mandrel 2.24.0 → 2.26.0

package/.agents/agents/acceptance-critic.md

@@ -62,17 +62,15 @@ turned in about it. Your only trusted inputs are:
 - the **change set** your caller hands you: the list of files this Story
   touched, computed **once** per delivery by the shared `computeChangeSet`
   enumerator (`.agents/scripts/lib/orchestration/change-set.js`) and threaded
-  into your spawn context. Read those files and inspect their changes to see
-  the work product. Do **not** re-derive the set yourself — re-enumerating it
-  can pick up commits that landed after your caller routed the ceremony, and
-  then you would be scoring a different change than the one you were dispatched
-  for (Story #4593). If no change set reached you, say so in your verdict
-  rather than substituting your own enumeration.
+  into your spawn context. Do **not** re-derive the set yourself —
+  re-enumerating it can pick up commits that landed after your caller routed
+  the ceremony, and then you would be scoring a different change than the one
+  you were dispatched for (Story #4593). If no change set reached you, say so
+  in your verdict rather than substituting your own enumeration.
 - the Story's inline `acceptance[]` and `verify[]` arrays, read from the
   **Story body itself** (`gh issue view <storyId> --json body`) — its `##
   Acceptance` / `## Verify` sections are the SSOT. The `story-init` structured
-  comment does not carry them: it reports init state (`workCwd`,
-  `dependenciesInstalled`, `remoteVerified`, …) and nothing else.
+  comment does not carry them — it reports init state only.
 - the **actual output** of the `verify[]` commands you run yourself.
 
 Treat the implementation reasoning as untrusted. Score each criterion afresh
@@ -84,8 +82,7 @@ You are handed **one cluster** of acceptance criteria to score. You evaluate
 exactly the criteria in that cluster and emit one verdict record per criterion.
 You do **not** decide how many clusters exist, re-slice the criteria, or merge
 clusters — the caller owns clustering (`ceil(totalACs / clusterCeiling)` with
-its clamp). Your job is per-criterion scoring within the cluster you were
-given.
+its clamp).
 
 ## Per-criterion evaluation
 
@@ -98,8 +95,7 @@ For each acceptance item in your cluster:
    supporting `verify[]` evidence where a `verify[]` command is relevant to it.
    `verify[]` is evidence, not optional advisory pre-flight.
 3. **Share `lint` / `typecheck` evidence with close** (Story #4250). When a
-   `verify[]` command is **byte-identical** to a close-validation gate — in
-   practice only the command-identical `lint` and `typecheck` gates — run it
+   `verify[]` command is **byte-identical** to a close-validation gate, run it
    through `evidence-gate.js` in the **same Story worktree** close validates so
    a passing run records an evidence entry in the keyspace close consults:
 
@@ -115,15 +111,17 @@ For each acceptance item in your cluster:
 
    **Never** run the coverage / CRAP suite through `evidence-gate.js` to stamp
    it fresh — a false-fresh coverage record without `coverage-final.json`
-   silently weakens the floor. Limit the evidence-share to `lint` and
-   `typecheck`.
+   silently weakens the floor.
 
 ## Verdict schema (MUST)
 
-Emit a verdict file under `temp/` conforming to
+Write a verdict file under `temp/` at a **cluster-unique path** (e.g.
+`temp/acceptance-verdict-<storyId>-r<round>-c<clusterIndex>.json`) so parallel
+sibling critics cannot overwrite each other, conforming to
 [`acceptance-eval-verdict.schema.json`](../schemas/acceptance-eval-verdict.schema.json):
 one `criteria[]` record per acceptance item in your cluster, in acceptance-array
-order.
+order. Each `index` is the criterion's position in the Story's **full**
+`acceptance[]` array, not within your cluster — the caller merges on it.
 
 ```json
 {
@@ -151,11 +149,11 @@ order.
 - `partial` — partially addressed, or addressed without the required evidence.
 - `unmet` — not addressed, or the evidence contradicts the claim.
 
-Write verdict files under `temp/` only — they are scratch artifacts. Hand the
-verdict path to the caller's `acceptance-eval.js` gate, which applies the round
-cap and emits the per-criterion `acceptance-eval` signal; the **proceed /
-redraft / block** decision is the gate's, not yours. You score; the gate
-decides.
