Live-tree restructure reference, four-column effects index, sensitivity-shelf template (field-tested)

README.md

@@ -34,10 +34,12 @@ icm-architect/
 ├─ references/
 │  ├─ core.md                 five principles, five-layer hierarchy, naming, token discipline
 │  ├─ forms.md                the six forms in depth: skeletons, moves, failure modes
-│  ├─ system-map.md           audit pipeline for the System map form
-│  └─ reference-integrity.md  restructure move-safety gate
+│  ├─ system-map.md              audit pipeline for the System map form
+│  ├─ reference-integrity.md     restructure move-safety gate
+│  └─ live-tree-restructure.md   restructuring a tree that is already in use
 └─ assets/templates/     copyable starters: CLAUDE.md, CONTEXT.md, stage contract,
-                         node card, object/process cards, schema, questionnaire
+                         node card, object/process cards, schema, questionnaire,
+                         effects index, private shelf
 ```
 
 MIT licensed, like the protocol it serves.

SKILL.md

@@ -76,11 +76,11 @@ Real workspaces mix forms (a record library whose records are mini knowledge bun
 - **Product** — run-specific artifacts (→ stage `output/` or record folders)
 - **Dead** — stale, duplicated, or superseded (→ propose `_archive/`, never silently delete). A file is Dead only after step 4 confirms nothing depends on it — apparent disuse is not proof.
 
-**4. Verify reference integrity — before proposing.** Apparent disuse is not proof of safety. Before any file is proposed for a move — especially a `Dead → _archive/` move — enumerate what points at it: in-vault, sibling-path (`../`), symlink, and outside this workspace (other repos, configs, scheduled jobs that hardcode a path in). External consumers are a question for the human gate, not an unbounded grep. A file with a live referrer is held, or moved only if every referrer is updated in the same change. See [references/reference-integrity.md](references/reference-integrity.md).
+**4. Verify reference integrity — before proposing.** Apparent disuse is not proof of safety. Before any file is proposed for a move — especially a `Dead → _archive/` move — enumerate what points at it: in-vault, sibling-path (`../`), symlink, and outside this workspace (other repos, configs, scheduled jobs that hardcode a path in). External consumers are a question for the human gate, not an unbounded grep. A file with a live referrer is held, or moved only if every referrer is updated in the same change. See [references/reference-integrity.md](references/reference-integrity.md). If the tree is LIVE — sessions have directories in it open, daemons and scheduled jobs read paths inside it, other repos hardcode paths into it — read [references/live-tree-restructure.md](references/live-tree-restructure.md) first; the census it describes is what turns "what points at this file" from a grep into an answer.
 
 **5. Propose before moving.** Present the target tree and a migration map (old path → new path → role → referrers found). Get approval. This is a human gate in a method built on human gates — honor it. The reviewer approves against the reference report from step 4, not against a hunch.
 
-**6. Migrate — copy, verify, then remove.** Never move-and-hope. Before any copy or rename, check whether the destination already exists **case-folded** — on Windows and macOS, `CLAUDE.md` → `CONTEXT.md` silently overwrites an existing `context.md`, and a file-inventory map will not show the collision. Surface every hit at the approval gate. Then copy to the new home, verify parity (file count and content hash) against the source, and only then remove the original. Write the entry file and contracts, de-duplicate toward one-home-per-fact (leave a link where the copy lived if anything referenced it). Separate method from instance: if the structure will be reused elsewhere, the blank template lives apart from this filled-in deployment.
+**6. Migrate — copy, verify, then remove.** Never move-and-hope. Before any copy or rename, check whether the destination already exists **case-folded** — on Windows and macOS, `CLAUDE.md` → `CONTEXT.md` silently overwrites an existing `context.md`, and a file-inventory map will not show the collision. Surface every hit at the approval gate. Then copy to the new home, verify parity (file count and content hash) against the source, and only then remove the original. Write the entry file and contracts, de-duplicate toward one-home-per-fact (leave a link where the copy lived if anything referenced it). Separate method from instance: if the structure will be reused elsewhere, the blank template lives apart from this filled-in deployment. On a live tree, every move goes through one guarded primitive that halts rather than guess, one manifest row per move, and a redirects index generated from the manifests — see [references/live-tree-restructure.md](references/live-tree-restructure.md).
 
 **7. Validate with the walk test.**
 
@@ -111,4 +111,5 @@ If a step fails, fix the structure — not by explaining more, but by moving or
 - [references/forms.md](references/forms.md) — the six forms in depth: skeletons, moves, failure modes. Read at step 2 of Build mode or step 2 of Restructure mode.
 - [references/system-map.md](references/system-map.md) — audit pipeline for the System map form. Read when that form is chosen.
