mirror-mind 0.0.1 → 0.32.1

package/docs/releases/v0.31.10.md

@@ -0,0 +1,118 @@
+---
+digest: >
+  v0.31.10 gives local consumers and installed extensions a secure, deterministic,
+  versioned way to read Journey operational state without gaining mutation
+  authority. Mirror now implements mirror.journey-projections@1.0 in the Python
+  Core with registered-root confinement, linearizable publication, immutable
+  receipts, a namespace-bound Extension API 1.1, deterministic Ariad compilation,
+  and post-commit lifecycle refresh. The unchanged consumer-owned black-box probe
+  passes against isolated synthetic state; release acceptance remains explicit
+  through installed-runtime verification and a consumer-owned return record.
+---
+
+# v0.31.10 — Journey Projection Contract
+
+**Date:** 2026-08-25
+
+## Highlights
+
+- Implements public contract `mirror.journey-projections@1.0` in the Python Core.
+- Adds `journey-projection capabilities`, `rebuild-operational`, and `inspect`,
+  with isolated test-only preparation/publication routes for the immutable
+  consumer probe.
+- Publishes projection and manifest state with one cross-process lock per Journey,
+  fresh manifest merge under lock, atomic replacement, last-valid preservation,
+  explicit divergence, and immutable snapshot receipts.
+- Adds Extension API `1.1` with `api.journey_projections`, permanently bound to
+  the installed extension's identity; extensions cannot select `ariad`, another
+  namespace, or a filesystem root.
+- Compiles Ariad roadmap, active Delivery work, public Explorer handoffs, and
+  canonical Refinement state into deterministic `ariad:operational` documents.
+- Refreshes represented state after source commits without making projection
+  availability a transaction dependency or rolling durable truth back.
+- Passes the unchanged consumer-owned probe with exact normative fixture parity,
+  schema/path/namespace attack rejection, atomic consistency, and no production
+  data.
+
+## Where We Started
+
+Nautilus needed a stable local reading of Journey state, but Mirror had only
+human-facing Markdown and runtime records. A consumer could either parse internal
+files directly, depend on private implementation details, or ask Mirror to
+surrender mutation authority. None was acceptable. The handoff therefore began
+with a consumer-owned contract and acceptance kit rather than a Mirror-owned API
+proposal.
+
+The central tension was authority. Ariad documents and lifecycle records had to
+remain the source of truth, extensions had to remain inside their own namespaces,
+and production callers could identify a Journey but never choose a filesystem
+root. At the same time, concurrent Core and extension publishers needed one
+consistent manifest rather than a collection of atomic files with lost-update
+races between them.
+
+## What Changed
+
+Mirror adopted the contract in layers. Public models, JSON Schema 2020-12
+validation, canonical UTF-8 serialization, stable payload-free errors, and honest
+capability discovery established the boundary first. The storage kernel then made
+publication linearizable per Journey across processes. Every writer acquires the
+same Journey lock, rereads the current manifest after acquisition, verifies or
+creates an immutable receipt, replaces the projection, and makes manifest
+replacement the publication linearization point. Controlled failures restore the
+previous pair when possible; unrecoverable states surface bounded divergence and
+inspection never repairs implicitly.
+
+Extension API `1.1` exposes that kernel through a façade bound at construction to
+`extension_id`. Envelope namespace and producer identity must match that binding,
+and `ariad` remains Core-only. A raw extension database connection grants no
+projection filesystem authority.
+
+The Ariad compiler reuses shared roadmap grammar and emits only represented,
+public durable state. Authored hierarchy order is preserved. Artifact paths are
+Journey-relative and confined. Explorer source conversations, prompts, raw
+reasoning, environment state, transcript bodies, and private narrative evidence
+are excluded. `sourceRevision` fingerprints projected content, so excluded data
+cannot perturb consumer identity.
+
+Lifecycle refresh is deliberately a post-commit observer. Delivery artifacts are
+refreshed only after their files exist; Explorer public state is projected only
+through durable confined handoffs; Refinement stays document-first. Equal source
+revisions are quiet. Compiler or publication failure cannot roll back the source
+mutation that already succeeded.
+
+Finally, the complete command surface was exercised by the unchanged external
+probe against a fresh isolated home. Fixed fixture identities exist only behind
+strict test-mode guards. The probe proved capability discovery, isolated
+preparation, exact Operational content, inspection, extension publication,
+last-valid preservation, traversal/namespace refusal, and atomic consistency.
