baldart 4.29.1 → 4.30.1

package/CHANGELOG.md

@@ -5,6 +5,24 @@ All notable changes to BALDART will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.30.1] - 2026-06-11
+
+**`new2`: stop spending opus on mechanical ops steps — explicit per-step model overrides.** Three `general-purpose` agents had no `model:` override, so they inherited the session's main-loop model (opus) for work that needs none. The Merge step is a deterministic OPS/GIT executor (git merge + YAML status reconciliation + grep-based epic closure + leave-and-report hygiene gates) whose correctness-critical checks (F-029 forcedDone guard, F-040 deferred guard) are enforced in JS AFTER it returns — independent of the agent's reasoning → **sonnet**. The per-card Codex review agent is a pure DRIVER (runs the companion, strips `[codex]` traces, maps findings) — the review intelligence is Codex, run externally → **haiku**. The post-merge Production Readiness checklist is non-blocking report-not-execute → **sonnet**. The Pre-flight agent (DAG + ownership map + idempotency — it grounds the whole batch) intentionally **stays opus**. **PATCH** (cost optimization on the EXPERIMENTAL `new2` surface; no behavior change — the deterministic guards/policies are unchanged; no config key).
+
+### Changed
+
+- **`framework/.claude/workflows/new2.js`** — `merge` → `model: 'sonnet'`; `review:<card>:codex` driver → `model: 'haiku'`; `production-readiness` → `model: 'sonnet'`. `preflight` unchanged (opus).
+
+## [4.30.0] - 2026-06-11
+
+**`new2`: Cross-Card Integration Pass — implement residuals deferred by a per-card ownership artifact in-batch, instead of leaving them as follow-ups to manage.** A residual deferred `out-of-ownership` is often a *process* artifact: during the per-card pipeline each card may only touch its own MAY-EDIT, so a fix that needs another card's files is deferred. But `new2` is strictly sequential — once every card is committed that boundary no longer binds. A new pass, run BEFORE the final review, re-runs `resolve()` for those residuals with ownership widened to `card MAY-EDIT ∪ remedy files` (domain-routed — never a raw coder), but ONLY when the remedy lands inside the batch union (`within()`); a remedy outside the batch is a future card's work and stays a follow-up. Transient `outage` residuals are retried with the card's own ownership. Everything else (`owner-gated` / `not-a-code-defect` / `baseline-not-reached` / new-AC `scope-expansion`) still defers — a coder physically cannot do those, or it would be silent scope creep. Integrated fixes are committed (one `[integrate]` commit) so the final review covers them, and a fully-freed card is marked DONE. **MINOR** (additive capability on the EXPERIMENTAL `new2` surface; scope per the user decision = out-of-ownership-within-batch + outage only; no `baldart.config.yml` key, so the schema-change propagation rule does not apply; no change to `/new`).
+
+### Added
+
+- **`framework/.claude/workflows/new2.js`** — `integrateCrossCard()` (new `Integrate` phase between `Implement` and `Final`): collects `out-of-ownership`/`outage` residuals, batch-union `within()` gate on remedy files, surgical ownership widening, domain-routed `resolve()` re-run, one integration commit + YAML DONE-marking for fully-freed cards, ledger cleanup. New telemetry `cross_card_integrated`; the residual ledger now carries `domain` + `remedyFiles`, and `cardMayEdit` records per-card MAY-EDIT for the union.
+- **`framework/.claude/workflows/new2-resolve.js`** — `noFollowup` arg: when the integration pass re-runs an already-tracked residual, a failed retry returns the verdict WITHOUT minting a duplicate follow-up card (the original residual stays tracked). `materialiseFollowup()` now propagates `remedyFiles` so the caller can decide whether a remedy is in-batch.
+- **`framework/.claude/skills/new2/SKILL.md`** — the A/B record step keeps `cross_card_integrated` alongside `deferral_breakdown` (how many deferrals were genuinely undeferrable vs absorbed in-batch).
+
 ## [4.29.1] - 2026-06-11
 
