mandrel 2.57.0 → 2.58.0

package/.agents/agents/story-worker.md

@@ -83,21 +83,22 @@ Do **not** re-read every file in `project.docsContextFiles`. Read the
 digest your caller passes, then pull files on demand at the lines it
 names. A null digest path means no docs mandate.
 
-## Close gates — one full-suite run
+## Close gates — one credited run
 
 `single-story-close.js` runs the canonical close-validation chain
 (**typecheck, lint, test, format, maintainability, coverage, crap**) and is
 the authoritative gate — do not pre-run it. The **one** exception is the
-full suite: after the self-eval loop's last fix commit, run `npm test`
-exactly once in `<workCwd>`. A green full run on `story-<storyId>`
-deposits the `test` credit close reads, keyed on the tree; a later commit
-voids it, and close captures coverage itself when the CRAP gate needs an
-artifact. If the suite outruns the host's sync Bash ceiling, dispatch it in
-the **background** — its completion notification re-invokes you. Never
-spawn a task to poll or `sleep`-loop against it; a waiter with a wrong
-condition outlives the agent. An exit code is never evidence a gate did
-work — the runner's **output** is: it prints whether it deposited credit,
-and a run off the Story branch or of a partial tier deposits nothing and
+full suite: after the self-eval loop's last fix commit, run it once in
+`<workCwd>` through the depositor — `evidence-gate.js --standalone
+--scope-id <storyId> --gate test --worktree <workCwd> -- npm test`. It runs
+whatever `npm test` resolves to and stamps that, so the credit is earned on
+any runner; a later commit voids it, and close captures coverage itself when
+the CRAP gate needs an artifact. If the suite outruns the host's sync Bash
+ceiling, dispatch it in the **background** — its completion notification
+re-invokes you. Never spawn a task to poll or `sleep`-loop against it; a
+waiter with a wrong condition outlives the agent. An exit code is never
+evidence a gate did work — the **output** is: a bare `npm test` deposits
+nothing unless it routes through mandrel's own runner, the only shape that
 says so. Redraft rounds run the scoped projects for the roots you changed
 plus `verify[]`, not the whole suite. Share `lint` / `typecheck` evidence
 with close via `evidence-gate.js`; never stamp coverage / CRAP fresh any

package/.agents/scripts/evidence-gate.js

@@ -269,7 +269,7 @@ runAsCli(import.meta.url, main, {
   source: 'evidence-gate',
   usage: {
     invocation:
-      'node .agents/scripts/evidence-gate.js --scope-id <id> --gate <name> [--standalone] [--no-evidence] [--cwd <path>] [--worktree <path>]',
+      'node .agents/scripts/evidence-gate.js --scope-id <id> --gate <name> [--standalone] [--no-evidence] [--cwd <path>] [--worktree <path>] -- <cmd> [args...]',
     summary:
       'Run one named gate, reusing a prior evidence stamp for the same HEAD instead of re-running it.',
     flags: [
@@ -282,6 +282,22 @@ runAsCli(import.meta.url, main, {
       ],
       ['--cwd <path>', 'Repository root (default: project root).'],
       ['--worktree <path>', 'Worktree the gate runs in.'],
+      [
+        '-- <cmd> [args...]',
+        'Required. The command this gate runs, passed through verbatim (never via a shell).',
+      ],
+    ],
+    notes: [
+      [
+        'Everything after the first `--` is the gate. The stamp therefore describes',
+        'what actually ran, whatever that is — which is how a project on any test',
+        'runner earns the close `test` credit:',
+        '',
+        '  node .agents/scripts/evidence-gate.js --standalone --scope-id 4250 \\',
+        '    --gate lint --worktree .worktrees/story-4250 -- npm run lint',
+        '  node .agents/scripts/evidence-gate.js --standalone --scope-id 4250 \\',
+        '    --gate test --worktree .worktrees/story-4250 -- npm test',
+      ].join('\n'),
     ],
   },
 });

package/.agents/scripts/lib/orchestration/code-review.js

@@ -42,6 +42,7 @@
 import { hasSurvivingCritical } from '../audit-suite/findings.js';
 import { resolveConfig } from '../config-resolver.js';
 import { computeChangeSet } from './change-set.js';
+import { remoteBaseRef } from './review-base-ref.js';
 import { deriveChangeLevel, resolveDepth } from './review-depth.js';
 import {
   collectProviderDegradations,
@@ -70,11 +71,14 @@ import { upsertStructuredComment } from './ticketing.js';
  */
 