+
+## Conscious Exclusions
+
+- No Tactical or Strategic interpretation is implemented by Mirror Core.
+- No projection write-back, implicit repair, semantic synthesis, model call, or
+  network dependency enters compilation or publication.
+- No caller-supplied production root and no extension-selected namespace.
+- No TypeScript implementation while CV22 remains paused; Python is the sole
+  product authority for this contract.
+- No production schema migration is required.
+- The release does not authorize Nautilus projection work until its consumer-owned
+  installed-runtime return record opens the gate.
+
+## What We Learned
+
+Atomic replacement alone is not a concurrency model. A trustworthy read-model
+contract needs a clear linearization point, fresh state under exclusion, immutable
+identity evidence, and an explicit posture for the narrow interval where one file
+has moved and another has not.
+
+Consumer-owned acceptance also sharpened the product boundary. By keeping the
+probe immutable and external, Mirror could choose its architecture freely while
+remaining unable to weaken the observable contract to fit its implementation.
+
+## Next Horizon
+
+With the installed-runtime return accepted, local consumers can build against the
+Operational projection and extensions can publish their own versioned readings.
+Tactical and Strategic meaning remains consumer/extension work. CV22 may later
+port the observable command contract when its paused TypeScript migration resumes,
+but no dual-authority obligation is created by this release.

package/docs/releases/v0.31.11.md

@@ -0,0 +1,88 @@
+---
+digest: >
+  v0.31.11 corrects Operational link confinement without weakening the Journey
+  security boundary. Authored parent-relative Markdown links now resolve from
+  their containing document and compile only when the canonical target remains
+  inside the registered Journey root. Real escapes, absolute and URI-like
+  targets, Windows separators, symlink escapes, and missing-target publication
+  failures remain bounded, while the last valid projection pair is preserved.
+---
+
+# v0.31.11 — Confined Operational Relative Links
+
+**Date:** 2026-08-26
+
+## Highlights
+
+- Accepts one-level and multi-level parent-relative Ariad roadmap links when the
+  canonical target remains inside the registered Journey.
+- Preserves normalized Journey-relative projection paths and confined directory
+  links resolving to `index.md`.
+- Continues rejecting canonical escapes, absolute paths, URI-like targets,
+  backslash-based paths, and directory or file symlinks escaping the Journey.
+- Preserves the previous valid Operational document and manifest when a confined
+  target is missing or compilation otherwise fails before publication.
+- Adds an isolated public-CLI regression matching the Nautilus capability package
+  linking to a root-level Delivery Story.
+
+## Where We Started
+
+Nautilus adopted `mirror.journey-projections@1.0` from v0.31.10 and immediately
+exercised a legitimate roadmap topology the normative synthetic fixture did not
+contain: a capability package linked back to a root-level Delivery Story through
+`../ds-001/index.md`. Mirror rejected the lexical `..` segment before asking
+whether the resolved file remained inside the registered Journey.
+
+The source Ariad mutation still committed and the projection kernel correctly
+preserved the previous valid pair. That safety posture prevented corruption, but
+left the Operational snapshot stale and blocked Tactical and Strategic consumers
+from claiming ancestry from current truth.
+
+## What Changed
+
+`OperationalCompiler` now resolves a relative source target from the containing
+document before classifying its safety. Canonical Journey-root confinement, not
+the mere presence of a parent segment, is the authority. Existing target and
+symlink components are canonicalized; a result outside the registered root still
+returns the structured `unsafe_projection_path` error without leaking a host
+path.
+
+A missing target whose unresolved canonical location remains inside the Journey
+continues to return a bounded source-compilation failure. Directory targets still
+resolve only to a confined `index.md`. Publication remains exclusively owned by
+the existing per-Journey linearizable kernel, so compiler failure cannot replace
+the last valid projection or manifest.
+
+The regression matrix covers same-directory links, one and multiple confined
+parent segments, confined directories, canonical escape, absolute path, file URI,
+Windows separator, file and directory symlink escape, missing target, and
+last-valid preservation. A guarded isolated public rebuild reproduces the exact
+CV-to-root-DS shape that exposed the defect.
+
+## Conscious Exclusions
+
+- No Nautilus-specific semantics enter Mirror Core.
+- No Tactical or Strategic schema or synthesis behavior changes.
+- No roadmap links are rewritten as a workaround.