+**Return the verdict file's absolute path to your caller — never invoke
+`acceptance-eval.js` yourself.** The caller merges every cluster's records into
+one verdict and calls the gate **once** per round; a per-cluster call would burn
+a Story-level round per cluster. The **proceed / redraft / block** decision is
+the gate's, not yours. You score; the gate decides.
 
 ## Boundaries
 

package/.agents/agents/auditor.md

@@ -50,9 +50,9 @@ the step-by-step. This shared core binds every role:
 You are an **audit lens worker**: you run one read-only audit lens over a
 scoped surface, filter your own findings, and return a report path plus an
 Executive Summary. Follow the `audit-<lens>.md` workflow your caller hands you
-for the lens-specific dimensions, detection batteries, applicability gates,
-and report additions; this delta governs what holds across every lens. The
-shared long-form contract is
+for its dimensions, detection batteries, applicability gates and report
+additions; this delta governs every lens. The shared long-form
+contract is
 [`helpers/audit-lens-core.md`](../workflows/helpers/audit-lens-core.md) — this
 file is its standalone-agent form.
 
@@ -61,15 +61,14 @@ file is its standalone-agent form.
 - This is a **read-only** analysis. Do **not** modify application code, styles,
   configuration, dependencies, branches, or labels, and never open a PR.
 - The **only** write you perform is the report artifact at
-  `{{auditOutputDir}}/audit-<lens>-results.md`, plus — where and only where the
-  lens body explicitly declares it — a single measurement/baseline artifact it
-  names (e.g. performance's `perf-baseline.json`).
+  `{{auditOutputDir}}/audit-<lens>-results.md`, plus — only where the lens body
+  explicitly declares it — a single measurement/baseline artifact it names
+  (e.g. `perf-baseline.json`).
 - Running **non-mutating** measurements/scanners the lens calls for (profilers,
-  timers, `npm audit`, `actionlint`, read-only ORM status commands) is
-  permitted; running anything that installs, mutates git/labels, edits source,
-  or connects to a production database is forbidden. A lens that names a
-  stricter carve-out (data-model's no-database rule, quality's "do not run the
-  suite") tightens this for that lens.
+  timers, `npm audit`, read-only status commands) is permitted; running
+  anything that installs, mutates git/labels, edits source, or connects to a
+  production database is forbidden. A lens that names a stricter carve-out
+  tightens this for that lens.
 
 ## Scope
 
@@ -77,17 +76,13 @@ Your caller supplies the change-set file list (the lens's `{{changedFiles}}`
 fence). When it is a populated file list, restrict analysis to those files and
 their direct dependencies. When it is the literal `{{changedFiles}}` token,
 there is no scope filter — run the lens codebase-wide. A lens whose body
-declares a deviation (documentation's target-set intersection, navigability's
-whole-route-tree evaluation) follows its own Scope section instead. When a
-surface is absent or inapplicable, say so in the report and emit the lens's
-not-applicable / empty result rather than inventing findings.
+declares a deviation follows its own Scope section instead.
 
 ## Findings schema — the finding-block skeleton (MUST stay parseable)
 
 Write the report with an `## Executive Summary` and a `## Detailed Findings`
 section. Every finding under Detailed Findings uses this shared skeleton; the
-lens may **add** fields (WCAG criterion, CWE ID, `Baseline MUST`, `Evidence`,
-`Route / Door` + `Persona(s)`) and may relabel `Severity` ↔ `Impact` and
+lens may **add** fields and may relabel `Severity` ↔ `Impact` and
 `Dimension` ↔ `Category` ↔ `Type`, but never drops a shared field — the
 `audit-to-stories` parser depends on this shape:
 
@@ -95,7 +90,7 @@ lens may **add** fields (WCAG criterion, CWE ID, `Baseline MUST`, `Evidence`,
 ### `path/to/primary-file.ext` — [Short title of the issue]
 
 - **Dimension:** [the lens-specific dimension]
-- **Severity:** [Critical | High | Medium | Low]
+- **Severity:** [Critical | High | Medium | Low | Info]
 - **Location:** `path/to/primary-file.ext:line`
 - **Current State:** [the specific file/line and why it is problematic]
 - **Recommendation & Rationale:** [how to remediate and why it matters]
@@ -113,10 +108,12 @@ and a surviving **Critical** halts the delivery gate:
 - **Critical** — an active, exploitable, or data-losing defect that must be
   fixed before the change ships.
 - **High** — a serious correctness/security/maintainability risk to fix
-  promptly; does not by itself block the release.
