refactor(status): one evidence store + zero-spawn status/dashboard (ADR-0063)

docs/UPGRADING.md

@@ -39,6 +39,27 @@ and supported `claude mcp serve` tool exposure are preserved. See
 [ADR-0051](adr/0051-supported-peer-delegation-and-host-realignment.md) for the policy,
 official source citations, authority boundaries and verification limits.
 
+## 2026-09-28: One evidence cache for `ak status`'s local checks
+
+`ak status`, `ak sync`, and the dashboard now share one evidence cache
+(`<state>/agentic-kit/evidence/`) for native runtime, host setup, deja-vu, version drift,
+npm-global-root, the daemon sweep, and the ak launcher check, each with its own age rule.
+Right after upgrading to this release the cache is cold. Native runtime, host setup,
+host-install-method, host-launch, deja-vu, npm-global-root, the daemon sweep, and the ak launcher
+check each probe once on their first use after the upgrade and record what they find — a normal
+row, possibly a moment slower on that one check, never a placeholder state. This is expected and
+needs no action. Two rows read differently until their own next refresh, unchanged by this
+release: ruflo-component rows read `unknown` until `ak sync` or `ak status --refresh` (see
+[MANAGED-TOOLS.md](MANAGED-TOOLS.md#managed-ruflo-components)); the remembered live-check rows
+(`ak x verify`'s suites) simply don't appear until `ak sync`, `ak x verify`, or `ak status --live`
+records one.
+
+The old, now-orphaned storage locations — `<stateBase>/agentic-kit/live-checks/` (pre-dating this
+release) and `<stateBase>/agentic-kit/ruflo-components-evidence.json` (also pre-dating this
+release) — are simply abandoned, not migrated. They are inert; delete them by hand or leave them.
+
+`--refresh`'s name and default did not change; its scope grew (see [ADR-0063](adr/0063-evidence-store-and-refresh-vocabulary.md)).
+
 ## 2026-09-27: AQE is pinned to the project root
 
 AQE used to create a new `.agentic-qe` store in whatever folder a command, hook or MCP server

docs/USAGE-SCORECARD-METRICS.md

@@ -1941,7 +1941,7 @@ aggregated here, and deriving the baseline from a widened bound would silently
 stretch it to whatever lookback the caller happened to pass. The dashboard route widens it to
 the depth the personal tap-share baseline needs rather than to the previous
 window alone: `days + BASELINE_TRAILING_DAYS` (`lookbackDays`,
-`src/lib/dashboard-server.mjs:1849`); `ak usage score` applies the same rule
+`src/lib/dashboard-server.mjs:1860`); `ak usage score` applies the same rule
 (`src/commands/usage.mjs:316`). One extra window would be a strict
 subset — too shallow for `promptBaselines`, which needs
 BASELINE_MIN_ACTIVE_DAYS of history BEFORE the displayed window and returns

docs/adr/0025-machine-footprint-metrics.md

@@ -1,8 +1,14 @@
 # ADR-0025 — Machine footprint: infrastructure metrics for install, runtime, storage, and catalog
 
