mandrel 2.55.0 → 2.57.0

package/.agents/scripts/test-isolate.js

@@ -24,198 +24,31 @@
  *
  * Output: human-readable text by default; pass `--json` for the raw
  * report envelope.
+ *
+ * **Shell only (Story #5316).** Nothing imports this file, so nothing here is
+ * reachable from a test — which is why every function it used to hold scored
+ * the CRAP formula's untested maximum. Argv parsing, report rendering,
+ * progress logging and the run orchestration now live under
+ * `lib/test-isolate/`, beside the `list-files` / `parse-tap` / `runner`
+ * modules that were always there. Keep this file a shell: anything with a
+ * branch in it belongs next door, where a test can reach it.
  */
 
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { runAsCli } from './lib/cli-utils.js';
-import { resolveTestFiles } from './lib/test-isolate/list-files.js';
-import { diagnoseIsolation } from './lib/test-isolate/runner.js';
+import { runTestIsolate } from './lib/test-isolate/run-isolate.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ROOT = path.resolve(__dirname, '..', '..');
 
-/**
- * @param {string[]} argv
- */
-export function parseIsolateArgv(argv) {
-  const options = {
-    pattern: undefined,
-    workers: undefined,
-    maxBisectDepth: 8,
-    maxBisectTargets: 5,
-    suiteConcurrency: 8,
-    json: false,
-    quiet: false,
-  };
-  for (let i = 0; i < argv.length; i += 1) {
-    const arg = argv[i];
-    if (arg === '--workers' && argv[i + 1]) {
-      options.workers = Number(argv[++i]);
-    } else if (arg === '--max-bisect-depth' && argv[i + 1]) {
-      options.maxBisectDepth = Number(argv[++i]);
-    } else if (arg === '--max-bisect-targets' && argv[i + 1]) {
-      options.maxBisectTargets = Number(argv[++i]);
-    } else if (arg === '--suite-concurrency' && argv[i + 1]) {
-      options.suiteConcurrency = Number(argv[++i]);
-    } else if (arg === '--json') {
-      options.json = true;
-    } else if (arg === '--quiet') {
-      options.quiet = true;
-    } else if (!arg.startsWith('--') && !options.pattern) {
-      options.pattern = arg;
-    }
-  }
-  return options;
-}
-
-/**
- * @param {import('./lib/test-isolate/runner.js').IsolateReport} report
- */
-export function renderReport(report) {
-  const lines = [];
-  lines.push('');
-  lines.push('=== test-isolate diagnostic report ===');
-  lines.push(`Files scanned:  ${report.files.length}`);
-  lines.push(`Wall duration:  ${(report.durationMs / 1000).toFixed(1)}s`);
-  lines.push('');
-
-  if (report.flippers.length === 0) {
-    lines.push('✓ No flippers detected — every file that passed alone');
-    lines.push('  also passed in the full suite run.');
-  } else {
-    lines.push(`✗ ${report.flippers.length} flipper(s) detected:`);
-    for (const f of report.flippers) {
-      lines.push(`  - ${f}`);
-    }
-    lines.push('');
-    if (report.bisections.length > 0) {
-      lines.push('Likely polluters (bisection suspects):');
-      for (const b of report.bisections) {
-        const tag = b.inconclusive ? ' [inconclusive]' : '';
-        lines.push(`  ${b.file}${tag}`);
-        for (const s of b.suspects) {
-          lines.push(`    ← ${s}`);
-        }
-      }
-    }
-  }
-
-  lines.push('');
-  if (report.envMutators.length === 0) {
-    lines.push('✓ No env-var leaks detected across isolated runs.');
-  } else {
-    lines.push(
-      `⚠ ${report.envMutators.length} file(s) left process.env mutated:`,
-    );
-    for (const m of report.envMutators) {
