@deftai/directive-content 0.96.0 → 0.97.0

package/patterns/operator-log-hygiene.md

@@ -0,0 +1,130 @@
+# Operator-log hygiene — structured operator-facing logs (#1940)
+
+Guidance for consumer services that humans operate. Declare and keep
+structured, operator-facing logs so outages are diagnosable without a
+week of reactive firefighting.
+
+Legend (from RFC2119): !=MUST, ~=SHOULD, ≉=SHOULD NOT, ⊗=MUST NOT, ?=MAY.
+
+**Load when:** implementing or reviewing services with operator dashboards,
+WARN/ERROR paths operators triage, multi-process / parent-child workers,
+or story AC / probe locked decisions about logging.
+
+**Not this pattern:**
+- Directive Product Insights / remote usage analytics — #2603
+- LLM-call telemetry — `patterns/llm-app.md`, `tools/telemetry.md` / #481
+- Framework DDD glossary — `glossary.md` / `deft-directive-glossary`
+
+**⚠️ See also**:
+- [../docs/operator-log-hygiene-checklist.md](../docs/operator-log-hygiene-checklist.md) — copy-paste build/probe checklist
+- [../docs/operator-log-hygiene-consumer-pack-stub.md](../docs/operator-log-hygiene-consumer-pack-stub.md) — optional consumer Taskfile/validator stub
+- [./llm-app.md](./llm-app.md) — LLM-specific observability (different lane)
+- [../tools/telemetry.md](../tools/telemetry.md) — general telemetry guidance
+
+## Honest value claim
+
+This pattern speeds **second systems**, shared language across services, and
+regression prevention when you opt in. It does **not** claim it would have
+avoided any first production week, or that the framework knows your field
+names. Log **shape** stays consumer-owned.
+
+## Failure modes (case study)
+
+When operator logging is left implicit, the same six deficiencies recur:
+
+1. **Happy-path-only terminals** — sessions finish externally (checks, UI)
+   while durable logs omit tail events on skip, timeout, supersede, cancel,
+   or error exits.
+2. **Missing correlation context** — multi-worker / parent-child designs ship
+   without slot, phase, or job-scoped IDs; forensics need archaeology.
+3. **Infrastructure treated as debug-only** — log rotation, flush-before-exit,
+   IPC handoff, and boot supervision lack fail-open guards and structured
+   events until production crashes.
+4. **Opaque operator text** — WARN/ERROR carry ticket numbers and engineer
+   `msg` strings; operators cannot triage severity or whether work continued.
+5. **Dishonest parent/child contracts** — parent logs imply success when IPC
+   never delivered; metrics and pollers infer wrong outcomes.
+6. **Hygiene lags the log line** — glossary and plain-English summaries land
+   in follow-up issues, not the same PR as the log line.
+
+## Positive rules
+
+- ! MUST emit terminal / completion events on **all** exit paths for a unit
+  of work that has operator-visible lifecycle (success, skip, timeout,
+  supersede, cancel, failure) — not only the happy path
+- ! MUST include correlation context for multi-process or pool designs
+  (for example job id, slot, phase, parent id) so one incident can be
+  reconstructed without log archaeology
+- ! MUST treat infrastructure paths that affect operator truth (rotation,
+  flush, IPC handoff, boot supervision) as first-class: fail-open where
+  possible, with structured events when they degrade
+- ~ SHOULD give operator-facing WARN/ERROR a stable, queryable shape
+  (stable event id + short operator-readable summary fields are common)
+  without requiring a Directive-owned schema
+- ~ SHOULD update operator log glossary / plain-English docs in the **same
+  PR** that adds or changes operator-facing log lines
+- ? MAY wire a consumer-owned validator into *your* `task check` aggregate
+  (see the consumer pack stub) — optional, never default-on in core
+
+## Anti-patterns
+
+- ⊗ Terminal events only on success while skip/timeout/error paths stay silent
+- ⊗ Multi-worker systems with no job/slot/phase correlation on log lines
+- ⊗ Treating rotation, flush, IPC, or boot supervision as "debug detail"
+  with no structured signal when they fail
+- ⊗ Operator-facing WARN/ERROR that only carry ticket numbers or engineer
+  free-text with no stable event identity
+- ⊗ Parent logs that claim success when the child message was never delivered
+- ⊗ Landing operator log lines without same-PR hygiene (docs/glossary/shape)
+- ⊗ Assuming Directive core will enforce your log schema or fail `deft check`
+  for every consumer by default
+
+## Explicit non-goals (thin v1)
+
+- ⊗ No core `plan.observability` / setup Phase 2 interview defaults in this
+  issue's close path
+- ⊗ No core `deft check` hard-fail for consumers who never opted in
+- ⊗ No prescription or validation of a fixed field set (`operatorSummary`,
+  glossary JSON schema, etc.) inside Directive core
+- ⊗ No default-on magic for all "service" project types
+- ⊗ No import of any external project's glossary JSON or validate task as
+  framework SoT
+- ⊗ Not Product Insights (#2603) and not LLM-call telemetry (#481)
+
+Hard-fail enforcement is allowed only when a **consumer** wires their own
+gate. Log shape remains consumer-owned.
+
+## External reference (SLizard — reference only)
+
+A production case study lives in **deftai/slizard** (June 2026 postmortem and
+follow-on hygiene work). Cite it as an **external reference implementation**,
+not as Directive schema:
+
+| External pointer | Role |
+|------------------|------|
+| SLizard `docs/operator-log-hygiene.md` | Project hygiene write-up |
+| SLizard `docs/operator-log-glossary.json` | Consumer-owned glossary shape |
+| SLizard `task operator-log:validate` | Consumer ship-gate example |
+| SLizard origin issues (e.g. #1394 LD-8, #1402) | How hygiene landed under fire |
+
+- ! MUST treat those paths and schemas as **pointers only**
+- ⊗ MUST NOT copy SLizard glossary JSON or validate schema into Directive
+  core as a mandatory contract
+- ⊗ MUST NOT close framework work by importing that repo's field names as
+  universal requirements
+
+## Build and probe
+
+Copy-paste AC / probe bullets:
+[`docs/operator-log-hygiene-checklist.md`](../docs/operator-log-hygiene-checklist.md).
+
+Optional consumer Taskfile + validator skeleton:
+[`docs/operator-log-hygiene-consumer-pack-stub.md`](../docs/operator-log-hygiene-consumer-pack-stub.md).
+
+## Cross-references
+
+- #1940 — consumer operator-log hygiene thin v1 (this pattern)
+- #2603 — Product Insights (different lane)
+- #481 — LLM-specific observability (different lane)
+- #1516 — product-pulse health report (adjacent ops UX, not log contract)
+- #829 — skill usage telemetry (framework internal)

package/scm/github.md

@@ -399,6 +399,32 @@ Following a v1.0.0 release, commits:
 - ! Consumer scaffolds and `npm-publish.yml` stay on GitHub-hosted `ubuntu-latest` (Blacksmith is opt-in for consumer orgs; npm `--provenance` requires GH-hosted)
 - ! Agents seeing `runner_capacity_stall` / `RUNNER_CAPACITY_STALL` MUST wait for auto-failover — ⊗ `--skip-ci` as a capacity remedy
 