 **`new2`: `deferral_breakdown` telemetry — see WHY residuals became follow-ups, per class.** Follow-up cards in `new2` are not "useless deferred work": an in-scope fixable anomaly is fixed directly by `resolve()`'s domain fixer in-batch; a follow-up is created ONLY for a residual that is structurally undeferrable (`out-of-ownership` would edit another card's files · `owner-gated`/`not-a-code-defect`/`baseline-not-reached` aren't code a coder can apply · `unresolved` already failed fixer+judge+tier-2 · `scope-expansion` with a new AC needs a PRD decision · `outage`). To diagnose a run with *many* follow-ups, the telemetry now counts residuals per class so a skewed breakdown points at the real root cause (many `out-of-ownership` → PRD MAY-EDIT too narrow · many `unresolved` → fixes genuinely hard · many `scope-expansion` → cards under-specified upstream) — data first, before any change to the deferral logic. **PATCH** (observability only on the EXPERIMENTAL `new2` surface; diagnosis-only — nothing is auto-implemented from a residual; no behavior change, no config key).

package/VERSION

@@ -1 +1 @@
-4.29.1
+4.30.1

package/framework/.claude/skills/new2/SKILL.md

@@ -230,5 +230,8 @@ returns when the batch is done. It returns:
    of WHY residuals became follow-ups instead of in-batch fixes) in the record — a class dominating
    it is a root-cause signal (many `out-of-ownership` → PRD MAY-EDIT too narrow · many `unresolved` →
    fixes genuinely hard · many `scope-expansion` → cards under-specified upstream), and it is the
-   data to consult BEFORE proposing any change to the deferral logic. Do NOT re-summarise the cards —
-   the workflow already did.
+   data to consult BEFORE proposing any change to the deferral logic. Keep `cross_card_integrated`
+   too (count of residuals the pre-final-review Cross-Card Integration Pass implemented in-batch —
+   out-of-ownership-within-batch + outage retries — instead of leaving as follow-ups); with
+   `deferral_breakdown` it shows how many deferrals were genuinely undeferrable vs absorbed in-batch.
+   Do NOT re-summarise the cards — the workflow already did.

package/framework/.claude/workflows/new2-resolve.js

@@ -47,6 +47,11 @@ const cfg = a.config || {}
 const paths = cfg.paths || {}
 const backlogDir = paths.backlog_dir || 'backlog'
 const protectedDomain = domain === 'security' || domain === 'migration'
+// v4.30.0 — when the new2 Cross-Card Integration Pass RE-runs resolve on an already-tracked
+// residual (with widened ownership), a failure must NOT mint a SECOND follow-up card: the
+// original residual is still tracked by the caller. noFollowup makes materialiseFollowup return
+// the verdict without spawning prd-card-writer (no duplicate card, no wasted spawn).
+const noFollowup = a.noFollowup === true
 
 // F-019 — bounded immediate retry on transient errors (shared pattern; no import allowed).
 const TRANSIENT = /overload|529|429|rate.?limit|5\d\d|econn|etimedout|timeout|temporar|unavailable/i
@@ -221,7 +226,7 @@ if (attempt && attempt.terminal) {
       confirmed = !!(tj && tj.confirmed)
     } catch (_) { confirmed = false }
   }
-  if (confirmed) { log(`${kind} terminal (${tr}) — short-circuit to follow-up.`); return await materialiseFollowup(kind, `terminal: ${tr} — ${attempt.note || ''}`, collectOOS(attempt), tr || 'unresolved') }
+  if (confirmed) { log(`${kind} terminal (${tr}) — short-circuit to follow-up.`); return await materialiseFollowup(kind, `terminal: ${tr} — ${attempt.note || ''}`, collectOOS(attempt), tr || 'unresolved', attempt.remedyFiles) }
   log(`terminal verdict (${tr}) rejected — proceeding to multi-attempt.`)
 }
 
