mandrel 2.0.0 → 2.2.0

package/.agents/scripts/lib/orchestration/merge-block-class.js

@@ -2,13 +2,12 @@
 /**
  * merge-block-class.js — Story #4426 (Epic #4425, slice 1: foundation).
  *
- * Shared block-class classifier consumed by BOTH delivery paths — the
- * epic-path must-land terminal step and the standalone
- * `single-story-close` must-land terminal step (the not-yet-landed
- * follow-on Stories under Epic #4425) — so a headless delivery run that
- * finishes its work without a confirmed merge is attributable to exactly
- * one of four classes from the SAME decision logic, instead of each path
- * inventing its own ad hoc diagnosis.
+ * Shared block-class classifier for the `single-story-close` must-land
+ * terminal step and `deliver-recover`, so a headless delivery run that
+ * finishes its work without a confirmed merge is attributable to exactly one
+ * class from ONE decision logic, instead of each caller inventing its own ad
+ * hoc diagnosis. (It was written to serve an epic-path terminal too; the v2
+ * cutover left `single-story-close` as the only delivery path.)
  *
  * Block classes (Epic #4425 Goal; `predicate-refused` added by #4472):
  *   - `checks-pending-timeout`           The watch/poll budget was
@@ -16,6 +15,24 @@
  *                                         were still pending/running — not
  *                                         a hard block, the run simply ran
  *                                         out of time.
+ *   - `checks-failed`                    A required check went RED — red
+ *                                         checks that branch protection does
+ *                                         not require are NOT this class
+ *                                         (see `failingChecksBlockMerge`). A
+ *                                         definitive terminal the merge wait
+ *                                         must fail fast on (Story #4543):
+ *                                         before this class the in-close poll
+ *                                         read only `state`/`mergedAt`, so a
+ *                                         check that failed at minute one
+ *                                         burned the entire budget and then
+ *                                         classified as
+ *                                         `branch-protection-human-required`
+ *                                         (the exhaustion probe sees
+ *                                         `mergeStateStatus: BLOCKED` with
+ *                                         checks settled) — sending the
+ *                                         operator to diagnose branch
+ *                                         protection instead of the red check
+ *                                         that is actually in their way.
  *   - `branch-protection-human-required` GitHub reports the PR needs a
  *                                         human action: a required review
  *                                         that hasn't been granted, or a
@@ -47,20 +64,27 @@
  *                                         this class makes it attributable.
  *
  * Pure function, no I/O: callers pass in the already-observed
- * arm-result / PR-probe / budget signals (from `AutomergeArmer`,
- * `MergeWatcher`, a raw `gh pr view` read, or the standalone
+ * arm-result / PR-probe / budget signals (from the close path's merge wait,
+ * a raw `gh pr view` read, or the standalone
  * `single-story-confirm-merge.js` poll) and get back a
  * `{ blockClass, reason }` verdict ready to hand to `emitMergeUnlanded`
  * (`emit-merge-unlanded.js`).
  */
 