+### Platform status probe + outage attribution (#3180)
+
+`pr:watch` / `pr:merge-ready` weather codes (`ci_never_scheduled`, `runner_capacity_stall`, `ci_cancelled_no_failover`, `ci_failures` — see #3167) classify **forge check-run shape**. They do **not** attribute the hold to an upstream platform outage vs repo config. When weather codes fire, CI never starts for HEAD, or many PRs share an empty-check pattern:
+
+! **MUST probe public status pages** (v1: open in browser / operator view; gates surface static URLs — no network fetch required):
+
+1. **GitHub Status** (Actions, Webhooks): https://www.githubstatus.com/
+2. **Blacksmith Status** (and any Github→Actions / Webhooks mirrors shown there): https://status.blacksmith.sh/
+
+**Attribution table** (`attribution` enum for handoffs):
+
+| Observation | `attribution` | Agent action |
+|-------------|---------------|--------------|
+| GH Actions and/or Webhooks major/partial outage | `platform` | Treat as platform incident; ⊗ workflow drive-by edits; ⊗ empty-commit thrash past #3167 caps; wait + re-check runs for HEAD + local `task check` |
+| Blacksmith components red while GH Actions green | `capacity` | Runner-provider incident; capacity/failover doctrine (#2672 / #3168) still applies |
+| Both green + still `ci_never_scheduled` on **this PR only** | `repo_config` | Investigate workflow paths, branch filters, required-check names, Actions disabled / org policy |
+| Status unclear or mixed signals | `unknown` | Cap thrash (#3167); BLOCKED with both status URLs; operator decision |
+
+! **Anti-thrash during attributed platform outage:** After thrash caps (max 2 re-triggers per #3167), stop automatic empty-commit / close-reopen / rebase loops. Remediation is wait + re-probe HEAD check-runs, not inventing workflow edits to "fix" a global outage.
+
+⊗ Merge or `--skip-ci` solely because a status page is red — status is **attribution for wait/thrash policy**, not a second branch-protection oracle (#3180 non-goal).
+⊗ Blame Blacksmith when status pages show GitHub Actions/Webhooks major outage and Blacksmith runners themselves operational.
+⊗ Edit workflows or re-push thrash to "fix" a documented global Actions/webhook outage without status-page probe.
+
+**BLOCKED handoff fields** (extend `BLOCKED: ci_weather` in review-cycle): `platform_status_github`, `platform_status_blacksmith`, optional incident URL, `attribution: platform | capacity | repo_config | unknown`. Cross-links: #3167 (weather codes), #3168 (failover arms), #2672 (capacity stall), #2688 (Greptile CLEAN + CI holdout ownership).
+
 **Security**:
 - ! Use GitHub Secrets for CI/CD credentials
 - ⊗ Commit secrets to repo

package/skills/deft-directive-article-review/SKILL.md

@@ -112,12 +112,22 @@ Look for lessons applicable to projects that directive-guided agents build:
 
 ### Step 5: Cross-reference open issues
 
-- ! Run `gh issue list --repo deftai/directive --state open --limit 100` to retrieve the current open issue backlog
-- ! For each suggestion from Step 4, check whether an open issue already covers it — fully or partially
-- ! If a suggestion duplicates an open issue: drop it from the proposal and note the existing issue number
-- ! If a suggestion extends or relates to an open issue: flag it as "extends #N" rather than proposing a standalone new issue
+Titles alone are insufficient for ownership verdicts (evidence: #3163). Body-level reads are mandatory.
+
+- ! Shortlist open **issues** only: prefer `gh issue list --repo deftai/directive --state open --limit 100` (issues, not PRs). If using REST `gh api repos/deftai/directive/issues?state=open&per_page=100`, **exclude** entries that have a `pull_request` field — GitHub's issues list mixes PRs in; never treat a PR as an owning issue for dedupe
+- ! For each suggestion from Step 4, identify candidate related/owning issues (title scan, semantic match, prior citations) from the issue-only shortlist
+- ! For every issue claimed as related or owning: read the **full issue body**. If the body is a stub or pointer-only, also read recent comments (REST `issues/<N>/comments`) before judging ownership
+- ! Prefer local cache when present: `.deft-cache/github-issue/deftai/directive/<N>/` (or project-equivalent) may satisfy the body-read requirement offline **only when all** of: (1) usable body (and comments when the body is a stub); (2) **affirmative freshness** — readable cache age or TTL metadata is present **and** within the project's cache TTL (not expired). If age/TTL metadata is missing or unreadable, the entry is **not** body-read complete — re-fetch live when network is available; if offline with missing freshness metadata, do not claim body-level ownership from that cache hit alone. Do not skip body-level ownership solely because network is unavailable if a **complete and affirmatively fresh** cache entry exists
+- ! Verify every issue number cited in the analysis **exists**, is an **issue** (not a PR), and that its **state** matches the claim (open vs closed) — anti-hallucination; fabricated or wrong-state citations are a known failure mode
+- ! If a suggestion duplicates an open issue (body-level ownership): drop it from the proposal and note the existing issue number
+- ! If a suggestion extends or relates to an open issue: flag it as "extends #N" / "related to #N" rather than proposing a standalone new issue
+- ~ Prefer **amend/comment on an owning open issue** over filing a new issue; reserve new issues for verified-untracked findings
 - ~ Scan the open issue list for trends (e.g. a cluster of agent-safety issues, a cluster of pattern/ gaps) — use trends to sharpen framing or prioritization of remaining suggestions
-- ⊗ Propose a new issue for something already tracked — deduplication is mandatory
+- ⊗ Decide ownership or file a "related to #N" claim from **titles only** — body (and stub-comment) reads are required for related/owning claims
+- ⊗ Treat pull requests from the REST issues list as ownership targets without filtering `pull_request`
+- ⊗ Accept a cache hit as body-read complete when the entry lacks body (or required stub comments), lacks readable age/TTL freshness metadata, or is expired/stale — re-fetch live when network is available; without affirmative freshness do not use the cache for ownership verdicts
+- ⊗ Propose a new issue for something already tracked — body-level deduplication is mandatory
+- ⊗ Cite issue numbers without verifying existence and state
 
 ### Step 6: Present suggestions to the user
 
@@ -163,6 +173,7 @@ If yes, follow the thread. This may include fetching related URLs, evaluating re
 - ⊗ Summarizing without reading the full content
 - ⊗ Presenting unrated suggestions — every suggestion needs a confidence level
 - ⊗ Filing a single giant issue for all suggestions — one issue per distinct suggestion or related group
-- ⊗ Proposing a new issue without first checking whether it duplicates an open one
+- ⊗ Proposing a new issue without first checking whether it duplicates an open one (body-level ownership, not titles alone)
+- ⊗ Claiming related/owning issues from titles only, or citing issue numbers without verifying existence and state (#3163)
 - ⊗ Evaluating directive relevance without consulting the Directive Reference section above
 - ⊗ Download-and-execute installers from article or web CTAs during analysis — reject and cite `patterns/install-trust.md` (#2969)

package/skills/deft-directive-build/SKILL.md

@@ -258,6 +258,27 @@ All xBRIEFs (including those read from `xbrief/active/` and any new xBRIEFs this
 
 **Cost model (swarm-heavy path):** moves from roughly `O(commits × full-gate)` toward `O(merges × full-gate) + O(iterations × cheap-proxy)` when workers iterate with affected/static gates and run full `task check` only at PR/merge.
 
