mandrel 2.22.0 → 2.24.0

package/.agents/scripts/lib/orchestration/light-suitability.js

@@ -36,9 +36,13 @@
  *      Under `--yes` (unattended) it fails closed to recommending `/plan`.
  *   3. **Diff-derived backstop ({@link checkLightDiffBackstop}).** After
  *      implementation the **actual** change set is re-checked with
- *      {@link module:lib/orchestration/review-depth.deriveChangeLevel} plus a
- *      file-count ceiling — the diff is the real scope signal — and an
- *      over-ceiling diff is blocked rather than landed silently.
+ *      {@link module:lib/orchestration/review-depth.deriveChangeLevel} plus the
+ *      implementation-only magnitude ceilings of {@link LIGHT_DIFF_CEILINGS} —
+ *      the diff is the real scope signal — and an over-ceiling diff is blocked
+ *      rather than landed silently. Story #4856 moved this from a `maxFiles: 4`
+ *      cardinality ceiling to changed lines over implementation files, and made
+ *      a block **recycle** its receipt Story through `/plan` tickets mode
+ *      instead of orphaning it.
  *   4. **Minimal receipt Story ({@link buildReceiptStoryTicket}).** A
  *      `type::story` ticket is authored inline so `refs #`, history, telemetry,
  *      and the `agent::executing -> agent::done` state machine survive.
@@ -79,35 +83,69 @@ export const OVERRIDABLE_SHAPE_CODES = Object.freeze([
 ]);
 
 /**
- * File-count ceiling for the **actual landed** change set the diff backstop
- * ({@link checkLightDiffBackstop}) enforces. This is the light path's **only**
- * cardinality ceiling, and deliberately so (Story #4764): the predicted
- * footprint is a declaration — a guess, and a gameable one — so the gate that
- * counts must be the one reading ground truth. A genuinely-light change stays
- * small; conservative by construction, since a ceiling an operator could widen
- * past what a single session safely absorbs is a ceiling that fails silently.
- * A framework constant, not a knob.
+ * Ceilings for the **actual landed** change set the diff backstop
+ * ({@link checkLightDiffBackstop}) enforces, measured on the change's
+ * implementation half (Story #4856 — see
+ * {@link module:lib/orchestration/diff-magnitude} for the measured case and the
+ * companion-class boundary).
+ *
+ * The backstop reads ground truth, so it is where size is genuinely enforced;
+ * the prediction gate above it is a declaration and stays coarse (Story #4764).
+ * What changed is the **axis**: this used to be `maxFiles: 4`, a cardinality
+ * ceiling that rejected 79% of this repository's real merged work while passing
+ * a three-file 323-line rewrite.
+ *
+ *   - `maxImplLines` — additions plus deletions across implementation files.
+ *                      Simulated over 41 merges, 1000 admits 83% of real work
+ *                      and rejects exactly the genuinely large changes.
+ *   - `maxImplFiles` — implementation files touched, a *sprawl* tripwire rather
+ *                      than a size gate. Set to `DEFAULT_DIFF_WIDTH.softFiles`
+ *                      so the light path and `review-depth.js` stop holding two
+ *                      different definitions of a narrow diff.
+ *
+ * Framework constants, not knobs: a ceiling an operator could widen past what a
+ * single session safely absorbs is a ceiling that fails silently.
  */
 export const LIGHT_DIFF_CEILINGS = Object.freeze({
-  maxFiles: 4,
+  maxImplLines: 1000,
+  maxImplFiles: 15,
 });
 
 /**
- * Coerce a candidate `maxFiles` ceiling into a positive integer, falling back
- * to the framework default for anything malformed — a stray `0`, `-1`, or `NaN`
- * must never widen (or zero out) the light diff ceiling.
+ * Coerce a candidate ceiling into a positive integer, falling back to the
+ * framework default for anything malformed — a stray `0`, `-1`, or `NaN` must
+ * never widen (or zero out) a light diff ceiling.
  *
  * @param {unknown} value
  * @param {number} fallback
  * @returns {number}
  */
-function normalizeMaxFiles(value, fallback) {
+function normalizeCeiling(value, fallback) {
   if (typeof value !== 'number' || !Number.isFinite(value) || value < 1) {
     return fallback;
   }
   return Math.floor(value);
 }
 
