mandrel 2.60.0 → 2.61.0

package/.agents/workflows/audit-devops.md

@@ -6,17 +6,14 @@ description: Audit CI/CD workflows, container images, infrastructure-as-code, an
 
 You are a Principal DevOps Engineer & Infrastructure Architect auditing this
 repo's DevOps infrastructure, DX tooling, and CI/CD pipelines for
-inefficiencies, security risks, and modernization opportunities. The shared lens
-machinery — read-only constraint, scope interpretation, report envelope +
-finding-block skeleton, severity scale, self-cross-check, and execution
-strategy — lives in
+inefficiencies, security risks, and modernization opportunities. The shared lens machinery lives in
 [`helpers/audit-lens-core.md`](helpers/audit-lens-core.md). Write the report to
 `{{auditOutputDir}}/audit-devops-results.md`. The report adds a **Proposed
 Implementation Roadmap** section (a logical, phased plan).
 
 ## Scope
 
-Interpret this lens's change-set fence per the core's Scope interpretation:
+Per the core's Scope interpretation:
 
 ```text
 {{changedFiles}}
@@ -24,9 +21,8 @@ Interpret this lens's change-set fence per the core's Scope interpretation:
 
 ## Execution strategy
 
-Run this lens as a single `subagent_type: auditor` dispatch returning the report
-path + Executive Summary; sequential inline execution is the fallback (see the
-core's Execution strategy).
+Run this lens as one `subagent_type: auditor` dispatch per the core's
+Execution strategy.
 
 ## Step 1: Detection Battery (Read-Only, Tool-First)
 

package/.agents/workflows/audit-documentation.md

@@ -10,10 +10,7 @@ renamed, scripts move, workflows change shape, version/topology claims go stale.
 The deterministic gates (`check-doc-links.js` and the generators' `--check`
 mode) catch broken links and generator drift — they cannot tell whether the
 prose still describes how the code actually behaves. That semantic
-verification is this lens's job. The
-shared lens machinery — read-only constraint, scope interpretation, report
-envelope + finding-block skeleton, severity scale, self-cross-check, and
-execution strategy — lives in
+verification is this lens's job. The shared lens machinery lives in
 [`helpers/audit-lens-core.md`](helpers/audit-lens-core.md). Write the report to
 `{{auditOutputDir}}/audit-documentation-results.md`. Each finding carries a
 **Category:** (`Broken Instruction | Stale Description | Missing Coverage |

package/.agents/workflows/audit-mobile.md

@@ -8,9 +8,7 @@ You are a Senior Mobile Web Engineer holding the frontend to its **small-screen
 and touch contract**: does every surface lay out, scroll, and answer a finger on
 a phone and a tablet — and does anything in the suite actually verify that it
 does? Default to **static** detection over source; escalate to a **runtime**
-viewport pass only when a live target is configured. The shared lens machinery —
-read-only constraint, scope interpretation, report envelope + finding-block
-skeleton, severity scale, self-cross-check, and execution strategy — lives in
+viewport pass only when a live target is configured. The shared lens machinery lives in
 [`helpers/audit-lens-core.md`](helpers/audit-lens-core.md). Write the report to
 `{{auditOutputDir}}/audit-mobile-results.md`. Dimension values:
 `Layout & Viewport | Touch Ergonomics | Responsive Assets | Mobile Verification`.
@@ -55,7 +53,7 @@ small-screen or touch defect; defer the rest so the suite never double-reports:
 
 ## Scope
 
-Interpret this lens's change-set fence per the core's Scope interpretation:
+Per the core's Scope interpretation:
 
 ```text
 {{changedFiles}}
@@ -63,9 +61,8 @@ Interpret this lens's change-set fence per the core's Scope interpretation:
 
 ## Execution strategy
 
-Run this lens as a single `subagent_type: auditor` dispatch returning the report
-path + Executive Summary; sequential inline execution is the fallback (see the
-core's Execution strategy).
+Run this lens as one `subagent_type: auditor` dispatch per the core's
+Execution strategy.
 