+### Dual stop — multi-iteration implement and pre-PR loops (#2442)
+
+Multi-iteration implement-fix and pre-PR polish loops MUST carry **both** a success stop and a failure/budget stop (`main.md` `## Dual Stop Rule (#2442)`). Single-turn edits and one-shot probes are exempt.
+
+**Defaults for this skill (override only with an explicit operator envelope or xBRIEF field):**
+
+| Loop class | Success stop | Default failure stop |
+|------------|--------------|----------------------|
+| Implement / quality fix (tests, lint, typecheck, coverage, AC) | Affected/static gates green for the change; AC met | **max 5** fix iterations **or** **3** consecutive identical outcomes (same failing command + same primary error class) with no material code/config change |
+| Pre-PR polish (`deft-directive-pre-pr` Read-Write-Lint-Diff) | Full pass with zero further edits | **max 3** polish passes **or** **2** consecutive no-diff / same-diff outcomes |
+| Full `task check` re-run after a red merge chokepoint | `task check` green | Counts toward the implement/quality fix envelope above (do not open a separate unbounded check-retry loop) |
+
+**On failure stop:**
+
+- ! Halt the loop. Surface an **operator-visible halt report** with: (1) iterations attempted and which stop fired (max-iter / no-progress / budget), (2) commands and primary failure fingerprints tried, (3) what is still red or missing, (4) the human decision needed (unblock dependency, rescope AC, waive with audit, abandon).
+- ! Prefer a structured `BLOCKED:` terminal (preamble §11 / #2843) when exiting a drive-to:merge-ready or parent-dispatched unit early because the envelope is exhausted.
+- ⊗ Continue "one more fix" after the envelope is exhausted.
+- ⊗ Reset the counter by opening a new commit, rewording the same change, or swapping workers while the same failure class remains.
+
+**Enforcement note:** skill defaults are behavioral. Durable delivery/acceptance circuit-breaker: **#3143** `packages/core/src/delivery-attempt/` (`evaluatePreDispatch`, `.deft/delivery-attempts/`). Docs: `docs/delivery-attempt.md`. Route delivery/acceptance automatic retries through that gate; do not invent a parallel ledger in this skill.
+
 ## Step 3: Build Phase by Phase
 
 For each phase:
@@ -295,6 +316,23 @@ task test:coverage  # >=85% or PROJECT-DEFINITION.xbrief.json override
 - ⊗ Re-run full install/session ceremony after offline seed when ritual is already complete (#3010) — use `session:ready` for recovery only.
 
 
+## Operator-log hygiene (lazy-load, #1940)
+
+When the story touches **operator-facing** services (dashboards, multi-process
+workers, WARN/ERROR operators triage):
+
+- ~ SHOULD load `patterns/operator-log-hygiene.md` and apply the copy-paste
+  checklist in `docs/operator-log-hygiene-checklist.md` to story AC or probe
+  locked decisions before claiming logging done
+- ⊗ MUST NOT treat this as Product Insights (#2603) or LLM-call telemetry
+  (#481) — those are different lanes
+- ⊗ MUST NOT assume core `deft check` enforces a log schema by default —
+  consumer-owned shape; optional pack stub under
+  `docs/operator-log-hygiene-consumer-pack-stub.md`
+
+Discovery keywords: operator log, operator-facing logs, observability checklist
+— also indexed in `REFERENCES.md`.
+
 ## Coding Standards (Summary)
 
 Read full files when you need detail:
@@ -343,6 +381,7 @@ feat(phase-2): add REST API endpoints with integration tests
 - ! Lint/type errors → fix them; ≉ add ignore comments without documented reason
 - ! Scope xBRIEF ambiguous -> ask user; ⊗ guess
 - ! Scope needs changes -> propose, get approval, update the scope xBRIEF first
+- ! Multi-iteration fix loops obey dual-stop defaults above (#2442); on envelope exhaustion halt with an operator-visible report -- do not thrash
 
 
 ## Probe-then-fill remote claims (#3120)
@@ -388,3 +427,5 @@ feat(phase-2): add REST API endpoints with integration tests
 - ⊗ Add a prohibition (`!` or `⊗`) without scanning the same file for conflicting softer-strength rules (`~`, `≉`) that reference the same term
 - ⊗ Invent remote PR/SHA/CI/review claims in handoff evidence without same-turn probe binding — invented-done (#3120)
 - ⊗ Fill remote ship/gate fields from memory when only local work completed; legal partial omits PR fields (#3120)
+- ⊗ Run multi-iteration implement / pre-PR loops without a failure stop (max iterations and/or no-progress) or without an operator-visible halt report when the envelope is exhausted (#2442)
+- ⊗ Silently continue after dual-stop failure halt — escalate; do not thrash (#2442)

package/skills/deft-directive-review-cycle/SKILL.md

@@ -190,6 +190,26 @@ Babysit and review-cycle are **not** a second unbounded implementation mandate.
 ⊗ Expand active story scope past xBRIEF AC mid-babysit without follow-up or consented amend (#2881).
 ⊗ Treat confidence-only holds as authorization to invent new subsystems in-tree.
 
+
+### Dual stop — review fix loops (#2442)
+
+Review fix cycles are multi-iteration work and MUST carry dual stop (`main.md` `## Dual Stop Rule (#2442)`). Single-turn re-checks are exempt.
+
+**Defaults for this skill (override only with an explicit operator envelope):**
+
+| Loop class | Success stop | Default failure stop |
+|------------|--------------|----------------------|
+| Greptile / bot fix batch (Step 3 → re-review) | No P0/P1 on current HEAD; confidence meets `minGreptileConfidence` | **max 3** fix-batch iterations across the whole review ownership (do **not** reset the counter on push when the same primary fingerprint remains) **or** **2** consecutive re-reviews with the same primary P0/P1 fingerprint and no material fix |
+| Confidence-only hold (0 P0/P1, score below floor) | Confidence meets floor, or operator chooses document/accept path | **max 1** optional polish pass, then stop (do not redesign unbounded — see confidence-only holds above) |
+
+**On failure stop:**
+
+- ! Halt automatic re-fix. Prefer `BLOCKED:` with PR number, HEAD SHA, blocker class (`review_cycle_cap` / `greptile_p0_p1` / `no_progress`), what was tried, and human decision needed (preamble §11 / #2843).
+- ⊗ Continue silent fix rounds after the envelope is exhausted.
+- ⊗ Reset the fix-batch counter solely by re-pushing, empty-committing, or swapping workers when the same primary finding fingerprint remains (poll-wait timer MAY reset for a new HEAD; the dual-stop fix-batch counter MUST NOT).
+
+**Enforcement note:** skill defaults are behavioral. Durable delivery/acceptance circuit breaker: **#3143** packages/core/src/delivery-attempt/ (valuatePreDispatch). Docs: docs/delivery-attempt.md.
+
 ### Step 3: Fix all findings in ONE batch commit
 
 ! Apply [`coding/review.md`](../../coding/review.md) single-batch, cross-file grep, and local structured-data validation rules. Land **all** in-scope fixes in one commit (or one intentional batch), never per-finding pushes.
@@ -297,6 +317,94 @@ Remediation:
 
 ⊗ Use `--skip-ci` / merge-with-pending because CI is capacity-stalled — the failover path is the unblock; skip-ci is an incident-only release escape hatch (#2652), not a runner-capacity remedy.
 