 /**
- * Resolve the project base branch fallback used when a caller omits
- * `baseRef`.
+ * Resolve the base ref used when a caller omits `baseRef`. Remote-qualified,
+ * never the bare branch name — a caller that does not name a base must not
+ * silently inherit the local ref's drift (Story #5325). An unfetched remote
+ * then yields an unenumerable diff, which every downstream consumer already
+ * fails safe on, instead of a confidently-wrong wide one.
  */
 function resolveConfigBase(config) {
-  return config?.project?.baseBranch ?? 'main';
+  return remoteBaseRef(config?.project?.baseBranch ?? 'main');
 }
 
 /** Positive-integer override, else the supplied default. */

package/.agents/scripts/lib/orchestration/pinned-identifier-lint.js

@@ -0,0 +1,137 @@
+/**
+ * pinned-identifier-lint.js — the `pinned-identifier` advisory lint over a
+ * draft Story's `acceptance[]` (Story #5323).
+ *
+ * `acceptance[]` is the Story's **binding** contract and `changes[]` only an
+ * advisory sketch the deliverer may revise, so an acceptance item naming an
+ * internal symbol pins something the executor is free to rename out from
+ * under it. The story-author prompt has always said so; nothing surfaced a
+ * violation, which left the rule enforced only by the authoring model
+ * remembering it.
+ *
+ * The classifier lives in its own module because its vocabulary is its own:
+ * four token grammars and a call-suffix strip that the sibling prose lint in
+ * `plan-text-hygiene.js` shares nothing with.
+ *
+ * Advisory by contract: findings are deterministic text for the persist
+ * dry-run's warning list. They never gate persist and spawn nothing.
+ *
+ * Pure, synchronous, no I/O.
+ *
+ * @module lib/orchestration/pinned-identifier-lint
+ */
+
+/**
+ * An inline code span carrying one of these is naming something other than a
+ * source identifier, and is never a pinned identifier:
+ *
+ *   - `/` — a file path or a glob (`src/app.js`, `tests/x/*.spec.ts`);
+ *   - `.` — a dotted path, a filename, or a config key
+ *     (`delivery.routing.closeAndLand`, `story-body.js`);
+ *   - `:` — a label (`agent::ready`, `type::story`);
+ *   - `-` — a kebab token: a `data-testid` value, a slug, a package name, or
+ *     a CLI flag (`--dry-run`);
+ *   - whitespace — an argv shape, so a command (`npm run lint`);
+ *   - `[` / `]` — a field reference (`acceptance[]`).
+ */
+const NON_IDENTIFIER_MARKERS = /[/.:\-\s[\]]/;
+
+/** A bare source identifier, with an optional call suffix stripped. */
+const BARE_IDENTIFIER_RE = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+
+/**
+ * An UPPER_SNAKE token. Exempt by contract: an environment variable and an
+ * internal constant are the same shape, and warning on every `DATABASE_URL`
+ * to catch the occasional pinned constant trades a real class of false
+ * positives for a marginal gain.
+ */
+const UPPER_SNAKE_RE = /^[A-Z0-9_$]+$/;
+
+/**
+ * A case transition (`staffCan`, `MyCalendarBoard`, `TimeGrid`) — the
+ * signature that separates a source identifier from a prose word a criterion
+ * legitimately quotes (`landed`, `pending`, `main`).
+ */
+const CASE_TRANSITION_RE = /[a-z][A-Z]/;
+
+/** The remedy, either side of the identifiers a finding names. */
+const MESSAGE_HEAD = 'Acceptance item pins the internal identifier(s) ';
+const MESSAGE_TAIL =
+  '; `changes[]` is an advisory sketch the deliverer may reshape, so assert ' +
+  'the observable behaviour instead of the symbol that implements it.';
+
+/**
+ * Collect the inline code spans of one acceptance item.
+ *
+ * @param {string} item
+ * @returns {string[]}
+ */
+function codeSpans(item) {
+  return [...String(item ?? '').matchAll(/`([^`\n]+)`/g)].map((m) => m[1]);
+}
+
+/**
+ * Decide whether one code span pins a source identifier: a bare token
+ * carrying a case transition, with no separator that would make it a path, a
+ * label, a kebab token, a flag or a command, and not an UPPER_SNAKE name.
+ *
+ * Deliberately conservative in one direction only: a false positive costs a
+ * warning line the author dismisses, while a false negative on a path, a
+ * testid or a command would train the author to ignore the lint.
+ *
+ * @param {string} span
+ * @returns {boolean}
+ */
+function isPinnedIdentifier(span) {
+  const token = span.trim().replace(/\(\s*\)$/, '');
+  return (
+    !NON_IDENTIFIER_MARKERS.test(token) &&
+    BARE_IDENTIFIER_RE.test(token) &&
+    !UPPER_SNAKE_RE.test(token) &&
+    CASE_TRANSITION_RE.test(token)
+  );
+}
+
+/**
+ * The authored `acceptance[]` of one draft Story.
+ *
+ * It is authored at the ticket's top level — the machine contract the
+ * validators read — and synced into the body only at assembly, so the top
+ * level wins; the parsed body covers a draft that carries it inline.
+ *
+ * @param {object} story The raw draft ticket.
+ * @param {object} body Its parsed body.
+ * @returns {string[]}
+ */
+function resolveAcceptance(story, body) {
+  if (Array.isArray(story?.acceptance)) return story.acceptance;
+  return Array.isArray(body?.acceptance) ? body.acceptance : [];
+}
+
+/**
+ * Evaluate the lint over one draft Story — one finding per offending
+ * acceptance item, naming every identifier it pinned.
+ *
+ * @param {object} story The raw draft ticket.
+ * @param {object} body Its parsed body.
+ * @param {string} slug
+ * @param {(text: string) => string} excerpt Evidence truncator, shared with
+ *   the sibling lints so every finding excerpts alike.
+ * @returns {Array<{ kind: 'pinned-identifier', slug: string, evidence: string, message: string }>}
+ */
+export function findPinnedIdentifiers(story, body, slug, excerpt) {
+  const acceptance = resolveAcceptance(story, body);
+  const findings = [];
+  for (const item of acceptance) {
+    const pinned = codeSpans(item).filter(isPinnedIdentifier);
+    if (pinned.length === 0) continue;
+    const named = pinned.map((name) => `\`${name}\``).join(', ');
+    findings.push({
+      kind: 'pinned-identifier',
+      slug,
+      evidence: excerpt(String(item ?? '')),
+      message: `${MESSAGE_HEAD}${named}${MESSAGE_TAIL}`,
+    });
+  }
+  return findings;
+}

