mandrel 2.0.0 → 2.1.0

package/.agents/docs/agentrc-reference.json

@@ -56,19 +56,17 @@
       "mentionOperator": false,
       "commentEvents": ["state-transition", "story-merged", "operator-message"],
       "webhookEvents": [
-        "epic-started",
-        "epic-progress",
-        "epic-blocked",
-        "epic-unblocked",
-        "epic-complete"
+        "state-transition",
+        "story-merged",
+        "story-closing",
+        "operator-message",
+        "merge.unlanded",
+        "merge.flip-failed",
+        "loop.tick"
       ]
     }
   },
   "planning": {
-    "context": {
-      "maxBytes": 50000,
-      "summaryMode": "auto"
-    },
     "codebaseSnapshot": {
       "tier": "skinny",
       "include": [
@@ -131,8 +129,7 @@
       "paths": ["README.md"]
     },
     "deliverRunner": {
-      "concurrencyCap": 3,
-      "verifyConcurrencyCap": 4
+      "concurrencyCap": 3
     },
     "worktreeIsolation": {
       "enabled": true,
@@ -336,12 +333,10 @@
       "codingGuardrails": {
         "cyclomaticFlag": 8,
         "cyclomaticMustFix": 12,
-        "miDropMustRefactor": 1.5,
         "requireSiblingTest": false
       },
       "autoRefresh": {
         "enabled": true,
-        "miDropCap": 1.5,
         "crapJumpCap": 5,
         "scope": "diff"
       },