+### CI weather reason codes + thrash caps (#3167)
+
+`pr:watch` / `pr:merge-ready` expose machine-distinguishable `ci_ready_state` values (also `--json`) so agents stop conflating Actions weather with product test failure:
+
+| `ci_ready_state` / verdict | Meaning | Agent action |
+|----------------------------|---------|--------------|
+| `ci_never_scheduled` / `CI_NEVER_SCHEDULED` | No CI workflow check-run for HEAD (empty or bots-only: Greptile/SLizard) | Cap re-triggers; then **BLOCKED** — do not multi-hour empty-commit thrash |
+| `runner_capacity_stall` / `RUNNER_CAPACITY_STALL` | Required still `queued`, no runner past budget (#2672) | Wait auto-failover; ⊗ `--skip-ci` |
+| `ci_failures` / `CI_BLOCKED` | Completed `failure` / `timed_out` with product evidence (#2688) | Own like Greptile P0 — fix or escalate |
+| `ci_cancelled_no_failover` / `CI_CANCELLED_NO_FAILOVER` | Primary `cancelled` and no green required sibling (failover skipped/not armed; workflow sibling **#3168**) | Cap re-triggers; then **BLOCKED** |
+| Greptile CLEAN fields / `greptile_pending` | Existing Step 6 / SHA / confidence | Unchanged |
+
+! **Thrash caps (MUST):** Under stable `ci_never_scheduled`, `ci_cancelled_no_failover`, or repeated capacity stall after failover wait budget, limit **CI re-trigger attempts** (empty-commit push, close/reopen, rebase-for-enqueue) to **at most 2** total across the ownership span. On the **2nd** failed re-trigger (or immediately when the weather code is stable and Greptile Step 6 is already clean), stop automatic re-push and emit a structured **BLOCKED** handoff.
+
+### Platform status probe + outage attribution (#3180)
+
+! When `ci_ready_state` is weather-class (`ci_never_scheduled`, `runner_capacity_stall`, `ci_cancelled_no_failover`, `ci_failures`), CI never starts for HEAD, or many PRs share an empty-check pattern: **MUST probe public status pages** before workflow thrash or drive-by edits. Gates surface static URLs in `pr:watch` / `pr:merge-ready` JSON and human output (v1: no network fetch required).
+
+1. ! **GitHub Status** (Actions, Webhooks): https://www.githubstatus.com/
+2. ! **Blacksmith Status**: https://status.blacksmith.sh/
+
+**Attribution table:**
+
+| Observation | `attribution` | Agent action |
+|-------------|---------------|--------------|
+| GH Actions and/or Webhooks major/partial outage | `platform` | Platform incident; ⊗ workflow drive-by edits; ⊗ empty-commit thrash past thrash caps; wait + re-check HEAD runs + local `task check` |
+| Blacksmith red while GH Actions green | `capacity` | Runner-provider incident; failover doctrine (#2672 / #3168) |
+| Both green + still `ci_never_scheduled` on this PR only | `repo_config` | Workflow paths, branch filters, required-check names, Actions disabled / org policy |
+| Unclear / mixed | `unknown` | Cap thrash; BLOCKED with both status URLs; operator decision |
+
+! **Anti-thrash during attributed platform outage:** After thrash caps, stop automatic re-push loops. Remediation is wait + re-probe HEAD check-runs, not inventing workflow edits for a global outage.
+
+⊗ Merge or `--skip-ci` solely because a status page is red — status is attribution for wait/thrash policy, not a second branch-protection oracle.
+⊗ Blame Blacksmith when GH Actions/Webhooks are the red components and Blacksmith runners are operational.
+⊗ Edit workflows / empty-commit thrash to "fix" a documented global Actions/webhook outage without a status-page probe.
+
+Cross-links: #3167 (weather codes), #3168 (failover arms), #2672 (capacity stall), #2688 (Greptile CLEAN + CI holdout).
+
+! **BLOCKED handoff template (CI weather):**
+
+```text
+BLOCKED: ci_weather
+PR: <N>
+HEAD: <sha>
+REASON: ci_never_scheduled|ci_cancelled_no_failover|runner_capacity_stall
+GREPTILE: CLEAN|P0/P1|pending (Step 6 fields)
+CI: <ci_ready_state from pr:watch --json>
+platform_status_github: https://www.githubstatus.com/
+platform_status_blacksmith: https://status.blacksmith.sh/
+incident_url: <optional status-page incident URL or n/a>
+attribution: platform|capacity|repo_config|unknown
+ATTEMPTS: empty-commit=<0-2> close-reopen=<0-2>
+REMEDIATION: wait for platform recovery | capacity failover (#3168) | repo config fix | human admin-merge playbook below | operator decision
+REDISPATCH_OK: yes|no
+```
+
+! Ownership of Greptile CLEAN + CI holdout is still real (#2688) — **ownership ≠ infinite wait**. After thrash caps, hand off; do not burn multi-hour `gh run watch` / empty-commit loops when Greptile is already CLEAN.
+
+! **Envelope selection under CI weather (#3153):** Prefer deliberate `stop-at: pr-open` implement + this skill as the partner merge-path babysit when known capacity/outage weather dominates; see swarm Envelope selection SLA and partner merge-path section above. Cross-link only — do not re-spec the tree here.
+
+⊗ Multi-hour empty-commit / close-reopen / rebase thrash after thrash caps when `ci_ready_state` is `ci_never_scheduled` or `ci_cancelled_no_failover`.
+⊗ Treat `ci_never_scheduled` as ordinary Greptile latency (`sha_match` / `terminal_check_run` only).
+⊗ Silent `--skip-ci` / admin merge without the outage playbook audit trail below.
+
+### SLizard advisory-only for merge-ready wait (#3167)
+
+! Required bot for **merge-ready wait** / Step 6 exit ownership is **Greptile**. SLizard (Gemini Verify) is **advisory only**: timeouts, retries, missing check, or flaky SLizard conclusions MUST NOT gate the review-cycle wait loop or authorize unbounded re-push.
+
+! `task pr:merge-ready` may still surface SLizard structure when present (#2189); agents MUST NOT idle-poll or thrash solely for SLizard when Greptile Step 6 is clean. Prefer continue / BLOCKED on CI weather / human decision.
+
+⊗ Block merge-ready babysit on SLizard alone when Greptile Step 6 all-of is satisfied on HEAD.
+
+### Outage admin-merge playbook (opt-in / human, #3167)
+
+When GitHub Actions is in a **documented major outage** (or multi-hour `ci_never_scheduled` / `ci_cancelled_no_failover` after thrash caps) and product + Greptile are ready:
+
+! Admin / human merge is **opt-in**, never the autonomous agent default. Preconditions:
+
+1. ! Greptile Step 6 fail-closed all-of on current HEAD (dogfood conf floor / `minGreptileConfidence`).
+2. ! Evidence of local or prior green `task check` / merge-gate when available.
+3. ! PR comment **audit note** naming the weather code, HEAD SHA, and who authorized override.
+4. ? Optional explicit env/policy for bot merge (`DEFT_ALLOW_BOT_MERGE` / `task policy:allow-bot-merge`) — **opt-in**, never silent default skip-ci.
+
+⊗ Autonomous `--skip-ci` / `--admin` merge as the default under ordinary CI weather.
+⊗ Replace branch protection with Greptile-only merge on normal days.
+
+Workflow failover arming (Blacksmith cancelled → GH-hosted lane) is sibling issue **#3168** — this skill owns agent thrash caps and reason codes only.
+
 ### Stall Detection Rubric (#564)
 
 ! Track per poll: `startedAt` (timestamp of the first observation of the IN_PROGRESS check run for the current commit) and `commit.oid` (head SHA being reviewed). Both fields MUST be re-recorded every time the head SHA changes -- the rubric measures elapsed time on a single commit, not across the whole review cycle.
@@ -360,6 +468,38 @@ Remediation:
 
 ! **Swarm monitor must not self-implement (#2843 / Gap C):** When a cohort monitor receives `BLOCKED` or DONE-with-blockers from a `drive-to: merge-ready` implementation leaf, the monitor MUST NOT enter the review/fix loop inline on Tier 1 — background-dispatch ONE continuation leaf scoped `drive-to: merge-ready` on the same worktree. Monitor-inline review-cycle is permitted only on Tier 3 or with explicit operator consent (see `skills/deft-directive-swarm/SKILL.md` Phase 5 completion-notification decision tree).
 