+/**
+ * Resolve the effective diff ceilings from a caller-supplied partial override.
+ *
+ * @param {{ maxImplLines?: unknown, maxImplFiles?: unknown }} [ceilings]
+ * @returns {{ maxImplLines: number, maxImplFiles: number }}
+ */
+function resolveDiffCeilings(ceilings) {
+  return {
+    maxImplLines: normalizeCeiling(
+      ceilings?.maxImplLines,
+      LIGHT_DIFF_CEILINGS.maxImplLines,
+    ),
+    maxImplFiles: normalizeCeiling(
+      ceilings?.maxImplFiles,
+      LIGHT_DIFF_CEILINGS.maxImplFiles,
+    ),
+  };
+}
+
 /**
  * Resolve the model's trivial-vs-standard verdict, held to the same ledgering
  * contract the planner's authored verdict is
@@ -389,11 +427,23 @@ export function resolveLightGateOutcome({
 }
 
 /**
- * Diff-derived backstop (Story #4740 AC-4): re-check the **actual** change set
- * after implementation, because the diff — not the prompt — is the real scope
- * signal. Blocks (rather than landing) when the diff intersects a sensitive-
- * path class, exceeds the file-count ceiling, or cannot be classified. A clean
- * result is the only path that lands light.
+ * Diff-derived backstop (Story #4740 AC-4, re-based on magnitude by Story
+ * #4856): re-check the **actual** change set after implementation, because the
+ * diff — not the prompt — is the real scope signal. Blocks (rather than landing)
+ * when the diff intersects a sensitive-path class, exceeds an implementation
+ * ceiling, or cannot be measured. A clean result is the only path that lands
+ * light.
+ *
+ * Two inputs, two different scopes, and the difference is load-bearing:
+ *
+ *   - `changedFiles` is the **full** change set, companions included, and is
+ *     what sensitive-path derivation reads. Exempting a companion from the
+ *     *count* must never exempt it from *risk* — a test file under a registered
+ *     sensitive class still blocks.
+ *   - `magnitude` is the implementation-only summary from
+ *     {@link module:lib/orchestration/diff-magnitude.summarizeDiffMagnitude}.
+ *     `null` means the magnitude could not be measured, which blocks: absence
+ *     of evidence is not evidence the diff is small.
  *
  * Reuses close's own {@link module:lib/orchestration/review-depth.deriveChangeLevel}
  * — one taxonomy, applied to the predicted shape at the gate and the actual
@@ -403,7 +453,8 @@ export function resolveLightGateOutcome({
  *
  * @param {{
  *   changedFiles?: unknown,
- *   ceilings?: { maxFiles?: number },
+ *   magnitude?: { implFiles?: number, implLines?: number }|null,
+ *   ceilings?: { maxImplLines?: number, maxImplFiles?: number },
  *   injectedRules?: object,
  *   selectSensitivePathClassesFn?: Function,
  * }} [args]
@@ -412,20 +463,19 @@ export function resolveLightGateOutcome({
  *   level: 'low'|'high'|null,
  *   classes: string[],
  *   fileCount: number|null,
- *   ceilings: { maxFiles: number },
+ *   magnitude: { implFiles: number, implLines: number }|null,
+ *   ceilings: { maxImplLines: number, maxImplFiles: number },
  *   reasons: string[],
  * }}
  */
 export function checkLightDiffBackstop({
   changedFiles,
+  magnitude,
   ceilings,
   injectedRules,
   selectSensitivePathClassesFn,
 } = {}) {
-  const maxFiles = normalizeMaxFiles(
-    ceilings?.maxFiles,
-    LIGHT_DIFF_CEILINGS.maxFiles,
-  );
+  const resolved = resolveDiffCeilings(ceilings);
   const files = Array.isArray(changedFiles)
     ? changedFiles.filter((f) => typeof f === 'string' && f.trim() !== '')
     : null;
@@ -436,7 +486,8 @@ export function checkLightDiffBackstop({
       level: null,
       classes: [],
       fileCount: files === null ? null : 0,
-      ceilings: { maxFiles },
+      magnitude: null,
+      ceilings: resolved,
       reasons: [
         'actual change set is unknown or empty — cannot verify the diff is light; escalate to /plan',
       ],
@@ -448,23 +499,12 @@ export function checkLightDiffBackstop({
     injectedRules,
     selectSensitivePathClassesFn,
   });
+  const measured = normalizeMagnitude(magnitude);
 