@@ -304,8 +309,15 @@ async function judgeVerify(verifiedAttempts) {
 // own code is complete; the residual is an external step (do NOT roll the card back). Anything
 // else (unresolved code defect, out-of-ownership, baseline) → genuine block → rollback as before.
 // The classifier flows back through resolve() in new2.js; never write it into the worktree.
-async function materialiseFollowup(k, reason, oos, deferralClass) {
+async function materialiseFollowup(k, reason, oos, deferralClass, remedyFiles) {
   const cls = deferralClass || 'unresolved'
+  const rf = Array.isArray(remedyFiles) ? remedyFiles : []
+  // noFollowup (integration re-run): return the verdict WITHOUT minting a duplicate card.
+  // remedyFiles rides the verdict so the caller can decide whether the remedy is in-batch.
+  if (noFollowup) {
+    log(`${k} still unresolved at integration — caller keeps the original residual (no duplicate card).`)
+    return { status: 'followup', followupCard: null, reason, deferralClass: cls, outOfScopeFindings: oos || [], remedyFiles: rf }
+  }
   let r = null
   try {
     // F-039 — backlog cards are owned by prd-card-writer (card-template + Rule C
@@ -322,9 +334,9 @@ async function materialiseFollowup(k, reason, oos, deferralClass) {
     // F-020 — could not materialise (e.g. outage): return WITHOUT a followupCard so the
     // SKILL writes it from the offline-safe residual ledger. Never claim it was created.
     log(`follow-up materialisation failed (${String(e && e.message)}) — skill will reconcile.`)
-    return { status: 'followup', followupCard: null, reason, deferralClass: cls, outOfScopeFindings: oos || [] }
+    return { status: 'followup', followupCard: null, reason, deferralClass: cls, outOfScopeFindings: oos || [], remedyFiles: rf }
   }
   const followupCard = (r && r.created && r.followupCard) ? r.followupCard : null
   log(`${k} → follow-up ${followupCard || '(deferred to skill)'} (nothing dropped).`)
-  return { status: 'followup', followupCard, reason, deferralClass: cls, outOfScopeFindings: oos || [] }
+  return { status: 'followup', followupCard, reason, deferralClass: cls, outOfScopeFindings: oos || [], remedyFiles: rf }
 }

package/framework/.claude/workflows/new2.js

@@ -1,10 +1,11 @@
 export const meta = {
   name: 'new2',
   description:
-    "EXPERIMENTAL workflow host for /new (A/B testing). Runs an ENTIRE backlog-card batch autonomously in the background runtime — pre-flight, a dependency-gated (DAG) per-card implement+review pipeline with specialized agents, cross-batch final review, and an integrity-gated auto-merge — so subagent output never enters the main orchestrator context. Zero AskUserQuestion: each /new gate is a deterministic policy; blocking gates and scope-expanding findings are routed to the new2-resolve self-healing workflow. Resilient by design: transient API errors are retried, a sustained outage degrades cleanly (durable resume), follow-ups for residuals are reconciled by the skill (offline-safe), and the merge is blocked unless the batch is verifiably complete (no false-DONE, no unreviewed code). Agents Read /new's reference modules for semantics (args.refModulesBase) so this script encodes only orchestration shape + gate policy. Claude-only.",
+    "EXPERIMENTAL workflow host for /new (A/B testing). Runs an ENTIRE backlog-card batch autonomously in the background runtime — pre-flight, a dependency-gated (DAG) per-card implement+review pipeline with specialized agents, cross-batch final review, and an integrity-gated auto-merge — so subagent output never enters the main orchestrator context. Zero AskUserQuestion: each /new gate is a deterministic policy; blocking gates and scope-expanding findings are routed to the new2-resolve self-healing workflow. Before the final review a cross-card integration pass implements the residuals that were deferred only by the per-card ownership artifact (out-of-ownership whose remedy lands inside the batch union) or by a transient outage — re-running resolve with batch-union ownership, domain-routed — so they are not left as follow-ups to manage later (owner-gated / not-a-code-defect / baseline / new-AC scope-expansion still defer). Resilient by design: transient API errors are retried, a sustained outage degrades cleanly (durable resume), follow-ups for residuals are reconciled by the skill (offline-safe), and the merge is blocked unless the batch is verifiably complete (no false-DONE, no unreviewed code). Agents Read /new's reference modules for semantics (args.refModulesBase) so this script encodes only orchestration shape + gate policy. Claude-only.",
   phases: [
     { title: 'Pre-flight', detail: 'deterministic workspace hygiene + worktree + dep-graph + cross-card grounding (Phase 0)' },
     { title: 'Implement', detail: 'dependency-gated per-card implement+review pipeline with owner_agent + specialized review fan-out' },
+    { title: 'Integrate', detail: 'cross-card integration pass: implement residuals deferred by a per-card ownership artifact / outage (batch-union ownership)' },
     { title: 'Final', detail: 'cross-batch final review (delegates to new-final-review)' },
     { title: 'Merge', detail: 'integrity-gated auto-merge to trunk via git.merge_strategy + cleanup' },
     { title: 'Production', detail: 'post-merge production-readiness checklist (Phase 7, non-blocking)' },
@@ -65,9 +66,11 @@ const mergeStrategy = gitCfg.merge_strategy || 'pr'
 const firstCard = cardIds[0] || 'BATCH'
 const gateLedger = []        // { card, gate, decision, detail }
 const residualFollowups = [] // { card, kind, followupCard, reason }
-const residuals = []         // F-020 OFFLINE-SAFE ledger: { card, kind, evidence, materialized }
+const residuals = []         // F-020 OFFLINE-SAFE ledger: { card, kind, evidence, materialized, deferralClass, domain, remedyFiles }
+const cardMayEdit = {}       // v4.30.0 — per-card MAY-EDIT, for the cross-card integration union
 const perCardResults = []
 let prodReadiness = null
+let integratedCount = 0      // v4.30.0 — residuals resolved by the Cross-Card Integration Pass
 let degraded = false
 const degradationReasons = []
 