+### Partner merge-path when implement stops at PR-open (#3153)
+
+! This skill is the **required partner** for the swarm **Envelope selection SLA** (`skills/deft-directive-swarm/references/core-phase-0.md` / Phase 3). When an implement leaf was deliberately scoped **`stop-at: pr-open`** (or a merge-ready leaf failed thin DONE and recovery chose babysit ownership), the parent/monitor MUST **not** leave the open PR without a merge-path owner.
+
+! **First-class merge-path ownership (MUST, same turn as PR ground-truth):**
+
+1. ! Spawn **or** retain **exactly one** review-cycle owner for the open PR:
+   - **Approach 1** review-monitor (`worker_role: review-monitor`) with sticky `<!-- deft:review-owner -->` lease (#3090 / #3044 / dual-invoke `review-monitor:register` when available), **or**
+   - A continuation leaf scoped **`drive-to: merge-ready`** on that PR/worktree that owns babysit → merge-ready in its tool loop, **or**
+   - Documented **parent-retained** ownership (`review_cycle: in_progress:<pr>#parent-retained`) with an explicit next poll/fix action — never silent hold.
+2. ! Route through **this skill** — ⊗ Cursor global babysit (`#2261`), freestyle main-session poll, or dual parallel monitors (`#3044`).
+3. ! Apply Owner Continuity Gate (#3090) and Single review-monitor lease (#3044) without exception: one sticky lease; force-takeover only when the prior owner is dead.
+4. ! **Post-merge `scope:complete` (#2321 / Gap C):** When the implement leaf stopped at pr-open, it MUST NOT have run `task scope:complete`. After the PR **merges**, the merge-path owner (or swarm Phase 6 `task swarm:finalize-cohort` / `task swarm:complete-cohort` / monitor) MUST run `task scope:complete` or `task scope:cancel`. `task verify:orphan-active` fails closed on stranded active briefs.
+5. ! **Human-merge / CLEAN-before-merge ownership (#3153 / #1193 / #2321):** When `plan.policy.requireHumanMerge` (or missing bot-merge authority) means the review owner reaches Greptile CLEAN / merge-ready but **cannot** squash-merge, lifecycle ownership is **not** complete. Prefer **durable** ownership (not a prose-only promise):
+   - **Preferred:** Parent/monitor **retains** ownership (`review_cycle: in_progress:<pr>#parent-retained` or sticky lease held by the long-lived monitor) until human merge lands, then runs `scope:complete` (or Phase 6 `task swarm:finalize-cohort` / `task swarm:complete-cohort`).
+   - **Allowed handoff:** Only to a **long-lived** parent/monitor / Phase 6 closer — same turn: (1) re-claim sticky `<!-- deft:review-owner -->` lease for the **recipient** (register/force as needed), (2) structured handback with PR, HEAD, `awaiting-human-merge`, and explicit post-merge `scope:complete` duty, (3) recipient acknowledges with `review_cycle: in_progress:<pr>#…` before the giving agent exits.
+   - ! Cohort through-merge: the **swarm monitor** is the default durable post-merge `scope:complete` owner for every `stop-at: pr-open` story (#2321) — do not rely on a review leaf that exits at CLEAN.
+   - ! **Post-CLEAN wake path (MUST):** After CLEAN under human-merge, the durable owner MUST keep a **reachable observe path** until the PR is `MERGED` (or closed without merge → `scope:cancel` / operator decision). Concrete options (pick one, same ownership):
+     1. **Background poller** (Approach 1 preferred when Tier 1): spawn/retain a review-monitor or short poll loop that probes `gh api repos/<owner>/<repo>/pulls/<N>` for `merged` / `state` on adaptive cadence (or host merge webhook when available), then runs post-merge verification + `scope:complete`.
+     2. **Parent-retained yield-with-wake:** parent keeps `review_cycle: in_progress:<pr>#parent-retained` and re-enters on the next operator message / scheduled re-invocation (Approach 2) with an explicit first action of "check merge state → if merged, `scope:complete`".
+     3. **Phase 6 cohort closer:** for swarm, record the PR as `awaiting-human-merge` in the monitor checkpoint and **require** the Phase 6 pre-sweep merge re-poll (`skills/deft-directive-swarm/references/core-phase-5-6.md` § Human-merge observe path / Step 1.5) before `task swarm:complete-cohort` / finalize — never skip `scope:complete` solely because Greptile was CLEAN earlier.
+   ⊗ Keep only a sticky lease with no poller, no parent re-entry plan, and no Phase 6 re-poll checklist — that is ownership-in-name-only and still strands `scope:complete`.
+   ⊗ Handoff to a short-lived leaf that exits at CLEAN without lease transfer.
+   ⊗ Emit terminal `DONE` / stand down at CLEAN when merge authority is human-only and no **reachable** durable owner (sticky lease + live parent/monitor/cohort closer **with an observe path above**) remains for post-merge `scope:complete`.
+6. ! **Thin DONE recovery (#2943 / #3153):** A failed `drive-to: merge-ready` leaf that only opened a PR is **not** success. After ground truth, hand merge path to **one** of the owners above — never improvise a second lease or re-dispatch implement + babysit in parallel without releasing the first.
+
+! **Cohort through-merge intent is unchanged:** stories still land on master. Envelope selection only assigns **who owns implement vs who owns Greptile/CI/merge** under capacity stall, conf floors, wall-clock budgets, or large multi-gate stories. Happy-path single `drive-to: merge-ready` leaves remain the default and do not use this partner handoff.
+
+! **Does not authorize:** lowering `minGreptileConfidence`, `--skip-ci` for capacity stalls, or unbounded redesign on conf-only holds (#2881 / #2672 / #3095).
+
+Cross-links: swarm decision tree `skills/deft-directive-swarm/references/core-phase-0.md` § Envelope selection SLA; Phase 3 Gap C `skills/deft-directive-swarm/references/core-phase-3.md`; thin SKILL pointer `skills/deft-directive-swarm/SKILL.md` § Envelope selection SLA.
+
 
