mandrel 2.41.0 → 2.43.0

package/.agents/scripts/lib/orchestration/verify-credit.js

@@ -0,0 +1,207 @@
+/**
+ * verify-credit.js — decide whether a Story `verify[]` entry has already been
+ * paid for by the delivery's single credited full-suite run (Story #5174).
+ *
+ * A Story's `verify[]` is meant to be *scoped* entries plus the one credited
+ * full-suite run the worker makes just before the hand-off push
+ * (`helpers/deliver-digest.md` § 5). When a `verify[]` entry is itself a
+ * full-suite command, running it spends a second whole-suite spawn for a
+ * result the credited run already established — and the close gate chain then
+ * makes a third. This module is the read side of that credit: given the
+ * entry's command it consults **the same stamp close consults** and reports
+ * the entry as credited instead of telling the caller to spawn it.
+ *
+ * It only ever *reads*. Nothing here writes a capture stamp or an evidence
+ * record — an entry that is not covered by a fresh stamp is reported
+ * `spawn: true` and runs for real, so the credit can never manufacture a pass.
+ *
+ * @see .agents/scripts/lib/coverage-capture.js (`isCoverageFresh`)
+ * @see .agents/scripts/lib/validation-evidence.js (`shouldSkip`)
+ */
+
+import { getQuality, resolveConfig } from '../config-resolver.js';
+import { isCoverageFresh } from '../coverage-capture.js';
+import { gitSpawn } from '../git-utils.js';
+import { hasNpmScript, readPackageScripts } from '../npm-scripts.js';
+import { hashCommandConfig, shouldSkip } from '../validation-evidence.js';
+
+/**
+ * The shape a `verify[]` array is supposed to have, stated once so the
+ * warning a caller surfaces and the prose in `deliver-digest.md` § 5 say the
+ * same thing.
+ * @type {string}
+ */
+export const FULL_SUITE_SHAPE_WARNING =
+  'verify[] should be scoped entries plus the single credited full-suite run ' +
+  '(deliver-digest.md § 5) — a full-suite command listed in verify[] is ' +
+  'reported credited against that run, never respawned.';
+
+/** Package managers whose `test` script means "the whole suite". */
+const PACKAGE_MANAGERS = new Set(['npm', 'pnpm', 'yarn', 'bun']);
+
+/** Script names that mean "the whole suite" rather than a scoped subset. */
+const FULL_SUITE_SCRIPTS = new Set(['test', 'test:coverage']);
+
+/**
+ * Split a Story `verify[]` line into its command and its tier tag.
+ *
+ * Story bodies write entries as `` `<command>` (<tier>) `` — the tier is
+ * planning metadata, not part of the command, and leaving it attached would
+ * make every entry look scoped.
+ *
+ * @param {string} entry
+ * @returns {{ command: string, tier: string|null }}
+ */
+export function parseVerifyEntry(entry) {
+  const text = String(entry ?? '').trim();
+  const tagged = /^(.*?)\s*\(([a-z-]+)\)$/i.exec(text);
+  const command = (tagged ? tagged[1] : text).trim().replace(/^`|`$/g, '');
+  return { command: command.trim(), tier: tagged ? tagged[2] : null };
+}
+
+/**
+ * Is this command a whole-suite run?
+ *
+ * Deliberately narrow. A false positive here would report a *scoped* command
+ * as credited without ever running it, which is how a gate stops gating — so
+ * anything carrying its own positional argument (`npm test -- tests/x.js`,
+ * `node --test tests/x.js`) is scoped by construction.
+ *
+ * @param {string} command
+ * @returns {boolean}
+ */
+export function isFullSuiteCommand(command) {
+  const tokens = String(command ?? '')
+    .trim()
+    .split(/\s+/)
+    .filter(Boolean);
+  if (tokens.length === 0) return false;
+
+  if (tokens[0] === 'node') {
+    // `node --test` with no path argument walks the default test globs.
+    const rest = tokens.slice(1);
+    return rest.length > 0 && rest.every((t) => t.startsWith('-'));
+  }
+
+  if (!PACKAGE_MANAGERS.has(tokens[0])) return false;
+  const rest = tokens[1] === 'run' ? tokens.slice(2) : tokens.slice(1);