package/.agents/docs/configuration.md

@@ -97,9 +97,6 @@ top-level keys are validation errors.
 | Key | Required | Type | Default | Description |
 | --- | --- | --- | --- | --- |
 | `riskHeuristics` | No | `string[]` or `{ append?, prepend? }` | — | — |
-| `context` | No | `object` | — | Nested configuration block. |
-| `context.maxBytes` | No | `integer` | — | — |
-| `context.summaryMode` | No | `"auto"` \| `"always"` \| `"never"` | — | — |
 | `codebaseSnapshot` | No | `object` | — | Nested configuration block. |
 | `codebaseSnapshot.tier` | No | `"skinny"` \| `"medium"` | — | — |
 | `codebaseSnapshot.include` | No | `array<string>` | — | — |
@@ -121,13 +118,12 @@ top-level keys are validation errors.
 | --- | --- | --- | --- | --- |
 | `execution` | No | `object` | — | Nested configuration block. |
 | `execution.timeoutMs` | No | `integer` | — | — |
-| `lease` | No | `object` | — | Story #3480 (Epic #3457). Assignee-as-lease primitive. ttlMs is the staleness window — a ticket claim whose owner has not emitted a story.heartbeat within this many milliseconds is reclaimable by another operator. Defaults to 900000 (15 min) in lib/config/limits.js. |
+| `lease` | No | `object` | — | Story #3480 (Epic #3457). Assignee-as-lease primitive. ttlMs is the staleness window — a ticket claim whose owner's last heartbeat is older than this many milliseconds is reclaimable by another operator. Defaults to 900000 (15 min) in lib/config/limits.js. Note the shipped guards fail closed (there is no live heartbeat source), so a stranded claim is cleared with --steal rather than by TTL expiry. |
 | `lease.ttlMs` | No | `integer` | — | — |
 | `docsFreshness` | No | `object` | — | Nested configuration block. |
 | `docsFreshness.paths` | No | `array` | — | — |
 | `deliverRunner` | No | `object` | — | Nested configuration block. |
 | `deliverRunner.concurrencyCap` | No | `integer` | — | Maximum ready Stories dispatched by /deliver at once. Default 3. Moderate by design — keeps host-quota consumption predictable while allowing a small ready-set fan-out. Set 1 for strictly sequential delivery; raise further on hosts with adequate parallel-agent quota. See deliver.md for the sequencing model and throughput tradeoff. |
-| `deliverRunner.verifyConcurrencyCap` | No | `integer` | — | Bounded-concurrency cap for the per-wave verifyWaveResults loop (Epic #3019 Tech Spec §1.4). Separate from the wave-execution `concurrencyCap` so operators can tune ticket-verification parallelism independently of Story dispatch parallelism. Default 4. |
 | `worktreeIsolation` | No | `object` | — | Nested configuration block. |
 | `worktreeIsolation.enabled` | No | `boolean` | — | — |
 | `worktreeIsolation.root` | No | `string` | — | — |
@@ -235,11 +231,9 @@ top-level keys are validation errors.
 | `quality.codingGuardrails` | No | `object` | — | Nested configuration block. |
 | `quality.codingGuardrails.cyclomaticFlag` | No | `integer` | — | — |
 | `quality.codingGuardrails.cyclomaticMustFix` | No | `integer` | — | — |
-| `quality.codingGuardrails.miDropMustRefactor` | No | `number` | — | — |
 | `quality.codingGuardrails.requireSiblingTest` | No | `boolean` | — | — |
 | `quality.autoRefresh` | No | `object` | — | Nested configuration block. |
 | `quality.autoRefresh.enabled` | No | `boolean` | — | — |
-| `quality.autoRefresh.miDropCap` | No | `number` | — | — |
 | `quality.autoRefresh.crapJumpCap` | No | `number` | — | — |
 | `quality.autoRefresh.scope` | No | `"diff"` \| `"full"` | — | — |
 | `quality.baselineEpsilon` | No | `object` | — | Per-kind epsilon for s-stability-epsilon (Story #1964). Sub-epsilon row deltas resolve to prior bytes so env variance does not rewrite the on-disk baseline. |
@@ -252,13 +246,15 @@ top-level keys are validation errors.
 | `quality.baselineEpsilon.bundle-size` | No | `number` | — | — |
 | `quality.baselineEpsilon.duplication` | No | `number` | — | — |
 | `quality.requireBaselines` | No | `boolean` | — | Story #4495. Fail-closed baseline-enforcement policy for the unified check-baselines close-validation gate. When false (default), a consumer that enables baseline gates (crap/maintainability/…) but has not committed the corresponding baseline artifacts under baselines/ gets a clean skip-with-reason instead of a deterministic first-try close failure. Set true to keep the gate registered so an absent baseline artifact fails close-validation with a preflight hint naming the fix (the fail-closed posture). |
-| `quality.navigability` | No | `object` | — | Navigability lens + journey-suite config (Epic #4131, F2/F3/F1/F4). Read by audit-suite/selector.js (route globs) and /deliver's risk-routed ceremony (journey suite). Opt-in: absent or empty routeGlobs degrades to a silent no-op. |
+| `quality.navigability` | No | `object` | — | Navigability lens + journey-suite config (Epic #4131, F2/F3/F1/F4). Read by audit-suite/selector.js (route globs) and /deliver's per-Story ceremony (journey suite). Opt-in: absent or empty routeGlobs degrades to a silent no-op. |
 | `quality.navigability.routeGlobs` | No | `array<string>` | — | Glob patterns (pages/**, app/**/route.ts) marking paths that add a user-facing route — the route-tree SSOT the navigability lens enumerates and the route-added routing predicate matches against. |
 | `quality.navigability.navRegistry` | No | `array<string>` | — | Tokens identifying the nav-registry SSOT the navigability lens checks every route resolves a nav door against. |
-| `quality.navigability.journeySuite` | No | `string` | — | Path or command for the per-persona journey suite /deliver's risk-routed ceremony runs. |
-| `mergeWatch` | No | `object` | — | Knobs consumed by the MergeWatcher lifecycle listener (Story #2896, Epic #2880). `intervalSeconds` is the poll cadence between `gh pr view --json mergeCommit,mergedAt` probes after epic.merge.armed; `maxBudgetSeconds` is the total wall-clock budget before the watcher surfaces `agent::blocked` with reason `budget-exceeded`. |
-| `mergeWatch.intervalSeconds` | No | `integer` | `30` | Seconds between MergeWatcher polls. Default 30. |
-| `mergeWatch.maxBudgetSeconds` | No | `integer` | `3600` | Total wall-clock budget (seconds) for the MergeWatcher poll loop. Default 3600 (60 minutes). |
+| `quality.navigability.journeySuite` | No | `string` | — | Path or command for the per-persona journey suite /deliver's per-Story ceremony runs. |