package/.agents/scripts/lib/orchestration/plan-context.js

@@ -29,6 +29,7 @@ import { parse as parseStoryBody } from '../story-body/story-body.js';
 import {
   renderStoryAuthorCore,
   renderStorySplitRules,
+  ticketsModePromptField,
 } from '../templates/decomposer-prompts.js';
 import {
   renderAcceptanceSpecSystemPrompt,
@@ -640,14 +641,21 @@ function withAdvisorySignals(complexitySignals, { config, cwd } = {}) {
  * rules a planner reads only when the default-single split policy clears
  * carried separately as `storySplitRules` (Story #5312).
  *
- * @returns {{ spec: string, acceptance: string, story: string, storySplitRules: string }}
+ * `storyTicketsRules` is the one mode-conditional field (Story #5323): it
+ * only means anything when the seed is an existing ticket, and an envelope
+ * that carries it in every mode teaches the author to look for a source
+ * ticket that a `--seed` run does not have.
+ *
+ * @param {{ mode?: string }} [args]
+ * @returns {{ spec: string, acceptance: string, story: string, storySplitRules: string, storyTicketsRules?: string }}
  */
-export function buildSystemPrompts() {
+export function buildSystemPrompts({ mode } = {}) {
   return {
     spec: renderTechSpecSystemPrompt(),
     acceptance: renderAcceptanceSpecSystemPrompt(),
     story: renderStoryAuthorCore(),
     storySplitRules: renderStorySplitRules(),
+    ...ticketsModePromptField(mode),
   };
 }
 
@@ -1007,7 +1015,7 @@ async function buildTicketsModeEnvelope({
     memoryPoolAdvisory: authoring.memoryPoolAdvisory,
     priorFeedback: authoring.priorFeedback,
     ticketSchema: TICKET_SCHEMA_DESCRIPTOR,
-    systemPrompts: buildSystemPrompts(),
+    systemPrompts: buildSystemPrompts({ mode: 'tickets' }),
     planState: null,
     planProfile:
       ticketIds.length === 1 ? 'story-default' : 'story-from-tickets',

package/.agents/scripts/lib/orchestration/plan-persist/acceptance-handle-repair.js