+  if (rest.length === 0 || !FULL_SUITE_SCRIPTS.has(rest[0])) return false;
+  // `npm test -- <path>` narrows the run; only a bare invocation is the suite.
+  return rest.length === 1;
+}
+
+/**
+ * Read HEAD from a worktree. `null` when the tree cannot be read — which
+ * routes to `spawn`, never to a credit.
+ *
+ * @param {string} cwd
+ * @param {Function} gitSpawnFn
+ * @returns {string|null}
+ */
+function readHeadSha(cwd, gitSpawnFn) {
+  const res = gitSpawnFn(cwd, 'rev-parse', 'HEAD');
+  if (res?.status !== 0) return null;
+  const sha = String(res.stdout ?? '').trim();
+  return sha.length > 0 ? sha : null;
+}
+
+/**
+ * Decide how a single `verify[]` entry should be executed.
+ *
+ * @param {object} input
+ * @param {string} input.command — the entry's command (tier tag already off).
+ * @param {number|string} input.storyId
+ * @param {string} input.worktree — ABSOLUTE path to the Story worktree.
+ * @param {string} [input.cwd] — main checkout (evidence keyspace root).
+ *   Defaults to `worktree`.
+ * @param {object} [deps] — test seams; every one defaults to the real impl.
+ * @returns {{
+ *   command: string, fullSuite: boolean, credited: boolean, spawn: boolean,
+ *   mode: 'capture'|'evidence'|null, reason: string, warning: string|null
+ * }}
+ */
+export function resolveVerifyCredit(
+  { command, storyId, worktree, cwd = worktree },
+  deps = {},
+) {
+  const {
+    resolveConfigImpl = resolveConfig,
+    getQualityImpl = getQuality,
+    readPackageScriptsImpl = readPackageScripts,
+    hasNpmScriptImpl = hasNpmScript,
+    isCoverageFreshImpl = isCoverageFresh,
+    shouldSkipImpl = shouldSkip,
+    hashCommandConfigImpl = hashCommandConfig,
+    gitSpawnFn = gitSpawn,
+  } = deps;
+
+  const base = { command, fullSuite: false, mode: null, warning: null };
+  if (!isFullSuiteCommand(command)) {
+    return { ...base, credited: false, spawn: true, reason: 'scoped' };
+  }
+
+  const scoped = {
+    ...base,
+    fullSuite: true,
+    warning: FULL_SUITE_SHAPE_WARNING,
+  };
+  const { crap } = getQualityImpl(resolveConfigImpl({ cwd: worktree }));
+  const mode =
+    crap?.enabled !== false &&
+    hasNpmScriptImpl(readPackageScriptsImpl(worktree), 'test:coverage')
+      ? 'capture'
+      : 'evidence';
+
+  if (mode === 'capture') {
+    const freshness = isCoverageFreshImpl({
+      coveragePath: crap.coveragePath,
+      targetDirs: crap.targetDirs,
+      cwd: worktree,
+    });
+    const fresh = freshness?.fresh === true;
+    return {
+      ...scoped,
+      mode,
+      credited: fresh,
+      spawn: !fresh,
+      reason: fresh ? 'capture-stamp-fresh' : (freshness?.reason ?? 'unknown'),
+    };
+  }
+
+  const headSha = readHeadSha(worktree, gitSpawnFn);
+  if (!headSha) {
+    return { ...scoped, mode, credited: false, spawn: true, reason: 'no-head' };
+  }
+  const [cmd, ...args] = command.split(/\s+/).filter(Boolean);
+  const verdict = shouldSkipImpl(
+    {
+      storyId,
+      gateName: 'test',
+      currentSha: headSha,
+      configHash: hashCommandConfigImpl({ cmd, args, cwd: worktree }),
+    },
+    { cwd, standalone: true },
+  );
+  return {
+    ...scoped,
+    mode,
+    credited: verdict.skip === true,
+    spawn: verdict.skip !== true,
+    reason: verdict.reason,
+  };
+}
+
+/**
+ * Classify a whole `verify[]` array in one pass.
+ *
+ * @param {string[]} entries — raw `verify[]` lines, tier tags included.
+ * @param {{ storyId: number|string, worktree: string, cwd?: string }} context
+ * @param {object} [deps]
+ * @returns {Array<ReturnType<typeof resolveVerifyCredit> & { tier: string|null }>}
+ */
+export function planVerifyExecution(entries, context, deps = {}) {
+  return (Array.isArray(entries) ? entries : []).map((entry) => {
+    const { command, tier } = parseVerifyEntry(entry);
+    return { ...resolveVerifyCredit({ ...context, command }, deps), tier };
+  });
+}