 ## Step 0: Discover the responsive baseline (run first)
 

package/.agents/workflows/audit-navigability.md

@@ -16,9 +16,7 @@ nav-registry entry surfaces it for any persona — only a hardcoded deep-link
 reaches it) and the **dead nav href** (a nav entry points at a route that does
 not exist). This is **mechanism, not content**: the lens reads the consumer's
 configured route tree and nav-registry SSOT and is a **silent no-op when neither
-is configured**. The shared lens machinery — read-only constraint, scope
-interpretation, report envelope + finding-block skeleton, severity scale,
-self-cross-check, and execution strategy — lives in
+is configured**. The shared lens machinery lives in
 [`helpers/audit-lens-core.md`](helpers/audit-lens-core.md). Write the report to
 `{{auditOutputDir}}/audit-navigability-results.md`. Dimension values:
 `Orphaned Route | Dead Nav Href`; extra finding fields **Route / Door:** and
@@ -61,9 +59,8 @@ a foreign change set leak into a scoped lens.
 
 ## Execution strategy
 
-Run this lens as a single `subagent_type: auditor` dispatch returning the report
-path + Executive Summary; sequential inline execution is the fallback (see the
-core's Execution strategy).
+Run this lens as one `subagent_type: auditor` dispatch per the core's
+Execution strategy.
 
 ## Configuration
 

package/.agents/workflows/audit-performance.md

@@ -11,9 +11,7 @@ read-through: **measure before you judge** (a claim with no profile/timing/byte
 count is a hypothesis, not a finding); **adapt to the repo profile** (activate
 only the dimensions that apply, declaring the rest inapplicable); and
 **interleaving correctness is a performance concern** (races have been the most
-expensive defects this repo shipped). The shared lens machinery — read-only
-constraint, scope interpretation, report envelope + finding-block skeleton,
-severity scale, self-cross-check, and execution strategy — lives in
+expensive defects this repo shipped). The shared lens machinery lives in
 [`helpers/audit-lens-core.md`](helpers/audit-lens-core.md). Write the report to
 `{{auditOutputDir}}/audit-performance-results.md`. Extra finding field:
 **Evidence:** [a Step 0 repro command (or quoted code path) + a `measured` or
@@ -21,7 +19,7 @@ severity scale, self-cross-check, and execution strategy — lives in
 
 ## Scope
 
-Interpret this lens's change-set fence per the core's Scope interpretation:
+Per the core's Scope interpretation:
 
 ```text
 {{changedFiles}}

package/.agents/workflows/audit-privacy.md

@@ -6,9 +6,7 @@ description: Audit logs, telemetry, and persistence paths for PII leakage and re
 
 You are a Data Privacy Officer & Security Engineer finding accidental logging,
 insecure storage, or unnecessary collection of PII, and checking GDPR/CCPA
-compliance. The shared lens machinery — read-only constraint, scope
-interpretation, report envelope + finding-block skeleton, severity scale,
-self-cross-check, and execution strategy — lives in
+compliance. The shared lens machinery lives in
 [`helpers/audit-lens-core.md`](helpers/audit-lens-core.md). Write the report to
 `{{auditOutputDir}}/audit-privacy-results.md`. This lens labels the severity
 axis **Impact** and uses dimension values `Leaky Log | Insecure Storage | Data
@@ -17,7 +15,7 @@ Encryption / Logging Safety / Minimization: Pass/Fail/Partial).
 
 ## Scope
 
-Interpret this lens's change-set fence per the core's Scope interpretation:
+Per the core's Scope interpretation:
 
 ```text
 {{changedFiles}}
@@ -25,9 +23,8 @@ Interpret this lens's change-set fence per the core's Scope interpretation:
 
 ## Execution strategy
 
-Run this lens as a single `subagent_type: auditor` dispatch returning the report
-path + Executive Summary; sequential inline execution is the fallback (see the
-core's Execution strategy).
+Run this lens as one `subagent_type: auditor` dispatch per the core's
+Execution strategy.
 
 ## Step 1: Sink-First Detection
 

package/.agents/workflows/audit-quality.md

@@ -7,9 +7,7 @@ description: Audit test coverage gaps, flaky tests, missing assertions, and test
 You are a Principal SDET & Quality Architect auditing the repository's testing
 infrastructure, coverage, flaky tests, mocking strategy, and test-pyramid
 balance — and, in Story-scoped mode, evaluating the implemented tests against
-the Story under audit. The shared lens machinery — read-only constraint, scope
-interpretation, report envelope + finding-block skeleton, severity scale,
-self-cross-check, and execution strategy — lives in
+the Story under audit. The shared lens machinery lives in
 [`helpers/audit-lens-core.md`](helpers/audit-lens-core.md). Write the report to
 `{{auditOutputDir}}/audit-quality-results.md`. Each finding carries a
 **Category:** (`Flakiness | Coverage | Performance | Mocking | Test Plans`); the
@@ -18,7 +16,7 @@ Test Plans: Healthy / Needs Work / Missing).
 