@@ -379,7 +382,9 @@ async function resolve(kind, card, evidence, extra) {
     const fc = (res && res.followupCard) || null
     residualFollowups.push({ card, kind, followupCard: fc || '(pending)', reason: (res && res.reason) || '' })
     // A3 — deferralClass rides the residual so the skill can gate DONE-reconciliation on it.
-    residuals.push({ card, kind, evidence, materialized: !!fc, deferralClass })
+    // v4.30.0 — domain + remedyFiles ride too, so the Cross-Card Integration Pass can re-route by
+    // domain and decide whether an out-of-ownership remedy lands inside the batch union.
+    residuals.push({ card, kind, evidence, materialized: !!fc, deferralClass, domain: dom, remedyFiles: (res && res.remedyFiles) || [] })
   }
   // F-022 — route out-of-scope findings the resolve surfaced.
   for (const osf of (res && res.outOfScopeFindings) || []) {
@@ -523,6 +528,7 @@ async function runCard(cardId, cardPath) {
   if (impl && impl.epic) { g('router', 'EPIC-SKIPPED', 'epic card'); return { card: cardId, status: 'epic-skipped', gates, commit: '-' } }
 
   const mayEdit = (impl && impl.mayEditPaths) || []
+  cardMayEdit[cardId] = mayEdit // v4.30.0 — feeds the cross-card integration union
   const scopeFiles = (impl && impl.scopeFiles) || []
   // F-040 — E4 honest label: 'AUTO-REVERTED' used to be a no-op log (files were left orphaned).
   // Now the owner agent reconciles out-of-ownership edits itself (implement.md §11b); we report
@@ -620,7 +626,11 @@ async function runCard(cardId, cardPath) {
             `Read the Codex output ONLY through a [codex]-trace-stripping filter. **Fallback**: if it exits non-zero / prints CODEX_NOT_FOUND / stays empty, return note:'codex-unavailable' with EMPTY blocks/scopeExpansion — do NOT review yourself (role boundary); the workflow spawns the real code-reviewer.\n\n` +
             `Map Codex BLOCKER/HIGH findings to blocks:[{gate:'codex-light',domain,evidence}] (each non-empty gate AND evidence — F-014). Map legitimate findings BEYOND this card's AC to scopeExpansion:[{evidence,domain,withinOwnership,newAC}].\n\n` +
             `Return: { blocks:[...], scopeExpansion:[...], note }`,
-          { label: `review:${cardId}:codex`, phase: 'Implement', agentType: 'general-purpose', schema: reviewSchema }
+          // Haiku, not the inherited opus: this agent is a pure DRIVER — it runs the Codex companion
+          // (node + --wait), strips [codex] traces, and maps the companion's findings into the schema.
+          // The review INTELLIGENCE is Codex (a different model, run externally); driving it needs no
+          // opus reasoning, same as the other mechanical git/ops steps.
+          { label: `review:${cardId}:codex`, phase: 'Implement', agentType: 'general-purpose', model: 'haiku', schema: reviewSchema }
         ).catch(onErr)
       }
       return stdReview(ra)
@@ -802,6 +812,96 @@ async function crashResult(id, e) {
   return { card: id, status: 'failed', gates: [{ gate: 'runCard', decision: 'ERROR', detail: String(e && e.message) }], commit: '-' }
 }
 