+| `mergeWatch` | No | `object` | — | Knobs consumed by the close-and-land merge wait (Story #4543; defaults in `lib/orchestration/merge-poll.js`). `intervalSeconds` is the poll cadence between `gh pr view` probes after the arm. `maxWaitSeconds` bounds ONE invocation of the merge wait and its expiry returns a resumable `pending` terminal with no label mutation; `maxBudgetSeconds` bounds the CUMULATIVE wait across resumes (anchored at the PR's createdAt, so a resume does not restart the clock) and exhausting it is the genuine give-up that classifies and blocks. `updateAttempts` caps the bounded update of a behind-the-base PR. |
+| `mergeWatch.intervalSeconds` | No | `integer` | `30` | Seconds between merge-wait polls. Default 30. |
+| `mergeWatch.maxWaitSeconds` | No | `integer` | `300` | Per-invocation merge-wait bound (seconds). Default 300 (5 minutes) — chosen to fit inside a single host tool invocation (~10 min ceiling) alongside the close gates that precede the wait. Expiry yields `pending` (exit 3), never a block. Headless callers with no host ceiling raise this to land in one block. |
+| `mergeWatch.maxBudgetSeconds` | No | `integer` | `3600` | Cumulative wall-clock budget (seconds) across merge-wait resumes, anchored at the PR's createdAt. Default 3600 (60 minutes). Exhausting this classifies the block and transitions the Story to agent::blocked. |
+| `mergeWatch.updateAttempts` | No | `integer` | `3` | Maximum times the merge wait will bring a behind-the-base PR up to date before giving up on the branch. Default 3. Set 0 to disable the update. |
 | `codeReview` | No | `object` | — | Nested configuration block. |
 | `codeReview.providers[]` | No | `array<object>` | — | Review-provider chain (Story #2871). When unset or empty, defaults to [{ name: "native" }]. The orchestrator iterates inline entries in declaration order and merges their Finding[] before posting one structured comment; manual-prompt entries (e.g. ultrareview) contribute a trailing 'Manual review suggestions' section. Selecting an adapter whose probe fails hard-fails at factory construction unless declared `optional: true` in the chain. Each item has: name, scopes, optional, manualPrompt, when. |
 | `codeReview.providerConfig` | No | `object` | — | Optional escape hatch for adapter-specific configuration. No documented keys in Epic #2815; reserved so future adapters can be configured without another schema migration. |
@@ -278,11 +274,11 @@ top-level keys are validation errors.
 | `ci.autoMerge` | No | `"trust-ci"` \| `"strict"` | — | Story #4356 (Epic #4355). Merge posture. 'trust-ci' (default) merges once required checks pass; 'strict' additionally requires a clean review gate. |
 | `routing` | No | `object` | — | v2 delivery-spawn routing: role-scoped boot contexts and maker-checker sampling. The v1 singleDelivery epic-route kill-switch was removed in Stage 6. |
 | `routing.roleScopedAgents` | No | `boolean` | — | Epic #4478 (M7-B). Kill-switch for the role-scoped boot contexts. When true (default), a converted delivery spawn (`story-worker`, `acceptance-critic`) boots on its own `.claude/agents/<role>.md` system prompt instead of re-paying the full CLAUDE.md @-import closure (≈50KB → ≈8KB per spawn — the payoff of the context diet). When false, every converted spawn falls back to `subagent_type: general-purpose` — the instant, code-rollback-free per-consumer revert, and the universal escape for hosts that ignore `.claude/agents/`. The fallback is the full-closure agent that ran before M7-B, so flipping it off never drops a gate. |
-| `routing.freshCriticSampleRate` | No | `number` | — | Epic #4478 (M7-B, Part 2). Maker-checker sampling floor. Risk-routed ceremony sends a low-risk acceptance cluster down the contract-identical inline critic path, but this fraction of low-risk clusters is still forced through a fresh-context critic so low risk never means zero independent checking. Clamped to [0, 1]; 0 disables the floor, 1 forces every cluster fresh. Default 0.2. Consumed by resolveCeremonyForRisk (lib/orchestration/ceremony-routing.js). |
-| `routing.ceremonyProfile` | No | `"minimal"` \| `"standard"` \| `"strict"` | — | Acceptance-ceremony depth. minimal = always inline critic; strict = always fresh-context critic; standard (default) = risk-routed with the maker-checker sampling floor. |
+| `routing.freshCriticSampleRate` | No | `number` | — | Epic #4478 (M7-B, Part 2). Maker-checker sampling floor. Under the standard profile, a change set touching no sensitive path routes its acceptance clusters down the contract-identical inline critic path, but this fraction of them is still forced through a fresh-context critic so a low derived level never means zero independent checking. Clamped to [0, 1]; 0 disables the floor, 1 forces every cluster fresh. Default 0.2. Consumed by resolveCeremonyForRisk (lib/orchestration/ceremony-routing.js). |
+| `routing.ceremonyProfile` | No | `"minimal"` \| `"standard"` \| `"strict"` | — | Acceptance-ceremony depth. minimal = always inline critic; strict = always fresh-context critic; standard (default) = routed off the change level derived from the Story diff, with the maker-checker sampling floor. |
 | `routing.closeAndLand` | No | `boolean` | — | When true (default), single-story-close lands through merge in one close. Opt out per-run with --no-wait-merge. |
 | `feedbackLoop` | No | `object` | — | Nested configuration block. |
-| `feedbackLoop.auditResultsAutoFile` | No | `boolean` | `true` | When true (default), the Epic finalize listener auto-files non-blocking audit-results findings as follow-up issues routed by source classification. Set to false to suppress auto-filing; findings remain accessible in the structured comments on the Epic. |
+| `feedbackLoop.auditResultsAutoFile` | No | `boolean` | `true` | When true (default), the close-time audit-results graduator auto-files non-blocking audit-results findings as follow-up issues routed by source classification. Set to false to suppress auto-filing; findings remain accessible in the structured comments on the Story. |
 | `feedbackLoop.retroProposals` | No | `boolean` | `true` | When true (default), the retro auto-files its actionable routed proposals as meta::<framework-gap\|consumer-improvement> + friction::<category> issues via the graduator pre-parsed-findings seam, and the rendered retro sections list the filed issue numbers instead of paste-ready gh command stanzas. Set to false to fall back to the command stanzas. |
 