+import { failingChecksBlockMerge } from './merge-poll.js';
+
 /**
- * The four block classes named in the Epic #4425 Goal. Order is the
- * evaluation priority documented on `classifyMergeBlock` below, NOT an
- * arbitrary listing — earlier entries are checked first when a real input
- * happens to satisfy more than one heuristic.
+ * Every class `classifyMergeBlock` can return. Order is the evaluation
+ * priority documented on `classifyMergeBlock` below, NOT an arbitrary
+ * listing — earlier entries are checked first when a real input happens to
+ * satisfy more than one heuristic.
+ *
+ * Started as the four classes named in the Epic #4425 Goal; Story #4543
+ * added `checks-failed` so a red required check is attributable as itself
+ * rather than being absorbed by the timeout or branch-protection verdicts.
  */
 export const BLOCK_CLASSES = Object.freeze([
+  'checks-failed',
   'checks-pending-timeout',
   'branch-protection-human-required',
   'arm-failure',
@@ -70,10 +94,12 @@ export const BLOCK_CLASSES = Object.freeze([
 /**
  * The full set of block-class values a `merge.unlanded` record may carry.
  * This is the classifier's four outputs PLUS `predicate-refused` (#4472),
- * which is emitted DIRECTLY by the AutomergePredicate / AutomergeArmer for a
- * headless refusal that never reached the poll-exhaustion classifier — so it
- * is a valid attribution value even though `classifyMergeBlock` never
- * produces it. `isValidBlockClass` (and the `merge.unlanded` schema enum)
+ * emitted DIRECTLY for a headless refusal that never reached the
+ * poll-exhaustion classifier — so it is a valid attribution value even though
+ * `classifyMergeBlock` never produces it. (The Epic-era listeners that used to
+ * emit it, AutomergePredicate and AutomergeArmer, are gone; the value stays
+ * because archived `merge.unlanded` records carry it and the schema enum
+ * must keep validating them.) `isValidBlockClass` (and the `merge.unlanded` schema enum)
  * validate against this broader set; the classifier's own reachability
  * invariant stays scoped to `BLOCK_CLASSES`.
  */
@@ -121,6 +147,12 @@ function describeApiRaceFallback(prProbe, budget) {
   if (prProbe?.error) {
     return `PR probe error: ${prProbe.error}`;
   }
+  // Red checks that do not gate the merge (step 1b declined them). Name the
+  // situation precisely: the operator must NOT be sent to fix the red check,
+  // because auto-merge was free to land this PR and did not.
+  if (prProbe?.checksStatus === 'failure') {
+    return `PR did not land although its failing checks are not required (mergeStateStatus=${prProbe?.mergeStateStatus ?? 'n/a'}); the red checks are not the block — check that auto-merge is still armed`;
+  }
   if (budget && budget.exhausted === true) {
     return `watch budget exhausted with an unrecognised checks status (${prProbe?.checksStatus ?? 'unknown'})`;
   }
@@ -137,6 +169,12 @@ function describeApiRaceFallback(prProbe, budget) {
  *      rejection surfaced AT arm time still routes to
  *      `branch-protection-human-required` rather than the generic
  *      `arm-failure`.
+ *   1b. A red required check — `checks-failed` (Story #4543). Evaluated
+ *      before every budget and probe signal because it is *definitive*:
+ *      no amount of remaining budget turns a failed check green, and on a
+ *      protected branch it also presents as `mergeStateStatus: 'BLOCKED'`,
+ *      so leaving it to step 3 would attribute the operator's red test run
+ *      to branch protection.
  *   2. Budget exhaustion while checks were still in flight —
  *      `checks-pending-timeout`. Evaluated BEFORE the human-required
  *      probe signals because on a protected branch GitHub reports
@@ -164,9 +202,10 @@ function describeApiRaceFallback(prProbe, budget) {
  *   (`REVIEW_REQUIRED`, `APPROVED`, …).
  * @param {string} [input.prProbe.mergeStateStatus] GitHub merge-state
  *   status (`BLOCKED`, `BEHIND`, `CLEAN`, …).
- * @param {string} [input.prProbe.checksStatus] Aggregate required-check
- *   status observed on the last probe (`success` | `pending` |
- *   `still-running` | `failure` | `unknown`).
+ * @param {string} [input.prProbe.checksStatus] Aggregate status across ALL
+ *   checks observed on the last probe (`success` | `pending` |
+ *   `still-running` | `failure` | `unknown`) — required-ness is decided by
+ *   `mergeStateStatus`, not by this field.
  * @param {string} [input.prProbe.error] Set when the probe call itself
  *   errored (network / API failure reading the PR).
  * @param {object} [input.budget] Poll-budget accounting.
@@ -205,6 +244,23 @@ export function classifyMergeBlock(input) {
   const checksPendingEvidence =
     checksStatus === 'pending' || checksStatus === 'still-running';
 