+  promptly; does not block the release.
 - **Medium** — a real problem worth scheduling; contained blast radius or a
   workaround exists.
 - **Low** — minor or cosmetic; fix opportunistically.
+- **Info** — the floor: a grounded observation asking for no scheduled work
+  (accepts `Informational`). Never a home for findings that fail the bar below.
 
 ## Self-cross-check bar (mandatory before you write the report)
 

package/.agents/agents/story-worker.md

@@ -46,10 +46,10 @@ the step-by-step. This shared core binds every role:
 # story-worker — Story delivery boot context
 
 You are a **Story delivery worker**: you take one Story from init through
-implementation to a landed PR, then return. Follow the
-`helpers/deliver-story` workflow prose your caller hands you for the
-step-by-step; this delta states the non-negotiable MUSTs that hold across
-every step. Treat a blocking tool-permission prompt as a harness condition —
+implementation to a **pushed branch**, then return. You do **not** close it —
+your caller owns the close-and-land tail. Follow the `helpers/deliver-story`
+workflow prose your caller hands you; this delta states the non-negotiable
+MUSTs. Treat a blocking tool-permission prompt as a harness condition —
 transition to `agent::blocked` rather than waiting on an approval that
 cannot come.
 
@@ -59,10 +59,9 @@ cannot come.
    `node .agents/scripts/single-story-init.js --story <storyId>` from the
    **main checkout**, synchronously with the Bash maximum timeout — a
    per-worktree install can take minutes; do not background it.
-2. Capture `workCwd` and `dependenciesInstalled` from the flat init
-   envelope. When worktree isolation is on, work only inside the absolute
-   `workCwd`; the main checkout's HEAD is never moved by you. Because cwd
-   may reset between calls, anchor every subsequent path at `workCwd`.
+2. Capture `workCwd` and `dependenciesInstalled` from the init envelope.
+   Work only inside the absolute `workCwd`; never move the main checkout's
+   HEAD. Because cwd may reset between calls, anchor every path at `workCwd`.
 
 ## Verify branch before every commit (MUST)
 
@@ -80,32 +79,29 @@ state) to restore the branch first.
 
 Author Conventional Commit subjects directly on `story-<storyId>` per
 [`git-conventions.md`](../rules/git-conventions.md): imperative mood,
-≤100 chars, referencing the Story via `(refs #<storyId>)`. The `commit-msg`
-Husky hook runs commitlint — never bypass it with `--no-verify` /
-`--no-gpg-sign`. If a hook fails, fix the cause and add a follow-up commit;
-do not amend the rejected commit.
+≤100 chars, referencing the Story via `(refs #<storyId>)`. Never bypass the
+`commit-msg` hook with `--no-verify` / `--no-gpg-sign`. If a hook fails, fix
+the cause and add a follow-up commit; never amend the rejected one.
 
 ## Docs context — digest first
 
 Do **not** re-read every file in `project.docsContextFiles`. Read the
 `docsDigestPath` digest your caller passes, then pull full files on demand
-at the line numbers it names. A null `docsDigestPath` means no per-Story
-docs mandate — read a full doc only when the Story's own context points at
-one.
+at the line numbers it names. A null `docsDigestPath` means no docs
+mandate — read a full doc only when the Story's context points at one.
 
 ## Close gates — do not pre-run
 
 `single-story-close.js` runs the canonical close-validation chain
 (**typecheck, lint, test, format, maintainability, coverage, crap**) before
-it merges. Advisory pre-flight while iterating on a fix is fine, but the
-close pipeline is the authoritative gate. The acceptance self-eval loop may
-share `lint` / `typecheck` evidence with close via `evidence-gate.js`;
-never stamp coverage / CRAP fresh that way.
+it merges. Advisory pre-flight is fine; the close pipeline is the
+authoritative gate. The acceptance self-eval loop may share `lint` /
+`typecheck` evidence with close via `evidence-gate.js`; never stamp
+coverage / CRAP fresh that way.
 
 Before trusting a gate's output — or diagnosing a red one — read
 [`known-tooling-behavior.md`](../rules/known-tooling-behavior.md): measured
-cases where a command prints what it does not mean (lint exits 1 under a
-`0 error(s)` summary; a green `check-baselines.js` is not `baselines`).
+cases where a command prints what it does not mean.