 
 ! Select the monitoring approach based on runtime capability detection (the matrix in `skills/deft-directive-swarm/SKILL.md` Phase 3 Step 1, extended per #1342 slices 1-2 for `spawn_subagent` / "grok-build", per #1877 for Cursor as first-class Tier-1 tiers, per #2876 for OpenClaw `sessions_spawn`, and per #3134 for Claude Code `claude-code` / `claude-agent`). Probe the environment (tool set + env vars) to obtain the stable platform descriptor (`grok-build`, `warp-orchestrated`, `warp-manual`, `cursor-composer`, `cursor-cloud-agent`, `claude-code`, `openclaw`, etc.) from the launch adapter / `get_platform_capabilities` and map the descriptor to the appropriate tier + dispatch primitive (`start_agent`, `spawn_subagent`, the Cursor `Task` tool, Claude Code `Agent` / `claude-agent`, or OpenClaw `sessions_spawn`). The descriptor (not hard-coded tool presence) is the single source of truth for both launch and review monitoring.
@@ -637,6 +777,16 @@ task lifecycle:event -- emit plan:approved \
 
 ## Anti-Patterns
 
+- ⊗ Multi-hour empty-commit / close-reopen thrash after CI weather thrash caps when `ci_never_scheduled` or `ci_cancelled_no_failover` (#3167)
+- ⊗ Workflow thrash or empty-commit spam during attributed platform outage without status-page probe (#3180)
+- ⊗ Merge or `--skip-ci` solely because a status page is red without check-run evidence (#3180)
+- ⊗ Block merge-ready wait on SLizard alone when Greptile Step 6 is clean (#3167)
+- ⊗ Silent admin / `--skip-ci` merge under Actions outage without audit comment and opt-in authority (#3167)
+- ⊗ Leave a deliberate `stop-at: pr-open` (or thin-DONE recovery) open PR without spawning/retaining one review-cycle babysit owner + lease continuity and post-merge `scope:complete` plan (#3153)
+- ⊗ Stand down at CLEAN under human-merge policy without a durable owner (sticky lease + live parent/monitor/Phase 6 closer) **and** a post-CLEAN observe path (poller / parent wake / Phase 6 re-poll) for post-merge `scope:complete` (#3153 / #1193 / #2321)
+- ⊗ Handoff human-merge cleanup to a short-lived leaf that exits at CLEAN without re-claiming the sticky lease (#3153)
+- ⊗ Retain only a sticky lease after CLEAN with no poller, no parent re-entry, and no Phase 6 merge re-poll — ownership-in-name-only (#3153)
+- ⊗ Dual-lease or freestyle Cursor global babysit for the partner merge-path after implement stops at PR-open (#3153 / #2261 / #3044)
 - ⊗ End owning turn with 0 children, no sticky lease, and no finish after drive-to-merge / babysit / shepherd claim — silent hold (#3090)
 - ⊗ Emit freeform `review_cycle: started` / `pending` / `initiated` or L4 `status: pass` without `done` or verifiable `in_progress:<pr>#…` lease/parent-retained (#3090)
 - ⊗ Treat check-run SUCCESS alone as CLEAN / merge-ready while dual-source P0/P1 remain (#3090)

package/skills/deft-directive-swarm/SKILL.md

@@ -127,6 +127,19 @@ Large multi-host skills use a **host-neutral core** plus **one** per-host adapte
 
 ! After the parent emits **one** user/caller-visible consolidate for a child `runId` / settle batch, **identical or equivalent completion replay** for the same key MUST be **silent** (no tools, no re-QC, no second final; host silent token when defined, e.g. OpenClaw `NO_REPLY`). Re-open only on new `runId`/batch, principal explicit reopen, or materially new evidence (new HEAD, new blocker class). Replay storms: at most one fail-loud note, then silent. Full MUST: `templates/agent-prompt-preamble.md` §11.5. Depth: `references/core-phase-5-6.md`. Orthogonal to empty settle ≠ done (#3044).
 
+### Dual stop — repair and monitor loops (#2442)
+
+! Multi-iteration swarm **repair** and **monitor** loops MUST carry dual stop: success (goal/AC/clean gate) **and** a failure/budget stop. Single-turn probes (one status check, one heartbeat read) are exempt. Principle: `main.md` `## Dual Stop Rule (#2442)`. Defaults and halt-report shape live in [`references/core-phase-4.md`](references/core-phase-4.md) (monitor / takeover) and [`references/core-ops.md`](references/core-ops.md) (prompts + anti-patterns).
+
+! Default failure envelope for repair/monitor class work (unless the operator or xBRIEF names a stricter one):
+- **max iterations:** 3 monitor repair actions (re-dispatch, takeover complete, re-trigger review) for the same leaf/PR failure class, **or**
+- **no-progress:** same error / same Greptile P0-P1 fingerprint / same idle state **3+** times with no material worktree or review change (composes with Phase 4 "stuck in an error loop" takeover trigger), **or**
+- **budget:** existing poll caps (`pr:watch` max-wait, Greptile service-error single retry + escalate) count as budget stops -- do not invent a second unbounded poll loop outside them.
+
+! On failure stop: halt automatic continuation; emit an operator-visible report (what was tried, what is missing, what human decision is needed). ⊗ Silent re-dispatch or infinite monitor continuation after the envelope is exhausted.
+
+! Composes with minimal-subgraph repair guidance (#2439): keep repairs minimal **and** bounded by dual-stop -- minimal repair is not a license to thrash. Durable delivery/acceptance circuit-breaker: **#3143** `packages/core/src/delivery-attempt/` (`evaluatePreDispatch`, unit ledger). Docs: `docs/delivery-attempt.md`. Skill defaults remain behavioral; mechanical gate lives in core.
+
 ## Runtime Capability Detection (summary)
 
 ! Before selecting a launch method, probe the environment. Full probe text: [`references/core-phase-3.md`](references/core-phase-3.md).
@@ -174,5 +187,6 @@ Large multi-host skills use a **host-neutral core** plus **one** per-host adapte
 - ⊗ Skip Phase 0 approval before Phase 1
 - ⊗ Misclassify OpenClaw `sessions_spawn` as `grok-build` or `generic-terminal` (#2875)
 - ⊗ Misclassify Claude Code as `cursor-composer` / `generic-terminal` (#3134)
+- ⊗ Run multi-iteration repair/monitor loops without a failure stop or with silent continuation after the envelope is exhausted (#2442)
 
 Full anti-pattern list: [`references/core-ops.md`](references/core-ops.md).

package/skills/deft-directive-swarm/references/core-ops.md

@@ -44,7 +44,8 @@ TASK: You must complete N [type] fixes on this branch ([branch-name]) in the def
 This is a git worktree. Do NOT just read files and stop — you must implement all changes,
 run iteration-lane validation during implement/fix loops, full task check before push,
 commit, push, create a PR, and run the review cycle.
-DO NOT STOP until all steps are complete.
+Drive every step to completion, subject to dual-stop (#2442): if a multi-iteration fix/repair
+loop hits its failure/budget stop, halt with BLOCKED (operator-visible report) — do not thrash past the envelope.
 