+  // 1b. A required check is RED. Definitive — no remaining budget makes a
+  // failed check pass — so this precedes both the budget branch and the
+  // BLOCKED-merge-state heuristic, which would otherwise attribute the red
+  // check to branch protection on any protected base.
+  //
+  // Gated on `failingChecksBlockMerge` rather than the raw rollup status:
+  // `checksStatus: 'failure'` covers optional checks too, and naming an
+  // optional red check as THE block sends the operator to fix a check that
+  // was never gating the merge. A red-but-not-gating PR that still failed to
+  // land falls through to the fallback, whose reason says exactly that.
+  if (failingChecksBlockMerge(prProbe)) {
+    return {
+      blockClass: 'checks-failed',
+      reason: `a required check failed (mergeStateStatus=${prProbe?.mergeStateStatus ?? 'n/a'})`,
+    };
+  }
+
   // 2. Budget exhausted while checks were still in flight. Ordered
   // before the human-required probe signals: `mergeStateStatus:
   // 'BLOCKED'` is the steady state on a protected branch while required

package/.agents/scripts/lib/orchestration/merge-poll.js

@@ -0,0 +1,104 @@
+/**
+ * merge-poll.js — merge-wait constants and check-rollup derivation owned by
+ * the close path.
+ *
+ * Story #4545 — these three symbols used to live in the Epic-era
+ * `lifecycle/listeners/merge-watcher.js`. That listener class had no
+ * production caller after the v2.0.0 Story-only cutover, but it was not
+ * importer-less: the live close path (`single-story-close/phases/confirm-merge.js`)
+ * and `deliver-recover.js` both reached into it for the poll defaults and
+ * `deriveChecksStatus`. Relocating them here lets the listener go without
+ * leaving the close path importing a lifecycle module it does not otherwise
+ * participate in.
+ *
+ * Sits beside `merge-block-class.js`, its sole consumer pairing:
+ * `deriveChecksStatus` produces the `prProbe.checksStatus` value that
+ * `classifyMergeBlock` reads.
+ */
+
+/**
+ * Default poll interval and cumulative budget for the merge wait. The schema
+ * in `.agents/schemas/agentrc.schema.json` exposes these as
+ * `delivery.mergeWatch.intervalSeconds` (default 30) and
+ * `delivery.mergeWatch.maxBudgetSeconds` (default 3600). Hard-coding the same
+ * numbers here keeps the close path self-contained when no config is wired in
+ * (e.g. unit tests).
+ */
+export const DEFAULT_INTERVAL_SECONDS = 30;
+export const DEFAULT_MAX_BUDGET_SECONDS = 3600;
+
+/**
+ * Pure: derive an aggregate `checksStatus` (`success` | `still-running` |
+ * `failure` | `unknown`) from a `statusCheckRollup` array (`gh pr view --json
+ * statusCheckRollup` shape: `{ status, conclusion }` per check). Mirrors the
+ * values `classifyMergeBlock` expects on `prProbe.checksStatus`.
+ *
+ * **Scope: EVERY check reported on the PR, required or not.** The rollup
+ * carries no required-vs-optional discriminator (`gh`'s projection has no
+ * `isRequired` field), so `failure` here means "something on this PR is red",
+ * NOT "the merge is blocked". Use {@link failingChecksBlockMerge} before
+ * treating a `failure` as terminal.
+ */
+export function deriveChecksStatus(statusCheckRollup) {
+  if (!Array.isArray(statusCheckRollup) || statusCheckRollup.length === 0) {
+    return 'unknown';
+  }
+  let anyPending = false;
+  for (const check of statusCheckRollup) {
+    const conclusion = String(check?.conclusion ?? '').toUpperCase();
+    const status = String(check?.status ?? '').toUpperCase();
+    if (['FAILURE', 'CANCELLED', 'TIMED_OUT', 'ERROR'].includes(conclusion)) {
+      return 'failure';
+    }
+    if (status !== 'COMPLETED') {
+      anyPending = true;
+    }
+  }
+  return anyPending ? 'still-running' : 'success';
+}
+
+/**
+ * The one `mergeStateStatus` value that means GitHub itself is gating the
+ * merge. See {@link failingChecksBlockMerge}.
+ */
+const MERGE_GATED_STATE = 'BLOCKED';
+
+/**
+ * Pure: does the PR's RED check status actually gate the merge?
+ *
+ * `deriveChecksStatus` aggregates the whole rollup, so it reports `failure`
+ * for a red check of any kind. Branch protection — and therefore GitHub
+ * native auto-merge — gates only on REQUIRED checks. A red optional check
+ * (an advisory bot, or a `CANCELLED` superseded workflow run, which the
+ * rollup derivation counts as a failure) says nothing about whether the PR
+ * will land: auto-merge lands it regardless. Treating that as terminal is
+ * what stranded a Story `agent::blocked` on a PR that merged anyway.
+ *
+ * `mergeStateStatus` is GitHub's own verdict, computed against the live
+ * branch-protection rules, so it supplies the required-vs-optional
+ * discrimination the rollup lacks:
+ *
+ *   - `BLOCKED`  — merging is gated. With red checks observed, the red
+ *                  required check is the gate.
+ *   - `UNSTABLE` — "mergeable with non-passing commit status": the red
+ *                  checks are NOT required. Auto-merge will land it.
+ *   - `CLEAN` / `BEHIND` / `UNKNOWN` / absent — not evidence that the red
+ *     check gates the merge.
+ *
+ * Deliberately conservative: only `BLOCKED` returns `true`. A transient
+ * `UNKNOWN` (GitHub has not finished computing the merge state) or a token
+ * that cannot see the field degrades to "keep waiting" — the caller's poll
+ * budget still bounds the wait and the budget-exhausted classification still
+ * fires. The asymmetry is intentional: failing to fail fast costs poll time,
+ * whereas failing fast wrongly costs a merged-but-`agent::blocked` strand
+ * that only an operator can unpick.
+ *
+ * @param {{ checksStatus?: string, mergeStateStatus?: string }} [prProbe]
+ * @returns {boolean}
+ */
+export function failingChecksBlockMerge(prProbe) {
+  if (prProbe?.checksStatus !== 'failure') return false;
+  return (
+    String(prProbe?.mergeStateStatus ?? '').toUpperCase() === MERGE_GATED_STATE
+  );
+}