 - **Status:** Implemented
-- **Updated:** 2026-09-26 — the System page reads `GET /api/system/summary`, the same payload with
-  the catalog projected to what the page draws; `GET /api/system` and `ak system --json` are
+- **Updated:** 2026-09-28 — `GET /api/system/summary`'s allow-list projection now also covers
+  `storage`, `install`, `projects` and `consumers` (previously only `catalog` was projected; the
+  other four passed through unfiltered and were ~76% of the endpoint's real-machine bytes).
+  `GET /api/system` and `ak system --json` are unchanged (remediation program, branch 6a task 11);
+  see [ADR-0063](0063-evidence-store-and-refresh-vocabulary.md) for the evidence-store design this
+  measurement and the rest of branch 6a were done under.
+- **Earlier update:** 2026-09-26 — the System page reads `GET /api/system/summary`, the same payload
+  with the catalog projected to what the page draws; `GET /api/system` and `ak system --json` are
   unchanged (#237, decision 8).
 - **Earlier update:** 2026-09-08 — installed tools preserve measured executable locations
   for private path reveal, with PATH resolution and bounded package-manifest fallback;
@@ -318,12 +324,16 @@ silent "Other" slice into a to-do list a release can close.
   trees that were never walked cannot be un-hidden client-side.
 - `ak system [--deep] [--json]` — CLI parity sharing the same collector, following the
   usage-scorecard precedent of one collector behind both surfaces.
-- `GET /api/system/summary` (amendment, 2026-09-26) — the page's read: the same payload and
-  parameters with the catalog projected to an allow-list of keys and items cut to what the page
-  draws (including `presence[].provider`). The full catalog repeats each presence fact in five
-  places and grows with items × projects × hosts; the page used about 0.4% of its item bytes and
-  the Runtime view re-fetched it every 30 seconds. `GET /api/system` stays the complete
-  `ak system --json` shape for scripts.
+- `GET /api/system/summary` (amendment, 2026-09-26; extended 2026-09-28) — the page's read: the
+  same payload and parameters with `catalog`, `storage`, `install`, `projects` and `consumers` each
+  projected to an allow-list of keys and items cut to what the page draws (including
+  `presence[].provider`). The full catalog repeats each presence fact in five places and grows with
+  items × projects × hosts; the page used about 0.4% of its item bytes and the Runtime view
+  re-fetched it every 30 seconds. The other four sections carry the same shape of excess (a deep
+  storage tree with `path`/`presence`/`files` at every node, a per-tool native-addon list, a
+  per-project framework/dependency stack detection never rendered) and were the majority of the
+  endpoint's real-machine bytes once the catalog alone was slimmed. `GET /api/system` stays the
+  complete `ak system --json` shape for scripts.
 
 ### 6. Read-only; reclaimables are advisory, in two safety tiers
 

docs/adr/0048-inventory-led-maintenance-resource-management.md

@@ -2,7 +2,14 @@
 
 - **Status:** Accepted — implementation delivered 2026-09-05; Implemented withheld pending
   human-evaluation and cross-platform gates
-- **Updated:** 2026-09-26 — a curated host source whose root is absent (host not installed) is
+- **Updated:** 2026-09-28 — [ADR-0063](0063-evidence-store-and-refresh-vocabulary.md) records the
+  unified evidence-cache age rule and directory layout behind `ak status`'s current, interim
+  `--refresh` boolean (ruflo-components, native runtime, host setup, deja-vu, version drift,
+  npm-global-root, daemon-sweep, ak-launcher); it is the precursor to, but does not itself
+  implement, this ADR's eventual `--refresh=live`/`--refresh=machine` split — the **Refresh
+  evidence** and **Re-measure machine** controls, their scan-store backing (`scan-store.mjs`), and
+  their UI are unchanged (remediation program, branch 6a).
+- **Earlier update:** 2026-09-26 — a curated host source whose root is absent (host not installed) is
   never scanned and never counted in coverage, the Discovery narrative or the Inventory banner;
   Discovery shows it as not installed and an explicit start is refused with `SOURCE_NOT_PRESENT`
   (#238 item 6). Existing acceptance gates remain outstanding.

docs/adr/0053-host-setup-evidence-and-usage-diagnostics.md

@@ -5,6 +5,13 @@
 - **Date:** 2026-09-20
 - **Updated:** 2026-09-20 — record inclusion in `4.0.0-alpha.50`; replace setup-only badges with consistent local health and explicit provider connection checks for Claude, Codex and OpenCode
 - **Updated:** 2026-09-26 — amended: management (Managed by ak / Found, not managed / Not installed) is reported separately from health; every found host is checked automatically; "Disabled" is retired (see [Amendment — 2026-09-26](#amendment--2026-09-26-management-is-not-health))
+- **Updated:** 2026-09-28 — host setup checks (`detectHosts`/`hostInstallState`/`hostExecutable`)
+  are now persisted evidence with an age rule (6h, invalidated by a PATH/package change), not
+  process-memory-only as this ADR originally describes; `host-readiness.mjs`'s own connection-check
+  proof (the health badge this ADR is about) is unaffected — it stays in-process, unpersisted,
+  15-minute-capped, consent-gated, untouched by this branch (its `host-health-evidence.mjs`
+  input-fingerprint helper, used only to invalidate that in-memory cache, is also untouched). See
+  [ADR-0063](0063-evidence-store-and-refresh-vocabulary.md) (remediation program, branch 6a tasks 5 and 7)
 - **Amends:** [ADR-0023](0023-fail-closed-operations-and-explicit-degradation.md)
 - **Related:** [ADR-0041](0041-host-neutral-hook-configuration-assurance.md), [ADR-0051](0051-supported-peer-delegation-and-host-realignment.md)
 