 <!-- END GENERATED:agentrc -->
@@ -405,15 +401,13 @@ Repository-level merge-method allowlist applied by bootstrap.
 | ----------------- | -------- | -------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
 | `mentionOperator` | No       | `false`                                                                                | When `true`, friction comments @-mention `operatorHandle` for `medium`-severity dispatches (high always @mentions).                          |
 | `commentEvents`   | No       | `["state-transition", "story-merged", "operator-message"]`                             | Allowlist of event names that reach the GitHub ticket comment channel.                                                                       |
-| `webhookEvents`   | No       | `["epic-started", "epic-progress", "epic-blocked", "epic-unblocked", "epic-complete"]` | Allowlist of event names that reach `NOTIFICATION_WEBHOOK_URL`. The webhook channel is curated for the epic narrative; story-level events are excluded. |
+| `webhookEvents`   | No       | `["state-transition", "story-merged", "story-closing", "operator-message", "merge.unlanded", "merge.flip-failed", "loop.tick"]` | Allowlist of event names that reach `NOTIFICATION_WEBHOOK_URL`. The vocabulary mirrors the events the v2 runtime actually emits through `notify()`. |
 
 Both fields' enums are pinned in the schema and rejected if extended. To
 suppress a channel entirely, set its array to `[]`.
 
-> **Severity assignment.** Task transitions and `story-run-progress` upserts
-> fire `low` (frequency-driven). Story state transitions, `wave-run-progress`,
-> `epic-run-progress`, and epic-completion fire `medium`. Epic blockers and
-> HITL gates fire `high` (webhook prefix `[Action Required]` when an
+> **Severity assignment.** Story state transitions fire `medium`. Blockers
+> and HITL gates fire `high` (webhook prefix `[Action Required]` when an
 > allowlisted blocker event reaches the webhook).
 
 ---
@@ -456,17 +450,6 @@ is `soft` (visible to the planner, does not trip re-decompose). Set a
    explicit `--allow-large-fan-out` operator flag for very large delete blasts;
    that is separate from Story sizing.
 