package/.agents/scripts/lib/orchestration/plan-context.js

@@ -35,19 +35,82 @@ import { buildDecomposerSystemPrompt } from './planning/decomposer-context.js';
 const SOURCE_TICKET_FETCH_CONCURRENCY = 4;
 /**
  * Envelope byte ceiling (regression guard for the design's named PR2 risk:
- * two envelopes → one bigger one). The folded envelope's bounded parts are:
- * the `applyBudget`-capped body (`planningContext.maxBytes` = 50 KB), the
- * tier-capped codebase snapshot (~35 KB skinny on this repo), the three
- * rendered system prompts (~15 KB), and the digest-first `docsContext`
- * (outline-only, or inline digest in one-pager/seed mode). Measured folded envelopes on this
- * repo land at ~42 KB; 256 KB (~64K tokens at the ≈4-chars/token estimate)
- * gives >2× headroom over a worst-case budgeted body + medium-tier snapshot
- * while staying an order of magnitude under the session budget. The test
- * suite asserts serialized envelopes stay under this value — raise it only
- * with a measured justification.
+ * two envelopes → one bigger one). This is the **only** live bound on
+ * envelope size: Story #4541 removed the `applyBudget` pass from
+ * `buildAuthoringContext`, because both builders below discard that budgeted
+ * body and ship the raw seed on `seed.content` instead — the budget bounded
+ * a field that never left the function.
+ *
+ * The envelope's bounded parts are: the tier-capped codebase snapshot
+ * (~35 KB skinny on this repo), the three rendered system prompts (~15 KB),
+ * and the digest-first `docsContext` (outline-only, or inline digest in
+ * one-pager/seed mode). The seed itself is operator-supplied and carried
+ * verbatim. Measured folded envelopes on this repo land at ~42 KB; 256 KB
+ * (~64K tokens at the ≈4-chars/token estimate) gives >2× headroom over a
+ * worst-case seed + medium-tier snapshot while staying an order of magnitude
+ * under the session budget. The test suite asserts serialized envelopes stay
+ * under this value — raise it only with a measured justification.
  */
 export const PLAN_CONTEXT_ENVELOPE_BYTE_CEILING = 256_000;
 
