chore: ratify shipped logic ceiling [BEAR-111]

.github/workflows/ci.yml

@@ -26,8 +26,8 @@ jobs:
           go_lines=$(printf '%s\n' "$production" | xargs wc -l | awk 'END { print $1 }')
           shell_lines=$(wc -l < install.sh | tr -d ' ')
           lines=$((go_lines + shell_lines))
-          echo "shipped logic lines: $lines (1,000 target; 1,500 absolute ceiling)"
-          test "$lines" -le 1500
+          echo "shipped logic lines: $lines (1,500 target; 2,000 absolute ceiling)"
+          test "$lines" -le 2000
       - run: go test ./...
       - run: go vet ./...
       - name: Validate experiment registry

.github/workflows/release.yml

@@ -65,8 +65,8 @@ jobs:
           go_lines=$(printf '%s\n' "$production" | xargs wc -l | awk 'END { print $1 }')
           shell_lines=$(wc -l < install.sh | tr -d ' ')
           lines=$((go_lines + shell_lines))
-          echo "shipped logic lines: $lines (1,000 target; 1,500 absolute ceiling)"
-          test "$lines" -le 1500
+          echo "shipped logic lines: $lines (1,500 target; 2,000 absolute ceiling)"
+          test "$lines" -le 2000
       - run: go test ./...
       - run: go vet ./...
       - name: Validate experiment registry

CLAUDE.md

@@ -8,7 +8,7 @@ ThreadBear is a playful, token-conscious Codex title manager for macOS: one smal
 - Before title-path architecture or live experiments, run `python3 scripts/validate-experiments.py`, consult `docs/experiments/registry.json`, and satisfy the preflight in `docs/experiments/README.md`. Contradictory records remain conditional until one changed variable is isolated. Automation proves mechanical integrity; the active issue and pull-request review judge whether the unknown and changed variable are meaningful.
 - Private eval corpus: `ericlitman/threadbear-eval` (real user messages — must never enter this public tree).
 - Voice: playful, bear-themed, never at the expense of operational clarity.
-- Shipped-logic target is 1,000 physical lines and CI rejects more than the 1,500-line absolute ceiling; stay as small as the product permits without compressing code to game the count.
+- Shipped-logic target is 1,500 physical lines and CI rejects more than the 2,000-line absolute ceiling; stay as small as the product permits without compressing code to game the count. Size-policy changes require a live issue to record the measured baseline and ratify the new bounds before implementation.
 - The only scheduler is the consented `threadbear-maintenance` Codex heartbeat attached to the persistent task. Do not add a LaunchAgent, second schedule, pending-title queue, detached title writer, or background classifier.
 - Changelog: every PR with user-visible changes must append a concise entry under `CHANGELOG.md`'s `Unreleased` section. Release preparation renames that section to `vN.N.N - YYYY-MM-DD` and adds a fresh `Unreleased` section; the release workflow rejects stable tags without the matching version section.
 - Shipping evidence: unit and fixture tests are necessary but never sufficient. Before calling a native lifecycle or release path shippable, exercise the reviewed candidate end to end against the real supported native control or official release service in an isolated, recoverable canary, record exact candidate/ref/results, and clean up the canary without visual inspection.

INSTALL.md

@@ -187,6 +187,6 @@ Uninstall refuses while `phase:migration_running` or a native archive operation
 
 ## Maintainer verification
 
-A release is ready only after unit and integration tests, the 1,500-line absolute shipped-logic gate, isolated install/reinstall/uninstall tests, 0-/1-/200-task controller fixtures, and controller resume, interruption, and failure cases.
+A release is ready only after unit and integration tests, the 1,500-line shipped-logic target and 2,000-line absolute gate, isolated install/reinstall/uninstall tests, 0-/1-/200-task controller fixtures, and controller resume, interruption, and failure cases.
 