 STEP 1 — Read directives: Read AGENTS.md, vbrief/vbrief.md, and the assigned xBRIEF(s) from xbrief/active/.
 Read skills/deft-directive-review-cycle/SKILL.md.
@@ -75,16 +76,21 @@ CONSTRAINTS:
 - Use conventional commits: type(scope): description
 - Iteration commits: affected/static fast lane only; full task check required before push (#1704)
 - Never force-push
+- Dual stop (#2442): multi-iteration fix/repair loops need success + failure/budget stop (build defaults: max 5 quality-fix iters or 3 identical no-progress; pre-PR: max 3 polish passes). On halt: operator-visible report (tried / missing / human decision). Single-turn work is exempt. Delivery/acceptance mechanical ledger is #3143 (`packages/core/src/delivery-attempt/` / `docs/delivery-attempt.md`).
 ```
 
 ### Template Rules
 
 - ! First line MUST start with `TASK:` followed by an imperative statement
-- ! Include `DO NOT STOP until all steps are complete` in the preamble
+- ! Include a drive-to-completion instruction that is **subordinate to dual-stop** (#2442): complete all steps unless a multi-iteration failure/budget envelope is exhausted — then `BLOCKED` with an operator-visible report (do not use unconditional "DO NOT STOP" language that overrides the failure stop)
 - ! Each task MUST include its xBRIEF filename and origin issue number
 - ! CONSTRAINTS section MUST list files the agent must not touch (other agents' scope)
 - ! Review cycle step MUST reference `skills/deft-directive-review-cycle/SKILL.md` explicitly
+- ! Multi-iteration prompts MUST name dual-stop defaults (or point at `main.md` / build skill #2442) so workers do not thrash without a failure envelope
+- ! **Unit-of-work envelope (#3153 / Gap C):** The prompt MUST declare `drive-to: merge-ready` **or** `stop-at: pr-open` (default merge-ready for story work). When `stop-at: pr-open`, state that the parent/monitor owns review-cycle babysit + post-merge `scope:complete` (worker MUST NOT `scope:complete` at exit). Selection tree: `references/core-phase-0.md` Envelope selection SLA.
 - ⊗ Start the prompt with context ("You are working in...") — agents treat this as passive setup and may stop after reading
+- ⊗ Write unconditional `DO NOT STOP until all steps are complete` without a dual-stop exception — that conflicts with the failure stop and causes thrash (#2442)
+- ⊗ Omit the unit-of-work envelope line or leave merge-path ownership ambiguous after a deliberate `stop-at: pr-open` (#3153)
 
 ## Push Autonomy
 
@@ -144,5 +150,11 @@ CONSTRAINTS:
 - ⊗ Multi-sentence progress-only first response after leaf completion announce (`subagent_announce` / parent-push) with zero tools / yield — tool-first ground-truth batch, host yield, or one short non-repeated answer only (#2943 text-repetition hang)
 - ⊗ N>2 near-identical assistant sentences in one turn with no tool_use / yield — FC14 hard-stop (`evaluateParentTurnShape` in `packages/core/src/parent-turn-shape/`; soft prose not sole mitigation) (#3131 / #2943)
 - ⊗ Treat thin DONE (completion without PR URL / merge evidence) as success — re-dispatch or take over after ground truth (#2943)
+- ⊗ Treat a `drive-to: merge-ready` exit with PR open but no merge-ready evidence as a designed handoff — it is FAILED thin DONE; recover with **one** continuation or review-cycle babysit owner, never dual lease (#3153 / #2943 / #3044)
+- ⊗ Dispatch `stop-at: pr-open` without a named review-cycle partner merge-path owner (babysit / Approach 1 monitor + sticky lease + post-merge `scope:complete` plan) (#3153)
+- ⊗ Freestyle Cursor global babysit or a second parallel review-monitor when recovering thin DONE or owning a stop-at:pr-open handoff (#2261 / #3044 / #3153)
 - ⊗ Second+ user-visible consolidate / final for the same child `runId` / settle batch without new evidence or principal reopen — completion latch silent-replay path (`templates/agent-prompt-preamble.md` §11.5 / #3092)
 - ⊗ Full dual-source re-QC solely because the harness re-delivered the same settle event (#3092)
+- ⊗ Run multi-iteration repair, monitor, or implement-fix loops without a dual-stop failure envelope (max iterations and/or no-progress and/or budget) (#2442)
+- ⊗ Silently continue, re-dispatch, or open another identical attempt after the failure stop fires — halt with an operator-visible report (what was tried, what is missing, what human decision is needed) (#2442)
+- ⊗ Treat dual-stop skill defaults as a durable delivery-attempt ledger — mechanical cross-revision circuit breaker is #3143 (`packages/core/src/delivery-attempt/`), not prompt-only thrashing control (#2442)

package/skills/deft-directive-swarm/references/core-phase-0.md

@@ -6,10 +6,43 @@
 
 ### Through-merge / N=1 still uses the launch path (#3032)
 
-! When operator intent is **through merge**, **drive to merge**, **land/ship issue**, or explicit **drive-to: merge-ready** for story work, the parent (monitor) conversation MUST NOT implement product code or own the implementation PR as the leaf. Parent MUST run this skill's launch path: worktree isolation when available, worker envelope with `drive-to: merge-ready`, xBRIEF preflight, pre-pr + review-cycle, then merge/`scope:complete` per #1880 Gap C.
+! When operator intent is **through merge**, **drive to merge**, **land/ship issue**, or explicit **drive-to: merge-ready** for story work, the parent (monitor) conversation MUST NOT implement product code or own the implementation PR as the leaf. Parent MUST run this skill's launch path: worktree isolation when available, worker envelope with the unit-of-work boundary selected below (`drive-to: merge-ready` default, or deliberate `stop-at: pr-open` per the envelope selection SLA), xBRIEF preflight, pre-pr + review-cycle, then merge/`scope:complete` per #1880 Gap C.
 ! **Cohort size N=1 is still a cohort for dispatch.** Solo through-merge uses the same swarm/solo-worker launch path as multi-story (`dispatch_kind: solo` or a one-story swarm-cohort). Do not treat "only one issue" as permission for the parent to code.
 ⊗ Parent implements, babysits product fix loops, or skips worktree + worker dispatch for through-merge / drive-to:merge-ready work when background subagent/worktree dispatch is available (#3032).
 
+### Envelope selection SLA — `drive-to: merge-ready` vs `stop-at: pr-open` (#3153)
+
+! **Cohort through-merge intent still means stories land on master.** Choosing `stop-at: pr-open` changes **who owns which mile** (implement leaf vs review-cycle babysit owner), not whether the cohort ships. Happy-path single-leaf ownership remains valid; this SLA does **not** replace Gap C with "always split."
+
+! **Default for story / through-merge dispatch:** `drive-to: merge-ready` — the implementation leaf owns implement → pre-pr → push → PR → Greptile review-cycle → CI → merge-ready (and `scope:complete` when the envelope includes that step) as **one** unit (#1880 Gap C / #3032).
+
+! **Select the envelope at Phase 0 allocation / Phase 3 dispatch prep** (before spawn). Record the choice in the worker prompt unit-of-work line. Re-evaluate only when a leaf returns `BLOCKED` / thin DONE and a **new** continuation is planned — never re-label a live `drive-to: merge-ready` leaf as if it had been `stop-at: pr-open`.
+
+#### Decision tree (concrete triggers)
+
+| Trigger | Envelope | Notes |
+|---------|----------|--------|
+| Happy path / short story / green CI expected / no wall-clock budget stated | **`drive-to: merge-ready`** (default) | One leaf owns full path; silent PR-open handback remains forbidden |