+/** Fields named in the over-ceiling error, to point at what to trim. */
+const OVERSIZE_REPORT_FIELDS = 3;
+
+/**
+ * Fail closed when an assembled envelope exceeds
+ * {@link PLAN_CONTEXT_ENVELOPE_BYTE_CEILING}.
+ *
+ * Until now the ceiling was enforced *only* by a test assertion over this
+ * repo's own fixtures, which bounds nothing at runtime: the value it actually
+ * has to hold for is a consumer's seed or `--tickets` source bodies, and no
+ * test sees those. That left the documented planner-context cap resting
+ * entirely on `planning.context.maxBytes` — which resolved but was wired to
+ * nothing (its `applyBudget` pass lost its last caller in the v2 cutover), so
+ * in practice no bound existed at all on the path that needed one. That key
+ * and its budget module were removed outright in Story #4541; this ceiling is
+ * the replacement.
+ *
+ * Failing closed is the right direction here and matches how an over-budget
+ * `## Spec` is handled (`spec-spill.js`): an envelope this size does not
+ * degrade the planner gracefully, it silently produces garbage Stories from a
+ * truncated-by-the-host context. Better to refuse and say what to trim. The
+ * bound is deliberately a fixed framework constant rather than an operator
+ * knob — a cap the operator can raise past what the model can read is a cap
+ * that fails silently again.
+ *
+ * Deliberately **not** exported: its only external caller would be a test, and
+ * a test-only export is a production-dead one. It is reachable end to end
+ * through {@link buildPlanContext}, which is where the behaviour matters.
+ *
+ * @param {object} envelope
+ * @param {{ ceiling?: number }} [opts]
+ * @returns {object} `envelope`, unchanged, when it fits.
+ */
+function assertPlanContextWithinCeiling(envelope, opts = {}) {
+  const ceiling = opts.ceiling ?? PLAN_CONTEXT_ENVELOPE_BYTE_CEILING;
+  const bytes = Buffer.byteLength(JSON.stringify(envelope) ?? '', 'utf-8');
+  if (bytes <= ceiling) return envelope;
+
+  const largest = Object.entries(envelope)
+    .map(([field, value]) => [
+      field,
+      Buffer.byteLength(JSON.stringify(value) ?? '', 'utf-8'),
+    ])
+    .sort((a, b) => b[1] - a[1])
+    .slice(0, OVERSIZE_REPORT_FIELDS)
+    .map(([field, size]) => `${field} (${Math.round(size / 1024)} KB)`)
+    .join(', ');
+
+  throw new Error(
+    `[plan-context] the assembled "${envelope?.mode}" envelope is ` +
+      `${Math.round(bytes / 1024)} KB, over the ` +
+      `${Math.round(ceiling / 1024)} KB planner-context ceiling. Largest ` +
+      `fields: ${largest}. Trim the seed, plan fewer --tickets source issues ` +
+      'in one run, or narrow `planning.codebaseSnapshot`. Raising the ceiling ' +
+      'needs a measured justification — see PLAN_CONTEXT_ENVELOPE_BYTE_CEILING.',
+  );
+}
+
 /**
  * Compact, machine-readable descriptor of the `tickets.json` array the
  * authoring pass writes and `validateAndNormalizeTickets` gates at persist
@@ -61,10 +124,13 @@ export const TICKET_SCHEMA_DESCRIPTOR = Object.freeze({
     slug: 'string — ^[a-z0-9][a-z0-9-]*$ (hyphen-case, unique per decompose)',
     type: "string — literal 'story' (2-tier hierarchy: Epic → Story only)",
     title: 'string — short descriptive title',
-    body: 'string — serialized Story-body markdown (never a JSON object)',
-    acceptance: 'string[] — top-level testable criteria (not nested in body)',
-    verify: 'string[] — top-level exact commands/test paths with (<tier>)',
-    labels: "string[] — must include 'type::story' (no persona::* axis)",
+    body: 'string — serialized Story-body markdown (never a JSON object); omit the ## Acceptance / ## Verify sections, persist syncs them in',
+    acceptance:
+      'string[] — top-level testable criteria; the machine contract, authored here and not in the body',
+    verify:
+      'string[] — top-level exact commands/test paths with (<tier>); the machine contract, authored here and not in the body',
+    labels:
+      "string[]? — extra labels to apply; 'type::story' is applied automatically. agent::*, type::*, and persona::* are rejected (runtime-owned or retired axes)",
     depends_on: 'string[]? — sibling Story slugs that block execution',
