@mmerterden/multi-agent-pipeline 18.0.0 → 19.1.0

package/docs/features.md

@@ -4,18 +4,19 @@ Comprehensive list of every feature the pipeline ships. The top-level `README.md
 
 ## Core Pipeline
 
-### 8-Phase Orchestration (0-7)
+### 6-Phase Orchestration (0-5)
 
 ```
 Phase 0: Init      Project selection, branch setup, identity, worktree
-Phase 1: Analysis  Stack detection, codebase exploration (parallel Explore agents)
-Phase 2: Planning  Task decomposition, architecture review, user approval
-Phase 3: Dev       TDD cycle: test → code → build (Sonnet)
-Phase 4: Review    Deterministic gates + parallel AI review + Fable triage
+Phase 1: Plan      Stack detection, codebase exploration (parallel Explore agents),
+                   task decomposition, architecture review, user approval
+Phase 2: Dev       TDD cycle: test → code → build (Sonnet), then the Verify exit
+                   gate: build · lint · tests · secrets, run once
+Phase 3: Review    Parallel AI review + Fable triage against Dev's logs, then the
+                   optional user test + on-demand device audits
                    (Claude Code: Fable + Opus + Sonnet · Copilot CLI: GPT-5.4 + Opus + Sonnet)
-Phase 5: Test      Optional manual testing + on-demand device audits
-Phase 6: Commit    Git commit, push, PR with default reviewers + draft/ready prompt
-Phase 7: Report   External: Jira comment · Wiki + Figma screenshots · Confluence
+Phase 4: Commit    Git commit, push, PR with default reviewers + draft/ready prompt
+Phase 5: Report    External: Jira comment · Wiki + Figma screenshots · Confluence
                    Internal: agent-log.md + Quality & Metrics + knowledge + memory
 ```
 
@@ -28,7 +29,7 @@ Each phase reads its own spec file under `pipeline/multi-agent-refs/phases/phase
 | `autopilot` | Skip all confirmation prompts; still fails safe on review blockers + build retries. |
 | `--local`   | Answers the workspace question up front: no worktree, work directly in `$PROJECT_ROOT` on a local branch. |
 
-Neither the workspace nor the depth is a flag. **Where the branch lives** is asked at Phase 0 Step 5b - worktree (`.worktrees/{id}/`, your checkout untouched) or local (the project root, which drops Phase 5 because the user-test gate checks the change out of a worktree and there is none). `:local` and `--local` state it in advance; every autopilot entry resolves it to a worktree and never asks, because an unattended run commits and pushes from wherever it stands and doing that in the user's own checkout is what worktrees exist to prevent. `state.workspaceSource` records who decided - `localMode: false` alone is both "the user chose a worktree" and "nothing asked".
+Neither the workspace nor the depth is a flag. **Where the branch lives** is asked at Phase 0 Step 5b - worktree (`.worktrees/{id}/`, your checkout untouched) or local (the project root, which drops the user test because that gate checks the change out of a worktree and there is none). `:local` and `--local` state it in advance; every autopilot entry resolves it to a worktree and never asks, because an unattended run commits and pushes from wherever it stands and doing that in the user's own checkout is what worktrees exist to prevent. `state.workspaceSource` records who decided - `localMode: false` alone is both "the user chose a worktree" and "nothing asked".
 
 Depth is not a flag either. `/multi-agent` and `/multi-agent:local` ask Full or Short at Phase 0 Step 7.5, recommending from the detected `taskType`; Short strips to Init → Dev(Opus self-contained) → Review → Test → Commit → Report. Autopilot never asks and always runs Full - "fast plus unattended" was removed in v16.0.0, because something has to choose when nobody is asked and unattended is the worst place to drop analysis and planning.
 
@@ -38,7 +39,7 @@ The install is not only useful while `/multi-agent` is running. `rules/outside-t
 
 - **Onboarded service credentials.** Resolve the logical name through `credential-store.sh` and read the issue, page or log. Writes route through the pipeline commands, which carry the rules that make them safe - issues are never auto-closed, PR bodies use `Ref:`, outward prose goes through the humanizer.
 - **The stack skills enabled for this repo.** Each toolkit's own `index` skill routes. The pipeline reads the effective `enabledPlugins` rather than keeping a stack table, so a seventh toolkit needs no code change.
-- **The `multi-agent-toolkit` MCP.** 99 tools for a running app.
+- **The `multi-agent-toolkit` MCP.** 115 tools for a running app.
 
 Uninstall preserves the whole layer - tokens, the reader that opens them, the mapping that names them, the MCP registration. It is 1.5 kB of always-loaded text; the detail lives in a ref that loads on demand, and a gate keeps both under a ceiling because every byte there is paid by every session.
 
@@ -46,7 +47,7 @@ Uninstall preserves the whole layer - tokens, the reader that opens them, the ma
 
 A deterministic, LLM-free map of what a repo declares and what refers to what, extracted by regex over comment-stripped source into `~/.claude/knowledge/<project>/code-graph.json`. Four stacks build today (Swift, Kotlin/Java, TypeScript/JavaScript, Python); each is one rules file, and the engine is the same for all of them. Zero runtime dependencies, zero API cost, read-only on the repo.
 
-Phase 1 queries it to hand Explore a ranked starting file set instead of a full scan, and Phase 7 rebuilds it after the branch changed code - a rebuild is seconds, so staleness is a `baseCommit` comparison rather than a date heuristic. Off by default behind `prefs.global.codeGraph.enabled`; with it off the pipeline behaves exactly as before.
+Phase 1 queries it to hand Explore a ranked starting file set instead of a full scan, and Phase 5 rebuilds it after the branch changed code - a rebuild is seconds, so staleness is a `baseCommit` comparison rather than a date heuristic. Off by default behind `prefs.global.codeGraph.enabled`; with it off the pipeline behaves exactly as before.
 
 `GRAPH_REPORT.md` also ends with **Symbols nothing else references**: symbols no other file in the repo names, split from the ones referenced only by their own tests. Candidates, never verdicts - the extractor is regex, not a parser, so the four classes that could not carry a reference edge either way (a kind outside the stack's `referenceKinds`, a name declared twice, a nested declaration, a test file) are counted and excluded rather than listed, and nothing gates on the result.
 
@@ -78,9 +79,9 @@ Stack skill sets ship as versioned plugins in the `multi-agent-plugins` marketpl
 /multi-agent:stack all         # every stack plugin
 ```
 
-### Package Manager Resolution (Phase 3, node-shaped stacks)
+### Package Manager Resolution (Phase 2, node-shaped stacks)
 
-Phase 3's web test arm and its build step used to type `npm`. A repo on pnpm, yarn or bun then failed in Phase 3 - with a worktree and a branch already created - or, worse, npm resolved against a lock file it does not own and the run continued on a tree the repo's own tooling would never have produced.
+Phase 2's web test arm and its build step used to type `npm`. A repo on pnpm, yarn or bun then failed in Phase 2 - with a worktree and a branch already created - or, worse, npm resolved against a lock file it does not own and the run continued on a tree the repo's own tooling would never have produced.
 
 `scripts/package-manager.mjs` resolves it from the repo instead: `$MA_PACKAGE_MANAGER`, then `package.json#packageManager`, then a lock file, then npm - reported AS a default, never as evidence, because "npm because nothing said otherwise" and "npm because the repo committed a package-lock" are different answers. Node core only (ADR-0004): a resolver that shelled out would need a working install of the tool it is identifying. The walk goes up to the directory holding `.git` and stops there, so a monorepo's root lock file is found and a stray one in a home directory is not. Two lock files means a migration left one behind: the newest wins and both are named.
 
@@ -121,15 +122,15 @@ Result persisted to `agent-state.taskType`:
 
 | Type        | Downstream effects                                                            |
 | ----------- | ----------------------------------------------------------------------------- |
-| `component` | Phase 3 dispatches to the marketplace component plugin (create-component) with SubPhase reporting |
-| `bugfix`    | Phase 4 emphasizes test coverage + regression; Phase 6 uses `fix(...)` prefix |
-| `feature`   | Standard TDD flow; Phase 6 uses `feat(...)` prefix                            |
-| `refactor`  | Phase 4 emphasizes behavior preservation; Phase 6 uses `refactor(...)` prefix |
-| `chore`     | Lightweight flow; Phase 6 uses `chore(...)` prefix                            |
+| `component` | Phase 2 dispatches to the marketplace component plugin (create-component) with SubPhase reporting |
+| `bugfix`    | Phase 3 emphasizes test coverage + regression; Phase 4 uses `fix(...)` prefix |
+| `feature`   | Standard TDD flow; Phase 4 uses `feat(...)` prefix                            |
+| `refactor`  | Phase 3 emphasizes behavior preservation; Phase 4 uses `refactor(...)` prefix |
+| `chore`     | Lightweight flow; Phase 4 uses `chore(...)` prefix                            |
 
 ### SubPhase Convention
 
-When a specialized skill takes over a main pipeline phase, progress is reported as SubPhases (e.g. `SubPhase 3.0: Init`, `SubPhase 3.1: Gather`). The top-level pipeline stays fixed at 8 phases (0-7) - specialized work slots into its parent phase without inflating the count.
+When a specialized skill takes over a main pipeline phase, progress is reported as SubPhases (e.g. `SubPhase 3.0: Init`, `SubPhase 3.1: Gather`). The top-level pipeline stays fixed at 6 phases (0-5) - specialized work slots into its parent phase without inflating the count.
 
 ## PR & Review Flow
 
@@ -141,14 +142,14 @@ When a specialized skill takes over a main pipeline phase, progress is reported
 
 ### Draft vs Ready Prompt
 
-Phase 6 asks `DRAFT or READY?` before creating the PR and persists the choice in `prefs.projects[].defaultPrMode`.
+Phase 4 asks `DRAFT or READY?` before creating the PR and persists the choice in `prefs.projects[].defaultPrMode`.
 
 - Bitbucket: `draft: true` flag (DC 8.x+) with `[DRAFT]` title fallback for older servers.
 - GitHub: `gh pr create --draft` + `gh pr ready` for promotion.
 
 ### `channels` Command
 
-Multi-channel reporter - Phase 7 delegates to it, and it's also invocable post-hoc for fixes closed outside the pipeline:
+Multi-channel reporter - Phase 5 delegates to it, and it's also invocable post-hoc for fixes closed outside the pipeline:
 
 ```bash
 /multi-agent:channels                              # current branch, current PR
@@ -170,7 +171,7 @@ Never auto-closes issues - uses `Ref: #N` / `Related: #N` / `See: PROJ-12345`, n
 
 ## Review Quality
 
-### Deterministic Gates (Phase 4 Step 1)
+### Deterministic Gates (Phase 3 Step 1)
 
 Cheap, objective checks run BEFORE any AI token is spent:
 
@@ -181,23 +182,23 @@ Cheap, objective checks run BEFORE any AI token is spent:
 
 If any gate fails, fix first. Don't waste AI tokens reviewing broken code.
 
-### Analysis Document Review (Phase 3.2 + 3.3)
+### Analysis Document Review (Phase 2.2 + 2.3)
 
 `/multi-agent:analysis` published behind a structural validator alone until v16.12.0: nothing read the
-document before it reached Confluence. Phase 3.2 now runs the same reviewer set and triage a code diff
+document before it reached Confluence. Phase 2.2 now runs the same reviewer set and triage a code diff
 gets, on the draft, before the destination is even chosen. Its first question is what the run skipped -
 an input declared missing that nothing searched for, an open question about evidence nobody read, a gap
 with no owner, a scope call made without asking. A blocking finding returns to synthesis with dispatch
 closed; it never becomes an open question, because "the document is wrong" is not something to ask the
 reader.
 
-Phase 3.3 then sorts what is left: reachable evidence is searched (never asked about), decisions the
+Phase 2.3 then sorts what is left: reachable evidence is searched (never asked about), decisions the
 user owns are asked with `AskUserQuestion`, and only genuinely external gaps enter the document as
 `AS-NN` rows with an owner. A gap carrying neither a `searched, not found` nor an `asked, external`
 stamp fails the dispatch gate. Autopilot runs both phases; only the asking degrades, into rows stamped
 `autopilot: could not ask`.
 