-### `planning.context`
-
-Caps the size of `--emit-context` JSON payloads emitted during `/plan`
-so a runaway Epic body (with its folded Tech Spec sections) can't blow the
-planning agent's context budget.
-
-| Field         | Required | Default  | Purpose                                                                                       |
-| ------------- | -------- | -------- | --------------------------------------------------------------------------------------------- |
-| `maxBytes`    | No       | `50000`  | Hard ceiling on the JSON payload size (bytes). Truncation is summary-mode-aware.              |
-| `summaryMode` | No       | `'auto'` | `'auto'` truncates intelligently; `'never'` errors over the cap; `'always'` always summarizes. |
-
 ### `planning.codebaseSnapshot`
 
 Controls the codebase-snapshot fetcher that grounds Tech Spec / Story authoring.
@@ -536,8 +519,7 @@ fall back to documented defaults (or are no-ops when omitted).
 
 | Field                       | Required | Default | Purpose                                          |
 | --------------------------- | -------- | ------- | ------------------------------------------------ |
-| `concurrencyCap`            | No       | `3`     | Max parallel Story sub-agents per wave.          |
-| `verifyConcurrencyCap`      | No       | `4`     | Max parallel verify steps per wave.              |
+| `concurrencyCap`            | No       | `3`     | Max ready Stories dispatched by `/deliver` at once. |
 
 ### `delivery.worktreeIsolation`
 
@@ -666,7 +648,6 @@ for `BUNDLE_SIZE_REFRESH=1` usage.
 | ---------------------- | -------- | ------- | ------------------------------------------------------------------ |
 | `cyclomaticFlag`       | No       | (none)  | Cyclomatic-complexity value at which the engineer should refactor.  |
 | `cyclomaticMustFix`    | No       | (none)  | Cyclomatic-complexity value that hard-fails the gate.               |
-| `miDropMustRefactor`   | No       | (none)  | MI drop that mandates a refactor.                                   |
 | `requireSiblingTest`   | No       | (none)  | When `true`, a new function requires a sibling test file.           |
 
 #### `delivery.quality.autoRefresh`
@@ -676,7 +657,6 @@ Controls Story-close auto-baseline-refresh for gated metrics.
 | Field         | Required | Default | Purpose                                                  |
 | ------------- | -------- | ------- | -------------------------------------------------------- |
 | `enabled`     | No       | (none)  | Master switch.                                           |
-| `miDropCap`   | No       | (none)  | Max MI drop the auto-refresher will absorb before failing. |
 | `crapJumpCap` | No       | (none)  | Max CRAP jump the auto-refresher will absorb before failing. |
 | `scope`       | No       | (none)  | One of `'diff'` or `'full'`.                              |
 
@@ -791,22 +771,6 @@ Paths are configured in `delivery.quality.gates.<tier>.baselinePath`. The
 default values match the canonical layout above; override only when a
 project genuinely stores baselines elsewhere.
 
-### Per-wave drift snapshots — `.agents/state/`
-
-The Epic runner's progress reporter writes wave-start snapshots so that a
-resumed run can detect intra-wave drift without re-reading the canonical
-baseline (which may have been refreshed mid-Epic).
-
-| File                                    | Owner                                                | Lifecycle                                       |
-| --------------------------------------- | ---------------------------------------------------- | ----------------------------------------------- |
-| `.agents/state/wave-mi-snapshot.json`   | `progress-signals/maintainability-drift.js`          | Captured at wave-start; overwritten next wave.   |
-| `.agents/state/wave-crap-snapshot.json` | `progress-signals/crap-drift.js`                     | Captured at wave-start; overwritten next wave.   |
-
-These are **not** ratchet baselines and must not be committed as such. The
-filenames intentionally differ from the canonical files so a repo-wide grep
-for `baselines/maintainability.json` or `baselines/crap.json` only ever hits
-the canonical paths.
-
 The `.agents/state/` directory itself is created on demand by the progress
 reporter; the framework does not require it to exist ahead of time and does
 not commit its contents.
@@ -867,7 +831,7 @@ git.
 per-contributor value with two jobs: the `@`-handle the framework @mentions on
 friction comments, **and** the lease owner the workflow guards
 ([`ticket-lease.js`](../scripts/lib/orchestration/ticket-lease.js))
-assign to a ticket so two contributors cannot drive the same Epic/Story
+assign to a ticket so two contributors cannot drive the same Story
 concurrently. Because the lease must distinguish *your* run from *another
 person's*, a shared committed handle would defeat it — everyone would coordinate
 under one identity. So each contributor sets their own in `.agentrc.local.json`:
@@ -1063,15 +1027,27 @@ mandrel explain --json   # JSON report for scripting
 
