mandrel 2.23.0 → 2.24.0

package/.agents/scripts/lib/orchestration/light-escalation.js

@@ -0,0 +1,169 @@
+/**
+ * lib/orchestration/light-escalation.js — what the light path does when it
+ * refuses a scope (Story #4856).
+ *
+ * Two behaviors, both previously missing, and both about a refusal rather than
+ * a verdict — the verdicts live in
+ * {@link module:lib/orchestration/light-suitability}:
+ *
+ *   1. **Recycling the receipt.** A blocked diff backstop used to tell the
+ *      operator to "escalate to `/plan`", which authored a brand-new Story and
+ *      left the receipt open with no successor — orphaning its branch, its
+ *      worktree, and a finished implementation. Naming the receipt as `/plan`'s
+ *      *input* recycles it instead: tickets mode already fetches a ticket,
+ *      rewrites it into properly-planned Stories, and closes the source as
+ *      superseded.
+ *
+ *      Deferring receipt creation until after the backstop would be the other
+ *      fix, and is deliberately not taken: the issue id is load-bearing in
+ *      `single-story-init.js` (the assignee lease, the `story-<id>` branch, the
+ *      label state machine) and in the `(refs #<id>)` commit subject.
+ *
+ *   2. **Telemetering the refusal.** Neither light-path rejection emitted any
+ *      signal, so an over-tight ceiling could only reach the framework as
+ *      anecdote — which is exactly how the `maxFiles: 4` defect surfaced. The
+ *      roll-up aggregates by category, so recording these makes the ceilings
+ *      recalibratable from evidence.
+ *
+ * Telemetry is best-effort by construction: a signals-write failure must never
+ * change a gate's verdict.
+ *
+ * @module lib/orchestration/light-escalation
+ */
+
+import {
+  emitRuntimeFriction,
+  RUNTIME_FRICTION_CATEGORIES,
+} from '../observability/runtime-friction.js';
+
+/**
+ * The `/plan` invocation that owns a Story the light path could not land.
+ *
+ * @param {number} storyId
+ * @returns {string}
+ */
+function buildRecycleCommand(storyId) {
+  return `/plan ${storyId}`;
+}
+
+/**
+ * Coerce an `--amends` argument (`#123` or `123`) into a positive integer issue
+ * number, or `null` when absent/malformed.
+ *
+ * This is the only Story context a **gate-stage** rejection can legitimately
+ * claim: the signals stream is keyed on a Story id, and an `ask-operator` gate
+ * has authored no receipt yet — deliberately, since not creating one is the
+ * point of that outcome. A bare prompt's rejection therefore has no stream to
+ * land in, and attributing it to a fabricated id would be worse than recording
+ * nothing.
+ *
+ * @param {unknown} amends
+ * @returns {number|null}
+ */
+function normalizeAmendsId(amends) {
+  const match = /^#?(\d+)$/.exec(String(amends ?? '').trim());
+  if (!match) return null;
+  const n = Number.parseInt(match[1], 10);
+  return Number.isInteger(n) && n > 0 ? n : null;
+}
+
+/**
+ * Record a suitability-gate refusal (`ask-operator`) as friction, attributed to
+ * the `--amends` target when there is one.
+ *
+ * @param {{
+ *   gate: object,
+ *   amends?: unknown,
+ *   recordFrictionFn?: typeof recordScopeFriction,
+ * }} args
+ * @returns {Promise<boolean>}
+ */
+export async function recordGateRefusal({
+  gate,
+  amends,
+  emitFn,
+  recordFrictionFn = recordScopeFriction,
+} = {}) {
+  return recordFrictionFn({
+    emitFn,
+    storyId: normalizeAmendsId(amends),
+    surface: 'suitability-gate',
+    reasons: gate?.outcome?.reasons ?? [],
+    details: {
+      action: gate?.action ?? null,
+      code: gate?.suitability?.shape?.code ?? null,
+    },
+  });
+}
+
+/**
+ * Handle a blocked diff backstop: record the refusal as friction and return the
+ * `/plan` invocation that recycles the receipt.
+ *
+ * Lives here rather than in the CLI so the shell stays a shell — the backstop
+ * mode's job is to branch and print, not to decide what a refusal means.
+ *
+ * @param {{
+ *   storyId: number,
+ *   result: object,
+ *   recordFrictionFn?: typeof recordScopeFriction,
+ * }} args `result` is a {@link module:lib/orchestration/light-suitability.checkLightDiffBackstop}
+ *   verdict.
+ * @returns {Promise<string>} The recycle command.
+ */
+export async function handleBlockedBackstop({
+  storyId,
+  result,
+  emitFn,
+  recordFrictionFn = recordScopeFriction,
+} = {}) {
+  await recordFrictionFn({
+    emitFn,
+    storyId,
+    surface: 'diff-backstop',
+    reasons: result?.reasons ?? [],
+    details: {
+      fileCount: result?.fileCount ?? null,
+      implFiles: result?.magnitude?.implFiles ?? null,
+      implLines: result?.magnitude?.implLines ?? null,
+      ceilings: result?.ceilings ?? null,
+      classes: result?.classes ?? [],
+    },
+  });
+  return buildRecycleCommand(storyId);
+}
+
+/**
+ * Record a light-path scope rejection as friction.
+ *
+ * Total: never throws, and returns `false` rather than propagating when the
+ * signals surface is unavailable.
+ *
+ * @param {{
+ *   storyId?: number|null,
+ *   surface: string,
+ *   reasons?: string[],
+ *   details?: object,
+ *   emitFn?: typeof emitRuntimeFriction,
+ * }} args
+ * @returns {Promise<boolean>}
+ */
+async function recordScopeFriction({
+  storyId,
+  surface,
+  reasons = [],
+  details = {},
+  emitFn,
+} = {}) {
+  const emit = emitFn ?? emitRuntimeFriction;
+  try {
+    return await emit({
+      storyId,
+      category: RUNTIME_FRICTION_CATEGORIES.LIGHT_SCOPE_REJECTED,
+      tool: 'deliver-light',
+      details: { surface, reasons, ...details },
+    });
+  } catch {
+    return false;
+  }
+}