-      const parts = [];
-      if (m.envDiff.added.length > 0) {
-        parts.push(`added=[${m.envDiff.added.join(', ')}]`);
-      }
-      if (m.envDiff.removed.length > 0) {
-        parts.push(`removed=[${m.envDiff.removed.join(', ')}]`);
-      }
-      if (m.envDiff.changed.length > 0) {
-        parts.push(`changed=[${m.envDiff.changed.join(', ')}]`);
-      }
-      lines.push(`  ${m.file}`);
-      lines.push(`    ${parts.join(' ')}`);
-    }
-  }
-
-  lines.push('');
-  return lines.join('\n');
-}
-
-/**
- * Programmatic entry — wired up by the CLI and exported for tests.
- *
- * @param {object} [opts]
- * @param {string[]} [opts.argv]
- * @param {string} [opts.repoRoot]
- * @param {(line: string) => void} [opts.onLog]
- * @returns {Promise<{ exitCode: number, report: import('./lib/test-isolate/runner.js').IsolateReport }>}
- */
-export async function runTestIsolate({
-  argv = process.argv.slice(2),
-  repoRoot = ROOT,
-  onLog = (s) => process.stdout.write(`${s}\n`),
-} = {}) {
-  const options = parseIsolateArgv(argv);
-  const files = resolveTestFiles({
-    pattern: options.pattern,
-    repoRoot,
-  });
-  if (files.length === 0) {
-    onLog(
-      `[test-isolate] no test files matched pattern: ${options.pattern ?? '<default>'}`,
-    );
-    return { exitCode: 0, report: emptyReport() };
-  }
-
-  if (!options.quiet) {
-    onLog(`[test-isolate] scanning ${files.length} file(s)...`);
-  }
-  const report = await diagnoseIsolation({
-    repoRoot,
-    files,
-    workers: options.workers,
-    suiteConcurrency: options.suiteConcurrency,
-    maxBisectDepth: options.maxBisectDepth,
-    maxBisectTargets: options.maxBisectTargets,
-    onProgress: options.quiet
-      ? undefined
-      : (stage, payload) => {
-          if (stage === 'isolated:start') {
-            onLog(`[test-isolate] isolated phase: ${payload.count} file(s)`);
-          } else if (stage === 'isolated:done') {
-            onLog('[test-isolate] isolated phase: done');
-          } else if (stage === 'suite:start') {
-            onLog(`[test-isolate] suite phase: ${payload.count} file(s)`);
-          } else if (stage === 'suite:done') {
-            onLog('[test-isolate] suite phase: done');
-          } else if (stage === 'bisect:start') {
-            onLog(`[test-isolate] bisecting flipper: ${payload.target}`);
-          } else if (stage === 'bisect:done') {
-            const list = payload.suspects.slice(0, 3).join(', ');
-            const more =
-              payload.suspects.length > 3
-                ? ` (+${payload.suspects.length - 3} more)`
-                : '';
-            onLog(`[test-isolate]   suspects: ${list}${more}`);
-          }
-        },
-  });
-
-  if (options.json) {
-    onLog(JSON.stringify(report, null, 2));
-  } else {
-    onLog(renderReport(report));
-  }
-
-  const exitCode =
-    report.flippers.length === 0 && report.envMutators.length === 0 ? 0 : 1;
-  return { exitCode, report };
-}
-
-function emptyReport() {
-  return {
-    pattern: null,
-    files: [],
-    isolated: [],
-    suite: [],
-    flippers: [],
-    bisections: [],
-    envMutators: [],
-    durationMs: 0,
-  };
-}
-
 runAsCli(
   import.meta.url,
   async () => {
-    const { exitCode } = await runTestIsolate();
+    const { exitCode } = await runTestIsolate({
+      argv: process.argv.slice(2),
+      repoRoot: ROOT,
+    });
     if (exitCode !== 0) process.exit(exitCode);
   },
   { source: 'test-isolate' },