package/.agents/scripts/lib/single-story-sweep/sweep-lock.js

@@ -161,6 +161,30 @@ function readLockOwner(lockPath, fsImpl = fs) {
   }
 }
 
+/**
+ * Read the pid a lockfile was created by (its third line — see
+ * {@link tryCreateLock}'s body format). Returns `null` when the file is
+ * absent, unreadable, or its pid line is not a positive integer.
+ *
+ * Exists so a *waiting* caller can name the holder in its wait line: a bounded
+ * wait with no attribution is indistinguishable from a hang, and the pid is
+ * the one field an operator can act on (`ps`, `kill`). Reading it is
+ * advisory — a `null` just means the wait line says less.
+ *
+ * @param {string} lockPath
+ * @param {object} [fsImpl]
+ * @returns {number|null}
+ */
+export function readLockHolderPid(lockPath, fsImpl = fs) {
+  try {
+    const lines = String(fsImpl.readFileSync(lockPath, 'utf8')).split('\n');
+    const pid = Number.parseInt(lines[2] ?? '', 10);
+    return Number.isInteger(pid) && pid > 0 ? pid : null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Pure: do two identity tuples describe the same lockfile instance? A `null`
  * on either side is "not the same" — an absent file is never the file we

package/.agents/workflows/helpers/acceptance-self-eval.md

@@ -113,6 +113,18 @@ mid-delivery, and evaluates the actual work product.
      optional advisory pre-flight — a criterion cannot be scored `met` without
      the supporting `verify[]` evidence where a `verify[]` command is relevant
      to it.
+   - **Reuses the credited full-suite run instead of re-paying for it.**
+     Before spawning a `verify[]` entry, classify it with `resolveVerifyCredit`
+     from
+     [`verify-credit.js`](../../scripts/lib/orchestration/verify-credit.js): an
+     entry that is itself a full-suite command (`npm test`, `pnpm run test`,
+     a bare `node --test`) is consulted against the **same stamp close reads**
+     and, when that stamp is fresh, recorded as `pass` with a `detail` naming
+     the credit — **never respawned**. A stale or absent stamp reports
+     `spawn: true` and the command runs for real, so the credit can never
+     manufacture a pass. The gate warns on any such entry: the intended shape
+     is scoped `verify[]` entries **plus** the one credited run
+     ([`deliver-digest.md`](deliver-digest.md) § 5).
    - **Shares `lint` / `typecheck` evidence with close.** When a
      `verify[]` command is **byte-identical** to a close-validation gate — in
      practice only the cheap, command-identical `lint` and `typecheck` gates

package/.agents/workflows/helpers/deliver-digest.md

@@ -2,9 +2,9 @@
 description: >-
   The deliver path's one bundled framework read. Carries what
   every Story delivery always needs — dispatch decision, engine invariants,
-  the change-set/ceremony incantation, the acceptance-eval gate, and the
-  terminal envelope contract — so the engine reads one file instead of
-  re-reading the helper/schema set each session.
+  the change-set/ceremony incantation, the acceptance-eval gate, the credited
+  full-suite run, and the terminal envelope contract — so the engine reads one
+  file instead of re-reading the helper/schema set each session.
 ---
 
 # Deliver digest (read once per session)
@@ -27,10 +27,8 @@ rule produces it:
    whatever its shape — sub-agent isolation is load-bearing only against a
    *concurrent* sibling racing the same checkout, and a one-Story run has none.
 2. **Every other run is `subagent`.** A multi-Story run dispatches every Story
-   as a sub-agent however trivial its shape — a lite body does not conjure a
-   second session for a sibling, and the wave tick may hand you the whole set
-   on one beat. Shape still sets ceremony; the `route::lite` label is a
-   human-visible hint, never the control signal.
+   as a sub-agent however trivial its shape. Shape still sets ceremony; the
+   `route::lite` label is a human-visible hint, never the control signal.
 
 `inline` removes model-side fan-out only — no `story-worker` boot, no fresh
 acceptance-critic spawn. **`subagent` and `inline` run the same engine**: same
@@ -112,7 +110,30 @@ an unmerged cluster verdict scores a fraction of the criteria and still reports
 not close**: post a `friction` comment and flip `agent::blocked`.
 Per-round mechanics: [`acceptance-self-eval.md`](acceptance-self-eval.md).
 