package/.agents/scripts/lib/orchestration/light-suitability.js

@@ -36,9 +36,13 @@
  *      Under `--yes` (unattended) it fails closed to recommending `/plan`.
  *   3. **Diff-derived backstop ({@link checkLightDiffBackstop}).** After
  *      implementation the **actual** change set is re-checked with
- *      {@link module:lib/orchestration/review-depth.deriveChangeLevel} plus a
- *      file-count ceiling — the diff is the real scope signal — and an
- *      over-ceiling diff is blocked rather than landed silently.
+ *      {@link module:lib/orchestration/review-depth.deriveChangeLevel} plus the
+ *      implementation-only magnitude ceilings of {@link LIGHT_DIFF_CEILINGS} —
+ *      the diff is the real scope signal — and an over-ceiling diff is blocked
+ *      rather than landed silently. Story #4856 moved this from a `maxFiles: 4`
+ *      cardinality ceiling to changed lines over implementation files, and made
+ *      a block **recycle** its receipt Story through `/plan` tickets mode
+ *      instead of orphaning it.
  *   4. **Minimal receipt Story ({@link buildReceiptStoryTicket}).** A
  *      `type::story` ticket is authored inline so `refs #`, history, telemetry,
  *      and the `agent::executing -> agent::done` state machine survive.
@@ -79,35 +83,69 @@ export const OVERRIDABLE_SHAPE_CODES = Object.freeze([
 ]);
 