 - [references/reference-integrity.md](references/reference-integrity.md) — the move-safety gate: what points at a file, case-folded destinations, copy-verify-remove. Read at step 4 of Restructure mode, or any time a move is contested.
-- [assets/templates/](assets/templates/) — copyable starters: `CLAUDE.md`, workspace `CONTEXT.md`, `stage-CONTEXT.md`, `node.md`, `object.md`, `process.md`, `schema.md`, `questionnaire.md`.
+- [references/live-tree-restructure.md](references/live-tree-restructure.md) — restructuring a tree that is in use: census, the consumers register, one guarded move primitive, the gates, shared-repo hygiene, and the drift report that catches the decay. Read at step 4 of Restructure mode whenever anything but a human reads a path in the tree.
+- [assets/templates/](assets/templates/) — copyable starters: `CLAUDE.md`, workspace `CONTEXT.md`, `stage-CONTEXT.md`, `node.md`, `object.md`, `process.md`, `schema.md`, `questionnaire.md`, `effects-CONTEXT.md` (a System map's change-impact index), `private-shelf-CONTEXT.md` (a sensitivity shelf).

assets/templates/effects-CONTEXT.md

@@ -0,0 +1,35 @@
+<!-- TEMPLATE for <repo>/map/effects/CONTEXT.md — the change-impact index. This is a
+     CATALOG of which cards to open, NOT a second copy of their waterfalls. Never create it
+     empty. Placeholders: {REPO}. Delete this comment when you fill it in. -->
+# If you are changing X, open these
+
+This is an index, not an analysis. It answers "where do I start reading" in one line
+and then gets out of the way — the actual Hits / Does not hit lives on the card, and
+the exhaustive fan-in lives in `../graph/<path>.md`. **If this file and a card
+disagree, the CARD is authoritative and this file is the bug.**
+
+Entries are phrased as the change an editor is about to make, in their words.
+
+| if you are changing… | open these cards first | and this graph node | does not hit (first-order) |
+|---|---|---|---|
+| {a concrete change, e.g. "the format of a location id"} | `../objects/{cluster}/{noun}.md`, then `../objects/{cluster}/{neighbour}.md` | {the graph node for fan-in, a pinned golden test, a mirrored grammar in another module} | {the obvious wrong next noun — one clause, a pointer, never a waterfall} |
+| {a table's columns} | `../objects/{cluster}/{table}.md` | {every writer named under Surfaces; whether another repo owns the object} | {a look-alike table or view this change does NOT reach} |
+| {a shared registry or contract} | `../objects/{cluster}/{registry}.md` | {the test that fails on an unregistered entry} | {a neighbouring registry this one is never cross-wired to} |
+
+The last column names the obvious wrong next noun — one clause, a pointer, never a
+waterfall.
+
+## What belongs here
+
+- A change that reaches further than the file you are editing. That is the whole bar.
+- Changes that LOOK local and are not: a shared grammar mirrored in two modules, a
+  registry with a completeness test, a column two repos read, a value that must stay
+  byte-identical on both sides of an index or a cache key.
+
+## What does not
+
+- Anything the graph already answers mechanically ("who imports this file").
+- A waterfall copied off a card. Link the card.
+- A change that touches one file and nothing else.
+
+Last updated: YYYY-MM-DD HH:MM TZ

assets/templates/private-shelf-CONTEXT.md

@@ -0,0 +1,23 @@
+# _private — the sensitivity shelf
+
+Last updated: YYYY-MM-DD HH:MM TZ   ·   mode 700   ·   owner: the human only
+
+## The load rule (binding on every agent and every account that can reach this tree)
+1. Nothing under this shelf is loaded unless the current task names the file.
+2. **Tier 0 files are never opened by an agent.** Report path and kind only. Rotation, pasting, and copying of a credential are human acts.
+3. Tier 1 and Tier 2 files may be read only when the task requires their content, and their content is never quoted outward — not into Slack, a PR, a commit message, a doc, an artifact, a memory file, or a transcript summary. Report aggregates, never rows.
+4. Never infer from this shelf. A fact learned here is not carried into another context unless the owner says so.
+5. Nothing here is deleted by an agent. Superseded items stay; the owner deletes.
+
+## Tiers
+| Tier | Folder | Holds |
+|---|---|---|
+| T0 | `credentials/` | env files, token snapshots, gate credentials, `.bak` copies of credential files |
+| T1 | `people/` | PINs, HR rosters, onboarding drafts that carried credentials |
+| T2 | `financial/` | raw customer/financial exports (accounting-system extracts, invoices, sales YTD) |
+
+## Credential register — stores that stay in place (path · kind · owner tool)
+Agents may `ls -la` these to confirm existence; never `cat`.
+| Path | Kind | Owner tool |
+|---|---|---|
+| <path> | <kind> | <owner tool> |