+// ───────────────────────────────────────────────────────────────────────────
+// Cross-Card Integration Pass (v4.30.0) — runs BEFORE the final review.
+// A residual deferred ONLY by the per-card ownership artifact (`out-of-ownership`, with its
+// remedy inside the batch union) or by a transient `outage` CAN now be implemented: new2 is
+// strictly sequential, so once every card is committed the per-card MAY-EDIT boundary no longer
+// binds. Re-run resolve() with ownership widened to the batch union (domain-routed — never a raw
+// coder), commit the result so the final review covers it, and mark a fully-freed card DONE.
+// Everything else (owner-gated / not-a-code-defect / baseline / scope-expansion / out-of-batch
+// out-of-ownership) stays a tracked follow-up: a coder physically cannot do those, or doing so
+// would be silent scope creep. Failure keeps the ORIGINAL residual (noFollowup → no duplicate card).
+// ───────────────────────────────────────────────────────────────────────────
+async function integrateCrossCard() {
+  if (degraded || !sharedCtx || !sharedCtx.worktreePath) return
+  const targets = residuals.filter((r) => !r.materialized && !r.integrated &&
+    (r.deferralClass === 'out-of-ownership' || r.deferralClass === 'outage'))
+  if (!targets.length) return
+  const batchUnion = dedupe(Object.values(cardMayEdit).flat())
+  if (!batchUnion.length) return
+  phase('Integrate')
+  const within = (files) => Array.isArray(files) && files.length &&
+    files.every((f) => batchUnion.some((m) => String(f).includes(m) || m.includes(String(f))))
+  const freedCards = new Set()
+  for (const r of targets) {
+    // out-of-ownership is implementable here ONLY if the remedy belongs to a card IN THIS batch;
+    // a remedy outside the union is a future card's work → it stays a tracked follow-up.
+    if (r.deferralClass === 'out-of-ownership' && !within(r.remedyFiles)) {
+      g('integrate', 'STAYS-FOLLOWUP', `${r.card}: remedy outside batch union (future card) — ${r.evidence}`)
+      continue
+    }
+    const dom = r.domain || 'code'
+    // Minimal widening (NOT the whole batch union): outage was not an ownership problem → retry with
+    // the card's own ownership; out-of-ownership → the card's files PLUS exactly the remedy files
+    // (already proven in-batch by within()). Tighter ownership = less room for incidental edits.
+    const ownership = r.deferralClass === 'outage'
+      ? (cardMayEdit[r.card] || batchUnion)
+      : dedupe((cardMayEdit[r.card] || []).concat(r.remedyFiles || []))
+    let res = null
+    try {
+      res = await workflow('new2-resolve', {
+        kind: r.kind, cardId: r.card, evidence: r.evidence,
+        findings: [{ kind: r.kind, evidence: r.evidence, domain: dom }],
+        worktreePath: sharedCtx.worktreePath,
+        mayEditPaths: domainMayEdit(dom, ownership),
+        scopeFiles: ownership, domain: dom,
+        refModulesBase: REF, config: cfg, ts: TS,
+        noFollowup: true, // a failed retry keeps the ORIGINAL residual — no duplicate card
+      })
+    } catch (e) { if (e && (e.transientExhausted || isTransient(e))) noteDegraded('outage'); res = null }