-### CLI-Aware Parallel Review + Fable Triage (Phase 4 Steps 2-3)
+### CLI-Aware Parallel Review + Fable Triage (Phase 3 Steps 2-3)
 
 | Reviewer   | Model               | Focus                             | Where it runs        |
 | ---------- | ------------------- | --------------------------------- | -------------------- |
@@ -207,7 +208,7 @@ stamp fails the dispatch gate. Autopilot runs both phases; only the asking degra
 
 The reviewer set is **CLI-aware**: Claude Code dispatches 3 reviewers in parallel (Fable + Opus + Sonnet - Opus fills the slot GPT-5.4 takes elsewhere); Copilot CLI dispatches all 3. Each returns structured JSON for deterministic aggregation. Cross-model diversity catches blind spots that any single model family would miss.
 
-**Fable Triage** (Phase 4 Step 3, Opus on Copilot CLI): Evaluates merged raw findings against task scope. Classifies each as `accepted` (fix now), `deferred` (out of scope, log for later), or `rejected` (false positive / noise). Only triage-accepted blocking items loop back to Phase 3.
+**Fable Triage** (Phase 3 Step 3, Opus on Copilot CLI): Evaluates merged raw findings against task scope. Classifies each as `accepted` (fix now), `deferred` (out of scope, log for later), or `rejected` (false positive / noise). Only triage-accepted blocking items loop back to Phase 3.
 
 ### Runtime Triage Validator
 
@@ -224,13 +225,13 @@ After triage returns, output is validated by `validate-triage.mjs`:
 
 If triage returns `approved: false` but has no blocking items, the validator forces `approved: true`. Conversely, if `approved: true` but blocking items exist, it forces `approved: false`. Hardened with an `if`/`then` constraint in the schema itself.
 
-### Verify-by-Test Triage (Phase 4 Step 3.7, opt-in)
+### Verify-by-Test Triage (Phase 3 Step 3.7, opt-in)
 
-A triage verdict is a judgment call; a failing repro test is proof. When `prefs.global.verifyByTest.enabled` is on, one verifier agent (default Sonnet) writes a minimal repro test per accepted blocking finding (cap: `maxFindings`=3) and runs only that test. Fails as predicted -> finding confirmed, the repro test becomes the Phase 3 rework RED test. Passes under `evidence-gate.mjs` -> finding downgraded to `deferred`. Compile error / timeout -> `inconclusive`, judgment stands. Timeout-bounded, never blocks. Full spec: `refs/features/verify-by-test.md`.
+A triage verdict is a judgment call; a failing repro test is proof. When `prefs.global.verifyByTest.enabled` is on, one verifier agent (default Sonnet) writes a minimal repro test per accepted blocking finding (cap: `maxFindings`=3) and runs only that test. Fails as predicted -> finding confirmed, the repro test becomes the Phase 2 rework RED test. Passes under `evidence-gate.mjs` -> finding downgraded to `deferred`. Compile error / timeout -> `inconclusive`, judgment stands. Timeout-bounded, never blocks. Full spec: `refs/features/verify-by-test.md`.
 
 ### Immutable-Test Rule + `test_lines_removed` Signal
 
-Existing tests are immutable during a task: deleting, renaming, or weakening an assertion to reach green is a violation (`refs/rules.md`, Phase 3 GREEN step). A test changes only when the task changes the spec it encodes, named in the commit body. Deterministic backstop: `diff-risk-score.mjs` emits `test_lines_removed` (w=3.0) for any test-classified file whose diff removes more lines than it adds.
+Existing tests are immutable during a task: deleting, renaming, or weakening an assertion to reach green is a violation (`refs/rules.md`, Phase 2 GREEN step). A test changes only when the task changes the spec it encodes, named in the commit body. Deterministic backstop: `diff-risk-score.mjs` emits `test_lines_removed` (w=3.0) for any test-classified file whose diff removes more lines than it adds.
 
 ### Update Check at Run Start
 
@@ -244,7 +245,7 @@ Phase 0 Step 0.6. Once per `ttlHours` window (cached, 3s-bounded curl to the npm
 
 Every phase transition appends a `## Handoff` block (Done / Remaining / Decisions / Open findings / Next) to `agent-log.md` - orchestrator-written from existing state, no LLM call. `/multi-agent:resume` and post-`/compact` re-grounding read the latest handoff first, so long runs re-enter from durable artifacts instead of conversation memory (fresh-context discipline from Anthropic's long-running-agent harness guidance).
 
-### Accessibility Code Review (Phase 4 Step 1.5)
+### Accessibility Code Review (Phase 3 Step 1.5)
 
 If changes include UI files, reviewers check for:
 
@@ -256,16 +257,16 @@ Pure code analysis - no simulator needed. Device-level audits run in Phase 5 whe
 
 ### Status Enforcement
 
-Phase 3 treats the issue-tracker status update as a required step with a post-mutation verify step that re-reads the field and retries once on silent `VALIDATION` failures (e.g. stale Projects V2 option IDs after a board rebuild).
+Phase 2 treats the issue-tracker status update as a required step with a post-mutation verify step that re-reads the field and retries once on silent `VALIDATION` failures (e.g. stale Projects V2 option IDs after a board rebuild).
 
 ## Safety & Hygiene
 
 - **Pre-Commit Secret Detection** (12 patterns): `PreToolUse` hook scans staged files for API keys/tokens, AWS access keys, private keys, `.env` files, service account JSON. Commit **blocked** if found.
 - **Read-Size Gate** (opt-in, `prefs.global.bulkRead.mode`): a `PreToolUse` hook inspects `Read` and the shell commands that read a file whole. In `observe` it only logs what it would have caught - the baseline you measure before routing anything. In `enforce` a file over `minLines` (default 350) is blocked and delegated to a haiku-rung worker (`bulk-read.sh`), which returns a line-numbered summary so the follow-up is a bounded `Read(offset:limit:)` instead of the whole file; the full text is parked under `.multi-agent/refs/`. The development phase and any file the run has already touched are exempt, because Claude Code's `Edit` requires its own `Read` first.
-- **Capture Hooks** (`SessionEnd`, `PreCompact`, `SessionStart`): every durable write used to live in Phase 7, the phase a run is least likely to reach. `SessionEnd` flushes a run that never got there; `PreCompact` flushes before an auto-compaction summarizes a long phase mid-flight, which is the same loss one level down; `SessionStart` prints at most two lines about an unfinished run. None calls a model, none reads a payload, and all exit 0 on every path - a hook that fails a session over bookkeeping is worse than the bookkeeping.
+- **Capture Hooks** (`SessionEnd`, `PreCompact`, `SessionStart`): every durable write used to live in Phase 5, the phase a run is least likely to reach. `SessionEnd` flushes a run that never got there; `PreCompact` flushes before an auto-compaction summarizes a long phase mid-flight, which is the same loss one level down; `SessionStart` prints at most two lines about an unfinished run. None calls a model, none reads a payload, and all exit 0 on every path - a hook that fails a session over bookkeeping is worse than the bookkeeping.
 - **Operational Reporting** (`prefs.global.usageLog`): coarse run metadata - task id, phase, status, durations, token counts - and never prompts, code, diffs or absolute paths. The per-machine token is REQUESTED from the endpoint by `usage-register.mjs` (setup, update, and the Phase 0 exit gate as a backstop), is write-only, and lives in the OS credential store; prefs hold only the entry name and the switch. `usageLog.optOut: true` blocks registration permanently and is checked before the network call. An unreachable endpoint leaves reporting off with one line and exit 0 - a run is never failed over bookkeeping.
 - **Build Queue**: All `xcodebuild` calls acquire a lock. Each worktree uses own `-derivedDataPath`. Stale locks auto-clean after 15 min. Non-Xcode builds don't need the lock.
-- **Context Management**: `CLAUDE_AUTOCOMPACT_PCT_OVERRIDE=65` - compaction at 65% usage (prevents degradation in 8-phase sessions).
+- **Context Management**: `CLAUDE_AUTOCOMPACT_PCT_OVERRIDE=65` - compaction at 65% usage (prevents degradation in 6-phase sessions).
 - **3-Iteration Hard Kill**: Any retry loop stops after 3 attempts, then pauses for user. No infinite loops.
 
 ## Testing & Quality
@@ -300,51 +301,51 @@ Per-phase token budgets prevent runaway sessions. If a phase exceeds its budget,
 - **Cost Telemetry**: Per-phase token cost tracking (`tokens_in`, `tokens_out`, `model`, `duration_ms`). Omitted fields handled gracefully.
 - **Phase Tracker**: Cross-CLI visual progress (current phase, elapsed time, iteration count).
 - **Phase Banner**: Terminal UI for phase transitions with Unicode box-drawing characters.
-- **Per-task Cost Breakdown in agent-log.md**: Phase 7 appends a 4-column block (Phase · Model · Tokens in/out · Est. USD) to every run's `agent-log.md`. Sourced from `phase-tracker.sh tokens` accumulators × `cost-table.json` prices. Independent of the channels-side `reportContent.costSummary` toggle. The `LOG_METRIC_FORWARD_TO_TRACKER=1` env flag mirrors `tokens_in`/`tokens_out`/`model` from `log-metric.sh` into the tracker so JSONL metrics and the cost block stay in sync from one call site.
+- **Per-task Cost Breakdown in agent-log.md**: Phase 5 appends a 4-column block (Phase · Model · Tokens in/out · Est. USD) to every run's `agent-log.md`. Sourced from `phase-tracker.sh tokens` accumulators × `cost-table.json` prices. Independent of the channels-side `reportContent.costSummary` toggle. The `LOG_METRIC_FORWARD_TO_TRACKER=1` env flag mirrors `tokens_in`/`tokens_out`/`model` from `log-metric.sh` into the tracker so JSONL metrics and the cost block stay in sync from one call site.
 
 ### Diff Risk Scoring
 
-`pipeline/scripts/diff-risk-score.mjs` runs at Phase 4 Step 1.75 - before reviewer dispatch. Heuristic, deterministic, sub-second, no LLM. Top-N risk-ranked files inject into each reviewer's prompt as a `${PRIORITY_FILES}` block; reviewers read those files first but still review the entire diff.
+`pipeline/scripts/diff-risk-score.mjs` runs at Phase 3 Step 1.75 - before reviewer dispatch. Heuristic, deterministic, sub-second, no LLM. Top-N risk-ranked files inject into each reviewer's prompt as a `${PRIORITY_FILES}` block; reviewers read those files first but still review the entire diff.
 
 Signals + weights: `security_path` ×3, `migration` ×4, `public_api` ×2, `no_test_change` ×2.5, `test_lines_removed` ×3 (test file shrinks - immutable-test backstop), `complexity_delta` ×1.5, `ui_critical` ×1.5, `loc_changed` ×1. Toggle via `prefs.global.diffRiskAdvisory` (default ON).
 
 ### Test Gap Detection
 
-`pipeline/scripts/test-gap-scan.mjs` runs at Phase 5 Step 0. Walks the diff for newly added public symbols and reports those with no paired test. Stack-specific rules ship for iOS, Android, Python, Node.js. iOS Views and Android `@Composable` symbols default to `important`; other public API additions to `suggestion`. Optional gating via `prefs.testGap.blockingThreshold` - when set, the report becomes a Phase 4 rework finding once `important + blocking` count exceeds the threshold.
+`pipeline/scripts/test-gap-scan.mjs` runs at Phase 3 Step 0. Walks the diff for newly added public symbols and reports those with no paired test. Stack-specific rules ship for iOS, Android, Python, Node.js. iOS Views and Android `@Composable` symbols default to `important`; other public API additions to `suggestion`. Optional gating via `prefs.testGap.blockingThreshold` - when set, the report becomes a Phase 4 rework finding once `important + blocking` count exceeds the threshold.
 