-## 5. Terminal envelope — the return contract
+## 5. The one creditable full-suite run
+
+**After the self-eval loop's last fix commit, immediately before the push** —
+the credit is keyed on the tree, so any later commit invalidates it. Redraft
+rounds run scoped tests; only this final run needs credit, and a bare
+`npm test` / `pnpm run test` deposits **none**, so close re-runs the identical
+suite. Shape it by the predicate `close-validation/gates.js` uses for its test
+gate:
+
+```bash
+# CRAP gate on (default) + a `test:coverage` script — writes the stamp the
+# close `coverage-capture` gate reads:
+node <main-repo>/.agents/scripts/coverage-capture.js --cwd <workCwd>
+# otherwise — the record the close `test` gate reads. <workCwd> ABSOLUTE,
+# runner exactly `npm test`: both sides hash {cmd, args, cwd}.
+node <main-repo>/.agents/scripts/evidence-gate.js --standalone \
+  --scope-id <storyId> --gate test --worktree <workCwd> -- npm test
+```
+
+`verify[]` is scoped entries **plus** this one run: an entry that is itself a
+full-suite command is reported credited against the same stamp, never
+respawned.
+
+## 6. Terminal envelope — the return contract
 
 `single-story-close.js` emits exactly one envelope on stdout between
 `--- STORY DELIVER TERMINAL ---` markers, schema-validated against
@@ -129,7 +150,7 @@ Relay it verbatim; never hand-compose one, never substitute prose.
 
 Required fields: `kind` (`story-deliver-terminal`), `storyId`, `status`,
 `phase`, `elapsedSeconds`, `nextCommand`. `phase` is one of `init`,
-`wrong-tree-guard`, `close-validation`, `base-sync`, `push`, `pull-request`,
+`wrong-tree-guard`, `base-sync`, `close-validation`, `push`, `pull-request`,
 `code-review`, `auto-merge`, `confirm-merge`, `post-land`, `done`. `gates`
 reports every gate as `passed` / `failed` / `skipped` — a skipped gate is
 reported, never omitted, so a missing gate is never read as a passing one.
@@ -139,7 +160,7 @@ reported, never omitted, so a missing gate is never read as a passing one.
 success; a failed gate replays its tail inline. `AGENT_LOG_LEVEL=verbose`
 restores live streaming.
 
-## 6. When to leave this file
+## 7. When to leave this file
 
 - Unclear state / a re-run refusal → `deliver-recover.js --story <id>` (read-only).
 - Lease, sweep, worktree-scope detail → [`deliver-story-reference.md`](deliver-story-reference.md).

package/.agents/workflows/helpers/deliver-story-reference.md

@@ -233,17 +233,19 @@ runs maker-blind at Story-scope review inside the close subprocess. The
 dispatch step produces `checklistPath` from the Story's predicted footprint
 before it spawns the worker — see [`/mandrel-deliver`](../mandrel-deliver.md).
 
-**Pre-eval full-suite discipline (spine step 1.3).** Repo-invariant guards —
+**Full-suite discipline (spine Step 2.5).** Repo-invariant guards —
 drift-guard and schema tests living outside the Story's scoped greps — are
 the failure class that actually bounces deliveries: close-validation
 discovers them only after the whole close pipeline has run, at several times
-the cost of one pre-eval full-suite run.
+the cost of one full-suite run in the worktree.
 