 Tests and fixtures alone are not shipping proof. Also execute every lifecycle command printed here against the reviewed release candidate and exercise each changed native lifecycle against a real, recoverable Codex test task through the supported native control. Exercise changed download/update behavior against the official release service in an isolated installation. Record exact candidate SHA, task/release IDs, before/after state, results, and cleanup without visual inspection. Confirm that `INSTALL.md` and `site/install` are byte-identical and that the hosted `threadbear.sh/install` serves the reviewed guide before announcing publication.

cmd/threadbear/site_contract_test.go

@@ -263,8 +263,8 @@ func TestShippedLogicStaysBelowAbsoluteLineCeiling(t *testing.T) {
 			count++
 		}
 	}
-	t.Logf("shipped executable logic: %d lines (target 1000, absolute ceiling 1500)", count)
-	if count > 1500 {
-		t.Fatalf("shipped executable logic is %d lines; absolute ceiling is 1500", count)
+	t.Logf("shipped executable logic: %d lines (target 1500, absolute ceiling 2000)", count)
+	if count > 2000 {
+		t.Fatalf("shipped executable logic is %d lines; absolute ceiling is 2000", count)
 	}
 }

docs/release-checklist.md

@@ -4,7 +4,7 @@ Before tagging a stable release:
 
 1. Run `python3 scripts/validate-experiments.py`. For every load-bearing title mechanism claimed by the release, cite its `TB-CAP-*` record and supporting `TB-EXP-*` evidence in the implementing issue and pull request. When the release depends on a new probe, also cite its closed `TB-PRE-*` record and bidirectionally linked result experiment. Do not release an unresolved capability or present contradictory evidence as a global conclusion. Review must judge the declared unknown and changed variable; validator success is not semantic approval.
 2. Rename `Unreleased` to `vN.N.N - YYYY-MM-DD` and add a fresh `Unreleased` section.
-3. Run `gofmt`, `go test ./...`, `go vet ./...`, both Darwin cross-builds, shell syntax checks, and installer/guide parity checks. Count tracked non-test Go plus shipped bootstrap shell, report the 1,000-line target comparison, and fail the release above the 1,500-line absolute ceiling.
+3. Run `gofmt`, `go test ./...`, `go vet ./...`, both Darwin cross-builds, shell syntax checks, and installer/guide parity checks. Count tracked non-test Go plus shipped bootstrap shell, report the 1,500-line target comparison, and fail the release above the 2,000-line absolute ceiling.
 4. In isolated homes, prove install, reinstall, status, inventory, and both uninstall title choices while preserving unrelated AGENTS content and hook definitions in order.
 5. Exercise 0-, 1-, and 200-task controller migrations. Prove deterministic exact-footer classification, adaptive ambiguity-only Luna waves, retention of successful workers after a later capacity error, bounded worker timeout, out-of-order result accounting, serial explicit native writes, concurrent rename/archive handling, interruption, same-controller resume, clean rerun, and final zero-remaining convergence.
 6. Install with `threadbear install --debug-canaries`, then run the exact-candidate release matrix in `docs/live-eval.md` from fresh Codex Desktop tasks. Verify the rendered active header and sidebar, capture privacy-safe screenshots outside the public repository, and restore controlled canary titles through the supported native path.

site/install

@@ -187,6 +187,6 @@ Uninstall refuses while `phase:migration_running` or a native archive operation
 
 ## Maintainer verification
 
-A release is ready only after unit and integration tests, the 1,500-line absolute shipped-logic gate, isolated install/reinstall/uninstall tests, 0-/1-/200-task controller fixtures, and controller resume, interruption, and failure cases.
+A release is ready only after unit and integration tests, the 1,500-line shipped-logic target and 2,000-line absolute gate, isolated install/reinstall/uninstall tests, 0-/1-/200-task controller fixtures, and controller resume, interruption, and failure cases.
 
 Tests and fixtures alone are not shipping proof. Also execute every lifecycle command printed here against the reviewed release candidate and exercise each changed native lifecycle against a real, recoverable Codex test task through the supported native control. Exercise changed download/update behavior against the official release service in an isolated installation. Record exact candidate SHA, task/release IDs, before/after state, results, and cleanup without visual inspection. Confirm that `INSTALL.md` and `site/install` are byte-identical and that the hosted `threadbear.sh/install` serves the reviewed guide before announcing publication.