 /**
- * File-count ceiling for the **actual landed** change set the diff backstop
- * ({@link checkLightDiffBackstop}) enforces. This is the light path's **only**
- * cardinality ceiling, and deliberately so (Story #4764): the predicted
- * footprint is a declaration — a guess, and a gameable one — so the gate that
- * counts must be the one reading ground truth. A genuinely-light change stays
- * small; conservative by construction, since a ceiling an operator could widen
- * past what a single session safely absorbs is a ceiling that fails silently.
- * A framework constant, not a knob.
+ * Ceilings for the **actual landed** change set the diff backstop
+ * ({@link checkLightDiffBackstop}) enforces, measured on the change's
+ * implementation half (Story #4856 — see
+ * {@link module:lib/orchestration/diff-magnitude} for the measured case and the
+ * companion-class boundary).
+ *
+ * The backstop reads ground truth, so it is where size is genuinely enforced;
+ * the prediction gate above it is a declaration and stays coarse (Story #4764).
+ * What changed is the **axis**: this used to be `maxFiles: 4`, a cardinality
+ * ceiling that rejected 79% of this repository's real merged work while passing
+ * a three-file 323-line rewrite.
+ *
+ *   - `maxImplLines` — additions plus deletions across implementation files.
+ *                      Simulated over 41 merges, 1000 admits 83% of real work
+ *                      and rejects exactly the genuinely large changes.
+ *   - `maxImplFiles` — implementation files touched, a *sprawl* tripwire rather
+ *                      than a size gate. Set to `DEFAULT_DIFF_WIDTH.softFiles`
+ *                      so the light path and `review-depth.js` stop holding two
+ *                      different definitions of a narrow diff.
+ *
+ * Framework constants, not knobs: a ceiling an operator could widen past what a
+ * single session safely absorbs is a ceiling that fails silently.
  */
 export const LIGHT_DIFF_CEILINGS = Object.freeze({
-  maxFiles: 4,
+  maxImplLines: 1000,
+  maxImplFiles: 15,
 });
 
 /**
- * Coerce a candidate `maxFiles` ceiling into a positive integer, falling back
- * to the framework default for anything malformed — a stray `0`, `-1`, or `NaN`
- * must never widen (or zero out) the light diff ceiling.
+ * Coerce a candidate ceiling into a positive integer, falling back to the
+ * framework default for anything malformed — a stray `0`, `-1`, or `NaN` must
+ * never widen (or zero out) a light diff ceiling.
  *
  * @param {unknown} value
  * @param {number} fallback
  * @returns {number}
  */
-function normalizeMaxFiles(value, fallback) {
+function normalizeCeiling(value, fallback) {
   if (typeof value !== 'number' || !Number.isFinite(value) || value < 1) {
     return fallback;
   }
   return Math.floor(value);
 }
 
+/**
+ * Resolve the effective diff ceilings from a caller-supplied partial override.
+ *
+ * @param {{ maxImplLines?: unknown, maxImplFiles?: unknown }} [ceilings]
+ * @returns {{ maxImplLines: number, maxImplFiles: number }}
+ */
+function resolveDiffCeilings(ceilings) {
+  return {
+    maxImplLines: normalizeCeiling(
+      ceilings?.maxImplLines,
+      LIGHT_DIFF_CEILINGS.maxImplLines,
+    ),
+    maxImplFiles: normalizeCeiling(
+      ceilings?.maxImplFiles,
+      LIGHT_DIFF_CEILINGS.maxImplFiles,
+    ),
+  };
+}
+
 /**
  * Resolve the model's trivial-vs-standard verdict, held to the same ledgering
  * contract the planner's authored verdict is
@@ -389,11 +427,23 @@ export function resolveLightGateOutcome({
 }
 