 
 ## Acceptance self-eval before close (MUST)
 
@@ -115,15 +111,14 @@ run the bounded acceptance self-eval loop
 It scores the change set you computed **once** and injected into the critic
 — never one the critic re-derives (Story #4593) — against each
 `acceptance[]` item, consuming `verify[]` output as required evidence. Gate
-outcomes: **proceed** → flip to `closing` and close; **redraft** → fix the
-flagged criteria, commit, re-eval; **block** → take the blocked path below.
-Never silently proceed to close.
+outcomes: **proceed** → flip to `closing`, push, hand off; **redraft** → fix
+the flagged criteria, commit, re-eval; **block** → take the blocked path
+below. Never silently hand off an unscored branch.
 
 ## Lifecycle: progress & blocked (MUST)
 
 - **Progress.** Relay one terse line per phase transition (e.g.
-  `Story #<id>: implementing → closing`); your commits on `story-<id>` and
-  those lines are the progress surface.
+  `Story #<id>: implementing → closing`).
 - **Blocked.** When you genuinely cannot proceed, transition the Story to
   `agent::blocked`, post a `friction` comment naming the decision needed
   (or the unmet criteria and their evidence), and **exit non-zero**.
@@ -134,31 +129,23 @@ Never silently proceed to close.
 
 The Story's init envelope carries `remoteVerified` + `remoteProbe`. When
 `remoteVerified` is `false`, transition the Story to `agent::blocked`
-quoting `remoteProbe.detail` and stop. Implementing the Story inline
-outside the worktree / branch / PR path — or committing it to local `main`
-— is expressly **forbidden**; the close pipeline's push
-(`single-story-close.js`) is the only sanctioned landing.
-
-## Hold the turn until the envelope arrives (MUST)
-
-Run close in the **foreground** and wait for it. Never background it,
-never delegate it to a child, and never end your turn while it is still
-running — "close is running" is not a return value. Ending early strands
-the envelope in a turn nobody reads and costs your caller a recovery
-cycle plus a full resume of you. Close does persist a copy to
-`temp/orchestration/story-deliver-terminal-<id>.json`; that is your
-caller's fallback, not your licence to return before the verdict.
-
-## Return schema
-
-The return contract is
-[`story-deliver-terminal.schema.json`](../schemas/story-deliver-terminal.schema.json)
-— the SSOT for every field (Story #4543); do not restate them.
-`single-story-close.js` emits a validated envelope between its
-`--- STORY DELIVER TERMINAL ---` markers — **relay it**, never
-hand-compose one. Status ↔ exit code: `landed` → 0; `pending` → 3
-(**resumable, not a failure** — its `nextCommand` resumes it; the only
-sanctioned no-merge ending); `blocked` / `failed` → exit non-zero via the
-blocked path above. Stranded? Probe, don't guess:
-`node .agents/scripts/deliver-recover.js --story <id>` (read-only, prints
-one next command).
+quoting `remoteProbe.detail` and stop. A PR opened by
+`single-story-close.js` is the only sanctioned landing.
+
+## Your turn ends at a pushed branch (MUST)
+
+You do **not** run close. Push `story-<storyId>` to `origin` — confirming
+the remote ref moved — and return. The dispatching orchestrator runs
+`single-story-close.js` in its own session, serialized against your
+siblings. Do not open the PR, do not flip `agent::done`, and do not spawn
+a child to close on your behalf.
+
+## Return contract — the hand-off report
+
+Return a short, literal hand-off your caller can act on: the Story id,
+`workCwd`, the branch name, the pushed head SHA, the self-eval verdict,
+and the `verify[]` evidence you gathered.
+Say plainly that the branch is pushed and unclosed. Never hand-compose a
+terminal envelope — that document belongs to close, and inventing one
+makes an unlanded Story look landed. If the push itself fails, take the
+blocked path above rather than returning a hand-off you cannot back.

package/.agents/audit-checklists/architecture.md

@@ -6,7 +6,7 @@
 
 # Architecture & Clean Code Audit — authoring checklist
 
-> Audit architectural boundaries, module coupling, and layering violations; emit a structured findings report keyed to High/Medium/Low severity.
+> Audit architectural boundaries, module coupling, layering violations, and shipped-but-uncalled seams; emit a structured findings report keyed to the canonical severity scale.