package/.agents/scripts/update-coverage-baseline.js

@@ -19,7 +19,10 @@
 
 import { createRequire } from 'node:module';
 import path from 'node:path';
-import { parseDiffScopeFlag } from './lib/baselines/diff-scope-cli.js';
+import {
+  buildCoverageUpdaterScorer,
+  resolveCoverageUpdaterScope,
+} from './lib/baselines/coverage-updater-cli.js';
 import { refreshBaseline } from './lib/baselines/refresh-service.js';
 import { runAsCli } from './lib/cli-utils.js';
 import { getBaselineEpsilon } from './lib/config/quality.js';
@@ -57,90 +60,42 @@ const USAGE = {
   ],
 };
 
+/** CommonJS `require`, for the `.c8rc.cjs` scope config below. */
 const require = createRequire(import.meta.url);
 
+/**
+ * Load the c8 include/exclude scope. Kept in the CLI rather than the extracted
+ * scorer because it is the one genuinely environment-bound step — a CJS
+ * `require` of a config file resolved against the working tree — and the
+ * scorer takes it as a seam so a test never touches the real `.c8rc.cjs`.
+ */
 function loadC8Scope(cwd) {
   return require(path.resolve(cwd, '.c8rc.cjs'));
 }
 
-function parseFullScopeFlag(argv = []) {
-  return argv.includes('--full-scope');
-}
-
 function main() {
-  const argv = process.argv.slice(2);
-  const diffScopeRef = parseDiffScopeFlag(argv);
-  const fullScope = parseFullScopeFlag(argv);
   const cwd = process.cwd();
+  const { fullScope, diffScopeRef } = resolveCoverageUpdaterScope(
+    process.argv.slice(2),
+  );
   Logger.info('[Coverage] Updating baseline from coverage-final.json...');
 
-  if (fullScope && diffScopeRef !== null) {
-    throw new Error(
-      '[Coverage] --full-scope is incompatible with --diff-scope; pick one',
-    );
-  }
-
-  // Build the per-kind scorer the service will invoke. The scorer receives
-  // `(files, { fullScope })` and returns rows in the `{path, lines,
-  // branches, functions}` shape the writer expects.
-  const scorer = (files, opts) => {
-    const effectiveCwd = opts?.cwd ?? cwd;
-    let raw;
-    try {
-      raw = readCoverageFinal(effectiveCwd);
-    } catch (err) {
-      Logger.error(`[Coverage] ❌ ${err.message}`);
-      return [];
-    }
-
-    const c8Config = loadC8Scope(effectiveCwd);
-    const c8Scope = buildScopePredicate({
-      include: c8Config.include ?? [],
-      exclude: c8Config.exclude ?? [],
-    });
-    const scores = scoreCoverageFinal({
-      raw,
-      cwd: effectiveCwd,
-      scope: c8Scope,
-    });
-
-    // In diff mode, further narrow to the service-resolved in-scope file list.
-    const inScope =
-      !opts?.fullScope && Array.isArray(files) && files.length > 0
-        ? new Set(files)
-        : null;
-
-    const rows = Object.entries(scores)
-      .filter(([relPath]) => inScope === null || inScope.has(relPath))
-      .map(([relPath, score]) => ({
-        path: relPath,
-        lines: score?.lines ?? 0,
-        branches: score?.branches ?? 0,
-        functions: score?.functions ?? 0,
-      }));
-
-    const fileCount = Object.keys(scores).length;
-    Logger.info(
-      `[Coverage] Scored ${fileCount} file(s)${inScope ? ` (${rows.length} in scope)` : ''}.`,
-    );
-    return rows;
-  };
-
   const absBaselinePath = path.resolve(cwd, COVERAGE_BASELINE_PATH);
-  const epsilon = getBaselineEpsilon('coverage', null);
   const refreshOpts = {
     kind: 'coverage',
     writePath: absBaselinePath,
-    epsilon,
-    scorer,
+    epsilon: getBaselineEpsilon('coverage', null),
+    scorer: buildCoverageUpdaterScorer(cwd, {
+      readCoverage: readCoverageFinal,
+      loadScope: loadC8Scope,
+      buildScope: buildScopePredicate,
+      score: scoreCoverageFinal,
+    }),
   };
-  if (fullScope) {
-    refreshOpts.fullScope = true;
-  } else if (diffScopeRef) {
-    refreshOpts.baseRef = diffScopeRef;
-  }
-  // No flag → scopeFiles=null + fullScope=false → service derives the diff
-  // via `origin/main..HEAD` (its default baseRef/headRef).
+  // No flag -> scopeFiles=null + fullScope=false -> the service derives the
+  // diff via `origin/main..HEAD` (its default baseRef/headRef).
+  if (fullScope) refreshOpts.fullScope = true;
+  else if (diffScopeRef) refreshOpts.baseRef = diffScopeRef;
 
   return refreshBaseline(refreshOpts).then((result) => {
     Logger.info(

package/.agents/scripts/update-crap-baseline.js

@@ -2,8 +2,11 @@
 // first import so the check runs before any third-party-importing sibling
 // module is evaluated (Story #3432).
 import './lib/runtime-deps/ensure-installed.js';
-import path from 'node:path';
-import { parseDiffScopeFlag } from './lib/baselines/diff-scope-cli.js';
+import {
+  buildCrapUpdaterScorer,
+  parseCrapUpdaterArgs,
+  resolveCrapUpdaterOptions,
+} from './lib/baselines/crap-updater-cli.js';
 import { refreshBaseline } from './lib/baselines/refresh-service.js';
 import { runAsCli } from './lib/cli-utils.js';
 import { getBaselineEpsilon } from './lib/config/quality.js';
@@ -14,10 +17,8 @@ import {
 } from './lib/config-resolver.js';
 import { loadCoverage } from './lib/coverage-utils.js';
 import {
-  checkResolutionFloor,
   resolveEscomplexVersion,
   resolveTsTranspilerVersion,
-  scanAndScore,
 } from './lib/crap-utils.js';
 
 import { Logger } from './lib/Logger.js';
@@ -79,139 +80,34 @@ const USAGE = {
   ],
 };
 