 /**
- * Diff-derived backstop (Story #4740 AC-4): re-check the **actual** change set
- * after implementation, because the diff — not the prompt — is the real scope
- * signal. Blocks (rather than landing) when the diff intersects a sensitive-
- * path class, exceeds the file-count ceiling, or cannot be classified. A clean
- * result is the only path that lands light.
+ * Diff-derived backstop (Story #4740 AC-4, re-based on magnitude by Story
+ * #4856): re-check the **actual** change set after implementation, because the
+ * diff — not the prompt — is the real scope signal. Blocks (rather than landing)
+ * when the diff intersects a sensitive-path class, exceeds an implementation
+ * ceiling, or cannot be measured. A clean result is the only path that lands
+ * light.
+ *
+ * Two inputs, two different scopes, and the difference is load-bearing:
+ *
+ *   - `changedFiles` is the **full** change set, companions included, and is
+ *     what sensitive-path derivation reads. Exempting a companion from the
+ *     *count* must never exempt it from *risk* — a test file under a registered
+ *     sensitive class still blocks.
+ *   - `magnitude` is the implementation-only summary from
+ *     {@link module:lib/orchestration/diff-magnitude.summarizeDiffMagnitude}.
+ *     `null` means the magnitude could not be measured, which blocks: absence
+ *     of evidence is not evidence the diff is small.
  *
  * Reuses close's own {@link module:lib/orchestration/review-depth.deriveChangeLevel}
  * — one taxonomy, applied to the predicted shape at the gate and the actual
@@ -403,7 +453,8 @@ export function resolveLightGateOutcome({
  *
  * @param {{
  *   changedFiles?: unknown,
- *   ceilings?: { maxFiles?: number },
+ *   magnitude?: { implFiles?: number, implLines?: number }|null,
+ *   ceilings?: { maxImplLines?: number, maxImplFiles?: number },
  *   injectedRules?: object,
  *   selectSensitivePathClassesFn?: Function,
  * }} [args]
@@ -412,20 +463,19 @@ export function resolveLightGateOutcome({
  *   level: 'low'|'high'|null,
  *   classes: string[],
  *   fileCount: number|null,
- *   ceilings: { maxFiles: number },
+ *   magnitude: { implFiles: number, implLines: number }|null,
+ *   ceilings: { maxImplLines: number, maxImplFiles: number },
  *   reasons: string[],
  * }}
  */
 export function checkLightDiffBackstop({
   changedFiles,
+  magnitude,
   ceilings,
   injectedRules,
   selectSensitivePathClassesFn,
 } = {}) {
-  const maxFiles = normalizeMaxFiles(
-    ceilings?.maxFiles,
-    LIGHT_DIFF_CEILINGS.maxFiles,
-  );
+  const resolved = resolveDiffCeilings(ceilings);
   const files = Array.isArray(changedFiles)
     ? changedFiles.filter((f) => typeof f === 'string' && f.trim() !== '')
     : null;
@@ -436,7 +486,8 @@ export function checkLightDiffBackstop({
       level: null,
       classes: [],
       fileCount: files === null ? null : 0,
-      ceilings: { maxFiles },
+      magnitude: null,
+      ceilings: resolved,
       reasons: [
         'actual change set is unknown or empty — cannot verify the diff is light; escalate to /plan',
       ],
@@ -448,23 +499,12 @@ export function checkLightDiffBackstop({
     injectedRules,
     selectSensitivePathClassesFn,
   });
+  const measured = normalizeMagnitude(magnitude);
 
-  const reasons = [];
-  if (classes.length > 0) {
-    reasons.push(
-      `diff intersects sensitive-path class(es) ${classes.join(', ')} — escalate to /plan (do not land light)`,
-    );
-  }
-  if (files.length > maxFiles) {
-    reasons.push(
-      `diff touches ${files.length} file(s) (> maxFiles ${maxFiles}) — escalate to /plan (do not land light)`,
-    );
-  }
-  if (level !== 'low' && classes.length === 0) {
-    reasons.push(
-      'sensitive-path classification unavailable — cannot verify the diff is non-sensitive; escalate to /plan',
-    );
-  }
+  const reasons = [
+    ...describeSensitivity({ level, classes }),
+    ...describeMagnitude(measured, resolved),
+  ];
 
   const blocked = reasons.length > 0;
   return {
@@ -472,15 +512,80 @@ export function checkLightDiffBackstop({
     level,
     classes,
     fileCount: files.length,
-    ceilings: { maxFiles },
+    magnitude: measured,
+    ceilings: resolved,
     reasons: blocked
       ? reasons
       : [
-          `diff is light: ${files.length} file(s) ≤ ${maxFiles}, no sensitive-path class — safe to land`,
+          `diff is light: ${measured.implLines} implementation line(s) ≤ ${resolved.maxImplLines} ` +
+            `across ${measured.implFiles} implementation file(s) ≤ ${resolved.maxImplFiles} ` +
+            `(${files.length} file(s) total, companions exempt), no sensitive-path class — safe to land`,
         ],
   };
 }
 
