[remigiusz-antczak]

Summary

This PR measures the bytes a full plugin install loads into every session, and adds a tripwire so that number cannot grow unnoticed. It changes no shipped text.

• Measured always-on load: 3,952 bytes (about 988 tokens). That is 3,202 bytes of skill descriptions, 409 of command descriptions and 341 from the SessionStart hook. UserPromptSubmit hooks and agents add nothing.
• That is about 8% of the 12.8k cache-write gap against the rival review toolkit. The rest of the gap comes from the skill body and the references a review loads, so that is where cost cuts have to land.
• No trim ships here. A 15% cut to descriptions would drop pinned trigger phrases.

The tripwire

scripts/test_always_loaded_surface.py fails when any of these happens:

• a plugin agent or plugin hook appears;
• an always-on hook appears that the byte count does not measure;
• the plugin default-path files (hooks/hooks.json, .mcp.json) appear;
• a network hook starts printing on SessionStart (proved from the hook source).

It parses hook commands with shlex, so VAR=... prefixes and unquoted forms are handled.

Review

An independent review pinned to the lane commit 9793aecd8f90a8442abfdd2914175bc61353debe found 🔴0 🟡0 🔵2. Both nits are queued for the next nits PR:

• the stdout-writer list misses os.write and similar calls;
• the watchdog check matches a source string, not behaviour.

This branch is that commit cherry-picked onto main 31419323d5860b34faa9b39dafe15e632ee34c94.

Tests

• always_loaded_surface 7/7, always_loaded_bytes 6/6, changelog fragments 23/23.
• Gates pass locally on the landed tree: size, size-ratchet, rules, mustload, check_section_pointers, skill_index --check and bench_check --changed.
• CI on the exact SHA is the blocking gate.

🤖 Generated with Claude Code