docs/adr/0055-aqe-embedding-lifecycle.md

@@ -15,6 +15,7 @@
 - **Updated:** 2026-09-27 — a passing embedding check reads "embedder verified"; status, `ak x verify aqe` and setup say AQE's pattern index binding stays unverified (agentic-qe#754) and corpus compatibility stays separate
 - **Updated:** 2026-09-27 — the busy rule's removal condition is agentic-qe#574 fixed in a released agentic-qe that is the kit floor; agentic-qe#719 (carried by 3.14.4) is only a partial fix
 - **Updated:** 2026-09-27 — beside these projections, `ak sync` and `ak setup` pin AQE to the project root (absolute `AQE_PROJECT_ROOT`, `AQE_MEMORY_PATH`, `AQE_STORAGE_PATH`) in `.claude/settings.local.json`, the recognized `.mcp.json` entry and both AQE tables of the project `.codex/config.toml`, under receipts from the same owned-env engine; a file git tracks is not pinned, and AQE's own relative `AQE_MEMORY_PATH` is taken back even after an AQE re-init. Stray AQE stores are merged and archived by `ak x aqe-store merge`. See [ADR-0062](0062-aqe-project-store-integrity.md) (remediation Branch 5, B5-D1 to B5-D5, B5-M5)
+- **Updated:** 2026-09-28 — live-check evidence storage relocated from `<stateBase>/agentic-kit/live-checks/<id>.json` to the shared `<stateBase>/agentic-kit/evidence/live-check/<id>.json` layout; this ADR's own live-check BEHAVIOR (TTL, statuses, remembered-check display) is unchanged, only where the evidence file lives. `ak x aqe-embedding verify` (distinct from `ak x verify`'s `aqe-embedding` row) does not persist evidence either way — it is a one-shot, unpersisted synthetic-backend proof. See [ADR-0063](0063-evidence-store-and-refresh-vocabulary.md) (remediation program, branch 6a task 2)
 - **Related:** [ADR-0023](0023-fail-closed-operations-and-explicit-degradation.md),
   [September repair](../audits/2026-09-09-aqe-integration-repair.md)
 

docs/adr/0058-managed-ruflo-components.md

@@ -25,6 +25,12 @@
   (ADR-0062): the receipt records a file or table ak created, and a release that leaves it empty
   removes it; older backups are pruned to the newest. An `adoptable` value is also taken back when
   ak already owned the key. The Ruflo component projections are unchanged.
+- **Updated:** 2026-09-28 — the evidence cache (`ruflo-components/evidence.mjs`'s `collectEvidence()`
+  result) is now stored under the shared `<stateBase>/agentic-kit/evidence/ruflo-component/machine.json`
+  layout, moved from `<stateBase>/agentic-kit/ruflo-components-evidence.json`; it still does NOT
+  route through the generic evidence envelope's `readEvidence`/`writeEvidence` — only its storage
+  location moved, its own 15-minute producer TTL / 24-hour display-staleness rule is unchanged. See
+  [ADR-0063](0063-evidence-store-and-refresh-vocabulary.md) (remediation program, branch 6a task 3)
 - **Deciders:** agentic-kit maintainers
 - **Related:** [ADR-0016](0016-capability-driven-integration-adapters.md) (value-precise ownership),
   [ADR-0023](0023-fail-closed-operations-and-explicit-degradation.md) (explicit degradation),