 ### Visual Evidence (UI changes)
 
 A UI change carries its own picture. `state.visualEvidence.required` is decided mechanically from `taskType` plus the changed-file list, never from a reading of the task.
 
-**Stills.** The "before" is the reporter's own ticket attachment, harvested in Phase 0; the pipeline never rebuilds the old state to photograph it. The "after" is captured in Phase 3 right after the build goes green, not Phase 5, which autopilot and both local modes drop. `capture-evidence.sh` cleans the status bar and downscales to 1242px so two captures of one screen differ by the change and not by the clock.
+**Stills.** The "before" is the reporter's own ticket attachment, harvested in Phase 0; the pipeline never rebuilds the old state to photograph it. The "after" is captured in Phase 2 right after the build goes green, not in the user test, which autopilot and both local modes drop. `capture-evidence.sh` cleans the status bar and downscales to 1242px so two captures of one screen differ by the change and not by the clock.
 
-**The flow video rides on a test run.** `probe-evidence-capability.sh` measures the UI test target, the tests matching this change, the device, the recorder and the MCP registration; Phase 0 Step 7.7 then asks the depth with the options built from that measurement, and a closed option keeps its row and states why. Tier 1 runs the repo's own UI test and records around it, tier 2 drives the flow through `agent_run_steps`, tier 3 records nothing and says so. The tier is re-checked before the recording starts, because a simulator booted at intake can be gone by Phase 3.
+**The flow video rides on a test run.** `probe-evidence-capability.sh` measures the UI test target, the tests matching this change, the device, the recorder and the MCP registration; Phase 0 Step 7.7 then asks the depth with the options built from that measurement, and a closed option keeps its row and states why. Tier 1 runs the repo's own UI test and records around it, tier 2 drives the flow through `agent_run_steps`, tier 3 records nothing and says so. The tier is re-checked before the recording starts, because a simulator booted at intake can be gone by Phase 2.
 
 UI test detection keys on `XCUIApplication` rather than on a folder named `*UITests`: in a real app the overwhelming majority of files under such a path are snapshot tests, which never launch the app and would produce a still frame filed as a flow.
 
-**Where it lands.** Jira takes both stills and video as attachments. With no Jira the stills go to an orphan `evidence/<task-id>` branch and the PR body embeds them, or links them with a blob permalink when the repo is private (GitHub's image proxy has no credentials for a private repo, and a broken image reads as missing evidence). Phase 6 blocks when a required artefact is neither published nor explained; the gate is against silence, not against an honest "the ticket carries no image".
+**Where it lands.** Jira takes both stills and video as attachments. With no Jira the stills go to an orphan `evidence/<task-id>` branch and the PR body embeds them, or links them with a blob permalink when the repo is private (GitHub's image proxy has no credentials for a private repo, and a broken image reads as missing evidence). Phase 4 blocks when a required artefact is neither published nor explained; the gate is against silence, not against an honest "the ticket carries no image".
 
 Toggle via `prefs.global.visualEvidence.enabled` (default ON), `visualEvidence.githubHost`, `visualEvidence.maxAttachmentMb`, `visualEvidence.maxVideoSeconds`, `prefs.global.testDepth.default`.
 
 ### Triage Memory
 
-Per-repo append-only JSONL corpus at `~/.claude/memory/multi-agent/<repo-slug>/triage-corpus.jsonl`. Phase 7 ingests every triage output (idempotent), Phase 1 enriches the analysis with similar past tasks, Phase 4 triage attaches prior-art hits to each raw finding with an explicit bias hedge. Token-overlap recall, zero deps, Node-18-compatible. `/multi-agent:search "<text>" --semantic` routes the query to the corpus instead of agent-log grep. Toggle via `prefs.global.priorArtEnrichment.enabled` (default ON).
+Per-repo append-only JSONL corpus at `~/.claude/memory/multi-agent/<repo-slug>/triage-corpus.jsonl`. Phase 5 ingests every triage output (idempotent), Phase 1 enriches the analysis with similar past tasks, Phase 3 triage attaches prior-art hits to each raw finding with an explicit bias hedge. Token-overlap recall, zero deps, Node-18-compatible. `/multi-agent:search "<text>" --semantic` routes the query to the corpus instead of agent-log grep. Toggle via `prefs.global.priorArtEnrichment.enabled` (default ON).
 
 ## Learning
 
 ### Knowledge Base (per project)
 
-Incremental learning. Phase 7 captures architecture, patterns, gotchas, and decisions into `$HOME/.claude/knowledge/{project}/`. Phase 1 reads it on the next run. Token cost decreases over time as the base grows.
+Incremental learning. Phase 5 captures architecture, patterns, gotchas, and decisions into `$HOME/.claude/knowledge/{project}/`. Phase 1 reads it on the next run. Token cost decreases over time as the base grows.
 
 ### Memory Capture (cross-session)
 
-Pipeline learns behavioral signals (feedback corrections, project constraints, external references). Phase 7 saves, Phase 1 injects. Max 3 new memories per run. Merge-over-duplicate. Stale memories verified before use.
+Pipeline learns behavioral signals (feedback corrections, project constraints, external references). Phase 5 saves, Phase 1 injects. Max 3 new memories per run. Merge-over-duplicate. Stale memories verified before use.
 
 **What does NOT go in memory**: architecture, code patterns, build gotchas, design decisions - those belong in the knowledge base.
 
 ### Lesson Diagnosis (Reflexion)
 
-Phase 4's lesson-memory loop records the causal root cause of each fix (`--diagnosis`), not just the outcome: the verbal "why" that prevents recurrence (Reflexion). `learnings-ledger.mjs brief` renders it as `(why: ...)` back into Phase 1 + triage on the next run, so the reason re-enters the loop, not only the symptom.
+Phase 3's lesson-memory loop records the causal root cause of each fix (`--diagnosis`), not just the outcome: the verbal "why" that prevents recurrence (Reflexion). `learnings-ledger.mjs brief` renders it as `(why: ...)` back into Phase 1 + triage on the next run, so the reason re-enters the loop, not only the symptom.
 
 ### Corpus Freshness Gate
 
@@ -366,7 +367,7 @@ Turn a recurring, project-specific job into a first-class `/multi-agent:<name>`
 
 ### Figma / Component Generation (dispatched to marketplace plugins)
 
-Component + Figma-to-code work is no longer bundled in this repo. When Phase 0 classifies a task as `component`, Phase 3 dispatches it to the per-stack marketplace plugins (`ai-ios-toolkit` / `ai-android-toolkit` in the `multi-agent-plugins` marketplace) via the Skill tool. The plugin's component skill generates `{Name}Configuration.swift`, `{Name}View.swift`, `{Name}+Modifiers.swift`, `{Name}.figma.swift`, and `FIGMA.md` with a variant matrix, then runs a 14-item pre-commit checklist covering design tokens, accessibility, tests, and Code Connect.
+Component + Figma-to-code work is no longer bundled in this repo. When Phase 0 classifies a task as `component`, Phase 2 dispatches it to the per-stack marketplace plugins (`ai-ios-toolkit` / `ai-android-toolkit` in the `multi-agent-plugins` marketplace) via the Skill tool. The plugin's component skill generates `{Name}Configuration.swift`, `{Name}View.swift`, `{Name}+Modifiers.swift`, `{Name}.figma.swift`, and `FIGMA.md` with a variant matrix, then runs a 14-item pre-commit checklist covering design tokens, accessibility, tests, and Code Connect.
 
 The plugin's cross-cutting integration skills feed component detection + implementation when the design triggers them (content: form / price / ui-patterns; interaction: navigation / overlays / bottom-sheets). Each is native-SwiftUI-first and reads project specifics (token namespaces, component paths, UI systems) from `figma-config`, including the optional `ui.navigationSystem` / `ui.overlaySystem` / `ui.sheetSystem` hooks (absent -> stock SwiftUI), so the same capabilities work on any SwiftUI codebase. The plugin's evolve-component skill reconciles an existing component against current Figma (drift-heal) and additively extends it, behind a human gate.
 
@@ -376,20 +377,20 @@ Automated visual testing and compliance audits via direct Bash (no MCP server de
 
 | Audit                 | When                | Command                      |
 | --------------------- | ------------------- | ---------------------------- |
-| iOS Accessibility     | Phase 5, on request | `swift ui-tree-dumper.swift` |
-| Android Accessibility | Phase 5, on request | `adb shell uiautomator dump` |
-| iOS Biometric         | Phase 5, auth flow  | `xcrun simctl keychain`      |
-| Android Launch Time   | Phase 5, perf       | `adb shell am start -W`      |
-| iOS Archive           | Phase 6, release    | `codesign`, `plutil`, `nm`   |
-| Android APK           | Phase 6, release    | `aapt2`, `apksigner`         |
+| iOS Accessibility     | Phase 3, on request | `swift ui-tree-dumper.swift` |
+| Android Accessibility | Phase 3, on request | `adb shell uiautomator dump` |
+| iOS Biometric         | Phase 3, auth flow  | `xcrun simctl keychain`      |
+| Android Launch Time   | Phase 3, perf       | `adb shell am start -W`      |
+| iOS Archive           | Phase 4, release    | `codesign`, `plutil`, `nm`   |
+| Android APK           | Phase 4, release    | `aapt2`, `apksigner`         |
 
 Audits are **on-demand** - triggered by user, never automatic.
 
 ### Jira + Confluence
 
-- Phase 3: transition issue to `In Progress` (verified post-mutation).
-- Phase 7: post analysis + test scenarios as Jira comment (Turkish by default, configurable).
-- Phase 7 (optional): create Confluence page under chosen parent, cached per project.
+- Phase 2: transition issue to `In Progress` (verified post-mutation).
+- Phase 5: post analysis + test scenarios as Jira comment (Turkish by default, configurable).
+- Phase 5 (optional): create Confluence page under chosen parent, cached per project.
 
 ### Keychain
 

package/docs/performance.md

@@ -13,7 +13,7 @@ node pipeline/scripts/aggregate-metrics.mjs
 # Markdown table (for PR descriptions, wikis, dashboards)
 node pipeline/scripts/aggregate-metrics.mjs --markdown
 
-# JSON (for machine consumption - Phase 7 report uses this)
+# JSON (for machine consumption - Phase 5 report uses this)
 node pipeline/scripts/aggregate-metrics.mjs --json
 
 # Filtered - only recent runs
@@ -77,7 +77,7 @@ _Source: ~/.claude/logs/multi-agent/metrics.jsonl · Events: 421 (0 parse errors
 - **`cycles per task avg` > 2.0** - triage is rejecting too many real findings
   or Phase 3 isn't converging. Inspect the edge-cases table.
 - **Most-common edge case = `over_rejection_guard_tripped`** - the triage
-  prompt lost scope context. Look at `phase-4-review.md:57-91`.
+  prompt lost scope context. Look at `phase-3-review.md:57-91`.
 - **`p95` much higher than `avg`** - a few tasks are looping 3+ times. Usually
   means one of: bad acceptance criteria in Phase 2, tests that flake, or
   environment-dependent build failures.
@@ -103,11 +103,11 @@ Current totals (v3.5.0):
 Lazy loading keeps these off the model's context until each phase actually
 runs - the full 14 k total is never loaded at once.
 
-## Embedding Metrics in Phase 7 Reports
+## Embedding Metrics in Phase 5 Reports
 
-Phase 7 automatically calls `aggregate-metrics.mjs --json` with the current
+Phase 5 automatically calls `aggregate-metrics.mjs --json` with the current
 task id and embeds the last 30 days' summary into the report body. See the
-template in `phase-7-report.md`.
+template in `phase-5-report.md`.
 