 ## Scope
 
-Interpret this lens's change-set fence per the core's Scope interpretation:
+Per the core's Scope interpretation:
 
 ```text
 {{changedFiles}}
@@ -26,9 +24,8 @@ Interpret this lens's change-set fence per the core's Scope interpretation:
 
 ## Execution strategy
 
-Run this lens as a single `subagent_type: auditor` dispatch returning the report
-path + Executive Summary; sequential inline execution is the fallback (see the
-core's Execution strategy).
+Run this lens as one `subagent_type: auditor` dispatch per the core's
+Execution strategy.
 
 ## Step 0 - Mode split + tool-first artifact read (mandatory)
 

package/.agents/workflows/audit-security.md

@@ -7,9 +7,7 @@ command: false
 
 You are a Cybersecurity Architect & Penetration Tester conducting a
 comprehensive security review (OWASP Top 10, insecure configs, attack vectors).
-The shared lens machinery — read-only constraint, scope interpretation, report
-envelope + finding-block skeleton, severity scale, self-cross-check, and
-execution strategy — lives in
+The shared lens machinery lives in
 [`helpers/audit-lens-core.md`](helpers/audit-lens-core.md). Write the report to
 `{{auditOutputDir}}/audit-security-results.md`. Extra finding fields: **CWE
 ID:** and **Baseline MUST:** (the violated `security-baseline.md` MUST). The
@@ -18,7 +16,7 @@ libraries to harden the app).
 
 ## Scope
 
-Interpret this lens's change-set fence per the core's Scope interpretation:
+Per the core's Scope interpretation:
 
 ```text
 {{changedFiles}}
@@ -26,9 +24,8 @@ Interpret this lens's change-set fence per the core's Scope interpretation:
 
 ## Execution strategy
 
-Run this lens as a single `subagent_type: auditor` dispatch returning the report
-path + Executive Summary; sequential inline execution is the fallback (see the
-core's Execution strategy).
+Run this lens as one `subagent_type: auditor` dispatch per the core's
+Execution strategy.
 
 ## Rubric — `rules/security-baseline.md` is the contract
 

package/.agents/workflows/audit-seo.md

@@ -7,9 +7,7 @@ description: Audit SEO fundamentals and Generative Engine Optimization signals (
 You are a Senior Technical SEO & Generative Engine Optimization (GEO) Specialist
 (semantic HTML, JSON-LD Schema, Core Web Vitals) surfacing structural, semantic,
 and content-level improvements that increase discoverability in both traditional
-search indexes and AI answer engines. The shared lens machinery — read-only
-constraint, scope interpretation, report envelope + finding-block skeleton,
-severity scale, self-cross-check, and execution strategy — lives in
+search indexes and AI answer engines. The shared lens machinery lives in
 [`helpers/audit-lens-core.md`](helpers/audit-lens-core.md). Write the report to
 `{{auditOutputDir}}/audit-seo-results.md`. Each finding carries a **Category:**
 (`SEO | GEO | Core Web Vitals | Crawlability`); the report adds a **Detailed
@@ -29,7 +27,7 @@ from an `.agentrc` key, and the probe fails open when indeterminate.
 
 ## Scope
 
-Interpret this lens's change-set fence per the core's Scope interpretation:
+Per the core's Scope interpretation:
 
 ```text
 {{changedFiles}}
@@ -37,9 +35,8 @@ Interpret this lens's change-set fence per the core's Scope interpretation:
 
 ## Execution strategy
 
-Run this lens as a single `subagent_type: auditor` dispatch returning the report
-path + Executive Summary; sequential inline execution is the fallback (see the
-core's Execution strategy).
+Run this lens as one `subagent_type: auditor` dispatch per the core's
+Execution strategy.
 
 ## Step 0: Indexability gate (run first)
 

package/.agents/workflows/audit-sre.md

@@ -7,9 +7,7 @@ description: "Audit production-readiness for a release candidate: SLOs, observab
 You are a Senior SRE & Lead Developer running an operational-readiness audit for
 a production release candidate — rollback & recovery paths, observability &
 instrumentation, resilience & failure handling, and runbooks & operational
-docs. The shared lens machinery — read-only constraint, scope interpretation,
-report envelope + finding-block skeleton, severity scale, self-cross-check, and
-execution strategy — lives in
+docs. The shared lens machinery lives in
 [`helpers/audit-lens-core.md`](helpers/audit-lens-core.md). Write the report to
 `{{auditOutputDir}}/audit-sre-results.md`. Each finding carries a **Category:**
 (`Rollback & Recovery | Observability | Resilience | Runbooks`); the report adds
@@ -18,7 +16,7 @@ Found).
 
 ## Scope
 
-Interpret this lens's change-set fence per the core's Scope interpretation:
+Per the core's Scope interpretation:
 
