docs: correct vendoring triage counts and runtime.ts barrel note

storage-isogit is 5 commits, not 9 files. Agent work is d1835be,
660ef81, and d1e05e9. runtime.ts is the split re-exports plus the
compat re-export, not a two-line barrel.

Author: TheGreatAxios

docs/VENDORING.md

@@ -311,8 +311,8 @@ packages/<area>`):
 | `harness`                          | 7       | whole `src/`                 | **Adopt**          | Supervisor-mailbox threading (`c7a7bf89`, `58e5689b`), step credential assembly (`7b8cfbbc`). Depends on adopted `types`/`agent`.                                                                                                                                                                                                                                                                                                                                                   |
 | `types`                            | 50      | whole `src/` (runtime split) | **Adopt**          | Required by mailbox/harness/inference/workflow-host (new `runtime-core`, `credential-delivery`, `workflow-definition`, `attachments`, `format-safety-rating` subpaths). Carries `adapter-manifest` (`2d973a4`), `PerCallInferenceOptions` (`d1835b`), identity/authz tightening (`0f72f95`, `1ff8805`). Four patched trees make this the biggest re-carry; no clean way to pin lower without breaking the adopted consumers, and the trio coherence rule forbids a types-only move. |
 | `inference`                        | 9       | whole `src/`                 | **Adopt**          | Reasoning-effort mapping (`c8be7e9`) and auth-claim fixes (`0f72f957`, `1ff88053`). 9 patched files three-way merged, 2 conflict regions resolved by hand (see `PATCHES.md`).                                                                                                                                                                                                                                                                                                       |
-| `storage-isogit`                   | 9       | whole `src/`                 | **Adopt**          | `e75eee2` `sync.request`/state-push removal, verified safe (below). Coupled-trio rule forces the pin to move with `types`/`inference` anyway.                                                                                                                                                                                                                                                                                                                                       |
-| `agent`                            | 3       | whole `src/`                 | **Adopt**          | Per-send inference options (`d1835b`) and probe-child dedupe (`872610b`, `a0be3012`); `./authoring` subpath consumed by the adopted workflow-host loader.                                                                                                                                                                                                                                                                                                                           |
+| `storage-isogit`                   | 5       | whole `src/`                 | **Adopt**          | `e75eee2` `sync.request`/state-push removal, verified safe (below). Coupled-trio rule forces the pin to move with `types`/`inference` anyway.                                                                                                                                                                                                                                                                                                                                       |
+| `agent`                            | 3       | whole `src/`                 | **Adopt**          | Per-send inference options (`d1835be`), runtime-contract imports (`660ef81`), and the `./authoring` subpath (`d1e05e9`) consumed by the adopted workflow-host loader.                                                                                                                                                                                                                                                                                                               |
 | `workflow-host` (partial: 3 files) | 68      | 3 vendored files only        | **Adopt** (narrow) | The other ~100 drift files live in supervisor/workflow trees we do not vendor and are excluded by design. `workflow-definition-loader.ts` dropped the `@intx/hub-sessions/substrate` import for `@intx/types/workflow-definition`, in the direction CL-9021 already wants.                                                                                                                                                                                                          |
 | `authz`, `log`, `tools-posix`      | 0       | nothing                      | **No change**      | `git diff 5453d0b0..4cc697241fa037244a9164a50aec507c112bc9fb -- packages/<p>` is empty for all three; pin bumped with the set for single-commit coherence only.                                                                                                                                                                                                                                                                                                                     |
 | `crypto`                           | 2       | not vendored                 | **No action**      | Published npm dep stays at `0.3.0`; its adopted consumers (`generateKeyPair`, `createEd25519Crypto`, `importPublicKeyBytes`) all already export from the installed `0.3.0` dist (verified against `node_modules/@intx/crypto/dist/index.d.ts`).                                                                                                                                                                                                                                     |

vendor/intx-types/PATCHES.md

@@ -35,8 +35,9 @@ All three entries re-carried; none dropped as upstream-absorbed (grep of the
 pristine `4cc6972` `packages/types` tree: `loadErrors`, `stopReason`,
 `normalizeError`, `credentialFailureOrdinal` all absent upstream). Upstream
 split `runtime.ts` into `runtime-core.ts` (runtime contracts) + the new
-`inference-events.ts` (event union); `runtime.ts` is now a two-line re-export
-barrel. The patch sites follow the split:
+`inference-events.ts` (event union). `runtime.ts` is those split
+re-exports plus the compat re-export of `formatSafetyRatingText`
+(about lines 1–11; see the entry below). The patch sites follow the split:
 
 - `inference.usage` stopReason → both declarations in
   `inference-events.ts` (arktype mapping and the TS union) carry the