 ## Disabling Metrics
 

package/docs/recovery-guide.md

@@ -9,9 +9,9 @@ the answer across `modes.md`, `operations.md`, and the individual phase specs.
 | Symptom                                                 | Jump to                                         |
 | ------------------------------------------------------- | ----------------------------------------------- |
 | Pipeline paused/halted mid-run                          | [Resume a paused task](#resume-a-paused-task)   |
-| Phase 3 build failed > 3 times                          | [Build retry exhausted](#build-retry-exhausted) |
-| Phase 4 triage returned exit 1 (invalid JSON) twice     | [Triage fallback](#triage-fallback)             |
-| Phase 4 triage returned exit 2 (over-rejection)         | [Over-rejection](#over-rejection-guard)         |
+| Phase 2 build failed > 3 times                          | [Build retry exhausted](#build-retry-exhausted) |
+| Phase 3 triage returned exit 1 (invalid JSON) twice     | [Triage fallback](#triage-fallback)             |
+| Phase 3 triage returned exit 2 (over-rejection)         | [Over-rejection](#over-rejection-guard)         |
 | Worktree already exists / dirty                         | [Worktree collisions](#worktree-collisions)     |
 | `agent-state.json` corrupt or unreadable                | [State corruption](#state-corruption)           |
 | Wrong git identity committed                            | [Identity rewind](#identity-rewind)             |
@@ -47,7 +47,7 @@ so `resume` continues in autopilot.
 
 ## Build Retry Exhausted
 
-Phase 3 retries the build up to **3 times** on each TDD cycle's green step. On
+Phase 2 retries the build up to **3 times** on each TDD cycle's green step. On
 the 4th consecutive failure the pipeline **pauses** (even in autopilot) and
 surfaces the error. Autopilot does not loop infinitely - this is intentional.
 
@@ -57,8 +57,8 @@ Path forward:
 2. If the failure is environmental (missing Xcode sim, wrong JDK), fix the
    environment and `resume` - the 3-retry counter resets.
 3. If the failure is logic (compile error in the generated code), edit the
-   offending file in the worktree, then `resume` - Phase 3 re-runs build.
-4. If the task itself is wrong-shaped (Phase 2 plan is infeasible), `kill` and
+   offending file in the worktree, then `resume` - Phase 2 re-runs build.
+4. If the task itself is wrong-shaped (Phase 1 plan is infeasible), `kill` and
    restart with a better-scoped prompt.
 
 ---
@@ -69,17 +69,17 @@ Path forward:
 
 | Exit | Meaning                  | Pipeline action                                |
 | ---- | ------------------------ | ---------------------------------------------- |
-| 0    | Valid & clean            | Proceed to Phase 5                             |
+| 0    | Valid & clean            | Proceed to Phase 4                             |
 | 1    | Invalid JSON / schema    | Retry triage ONCE. On second exit-1, fallback: treat ALL raw findings as accepted. |
 | 2    | Over-rejection (>80%)    | Pause for human confirmation                   |
 | 3    | Contradiction corrected  | Use `result.corrected`, continue               |
 
 If exit 1 fires twice (fallback path):
 
-1. The pipeline logs `Phase 4: triage failed twice - fallback, all findings accepted as blocking`.
-2. All raw findings loop back into Phase 3 as if they were all real blockers.
+1. The pipeline logs `Phase 3: triage failed twice - fallback, all findings accepted as blocking`.
+2. All raw findings loop back into Phase 2 as if they were all real blockers.
 3. This is intentionally conservative - we'd rather over-fix than skip
-   something real. You can manually mark noise in the Phase 6 PR description.
+   something real. You can manually mark noise in the Phase 4 PR description.
 
 ## Over-Rejection Guard
 
@@ -91,8 +91,8 @@ asks a human to look at the raw findings vs triage output.
 
 - Open `agent-log.md`, find the triage invocation.
 - Compare raw findings (logged) with rejected items.
-- If the rejections are correct, run `resume` with `--accept-overrejection` (Phase 4 re-enters validation with the guard soft-failed).
-- If not, run `resume` - Phase 4 re-runs triage with the guard still active.
+- If the rejections are correct, run `resume` with `--accept-overrejection` (Phase 3 re-enters validation with the guard soft-failed).
+- If not, run `resume` - Phase 3 re-runs triage with the guard still active.
 
 Autopilot behavior: logs the warning, accepts the triage output, continues -
 the autopilot contract values throughput over human-in-loop.
@@ -216,7 +216,7 @@ cat .worktrees/{id}/agent-state.json | grep status
 ## Instruction Fallback
 
 `state.instructionDriven=true` but the file at `state.instructionFiles.commit`
-is missing on disk. Phase 6 logs an error, sets
+is missing on disk. Phase 4 logs an error, sets
 `state.instructionDrivenFallback=true`, and uses the standard commit path.
 
 This is rarely fatal - usually the instruction file was removed between
@@ -320,7 +320,7 @@ cp "$TRACKER_STATE" "$TRACKER_STATE.bak.$(date +%s)"
 # 3. Either restore from a recent valid snapshot in the same dir, or
 #    reinitialize from the agent-log timeline:
 bash $HOME/.claude/scripts/phase-tracker.sh init "<task-id>"
-for p in 0:Init 1:Analysis 2:Planning 3:Dev 4:Review 5:Test 6:Commit 7:Report; do
+for p in 0:Init 1:Plan 2:Dev 3:Review 4:Commit 5:Report; do
   bash $HOME/.claude/scripts/phase-tracker.sh add "${p%%:*}" "${p#*:}"
 done
 # Replay completed phases from agent-log.md headers
@@ -338,7 +338,7 @@ reinit. A footnote in `agent-log.md` documenting the rebuild is good practice.
 ## Token Rotation Mid-Pipeline (v8.0.0)
 
 A token (Jira / Bitbucket / GitHub / Vercel) was rotated while a long-running
-pipeline was active. Phase 6 / Phase 7 then fail with `401 Unauthorized` even
+pipeline was active. Phase 4 / Phase 5 then fail with `401 Unauthorized` even
 though earlier phases worked.
 
 Fix:
@@ -362,7 +362,7 @@ echo "$NEW_TOKEN" | secret-tool store --label="$LABEL" account "$ACCOUNT" servic
 # 2. Sanity-check the doctor reports the new token's prefix
 bash pipeline/lib/credential-store.sh doctor
 