+- No projection namespace, atomicity, receipt, or publication rule changes.
+- No TypeScript parity work while CV22 remains paused.
+
+## What We Learned
+
+Lexical traversal and boundary escape are not equivalent. Rejecting every `..`
+looks conservative, but it substitutes syntax for authority and can make valid
+repository structure unavailable. The secure question is where the canonical
+existing target resolves, followed by an explicit root-boundary and file-type
+check.
+
+Consumer-owned acceptance remains valuable precisely because it supplies real
+shapes rather than implementation assumptions. The v1 contract was secure, but
+its first fixture did not represent this topology; Nautilus exposed the missing
+case without requiring Mirror to absorb consumer semantics.
+
+## Next Horizon
+
+After the installed Nautilus rebuild advances `operational.json` and its manifest
+to current Ariad truth, Nautilus can close TD-001 and resume explicit Tactical
+and Strategic synthesis over a current Operational ancestor. The consumer return
+remains the final gate; source-only success is insufficient.

package/docs/releases/v0.31.12.md

@@ -0,0 +1,105 @@
+---
+digest: >
+  v0.31.12 makes authority boundaries explicit across Builder orchestration and
+  Journey administration. Natural or cadence-declared delegation can authorize
+  one exact story Plan without weakening the mandatory Navigator Validation
+  gate, while Driver-authored Plans remain preserved and implementable. Release
+  intent is now durable context rather than permission to publish. A versioned,
+  model-free Journey mutation service adds transactional hierarchy changes, and
+  Delivery Story Done now refuses to claim coherence until authored roadmap
+  status is actually aligned.
+---
+
+# v0.31.12 — Bounded Authority and Journey Integrity
+
+**Date:** 2026-08-29
+
+## Highlights
+
+- Accepts natural one-turn story Plan delegation in stepwise/checkpoint cadence
+  and declarative bounded story authority in accelerated cadence.
+- Preserves exact active-item, generation, level, expiry, single-use, and
+  concurrency boundaries while keeping Navigator Validation mandatory.
+- Keeps Driver-authored Plan bodies intact through approval and distinguishes a
+  Delivery Story's release intent from commit, push, tag, and publication
+  authority.
+- Adds `mirror.journey-mutation@1.0`, a deterministic and model-free service for
+  transactional Journey creation, update, movement, ordering, and guarded
+  removal.
+- Refuses Delivery Story Done before cursor or artifact mutation when authored DS,
+  child, candidate-row, or canonical roadmap status remains non-Done.
+
+## Where We Started
+
+Ariad's safe defaults had become too literal. Even when the Navigator naturally
+asked for a Plan and immediate implementation, story-by-story flow stopped for a
+second approval; accelerated cadence carried no declarative policy for that same
+boundary. The first implementation also risked replacing a useful Driver-authored
+Plan at approval time, and release intent could be mistaken for authority to
+publish.
+
+At the same time, Journey hierarchy mutation still depended on scattered storage
+operations rather than one versioned, model-free transactional contract. The
+CV20.DS16 closure then exposed a final trust defect: `done-delivery-story` could
+render “Closure coherence passed” while authored roadmap files still said `In
+Progress`.
+
+## What Changed
+
+Story Plan preauthorization now records bounded structural authority for one
+exact active User or Technical Story. Natural delegation can create and approve a
+complete Plan in one flow for stepwise/checkpoint work; accelerated cadence reads
+`plan_approval_policy=bounded_story_authority` from method data instead of
+receiving authority from a hard-coded profile name. Receipts are generation-bound,
+single-use, atomic under concurrent attempts, and never cross Navigator
+Validation. The completeness classifier recognizes actual scaffold markers
+without treating legitimate domain prose such as “Payment placeholder” as an
+unfinished Plan.
+
+Plan approval no longer regenerates or overwrites an authored Plan. Release intent
+is persisted and rendered as orientation, but its contract explicitly grants no
+commit, push, tag, stable-promotion, or publication authority.
+
+`JourneyAdminService` introduces the versioned `mirror.journey-mutation@1.0`
+contract. It exports deterministic registry state and performs hierarchy writes
+transactionally without model calls. Parent changes, sibling ordering, protected
+historical associations, and projection refresh ordering are checked before a
+mutation can leave an orphaned or partially moved Journey.