-  const reasons = [];
-  if (classes.length > 0) {
-    reasons.push(
-      `diff intersects sensitive-path class(es) ${classes.join(', ')} — escalate to /plan (do not land light)`,
-    );
-  }
-  if (files.length > maxFiles) {
-    reasons.push(
-      `diff touches ${files.length} file(s) (> maxFiles ${maxFiles}) — escalate to /plan (do not land light)`,
-    );
-  }
-  if (level !== 'low' && classes.length === 0) {
-    reasons.push(
-      'sensitive-path classification unavailable — cannot verify the diff is non-sensitive; escalate to /plan',
-    );
-  }
+  const reasons = [
+    ...describeSensitivity({ level, classes }),
+    ...describeMagnitude(measured, resolved),
+  ];
 
   const blocked = reasons.length > 0;
   return {
@@ -472,15 +512,80 @@ export function checkLightDiffBackstop({
     level,
     classes,
     fileCount: files.length,
-    ceilings: { maxFiles },
+    magnitude: measured,
+    ceilings: resolved,
     reasons: blocked
       ? reasons
       : [
-          `diff is light: ${files.length} file(s) ≤ ${maxFiles}, no sensitive-path class — safe to land`,
+          `diff is light: ${measured.implLines} implementation line(s) ≤ ${resolved.maxImplLines} ` +
+            `across ${measured.implFiles} implementation file(s) ≤ ${resolved.maxImplFiles} ` +
+            `(${files.length} file(s) total, companions exempt), no sensitive-path class — safe to land`,
         ],
   };
 }
 
+/**
+ * Coerce a magnitude summary into non-negative integer counts, or `null` when
+ * it was not measurable. Pure.
+ *
+ * @param {unknown} magnitude
+ * @returns {{ implFiles: number, implLines: number }|null}
+ */
+function normalizeMagnitude(magnitude) {
+  const implFiles = magnitude?.implFiles;
+  const implLines = magnitude?.implLines;
+  if (!Number.isFinite(implFiles) || !Number.isFinite(implLines)) return null;
+  if (implFiles < 0 || implLines < 0) return null;
+  return { implFiles: Math.floor(implFiles), implLines: Math.floor(implLines) };
+}
+
+/**
+ * Sensitivity objections, over the **full** change set. Pure.
+ *
+ * @param {{ level: 'low'|'high'|null, classes: string[] }} derived
+ * @returns {string[]}
+ */
+function describeSensitivity({ level, classes }) {
+  if (classes.length > 0) {
+    return [
+      `diff intersects sensitive-path class(es) ${classes.join(', ')} — escalate to /plan (do not land light)`,
+    ];
+  }
+  if (level !== 'low') {
+    return [
+      'sensitive-path classification unavailable — cannot verify the diff is non-sensitive; escalate to /plan',
+    ];
+  }
+  return [];
+}
+
+/**
+ * Magnitude objections, over the implementation half only. Pure.
+ *
+ * @param {{ implFiles: number, implLines: number }|null} measured
+ * @param {{ maxImplLines: number, maxImplFiles: number }} ceilings
+ * @returns {string[]}
+ */
+function describeMagnitude(measured, ceilings) {
+  if (measured === null) {
+    return [
+      'change magnitude could not be measured (unreadable or unparseable numstat) — cannot verify the diff is light; escalate to /plan',
+    ];
+  }
+  const reasons = [];
+  if (measured.implLines > ceilings.maxImplLines) {
+    reasons.push(
+      `diff changes ${measured.implLines} implementation line(s) (> maxImplLines ${ceilings.maxImplLines}) — escalate to /plan (do not land light)`,
+    );
+  }
+  if (measured.implFiles > ceilings.maxImplFiles) {
+    reasons.push(
+      `diff spans ${measured.implFiles} implementation file(s) (> maxImplFiles ${ceilings.maxImplFiles}) — escalate to /plan (do not land light)`,
+    );
+  }
+  return reasons;
+}
+
 /** Cap on a receipt slug's length — keep the branch/id readable. */
 const RECEIPT_SLUG_MAX = 48;
 