+    if (res && res.status === 'resolved') {
+      r.integrated = true
+      freedCards.add(r.card)
+      g('integrate', 'INTEGRATED', `${r.card} (${r.deferralClass}/${dom}): ${r.evidence}`)
+    } else {
+      g('integrate', 'STILL-DEFERRED', `${r.card} (${r.deferralClass}): ${(res && res.reason) || 'unresolved with widened ownership'}`)
+    }
+  }
+  const integrated = targets.filter((r) => r.integrated)
+  if (!integrated.length) return
+  // Drop integrated residuals from the offline-safe ledger (the work landed — nothing to follow up).
+  for (let i = residuals.length - 1; i >= 0; i--) if (residuals[i].integrated) residuals.splice(i, 1)
+  // A card is FULLY freed (→ DONE) only when no residual remains for it AND its sole deferral
+  // reasons were the integration classes; a card still owner-gated/policy-deferred stays NON-DONE.
+  const fullyFreed = []
+  for (const cardId of freedCards) {
+    const pc = perCardResults.find((x) => x.card === cardId)
+    if (!pc) continue
+    const stillResidual = residuals.some((x) => x.card === cardId)
+    const remaining = (pc.deferredClasses || []).filter((c) => c !== 'out-of-ownership' && c !== 'outage')
+    pc.deferredClasses = remaining
+    if (!stillResidual && !remaining.length) { pc.deferred = false; fullyFreed.push(cardId) }
+    for (let i = residualFollowups.length - 1; i >= 0; i--) {
+      if (residualFollowups[i].card === cardId && !stillResidual) residualFollowups.splice(i, 1)
+    }
+  }
+  // ONE integration commit (the fixes cross card boundaries); mark fully-freed cards DONE in YAML.
+  try {
+    await agentSafe(
+      `Commit the cross-card integration fixes in worktree ${sharedCtx.worktreePath}. MECHANICAL — do NOT modify source beyond what is already changed on disk. Steps:\n` +
+        `(1) \`git status --porcelain\`; (2) stage ONLY dirty files within the batch union ${JSON.stringify(batchUnion)} — NEVER \`git add -A\`, NEVER \`git stash\`; (3) for each fully-freed card YAML [${fullyFreed.join(', ') || '(none)'}] set status to DONE and add implementation_note "cross-card integration: deferred AC resolved with batch-union ownership (new2 v4.30.0)"; (4) commit message \`[integrate] cross-card residual fixes${fullyFreed.length ? ' (' + fullyFreed.join(', ') + ')' : ''}\`; (5) 'nothing to commit' = the resolve already committed (record HEAD).\n` +
+        `Return: { committed, commit, filesChanged }`,
+      { label: 'integrate:commit', phase: 'Integrate', agentType: 'general-purpose', model: 'haiku',
+        schema: { type: 'object', required: ['committed'], additionalProperties: true, properties: { committed: { type: 'boolean' }, commit: { type: 'string' }, filesChanged: { type: 'array', items: { type: 'string' } } } } }
+    )
+  } catch (e) { if (e && e.transientExhausted) noteDegraded('outage') }
+  integratedCount = integrated.length
+  ledger(fullyFreed[0] || firstCard, 'cross-card-integration', 'DONE', `${integrated.length} residual(s) integrated; freed→DONE: ${fullyFreed.join(', ') || 'none (code landed, cards still deferred for other reasons)'}`)
+}
+
+await integrateCrossCard()
+
 const committed = perCardResults.filter((r) => r.status === 'committed')
 