 
 Self-check your change against this lens's concerns before you ship:
 
@@ -21,3 +21,7 @@ Self-check your change against this lens's concerns before you ship:
 - [ ] Medium
 - [ ] Low
 - [ ] Automated Architecture Guardrails
+- [ ] Shipped-But-Never-Wired Seams (mandatory).
+- [ ] A produced-but-never-consumed artifact.
+- [ ] An optional field nothing populates.
+- [ ] An exported seam with no in-tree caller

package/.agents/audit-checklists/baselines.md

@@ -0,0 +1,21 @@
+<!-- GENERATED FILE — do not edit by hand.
+     Source of truth: .agents/workflows/audit-baselines.md
+     Regenerate: node .agents/scripts/generate-lens-checklists.js
+     Drift is gated by: npm run docs:check
+-->
+
+# Baseline & Ratchet Audit — authoring checklist
+
+> Audit the committed baseline surface — dead instruments, stale baselines, cross-gate hotspot clusters, trend drift, and floor-tightening headroom — and emit findings whose remediation burns the measured debt down and tightens the ratchet behind it.
+
+Self-check your change against this lens's concerns before you ship:
+
+- [ ] `configError` non-null.
+- [ ] `degradations`.
+- [ ] Dead Instruments.
+- [ ] Staleness.
+- [ ] Hotspot Clusters.
+- [ ] Trend Drift.
+- [ ] Tightening Headroom.
+- [ ] Hotspot Cluster template
+- [ ] Tightening Headroom template

package/.agents/audit-checklists/quality.md

@@ -18,3 +18,6 @@ Self-check your change against this lens's concerns before you ship:
 - [ ] Test Data Management
 - [ ] Performance & Execution
 - [ ] Requirement Alignment
+- [ ] Unwired Seams — Coverage Without a Caller (mandatory).
+- [ ] A produced-but-never-consumed artifact
+- [ ] An optional field nothing populates

package/.agents/docs/agentrc-reference.json

@@ -100,7 +100,8 @@
       "watch": {
         "pollIntervalMs": 10000,
         "maxPolls": 180,
-        "maxResumes": 3
+        "maxResumes": 3,
+        "attachWindowMs": 1200000
       },
       "autoMerge": "trust-ci"
     },

package/.agents/docs/configuration.md

@@ -278,10 +278,11 @@ top-level keys are validation errors.
 | `acceptanceEval.maxRounds` | No | `integer` | — | Maximum number of redraft rounds before escalation. Default 2; clamped into [1, hard ceiling] by lib/config/acceptance-eval.js so the cap can never be disabled (maxRounds: 0 clamps up to 1). |
 | `acceptanceEval.clusterCeiling` | No | `integer` | — | Epic #4475 (M4-B). Max acceptance criteria one single-delivery acceptance critic scores in a single fresh-context pass. Single delivery clusters the Epic ## Acceptance Table ACs into ceil(totalACs / clusterCeiling) groups and spawns one maker-blind critic per cluster, restoring the distributed acceptance coverage the per-Story critic fan-out gave for free. Default 4; clamped into [1, 8] by lib/config/acceptance-eval.js so a large value cannot collapse the fan-out to a single diluted critic. Ignored on the fan-out route. |
 | `ci` | No | `object` | — | Nested configuration block. |
-| `ci.watch` | No | `object` | — | Story #4356 (Epic #4355). Poll-loop tuning for the merge/CI watch. pollIntervalMs is the cadence between check probes; maxPolls caps total probes before the watcher gives up; maxResumes caps how many times the watcher may resume after a transient stall. |
+| `ci.watch` | No | `object` | — | Story #4356 (Epic #4355). Poll-loop tuning for the merge/CI watch. pollIntervalMs is the cadence between check probes; maxPolls caps total probes before the watcher gives up; maxResumes caps how many times the watcher may resume after a transient stall; attachWindowMs bounds the wait for a required context to attach at all. |
 | `ci.watch.pollIntervalMs` | No | `integer` | — | — |
 | `ci.watch.maxPolls` | No | `integer` | — | — |
 | `ci.watch.maxResumes` | No | `integer` | — | — |
+| `ci.watch.attachWindowMs` | No | `integer` | — | Story #4890. How long (ms) the watch keeps re-resolving an EMPTY `gh pr checks --required` set before it stops waiting for a required context to attach. A ruleset attaches its contexts asynchronously and the arrival latency is set by the slowest one, so a required context that is an aggregator job gated on every other tier is the last to appear — measured at 16m52s on this repository. Default 1200000 (20 minutes). Raise it for a repository whose contexts arrive later still; exhausting the window is never reported as a red check (the watch exits 2, not-yet-started). |