+
+Delivery Story closure now performs a read-only authored-roadmap preflight before
+calling the mutating Done core. Existing packages resolve through heading-based
+story identity. Explicit DS and child package statuses, child candidate rows, and
+canonical Code/Status table rows must already report Done; otherwise the command
+returns project-relative evidence, leaves the cursor unchanged, and creates no
+Done artifact. The agent retains semantic ownership of Markdown edits.
+
+## Conscious Exclusions
+
+- Natural Plan delegation does not bypass Navigator Validation, broaden to a
+  different story, survive generation mismatch, or authorize external effects.
+- Release intent does not authorize commit, push, merge, tagging, stable
+  promotion, GitHub publication, or installation.
+- Python verifies authored closure status but does not rewrite roadmap prose or
+  infer project meaning.
+- Journey mutation remains a local Core contract; it adds no hosted service,
+  synchronization protocol, model-based planning, or destructive cascade.
+- The four pre-existing repository-wide Ruff findings under
+  `spikes/ts-search-parity/` are unchanged.
+
+## What We Learned
+
+Good autonomy is not the absence of checkpoints. It is authority represented at
+the right granularity: exact scope, explicit policy, bounded lifetime, atomic
+consumption, and a visible hard stop where human judgment still matters.
+
+Coherence must also be proven from authored state rather than inferred from a
+runtime transition. A Done surface earns trust only when it refuses to speak
+more strongly than the files and cursor allow.
+
+## Next Horizon
+
+CV20 can continue refining Ariad's remaining release/push and debt-loop behavior
+on top of explicit authority contracts. Journey consumers can adopt the versioned
+mutation service without coupling hierarchy administration to model behavior.
+The next release boundary should remain driven by a completed story or
+maintenance need rather than by this horizon alone.

package/docs/releases/v0.31.13.md

@@ -0,0 +1,99 @@
+---
+digest: >
+  v0.31.13 gives external shells one explicit, generic boundary for appending
+  externally identified messages to an exact Mirror conversation. The contract
+  is atomic and idempotent, guards Journey ownership, and remains independent of
+  runtime-session routing and conversation lifecycle inference. The release also
+  repairs Ariad Coherence reentry after evidence correction and closes the lazy
+  SQLite WAL recovery defect that blocked this candidate. No model pin or prompt
+  changed, so the model-behavior eval gate is not activated.
+---
+
+# v0.31.13 — Explicit Append and Lifecycle Recovery
+
+**Date:** 2026-08-29
+
+## Highlights
+
+- Adds the public `conversations append` JSON interface for exact-destination,
+  externally identified message appends.
+- Commits each batch atomically, classifies canonical-equivalent retries as
+  idempotent, and rejects divergent or cross-conversation message-ID reuse.
+- Requires exact Journey ownership without consulting runtime sessions,
+  generations, recent activity, or conversation-logger state.
+- Allows explicit late append to ended conversations without reopening them or
+  rerunning extraction, summaries, titles, tags, embeddings, or other semantic
+  refresh.
+- Lets Ariad rerun a pending Coherence checkpoint after evidence correction and
+  completes D-016's lazy SQLite WAL recovery fallback.
+
+## Where We Started
+
+External shells could not durably reconcile messages into one known Mirror
+conversation through a generic public boundary. Reusing runtime-session or
+conversation-logger behavior would have coupled explicit persistence to recency,
+generation, lifecycle inference, and downstream-specific assumptions. The work
+also exposed two independent runtime defects: a Coherence checkpoint could create
+`navigator_coherence` without any legal reentry, and SQLite 3.51 could defer a
+read-only WAL-sidecar failure until the first schema query, outside the existing
+fallback guard.
+
+## What Changed
+
+`conversations append` accepts a strict versioned JSON request on stdin and
+resolves only the complete caller-supplied conversation ID. It validates bounded
+message IDs, roles, canonical timestamps, UTF-8 content and metadata limits,
+batch size, and exact Journey equality before entering one storage-owned
+`BEGIN IMMEDIATE` transaction. Caller message IDs are the idempotency authority:
+canonical-equivalent retries return `existing`; divergent or cross-conversation
+reuse rejects the whole batch. Receipts and failures remain bounded and never
+echo message bodies or metadata.
+
+The append boundary does not read or mutate runtime sessions and does not route
+by generation, recency, or active logger state. Explicit append remains valid
+after `ended_at` is populated, but it does not reopen the conversation or rerun
+memory extraction, summary, title, tag, embedding, or other semantic state.
+Message reads now order deterministically by `created_at, id`.