   }),
   validatedBy:
@@ -295,17 +361,12 @@ export function buildDeliveryShapeSignal({ body } = {}) {
  * authoritative from day one); the decompose prompt reuses the existing
  * Story #4162 carrier including the risk-heuristics suffix.
  *
- * @param {{ heuristics?: string[], maxTickets?: number, epicId?: number|null }} args
+ * @param {{ heuristics?: string[], maxTickets?: number }} args
  * @returns {{ spec: string, acceptance: string, decompose: string }}
  */
-export function buildSystemPrompts({
-  heuristics = [],
-  maxTickets,
-  epicId = null,
-} = {}) {
+export function buildSystemPrompts({ heuristics = [], maxTickets } = {}) {
   const decompose = buildDecomposerSystemPrompt(heuristics, {
     maxTickets,
-    epicId,
   });
   return {
     spec: renderTechSpecSystemPrompt(),
@@ -373,7 +434,6 @@ async function buildSeedFileModeEnvelope({
   provider,
   config,
   settings,
-  fullContext,
   cwd,
   modeLabel = 'seed-file',
 }) {
@@ -401,7 +461,6 @@ async function buildSeedFileModeEnvelope({
     { ...settings, docsContextFiles: [] },
     {
       epic: { id: 0, title: seedFilePath ?? 'seed', body: content },
-      fullContext,
       github: config.github ?? null,
       cwd,
     },
@@ -436,7 +495,6 @@ async function buildSeedFileModeEnvelope({
     systemPrompts: buildSystemPrompts({
       heuristics,
       maxTickets: limits.maxTickets,
-      epicId: null,
     }),
     planState: null,
     // N=1 default: author one Story; skip Epic-scale decompose ceremony.
@@ -454,7 +512,6 @@ async function buildSeedModeEnvelope({
   provider,
   config,
   settings,
-  fullContext,
   cwd,
 }) {
   if (typeof seedText !== 'string' || seedText.trim().length === 0) {
@@ -468,7 +525,6 @@ async function buildSeedModeEnvelope({
     provider,
     config,
     settings,
-    fullContext,
     cwd,
     modeLabel: 'seed',
   });
@@ -528,7 +584,6 @@ async function buildTicketsModeEnvelope({
   provider,
   config,
   settings,
-  fullContext,
   cwd,
 }) {
   if (!Array.isArray(ticketIds) || ticketIds.length === 0) {
@@ -558,7 +613,6 @@ async function buildTicketsModeEnvelope({
         title: sourceTickets[0]?.title ?? 'tickets',
         body: seed,
       },
-      fullContext,
       github: config.github ?? null,
       cwd,
     },
@@ -594,7 +648,6 @@ async function buildTicketsModeEnvelope({
     systemPrompts: buildSystemPrompts({
       heuristics,
       maxTickets: limits.maxTickets,
-      epicId: null,
     }),
     planState: null,
     planProfile:
@@ -610,6 +663,10 @@ async function buildTicketsModeEnvelope({
 /**
  * Build the single planner-context envelope.
  *
+ * Every mode returns through here, which makes this the one place the
+ * envelope's total size is decided — and therefore the only honest place to
+ * bound it (see {@link assertPlanContextWithinCeiling}).
+ *
  * @param {{
  *   mode: 'seed-file'|'seed'|'tickets',
  *   seedFilePath?: string,
@@ -632,7 +689,36 @@ export async function buildPlanContext({
   provider,
   config = {},
   settings = {},
-  fullContext = false,
+  cwd,
+}) {
+  return assertPlanContextWithinCeiling(
+    await buildPlanContextEnvelope({
+      mode,
+      seedFilePath,
+      seedFileContent,
+      seedText,
+      ticketIds,
+      provider,
+      config,
+      settings,
+      cwd,
+    }),
+  );
+}
+
+/**
+ * Mode dispatch for {@link buildPlanContext}. Split out so the ceiling check
+ * wraps every mode exactly once.
+ */
+async function buildPlanContextEnvelope({
+  mode,
+  seedFilePath,
+  seedFileContent,
+  seedText,
+  ticketIds,
+  provider,
+  config,
+  settings,
   cwd,
 }) {
   if (mode === 'seed-file') {
@@ -647,7 +733,6 @@ export async function buildPlanContext({
       provider,
       config,
       settings,
-      fullContext,
       cwd,
       modeLabel: 'seed-file',
     });
@@ -658,7 +743,6 @@ export async function buildPlanContext({
       provider,
       config,
       settings,
-      fullContext,
       cwd,
     });
   }
@@ -668,7 +752,6 @@ export async function buildPlanContext({
       provider,
       config,
       settings,
-      fullContext,
       cwd,
     });
   }