 ### `mandrel sync-commands`
 
-Regenerates the flat `.claude/commands/` tree from `.agents/workflows/`. The
-bootstrap wires a `UserPromptSubmit` hook so this runs automatically on every
-Claude Code prompt; manual invocations are only needed when the hook is absent
-or the commands/ tree is manually deleted.
+Regenerates the flat `.claude/commands/` tree from `.agents/workflows/`. Runs
+automatically at install time (via `prepare`) and as part of `mandrel
+sync`/`update`; manual invocations are only needed when the commands/ tree is
+manually deleted or edited by hand. Refuses to project when the materialized
+`.agents/` tree doesn't match the running CLI's own version.
 
 ```bash
 mandrel sync-commands
 ```
 
+### `mandrel sync-agents`
+
+Regenerates the flat `.claude/agents/` tree from `.agents/agents/` — the
+role-scoped boot contexts `delivery.routing.roleScopedAgents` (default
+`true`) dispatches spawns against. Same wiring and version-match refusal as
+`mandrel sync-commands` above.
+
+```bash
+mandrel sync-agents
+```
+
 ### `mandrel uninstall`
 
 Reverses a recorded install using the install ledger

package/.agents/docs/execution-reference.md

@@ -19,12 +19,13 @@ validated.
 
 - **Canonical record + schema validation**: `diagnose-friction.js` appends one
   `kind: friction` record, validated write-time against
-  `signal-event.schema.json`, to the per-Epic/per-Story `signals.ndjson`
-  stream on local disk. The retro roll-up reads that stream back to aggregate
+  `signal-event.schema.json`, to the per-run/per-Story `signals.ndjson`
+  stream on local disk (under `temp/run-<id>/`). The retro roll-up reads that
+  stream back to aggregate
   friction into routed proposals; nothing is posted to the GitHub ticket at
   capture time.
-- **No-Epic context**: Outside an Epic/Story loop there is no per-Epic stream
-  to anchor to, so the record lands on the **standalone signal stream**
+- **Standalone context**: Outside a delivery run there is no `temp/run-<id>/`
+  stream to anchor to, so the record lands on the **standalone signal stream**
   (`temp/standalone/stories/story-<sid>/signals.ndjson`) under the same
   canonical schema.
 - **Never silently dropped**: The signal is never silently dropped — a
@@ -57,12 +58,40 @@ schema mechanics are in [§ Friction telemetry](#friction-telemetry) above.
 
 ## FinOps & token budgeting (economic guardrails)
 
-Mandrel does **not** enforce live LLM spend from response metadata. The
-framework limits **hydrated prompt size** via section-aware elision
-(`elideEnvelope`) and optional **pre-dispatch estimates**; your host
-runtime (editor / CLI) owns session quota and hard stops. Consult this
-section when reasoning about why a task prompt was elided or why `/deliver`
-refused a fan-out on budget grounds.
+Mandrel does **not** enforce live LLM spend from response metadata. It bounds
+two things, both **fixed framework constants** rather than operator knobs, and
+both **fail closed**: the assembled `/plan` context envelope, and plan-time
+Story sizing. Your host runtime (editor / CLI) owns session quota and hard
+stops. Consult this section when reasoning about why `/plan` refused an
+over-ceiling envelope or an over-budget Story count.
+
+> **There is no configurable context budget.** `planning.context.maxBytes` /
+> `summaryMode` were removed outright in Story #4541, along with the
+> `applyBudget` pass they fed: that pass lost its last caller in the v2
+> cutover, and it was already bounding a field the envelope builders discarded
+> before shipping the raw seed anyway. The schema now **rejects**
+> `planning.context`, so a config carrying it fails loudly rather than silently
+> capping nothing. The ceiling below is the replacement and the only live bound
+> on planner-context size. Separately, `elideEnvelope` in
+> `lib/orchestration/context-envelope.js` — which this section used to credit
+> with limiting hydrated prompt size — has no production caller either (it is
+> carried in `baselines/dead-exports-production.json`). Only `estimateTokens`
+> from that module is live.
+
+### Planner-context envelope (`/plan`)
+
+- **`PLAN_CONTEXT_ENVELOPE_BYTE_CEILING`** (`lib/orchestration/plan-context.js`):
+  256 KB (≈64K tokens at the ≈4-chars/token estimate) on the serialized
+  envelope `buildPlanContext` assembles, checked at the single choke point
+  every mode returns through. Measured envelopes on this repo land at ~42 KB,
+  so the ceiling is >2× headroom over a worst-case seed plus a medium-tier
+  codebase snapshot.
+- **On refusal**, the error names the envelope's largest fields. Trim the seed,
+  plan fewer `--tickets` source issues in one run, or narrow
+  `planning.codebaseSnapshot`. The seed is carried **verbatim** by design — it
+  is the operator's request, and summarizing it silently would degrade planning
+  quality precisely when the input is richest — so there is no elision path to
+  fall back on. Raising the ceiling needs a measured justification.
 