+
+Ariad Coherence now permits reentry only for the exact pair
+`pending_confirmation=navigator_coherence` and
+`last_delivery_event=coherence`. Corrected evidence is re-evaluated normally;
+unrelated or inconsistent pending confirmations remain blocked, and Done never
+consumes the Coherence confirmation.
+
+D-016 is Paid. `_connect_read_only()` performs one minimal schema read after
+opening `mode=ro`; if and only if that read raises the exact expected
+`unable to open database file` operational error, it closes the connection and
+reopens the existing database with `mode=rw` so SQLite can recover WAL sidecars.
+Missing databases are never created, unrelated SQLite errors propagate, and the
+normal read-only path does not fall back.
+
+## Conscious Exclusions
+
+- The append interface does not generate caller message IDs, infer destinations,
+  route through runtime sessions, or reuse conversation-logger semantics.
+- Late append does not trigger semantic re-extraction or refresh. Downstream
+  consumers remain responsible for any separate reconciliation policy.
+- Ended conversations are not reopened and lifecycle timestamps are not changed.
+- D-006 remains the pre-existing project-wide mypy baseline; this release adds no
+  typing regression and does not claim that debt is paid.
+- No model pin or prompt changed. The model-behavior `eval --all` release gate is
+  therefore not activated.
+- Release preparation does not authorize push, tagging, stable promotion, GitHub
+  Release publication, or production update.
+
+## What We Learned
+
+An explicit persistence boundary is safest when identity, destination, ordering,
+and retry authority come from the caller while lifecycle inference stays out of
+the transaction. Recovery flows need the same precision: a runtime must not only
+represent a pending checkpoint or fallback condition, but also provide one
+bounded path that can legally resolve it.
+
+## Next Horizon
+
+After the candidate commit and central verification are authorized, the release
+can proceed through its separate tag, stable-promotion, GitHub publication, and
+installed-runtime acceptance gates. External-shell consumers can then adopt the
+append contract without coupling their reconciliation logic to Mirror runtime
+sessions.

package/docs/releases/v0.31.14.md

@@ -0,0 +1,97 @@
+---
+digest: >
+  v0.31.14 adds the public Ariad Workbench `change-request resume` verb so a
+  non-terminal Change Request that lost the active pointer can continue without
+  direct SQLite edits or artificial status regression. The release closes CR011
+  from RS003 after a Nautilus Harness production reproduction showed an
+  implemented CR stranded behind a completed sibling. Resume preserves the CR
+  record and updates only the Refinement cursor, allowing implemented CRs to
+  validate and validated CRs to receive a Done note. No schema migration, model
+  pin, or prompt changed.
+---
+
+# v0.31.14 — Change Request Resume
+
+**Date:** 2026-08-30
+
+## Highlights
+
+- Adds `uv run python -m memory build change-request resume --journey <slug> --change-request-id <cr-id>`.
+- Restores the active pointer for non-terminal advanced Change Requests without changing their status, evidence, timestamps, RS link, or provenance.
+- Lets resumed `implemented` CRs proceed to `validate` and resumed `validated` CRs proceed to `done` through the existing public lifecycle.
+- Refuses `captured` CRs with guidance to use `select`, and refuses terminal CRs (`done`, `parked`, `rejected`, `promoted`).
+- Documents the command in the runtime reference and Pi Builder skill guidance, with deterministic `REFINEMENT_FLOW_EVENT` rendering for `CR RESUMED`.
+
+## Where We Started
+
+A real Nautilus Harness production Workbench reached a stranded state. RS012 had
+CR028 in `implemented`. A sibling CR030 was selected, implemented, validated, and
+marked `done`, which correctly cleared the active Change Request pointer. When
+the Navigator later validated CR028, `change-request validate` refused with
+`Error: active Change Request is required`; trying to reselect it refused with
+`Error: cannot select from status 'implemented'; expected captured`.
+
+The Workbench had no public operation to make a non-terminal advanced CR active
+again. The only alternatives were wrong: direct SQLite editing, which violates
+the public authority boundary, or artificial status regression, which corrupts
+the lifecycle record.
+
+## What Changed
+
+`change-request resume` is a narrow recovery primitive. It resolves the requested
+CR through the same Journey and active Refinement Story authority guards as the
+ordinary CR lifecycle, then updates only the Refinement cursor. The Change
+Request row is not rewritten: status, outcome notes, evidence, timestamps,
+position, source, provenance, and RS linkage remain intact.