-**Run it so close can credit it.** Close skips a gate that already passed at
-the current HEAD, but a bare `npm test` deposits no such record — the suite
-then runs twice per delivery, once here and once in the close gate chain.
-Pick the invocation by the same predicate `close-validation/gates.js` uses to
-choose its test gate:
+**Run it once, last, so close can credit it.** The run belongs **after** the
+self-eval loop's last fix commit and immediately **before** the hand-off push,
+so its stamp describes the tree that is pushed; redraft rounds run scoped
+tests. Close skips a gate that already passed at the current HEAD, but a bare
+`npm test` deposits no such record — the suite then runs twice per delivery,
+once here and once in the close gate chain. Pick the invocation by the same
+predicate `close-validation/gates.js` uses to choose its test gate:
 
 ```bash
 # CRAP gate enabled (default) + a `test:coverage` script — writes the stamp
@@ -259,7 +261,15 @@ node <main-repo>/.agents/scripts/evidence-gate.js --standalone \
 The credit expires the moment it stops describing the tree: evidence is keyed
 on HEAD, the capture stamp on a content digest of `crap.targetDirs`. A
 self-eval fix — or any commit — invalidates it and close re-runs the suite for
-real, so this never trades away the gate.
+real, so this never trades away the gate. That keying is exactly why the run
+comes last.
+
+**`verify[]` reuses the same stamp.** A `verify[]` entry that is itself a
+full-suite command is reported **credited** against that stamp rather than
+respawned (`resolveVerifyCredit` in
+[`verify-credit.js`](../../scripts/lib/orchestration/verify-credit.js)), and the
+self-eval gate warns when it sees one: the intended shape is scoped `verify[]`
+entries **plus** the single credited run.
 
 **Conflict with `main` mid-implementation** → resolve as you would any branch
 rebase. There is no `epic/<id>` intermediate, so the rebase base is `main`
@@ -500,22 +510,16 @@ judgment that help text cannot carry.
 
 The `single-story-close.js` script, in order:
 
-1. Runs the close-validation gates against `baseBranch` as the baseline.
-   On any gate failure it throws — the operator fixes and re-runs close.
-   **Gate output is captured, not streamed.** Every gate line
-   goes to `temp/orchestration/close-gates-<storyId>.log`; a clean run reports
-   one digest line naming that artifact, and a **failed** gate replays its
-   captured tail inline so the evidence is in front of you without opening a
-   file. Read the artifact when you need the full text — or re-run under
-   `AGENT_LOG_LEVEL=verbose` for live streaming.
-   1a. **Syncs the Story branch from `origin/<baseBranch>`** before push.
-   Runs `git fetch origin <baseBranch>` followed by
-   `git merge --no-edit origin/<baseBranch>` inside the worktree. This
+1. **Syncs the Story branch from `origin/<baseBranch>`** — before the gates,
+   not after them. Runs `git fetch origin <baseBranch>` followed
+   by `git merge --no-edit origin/<baseBranch>` inside the worktree. This
    defends against the parallel-`/deliver-story` race: when
    multiple sessions run in parallel, the Story that auto-merges first
    bumps `baseBranch`, and without this sync the lagging Stories open
    PRs that are "behind base" and stall against branch-protection's
-   `up-to-date branch` rule. Outcomes:
+   `up-to-date branch` rule. Running it first also means a conflict costs
+   no gate run at all, and — the load-bearing half — the tree the gates
+   validate is the tree the push sends. Outcomes:
    - **No-op / fast-forward / clean merge-commit** → close proceeds to
      push.
    - **Merge conflict** → the merge is aborted, a `friction` structured
@@ -533,12 +537,26 @@ The `single-story-close.js` script, in order:
    closes the PR-open-time race but a residual race remains between PR
    open and auto-merge fire.
 
-2. Pushes `story-<id>` to `origin`.
-3. Probes for an existing open PR with `head = story-<id>`. If none
+2. Runs the close-validation gates against `baseBranch` as the baseline.
+   On any gate failure it throws — the operator fixes and re-runs close.
+   The chain fails cheapest-first: `typecheck`, `lint`, `format` and the
+   coverage-independent half of the baselines gate
+   (`check-baselines-independent`) run in parallel, and only once they are
+   green does the serial walk pay for `coverage-capture` and the
+   coverage-consuming half (`check-baselines-coverage`).
+   **Gate output is captured, not streamed.** Every gate line
+   goes to `temp/orchestration/close-gates-<storyId>.log`; a clean run reports