+/**
+ * Coerce a magnitude summary into non-negative integer counts, or `null` when
+ * it was not measurable. Pure.
+ *
+ * @param {unknown} magnitude
+ * @returns {{ implFiles: number, implLines: number }|null}
+ */
+function normalizeMagnitude(magnitude) {
+  const implFiles = magnitude?.implFiles;
+  const implLines = magnitude?.implLines;
+  if (!Number.isFinite(implFiles) || !Number.isFinite(implLines)) return null;
+  if (implFiles < 0 || implLines < 0) return null;
+  return { implFiles: Math.floor(implFiles), implLines: Math.floor(implLines) };
+}
+
+/**
+ * Sensitivity objections, over the **full** change set. Pure.
+ *
+ * @param {{ level: 'low'|'high'|null, classes: string[] }} derived
+ * @returns {string[]}
+ */
+function describeSensitivity({ level, classes }) {
+  if (classes.length > 0) {
+    return [
+      `diff intersects sensitive-path class(es) ${classes.join(', ')} — escalate to /plan (do not land light)`,
+    ];
+  }
+  if (level !== 'low') {
+    return [
+      'sensitive-path classification unavailable — cannot verify the diff is non-sensitive; escalate to /plan',
+    ];
+  }
+  return [];
+}
+
+/**
+ * Magnitude objections, over the implementation half only. Pure.
+ *
+ * @param {{ implFiles: number, implLines: number }|null} measured
+ * @param {{ maxImplLines: number, maxImplFiles: number }} ceilings
+ * @returns {string[]}
+ */
+function describeMagnitude(measured, ceilings) {
+  if (measured === null) {
+    return [
+      'change magnitude could not be measured (unreadable or unparseable numstat) — cannot verify the diff is light; escalate to /plan',
+    ];
+  }
+  const reasons = [];
+  if (measured.implLines > ceilings.maxImplLines) {
+    reasons.push(
+      `diff changes ${measured.implLines} implementation line(s) (> maxImplLines ${ceilings.maxImplLines}) — escalate to /plan (do not land light)`,
+    );
+  }
+  if (measured.implFiles > ceilings.maxImplFiles) {
+    reasons.push(
+      `diff spans ${measured.implFiles} implementation file(s) (> maxImplFiles ${ceilings.maxImplFiles}) — escalate to /plan (do not land light)`,
+    );
+  }
+  return reasons;
+}
+
 /** Cap on a receipt slug's length — keep the branch/id readable. */
 const RECEIPT_SLUG_MAX = 48;
 