package/.agents/scripts/lib/orchestration/plan-context.js

@@ -379,14 +379,21 @@ function resolveRiskHeuristics(config = {}) {
  * this one screens a seed, that one decides. Collapsing them would make a
  * confirm a bypass.
  *
- *   - `maxArtifacts`           — enumerated seed items (one artifact each).
+ * **Risk only, never cardinality (Story #4856).** This carried a
+ * `maxArtifacts: 2` ceiling — the second surviving artifact count after Story
+ * #4764 retired the axis from the routing gate, and the more misleading of the
+ * two, because the artifacts it counted were **paths scraped from seed prose**
+ * rather than a measured footprint. Observed on the seed that produced Story
+ * #4856: a change spanning four framework modules was suggested as light off
+ * two scraped paths, one of which did not exist at the scraped location. A count
+ * of guesses is not a size signal, so the screen now keys on risk alone.
+ *
  *   - `maxRiskHeuristicHits`   — any risk-heuristic hit disqualifies: risk
  *                                is exactly what a light path should not carry.
  *   - `maxSensitivePathClasses`— any sensitive-path class disqualifies, the
  *                                same taxonomy close applies to a landed diff.
  */
 const DELIVER_LIGHT_SUGGESTION_CEILINGS = Object.freeze({
-  maxArtifacts: 2,
   maxRiskHeuristicHits: 0,
   maxSensitivePathClasses: 0,
 });
@@ -413,9 +420,6 @@ export function buildDeliverLightSuggestion(complexitySignals) {
   const advisory = /** @type {const} */ (true);
   const automatic = /** @type {const} */ (false);
   const s = complexitySignals ?? {};
-  const artifactCount = Number.isInteger(s.artifactCount)
-    ? s.artifactCount
-    : Number.POSITIVE_INFINITY;
   const riskHits = Array.isArray(s.riskHeuristicHits)
     ? s.riskHeuristicHits.length
     : Number.POSITIVE_INFINITY;
@@ -424,11 +428,6 @@ export function buildDeliverLightSuggestion(complexitySignals) {
     : Number.POSITIVE_INFINITY;
 
   const reasons = [];
-  if (artifactCount > ceilings.maxArtifacts) {
-    reasons.push(
-      `seed enumerates ${artifactCount} artifacts (> ${ceilings.maxArtifacts})`,
-    );
-  }
   if (riskHits > ceilings.maxRiskHeuristicHits) {
     reasons.push(`seed hits ${riskHits} risk-heuristic phrase(s)`);
   }
@@ -446,9 +445,9 @@ export function buildDeliverLightSuggestion(complexitySignals) {
     ceilings,
     reasons: suggested
       ? [
-          `seed fits the light-path ceilings (≤${ceilings.maxArtifacts} artifacts, ` +
-            'no risk-heuristic hits, no sensitive-path classes) — the operator ' +
-            'may prefer /deliver for this scope',
+          'seed carries no risk signal (no risk-heuristic hits, no ' +
+            'sensitive-path classes) — the operator may prefer /deliver for ' +
+            "this scope; the light path's own gate and diff backstop decide size",
         ]
       : reasons,
   };