+   one digest line naming that artifact, and a **failed** gate replays its
+   captured tail inline so the evidence is in front of you without opening a
+   file. Read the artifact when you need the full text — or re-run under
+   `AGENT_LOG_LEVEL=verbose` for live streaming.
+
+3. Pushes `story-<id>` to `origin`.
+4. Probes for an existing open PR with `head = story-<id>`. If none
    exists, opens one via `gh pr create --base <baseBranch>`. The PR
    body carries `Closes #<storyId>` so the GitHub merge auto-closes the
    issue.
-   3a. **Enables GitHub native auto-merge by default** via
+   4a. **Enables GitHub native auto-merge by default** via
    `gh pr merge <prNumber> --auto --squash --delete-branch`. Once CI's
    required checks turn green, GitHub squash-merges the PR and deletes
    the source branch — the operator does not need to babysit the merge
@@ -546,7 +564,7 @@ The `single-story-close.js` script, in order:
    non-fatal: the operator retains the manual merge surface in the
    GitHub UI. Pass `--no-auto-merge` to opt out when the PR needs a
    pre-merge eyeball.
-4. Flips the Story to **`agent::closing`** (NOT `agent::done`) and leaves
+5. Flips the Story to **`agent::closing`** (NOT `agent::done`) and leaves
    the GitHub issue **OPEN**. Auto-merge completes
    asynchronously _after_ this script exits, so closing the issue here
    would strand a CLOSED issue with no merged work if the PR later failed
@@ -557,9 +575,9 @@ The `single-story-close.js` script, in order:
    `--no-wait-merge` run, or the in-close confirm phase on the
    close-and-land default. (Step 5.5 is the Status-column resync.) A Story
    only reaches `agent::done` once its PR to `main` is confirmed merged.
-5. Reaps the worktree when `delivery.worktreeIsolation.reapOnSuccess`
+6. Reaps the worktree when `delivery.worktreeIsolation.reapOnSuccess`
    is enabled.
-6. **Releases the Story lease.** Clears the Story assignment
+7. **Releases the Story lease.** Clears the Story assignment
    that init claimed so the next `/deliver-story` run sees an
    unclaimed ticket. The release is a no-op when the operator no longer
    holds the claim (a later run took over via reclaim/steal), so a late
@@ -572,13 +590,15 @@ The `single-story-close.js` script, in order:
    de-assigning the ticket. The close result carries
    `leaseReleased: <boolean>`.
 
-`--skip-validation` bypasses Step 1 (gates). Use only when re-running
+`--skip-validation` bypasses the gate step. Use only when re-running
 close after a fixed gate failure that's already known to pass.
 
-`--skip-sync` bypasses Step 1a (base-sync). Use only when re-running
-close after a hand-resolved sync, or in tests.
+`--skip-sync` bypasses the base-sync step. Use only when re-running
+close after a hand-resolved sync, or in tests. The two flags are
+independent: either, both or neither may be set, and each elides exactly
+its own phase.
 
-`--no-auto-merge` disables Step 3a. Use when the PR materially changes
+`--no-auto-merge` disables the auto-merge arm (step 4a). Use when the PR materially changes
 behaviour and warrants pre-merge review.
 
 ---

package/.agents/workflows/helpers/deliver-story.md

@@ -40,7 +40,7 @@ that dispatched the work**, never to a spawned worker.
 
 **A worker returning no terminal envelope is expected, not a failure** — only
 Step 3 mints one. Never re-dispatch the Story on it; resume per § Recovery
-(reference § Idempotence and the standing constraints).
+(reference § Idempotence).
 
 ## Step 0 — Initialize (`single-story-init.js`)
 
@@ -73,12 +73,8 @@ One branch, one PR to `main`, commits against the inline `acceptance[]` /
    digest-first; read a caller-provided `checklistPath` first, and walk any
    `## Slicing` rows as **intra-session checkpoints** (reference § Step 1).
 2. Implement and commit on the Story branch, iterating with quick advisory
-   gates (`typecheck`, `lint`, scoped tests) — the full chain runs in Step 3.
-3. Run the full suite once in the worktree **before Step 1a**: repo-invariant
-   guards outside the Story's scoped greps are the failure class that bounces
-   deliveries. Fix and commit first, then run the self-eval loop. Run it **so
-   Step 3 credits it** — a bare `npm test` records nothing, so close re-runs
-   the identical suite (reference § Step 1, "Pre-eval full-suite discipline").
+   gates (`typecheck`, `lint`, scoped tests) — the full chain runs in Step 3,
+   and the **one** creditable full-suite run at Step 2.5.
 
 ### Step 1a — Bounded acceptance self-eval loop (**required**)
 
@@ -94,14 +90,21 @@ Ceremony is `delivery.routing.ceremonyProfile` × the **derived change level**,