-function parseCliArgs(argv = process.argv.slice(2)) {
-  const out = {
-    baselinePath: undefined,
-    coveragePath: undefined,
-    fullScope: false,
-    diffScopeRef: null,
-  };
-  for (let i = 0; i < argv.length; i += 1) {
-    if (argv[i] === '--baseline' && argv[i + 1]) {
-      out.baselinePath = argv[i + 1];
-      i += 1;
-    } else if (argv[i] === '--coverage' && argv[i + 1]) {
-      out.coveragePath = argv[i + 1];
-      i += 1;
-    } else if (argv[i] === '--full-scope') {
-      out.fullScope = true;
-    }
-  }
-  out.diffScopeRef = parseDiffScopeFlag(argv);
-  return out;
-}
-
 async function main() {
-  const args = parseCliArgs();
   const config = resolveConfig();
-  const crap = getQuality(config).crap;
-  const targetDirs = Array.isArray(crap.targetDirs) ? crap.targetDirs : [];
-  const requireCoverage = crap.requireCoverage !== false;
-  const minMethodResolutionRate = crap.minMethodResolutionRate ?? 0.75;
-  const coveragePath =
-    args.coveragePath ?? crap.coveragePath ?? 'coverage/coverage-final.json';
-  const baselinePath = args.baselinePath ?? getBaselines(config).crap.path;
-  const ignoreGlobs = Array.isArray(crap.ignoreGlobs) ? crap.ignoreGlobs : [];
+  const options = resolveCrapUpdaterOptions(
+    parseCrapUpdaterArgs(process.argv.slice(2)),
+    { crap: getQuality(config).crap, baselines: getBaselines(config) },
+  );
 
   Logger.info('[CRAP] Updating baseline...');
-  Logger.info(`[CRAP] Target dirs: ${targetDirs.join(', ')}`);
+  Logger.info(`[CRAP] Target dirs: ${options.targetDirs.join(', ')}`);
   Logger.info(
-    `[CRAP] Coverage source: ${coveragePath}${requireCoverage ? ' (required)' : ' (optional)'}`,
+    `[CRAP] Coverage source: ${options.coveragePath}${options.requireCoverage ? ' (required)' : ' (optional)'}`,
   );
 