 | `ci.autoMerge` | No | `"trust-ci"` \| `"strict"` | — | Story #4356 (Epic #4355). Merge posture. 'trust-ci' (default) merges once required checks pass; 'strict' additionally requires a clean review gate. |
 | `routing` | No | `object` | — | v2 delivery-spawn routing: role-scoped boot contexts and maker-checker sampling. The v1 singleDelivery epic-route kill-switch was removed in Stage 6. |
 | `routing.roleScopedAgents` | No | `boolean` | — | Epic #4478 (M7-B). Kill-switch for the role-scoped boot contexts. When true (default), a converted delivery spawn (`story-worker`, `acceptance-critic`) boots on its own `.claude/agents/<role>.md` system prompt instead of re-paying the full CLAUDE.md @-import closure (≈50KB → ≈8KB per spawn — the payoff of the context diet). When false, every converted spawn falls back to `subagent_type: general-purpose` — the instant, code-rollback-free per-consumer revert, and the universal escape for hosts that ignore `.claude/agents/`. The fallback is the full-closure agent that ran before M7-B, so flipping it off never drops a gate. |

package/.agents/docs/quality-gates.md

@@ -102,13 +102,18 @@ npm run coverage:update # writes baselines/coverage.json from the run
 runners that orchestrate coverage capture separately).
 
 The files-out-of-scope list is declared in [`.c8rc.cjs`](../../.c8rc.cjs) —
-thin CLI shells (e.g. `agents-bootstrap-github.js`, `plan-context.js`,
-`plan-persist.js`) plus the larger Story #1702 carve-out of
-top-level/orchestration/git CLIs and `lib/*` glue, each with a per-entry
-rationale in the `.c8rc.cjs` header comment (the authoritative list). Every
-excluded file also carries `/* node:coverage ignore file */` at the top of its
-source as a second line of defence; the header comment MUST be updated when the
-list changes.
+thin CLI shells plus the larger Story #1702 carve-out of
+top-level/orchestration/git CLIs and `lib/*` glue. The `exclude[]` array is
+the **single** declaration: each entry carries its rationale as an inline
+comment on the line above it. Story #4922 removed the prose inventory the
+header used to duplicate — two copies of one list in one file, 27 files
+apart by the time it was measured. Do not reintroduce one. Every excluded
+file also carries `/* node:coverage ignore file */` at the top of its source
+as a second line of defence.
+
+`.c8rc.cjs`'s `include` globs and `delivery.quality.gates.coverage.targetDirs`
+in [`.agentrc.json`](../../.agentrc.json) MUST name the same roots — the gate
+scores what c8 measures. `tests/c8rc-scope.test.js` asserts both invariants.
 
 ---
 
@@ -123,11 +128,30 @@ touched it:
 
 | Metric | Floor | Scope |
 | --- | --- | --- |
-| Coverage — lines | ≥ 90 % | per file |
-| Coverage — branches | ≥ 85 % | per file |
-| Coverage — functions | ≥ 90 % | per file |
-| Maintainability Index | ≥ 70 | per file |
-| CRAP | ≤ 20 | per method |
+| Coverage — lines | ≥ 94 % | repo rollup |
+| Coverage — branches | ≥ 85 % | repo rollup |
+| Coverage — functions | ≥ 87 % | repo rollup |
+| Maintainability Index | ≥ 70 | repo rollup |
+| CRAP — methods above 20 | ≤ 13 | repo rollup |
+
+Floors are enforced against the baseline's `rollup` components — the
+`applyFloors` phase compares `rollup["*"]` (and any named component), never
+individual rows. Story #4922 corrected this table, which previously read
+"per file" and quoted 90/85/90 for coverage; those numbers came from the
+example in `.agents/docs/agentrc-reference.json`, which is validated only
+against itself, and the coverage gate was not configured at all.
+
+The live coverage floors are derived from the measurement in
+[`baselines/coverage.json`](../../baselines/coverage.json) — a full-tier run
+scored 95.65 / 86.16 / 88.52, and each floor sits ~1–1.7 points under its
+axis. Re-derive them, do not invent them, whenever the baseline is
+regenerated wholesale.