 never a planner-authored verdict. **Digest § 3** is the incantation (change set
 once, derive the level, resolve critics with `ceremony-routing.js`); edge cases
 are reference § Step 2. Hard gates always run in Step 3 — the derived level
-never disables them; do **not** pre-run the chain here.
+never disables them; do **not** pre-run the chain here — Step 2.5's credited
+suite run is the sole exception.
 
-### Step 2.5 — Push and hand off (sub-agent dispatch only)
+### Step 2.5 — The creditable full-suite run, then push and hand off
 
-Push `story-<storyId>` to `origin` and confirm the remote ref moved. Return the
-hand-off — Story id, `workCwd`, branch, pushed head SHA, self-eval verdict,
-`verify[]` evidence — then stop. Do not open the PR; do not compose a terminal
-envelope. An inline run skips this.
+Run the full suite **once**, after the self-eval loop's last fix commit and
+immediately **before** the push, in the shape close credits (**digest § 5**):
+the credit is keyed on the tree, so any later commit invalidates it, and a bare
+`npm test` deposits none. Red → fix, commit, re-run. An inline run makes the
+same run before Step 3.
+
+Then (sub-agent dispatch only) push `story-<storyId>` to `origin`, confirm the
+remote ref moved, and return the hand-off — Story id, `workCwd`, branch, pushed
+head SHA, self-eval verdict, `verify[]` evidence — then stop. Do not open the
+PR; do not compose a terminal envelope.
 
 ## Step 3 — Close and land (`single-story-close.js`)
 
@@ -115,7 +118,7 @@ node <main-repo>/.agents/scripts/single-story-close.js --story <storyId> --cwd <
 **The whole delivery tail** — gates, PR, merge wait, `agent::done` flip,
 post-land tail in one process. Never background it, never delegate it to a
 child, and never end your turn while it is still running: "close is running"
-is not a return value. Branch on the envelope's `status` per **digest § 5**
+is not a return value. Branch on the envelope's `status` per **digest § 6**
 (`landed` → Step 7; `pending` → run `nextCommand`; `blocked`/`checks-failed`
 → Step 4; `failed` → diagnose, re-run). Gate output is captured.
 
@@ -126,7 +129,7 @@ Internals, merge-wait budgets, the slow-CI **async** confirm mode, the
 
 Relay the validated envelope close emits between its
 `--- STORY DELIVER TERMINAL ---` markers — never free-form prose, never a
-hand-composed object. Statuses, exits and fields: **digest § 5** (SSOT: the
+hand-composed object. Statuses, exits and fields: **digest § 6** (SSOT: the
 shipped [schema](../../schemas/story-deliver-terminal.schema.json)).
 `pending` is the only sanctioned no-merge ending.
 
@@ -139,15 +142,14 @@ so only a green on a NEW head SHA re-arms it — a re-run is refused; fix at sou
 and push ([`rules/ci-remediation.md`](../../rules/ci-remediation.md)). And a
 `tail.*: false` degrades the report, never the land.
 
-**Watch exit codes** — `pr-watch-with-update.js` exits 0 green, 1 only when a
-required check genuinely failed (or the PR is unreadable), 2 slow-but-not-red:
-still-running, unresolved, **or** `notYetStarted` — no required context attached
-inside `attachWindowMs`. Never route a 2 onto the red path; nothing is broken
-and no digest exists to read.
+**Watch exit codes** — `pr-watch-with-update.js` exits 0 green, 1 on a genuine
+red, 2 slow-but-not-red (still-running, unresolved, or `notYetStarted`). Never
+route a 2 onto the red path: nothing is broken and no digest exists to read.
+Which slow condition, and what to do: reference § Step 4.
 
 **Lost envelope first: read it off disk.** Close persists each to
 `temp/orchestration/story-deliver-terminal-<storyId>.json`; branch on it per
-digest § 5. Otherwise do not guess — probe **read-only** with
+digest § 6. Otherwise do not guess — probe **read-only** with
 `node .agents/scripts/deliver-recover.js --story <storyId>`; it prints the
 **one** next command with its evidence, never a menu. A live close answers
 `close-in-flight`: wait, never re-init underneath it.

package/.agents/workflows/memory-consolidate.md

@@ -2,8 +2,8 @@
 description: >-
   Attended consolidation pass over this project's agent memory pool — merge
   duplicates, verify claims against the current tree, prune with operator
-  confirmation, rewrite the index, and stamp the pool so the /mandrel-plan advisory
-  goes quiet.
+  confirmation, rewrite the index, and stamp the pool with the date and entry
+  count the /mandrel-plan advisory measures its next nudge against.
 ---
 
 # /memory-consolidate [--dry-run]
@@ -93,14 +93,26 @@ pointers only, never memory content.
 Then write the receipt to `.consolidation-stamp.json` in the pool root:
 