package/.agents/scripts/lib/orchestration/plan-critic-conditions.js

@@ -1,16 +1,16 @@
 /**
- * plan-critic-conditions.js — risk/size-conditional dispatch decisions for
+ * plan-critic-conditions.js — size/heuristic-conditional dispatch decisions for
  * the /plan author-step critics (Epic #4474 PR6, design §4).
  *
- * The collapsed plan flow keeps the consolidation (8.3) and pre-mortem
- * (8.5) critics as fresh-context sub-agent dispatches, but makes each
- * dispatch **conditional** instead of unconditional — the dominant plan
- * cost is turns × standing context, and an unconditional critic pays a
- * full sub-agent spawn even when it provably has nothing to find. This
- * module computes those decisions deterministically so the workflow never
- * judges its own dispatch conditions:
+ * The collapsed plan flow keeps the consolidation and pre-mortem critics as
+ * fresh-context sub-agent dispatches, but makes each dispatch
+ * **conditional** instead of unconditional — the dominant plan cost is
+ * turns × standing context, and an unconditional critic pays a full
+ * sub-agent spawn even when it provably has nothing to find. This module
+ * computes those decisions deterministically so the workflow never judges
+ * its own dispatch conditions:
  *
- *   - **Consolidation (8.3)**: dispatch only when the existing
+ *   - **Consolidation**: dispatch only when the existing
  *     `evaluateConsolidationPrecondition` gate says `dispatch: true` AND
  *     (the draft has more than `CONSOLIDATION_STORY_THRESHOLD` stories OR
  *     the precondition confirmed a divergence from the Delivery Slicing
@@ -18,27 +18,29 @@
  *     small draft is NOT a confirmed divergence — it skips, because a
  *     ≤-threshold draft is small enough for gate #2's single-view review
  *     to catch a distorted shape without a dedicated sub-agent.
- *   - **Pre-mortem (8.5)**: dispatch when the risk verdict's overall level
- *     is `high`, OR the ticket count is at least half of `maxTickets`, OR
- *     any configured `planning.riskHeuristics` phrase matches the plan
- *     text (case-insensitive substring).
+ *   - **Pre-mortem**: dispatch when the ticket count is at least half
+ *     of `maxTickets`, OR any configured `planning.riskHeuristics` phrase
+ *     matches the plan text (case-insensitive substring). Story #4542 removed
+ *     its third condition — the authored risk verdict's overall level — along
+ *     with the verdict itself; both surviving conditions read the plan's own
+ *     observable text and shape rather than a self-assessment.
  *
  * Under-firing risk (design PR6 note): the persist validators are
  * unchanged hard gates and G2's cohort re-measures plan quality; every
  * skip decision this module produces is logged to the plan-metrics ledger
- * (`appendCriticSkip`) by the callers so under-firing is auditable.
+ * (`appendCriticSkip`) by the caller so under-firing is auditable.
  *
- * Pure, synchronous, no I/O — the folded pre-write phase inside
- * `plan-persist.js` owns reading the authored artifacts and the resolved
- * config.
+ * Pure, synchronous, no I/O. The single caller is `plan-critics-evaluate.js`,
+ * driven by the `plan-critics.js` CLI that `/plan` runs between Author and
+ * Persist (Story #4592); the CLI owns reading the authored artifacts and the
+ * resolved config.
  */
 