-  const absBaselinePath = path.isAbsolute(baselinePath)
-    ? baselinePath
-    : path.resolve(process.cwd(), baselinePath);
-
-  if (args.fullScope && args.diffScopeRef !== null) {
-    throw new Error(
-      '[CRAP] --full-scope is incompatible with --diff-scope; pick one',
-    );
-  }
-
-  // Build the per-kind scorer the service will invoke. The scorer receives
-  // `(files, { fullScope, cwd })`:
-  //   - fullScope === true:  walk all target dirs; scopeFiles=null passed to scanAndScore.
-  //   - fullScope === false: score only the diff-derived in-scope files.
-  const scorer = async (files, opts) => {
-    const effectiveCwd = opts?.cwd ?? process.cwd();
-    const coverageAbs = path.isAbsolute(coveragePath)
-      ? coveragePath
-      : path.resolve(effectiveCwd, coveragePath);
-    const coverage = loadCoverage(coverageAbs);
-    if (!coverage && requireCoverage) {
-      Logger.warn(
-        `[CRAP] ⚠ No coverage artifact at ${coveragePath}. All files will be skipped under requireCoverage=true.`,
-      );
-      Logger.warn(
-        "[CRAP] ⚠ Run 'npm run test:coverage' before 'npm run crap:update'.",
-      );
-      return [];
-    }
-    const scopeFiles = opts?.fullScope ? null : (files ?? null);
-    const {
-      rows,
-      scannedFiles,
-      skippedFilesNoCoverage,
-      skippedMethodsNoCoverage,
-      resolution,
-    } = await scanAndScore({
-      targetDirs,
-      coverage,
-      requireCoverage,
-      cwd: effectiveCwd,
-      ignoreGlobs,
-      scopeFiles,
-    });
-
-    Logger.info(`[CRAP] Scanned ${scannedFiles} file(s).`);
-    if (skippedFilesNoCoverage > 0) {
-      Logger.info(
-        `[CRAP] Skipped ${skippedFilesNoCoverage} file(s) without coverage entries.`,
-      );
-    }
-    if (skippedMethodsNoCoverage > 0) {
-      Logger.info(
-        `[CRAP] Skipped ${skippedMethodsNoCoverage} method(s) whose per-method coverage was unresolved.`,
-      );
-    }
-    if (resolution) {
-      Logger.info(
-        `[CRAP] Method resolution: ${resolution.resolvedMethods}/${resolution.joinableMethods} ` +
-          `(${(resolution.rate * 100).toFixed(1)}%) in files with coverage.`,
-      );
-    }
-    // Fail closed BEFORE the service persists anything — a thin baseline is
-    // never written and then apologised for.
-    const refusal = checkResolutionFloor(resolution, minMethodResolutionRate);
-    if (refusal) throw new Error(refusal);
-
-    return (rows ?? []).filter(
-      (r) => typeof r?.crap === 'number' && Number.isFinite(r.crap),
-    );
-  };
-
-  const epsilon = getBaselineEpsilon('crap', config);
   const refreshOpts = {
     kind: 'crap',
-    writePath: absBaselinePath,
-    epsilon,
-    scorer,
+    writePath: options.absBaselinePath,
+    epsilon: getBaselineEpsilon('crap', config),
+    scorer: buildCrapUpdaterScorer(options, { loadCoverage }),
   };
-  if (args.fullScope) {
-    refreshOpts.fullScope = true;
-  } else if (args.diffScopeRef) {
-    refreshOpts.baseRef = args.diffScopeRef;
-  }
-  // No flag → scopeFiles=null + fullScope=false → service derives the diff
-  // via `origin/main..HEAD` (its default baseRef/headRef).
+  // No flag -> scopeFiles=null + fullScope=false -> the service derives the
+  // diff via `origin/main..HEAD` (its default baseRef/headRef).
+  if (options.fullScope) refreshOpts.fullScope = true;
+  else if (options.diffScopeRef) refreshOpts.baseRef = options.diffScopeRef;
 
   const result = await refreshBaseline(refreshOpts);
 
-  const escomplexVersion = resolveEscomplexVersion();
-  const tsTranspilerVersion = resolveTsTranspilerVersion();
   Logger.info(
-    `[CRAP] ✅ Baseline updated (kernelVersion=${result.envelope.kernelVersion}, escomplexVersion=${escomplexVersion}, tsTranspilerVersion=${tsTranspilerVersion}). Wrote to ${absBaselinePath}.`,
+    `[CRAP] ✅ Baseline updated (kernelVersion=${result.envelope.kernelVersion}, escomplexVersion=${resolveEscomplexVersion()}, tsTranspilerVersion=${resolveTsTranspilerVersion()}). Wrote to ${options.absBaselinePath}.`,
   );
   Logger.info(
     `[CRAP] Wrote ${result.envelope.rows.length} row(s). scope=${result.scope.mode}, wrote=${result.wrote}.`,

package/.agents/skills/core/scope-triage/SKILL.md

@@ -15,10 +15,10 @@ description:
   is a single path that emits **one Story by default**.
 - This skill is an optional **split advisory**: should the author keep one
   Story, or does the seed clear the default-single split policy?
-- Anchor sizing judgment to `DEFAULT_MODEL_CAPACITY` and
-  `DELIVERABLE_GRANULARITY_GUIDANCE` in
+- Anchor sizing judgment to `DELIVERABLE_GRANULARITY_GUIDANCE` in
   [`ticket-validator-sizing.js`](../../../scripts/lib/orchestration/ticket-validator-sizing.js).
-  Do not restate numeric thresholds.
+  There is no numeric threshold to restate — Story #5312 deleted the
+  plan-time capacity ceilings.
 - Lead with **cohesion**: one Story is one coherent change with one reason
   to exist. Coupled work stays one Story and uses `## Slicing` for
   intra-session checkpoints.

package/.agents/workflows/audit-clean-code.md

@@ -46,7 +46,8 @@ run the tools first.
    `check-baselines.js` gate enforces. Treat any per-file MI drop beyond
    `delivery.quality.gates.maintainability.tolerance` (default 0.5pt) as a
    grounded must-fix finding, and any cyclomatic reading over the
-   `codingGuardrails` ceilings (flag > 8, must-fix > 12) as measured, not
+   `codingGuardrails.cyclomaticFlag` (> 8) or the fixed ratchet ceiling
+   (≥ 12, reported by `quality:preview` as an advisory) as measured, not
    guessed.
 