 // ───────────────────────────────────────────────────────────────────────────
@@ -920,7 +1020,12 @@ if (!committed.length) {
         `• EPIC CLOSURE (Phase 6b step 5e): the epic/parent card (group.is_epic:true) is NOT in the batch and stays TODO unless closed here. For each distinct group.parent of the batch cards (and any epic card in the batch itself): if EVERY child of that epic — \`grep -l "parent: <EPIC-ID>" ${paths.backlog_dir || 'backlog'}/*.yml | xargs grep -L "status: DONE"\` prints nothing — set the epic card status:DONE + completed_date + note "epic-closure gate — all children DONE" and fold into the reconciliation commit. If any child is still open → leave the epic untouched. This is NOT a forcedDone violation (the epic is a tracker, gated on all-children-DONE, not on its own commit). Return epicsClosed:[<EPIC-IDs marked DONE>].\n` +
         `• G19 sync-deferred → HEAD==${TRUNK} ff-pull, else leave+report. G20 → leave+report. G21 post-batch dirty → partition-ignore framework artifacts; leave the rest + report (do NOT commit). G22 divergence → behind: ff-pull; ahead/both: leave+report; NEVER reset --hard/force-push. G23 stash restore conflict → leave intact + report.\n\n` +
         `Return: { merged, mergeCommit, mergeTs, reconciliation, forcedDone:[], deferredLeftOpen:[], uncommittedLeft, note }`,
-      { label: 'merge', phase: 'Merge', agentType: 'general-purpose', schema: MERGE_SCHEMA }
+      // Sonnet, not the inherited opus: this is a deterministic OPS/GIT executor (git merge +
+      // YAML status reconciliation + grep-based epic closure + leave-and-report hygiene gates), and
+      // the correctness-critical checks (F-029 forcedDone guard, F-040 deferred guard) are enforced
+      // in JS AFTER it returns — they do NOT depend on the agent's reasoning. Opus here is pure cost;
+      // haiku would be too weak for the conditional epic-closure / G19-23 divergence logic.
+      { label: 'merge', phase: 'Merge', agentType: 'general-purpose', model: 'sonnet', schema: MERGE_SCHEMA }
     )
   } catch (e) { if (e && e.transientExhausted) noteDegraded('outage'); mergeResult = null }
   if (mergeResult && (mergeResult.forcedDone || []).length) { noteDegraded('false_done'); ledger(firstCard, 'F029-guard', 'VIOLATION', `forcedDone: ${mergeResult.forcedDone.join(' ')}`) }
@@ -945,7 +1050,10 @@ if (mergeResult && mergeResult.merged) {
   try {
     prodReadiness = await agentSafe(
       `Run the post-merge Production Readiness checklist per ${REF}/production-readiness.md (Phase 7) over the batch's changed files. Auto-EXECUTE only stack-matched index/access-rule/cron deploys; REPORT (do not execute) env vars, feature flags, DB migrations, secrets, DNS. NON-BLOCKING. ROLE BOUNDARY: you EXECUTE commands, you never edit repository files — a needed code/config change is reported as a manual item.\n\n${projectBrief}\nChanged files: ${dedupe(committed.flatMap((r) => r.filesChanged || [])).join(', ') || '(derive from git)'}\n\nReturn: { autoExecuted:[...], manualItems:[...], note }`,
-      { label: 'production-readiness', phase: 'Production', agentType: 'general-purpose',
+      // Sonnet, not the inherited opus: a non-blocking report-not-execute checklist (auto-run only
+      // stack-matched deploys, REPORT the rest). Sonnet follows the checklist reliably at a fraction
+      // of the cost; nothing here gates the merge (it already happened).
+      { label: 'production-readiness', phase: 'Production', agentType: 'general-purpose', model: 'sonnet',
         schema: { type: 'object', required: ['manualItems'], additionalProperties: true, properties: { autoExecuted: { type: 'array', items: { type: 'string' } }, manualItems: { type: 'array', items: { type: 'string' } }, note: { type: 'string' } } } }
     )
     ledger(firstCard, 'phase7-production', 'DONE', `auto=${((prodReadiness && prodReadiness.autoExecuted) || []).length} manual=${((prodReadiness && prodReadiness.manualItems) || []).length}`)
@@ -994,6 +1102,9 @@ function buildTelemetry() {
     // ownership), many `unresolved` → fixes genuinely hard, many `scope-expansion` → cards
     // under-specified upstream. This is diagnosis-only; nothing is auto-implemented from a residual.
     deferral_breakdown: residuals.reduce((b, x) => { const k = x.deferralClass || x.kind || 'unknown'; b[k] = (b[k] || 0) + 1; return b }, {}),
+    // v4.30.0 — residuals the Cross-Card Integration Pass implemented in-batch (out-of-ownership
+    // within the batch union + outage retries) instead of leaving as follow-ups to manage later.
+    cross_card_integrated: integratedCount,
     // followups_on_disk is filled by the SKILL after it materialises pending residuals.
     followups_materialized_in_workflow: residuals.filter((x) => x.materialized).length,
     resolve_invocations: resolvedSignatures.size,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "baldart",
-  "version": "4.29.1",
+  "version": "4.30.1",
   "description": "Claude Agent Framework - Reusable framework for coordinating AI agents and humans in software projects",
   "bin": {
     "baldart": "./bin/baldart.js"