package/.agents/scripts/lib/orchestration/run-epilogue.js

@@ -557,22 +557,29 @@ async function executeFollowUpRollup({
   // Shared with the story-scoped gather (Story #4649): `storyId` + `details`
   // are what the composer's recovery-netting keys on, and two hand-rolled
   // copies of this loop are how they got dropped in the first place.
-  const signals = await gatherRunFrictionSignals(stories, config);
+  const { signals, window: frictionWindow } = await gatherRunFrictionSignals(
+    stories,
+    config,
+  );
   const repos = resolveFollowUpRepos(config);
   const primaryId = Number(stories[0]);
+  // Story #4850 — `runToken` and `anchorStoryIds` are INPUTS. This used to
+  // compose with the primary Story's numeric id standing in for the run and
+  // then rewrite the rendered title/body by regex over a `plan-run \d+`
+  // substring, which meant the composer's own wording could not be changed
+  // without silently breaking the patch. `anchorStoryIds` is what lets the
+  // composer tell a corpus confined to this run from one spanning the whole
+  // surviving window, so it never titles the latter as if it were the former.
   const proposals = composeRoutedProposals({
     anchorId: Number.isInteger(primaryId) ? primaryId : 1,
     anchorKind: 'run',
+    runToken: String(planRunId ?? ''),
+    anchorStoryIds: stories,
     frameworkRepo: repos.frameworkRepo,
     consumerRepo: repos.consumerRepo,
     signals,
     unresolvedBlockedEvents: [],
   });
-  // Patch titles to mention the plan-run token (anchorKind run uses numeric id).
-  for (const item of [...proposals.framework, ...proposals.consumer]) {
-    item.title = item.title.replace(/plan-run \d+/, `plan-run ${planRunId}`);
-    item.body = item.body.replace(/plan-run \d+/g, `plan-run ${planRunId}`);
-  }
   const graduated = await graduateFn({
     epicId: primaryId,
     provider,
@@ -619,6 +626,11 @@ async function executeFollowUpRollup({
     signalCount: signals.length,
     storyCount: stories.length,
     filed: graduated.filed?.length ?? 0,
+    // Story #4850 — the recurrence window the gather actually applied, and what
+    // it dropped. `signalCount` alone cannot distinguish "the window is bounded
+    // at 30 days and 40 rows aged out" from "nothing older exists", and an
+    // operator triaging a roll-up needs to know which corpus produced it.
+    frictionWindow,
     // Story #4828 — everything below is what the roll-up saw and what became
     // of it. The pre-#4828 result reported `signalCount` and `filed` and
     // nothing in between, so nine signals routing into one proposal whose

package/.agents/scripts/lib/orchestration/single-story-close/phases/post-land.js

@@ -11,7 +11,7 @@
  * Story is already `agent::done`, so confirm short-circuits `noop` and the
  * capture's `action === 'done'` gate never opens).
  *
- * This module folds all four steps into one phase both landing surfaces
+ * This module folds every such step into one phase both landing surfaces
  * reach — the in-close wait (`phases/confirm-merge.js`) and the standalone
  * `single-story-confirm-merge.js` CLI — so the two paths cannot diverge and
  * "landed" means the whole tail ran.
@@ -45,6 +45,7 @@ import {
   planFastForward as defaultPlanFastForward,
 } from '../../git-cleanup/phases/fast-forward.js';
 import { reassertStatusColumn as defaultReassertStatusColumn } from '../../reassert-status-column.js';
+import { releaseStoryLease as defaultReleaseStoryLease } from '../../single-story-lease-guard.js';
 import { captureStoryFollowUps as defaultCaptureStoryFollowUps } from '../../story-follow-ups.js';
 
 /**
@@ -241,6 +242,54 @@ async function stepTempPurge({ storyId, config, purgeStoryTempArtifactsFn }) {
   return { ok: errors.length === 0, detail: errors.join('; ') || null };
 }
 