 ### Session-mass capacity (plan-time sizing)
 

package/.agents/docs/quality-gates.md

@@ -17,9 +17,8 @@ the lift the floor gate represents.
 
 The configuration knobs that drive these gates live in
 [`.agents/docs/configuration.md`](../docs/configuration.md) under
-`delivery.quality.*` and the framework-internal `DEFAULT_STORY_MERGE_RETRY` constant. This
-file is the runbook side — what the gate does, when it fires, and how to
-bootstrap or refresh it.
+`delivery.quality.*`. This file is the runbook side — what the gate does,
+when it fires, and how to bootstrap or refresh it.
 
 The **baseline envelope, per-kind shapes, component model, writer/reader
 contract, and floor-override path** are documented in the
@@ -37,14 +36,13 @@ it once and reuse the context as you read through any individual gate.
 ## Concurrent close safety
 
 `/deliver` may close multiple Stories from separate Story branches in quick
-succession. The push step inside `single-story-close.js` refreshes against the
-latest `main` and retries a rejected Story-branch push — bounded by
-`DEFAULT_STORY_MERGE_RETRY.maxAttempts` (3) and
-`DEFAULT_STORY_MERGE_RETRY.backoffMs` (`[250, 500, 1000]`) from
-`.agents/scripts/lib/config/runners.js`.
-A real
-content conflict (both stories touched the same lines) aborts the loop
-with a clear error and leaves the local tree clean for manual resolution.
+succession. Each Story rebases onto the latest `main` in its own base-sync
+phase (`phases/base-sync.js`) before the push, so concurrent closes serialize
+through their own worktrees rather than racing one shared branch. The push
+step itself does not retry: a rejected push fails the close non-zero and the
+operator resolves it, and a real content conflict (both Stories touched the
+same lines) surfaces at base-sync with a clear error, leaving the local tree
+clean for manual resolution.
 
 ---
 
@@ -515,7 +513,7 @@ does not pause automatically on `risk::high`.
 
 The sole runtime HITL pause point is `agent::blocked`: when an agent
 encounters an unresolvable blocker (including unsafe destructive actions
-lacking explicit authorization), it flips the ticket/Epic to
+lacking explicit authorization), it flips the ticket to
 `agent::blocked`, posts friction context, and waits for operator resume
 (`agent::executing`).
 
@@ -753,10 +751,10 @@ Behaviour:
 - The `components` map is optional. When omitted, the default
   `{ "*": ["**"] }` applies and only `*` rows are ever evaluated.
 - The unified `check-baselines.js` reports breaches per component, with
-  `*` always present in the output. The per-component progress signals
-  (`crap-drift.js#detectComponentRegressions`,
-  `maintainability-drift.js#detectComponentRegressions`) name the
-  breached component in their bullet so a `*` rollup is not falsely
+  `*` always present in the output. The shared baselines kernel
+  (`lib/baselines/kernel.js`, via the per-kind rollups in
+  `lib/baselines/kinds/`) groups rows by component and names the
+  breached component in its output so a `*` rollup is not falsely
   implicated when only a component-scoped floor was crossed.
 
 #### Floor axes must match rollup axes

package/.agents/docs/workflows.md

@@ -14,10 +14,10 @@ modules, not runnable commands). The canonical workflow narrative lives in
 compose. This file is only for "which command does X?" lookups.
 
