feat(research-loop-cap): give the discovery ceiling a reader, not just a sentence

The bounded-cost NFR asks for explicit ceilings on BOTH axes - max
conversation turns and max discovered dimensions. The turn axis got
MAX_CONV_TURNS, a ledger-backed reader and a PreToolUse enforcer. The
discovery axis got one sentence in Phase 4.5 prose ("append candidates only
while the whole list stays at or below maxDimensions: 8") with no constant
of its own, no reader, and no test that a run exceeding it is caught. That
is the brief_reviewer_iter_cap shape the operator decision warned about: a
cap nothing reads.

checkDimensionCeiling() is the reader, exposed on the CLI as
--check-dimensions N (exit 0 within, exit 1 rejected), and Phase 4.5 step 3
now calls it once the final list is settled instead of merely describing the
bound.

Three deliberate choices:

- The ceiling IS MAX_TOTAL_DIMENSIONS, the constant that sizes the turn
  budget. Both axes read one settings.json:16 value, so they cannot end up
  enforcing different numbers - a second constant is how that drift starts.
- An unreadable count is REJECTED ('abc', null, undefined, {}, -1, NaN,
  non-integers). A cost ceiling that waves through what it cannot measure is
  not a ceiling.
- --check-dimensions requires no run id, effort or VOYAGE_STORM_ENABLED.
  Phase 4.5 never calls the budget gate - that is why its skip-guard reads
  the flag directly - so the ceiling check must not inherit the gate's
  preconditions.

The mitigation the review already verified still holds and is unchanged:
MAX_TOTAL_DIMENSIONS bounds actual retrieval cost regardless of how many
dimensions discovery appends. What was missing was anything that FAILS on a
list over the bound, and now a run over it is rejected by exit code.

Review finding 96a3ee51152dfe72aca703f771843f2f3639e7b6 (MINOR).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LuGhWAbWyRFBFeemfhxoVv

lib/util/research-loop-cap.mjs

@@ -29,9 +29,15 @@
 // the legitimate first-turn state. This module is a budget control, not
 // telemetry — the opposite of lib/stats/event-emit.mjs's fail-open.
 //
-// CLI shim:
+// CLI shim, two modes:
 //   node lib/util/research-loop-cap.mjs --run-id ID --dimension D --effort E
 //   → JSON: { ok, used, budget, reason? }   (exit 0 = granted, exit 1 = denied)
+//
+//   node lib/util/research-loop-cap.mjs --check-dimensions N
+//   → JSON: { ok, count, ceiling, reason? } (exit 0 = within, exit 1 = rejected)
+//   The second axis of the bounded-cost NFR. Phase 4.5 never calls the budget
+//   gate, so this mode requires no run id, effort or STORM flag — but it reads
+//   the SAME MAX_TOTAL_DIMENSIONS the budget is sized against.
 
 import { existsSync, mkdirSync, appendFileSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
@@ -47,6 +53,40 @@ export function isStormEnabled(env = process.env) {
   return env.VOYAGE_STORM_ENABLED === '1';
 }
 
+/**
+ * The OTHER cost ceiling: how large the whole dimension list may get after
+ * Phase 4.5 discovery has appended to it.
+ *
+ * The bounded-cost NFR asks for explicit ceilings on both axes. The turn axis
+ * had a constant, a ledger-backed reader and a PreToolUse enforcer; the
+ * discovery axis had only a sentence in Phase 4.5 prose — a cap nothing reads,
+ * which is the failure mode the operator decision on brief_reviewer_iter_cap
+ * warned about. This is the reader.
+ *
+ * The ceiling is MAX_TOTAL_DIMENSIONS on purpose: the value that sizes the turn
+ * budget IS settings.json:16's maxDimensions, and a second constant for the same
+ * number is how two readers end up enforcing different bounds.
+ *
+ * Accepts the dimension list or its count, because Phase 4.5 has the list and
+ * the CLI has a number. A count that cannot be read is REJECTED — a cost ceiling
+ * that waves through what it cannot measure is not a ceiling.
+ *
+ * @param {string[]|number|string} dimensions
+ * @param {{ceiling?: number}} [opts]
+ * @returns {{ok: boolean, count: number|null, ceiling: number, reason?: string}}
+ */
+export function checkDimensionCeiling(dimensions, opts = {}) {
+  const ceiling = Number.isFinite(opts.ceiling) ? opts.ceiling : MAX_TOTAL_DIMENSIONS;
+  const count = Array.isArray(dimensions) ? dimensions.length : Number(dimensions);
+  if (dimensions === null || dimensions === undefined || !Number.isInteger(count) || count < 0) {
+    return { ok: false, count: null, ceiling, reason: 'unreadable_dimension_count' };
+  }
+  if (count > ceiling) {
+    return { ok: false, count, ceiling, reason: 'ceiling_exceeded' };
+  }
+  return { ok: true, count, ceiling };
+}
+
 /**
  * Coerce TREKRESEARCH_MAX_CONV_TURNS. NaN, empty, negative, zero, Infinity, or
  * any fraction that floors below 1 all fall back to MAX_CONV_TURNS — never to
@@ -280,12 +320,23 @@ function parseArgs(argv) {
     if (a === '--run-id') out.runId = argv[++i];
     else if (a === '--dimension') out.dimension = argv[++i];
     else if (a === '--effort') out.effort = argv[++i];
+    else if (a === '--check-dimensions') out.checkDimensions = argv[++i];
   }
   return out;
 }
 
 if (import.meta.url === `file://${process.argv[1]}`) {
   const args = parseArgs(process.argv.slice(2));
+
+  // The dimension ceiling is a Phase 4.5 concern, and Phase 4.5 never calls the
+  // budget gate — so this branch must not inherit the gate's preconditions
+  // (run id, effort, STORM flag). It is a pure bound on list size.
+  if (args.checkDimensions !== undefined) {
+    const result = checkDimensionCeiling(args.checkDimensions);
+    process.stdout.write(JSON.stringify(result) + '\n');
+    process.exit(result.ok ? 0 : 1);
+  }
+
   if (!args.runId || !args.dimension || !args.effort) {
     process.stdout.write(JSON.stringify({
       ok: false,