item below is a statement the document makes that is now false against the code, verified by grep at c3bbe6c.

What is wrong, specifically

Claim in the doc	Reality at c3bbe6c
src/session/ — "Not a pipeline stage, and has no callers"	It has four. src/recorder/preamble.ts:67 and src/recorder/cli.ts:25 import SessionAuthorization, as do experiments/gate-v1/live-run.ts:28 and fresh-baseline.ts:57. It is now on the critical path of every session establishment
Break 1 — "Nothing outside src/cache/ and tests/ imports the cache package"	experiments/gate-v1/run-matrix.ts:31-32 imports JsonlCacheStore and resolveProgram. The read half is wired (#118); the write half still is not (filed separately)
Stub row 1 — "Repair proposes nothing", issue #27	#27 is closed. AnthropicRepairModelClient exists (src/runner/repair-anthropic.ts, #151). StubRepairModelClient is still the default, which is the accurate and much narrower statement
Stub row 2 — "no costFresh argument anywhere in src/ or experiments/"	gate:matrix --cost-fresh, loadCostFreshBaseline(), and FreshBaselineRunner all landed in #164. Still unmeasured — which is the true part worth keeping — but the mechanism exists
Open questions — "npm run lint:docs does not exist"	It exists, is in package.json, and is a required step of npm run ci. #53 closed
Package table	No row for src/cli.ts — the paragent binary (#155), now the most user-visible entry point in the repo
Header — "Six pipeline packages plus two leaves"	Recount against src/ as it stands
Stub rows citing #25, #52, #62, #66, #67 as open work	All five are closed

What to do

1. Re-derive from main, and stamp the new commit in the same place the current derivation line sits. Read the code; do not patch the table from this issue's list — this issue is evidence that the doc drifted, not a substitute for reading the source.
2. Add the consent gate to the invariants section. establishSession now requires a SessionAuthorization (Design and ship explicit session-automation consent language (PRD §7) #102, ADR-0018) so there is no path into the login flow that skips the consent check. That is exactly what the "Invariants that must not break" section catalogs — an enforced-by-construction guarantee with a private constructor behind it — and it is currently absent. It has already caught one real regression: feat(runner): ship the fresh-baseline measurement harness (#39) #164 added a third call site and the type system failed the build.
3. Redraw the diagram for the edges that changed: recorder → session, run-matrix → cache (read), the gate:baseline entry point, and src/cli.ts as a public surface.
4. Keep the two-breaks framing, but restate break 1 accurately — the read hop landed, the write hop did not.
5. Do not soften the honest parts. The document's value is that it says plainly what is stubbed. Every "still not a measurement" caveat is still true and must survive the refresh: no gate number exists, cost_fresh is zeros, cache hit-rate has no denominator.

Constraints

• Every claim re-verified against the code, not against a sibling doc — that is the standard the document sets for itself in its own opening.
• Where a sibling doc disagrees with the code, record the disagreement in Open questions rather than resolving it inline. The existing entries about DEVELOPMENT.md and contracts/README.md should be re-checked and kept or retired on evidence.
• CONTRIBUTING rule 3: no invented numbers. The line counts are wc -l; redo them or drop them.

How to test

npm run lint:docs
npm run ci

Then spot-check the falsifiable claims rather than trusting the prose — for each "not wired" statement, run the grep that would disprove it:

grep -rn "from \"../session/" --include="*.ts" src/
grep -rn "writeCacheRow" --include="*.ts" src/ experiments/ | grep -v "^src/cache/"

Before you open the PR

• Derivation commit updated to the commit actually read
• Every row in the table above corrected
• src/cli.ts has a package-table row
• Consent gate added to the invariants section
• Diagram redrawn for the changed edges
• Closed issues no longer cited as open work
• Every honest "not measured / not wired" caveat preserved
• Open questions re-checked, entries retired only on evidence