package/.agents/scripts/lib/orchestration/plan-context.js

@@ -379,14 +379,21 @@ function resolveRiskHeuristics(config = {}) {
  * this one screens a seed, that one decides. Collapsing them would make a
  * confirm a bypass.
  *
- *   - `maxArtifacts`           — enumerated seed items (one artifact each).
+ * **Risk only, never cardinality (Story #4856).** This carried a
+ * `maxArtifacts: 2` ceiling — the second surviving artifact count after Story
+ * #4764 retired the axis from the routing gate, and the more misleading of the
+ * two, because the artifacts it counted were **paths scraped from seed prose**
+ * rather than a measured footprint. Observed on the seed that produced Story
+ * #4856: a change spanning four framework modules was suggested as light off
+ * two scraped paths, one of which did not exist at the scraped location. A count
+ * of guesses is not a size signal, so the screen now keys on risk alone.
+ *
  *   - `maxRiskHeuristicHits`   — any risk-heuristic hit disqualifies: risk
  *                                is exactly what a light path should not carry.
  *   - `maxSensitivePathClasses`— any sensitive-path class disqualifies, the
  *                                same taxonomy close applies to a landed diff.
  */
 const DELIVER_LIGHT_SUGGESTION_CEILINGS = Object.freeze({
-  maxArtifacts: 2,
   maxRiskHeuristicHits: 0,
   maxSensitivePathClasses: 0,
 });
@@ -413,9 +420,6 @@ export function buildDeliverLightSuggestion(complexitySignals) {
   const advisory = /** @type {const} */ (true);
   const automatic = /** @type {const} */ (false);
   const s = complexitySignals ?? {};
-  const artifactCount = Number.isInteger(s.artifactCount)
-    ? s.artifactCount
-    : Number.POSITIVE_INFINITY;
   const riskHits = Array.isArray(s.riskHeuristicHits)
     ? s.riskHeuristicHits.length
     : Number.POSITIVE_INFINITY;
@@ -424,11 +428,6 @@ export function buildDeliverLightSuggestion(complexitySignals) {
     : Number.POSITIVE_INFINITY;
 
   const reasons = [];
-  if (artifactCount > ceilings.maxArtifacts) {
-    reasons.push(
-      `seed enumerates ${artifactCount} artifacts (> ${ceilings.maxArtifacts})`,
-    );
-  }
   if (riskHits > ceilings.maxRiskHeuristicHits) {
     reasons.push(`seed hits ${riskHits} risk-heuristic phrase(s)`);
   }
@@ -446,9 +445,9 @@ export function buildDeliverLightSuggestion(complexitySignals) {
     ceilings,
     reasons: suggested
       ? [
-          `seed fits the light-path ceilings (≤${ceilings.maxArtifacts} artifacts, ` +
-            'no risk-heuristic hits, no sensitive-path classes) — the operator ' +
-            'may prefer /deliver for this scope',
+          'seed carries no risk signal (no risk-heuristic hits, no ' +
+            'sensitive-path classes) — the operator may prefer /deliver for ' +
+            "this scope; the light path's own gate and diff backstop decide size",
         ]
       : reasons,
   };

package/.agents/scripts/lib/orchestration/single-story-close/phases/post-land.js

@@ -11,7 +11,7 @@
  * Story is already `agent::done`, so confirm short-circuits `noop` and the
  * capture's `action === 'done'` gate never opens).
  *
- * This module folds all four steps into one phase both landing surfaces
+ * This module folds every such step into one phase both landing surfaces
  * reach — the in-close wait (`phases/confirm-merge.js`) and the standalone
  * `single-story-confirm-merge.js` CLI — so the two paths cannot diverge and
  * "landed" means the whole tail ran.
@@ -45,6 +45,7 @@ import {
   planFastForward as defaultPlanFastForward,
 } from '../../git-cleanup/phases/fast-forward.js';
 import { reassertStatusColumn as defaultReassertStatusColumn } from '../../reassert-status-column.js';
+import { releaseStoryLease as defaultReleaseStoryLease } from '../../single-story-lease-guard.js';
 import { captureStoryFollowUps as defaultCaptureStoryFollowUps } from '../../story-follow-ups.js';
 
 /**
@@ -241,6 +242,54 @@ async function stepTempPurge({ storyId, config, purgeStoryTempArtifactsFn }) {
   return { ok: errors.length === 0, detail: errors.join('; ') || null };
 }
 
