docs(adr): accept ADR-022, record three decisions (#1756)

[ozand]

Summary

Closes #1756. Flips docs/adr/ADR-022-context-ontology.md from status: proposed to accepted, following the acceptance procedure added under #1712 (docs/adr/README.md, "Acceptance" section, enforced by tests/test_adr_acceptance.py): every Test Contract item now names an existing test that cites ADR-022, and the README index row is updated to match the frontmatter.

What changed in the Status section (current truth, not the issue's snapshot)

• Eleven original follow-ups closed and deployed (release 20260918T002450Z-canonical-023a38f7), as the issue said.
• Three more landed since the issue was written and are now named as closed: Role prompts as files: proposer, curator, reflector, strategist, goal review, narrator, skill-eval load roles/*.md over shared identity and soul #1729 (roles/*.md, merged 824cac9e, deployed in 20260918T162023Z-canonical-824cac9e, health gate CLEAN-EXIT, system_prompt_chars present on post-flip rows), search_memory status contract is stated twice: OPERATING.md Tools section and MemoryStore.MEMORY_SEARCH_POINTER #1745 (search_memory contract duplication, fixed d3dd4aa6), Outcome rows cannot answer 'was this a real failure', so every replay of that class expires with the result artifacts (~29 days) #1748 (real-failure criterion on outcome rows, fixed ada86014).
• Still open, named as such, not claimed done: Gate: the AGENTS.md scope bound locks the repair it demands — make it a ratchet #1750, One rule, one home: dispose the nine procedural AGENTS.md sections against OPERATING.md and the four zero-read skills #1751, Instance AGENTS.md is truncated on 49 of 49 cycles: rewrite it to repository layout in one commit #1752, System prompt budget: raise 24,000 to 35,000 chars, derived from the 98,304-token window, and restore the droppable reserve #1753.

The three decisions (7-9) added to the Decision section

1. Budget unit (decision 7): the budget is stated in tokens (98,304-token serving window) but enforced in characters, because the i386 host has no tokenizer. Cites the eeepc measurement that closed Measure what llama-server does when prompt + max_tokens exceeds n_ctx before sizing the prompt budget #1754: 2,876 executor calls, prompt_tokens max 79,804, completion_tokens capped at exactly 8,192 (client max_tokens), prompt+completion max 83,836 against 98,304 — 14,468 tokens headroom.
2. Scope of "code does not author" (decision 8): verified against nanobot/agent/context.py — ContextBuilder._get_identity(loop_profile=False) (interactive profile) deliberately keeps the original nanobot template as a code literal (role sentence, ## Platform Policy, ## nanobot Guidelines, the closing message-tool line). Rule 2 binds only the loop-profile path. tests/test_ontology_loader.py::test_no_forbidden_loop_prose_in_context_or_subagent_source checks this scoping directly.
3. SOUL.md/USER.md filename collision (decision 9): verified with rg -n "SOUL.md|USER.md" --type py . — nanobot/templates/SOUL.md/USER.md are package-bundled interactive-workspace scaffolding (copied in by sync_workspace_templates only when missing), distinct from the operator-owned release-root SOUL.md/USER.md the loop reads. Decision: keep the collision (renaming is a stated non-goal); the two profiles disambiguate by directory/loader path, not filename. This matches the issue's own description of the collision — no discrepancy found.

Note on #1750

The principle from #1750 ("a bound introduced over existing content ships with either a migration commit or a ratchet clause") is not added by this PR — another agent is working #1750 against this same ADR concurrently (worktree T:/Code/.worktrees/ratchet-1750 already exists). Do not merge this PR in a way that discards that incoming section; it will need a rebase/merge reconciliation with whichever lands second.

Files changed

• docs/adr/ADR-022-context-ontology.md
• docs/adr/README.md

Test plan

Ran the four files the ADR's Test Contract requires, per the acceptance procedure, nothing else:

• tests/test_prompt_ontology.py — pass (40 passed / 1 xfail across the four files combined; the single xfail(strict=True) is test_agents_md_scope_violations_against_real_instance_fixture, expected until Instance AGENTS.md is truncated on 49 of 49 cycles: rewrite it to repository layout in one commit #1752 shrinks the real instance AGENTS.md)
• tests/test_operating_md.py — pass
• tests/test_ontology_loader.py — pass
• tests/test_release_ontology_files.py — pass

Also ran tests/test_adr_acceptance.py (not one of the four, but the mechanism that enforces the acceptance procedure this PR relies on) to confirm the flip doesn't regress it: 28 passed, 1 skipped, 4 xfailed — clean, no drift between the README index and ADR-022's frontmatter, no unmapped Test Contract item.

🤖 Generated with Claude Code

[ozand]

Rebased onto de20e708 (#1750, merged). Two things resolved in the rebase, both worth stating rather than burying:

1. ADR conflict, resolved as a union, not a choice. Gate: the AGENTS.md scope bound locks the repair it demands — make it a ratchet #1750 added its principle to the same section this PR rewrote. Both are decisions and both stay: 7 (budget unit), 8 (loop-profile scope), 9 (SOUL/USER collision) from this PR, and the ratchet principle promoted to decision 10 with its own heading rather than left as a loose paragraph.
2. The "Gate: the AGENTS.md scope bound locks the repair it demands — make it a ratchet #1750 is open / being added separately" wording is now false — it merged as de20e708 while this PR was in review. Both references updated: the Status line records it as closed with its sha, and the References entry points at decision 10.

75 passed, 1 skipped, 5 xfailed across test_adr_acceptance, test_prompt_ontology, test_operating_md, test_ontology_loader, test_mutation_policy.

Separately, for the record: this PR's working-tree edits also landed in the main checkout T:/Code/eeebot and had to be discarded there before main could fast-forward. They were byte-identical to the branch, so nothing was lost — but a worktree-isolated task should leave no trace in the main checkout, and this one did.