 2. **Committed baselines (codebase-wide mode).** Read the committed metric
@@ -98,8 +99,8 @@ Analyze the repository with a focus on:
   from
   [`helpers/code-quality-guardrails.md`](helpers/code-quality-guardrails.md):
   cyclomatic complexity > 8 (`delivery.quality.codingGuardrails.cyclomaticFlag`)
-  is **flag in review** (annotate or split); > 12
-  (`codingGuardrails.cyclomaticMustFix`) is **must-fix** before the work merges.
+  is **flag in review** (annotate or split); ≥ 12 is the fixed ratchet
+  ceiling `check-cyclomatic.js` enforces on new breaches.
   A per-file MI drop beyond the configured
   `delivery.quality.gates.maintainability.tolerance` (default 0.5pt) requires
   a refactor in the same Story rather than a baseline bump.

package/.agents/workflows/audit-to-stories.md

@@ -181,6 +181,14 @@ persists, via `carryProvenanceFooters`
 The carry is additive, union-preserving and idempotent, so a resumed persist
 cannot stack footers and a hand-authored fingerprint is never dropped.
 
+**Persist records the ledger and the labels too.** It stamps the seed's
+`audit::<dimension>` labels — the dedup corpus is listed by them, and an indexed
+run answers lookups from that pool without reaching the provider, so a footer
+alone leaves a plan-path Story invisible — and records each Story's
+**attributed** identities. Union-only identities are not recorded: every sibling
+carries every fingerprint, so an owner would be a coin flip; persist says so on
+stderr. Author per-Story `provenance` to record them.
+
 This is deliberately not an authoring step. It used to be: the footers reached
 the seed and stopped there, leaving the authoring agent to notice HTML comments
 in a one-pager and copy them forward — a remembered step, which is to say no
@@ -243,6 +251,14 @@ every Story that has a resolvable blocker with a canonical
 GitHub `blocked_by` relations. An edge whose target was never opened (deduped,
 ledger-suppressed) drops rather than becoming a `blocked by #undefined`.
 
+**This pass also records the ledger.** The `--ids` map is the only artifact
+carrying the numbers just opened, so `--wire-edges` folds in the cross-run
+record: each mapped group's findings are written `filed` against its Issue
+(`--ledger <path>`, default `baselines/audit-ledger.json`; `--dry-run`
+suppresses the write). The record runs **before** the provider loads, so a host
+with no `gh` still remembers what it filed. Without it nothing ever writes
+`filed` and the ledger suppresses nothing.
+
 **Do not skip this.** `/mandrel-deliver` has no other source for this cohort's order:
 its footprint guard ignores the shared provenance footers, so an unwired cohort
 is genuinely unordered and `/mandrel-deliver` will co-dispatch Stories the edges say
@@ -277,31 +293,45 @@ the `classifications` array:
   is skipped by default; flag in the Phase 7 summary so the operator
   can decide whether to reopen.
 