 ```text
 {{changedFiles}}
@@ -26,9 +24,8 @@ Interpret this lens's change-set fence per the core's Scope interpretation:
 
 ## Execution strategy
 
-Run this lens as a single `subagent_type: auditor` dispatch returning the report
-path + Executive Summary; sequential inline execution is the fallback (see the
-core's Execution strategy).
+Run this lens as one `subagent_type: auditor` dispatch per the core's
+Execution strategy.
 
 ## Step 1: Resilience Detection Battery (Read-Only, Tool-First)
 

package/.agents/workflows/audit-to-stories.md

@@ -26,7 +26,7 @@ They remain read-only emitters of audit reports.
 
 1. At least one `audit-*-results.md` file under
    `temp/audits/` (or the path passed as the argument). Run a
-   `/audit-<dimension>` or `/audit-fan-out` first if none are present.
+   `/audit-<dimension>` first if none are present.
 2. `GITHUB_TOKEN` or `gh auth status` clean — the dedupe and create
    steps both call GitHub.
 3. The `audit::<dimension>` label taxonomy bootstrapped via
@@ -37,8 +37,7 @@ They remain read-only emitters of audit reports.
 
 `/audit-to-stories [audit-file-or-glob]`
 
-- No argument → scans `temp/audits/audit-*-results.md`. The roll-up
-  report `audit-fan-out-results.md` is intentionally skipped.
+- No argument → scans `temp/audits/audit-*-results.md`.
 - Single file path or glob → restricts the scan to that input.
 