@@ -0,0 +1,107 @@
+/**
+ * acceptance-handle-repair.js — repair-before-judging for the `AC-<n>:`
+ * presentation handle on authored acceptance items (Story #5323).
+ *
+ * The handle belongs to the body renderer, which numbers each checkbox from
+ * its position in `acceptance[]` (`story-body.js`). An author planning from
+ * an existing ticket reads that rendered body as a template and carries the
+ * handle forward, so the persisted checkbox reads `- [ ] AC-1: AC-1: …`; a
+ * lettered handle copied out of a hand-edited source (`AC-14a:`) misnumbers
+ * the rest of the list against its own text.
+ *
+ * The correction is mechanical and total — strip the handle the renderer
+ * will re-apply — so this module applies it and **reports** it, exactly as
+ * `changes-repair.js` does for the `{ path, assumption }` formality. Charging
+ * the author a re-draft round to paste back text the strip already produced
+ * buys nothing.
+ *
+ * It lives beside the validator rather than inside it for the same reason
+ * `changes-repair.js` does: the validator's job is to judge, and mixing a
+ * mutating repair pass into a module of pure collectors muddies both.
+ * `persist-helpers.js#validateTickets` calls this first, then the validators.
+ *
+ * @module lib/orchestration/plan-persist/acceptance-handle-repair
+ */
+
+import { stripAcceptanceHandle } from '../../story-body/story-body.js';
+import { renderChangeRepair } from './changes-repair.js';
+
+/**
+ * Strip the handle off one surface's `acceptance[]`, recording each distinct
+ * strip on `repairs`.
+ *
+ * @param {object} surface An object that may carry an `acceptance` array.
+ * @param {string} slug
+ * @param {Set<string>} reported Items already reported for this ticket.
+ * @param {object[]} repairs Accumulator, mutated.
+ * @returns {void}
+ */
+function repairSurface(surface, slug, reported, repairs) {
+  if (!Array.isArray(surface.acceptance)) return;
+  surface.acceptance = surface.acceptance.map((item) => {
+    const { text, stripped } = stripAcceptanceHandle(item);
+    if (!stripped) return item;
+    const from = String(item ?? '');
+    if (!reported.has(from)) {
+      reported.add(from);
+      repairs.push({ kind: 'acceptance-handle', slug, from, to: text });
+    }
+    return text;
+  });
+}
+
+/**
+ * Strip the presentation `AC-<n>:` handle off every authored `acceptance[]`
+ * item, on both surfaces that can carry one: the ticket's top-level array
+ * (the machine contract) and a structured body's.
+ *
+ * A serialized **string** body needs no pass of its own — `parse()` strips
+ * the handle with the same grammar this does, so the two surfaces converge
+ * on one list whichever carried the handle, and the contract sync (which
+ * fails closed on a disagreement) sees them agree.
+ *
+ * Mutates `tickets` in place — the persist pipeline threads this same array
+ * on to assembly. Total: a non-array argument and non-Story tickets are
+ * no-ops.
+ *
+ * @param {object[]} tickets
+ * @returns {Array<{ kind: 'acceptance-handle', slug: string, from: string, to: string }>}
+ */
+export function normalizeAcceptanceHandles(tickets) {
+  const repairs = [];
+  for (const ticket of Array.isArray(tickets) ? tickets : []) {
+    if (!ticket || typeof ticket !== 'object' || ticket.type !== 'story') {
+      continue;
+    }
+    const slug = ticket.slug ?? ticket.title ?? '<unknown>';
+    // A ticket normally carries the same list on both surfaces, so report
+    // each distinct item once — the operator reads one correction, not two.
+    const reported = new Set();
+    repairSurface(ticket, slug, reported, repairs);
+    const body = ticket.body;
+    if (body && typeof body === 'object') {
+      repairSurface(body, slug, reported, repairs);
+    }
+  }
+  return repairs;
+}
+
+/**
+ * Render one entry of the dry-run's mixed repair list.
+ *
+ * The list carries two kinds — a `changes[]` entry repaired by probing base,
+ * and an `acceptance[]` item whose handle was normalised off — and both are
+ * mechanical corrections the run applied on the author's behalf, so both
+ * belong on the one list the operator reads. This module owns the dispatch
+ * because it owns the newer kind: it renders its own line and delegates
+ * every other kind to `changes-repair.js`, so neither producer has to know
+ * the other's shape.
+ *
+ * @param {{ kind?: string, slug: string, from: string, to?: string }} repair
+ * @returns {string}
+ */
+export function renderRepair(repair) {
+  if (repair.kind !== 'acceptance-handle') return renderChangeRepair(repair);
+  const { slug, from, to } = repair;
+  return `Story "${slug}": acceptance[] item "${from}" carried an AC-<n> handle — normalised to "${to}"; the body renderer numbers the checkboxes.`;
+}