-`routeFinding` is handed a `searchIssues` port adapted from the
-project's existing GitHub provider — the actual search runs against the
-repo's open + closed issues for each sha in the group, and the helper's
-footer-confirmation step filters out false-positive search hits whose
-body mentions the sha in prose without the canonical marker. The
-workflow owns **no** parallel dedup or footer-parsing code: the
-fingerprint, footer round-trip, and routing all live in that one shared
-module.
-
-Dedup runs in **two stages** when a provider resolves: a
-meaning-first **semantic candidate** pass (`searchCandidates`, wired to
-[`lib/findings/semantic-issue-search.js`](../scripts/lib/findings/semantic-issue-search.js))
-runs FIRST and widens the net across open + closed issues; the exact
-**fingerprint / semantic-key** confirmation runs SECOND. A finding whose title
-was reworded but whose *location* is unchanged still confirms against the Issue
-that already tracks that location, because the audit filers stamp a
-location-based `audit-semantic-keys` footer alongside the `audit-fingerprints`
-footer. Filings from the
+`routeFinding` reads open + closed issues through two ports, which **both run
+and union their pools** — the exact `searchIssues` lookup, and the meaning-first
+`searchCandidates` pass wired to
+[`lib/findings/semantic-issue-search.js`](../scripts/lib/findings/semantic-issue-search.js).
+Confirmation then filters that union by footer, dropping hits whose body
+mentions a sha in prose without the canonical marker. A finding reworded but
+unmoved still confirms, because the filers stamp a location-based
+`audit-semantic-keys` footer
+beside `audit-fingerprints`; so do
 [`retro-proposals-graduator`](../scripts/lib/feedback-loop/retro-proposals-graduator.js)
-carry the same canonical `audit-fingerprints` footer, so a sweep recognizes a
-graduator-filed issue and never re-files it.
+filings, which a sweep therefore never re-files.
+
+Where the corpus is pre-fetched — either off the list endpoint or from
+`--issues-file` — the exact lookup is answered from that local index and the
+search API is spent only on findings with no exact hit. The workflow owns **no**
+parallel dedup or footer-parsing code: fingerprint, footer round-trip, and
+routing all live in that one shared module.
+
+### When there is no `gh` CLI
+
+**No GitHub access** (air-gapped): pass `--no-provider` to `--scan`. Every
+group is classified `create` and the operator is told dedupe was skipped — a
+re-run opens duplicates.
+
+**Reachable, but not through `gh`** (a cloud sandbox: no `gh`, no direct API,
+MCP fine): fetch the corpus yourself. List every issue labelled `audit::*` at
+state `all` — `mcp__github__list_issues` or any other path — write the raw
+result as a JSON array, and pass it:
+
+```bash
+node .agents/scripts/audit-to-stories.js --scan --no-provider \
+  --issues-file temp/audits/issues.json --glob "temp/audits/audit-*-results.md"
+```
 
-When no provider is available (e.g. air-gapped dev environment), pass
-`--no-provider` to the `--scan` step — every group is classified
-`create` and the operator is informed that dedupe was skipped.
+Real `skip-open` / `skip-reoccurring` classifications come back. The corpus is
+normalised on load, so a raw list result works as-is; only `number` and `body`
+are read. An unreadable file is a hard error, never a silent fall-back to an
+unchecked run; an **empty** array — a valid first sweep — is reported with its
+count so it cannot pass for a failed fetch.
 
 ### Cross-run ledger
 
@@ -314,8 +344,12 @@ shape). Each entry is keyed by the finding's fingerprint plus a location-based
 (`new | filed | fixed | accepted-risk | regressed`). A finding whose tracking
 Issue was closed as `not_planned` becomes `accepted-risk` and is **suppressed**
 on every later scan; a `fixed` finding that re-appears becomes `regressed`. The
-ledger is written by the unattended `--auto` sweep and by any `--scan --ledger`
-run; the plain `--scan` path leaves it untouched.
+ledger is written by the unattended `--auto` sweep, by any `--scan --ledger`
+run, by the Phase 5c `--wire-edges` pass, and by `plan-persist` on the Phase 5a
+chained path — the two filing paths both record what they filed; the
+plain `--scan` path leaves it untouched. A finding whose resolved Issue is open
+is recorded `filed` and is known on re-detection; a closed Issue still outranks
+that.
 
 ## Phase 7 — Summary & cleanup
 
@@ -391,8 +425,10 @@ The routine shape is **lenses full-scope → dry-run → live with a ledger PR**
 from `delivery.auditToStories.severityFloor` (default `high`, overridable with
 `--severity`), applies the two-stage dedup, reconciles the cross-run ledger,
 and prints a run-summary JSON (create / skip-open / skip-reoccurring /
-suppressed-by-ledger tallies, plus the re-detected open Issue numbers an
-operator may want a "re-detected" comment on). `--dry-run` performs zero GitHub
+suppressed-by-ledger tallies, the `create`-classified group keys the `--ids`
+map is built from, plus the re-detected open Issue numbers an operator may want
+a "re-detected" comment on). It opens no Issues itself, so run Phase 5c after
+filing or the sweep's memory stays empty. `--dry-run` performs zero GitHub
 writes and skips the ledger write, emitting only the summary.
 
 `--auto` **fails closed on any `summary.reportFailures[]` entry** (Phase 1): an