 import { evaluateConsolidationPrecondition } from './consolidation-precondition.js';
-import { deriveRiskEnvelope } from './planning-risk.js';
 
 /**
  * Draft-story count above which the consolidation critic fires even
- * without a confirmed slicing divergence (design §6 PR6: "> 5 stories").
+ * without a confirmed slicing divergence (#4474 PR6: "> 5 stories").
  */
 export const CONSOLIDATION_STORY_THRESHOLD = 5;
 
@@ -52,7 +54,7 @@ export const CONSOLIDATION_STORY_THRESHOLD = 5;
  */
 
 /**
- * Decide the 8.3 consolidation dispatch: precondition AND size/divergence.
+ * Decide the consolidation dispatch: precondition AND size/divergence.
  *
  * @param {object} input
  * @param {object[]} input.draftStories - The draft `tickets.json` array
@@ -105,14 +107,10 @@ export function evaluateConsolidationDispatch({ draftStories, specText }) {
 }
 
 /**
- * Decide the 8.5 pre-mortem dispatch: high risk, or size ≥ ½ budget, or a
- * risk-heuristic phrase match.
+ * Decide the pre-mortem dispatch: size ≥ ½ budget, or a risk-heuristic
+ * phrase match.
  *
  * @param {object} input
- * @param {import('./planning-risk.js').RiskVerdict} input.riskVerdict -
- *   The authored `risk-verdict.json` payload; the overall level is derived
- *   deterministically from its axes (`deriveRiskEnvelope`), never trusted
- *   as a free-standing field.
  * @param {number} input.ticketCount - Draft ticket count (0 in the
  *   single-delivery shape — no tickets exist).
  * @param {number} input.maxTickets - The reviewability budget
@@ -120,11 +118,10 @@ export function evaluateConsolidationDispatch({ draftStories, specText }) {
  * @param {string[]} [input.riskHeuristics] - `planning.riskHeuristics`
  *   phrases from the resolved config.
  * @param {string} [input.planText] - Concatenated plan text the heuristics
- *   match against (tech spec + serialized tickets + risk summary).
+ *   match against (tech spec + serialized tickets).
  * @returns {CriticDispatchDecision}
  */
 export function evaluatePremortemDispatch({
-  riskVerdict,
   ticketCount,
   maxTickets,
   riskHeuristics = [],
@@ -137,13 +134,6 @@ export function evaluatePremortemDispatch({
   }
   const reasons = [];
 
-  const { overallLevel } = deriveRiskEnvelope(riskVerdict);
-  if (overallLevel === 'high') {
-    reasons.push(
-      'Risk verdict overall level is high — predicted-rework findings are worth a fresh-context pass.',
-    );
-  }
-
   const count = Number.isInteger(ticketCount) ? ticketCount : 0;
   if (count * 2 >= maxTickets) {
     reasons.push(
@@ -172,7 +162,7 @@ export function evaluatePremortemDispatch({
     critic: 'pre-mortem',
     dispatch: false,
     reasons: [
-      `Overall risk is ${overallLevel} (not high), ticket count ${count} is under half the budget (maxTickets ${maxTickets}), and no planning.riskHeuristics phrase matches the plan text.`,
+      `Ticket count ${count} is under half the budget (maxTickets ${maxTickets}) and no planning.riskHeuristics phrase matches the plan text.`,
     ],
   };
 }