+
+The verb accepts advanced non-terminal states, including `active`, `planned`,
+`implemented`, and `validated`. That preserves the one-active-CR invariant while
+letting a stranded item return to the correct lifecycle point. A resumed
+`implemented` CR can run `change-request validate`; a resumed `validated` CR can
+run `change-request done`.
+
+The release intentionally keeps `select` strict. `select` starts a captured CR
+and changes its status to `active`; overloading it for recovery would hide the
+difference between beginning work and restoring lost focus. `resume` names the
+recovery act explicitly.
+
+Ariad surfaces now render `change_request_resumed` as a `REFINEMENT_FLOW_EVENT`
+with stage-aware ribbon placement and next-move guidance. Tests cover the
+required two-CR reproduction: CR A reaches `implemented`, CR B reaches `done` and
+clears the pointer, CR A resumes without row mutation, validates, and completes.
+Additional tests prove `validated` resumes to Done and terminal CRs cannot
+resume.
+
+## Conscious Exclusions
+
+- No schema migration was added. This is a cursor recovery verb, not a redesign of
+  per-CR phase storage.
+- The release does not make multiple Change Requests active concurrently.
+- Broader revisable lifecycle work in RS003 remains outside this patch: CR010,
+  CR012, and CR013 are still captured.
+- D-014 remains Carried as a pre-existing runtime-diagnose web-test polling
+  budget issue. It reproduced on the parent commit as well as this release
+  candidate and is not caused by CR011.
+- A one-off process-death lock failure from the complete-suite run was not
+  reproduced in isolation on either HEAD or the parent commit; no new debt is
+  recorded without further evidence.
+- No model pin or prompt changed. The model-behavior `eval --all` release gate is
+  therefore not activated.
+- Release preparation does not authorize push, PR, merge, tagging, stable
+  promotion, GitHub Release publication, or production runtime update.
+
+## What We Learned
+
+A lifecycle that stores active work in one cursor slot needs an explicit recovery
+vocabulary. Terminal exits already had public verbs because real refinement work
+moves unevenly; resumption deserves the same public boundary. The safe version is
+small and explicit: preserve the record, restore the cursor, and let the ordinary
+status-driven lifecycle continue.
+
+## Next Horizon
+
+After local release preparation is accepted, publish this as a dedicated patch
+release because it unblocks a production consumer without coupling to unrelated
+Workbench work. The exact publication sequence remains separate: push to `main`,
+verify GitHub Actions, tag `v0.31.14`, promote `stable`, publish the GitHub
+Release, and only then update production runtimes through the safe updater.

package/docs/releases/v0.31.2.md

@@ -0,0 +1,115 @@
+---
+digest: >
+  v0.31.2 is a maintenance patch that stops the Ariad Builder runtime from
+  crashing on long document content. `build pull-item` on a Delivery Story
+  raised OSError [Errno 63] (File name too long) whenever a candidate story
+  title was paragraph-length, because the kebab slug used for the roadmap
+  folder had no length cap. The fix consolidates four drifted `_slugify`
+  copies into one accent-stripping, length-capped `memory.utils.kebab_slug`,
+  which also closes the identical latent crash in the Explorer handoff writer
+  and makes the roadmap package writer and locator derive the same path by
+  construction. A five-persona review of the plan corrected the original
+  handoff's "single choke point" assumption and left code-cell sanitization
+  and the transcript-export slug sibling as recorded debt.
+---
+
+# v0.31.2 — Filesystem-Safe Slug Consolidation
+
+**Date:** 2026-07-22
+
+## Highlights
+
+- Fixes an `OSError [Errno 63] (File name too long)` crash in `build
+  pull-item` when a Delivery Story's candidate-story title is
+  paragraph-length: the roadmap folder slug now hard-caps at 80 characters,
+  well under the 255-byte filesystem `NAME_MAX`.
+- Consolidates four drifted kebab `_slugify` copies (`builder/lifecycle`,
+  `cli/build`, `services/explorer_handoff`, `services/journey`) into a single
+  `memory.utils.kebab_slug` — accent-stripping, kebab-case, length-capped.
+- Closes the *same* latent `mkdir` crash in the Explorer→Builder handoff
+  writer, which used `exist_ok=False` and would have failed harder on a long
+  handoff title.
+- Makes the roadmap package *writer* (`lifecycle`) and *locator* (`build`)
+  derive the same folder path by construction, removing a silent divergence
+  that capping only one copy would have introduced.