 ```json
-{ "lastConsolidatedAt": "<ISO-8601 timestamp>" }
+{ "lastConsolidatedAt": "<ISO-8601 timestamp>", "entryCount": 42 }
 ```
 
-The `/mandrel-plan` Phase 0 advisory reads this file; until it is written, the nudge
-keeps firing. Write it **only** after Gate #2 — the stamp asserts an operator
-reviewed the pass, so writing it early makes it a lie.
+`entryCount` is the surviving non-index `*.md` count **after** the rewrite —
+count the directory, never the plan. It is the baseline the next run measures
+growth against, so a wrong number silently mis-arms the nudge.
+
+The `/mandrel-plan` Phase 0 advisory re-arms on exactly two conditions: the
+stamp aging past `planning.memoryPool.staleAfterDays` (30), or
+`planning.memoryPool.growthDelta` (25) entries written since that count. Pool
+size alone never triggers it — a pass that keeps every entry still quiets the
+nudge. A stamp with no `entryCount` leaves growth unmeasured, and only the age
+arm can speak until the next pass writes one.
+
+Write it **only** after Gate #2 — the stamp asserts an operator reviewed the
+pass, so writing it early makes it a lie.
 
 Close with counts: entries read, corrected, merged, pruned, and the new total.
+Then the forecast the operator would otherwise derive by hand: when the
+advisory next fires, and which arm reaches it first.
 
 ## Constraints
 

package/docs/CHANGELOG.md

@@ -15,6 +15,31 @@ All notable changes to this project will be documented in this file.
 -->
 <!-- markdownlint-disable-file MD004 MD012 MD037 -->
 
+## [2.43.0](https://github.com/dsj1984/mandrel/compare/mandrel-v2.42.0...mandrel-v2.43.0) (2026-09-07)
+
+
+### Added
+
+* memory-pool advisory measures growth since the last consolidation instead of an absolute entry ceiling ([#5182](https://github.com/dsj1984/mandrel/issues/5182)) ([#5183](https://github.com/dsj1984/mandrel/issues/5183)) ([cccdd69](https://github.com/dsj1984/mandrel/commit/cccdd69546e5dfb4c6d1e205423ff52f07982ade))
+
+## [2.42.0](https://github.com/dsj1984/mandrel/compare/mandrel-v2.41.0...mandrel-v2.42.0) (2026-09-06)
+
+
+### Added
+
+* full-suite capture economy: default the coverage-independent skip on, and serialize concurrent captures behind a host lock ([#5173](https://github.com/dsj1984/mandrel/issues/5173)) ([#5178](https://github.com/dsj1984/mandrel/issues/5178)) ([ed79751](https://github.com/dsj1984/mandrel/commit/ed7975199b6e2a3279a5d0d02b50e3068509987f))
+* story-worker digest carries the creditable full-suite invocation, runs it after self-eval, and the critic reuses its stamp ([#5174](https://github.com/dsj1984/mandrel/issues/5174)) ([#5175](https://github.com/dsj1984/mandrel/issues/5175)) ([1e46457](https://github.com/dsj1984/mandrel/commit/1e464574aa6305dcc8f1ff8522015ae0f9a5301a))
+
+
+### Fixed
+
+* scope the baseline refresh acknowledgment to the rows the refresh commit actually refreshed ([#5179](https://github.com/dsj1984/mandrel/issues/5179)) ([#5180](https://github.com/dsj1984/mandrel/issues/5180)) ([e8758b9](https://github.com/dsj1984/mandrel/commit/e8758b909ec19ed55c0678c05f481d515937f978))
+
+
+### Changed
+
+* close fails fast: base-sync before validation, and coverage-independent baseline kinds in the parallel gate phase ([#5172](https://github.com/dsj1984/mandrel/issues/5172)) ([#5177](https://github.com/dsj1984/mandrel/issues/5177)) ([dff33d5](https://github.com/dsj1984/mandrel/commit/dff33d530965ef7da8ee3dd4f1f218d11805273f))
+
 ## [2.41.0](https://github.com/dsj1984/mandrel/compare/mandrel-v2.40.0...mandrel-v2.41.0) (2026-09-06)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mandrel",
-  "version": "2.41.0",
+  "version": "2.43.0",
   "description": "Claude Code-first opinionated workflow framework: instructions, skills, rules, and SDLC workflows that govern AI coding assistants.",
   "files": [
     ".agents/",