 Every command file lives at `.agents/workflows/<name>.md` and is projected
-into a flat `.claude/commands/` tree by `npm run sync:commands` (the
-UserPromptSubmit hook keeps it current) so it shows up as a bare `/<name>`
-slash command (e.g. `/deliver`). The projection writes only
-`.claude/commands/<name>.md` — there is no plugin manifest and no
+into a flat `.claude/commands/` tree by `npm run sync:commands` (kept
+current at install time and on every `mandrel sync`/`update`) so it shows
+up as a bare `/<name>` slash command (e.g. `/deliver`). The projection
+writes only `.claude/commands/<name>.md` — there is no plugin manifest and no
 marketplace listing. The commands load in every Claude Code environment.
 
 Loop units are the one namespaced exception: files under
@@ -43,7 +43,7 @@ description, edit the workflow file’s front-matter and regenerate.
 | `/audit-documentation` | Audit the repository's main documentation for staleness, semantic drift, and completeness; emit a structured High/Medium/Low findings report. |
 | `/audit-lighthouse` | Run a Lighthouse audit (Performance / Accessibility / Best Practices / SEO) and produce a structured findings report |
 | `/audit-navigability` | Audit the whole route tree against the consumer's nav-registry SSOT — every route has a persona nav door and no nav href is dead. A deliberately-global lens (Epic #4131, F2/F3) exempt from the cross-epic-leak guard and routed onto route-adding change sets. |
-| `/audit-performance` | Audit hot paths, algorithmic complexity, and I/O bottlenecks in the tooling surface (`epic-close`, dispatcher, gates); propose remediations. |
+| `/audit-performance` | Audit hot paths, algorithmic complexity, and I/O bottlenecks in the tooling surface (`single-story-close`, dispatcher, gates); propose remediations. |
 | `/audit-privacy` | Audit logs, telemetry, and persistence paths for PII leakage and retention violations; surface secrets exposure and consent gaps. |
 | `/audit-quality` | Audit test coverage gaps, flaky tests, missing assertions, and test-pyramid balance; recommend a remediation batch. |
 | `/audit-security` | Audit dependency CVEs, input-validation gaps, secrets handling, and auth boundaries; emit a structured High/Medium/Low findings report. |
@@ -51,7 +51,7 @@ description, edit the workflow file’s front-matter and regenerate.
 | `/audit-sre` | "Audit production-readiness for a release candidate: SLOs, observability, runbooks, error budgets, and rollback paths." |
 | `/audit-to-stories` | Convert findings produced by the audit-\* workflows into actionable GitHub Stories. Reads temp/audits/audit-\*-results.md, groups findings cross-audit, deduplicates against existing Issues by fingerprint, and either chains into /plan --seed-file or opens standalone Stories. |
 | `/audit-ux-ui` | Audit UX/UI consistency and design system adherence |
-| `/deliver` | Unified delivery entry point. Delivers one or more Stories via the single deliver-story engine — story-<id> → PR → main. Sequences N>1 by depends\_on and runs the per-run epilogue once at the end. |
+| `/deliver` | Unified delivery entry point. Takes a list of Story ids, resolves their dependency graph from live state, and delivers each via the single deliver-story engine — story-<id> → PR → main. |
 | `/git-cleanup` | Tidy the local checkout in four phases: fast-forward `main`, prune stale remote-tracking refs, sweep merged branches (squash-aware), and triage `git stash` entries — each step gated by operator confirmation. |
 | `/git-deliver` | Single ad-hoc delivery command for working-tree changes. Detects the git setup and escalates to the right terminal step — commit only, commit + push, or commit + push + open a PR with native auto-merge — picking the default from observable state and letting flags pin any level explicitly. Replaces the retired git-commit-all, git-push, and git-pr-all trio. |
 | `/mandrel-update` | npm-era upgrade wraparound for a Mandrel consumer. Runs `npx mandrel update` (resolve newest published version → install → re-materialize `.agents/` → migrate → doctor → surface changelog) as the single mechanical step, then walks the operator through the judgment wraparound the CLI deliberately leaves unowned: reconcile `.agentrc.json`, install the Epic #1386 quality-gate surface, refresh the harness permission allowlist, reconcile the consumer's `AGENTS.md` / runbooks against the surfaced changelog, and stage + commit the staged lockfile bump. |