package/.agents/scripts/lib/orchestration/plan-persist/changes-repair.js

@@ -261,7 +261,12 @@ function repairTicket(ticket, existsAtBase) {
 }
 
 /**
- * Render one repair as the dry-run line the operator reads.
+ * Render one `changes[]` repair as the dry-run line the operator reads.
+ *
+ * The dry-run's repair list is mixed — an `acceptance[]` handle strip is
+ * reported on it too — but the dispatch across kinds lives in
+ * [`acceptance-handle-repair.js`](acceptance-handle-repair.js)`#renderRepair`,
+ * which delegates here for this kind. Each producer owns its own line.
  *
  * @param {{ slug: string, from: string, path: string, assumption: string, reason: string }} repair
  * @returns {string}

package/.agents/scripts/lib/orchestration/plan-persist/persist-helpers.js

@@ -10,9 +10,10 @@
  * checkout on CI has no local `main`), else nothing — a shallow checkout
  * with no base at all skips the probes instead of reading every path as
  * absent.
- *   - `validateTickets(tickets, config, opts)` — repairs the mechanical
- *     `changes[]` formalities against the base branch, then runs the
- *     cross-link, freshness, and task-body validators in one pass.
+ *   - `validateTickets(tickets, config, opts)` — normalises the authored
+ *     `acceptance[]` handles and repairs the mechanical `changes[]`
+ *     formalities against the base branch, then runs the cross-link,
+ *     freshness, and task-body validators in one pass.
  *
  * Story #5312 deleted the fan-out probe that lived here: the delete
  * blast-radius count never refused a real plan, and the `git grep` it paid
@@ -24,6 +25,7 @@
 import { gitSpawn } from '../../git-utils.js';
 import { validateTaskBodies } from '../task-body-validator.js';
 import { validateAndNormalizeTickets } from '../ticket-validator.js';
+import { normalizeAcceptanceHandles } from './acceptance-handle-repair.js';
 import { repairChangeEntries } from './changes-repair.js';
 
 /**
@@ -167,13 +169,16 @@ function defineHidden(validated, extras) {
 export function validateTickets(tickets, config, opts = {}) {
   const baseBranch = resolveBaseBranchRef(config);
   const baseBranchRef = resolveProbeRef({ baseBranch, cwd: opts.cwd });
-  const repairs = repairChangeEntries(tickets, {
-    existsAtBase: makeExistsAtBase({
-      baseBranchRef,
-      cwd: opts.cwd,
-      gitRunner: opts.gitRunner,
+  const repairs = [
+    ...normalizeAcceptanceHandles(tickets),
+    ...repairChangeEntries(tickets, {
+      existsAtBase: makeExistsAtBase({
+        baseBranchRef,
+        cwd: opts.cwd,
+        gitRunner: opts.gitRunner,
+      }),
     }),
-  });
+  ];
   const validated = validateAndNormalizeTickets(tickets, {
     baseBranchRef: baseBranchRef ?? undefined,
     gitRunner: opts.gitRunner,

package/.agents/scripts/lib/orchestration/plan-persist/run-plan-persist.js

@@ -62,8 +62,8 @@ import {
   conflictFindingKey,
 } from '../ticket-validator-conflicts.js';
 import { upsertStructuredComment } from '../ticketing.js';
+import { renderRepair } from './acceptance-handle-repair.js';
 import { recordAuditFilings, withAuditLabels } from './audit-provenance.js';
-import { renderChangeRepair } from './changes-repair.js';
 import {
   resolveContainerEpic,
   resolveCrossPlanLinks,
@@ -146,7 +146,7 @@ function enforceTicketValidation(validated) {
     );
   }
   const warnings = [
-    ...(validated.repairs ?? []).map((repair) => renderChangeRepair(repair)),
+    ...(validated.repairs ?? []).map(renderRepair),
     ...(validated.warnings ?? []),
   ];
   return {
@@ -170,18 +170,28 @@ function freshnessCounts(probeRef, warnings) {
   return { stale: warnings.length, ambiguous: 0 };
 }
 