-# 3. Resume the pipeline - Phase 6/7 re-resolve the token on each invocation,
+# 3. Resume the pipeline - Phase 4/5 re-resolve the token on each invocation,
 #    so no state edit is required.
 /multi-agent:resume <task-id>
 ```
@@ -446,7 +446,7 @@ versions).
 ## Failed Push + Force-Push Decision (v8.0.0)
 
 `git push` rejects the branch (non-fast-forward, hook rejected, branch
-protection mismatch, etc.). The pipeline is paused at Phase 6 Step 3.
+protection mismatch, etc.). The pipeline is paused at Phase 4 Step 3.
 
 Decision tree:
 

package/docs/token-budget-history.md

@@ -19,4 +19,6 @@ back into. The ceiling can still be raised; it can no longer be raised for free.
 
 ---
 
-Token estimate = ceil(chars / 4). Per-phase budget rule: warn = current+10% (rounded to nearest 50), max = current+25%. Gives ~6 edit cycles of headroom before warn trips  -  intentionally quiet under normal maintenance, loud when a phase grows unusually. Only the active phase is loaded (lazy). Recalibrated at v10.0.0 after the validator/consistency/simplifier/lesson gate contracts landed in phases 1-4. Recalibrated again at v10.9.0 after the verify-by-test (Phase 4 Step 3.7), update-check (Phase 0 Step 0.6), immutable-test (Phase 3 GREEN) and redTests re-entry contracts landed  -  Step 3.7 prose was compressed to a pointer into refs/features/verify-by-test.md before the recalibration. Total bumped 50000 -> 51000 at v12.5.0 after the worktree residue/traversal-prune contract (Phase 0 + Phase 5 heal) and the Reflexion causal-diagnosis contract (Phase 4 lesson memory) landed; the prose was compressed first (161 tokens reclaimed) and every per-phase max still passes  -  only the aggregate needed room. Recalibrated again at v13.6.0 after the install-relative path correction: an instruction that names `pipeline/scripts/x` resolves only from a repo checkout, and a run happens in the user's worktree, so 157 references across these docs moved to `$HOME/.claude/...` at +5 bytes each  -  196 tokens of pure correctness cost. Same discipline as before: prose was compressed FIRST (149 tokens reclaimed, by pointing Phase 1's Figma tier table at the Phase 0 probe that already resolved it and Phase 4's Codex constraints at the always-loaded AGENTS.md block), and only then were the budgets moved. Five warn lines had been permanently amber, which makes the amber tier useless as a signal, so every warn was reset to the documented current+10% and the four maxes that the new warn would have collided with were reset to current+25%. Aggregate 51000 -> 51500. Total bumped 51500 -> 52200 at v14.0.0 after Phase 4 Review entered the four --dev mode phase sets and the criteria-resolution contract (Step 1.78) landed. Same discipline as every prior bump: prose was compressed FIRST, 820 tokens reclaimed, before the number moved. Two of those compressions are structural rather than cosmetic - the hardcoded SwiftUI interaction list in Step 1.5 and the SwiftUI convention paragraph in Step 2.8 were transcriptions of rules that now live in a scoped registry, so keeping them here would have re-created the drift this release exists to remove, and the third moved the Step 1.78 full contract into refs/features/skill-conformance.md leaving a pointer. What remains is contract text that cannot be inferred: the manifest's four consumer-visible parts, the conformance checklist the reviewers must return, and the fail-closed semantics. Every per-phase max still passes (phase-4 12405/14750); only the aggregate needed room. Total bumped 52200 -> 52700 at v14.1.0 after two more contracts landed: stack skill routing (Phase 3 pre-flight step 9) and worktree finalize (Phase 6 step 9). Compression came first, as always, and twice: 224 tokens out of Phase 3 by pointing its criteria-ledger and routing steps at their feature files instead of restating them, and 190 out of Phase 6 by moving the finalize contract into refs/features/worktree-finalize.md and leaving the invocation plus the exit-3 semantics. Both new contracts follow the pattern the earlier ones set: the phase doc carries the call and the decision, the feature file carries the reasoning, and the feature files are outside this budget because it loops only the eight phase-N-* keys. Every per-phase max still passes (phase-3 7677/8950, phase-6 5223/6150 and both under warn); only the aggregate needed room. Total bumped 52700 -> 52750 for the Phase 0 Step 3 branch-persistence correction: the step wrote the legacy `projects[].branches` while the TTL filter two sections below read `global.recentBranches`, and both spots named a `{name, lastUsed}` shape the schema rejects (`branch` required, `additionalProperties: false`), so the recent-branch picker option could never populate and a literal implementation would have failed prefs validation. Naming the right target, the right key and the legacy field to avoid costs 41 tokens over the one line it replaces. Compression came first and was applied three times to the replacement text itself, from 120 tokens down to 66, by moving the rationale out of the phase doc entirely: the reasoning now lives where it is enforced, in the migrate-prefs carry-forward comment and the smoke-pref-migration f7 block, leaving the phase doc with only the instruction. 50 was the smallest step that clears it; phase-0-init sits at 10893/12400, far under its own max, so this is purely an aggregate ceiling. v15.0.0: total 52750 -> 53100, the stack-skill tables in phase-1/2/4 now carry plugin-namespaced names (ai-<stack>-toolkit:<skill>) - functional prefixes, ~170 tokens. v15.10.0: total 53350 -> 53950 for the memory-recall + context-offload contracts (Phase 1 two-block durable-knowledge injection and its telemetry, Phase 3 build-log offload pipe, Phase 4 ranked prior art, offload pipe and recall telemetry). Compression came first and twice, taking the new prose from 1168 tokens to 580: the reasoning behind the two blocks lives in multi-agent-refs/prompt-assembly.md and the reasoning behind the offload filter lives in the offload-ref.sh header, both outside this budget, so the phase docs carry only the call, the pref that gates it and the one fact an agent cannot infer - that the evidence gate still reads the whole build log, so offloading changes what is read, never what counts as a verified pass. Every per-phase max still passes (phase-3 7985/8950, phase-4 12997/14750); phase-3 and phase-4 crossed their warn lines and are left amber on purpose, because that is the signal that those two docs are the next ones needing structural compression rather than another bump. v15.13.0: total 53950 -> 54050 for the prefs-to-flag bridges. Five settings had shipped declared-but-inert: contextOffload.minLines and .tailLines (fixed in 15.11.0), learningsLedger.maxBriefEntries, and testGap.scanTree and .promoteSeverity - the last two declared in the schema AND implemented as flags in the scanner, with nothing in between reading the pref and passing the flag. Wiring three of them costs the phase docs 94 tokens, which is the wiring itself and not prose: two `--max` substitutions and a three-line GAP_FLAGS block. Compression came first and twice, as always: the rationale that would have sat in phase-5 now lives in the header of smoke-prefs-consumed.sh, the gate that makes this class fail a build instead of shipping, and a `--severity-promote` table row was dropped because the invocation above it now shows the flag and names the pref that triggers it, which the row did not. 100 was the smallest step that clears it. Every per-phase max still passes; phase-3 and phase-4 remain amber on purpose. v15.14.0: total 54050 -> 54400 for the supported-version gate. Phase 0 Step 0.6 stopped being purely advisory: a release can now publish an npm dist-tag `required` that names the oldest runnable version, and below it the run halts instead of nagging. What the phase doc has to carry is the part an agent cannot infer - the third stdout field, that the halt is identical in autopilot, and that the run must NOT continue on the freshly updated install because its docs were already loaded from the old version. Compression came first, as always, and took the new prose from 469 tokens to 337: the rationale for the floor, the exemption list, the fail-open rules and the `npm dist-tag add` recipe all moved to multi-agent-refs/rules.md "Supported Version Gate" (loaded by 25 commands, outside this budget) and to the header of require-supported-version.sh, leaving the phase doc with the call, the decision table and the halt. 350 was the smallest step that clears it. Every per-phase max still passes (phase-0-init 11230/12400); phase-3 and phase-4 remain amber on purpose. v15.17.0: total 54400 -> 54900 for the Phase 1 analysis-document step. Phase 2 and Phase 3 pre-flights had BLOCKED on `analysis/<feature>-<platform>.md` since v9.0.0 while nothing produced it, so a full run either aborted at Phase 2 or the model ignored its own BLOCKING contract; Step 4 is the producer. What the phase doc carries is only what cannot be inferred: the when-table (taskType x Figma reference), the four refs in load order, the two artefacts, and that the doc validator fails closed. Compression came first and took the step from 745 tokens to 497: the history of why the gap existed moved to the CHANGELOG, the per-ref one-line descriptions moved into the refs' own headers, and the autopilot carve-out collapsed to one clause. The 17.4k-token analysis engine itself is NOT in this budget - it moved out of commands/ into multi-agent-refs/analysis/{locked,evidence,synthesis,render}.md, loaded on demand, which also took analysis/SKILL.md from 18081 to 5974 tokens and retired its lint grace entry. 500 was the smallest step that clears it; phase-1-analysis sits at 4338/4600 and is amber on purpose, like phase-3 and phase-4. v15.18.0: total 54900 -> 55250 for analysis mode. Three phase docs gained a mode branch that cannot be inferred: Phase 4 reviews a document instead of a diff (validator, the one question reviewers answer, the open-question walk), and Phase 6 publishes instead of committing. Compression came first and was applied twice to the new prose and once to old: the Phase 4 branch went from 320 tokens to 180 and the Phase 6 branch from 190 to 120 by pointing at multi-agent-refs/analysis/{resolve,render}.md, which now hold the walks themselves, and the front-matter parse contract stopped being spelled out in both pre-flights. The analysis engine keeps leaving this budget rather than entering it: intake joined locked/evidence/synthesis/render/resolve in multi-agent-refs/analysis/, which is what let analysis/SKILL.md drop under the 6000 hard cap after its grace entry was retired. 350 was the smallest step that clears it; phase-4 and phase-6 are amber on purpose, as phase-1 and phase-3 already were. v15.20.0: total 55250 -> 55500 for the TDD bridge. Phase 3 pre-flight read the analysis doc's concept table and even said test method names come from it, while nothing read Section 15 - so the RED step invented tests and the analysis test matrix never reached development. Phase 3 step 5b now loads it into state.dev.testPlan[] and Phase 4 step 1.45 cross-checks every planned row against a real test, which is what turns "analysis quality is output quality" from a slogan into a finding. Compression came first on both blocks, 300 tokens down to 175, by dropping the enumerated failure modes to one line each and the rationale to one clause; the reasoning lives in the CHANGELOG. 250 was the smallest step that clears it. v15.21.0: total 55500 -> 55800 for the post-analysis confirmation. Phase 2 gained Step 0.9, the last human checkpoint before Phase 3: derived values are shown for confirmation and only Section 20 rows are asked, through the resolve engine that already exists in refs. It belongs here rather than Phase 4 because Phase 4 runs after development, where an answer arrives too late to change anything. Compression came first and twice, 430 tokens down to 250, by collapsing the derived-vs-asked explanation to one sentence each and moving the walk itself to multi-agent-refs/analysis/resolve.md, which Phase 4 and analysis-resolve already mount. 300 was the smallest step that clears it. v15.22.0: total 55800 -> 55900 for the analyst-toolkit hooks. Phase 1 Step 4 now names the two prefs that decide whether a document is produced at all and how deep it goes (forceFull, mode) - the first of those had shipped declared-but-inert and smoke-prefs-consumed caught it - and Phase 4 triage gained one clause: a finding that blames a third-party library asks evidence-github whether it is already open upstream, which turns it into a deferred item with a citation instead of Phase 3 rework on code that is not ours. Compression came first and three times, taking the new prose from 220 tokens to 110, and the Phase 1d evidence contract itself never entered this budget - it lives in multi-agent-refs/analysis/evidence.md beside the phases it belongs to. 100 was the smallest step that clears it, leaving 34 tokens of headroom. phase-4 stays amber and the debt named at v15.10.0 stands: it is the doc that needs structural compression rather than another bump, and the two candidates are the inline triage JSON shape and the 3.4 telemetry block, both of which restate something already authoritative elsewhere. v16.0.0: total 55900 -> 56350 for the depth picker. `--dev` and the four dev-* commands are gone; depth is Phase 0 Step 7.5, which costs phase-0-init a step it did not have. Compression came first and three times, taking the step from 530 tokens to 300: the question wording, the per-taskType recommendation and the mode tables all live in phases/modes.md (outside this budget), so the phase doc carries only what an agent cannot infer - that the step runs after Step 7 and why, who is exempt, that ASK_CHOICE_DEFAULT must be passed explicitly because ask-choice.sh takes the FIRST option on a non-TTY, and that Short flips the Phase 1/2 tiles late rather than pre-marking them. The phase-4 telemetry block named as compression debt at v15.22.0 was collapsed to an emit() helper (-27) and the four dev-* mode files left the tree entirely, but neither offsets a genuinely new phase step. 450 was the smallest step that clears it, leaving 119 tokens of headroom. phase-4 remains amber and its other named candidate, the inline triage JSON shape, was left alone on purpose: it is the prompt the triage agent is handed, not a restatement for readers. v16.2.0: total 56350 -> 56600 for the spec-freshness and reuse-tag contracts. Phase 3 step 3 had compared `state.run.lastAnalysisDigest` since it was written, against a key nothing ever set and that the state schema did not declare, so the staleness branch was unreachable and every run reported fresh by default. Phase 1 now persists the digest and a `base_commit` anchor, and step 3 gained the repo-drift half the digest cannot see: a reused document keeps a matching digest precisely because its evidence inputs did not change, while the code underneath it moved. The second contract is the Section 14 tag reaching development: Phase 2 carries it onto the todo as `sourceTag` and Phase 3 treats it as an instruction, which is what stops a Reuse row from being re-implemented. Compression came first and took the four additions from 380 tokens to 214, by moving every rationale clause out of the phase docs: why the commit anchor exists rather than a digest recomputation lives in this note and the CHANGELOG, and the schema descriptions carry the field semantics. The baseline had 9 tokens of headroom, so no addition of any size could have fit without a bump. 250 was the smallest step that clears it, leaving 45 tokens. phase-3 and phase-4 remain amber. v16.13.0: total 57600 -> 57700 for the code-graph injection and the fable-rung switch. Phase 1 gained Step 2.6 (query the graph, hand Explore a ranked starting set), Phase 7 gained the post-branch graph refresh, and Phase 0 Step 0 gained one line: a prefs switch that resolves every preferredModel: fable persona to opus for the run, which also collapses the Phase 4 Claude Code panel from three reviewers to two. Compression came first and mostly structurally: of roughly 1,630 tokens of new contract text, 1,310 never entered this budget at all - the whole code-graph contract lives in multi-agent-refs/features/code-graph.md (604) and the fable switch's scope table, per-host effects and cost-accounting consequence live in features/model-fallback.md (+707), leaving the phase docs with the call, the pref that gates it and the one fact an agent cannot infer. Phase 4 was compressed on top of that: its TLDR restated the reviewer matrix 270 lines below it, so 36 tokens came back and the doc nets +6 despite carrying two new clauses. One of those clauses is a correction rather than a feature - the consensus rule still said reviewerCount is 2 on Claude Code, which stopped being true when the third reviewer landed in 16.12.0, and the cross-CLI smoke never caught it because it reads the matrix line instead. 