 ## Phase 1 — Discover & parse
@@ -46,15 +45,11 @@ They remain read-only emitters of audit reports.
 Run the CLI in `--scan` mode against the resolved glob. It parses every
 finding block, normalises the fields (`Severity` / `Impact` are
 both recognised; `Dimension` / `Category` likewise), and extracts file
-paths mentioned in the body. A `###` heading that carries no severity axis and
-holds `####` blocks is read as a **grouping header**: its `####` children are
-the findings, and the header itself never becomes one. It then stamps each
-finding with a stable sha1 fingerprint via the shared
+paths mentioned in the body, and stamps each finding with a stable sha1
+fingerprint via the shared
 [`lib/findings/route-finding.js`](../scripts/lib/findings/route-finding.js)
-helper (`fingerprintFinding`) — the single dedup/route implementation
-shared with `qa-explore`. The workflow carries **no** separate inline
-fingerprint or dedup code; identity, footer round-trip, and routing all
-flow through that one module.
+helper (`fingerprintFinding`) — the single dedup/route implementation shared
+with `qa-explore`; carry no separate inline fingerprint or dedup code.
 
 ```bash
 node .agents/scripts/audit-to-stories.js --scan \
@@ -69,13 +64,10 @@ rather than re-parsing the reports.
 **The tally cross-check is automatic.** Every report declares
 `Severity tally: Critical <n> / High <n> / Medium <n> / Low <n>` in its
 Executive Summary; the scan compares that line with what it parsed and carries
-each disagreement on `summary.reportFailures[]` as
-`{ sourceReport, kind, reported, parsed }`. The kinds are `missing-tally` (no
-line), `tally-mismatch` (line and parse disagree), and `unresolved-severity` (a
-finding whose severity did not resolve — dropped from grouping, never filed as
-an `unknown` group). They print to stderr before `--scan` returns its plan, so
-a mis-parsed report is never read as a clean audit: re-run the lens rather than
-file from it. Over older reports predating the mandate,
+each disagreement on `summary.reportFailures[]` (`missing-tally`,
+`tally-mismatch`, `unresolved-severity`), printed to stderr before `--scan`
+returns its plan. A mis-parsed report is never a clean audit: re-run the lens
+rather than file from it. Over older reports predating the mandate,
 `--scan --allow-missing-tally` downgrades **only** `missing-tally` to a
 warning.
 
@@ -192,13 +184,9 @@ alone leaves a plan-path Story invisible — and records each Story's
 carries every fingerprint, so an owner would be a coin flip; persist says so on
 stderr. Author per-Story `provenance` to record them.
 
-This is deliberately not an authoring step. It used to be: the footers reached
-the seed and stopped there, leaving the authoring agent to notice HTML comments
-in a one-pager and copy them forward — a remembered step, which is to say no
-step at all. Stories filed on the recommended path were therefore invisible to
-the next sweep's Phase 6 dedup, which re-filed work it had already planned. If
-you find yourself copying a footer by hand, the carry is broken — fix it there
-rather than papering over it in the body.
+This is deliberately not an authoring step. If you find yourself copying a
+footer by hand, the carry is broken — fix it there rather than papering over it
+in the body.
 
 ## Phase 5b — Standalone-Stories path
 
@@ -226,9 +214,9 @@ Labels applied:
   (cross-audit groups carry multiple).
 - `risk::high` — added when any finding in the group is Critical.
 
-**No `agent::` state label, deliberately.** The filer used to emit
-`agent::ready`, which is exactly what `/mandrel-deliver` reads as "available
-for pickup" — and these bodies are audit prose, not a delivery-ready Spec. A
+**No `agent::` state label, deliberately.** `agent::ready` is what
+`/mandrel-deliver` reads as "available for pickup", and these bodies are audit
+prose, not a delivery-ready Spec. A
 Story with no `agent::` label is a legal initial state; `/mandrel-plan` stamps
 `agent::ready` as its terminal flip once the finding has become a scoped
 capability slice. Do not re-add it here or apply it by hand at create time.
@@ -425,8 +413,7 @@ The routine shape is **lenses full-scope → dry-run → live with a ledger PR**
 3. `--auto --ledger-commit` once the tallies stop surprising you.
 
 `--auto` runs with **no interactive gates**: it resolves the severity floor
-from `delivery.auditToStories.severityFloor` (default `high`, overridable with
-`--severity`), applies the two-stage dedup, reconciles the cross-run ledger,
+from `--severity` (default `high`), applies the two-stage dedup, reconciles the cross-run ledger,
 and prints a run-summary JSON (create / skip-open / skip-reoccurring /
 suppressed-by-ledger tallies, the `create`-classified group keys the `--ids`
 map is built from, plus the re-detected open Issue numbers an operator may want

package/.agents/workflows/audit-ux-ui.md

@@ -6,9 +6,7 @@ description: Audit UX/UI consistency and design system adherence
 
 You are a Lead Product Designer & Frontend Architect evaluating the frontend for
 UI consistency, UX best practices, and adherence to the project's design system,
-ensuring the app feels premium and cohesive. The shared lens machinery —
-read-only constraint, scope interpretation, report envelope + finding-block
-skeleton, severity scale, self-cross-check, and execution strategy — lives in
+ensuring the app feels premium and cohesive. The shared lens machinery lives in
 [`helpers/audit-lens-core.md`](helpers/audit-lens-core.md). Write the report to
 `{{auditOutputDir}}/audit-ux-ui-results.md`. Dimension values:
 `Visual Consistency | UX Best Practices | Accessibility`; the report adds a
@@ -23,7 +21,7 @@ description for how applicability is probed from the consumer's checkout.
 
 ## Scope
 
-Interpret this lens's change-set fence per the core's Scope interpretation:
+Per the core's Scope interpretation:
 
 ```text
 {{changedFiles}}
@@ -31,9 +29,8 @@ Interpret this lens's change-set fence per the core's Scope interpretation:
 
 ## Execution strategy
 
-Run this lens as a single `subagent_type: auditor` dispatch returning the report
-path + Executive Summary; sequential inline execution is the fallback (see the
-core's Execution strategy).
+Run this lens as one `subagent_type: auditor` dispatch per the core's
+Execution strategy.
 
 ## Step 0: Discover the design-system SSOT (run first)
 

package/.agents/workflows/helpers/audit-lens-core.md

@@ -152,7 +152,7 @@ Treat the following as **out of scope by construction** and drop any finding
 that rests on one of them:
 
 - **Sanctioned test seams** — exports consumed only by tests, and other
-  patterns the `test-seams` rule blesses. Never a production defect.
+  deliberate test-only patterns. Never a production defect.
 - **Entry points & public API surface** — CLI mains, `bin/` scripts, declared
   `exports` / `bin` / `main`, and barrel contracts consumed out-of-tree. A
   zero in-repo consumer count is not death.

package/.agents/workflows/helpers/code-quality-guardrails.md

@@ -5,11 +5,11 @@ this framework cites. Reviewers, prescriptive auditors, and writing agents all
 read the same numbers from here so a "high cyclomatic complexity" finding in
 `/audit-clean-code` and a pre-commit refusal cite the same threshold.
 