+/**
+ * Release the Story's assignee-lease now that the merge is confirmed
+ * (Story #4860).
+ *
+ * The close used to release here-ish — immediately after the PR was opened
+ * and armed, before the merge wait ran — so a Story's ticket read *unassigned*
+ * for the entire window its PR was open, and indefinitely on the
+ * operator-merge path where a human owns the land. The claim is the only
+ * ticket-visible record of who owns in-flight work, so dropping it at PR
+ * creation is dropping it at exactly the wrong moment.
+ *
+ * It lives in the tail rather than in either landing surface because the tail
+ * is the one seam **both** reach — the in-close merge wait
+ * (`phases/confirm-merge.js`) and the standalone
+ * `single-story-confirm-merge.js` CLI. Homing it anywhere else re-opens the
+ * surface divergence this module exists to close.
+ *
+ * Idempotent by construction: `releaseStoryLease` no-ops when the resolved
+ * operator is no longer the recorded owner, so a re-run (or the belated
+ * manual confirm that backfills an already-`agent::done` Story) reports the
+ * no-op reason rather than yanking a claim someone else has since taken.
+ *
+ * A `released: false` no-op is **not** a step failure: an already-released
+ * ticket is the desired end state, and reporting it as `false` would train
+ * readers to ignore the field. Only a throw — an unreachable API, an
+ * unresolvable operator identity — degrades the step, and like every tail
+ * step that degrades the report, never the land.
+ */
+async function stepLeaseRelease({
+  storyId,
+  provider,
+  config,
+  progress,
+  releaseStoryLeaseFn,
+}) {
+  const outcome = await releaseStoryLeaseFn({ provider, storyId, config });
+  progress?.(
+    'POST-LAND',
+    outcome?.released
+      ? `🔓 Story #${storyId} lease released (merge confirmed).`
+      : `⏭  Story #${storyId} lease not released (${outcome?.reason ?? 'unknown'}).`,
+  );
+  return {
+    ok: true,
+    detail: outcome?.released ? null : (outcome?.reason ?? null),
+  };
+}
+
 /**
  * Run the whole post-land tail. Never throws.
  *
@@ -280,7 +329,8 @@ async function stepTempPurge({ storyId, config, purgeStoryTempArtifactsFn }) {
  * @param {Function} [args.executeFastForwardFn]    Test seam.
  * @param {Function} [args.acquireLockWithWaitFn]   Test seam.
  * @param {Function} [args.purgeStoryTempArtifactsFn] Test seam.
- * @returns {Promise<{ followUps: boolean, statusResync: boolean, refCleanup: boolean, baseFastForward: boolean, tempPurge: boolean, details: Record<string, string|null> }>}
+ * @param {Function} [args.releaseStoryLeaseFn]     Test seam.
+ * @returns {Promise<{ followUps: boolean, statusResync: boolean, refCleanup: boolean, baseFastForward: boolean, tempPurge: boolean, leaseRelease: boolean, details: Record<string, string|null> }>}
  */
 export async function runPostLandTail({
   storyId,
@@ -299,6 +349,7 @@ export async function runPostLandTail({
   executeFastForwardFn = defaultExecuteFastForward,
   acquireLockWithWaitFn = defaultAcquireLockWithWait,
   purgeStoryTempArtifactsFn = defaultPurgeStoryTempArtifacts,
+  releaseStoryLeaseFn = defaultReleaseStoryLease,
 }) {
   progress?.('POST-LAND', `🧾 Running land tail for Story #${storyId}...`);
 
@@ -401,18 +452,35 @@ export async function runPostLandTail({
     { name: 'temp purge', progress },
   );
 
+  // Story #4860 — the merge is confirmed, so the operator's claim on this
+  // Story has finally done its job. Released here rather than at PR creation
+  // so the ticket stays assigned for the whole time its PR is open.
+  const leaseRelease = await step(
+    () =>
+      stepLeaseRelease({
+        storyId,
+        provider,
+        config,
+        progress,
+        releaseStoryLeaseFn,
+      }),
+    { name: 'lease release', progress },
+  );
+
   const tail = {
     followUps: followUps.ok,
     statusResync: statusResync.ok,
     refCleanup: refCleanup.ok,
     baseFastForward: baseFastForward.ok,
     tempPurge: tempPurge.ok,
+    leaseRelease: leaseRelease.ok,
     details: {
       followUps: followUps.detail,
       statusResync: statusResync.detail,
       refCleanup: refCleanup.detail,
       baseFastForward: baseFastForward.detail,
       tempPurge: tempPurge.detail,
+      leaseRelease: leaseRelease.detail,
     },
   };
   const degraded = Object.entries(tail)