100 was the smallest step that clears it, leaving 54 tokens. phase-3 and phase-4 remain amber. v16.17.0: total 57700 -> 57850 for the platform-parity cross-check. Phase 4 gained Step 1.8: when dev-context carries a counterpart app repo, the review compares the change against the other platform on four axes. Compression came first and structurally, as always - of roughly 1,610 tokens of new contract text, 1,490 never entered this budget at all, because the four axes, the file cap, the graph-query recipe, the read-only prohibitions and the rule that an extractor miss may not be reported as an absence all live in multi-agent-refs/platform-parity.md. The step itself was then cut from ~200 tokens to 120 by deleting everything the ref already owns, leaving the trigger, the pointer and the two facts an agent must not infer: the counterpart repo is read-only, and parity findings are never blocking. The baseline had 13 tokens of headroom, so no addition of any size could have fit without a bump. 150 was the smallest step that clears it, leaving 35 tokens. phase-3 and phase-4 remain amber, and phase-4's structural-compression debt still stands. v16.20.0: phase-4-review max 14750 -> 15150 and total 58250 -> 60250 for the cross-round review delta, the scope self-check handoff and the circuit-breaker wiring. Compression came first and structurally: of roughly 3,900 tokens of new contract text, 2,700 never entered this budget at all - the previous-round-findings block, the scope-self-check block, the Step 3.8 state merge, telemetry and picker wording live in multi-agent-refs/features/review-delta.md, and the scope-check record rules and consumers in features/scope-check.md - so the phase docs carry the call, the pref that gates it and the exit table. The Phase 3 stability rule and the trigger-3 write were cut twice more before the bump; phase-3 stays under its max (8692/8950). Phase 4 is the first per-phase max raised since v10.9.0: the doc gained three steps that cannot be inferred (a per-round triage file, a prefix block that changes what reviewers report, and a halt condition), and its structural-compression debt (the inline triage JSON shape, named at v15.10.0) still stands and is the next candidate. 15150 and 60250 were the smallest steps that clear it, leaving 25 and 45 tokens. v16.23.0: phase-0-init max 12400 -> 12500 and total 60250 -> 60500 for the widget-registration call and the accounting gate. Phase 0 gained the `tiles` call and the exit-3 rule, Phase 7 gained the run report; together they are contract an agent cannot infer - which call registers this host's widget, and that a completion is refused without recorded spend. Compression came first and twice, taking the new prose from 472 tokens to 255: the per-host call list moved into tracker-contract.md "The card is not the widget" and the record-then-rerun recovery into "Accounting is a gate", both outside this budget, leaving the phase docs with the call and the one fact that cannot be looked up. 100 and 250 were the smallest steps that clear it, leaving 74 and 40 tokens. phase-3 and phase-4 remain amber. v16.24.0: total 60500 -> 60750 for visual evidence. Four phase docs gained one instruction each that cannot be inferred: Phase 0 keeps the issue's own images as the pre-fix evidence, Phase 3 captures the fixed state (there and not Phase 5, because every autopilot and --local entry drops Phase 5), Phase 5 hosts the flow recording when it runs, and Phase 6 blocks on a required artefact that is neither attached nor explained. Compression came first and twice, 42 tokens back, and the contract itself never entered this budget: the trigger matrix, the three video tiers, the size-degradation ladder and both render shapes live in multi-agent-refs/features/visual-evidence.md. phase-0-init cleared its own max without a bump. 250 was the smallest step that clears the aggregate. phase-3 and phase-4 remain amber. v17.0.0: phase-0-init max 13000 -> 13100 and total 62400 -> 62500 for the evidence-verdict writer. Phase 0 Step 7.7 probed with `--platform "$PLATFORM"`, a variable no phase document ever assigned, and it was gated on `visualEvidence.required`, which no phase document ever wrote - five readers, zero writers - so the step, Phase 3's capture and Phase 6's blocker were all unreachable and the pipeline reported nothing wrong. The step now writes the verdict and derives the platform from the stack, skipping the probe with a recorded reason when there is no device platform rather than passing the empty string the probe refuses with exit 2. Compression came first and three times, 30 tokens back from the Step 7.7 index rule that restated Step 7.5 verbatim and 55 from the new block itself; the reasoning never entered this budget, because who writes the verdict and how the platform is derived live in features/visual-evidence.md sections 1a and 1b. phase-3-dev max 9250 -> 9300 in the same change: it reads the platform back from state and re-decides the provisional verdict before capturing, which is the half of the fix that makes Phase 3 honest rather than merely reachable. Compressed three times first, 29 tokens back, by pointing its Phase-5 rationale and its tier mapping at visual-evidence.md sections 3 and 4.3 where both already live. 100, 50 and 150 were the smallest steps that clear it, leaving 24, 15 and 26 tokens. phase-3 and phase-4 remain amber. v17.1.0: total 62550 -> 62600 for the Figma/toolkit MCP distinction and web as an evidence platform. Three phase docs said "MCP forbidden" without qualifying it, while the gate that enforces it (smoke-no-mcp-in-dev-phases.sh) has always matched `figma` and nothing else - so the prose banned the screenshot, xcodebuild and UI-test tools that Phase 3 Steps 3.4 and 3.55 actually call, which is one way a run reaches Phase 7 with no evidence. Phase 0 gained one `web` arm in the platform derivation, now that run-ui-tests.sh has a web arm to derive it for. Compression came first and three times, taking the new prose from 175 tokens to 30: the reasoning moved to rules.md, whose own seven-row Figma phase matrix was deleted in the same pass because it duplicated rules/figma-pipeline.md "Phase access matrix" two paragraphs below this file's own instruction not to duplicate that rule file - 74 tokens back there, which is why phase-3-dev cleared its max without a bump (9298/9300). 50 was the smallest step that clears the aggregate, leaving 37 tokens. phase-3 and phase-4 remain amber. v17.1.0 (2): total 62600 -> 62700 for the plan reaching the task widget. Phase 2 computed tasks[], their order and their dependsOn[] edges, stored them, and used them to drive Phase 3's ready-task picker - and none of it was visible on the surface the user actually watches; the card had drawn sub-phases for releases, the widget never had. Phase 2 gains one call. Compression came first and twice: the tasks[]-to-todos[] jq blob left the phase doc for plan-todos.sh `set`, which now accepts a planning-output document directly (-28, and it removes a mapping two files defined, of which this was the untested copy), and the new step's own prose was cut from 116 tokens to 61. The parsing of the plan itself never entered this budget - it lives in phase-tracker.sh `plan`, which owns the sub-phase structure it writes. 100 was the smallest step that clears it, leaving 75 tokens. phase-3 and phase-4 remain amber. v17.5.0: phase-0-init max 13100 -> 13150 for the deferred widget registration, the dev-context step and two more exit-gate assertions. Compression came first and seven times, 492 tokens reclaimed before the number moved: the TLDR restated the step headings under it, the exit-gate list restated the script's own header comment, and the clarifier cost note, the branch-collision probe rationale, the fetch-fail host explanation, the multi-repo write-state race and the baseline unknown-vs-green warning all restate something already authoritative in agents/task-clarifier.md, phases/operations.md or phase0-exit-gate.mjs. The three additions are contract an agent cannot infer: that only Phase 0 is registered at Step -1 and the rest at 7.5 with `tiles --new`, that the dev-context picker runs between project and branch and writes siblings[] even when empty, and that a one-option AskUserQuestion is refused by the host along with every question batched with it. The reasoning for the last one never entered this budget - it lives in picker-contract.md "Two options or it is not a question". 50 was the smallest step that clears it, leaving 28 tokens; the aggregate needed no bump and sits at 62698/62700. phase-3 and phase-4 remain amber. v17.5.0 (2): phase-0-init max 13150 -> 13300 and total 62700 -> 62900 for the workspace question. Phase 0 gained Step 5b: where the branch lives was decided by a flag and by a command name, never by a question, so a user who saw a run improvise "Worktree / Lokal" once took it for a shipped picker and concluded /multi-agent:local was redundant - while it was the only way to reach local mode at all. Compression came first and three times, 156 tokens reclaimed before the number moved and the step itself cut from 426 tokens to 181: the ask-choice index rule in Step 7.5 restated modes.md "Pipeline depth" in full, and the question wording, the two options and what local costs now live in modes.md "Local Mode", outside this budget. What the phase doc carries is what an agent cannot infer - that it runs after Step 4 and before Step 6b and 7.5, who is exempt, and that autopilot resolves it to a worktree rather than skipping it, because an unattended commit in the user's own checkout is what worktrees exist to prevent. The state field is the other half: localMode alone cannot say whether anyone decided, since false is both a chosen worktree and one nothing asked about, and phase0-exit-gate.mjs now refuses to close Phase 0 without workspaceSource. 150 and 200 were the smallest steps that clear it, leaving 32 and 56 tokens. phase-3 and phase-4 remain amber. v17.5.0 (3): phase-0-init max 13300 -> 13400 and total 62900 -> 63000 for base-branch evidence. Step 3 asked one question with a list it could not vouch for: `git fetch origin` ran, its exit code was discarded, and `git branch -r` printed the remote-tracking cache either way, so a restricted network produced a weeks-old local list presented as the remote's answer. And the answer was usually derivable - an issue carrying a target version, or linking a separate issue that represents the release, already names the branch on a repo whose release branches encode the version - and nothing derived it. Rule 5 now captures the exit code and rule 5b hands the list plus the issue's version fields and links to base-branch-candidates.mjs. Compression came first and six times, 1,118 characters reclaimed across this step before the number moved: the one-row picker rule and the not-skippable rule both restated picker-contract.md, the autopilot resolution order and the whole rationale for admitting version-carrying branches moved into features/base-branch-evidence.md, and the fetch-fail persistence block was four sentences for one instruction. The feature's own reasoning never entered this budget at all - the evidence sources, the learned convention, the picker contract, the autopilot fencing and the state shape are ~1,900 tokens living in that ref. What the phase doc carries is the call and the two facts an agent cannot infer: that the fetch exit code decides whether the list may be called remote, and that the branch filter needs a version alternative because a word list that discards is the prefix table this replaces. 100 was the smallest step that clears both, leaving 51 and 61 tokens. phase-3 and phase-4 remain amber. v17.6.0: phase-3-dev max 9300 -> 9450 and total 63000 -> 63150 for package-manager resolution. The node-shaped arms typed `npm` into two command lines, so a repo on pnpm, yarn or bun failed in Phase 3 with a worktree and a branch already created - or, worse, npm resolved against a lock file it does not own and the run continued on a tree the repo's own tooling would never have produced. Both arms now call package-manager.mjs, which prints the line to run. A resolver invocation is inherently longer than the four characters it replaces, and phase-3-dev had 2 tokens of headroom (9298/9300), so no addition of any size could have fit without a bump. Compression came first and twice, taking the new prose from 430 characters to 160 and trimming the build arm's tail by 140: the resolution order, the two-lock-file rule, the per-manager command shapes, the exit-3 contract and the eval-safety argument all live in features/package-manager.md, outside this budget. What the phase doc carries is the call and the one fact an agent cannot infer - that exit 3 means the repo declares no such script, so the step is skipped and said, never substituted. phase-4-review was compressed rather than raised in the same pass: its Gate 3 comment named npm as though it were the only node test command, and the corrected line is 64 characters SHORTER than the one it replaces, so the doc nets -64 while becoming true (15150/15150). 150 was the smallest step that clears phase-3-dev, leaving 51 tokens; 150 clears the aggregate, leaving 133. phase-3 and phase-4 remain amber.