-> Tunable via `delivery.quality.codingGuardrails` in `.agentrc.json` —
-> see [`agentrc-reference.json`](../../docs/agentrc-reference.json) for the framework
-> defaults and [`schemas/agentrc.schema.json`](../../schemas/agentrc.schema.json)
-> for the validated shape. Override per-project; never fork this helper to
-> change a number.
+> The cyclomatic thresholds are fixed framework constants (Story #5382 folded
+> the never-set `delivery.quality.codingGuardrails` block); the MI tolerance
+> is `delivery.quality.gates.maintainability.tolerance` — see
+> [`agentrc-reference.json`](../../docs/agentrc-reference.json). Never fork
+> this helper to change a number.
 
 ## At-keyboard verification
 
@@ -28,14 +28,14 @@ hook calls the same script.
 
 Cyclomatic complexity (CC) is measured per function by `escomplex` (the same
 engine the maintainability axis of `check-baselines.js` runs). Two
-thresholds — the advisory `delivery.quality.codingGuardrails.cyclomaticFlag`
-and the fixed ceiling of 12 (`cyclomaticMustFix` was retired as a config
-key in Story #5313):
+thresholds — the advisory flag of 8 and the fixed ceiling of 12, both
+constants (`cyclomaticMustFix` was retired as a config key in Story #5313,
+`cyclomaticFlag` in Story #5382):
 
 | CC range | Action |
 | --- | --- |
 | ≤ 8 | Pass — no annotation required. |
-| > 8 (default `cyclomaticFlag`) | **Flag** — `quality:preview` counts the function in its `new-method count over c=<flag>` column. The function is allowed to land but the report names it. |
+| > 8 (the advisory flag) | **Flag** — `quality:preview` counts the function in its `new-method count over c=<flag>` column. The function is allowed to land but the report names it. |
 | ≥ 12 | **Advisory in `quality:preview`** — listed by file, method and reading; the preview exits 0 on it. **Ratchet in `check-cyclomatic.js`**: fails when a file gains a function above 12, or when its worst function gets worse than the recorded baseline. |
 
 `check-cyclomatic.js` is a **ratchet**, not a cliff: `baselines/cyclomatic.json`
@@ -57,11 +57,8 @@ source under `tests/<mirrored-path>/<basename>.test.js`. Same-commit pairing
 keeps the bisect honest — a regression and the test that would have caught
 it land or revert together.
 
-When `delivery.quality.codingGuardrails.requireSiblingTest` is `true`,
-the pre-commit hook refuses to commit a staged new source file that
-lacks a sibling test. Default is `false` so legacy repos opt in
-deliberately; once enabled, the structural check replaces the
-review-time prose rule.
+No structural check enforces the pairing — it is a review-time rule
+(Story #5382 removed the never-read `requireSiblingTest` switch).
 
 ## Maintainability-Index drop refactor rule
 
@@ -84,7 +81,7 @@ the commit lands (scoped to `HEAD` by default — the alias passes no
 Renaming a file (or moving it across `src/` directories) detaches its MI and
 CRAP history from the baseline keys. The correct response is a **baseline
 refresh**, not a regression entry: include `baseline-refresh:` (the
-`delivery.quality.crap.refreshTag` default) in the commit subject so the
+fixed refresh tag) in the commit subject so the
 ratchet treats the new key as a clean entry instead of comparing it to
 nothing.
 

package/.agents/workflows/helpers/deliver-digest.md

@@ -103,10 +103,12 @@ Per-round mechanics: [`acceptance-self-eval.md`](acceptance-self-eval.md).
 
 ## 5. The one credited suite run
 
-After the self-eval loop's last fix commit, run the suite **once** in the
-worktree through the depositor — it spawns the project's own `npm test`,
-whatever that resolves to, and stamps the result, so any runner earns the
-credit:
+After the self-eval loop's last fix commit, fetch and merge
+`origin/<baseBranch>` into the Story branch **first**, ahead of this run and
+the push: close's base-sync then no-ops, so neither stamp goes stale. Then
+run the suite **once** in the worktree through the depositor — it spawns the
+project's own `npm test`, whatever that resolves to, and stamps the result,
+so any runner earns the credit:
 
 ```bash
 node <main-repo>/.agents/scripts/evidence-gate.js --standalone \