+| Operator (or xBRIEF) states a wall-clock / context budget that is likely shorter than CI + conf-floor wait | **`stop-at: pr-open` recommended** | Parent/monitor **must** spawn or retain one review-cycle babysit owner on the open PR (partner contract: `skills/deft-directive-review-cycle/SKILL.md` § Partner merge-path) |
+| Known or observed **runner capacity stall** (`ci_ready_state=runner_capacity_stall` / #2672) dominating wall clock before implement finishes | **`stop-at: pr-open` recommended** | Do not lower conf floors or `--skip-ci`; split so implement leaf does not burn host budget waiting on runners; babysit owns failover wait |
+| Large multi-gate story (many required checks, multi-round Greptile, dogfood conf floor, expected multi-hour non-impl wait) | **`stop-at: pr-open` recommended** | Keeps implement leaf focused; merge path owned by review-cycle babysit with sticky lease (#3090 / #3044) |
+| **Conf-only residual** after implement: 0 P0/P1, score below `minGreptileConfidence`, product AC met (#2881 / #3095) | Prefer **`drive-to: merge-ready`** leaf to exit **`BLOCKED`** (not thin DONE) **or** deliberate **`stop-at: pr-open`** + babysit if the split was pre-declared | Confidence-only holds are **not** a mandate to redesign; babysit offers document/accept/minimal polish — not unbounded redesign |
+| Host leaf cannot nest a review-monitor (Cursor Task / Claude Code nested-spawn limits #2797 / #3134) **and** Approach 1 sibling is desired | **`stop-at: pr-open` required** for the implement leaf | Orchestrator spawns sibling review-monitor + lease; same as existing leaf-boundary rules |
+| Explicit operator override | Honor operator | Still declare envelope in dispatch; partner ownership rules still apply |
+
+#### Thin DONE and recovery (fail-closed)
+
+! A `drive-to: merge-ready` leaf that exits with PR URL but **no** merge / merge-ready evidence is **FAILED thin DONE** (#2943 / preamble §11) — not success and not a designed handoff.
+! Recovery: parent/monitor ground-truths once, then backgrounds **exactly one** continuation owner scoped `drive-to: merge-ready` on the same worktree/PR **or** one review-cycle babysit owner with sticky `<!-- deft:review-owner -->` lease. ⊗ Dual lease / parallel babysit (#3044). ⊗ Cursor global babysit freestyle (#2261).
+! A **deliberate** `stop-at: pr-open` exit (PR open + structured handback) is **not** thin DONE — it is a designed handoff that **requires** the review-cycle partner merge-path contract immediately (same turn tool dispatch or registered owner).
+! Under human-merge policy, the partner owner (or an explicit handoff recipient) remains responsible through merge + `scope:complete` — CLEAN alone is not lifecycle complete (review-cycle partner merge-path / #1193 / #2321).
+
+⊗ Re-scope a live `drive-to: merge-ready` worker mid-flight to "PR-open is enough" without a new dispatch envelope.
+⊗ Choose `stop-at: pr-open` without a named babysit / review-monitor owner plan (silent drop of merge path).
+⊗ Lower Greptile floors, skip CI, or use `--skip-ci` as the alternative to envelope selection (#2672 / #3095).
+
+Cross-links: Phase 3 Worker-owns-lifecycle (`references/core-phase-3.md`), review-cycle partner merge-path (`skills/deft-directive-review-cycle/SKILL.md`), preamble Gap C (`templates/agent-prompt-preamble.md` § Orchestrator dispatch doctrine).
+
 ### Headless cohort fast-path: low-ceremony launch (C1 / #1387)
 
 ! When the operator supplies a **pre-approved cohort** via the **C1** `task swarm:launch` CLI, Phase 0 runs in headless / low-ceremony mode: the per-phase interactive approval gates (the Step 0c promote-fill prompts, the Step 0.5 lifecycle-bridge approval, and the Step 4/5 allocation approval) collapse into a SINGLE consent -- the `## Allocation context` token (#1378) carried in the dispatch envelope. The interactive promote-fill loop (Step 0a -- 0d below) is SKIPPED.

package/skills/deft-directive-swarm/references/core-phase-3.md

@@ -126,12 +126,18 @@ Cross-references: `packages/core/src/swarm/routing.ts` (`SWARM_WORKER_ROLES`), `
 
 ! **Worker-owns-lifecycle (Gap C):** Every implementation-worker dispatch prompt MUST declare the unit-of-work boundary: `stop-at: pr-open` OR `drive-to: merge-ready` (default for story xBRIEF work). Workers scoped `drive-to: merge-ready` own pre-PR, push, PR open, Greptile review-cycle poll/fix, and the #1259 Step 6 fail-closed exit as ONE dispatch — they spawn their own review poller per `skills/deft-directive-review-cycle/SKILL.md` monitoring tiers. The monitor MUST NOT plan a separate post-PR review leaf for a worker already scoped merge-ready.
 
+! **Envelope selection at launch (#3153):** Choose the unit-of-work boundary using the Phase 0 **Envelope selection SLA** decision tree (`references/core-phase-0.md`) before spawn. Default remains `drive-to: merge-ready`. When the tree recommends or requires `stop-at: pr-open` (capacity stall, wall-clock budget, large multi-gate, host nested-monitor limits), the monitor MUST pre-plan the **partner merge-path owner** (review-cycle babysit / Approach 1 review-monitor) and dispatch or retain that owner when the implement leaf hands back — same turn as ground-truth of PR open, not improvised thin-DONE recovery. Cohort through-merge still means land on master; only mile ownership splits.
+
+! **Deliberate `stop-at: pr-open` is not silent Gap C handback:** Silent PR-open handback for a worker whose envelope already said `drive-to: merge-ready` remains **forbidden**. A **pre-declared** `stop-at: pr-open` plus an immediately owned review-cycle babysit path is the supported alternative under the #3153 SLA. Partner contract depth: `skills/deft-directive-review-cycle/SKILL.md` § Partner merge-path when implement stops at PR-open.
+
 ! **Post-merge scope lifecycle (#2321 / Gap C):** Workers scoped `stop-at: pr-open` MUST NOT run `task scope:complete` before exit — their activation checkpoint rides into master on merge. The monitor (or Phase 6 `task swarm:finalize-cohort` / `task swarm:complete-cohort` on the headless path) MUST run `task scope:complete` or `task scope:cancel` for each shipped story xBRIEF after its PR merges. Workers scoped `drive-to: merge-ready` (or `drive-to: merge`) MUST include `task scope:complete` on their active xBRIEF as part of the same unit of work (after merge when appropriate). `task verify:orphan-active` fails closed when active/running briefs remain after their issues close or PR merges.
 
 ! **Background / independent dispatch (Gap D):** Dispatch implementation, fix, and review-cycle workers independently / in the background when the platform supports it. On Cursor, use the Task tool background path (`run_in_background: true`); on Claude Code, use the `Agent` tool with `run_in_background: true` (or host equivalent) (#3134); on OpenClaw, use `sessions_spawn` with the host's non-blocking / background session flags so the monitor conversation stays interactive. Foreground dispatch is for short tasks (<~3 min) only.
 
 ⊗ Hand back at PR-open and re-dispatch separate review-monitor or fix leaf agents for a worker whose envelope scoped `drive-to: merge-ready` (#1880 Gap C).
 
+⊗ Dispatch `stop-at: pr-open` without a named review-cycle babysit / merge-path owner plan — that drops the merge mile (#3153).
+
 ⊗ Foreground/blocking dispatch for long-running implementation, fix, or review-cycle workers when background dispatch is available (#1880 Gap D).