+/**
+ * Release the Story's assignee-lease now that the merge is confirmed
+ * (Story #4860).
+ *
+ * The close used to release here-ish — immediately after the PR was opened
+ * and armed, before the merge wait ran — so a Story's ticket read *unassigned*
+ * for the entire window its PR was open, and indefinitely on the
+ * operator-merge path where a human owns the land. The claim is the only
+ * ticket-visible record of who owns in-flight work, so dropping it at PR
+ * creation is dropping it at exactly the wrong moment.
+ *
+ * It lives in the tail rather than in either landing surface because the tail
+ * is the one seam **both** reach — the in-close merge wait
+ * (`phases/confirm-merge.js`) and the standalone
+ * `single-story-confirm-merge.js` CLI. Homing it anywhere else re-opens the
+ * surface divergence this module exists to close.
+ *
+ * Idempotent by construction: `releaseStoryLease` no-ops when the resolved
+ * operator is no longer the recorded owner, so a re-run (or the belated
+ * manual confirm that backfills an already-`agent::done` Story) reports the
+ * no-op reason rather than yanking a claim someone else has since taken.
+ *
+ * A `released: false` no-op is **not** a step failure: an already-released
+ * ticket is the desired end state, and reporting it as `false` would train
+ * readers to ignore the field. Only a throw — an unreachable API, an
+ * unresolvable operator identity — degrades the step, and like every tail
+ * step that degrades the report, never the land.
+ */
+async function stepLeaseRelease({
+  storyId,
+  provider,
+  config,
+  progress,
+  releaseStoryLeaseFn,
+}) {
+  const outcome = await releaseStoryLeaseFn({ provider, storyId, config });
+  progress?.(
+    'POST-LAND',
+    outcome?.released
+      ? `🔓 Story #${storyId} lease released (merge confirmed).`
+      : `⏭  Story #${storyId} lease not released (${outcome?.reason ?? 'unknown'}).`,
+  );
+  return {
+    ok: true,
+    detail: outcome?.released ? null : (outcome?.reason ?? null),
+  };
+}
+
 /**
  * Run the whole post-land tail. Never throws.
  *
@@ -280,7 +329,8 @@ async function stepTempPurge({ storyId, config, purgeStoryTempArtifactsFn }) {
  * @param {Function} [args.executeFastForwardFn]    Test seam.
  * @param {Function} [args.acquireLockWithWaitFn]   Test seam.
  * @param {Function} [args.purgeStoryTempArtifactsFn] Test seam.
- * @returns {Promise<{ followUps: boolean, statusResync: boolean, refCleanup: boolean, baseFastForward: boolean, tempPurge: boolean, details: Record<string, string|null> }>}
+ * @param {Function} [args.releaseStoryLeaseFn]     Test seam.
+ * @returns {Promise<{ followUps: boolean, statusResync: boolean, refCleanup: boolean, baseFastForward: boolean, tempPurge: boolean, leaseRelease: boolean, details: Record<string, string|null> }>}
  */
 export async function runPostLandTail({
   storyId,
@@ -299,6 +349,7 @@ export async function runPostLandTail({
   executeFastForwardFn = defaultExecuteFastForward,
   acquireLockWithWaitFn = defaultAcquireLockWithWait,
   purgeStoryTempArtifactsFn = defaultPurgeStoryTempArtifacts,
+  releaseStoryLeaseFn = defaultReleaseStoryLease,
 }) {
   progress?.('POST-LAND', `🧾 Running land tail for Story #${storyId}...`);
 
@@ -401,18 +452,35 @@ export async function runPostLandTail({
     { name: 'temp purge', progress },
   );
 
+  // Story #4860 — the merge is confirmed, so the operator's claim on this
+  // Story has finally done its job. Released here rather than at PR creation
+  // so the ticket stays assigned for the whole time its PR is open.
+  const leaseRelease = await step(
+    () =>
+      stepLeaseRelease({
+        storyId,
+        provider,
+        config,
+        progress,
+        releaseStoryLeaseFn,
+      }),
+    { name: 'lease release', progress },
+  );
+
   const tail = {
     followUps: followUps.ok,
     statusResync: statusResync.ok,
     refCleanup: refCleanup.ok,
     baseFastForward: baseFastForward.ok,
     tempPurge: tempPurge.ok,
+    leaseRelease: leaseRelease.ok,
     details: {
       followUps: followUps.detail,
       statusResync: statusResync.detail,
       refCleanup: refCleanup.detail,
       baseFastForward: baseFastForward.detail,
       tempPurge: tempPurge.detail,
+      leaseRelease: leaseRelease.detail,
     },
   };
   const degraded = Object.entries(tail)