+/** How each text-hygiene finding kind names itself on the warning list. */
+const TEXT_HYGIENE_LABELS = {
+  'open-question': 'open question in body',
+  'pinned-identifier': 'pinned identifier in acceptance[]',
+};
+
 /**
- * The `open-question` lint over the draft bodies (Story #5312) — an
+ * The advisory text-hygiene lints over the draft (Story #5312, #5323) — an
  * operator-directed question persisted into a Story a non-interactive
- * sub-agent executes. A warning the dry-run lists, never a refusal.
+ * sub-agent executes, and an acceptance item pinning an internal symbol the
+ * advisory `changes[]` may reshape. Warnings the dry-run lists, never
+ * refusals.
  *
  * @param {object[]} rawStories
  * @returns {string[]}
  */
-function collectOpenQuestionWarnings(rawStories) {
+function collectTextHygieneWarnings(rawStories) {
   return evaluateTextHygiene({ draftStories: rawStories }).findings.map(
     (finding) =>
-      `Story "${finding.slug}": open question in body — "${finding.evidence}". ${finding.message}`,
+      `Story "${finding.slug}": ${
+        TEXT_HYGIENE_LABELS[finding.kind] ?? finding.kind
+      } — "${finding.evidence}". ${finding.message}`,
   );
 }
 
@@ -595,7 +605,7 @@ export async function runPlanPersist({
     enforceTicketValidation(validated);
   const warnings = [
     ...validationWarnings,
-    ...collectOpenQuestionWarnings(rawStories),
+    ...collectTextHygieneWarnings(rawStories),
   ];
   logWarnings(warnings);
 

package/.agents/scripts/lib/orchestration/plan-text-hygiene.js

@@ -1,6 +1,7 @@
 /**
- * plan-text-hygiene.js — the `open-question` lint over draft Story bodies
- * (Story #4599; narrowed to one lint by Story #5312).
+ * plan-text-hygiene.js — the advisory draft-Story lints: `open-question`
+ * over body prose (Story #4599; narrowed to one lint by Story #5312) and
+ * `pinned-identifier` over `acceptance[]` (Story #5323).
  *
  * A Story is executed by a non-interactive sub-agent, so an operator-directed
  * open question persisted into its body ("Flag if…", "TBD", "confirm with the
@@ -12,6 +13,11 @@
  * lints with the critic gate that surfaced them: both scored prose shape the
  * authoring model already judges, and neither ever changed a persisted body.
  *
+ * `pinned-identifier` is the one lint that scores the **binding** half of the
+ * ticket; its classifier lives in
+ * [`pinned-identifier-lint.js`](pinned-identifier-lint.js), which shares no
+ * vocabulary with the prose heuristic here.
+ *
  * Advisory by contract: findings are deterministic text for the dry-run's
  * warning list. They never gate persist and spawn nothing.
  *
@@ -24,6 +30,7 @@
  */
 
 import { parse } from '../story-body/story-body.js';
+import { findPinnedIdentifiers } from './pinned-identifier-lint.js';
 
 /** Truncation length for the `evidence` excerpt on each finding. */
 const EVIDENCE_MAX_CHARS = 160;
@@ -41,7 +48,7 @@ const OPEN_QUESTION_MARKERS = [
 
 /**
  * @typedef {Object} TextHygieneFinding
- * @property {'open-question'} kind
+ * @property {'open-question'|'pinned-identifier'} kind
  * @property {string} slug - The draft Story's slug ('' when absent).
  * @property {string} evidence - Excerpt of the offending text.
  * @property {string} message - Human-readable, re-author-actionable text.
@@ -123,7 +130,7 @@ function findOpenQuestions(prose, slug) {
 }
 
 /**
- * Evaluate the open-question lint over a draft Story array.
+ * Evaluate the advisory lints over a draft Story array.
  *
  * @param {{ draftStories?: Array<object>|null }} args - The draft
  *   `stories.json` array (raw Story objects with top-level `slug` /
@@ -146,7 +153,10 @@ export function evaluateTextHygiene({ draftStories = null } = {}) {
     }
     const goal = typeof body.goal === 'string' ? body.goal : '';
     const spec = typeof body.spec === 'string' ? body.spec : '';
-    findings.push(...findOpenQuestions([goal, spec].join('\n'), slug));
+    findings.push(
+      ...findOpenQuestions([goal, spec].join('\n'), slug),
+      ...findPinnedIdentifiers(story, body, slug, excerpt),
+    );
   }
   return { findings };
 }