+Token estimate = ceil(chars / 4). Per-phase budget rule: warn = current+10% (rounded to nearest 50), max = current+25%. Gives ~6 edit cycles of headroom before warn trips  -  intentionally quiet under normal maintenance, loud when a phase grows unusually. Only the active phase is loaded (lazy). Recalibrated at v10.0.0 after the validator/consistency/simplifier/lesson gate contracts landed in phases 1-4. Recalibrated again at v10.9.0 after the verify-by-test (Phase 4 Step 3.7), update-check (Phase 0 Step 0.6), immutable-test (Phase 3 GREEN) and redTests re-entry contracts landed  -  Step 3.7 prose was compressed to a pointer into refs/features/verify-by-test.md before the recalibration. Total bumped 50000 -> 51000 at v12.5.0 after the worktree residue/traversal-prune contract (Phase 0 + Phase 5 heal) and the Reflexion causal-diagnosis contract (Phase 4 lesson memory) landed; the prose was compressed first (161 tokens reclaimed) and every per-phase max still passes  -  only the aggregate needed room. Recalibrated again at v13.6.0 after the install-relative path correction: an instruction that names `pipeline/scripts/x` resolves only from a repo checkout, and a run happens in the user's worktree, so 157 references across these docs moved to `$HOME/.claude/...` at +5 bytes each  -  196 tokens of pure correctness cost. Same discipline as before: prose was compressed FIRST (149 tokens reclaimed, by pointing Phase 1's Figma tier table at the Phase 0 probe that already resolved it and Phase 4's Codex constraints at the always-loaded AGENTS.md block), and only then were the budgets moved. Five warn lines had been permanently amber, which makes the amber tier useless as a signal, so every warn was reset to the documented current+10% and the four maxes that the new warn would have collided with were reset to current+25%. Aggregate 51000 -> 51500. Total bumped 51500 -> 52200 at v14.0.0 after Phase 4 Review entered the four --dev mode phase sets and the criteria-resolution contract (Step 1.78) landed. Same discipline as every prior bump: prose was compressed FIRST, 820 tokens reclaimed, before the number moved. Two of those compressions are structural rather than cosmetic - the hardcoded SwiftUI interaction list in Step 1.5 and the SwiftUI convention paragraph in Step 2.8 were transcriptions of rules that now live in a scoped registry, so keeping them here would have re-created the drift this release exists to remove, and the third moved the Step 1.78 full contract into refs/features/skill-conformance.md leaving a pointer. What remains is contract text that cannot be inferred: the manifest's four consumer-visible parts, the conformance checklist the reviewers must return, and the fail-closed semantics. Every per-phase max still passes (phase-4 12405/14750); only the aggregate needed room. Total bumped 52200 -> 52700 at v14.1.0 after two more contracts landed: stack skill routing (Phase 3 pre-flight step 9) and worktree finalize (Phase 6 step 9). Compression came first, as always, and twice: 224 tokens out of Phase 3 by pointing its criteria-ledger and routing steps at their feature files instead of restating them, and 190 out of Phase 6 by moving the finalize contract into refs/features/worktree-finalize.md and leaving the invocation plus the exit-3 semantics. Both new contracts follow the pattern the earlier ones set: the phase doc carries the call and the decision, the feature file carries the reasoning, and the feature files are outside this budget because it loops only the eight phase-N-* keys. Every per-phase max still passes (phase-3 7677/8950, phase-6 5223/6150 and both under warn); only the aggregate needed room. Total bumped 52700 -> 52750 for the Phase 0 Step 3 branch-persistence correction: the step wrote the legacy `projects[].branches` while the TTL filter two sections below read `global.recentBranches`, and both spots named a `{name, lastUsed}` shape the schema rejects (`branch` required, `additionalProperties: false`), so the recent-branch picker option could never populate and a literal implementation would have failed prefs validation. Naming the right target, the right key and the legacy field to avoid costs 41 tokens over the one line it replaces. Compression came first and was applied three times to the replacement text itself, from 120 tokens down to 66, by moving the rationale out of the phase doc entirely: the reasoning now lives where it is enforced, in the migrate-prefs carry-forward comment and the smoke-pref-migration f7 block, leaving the phase doc with only the instruction. 50 was the smallest step that clears it; phase-0-init sits at 10893/12400, far under its own max, so this is purely an aggregate ceiling. v15.0.0: total 52750 -> 53100, the stack-skill tables in phase-1/2/4 now carry plugin-namespaced names (ai-<stack>-toolkit:<skill>) - functional prefixes, ~170 tokens. v15.10.0: total 53350 -> 53950 for the memory-recall + context-offload contracts (Phase 1 two-block durable-knowledge injection and its telemetry, Phase 3 build-log offload pipe, Phase 4 ranked prior art, offload pipe and recall telemetry). Compression came first and twice, taking the new prose from 1168 tokens to 580: the reasoning behind the two blocks lives in multi-agent-refs/prompt-assembly.md and the reasoning behind the offload filter lives in the offload-ref.sh header, both outside this budget, so the phase docs carry only the call, the pref that gates it and the one fact an agent cannot infer - that the evidence gate still reads the whole build log, so offloading changes what is read, never what counts as a verified pass. Every per-phase max still passes (phase-3 7985/8950, phase-4 12997/14750); phase-3 and phase-4 crossed their warn lines and are left amber on purpose, because that is the signal that those two docs are the next ones needing structural compression rather than another bump. v15.13.0: total 53950 -> 54050 for the prefs-to-flag bridges. Five settings had shipped declared-but-inert: contextOffload.minLines and .tailLines (fixed in 15.11.0), learningsLedger.maxBriefEntries, and testGap.scanTree and .promoteSeverity - the last two declared in the schema AND implemented as flags in the scanner, with nothing in between reading the pref and passing the flag. Wiring three of them costs the phase docs 94 tokens, which is the wiring itself and not prose: two `--max` substitutions and a three-line GAP_FLAGS block. Compression came first and twice, as always: the rationale that would have sat in phase-5 now lives in the header of smoke-prefs-consumed.sh, the gate that makes this class fail a build instead of shipping, and a `--severity-promote` table row was dropped because the invocation above it now shows the flag and names the pref that triggers it, which the row did not. 100 was the smallest step that clears it. Every per-phase max still passes; phase-3 and phase-4 remain amber on purpose. v15.14.0: total 54050 -> 54400 for the supported-version gate. Phase 0 Step 0.6 stopped being purely advisory: a release can now publish an npm dist-tag `required` that names the oldest runnable version, and below it the run halts instead of nagging. What the phase doc has to carry is the part an agent cannot infer - the third stdout field, that the halt is identical in autopilot, and that the run must NOT continue on the freshly updated install because its docs were already loaded from the old version. Compression came first, as always, and took the new prose from 469 tokens to 337: the rationale for the floor, the exemption list, the fail-open rules and the `npm dist-tag add` recipe all moved to multi-agent-refs/rules.md "Supported Version Gate" (loaded by 25 commands, outside this budget) and to the header of require-supported-version.sh, leaving the phase doc with the call, the decision table and the halt. 350 was the smallest step that clears it. Every per-phase max still passes (phase-0-init 11230/12400); phase-3 and phase-4 remain amber on purpose. v15.17.0: total 54400 -> 54900 for the Phase 1 analysis-document step. Phase 2 and Phase 3 pre-flights had BLOCKED on `analysis/<feature>-<platform>.md` since v9.0.0 while nothing produced it, so a full run either aborted at Phase 2 or the model ignored its own BLOCKING contract; Step 4 is the producer. What the phase doc carries is only what cannot be inferred: the when-table (taskType x Figma reference), the four refs in load order, the two artefacts, and that the doc validator fails closed. Compression came first and took the step from 745 tokens to 497: the history of why the gap existed moved to the CHANGELOG, the per-ref one-line descriptions moved into the refs' own headers, and the autopilot carve-out collapsed to one clause. The 17.4k-token analysis engine itself is NOT in this budget - it moved out of commands/ into multi-agent-refs/analysis/{locked,evidence,synthesis,render}.md, loaded on demand, which also took analysis/SKILL.md from 18081 to 5974 tokens and retired its lint grace entry. 500 was the smallest step that clears it; phase-1-analysis sits at 4338/4600 and is amber on purpose, like phase-3 and phase-4. v15.18.0: total 54900 -> 55250 for analysis mode. Three phase docs gained a mode branch that cannot be inferred: Phase 3 reviews a document instead of a diff (validator, the one question reviewers answer, the open-question walk), and Phase 6 publishes instead of committing. Compression came first and was applied twice to the new prose and once to old: the Phase 4 branch went from 320 tokens to 180 and the Phase 6 branch from 190 to 120 by pointing at multi-agent-refs/analysis/{resolve,render}.md, which now hold the walks themselves, and the front-matter parse contract stopped being spelled out in both pre-flights. The analysis engine keeps leaving this budget rather than entering it: intake joined locked/evidence/synthesis/render/resolve in multi-agent-refs/analysis/, which is what let analysis/SKILL.md drop under the 6000 hard cap after its grace entry was retired. 350 was the smallest step that clears it; phase-4 and phase-6 are amber on purpose, as phase-1 and phase-3 already were. v15.20.0: total 55250 -> 55500 for the TDD bridge. Phase 3 pre-flight read the analysis doc's concept table and even said test method names come from it, while nothing read Section 15 - so the RED step invented tests and the analysis test matrix never reached development. Phase 3 step 5b now loads it into state.dev.testPlan[] and Phase 4 step 1.45 cross-checks every planned row against a real test, which is what turns "analysis quality is output quality" from a slogan into a finding. Compression came first on both blocks, 300 tokens down to 175, by dropping the enumerated failure modes to one line each and the rationale to one clause; the reasoning lives in the CHANGELOG. 250 was the smallest step that clears it. v15.21.0: total 55500 -> 55800 for the post-analysis confirmation. Phase 2 gained Step 0.9, the last human checkpoint before Phase 3: derived values are shown for confirmation and only Section 20 rows are asked, through the resolve engine that already exists in refs. It belongs here rather than Phase 4 because Phase 3 runs after development, where an answer arrives too late to change anything. Compression came first and twice, 430 tokens down to 250, by collapsing the derived-vs-asked explanation to one sentence each and moving the walk itself to multi-agent-refs/analysis/resolve.md, which Phase 4 and analysis-resolve already mount. 300 was the smallest step that clears it. v15.22.0: total 55800 -> 55900 for the analyst-toolkit hooks. Phase 1 Step 4 now names the two prefs that decide whether a document is produced at all and how deep it goes (forceFull, mode) - the first of those had shipped declared-but-inert and smoke-prefs-consumed caught it - and Phase 3 triage gained one clause: a finding that blames a third-party library asks evidence-github whether it is already open upstream, which turns it into a deferred item with a citation instead of Phase 3 rework on code that is not ours. Compression came first and three times, taking the new prose from 220 tokens to 110, and the Phase 1d evidence contract itself never entered this budget - it lives in multi-agent-refs/analysis/evidence.md beside the phases it belongs to. 100 was the smallest step that clears it, leaving 34 tokens of headroom. phase-4 stays amber and the debt named at v15.10.0 stands: it is the doc that needs structural compression rather than another bump, and the two candidates are the inline triage JSON shape and the 3.4 telemetry block, both of which restate something already authoritative elsewhere. v16.0.0: total 55900 -> 56350 for the depth picker. `--dev` and the four dev-* commands are gone; depth is Phase 0 Step 7.5, which costs phase-0-init a step it did not have. Compression came first and three times, taking the step from 530 tokens to 300: the question wording, the per-taskType recommendation and the mode tables all live in phases/modes.md (outside this budget), so the phase doc carries only what an agent cannot infer - that the step runs after Step 7 and why, who is exempt, that ASK_CHOICE_DEFAULT must be passed explicitly because ask-choice.sh takes the FIRST option on a non-TTY, and that Short flips the Phase 1/2 tiles late rather than pre-marking them. The phase-4 telemetry block named as compression debt at v15.22.0 was collapsed to an emit() helper (-27) and the four dev-* mode files left the tree entirely, but neither offsets a genuinely new phase step. 450 was the smallest step that clears it, leaving 119 tokens of headroom. phase-4 remains amber and its other named candidate, the inline triage JSON shape, was left alone on purpose: it is the prompt the triage agent is handed, not a restatement for readers. v16.2.0: total 56350 -> 56600 for the spec-freshness and reuse-tag contracts. Phase 3 step 3 had compared `state.run.lastAnalysisDigest` since it was written, against a key nothing ever set and that the state schema did not declare, so the staleness branch was unreachable and every run reported fresh by default. Phase 1 now persists the digest and a `base_commit` anchor, and step 3 gained the repo-drift half the digest cannot see: a reused document keeps a matching digest precisely because its evidence inputs did not change, while the code underneath it moved. The second contract is the Section 14 tag reaching development: Phase 2 carries it onto the todo as `sourceTag` and Phase 3 treats it as an instruction, which is what stops a Reuse row from being re-implemented. Compression came first and took the four additions from 380 tokens to 214, by moving every rationale clause out of the phase docs: why the commit anchor exists rather than a digest recomputation lives in this note and the CHANGELOG, and the schema descriptions carry the field semantics. The baseline had 9 tokens of headroom, so no addition of any size could have fit without a bump. 250 was the smallest step that clears it, leaving 45 tokens. phase-3 and phase-4 remain amber. v16.13.0: total 57600 -> 57700 for the code-graph injection and the fable-rung switch. Phase 1 gained Step 2.6 (query the graph, hand Explore a ranked starting set), Phase 7 gained the post-branch graph refresh, and Phase 0 Step 0 gained one line: a prefs switch that resolves every preferredModel: fable persona to opus for the run, which also collapses the Phase 4 Claude Code panel from three reviewers to two. Compression came first and mostly structurally: of roughly 1,630 tokens of new contract text, 1,310 never entered this budget at all - the whole code-graph contract lives in multi-agent-refs/features/code-graph.md (604) and the fable switch's scope table, per-host effects and cost-accounting consequence live in features/model-fallback.md (+707), leaving the phase docs with the call, the pref that gates it and the one fact an agent cannot infer. Phase 4 was compressed on top of that: its TLDR restated the reviewer matrix 270 lines below it, so 36 tokens came back and the doc nets +6 despite carrying two new clauses. One of those clauses is a correction rather than a feature - the consensus rule still said reviewerCount is 2 on Claude Code, which stopped being true when the third reviewer landed in 16.12.0, and the cross-CLI smoke never caught it because it reads the matrix line instead. 