package/.agents/scripts/lib/orchestration/single-story-close/runner.js

@@ -353,8 +353,8 @@ function closeResult({
     note: waitedForMerge
       ? 'Close-and-land: PR merge confirmed. Story flipped agent::closing → agent::done, the issue closed (confirmStoryMerged), and the post-land tail ran.'
       : autoMergeEnabled
-        ? 'PR open against baseBranch with auto-merge enabled. Story rests at agent::closing (issue stays OPEN). GitHub will squash-merge when required checks pass; run single-story-confirm-merge.js after the merge confirms to flip agent::done and close the issue (the Closes #<id> footer also auto-closes it).'
-        : 'PR open against baseBranch. Story rests at agent::closing (issue stays OPEN). Operator merges via GitHub UI; run single-story-confirm-merge.js after the merge confirms to flip agent::done (the Closes #<id> footer also auto-closes the issue).',
+        ? 'PR open against baseBranch with auto-merge enabled. Story rests at agent::closing (issue stays OPEN and assigned to the operator). GitHub will squash-merge when required checks pass; run single-story-confirm-merge.js after the merge confirms to flip agent::done, release the lease, and close the issue (the Closes #<id> footer also auto-closes it).'
+        : 'PR open against baseBranch. Story rests at agent::closing (issue stays OPEN and assigned to the operator). Operator merges via GitHub UI; run single-story-confirm-merge.js after the merge confirms to flip agent::done and release the lease (the Closes #<id> footer also auto-closes the issue).',
   };
 }
 
@@ -552,7 +552,18 @@ async function runClosePipeline({
     config,
     progress,
   });
-  const leaseReleased = await releaseLease(leaseArgs);
+  // Story #4860 — the clean-path lease release USED to sit here, immediately
+  // after the arm and the `agent::closing` flip. That dropped the operator's
+  // claim the moment the PR opened, so a ticket read unassigned for the whole
+  // time its PR was in flight — and forever on the operator-merge path, where
+  // nothing downstream ever re-claimed it. The release now belongs to the
+  // post-land tail, which runs only on a CONFIRMED merge and which both
+  // landing surfaces reach. Every non-merged ending below — the
+  // `merge.unlanded` block, an exhausted wait budget, `--no-wait-merge`,
+  // `--no-auto-merge` — deliberately RETAINS the claim: the PR is open and the
+  // work still has an owner. The only releases that survive here are
+  // `releaseLeaseOnBlock`'s two throwing exits above, which fire before the PR
+  // is ever armed (Story #4257's hand-off property).
 
   // Close-and-land (Story #4428; default since `delivery.routing.closeAndLand`
   // — Story #4539): poll the just-armed PR to merge confirmation, or block
@@ -625,7 +636,11 @@ async function runClosePipeline({
       autoMergeEnabled,
       autoMergeReason,
       worktreeReaped,
-      leaseReleased,
+      // Story #4860 — the release is a post-land tail step now, so the tail's
+      // own per-step boolean IS the answer. A wait that ended anything other
+      // than landed never ran the tail, and correctly reports `false`: the
+      // claim is still held, by design.
+      leaseReleased: waitOutcome.tail?.leaseRelease === true,
       localCleanupDeferred,
       directMerged,
       waitedForMerge: true,
@@ -663,7 +678,10 @@ async function runClosePipeline({
     autoMergeEnabled,
     autoMergeReason,
     worktreeReaped,
-    leaseReleased,
+    // Story #4860 — this is the no-wait ending: the PR is open and a human
+    // owns the merge, so the Story stays assigned until the confirm-merge
+    // surface lands it and runs the tail.
+    leaseReleased: false,
     localCleanupDeferred,
     directMerged,
   });