+
+The coverage gate deliberately declares **no `tolerance`**, so its
+head-vs-base ratchet arm reports regressions without failing the build (the
+same shape the `crap` gate uses). Story #4922's scope was making the
+instrument honest; arming the ratchet belongs with the debt burn-down that
+the widened measurement newly exposes.
 
 The floors are declared in [`.agentrc.json`](../../.agentrc.json) under
 `delivery.quality.gates.<gate>.floors.*` (defaults baked into the helper
@@ -173,11 +197,11 @@ The floor gate is only as strict as its scope, so the `exclude` list in
 [`.c8rc.cjs`](../../.c8rc.cjs) carries three hard requirements that are
 enforced by review (and partially by the audit suite):
 
-1. **One-line rationale per entry.** Every file in `exclude[]` MUST have
-   a bulleted justification in the `.c8rc.cjs` header comment naming
-   *why* it is excluded — typically "thin CLI shell, meaningful logic
-   lives in `lib/<X>` and is unit-tested there." A bare path with no
-   rationale is a review-block.
+1. **One-line rationale per entry.** Every file in `exclude[]` MUST carry
+   an inline comment on the line(s) directly above it naming *why* it is
+   excluded — typically "thin CLI shell, meaningful logic lives in
+   `lib/<X>` and is unit-tested there." A bare path with no rationale is a
+   review-block, and `tests/c8rc-scope.test.js` fails on one.
 2. **`/* node:coverage ignore file */` pragma at source.** Every
    excluded file MUST carry the Node coverage pragma at the top of its
    own source. This is the second line of defence: when `c8 report` and
@@ -260,6 +284,42 @@ default and the deep-merge extender form).
 
 ---
 
+## Cyclomatic ceiling ratchet
+
+`delivery.quality.codingGuardrails.cyclomaticMustFix` (default `12`) is the
+per-function complexity ceiling, enforced by `check-cyclomatic.js`. It is a
+**standalone ratchet** — the same slot as `check-arch-cycles.js`,
+`check-dead-exports.js`, and `check-context-budget.js` — not a
+`delivery.quality.gates` kind, so it needs no gate block and no floor.
+
+```bash
+node .agents/scripts/check-cyclomatic.js            # the gate
+node .agents/scripts/check-cyclomatic.js --update   # re-record the breaches
+```
+
+`baselines/cyclomatic.json` records, per file, how many functions currently
+sit above the ceiling and how bad the worst one is. The gate fails when a
+file's over-ceiling count rises (including `0 → 1`, a brand-new breach) or
+when its worst function gets worse than recorded. Shrinking and disappearing
+are the success signals and never fail.
+
+Recording existing breaches is what makes the ceiling adoptable: a repository
+with dozens of over-ceiling functions can turn the gate on today and burn them
+down on its own schedule, instead of disabling a gate that fails on the first
+commit. Re-run `--update` after a deliberate refactor; that is the only motion
+allowed to raise a recorded count, and it shows up in review as a baseline
+diff.
+
+The scan reuses `delivery.quality.gates.maintainability.targetDirs` /
+`ignoreGlobs` — both instruments read the same coverage-free escomplex
+surface, so a separate scope declaration could only ever restate it.
+
+`cyclomaticFlag` (default `8`) is the softer half of the pair: it is not
+gated, and names the ceiling `quality:preview` counts new methods against in
+its `new-method count over c=<flag>` column.
+
+---
+
 ## CRAP gate — Consumer onboarding
 
 > Baseline envelope, axes, and component model: see the
@@ -436,7 +496,9 @@ are not comparable to rows scored by this one, and neither `kernelVersion` nor
 therefore carries a `scoringSemantics` stamp; `check-baselines` fails closed on
 a mismatch with the exact re-baseline command rather than comparing across the
 boundary. Bump the stamp whenever the coverage join, the line coordinate
-system, or the unresolved-method policy changes.
+system, the unresolved-method policy, or the method identity rule changes —
+Story #4969 bumped it for the last of these, replacing escomplex's positional
+`<anon method-N>` label with an enclosing-scope-path identity.
 
 ---
 

package/.agents/docs/workflows.md

@@ -32,12 +32,13 @@ by `node .agents/scripts/generate-workflows-doc.js`; `npm run docs:check`
 fails when it drifts from the on-disk workflow set. To change a command’s
 description, edit the workflow file’s front-matter and regenerate.