100 was the smallest step that clears it, leaving 54 tokens. phase-3 and phase-4 remain amber. v16.17.0: total 57700 -> 57850 for the platform-parity cross-check. Phase 4 gained Step 1.8: when dev-context carries a counterpart app repo, the review compares the change against the other platform on four axes. Compression came first and structurally, as always - of roughly 1,610 tokens of new contract text, 1,490 never entered this budget at all, because the four axes, the file cap, the graph-query recipe, the read-only prohibitions and the rule that an extractor miss may not be reported as an absence all live in multi-agent-refs/platform-parity.md. The step itself was then cut from ~200 tokens to 120 by deleting everything the ref already owns, leaving the trigger, the pointer and the two facts an agent must not infer: the counterpart repo is read-only, and parity findings are never blocking. The baseline had 13 tokens of headroom, so no addition of any size could have fit without a bump. 150 was the smallest step that clears it, leaving 35 tokens. phase-3 and phase-4 remain amber, and phase-4's structural-compression debt still stands. v16.20.0: phase-4-review max 14750 -> 15150 and total 58250 -> 60250 for the cross-round review delta, the scope self-check handoff and the circuit-breaker wiring. Compression came first and structurally: of roughly 3,900 tokens of new contract text, 2,700 never entered this budget at all - the previous-round-findings block, the scope-self-check block, the Step 3.8 state merge, telemetry and picker wording live in multi-agent-refs/features/review-delta.md, and the scope-check record rules and consumers in features/scope-check.md - so the phase docs carry the call, the pref that gates it and the exit table. The Phase 3 stability rule and the trigger-3 write were cut twice more before the bump; phase-3 stays under its max (8692/8950). Phase 4 is the first per-phase max raised since v10.9.0: the doc gained three steps that cannot be inferred (a per-round triage file, a prefix block that changes what reviewers report, and a halt condition), and its structural-compression debt (the inline triage JSON shape, named at v15.10.0) still stands and is the next candidate. 15150 and 60250 were the smallest steps that clear it, leaving 25 and 45 tokens. v16.23.0: phase-0-init max 12400 -> 12500 and total 60250 -> 60500 for the widget-registration call and the accounting gate. Phase 0 gained the `tiles` call and the exit-3 rule, Phase 7 gained the run report; together they are contract an agent cannot infer - which call registers this host's widget, and that a completion is refused without recorded spend. Compression came first and twice, taking the new prose from 472 tokens to 255: the per-host call list moved into tracker-contract.md "The card is not the widget" and the record-then-rerun recovery into "Accounting is a gate", both outside this budget, leaving the phase docs with the call and the one fact that cannot be looked up. 100 and 250 were the smallest steps that clear it, leaving 74 and 40 tokens. phase-3 and phase-4 remain amber. v16.24.0: total 60500 -> 60750 for visual evidence. Four phase docs gained one instruction each that cannot be inferred: Phase 0 keeps the issue's own images as the pre-fix evidence, Phase 3 captures the fixed state (there and not Phase 5, because every autopilot and --local entry drops Phase 5), Phase 5 hosts the flow recording when it runs, and Phase 6 blocks on a required artefact that is neither attached nor explained. Compression came first and twice, 42 tokens back, and the contract itself never entered this budget: the trigger matrix, the three video tiers, the size-degradation ladder and both render shapes live in multi-agent-refs/features/visual-evidence.md. phase-0-init cleared its own max without a bump. 250 was the smallest step that clears the aggregate. phase-3 and phase-4 remain amber. v17.0.0: phase-0-init max 13000 -> 13100 and total 62400 -> 62500 for the evidence-verdict writer. Phase 0 Step 7.7 probed with `--platform "$PLATFORM"`, a variable no phase document ever assigned, and it was gated on `visualEvidence.required`, which no phase document ever wrote - five readers, zero writers - so the step, Phase 3's capture and Phase 6's blocker were all unreachable and the pipeline reported nothing wrong. The step now writes the verdict and derives the platform from the stack, skipping the probe with a recorded reason when there is no device platform rather than passing the empty string the probe refuses with exit 2. Compression came first and three times, 30 tokens back from the Step 7.7 index rule that restated Step 7.5 verbatim and 55 from the new block itself; the reasoning never entered this budget, because who writes the verdict and how the platform is derived live in features/visual-evidence.md sections 1a and 1b. phase-3-dev max 9250 -> 9300 in the same change: it reads the platform back from state and re-decides the provisional verdict before capturing, which is the half of the fix that makes Phase 3 honest rather than merely reachable. Compressed three times first, 29 tokens back, by pointing its Phase-5 rationale and its tier mapping at visual-evidence.md sections 3 and 4.3 where both already live. 100, 50 and 150 were the smallest steps that clear it, leaving 24, 15 and 26 tokens. phase-3 and phase-4 remain amber. v17.1.0: total 62550 -> 62600 for the Figma/toolkit MCP distinction and web as an evidence platform. Three phase docs said "MCP forbidden" without qualifying it, while the gate that enforces it (smoke-no-mcp-in-dev-phases.sh) has always matched `figma` and nothing else - so the prose banned the screenshot, xcodebuild and UI-test tools that Phase 3 Steps 3.4 and 3.55 actually call, which is one way a run reaches Phase 7 with no evidence. Phase 0 gained one `web` arm in the platform derivation, now that run-ui-tests.sh has a web arm to derive it for. Compression came first and three times, taking the new prose from 175 tokens to 30: the reasoning moved to rules.md, whose own seven-row Figma phase matrix was deleted in the same pass because it duplicated rules/figma-pipeline.md "Phase access matrix" two paragraphs below this file's own instruction not to duplicate that rule file - 74 tokens back there, which is why phase-3-dev cleared its max without a bump (9298/9300). 50 was the smallest step that clears the aggregate, leaving 37 tokens. phase-3 and phase-4 remain amber. v17.1.0 (2): total 62600 -> 62700 for the plan reaching the task widget. Phase 2 computed tasks[], their order and their dependsOn[] edges, stored them, and used them to drive Phase 3's ready-task picker - and none of it was visible on the surface the user actually watches; the card had drawn sub-phases for releases, the widget never had. Phase 2 gains one call. Compression came first and twice: the tasks[]-to-todos[] jq blob left the phase doc for plan-todos.sh `set`, which now accepts a planning-output document directly (-28, and it removes a mapping two files defined, of which this was the untested copy), and the new step's own prose was cut from 116 tokens to 61. The parsing of the plan itself never entered this budget - it lives in phase-tracker.sh `plan`, which owns the sub-phase structure it writes. 100 was the smallest step that clears it, leaving 75 tokens. phase-3 and phase-4 remain amber. v17.5.0: phase-0-init max 13100 -> 13150 for the deferred widget registration, the dev-context step and two more exit-gate assertions. Compression came first and seven times, 492 tokens reclaimed before the number moved: the TLDR restated the step headings under it, the exit-gate list restated the script's own header comment, and the clarifier cost note, the branch-collision probe rationale, the fetch-fail host explanation, the multi-repo write-state race and the baseline unknown-vs-green warning all restate something already authoritative in agents/task-clarifier.md, phases/operations.md or phase0-exit-gate.mjs. The three additions are contract an agent cannot infer: that only Phase 0 is registered at Step -1 and the rest at 7.5 with `tiles --new`, that the dev-context picker runs between project and branch and writes siblings[] even when empty, and that a one-option AskUserQuestion is refused by the host along with every question batched with it. The reasoning for the last one never entered this budget - it lives in picker-contract.md "Two options or it is not a question". 50 was the smallest step that clears it, leaving 28 tokens; the aggregate needed no bump and sits at 62698/62700. phase-3 and phase-4 remain amber. v17.5.0 (2): phase-0-init max 13150 -> 13300 and total 62700 -> 62900 for the workspace question. Phase 0 gained Step 5b: where the branch lives was decided by a flag and by a command name, never by a question, so a user who saw a run improvise "Worktree / Lokal" once took it for a shipped picker and concluded /multi-agent:local was redundant - while it was the only way to reach local mode at all. Compression came first and three times, 156 tokens reclaimed before the number moved and the step itself cut from 426 tokens to 181: the ask-choice index rule in Step 7.5 restated modes.md "Pipeline depth" in full, and the question wording, the two options and what local costs now live in modes.md "Local Mode", outside this budget. What the phase doc carries is what an agent cannot infer - that it runs after Step 4 and before Step 6b and 7.5, who is exempt, and that autopilot resolves it to a worktree rather than skipping it, because an unattended commit in the user's own checkout is what worktrees exist to prevent. The state field is the other half: localMode alone cannot say whether anyone decided, since false is both a chosen worktree and one nothing asked about, and phase0-exit-gate.mjs now refuses to close Phase 0 without workspaceSource. 150 and 200 were the smallest steps that clear it, leaving 32 and 56 tokens. phase-3 and phase-4 remain amber. v17.5.0 (3): phase-0-init max 13300 -> 13400 and total 62900 -> 63000 for base-branch evidence. Step 3 asked one question with a list it could not vouch for: `git fetch origin` ran, its exit code was discarded, and `git branch -r` printed the remote-tracking cache either way, so a restricted network produced a weeks-old local list presented as the remote's answer. And the answer was usually derivable - an issue carrying a target version, or linking a separate issue that represents the release, already names the branch on a repo whose release branches encode the version - and nothing derived it. Rule 5 now captures the exit code and rule 5b hands the list plus the issue's version fields and links to base-branch-candidates.mjs. Compression came first and six times, 1,118 characters reclaimed across this step before the number moved: the one-row picker rule and the not-skippable rule both restated picker-contract.md, the autopilot resolution order and the whole rationale for admitting version-carrying branches moved into features/base-branch-evidence.md, and the fetch-fail persistence block was four sentences for one instruction. The feature's own reasoning never entered this budget at all - the evidence sources, the learned convention, the picker contract, the autopilot fencing and the state shape are ~1,900 tokens living in that ref. What the phase doc carries is the call and the two facts an agent cannot infer: that the fetch exit code decides whether the list may be called remote, and that the branch filter needs a version alternative because a word list that discards is the prefix table this replaces. 100 was the smallest step that clears both, leaving 51 and 61 tokens. phase-3 and phase-4 remain amber. v17.6.0: phase-3-dev max 9300 -> 9450 and total 63000 -> 63150 for package-manager resolution. The node-shaped arms typed `npm` into two command lines, so a repo on pnpm, yarn or bun failed in Phase 3 with a worktree and a branch already created - or, worse, npm resolved against a lock file it does not own and the run continued on a tree the repo's own tooling would never have produced. Both arms now call package-manager.mjs, which prints the line to run. A resolver invocation is inherently longer than the four characters it replaces, and phase-3-dev had 2 tokens of headroom (9298/9300), so no addition of any size could have fit without a bump. Compression came first and twice, taking the new prose from 430 characters to 160 and trimming the build arm's tail by 140: the resolution order, the two-lock-file rule, the per-manager command shapes, the exit-3 contract and the eval-safety argument all live in features/package-manager.md, outside this budget. What the phase doc carries is the call and the one fact an agent cannot infer - that exit 3 means the repo declares no such script, so the step is skipped and said, never substituted. phase-4-review was compressed rather than raised in the same pass: its Gate 3 comment named npm as though it were the only node test command, and the corrected line is 64 characters SHORTER than the one it replaces, so the doc nets -64 while becoming true (15150/15150). 150 was the smallest step that clears phase-3-dev, leaving 51 tokens; 150 clears the aggregate, leaving 133. phase-3 and phase-4 remain amber.
+
+Recalibrated at v19.0.0 for the six-phase contract. Eight documents became six: `phase-1-analysis` + `phase-2-planning` merged into `phase-1-plan` (10000), `phase-3-dev` absorbed the Stage 1 verify gates that `phase-4-review` used to run a second time and became `phase-2-dev` (10650), the rest of review plus the whole of the old test phase became `phase-3-review` (17200), and commit and report kept their contents at their new numbers (6500, 5550). `phase-0-init` is untouched at 13400 - it was the reason analysis folded into planning rather than into init, because init plus analysis would have needed roughly 18000 and the two-sided rule refuses a ceiling that far above the measurement. Every ceiling here was measured after the merge rather than summed from the two documents that fed it: summing would have banked the duplicated build prose the merge deleted. Total 63150 -> 63300, which is the aggregate the six measurements actually need, not the old eight-phase total carried forward.