+- Empty-slug guard: an all-punctuation title now yields the bare code folder
+  (`ds-35-ts-1`) instead of a trailing-hyphen name (`ds-35-ts-1-`).
+- Records two conscious exclusions as debt: D-012 (the candidate-table *code*
+  cell is still not sanitized for path separators) and D-013 (the
+  `transcript_export` capped-kebab sibling stays separate).
+
+## Where We Started
+
+A separate Builder session pulling Delivery Story DS-37 hit a hard runtime
+crash. `build pull-item` ran `pull → prepare → expand`, and `expand` died
+inside `mkdir` with `OSError [Errno 63] (File name too long)`. The Delivery
+Story's candidate-stories table used full paragraphs as the "Story" cell, and
+the kebab slug that becomes the child package's directory name had no length
+cap — a ~650-character component against a 255-byte filesystem limit. The
+runtime must never crash on document content, so this was a robustness bug,
+not an authoring problem to be worked around by shortening a title.
+
+## What Changed
+
+The reported fix was a five-line length cap in one function. The review found
+that would have been wrong in a subtle way. There were four separate
+kebab-style `_slugify` implementations, and two of them —
+`builder/lifecycle.py` (which *writes* the roadmap package) and
+`cli/build.py` (which *locates* it) — derive the same folder path. Capping
+only the crashing one would have made the writer and the locator disagree.
+Meanwhile `services/journey.py` already carried the correct capped,
+accent-stripping version, and `services/explorer_handoff.py` held a third
+uncapped copy feeding a stricter `mkdir(exist_ok=False)`.
+
+So the fix became a consolidation. The correct algorithm was promoted to a
+single `memory.utils.kebab_slug` — strip accents, collapse to kebab-case,
+hard-cap at 80 characters — and all four callers now route through it. That
+one change fixes the DS-37 crash, closes the identical latent crash in the
+Explorer handoff writer, keeps the writer and locator consistent by
+construction, and adds accent-stripping to the two callers that lacked it. An
+all-punctuation title now produces the bare code folder rather than a
+trailing-hyphen name, matching the sibling path-derivation code that already
+handled the empty case.
+
+The plan was reviewed through five professional lenses — quality-assurance,
+database-architect, security-engineer, devops-engineer, and ai-engineer —
+before implementation. That review corrected the original handoff's premise
+(the "single choke point" was actually four choke points), confirmed the
+back-compat guarantee, and surfaced the two gaps now carried as debt.
+Back-compat was verified against the live repository: the longest existing
+roadmap slug is ~63 characters, under the 80 cap, and no existing folder ends
+in a hyphen, so no package path on disk changes. The change shipped test-first
+with unit coverage for `kebab_slug`, the empty-slug guard, both
+paragraph-title crash regressions, and a single-source consolidation guard.
+
+## Conscious Exclusions
+
+- **D-012 — code-cell sanitization.** `kebab_slug` hardened the folder
+  *title*, but the work-item *code* segment is still only lower-cased and
+  dot-replaced, so a crafted code cell with path separators remains a latent
+  traversal vector. Low severity today — candidate tables are Navigator-
+  authored and local — so it is recorded, not fixed here.
+- **D-013 — the fifth slugger.** `cli/transcript_export.slugify` is a
+  capped-kebab sibling with different semantics (public name, cap 50,
+  word-boundary truncation, `"conversation"` fallback) and stays separate;
+  `docs_lint.slugify` is a deliberately different GitHub-anchor slugger and is
+  not debt.
+- **No behavior change to journey slugs.** `kebab_slug` reproduces
+  `journey.py`'s prior output exactly, so journey creation and validation are
+  untouched.
+
+## What We Learned
+
+A handoff that framed the fix as a five-line, single-site cap was accurate
+about the crash and wrong about the blast radius. Reading the actual call
+graph before writing the cap turned a local patch into a consolidation that
+closed a second, unreported crash site and prevented a silent writer/locator
+divergence. The cheap correctness came from treating the handoff's "root
+cause" as a hypothesis to verify, not a conclusion to implement.
+
+## Next Horizon
+
+The two recorded debt items — code-segment sanitization (D-012) and the
+transcript-export slug sibling (D-013) — are the visible follow-ups the next
+time a change touches roadmap folder derivation or transcript export. The
+consolidation leaves a single, obvious place to make those improvements.