 
-## Commands (25)
+## Commands (27)
 
 | Command | Description |
 | --- | --- |
 | `/audit-accessibility` | Audit WCAG accessibility conformance (static-first) with an optional runtime verification pass, and produce a structured findings report |
-| `/audit-architecture` | Audit architectural boundaries, module coupling, and layering violations; emit a structured findings report keyed to High/Medium/Low severity. |
+| `/audit-architecture` | Audit architectural boundaries, module coupling, layering violations, and shipped-but-uncalled seams; emit a structured findings report keyed to the canonical severity scale. |
+| `/audit-baselines` | Audit the committed baseline surface — dead instruments, stale baselines, cross-gate hotspot clusters, trend drift, and floor-tightening headroom — and emit findings whose remediation burns the measured debt down and tightens the ratchet behind it. |
 | `/audit-clean-code` | Audit code smells, dead code, complexity hotspots, and maintainability-index outliers; emit a structured findings report. |
 | `/audit-data-model` | Audit the persistence layer as a first-class artifact — model↔migration↔seed drift, constraint completeness, migration hygiene, type fidelity, and access-pattern fit; gated by a persistence-layer applicability probe so DB-less repos skip cleanly. |
 | `/audit-dependencies` | Audit `package.json` for unused, outdated, and major-version-stale dependencies; surface Node-engine drift and propose upgrade batches. |
@@ -56,6 +57,7 @@ description, edit the workflow file’s front-matter and regenerate.
 | `/git-cleanup` | Tidy the local checkout in four phases: fast-forward `main`, prune stale remote-tracking refs, sweep merged branches (squash-aware), and triage `git stash` entries — each step gated by operator confirmation. |
 | `/git-deliver` | Single ad-hoc delivery command for working-tree changes. Detects the git setup and escalates to the right terminal step — commit only, commit + push, or commit + push + open a PR with native auto-merge — picking the default from observable state and letting flags pin any level explicitly. Replaces the retired git-commit-all, git-push, and git-pr-all trio. |
 | `/mandrel-update` | npm-era upgrade wraparound for a Mandrel consumer. Runs `npx mandrel update` (resolve newest published version → install → re-materialize `.agents/` → migrate → doctor → surface changelog) as the single mechanical step, then walks the operator through the judgment wraparound the CLI deliberately leaves unowned: reconcile `.agentrc.json`, install the stabilized quality-gate surface, refresh the harness permission allowlist, reconcile the consumer's `AGENTS.md` / runbooks against the surfaced changelog, and stage + commit the staged lockfile bump. |
+| `/memory-consolidate` | Attended consolidation pass over this project's agent memory pool — merge duplicates, verify claims against the current tree, prune with operator confirmation, rewrite the index, and stamp the pool so the /plan advisory goes quiet. |
 | `/plan` | Unified planning entry point. Interrogate → author → persist. Emits one Story by default; splits into N>1 only under the default-single split policy. |
 | `/prototype` | Operator-invoked UI prototype pass. Discovers the consumer's design-system SSOT first, then — only after the operator confirms — writes exactly one self-contained HTML file under the gitignored workspace-root temp tree, so a layout can be reviewed before its UI acceptance criteria are authored. |
 | `/qa-assist` | Human-led QA assist loop — set up, then ride a rolling multi-observation intake session. The operator reports observations in any order; the agent enriches each (repro + root-cause file:line + coverage verdict for bugs; analysis + options + recommendation for enhancements), asks clarifying questions only when ambiguous, and appends a redacted ledger item — recording, never planning — to a persistent, resumable session under temp/qa/. Only when the operator says they are done does it review the full ledger and hand off to /plan. |

package/.agents/instructions.md

@@ -79,7 +79,7 @@ present, else the **Tech Stack** section of `docs/architecture.md`.
 
 You MUST log operational friction (repeated tool errors, unrecoverable
 command failures, self-corrected ambiguity, automatable boilerplate):
-`node .agents/scripts/diagnose-friction.js --story [STORY_ID] --cmd [FAILED_COMMAND]`
+`node .agents/scripts/diagnose-friction.js --story [STORY_ID] --cmd <cmd> <args...>`
 — a **local NDJSON signal** (not posted to the ticket). Schema and the
 `AGENT_LOG_LEVEL` table:
 [`docs/execution-reference.md`](docs/execution-reference.md#friction-telemetry).