diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9175eb9ad..428811863 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,223 +9,114 @@ breaking changes may land in a minor release.
 
 ### Added
 
-- Add an epic-close `resolve` for tickets runs paused at `epic-boundary`: open
-  bmad-agent-po on the paused epic's closure check (`--no-interactive`: no session),
-  then resume only when the epic reads `done` or `dropped` and its epic folder has no
-  uncommitted change; never trust the session's exit code. Exit 1, still paused, on a
-  failed check (`epic-close-unverified`), a retrospective still owed, a missing
-  bmad-agent-po skill or a dev CLI with no interactive mode. Journal
-  `epic-close-session-start` / `-end` and `epic-close-verified`. TUI: `R`, and **Close
-  with bmad-agent-po** in the epic-closure viewer.
-- Add `resolve --at-reset [--margin-min N]`: for a usage-limit pause the coding CLI waits
-  out, wait in the foreground until the recorded reset plus the margin (default 2 min),
-  then re-arm and resume as `--no-interactive --resume`. Refuse (exit 1) credit
-  exhaustion, an unresolved reset and a reset past `[limits] quota_wait_max_min`, and,
-  after the wait, a pause other than the one waited on; Ctrl-C leaves the run paused
-  (exit 130). Journal the wait as `at-reset-wait-start` / `-end`.
-- Add the `adapter.launch-probe` check to `validate --probes`: for each distinct role
-  launch (roles with the same argv share one) whose `generic`-adapter profile declares
-  `parked_prompt_patterns`, launch the coding CLI once with no prompt, and fail when its
-  first screen shows a startup dialog an unattended session would park on. A profile
-  without patterns is reported and not launched; a screen the probe could not see is a
-  warning.
-- Add `limits.quota_wait_max_min` (default 300; 0 = off): while the visible pane shows
-  Claude Code waiting out a usage-window reset and the transcript is idle, freeze the
-  session timeout and hold the stall nudge, so the session finishes after the CLI's own
-  auto-continue. Past the cap, or when the parsed reset lies beyond it, pause with a
-  usage-limit reason. Surface the wait and the reset time in `heartbeat.json`
-  (`quota_waiting`, `quota_wait_s`, `quota_resets_at`), `session-end` (`quota_wait_s`,
-  `usage_limit_resets`), the journal (`quota-wait-*`), the pause reason
-  (`; resets <time>`) and the TUI header (`quota wait`).
 - Add the experimental `tickets` work source for BMAD v7 initiative ticket trees
   (`[stories] source = "tickets"`): dispatch `bmad-build-auto ticket <ref>` in initiative
   build order, verify each plan at `built`, and mark it `done` through `tickets.py mark`
-  (`[tickets] mark_done`, `thorough_review`). See `docs/tickets-guide.md`.
-- Support BMAD-METHOD v7 as of upstream main `61e01f82` (`6.13.0-next`; v7 is not yet
-  tagged). The contract tests run against `bmad-agent-po`'s `tickets.py` vendored at
-  that commit.
-- Resolve BMAD v7 config (`[core] output_folder`, `active_initiative`): a project with
-  `_bmad/method/scripts/tickets.py` resolves its artifacts to the active initiative
-  folder. New validate warnings `bmad-config.initiative-unset` and
-  `bmad-config.v6-keys-ignored`.
-- Validate tickets projects: the `tickets.*` preflight (script, config reader, uv, active
-  initiative, repo store, store topology; tracker stores and the multi-repo workspace
-  layout are refused), the dev skill's ticket route (`skills.tickets-dispatch*`), and
-  `tickets.py` under `--probes`. `validate --json` gains `initiative`, `era` and
+  (`[tickets] mark_done`, `thorough_review`). Supports BMAD-METHOD v7 as of upstream main
+  `61e01f82` (`6.13.0-next`; v7 is not yet tagged), in both the `tickets/` folder layout
+  and the preview-era flat layout. See `docs/tickets-guide.md`.
+- Resolve BMAD v7 config (`[core] output_folder`, `active_initiative`) to the active
+  initiative folder, and validate tickets projects: the `tickets.*` preflight (tracker
+  stores and the multi-repo workspace layout are refused), the dev skill's ticket route,
+  and `tickets.py` under `--probes`. `validate --json` gains `era`, `initiative` and
   `ticket_store`; `mode` gains `tickets`.
 - Pause tickets runs for a person: hitl tickets (`ticket-hitl`), tickets needing
-  refinement (`ticket-refine`), tree faults, foreign in-progress rows and a dirty
-  initiative folder (`ticket-tree`), plan and done checkpoints, and epic closure.
-- Follow upstream checkpoints: a refined `plan_checkpoint` waits for story-file approval
-  before dispatch, an unrefined one runs a `Halt after planning.` leg and pauses for plan
-  review, and `done_checkpoint` pauses after the ticket commits.
-- Run the epic retrospective (`/bmad-retrospective -H <epic-slug>`) when a run finishes
-  an epic, record its verdict, and pause at `epic-boundary` for a person to close the
-  epic with bmad-agent-po. A `rejected` verdict pauses every later pick while the epic
-  stays open; any other pauses once. A retrospective refused for a dirty tree, a git fault or a stop request
-  records no closure, so the resume runs it.
-- Park a ticket as `blocked` ("awaiting operator: …"), never `done`.
-  `bmad-loop confirm <ref>` marks it `done` through `tickets.py mark` once the actions
-  are done; `bmad-loop resolve <run-id>` re-arms an escalated ticket. A code rollback
-  re-arms its plan, and a timed-out review lands it at `built`.
-- Drive every repo-store layout: a store tracked in the code checkout is marked inside
-  the unit's commit; an ignored folder or a store in its own repository is marked after
-  the code lands (latched and replayed on resume), and a store repository gets plan-only
-  commits with `Bmad-Code-*` trailers, the `built` plan too under `mark_done = "never"`.
-  A store commit never overwrites a person's staged version of a path, even one deleted
-  from disk. A failed store commit is retried before the run finishes and pauses at
-  `ticket-tree` if still owed; a failed retrospective commit pauses at the epic boundary
-  before its closure, and the resume commits it. A store
-  inside a renamed project moves with it. `confirm` commits a store plan in the store's
-  own repository.
-- Add a `Bmad-Ticket:` trailer to tickets unit commits, plus `Bmad-Plan:` when the plan lies
-  inside the code checkout, and name worktree unit branches `bmad-loop/<run>/<epic-slug>/<ref>`.
-- Add tickets mode to `run --dry-run` (build order, dispatches, the first pause) and the
-  `run --epic` / `--story` selectors (an epic id or slug, a ticket ref).
+  refinement (`ticket-refine`), tree faults, a moved or missing in-flight ticket and a
+  dirty initiative folder (`ticket-tree`), `plan_checkpoint` / `done_checkpoint`, and
+  epic closure.
+- Run the epic retrospective when a tickets run finishes an epic, then pause at
+  `epic-boundary` until a person closes the epic: `bmad-loop resolve` opens bmad-agent-po
+  on it (`--no-interactive`: no session) and resumes only once the epic reads `done` or
+  `dropped` with its folder committed. A `rejected` verdict pauses every later pick while
+  the epic stays open. TUI: `R`, and **Close with bmad-agent-po** in the epic-closure
+  viewer.
+- Build a parent initiative's children one run each, in build order, under worktree
+  isolation: drained children are closed before every pick, one `--max-stories` budget
+  spans the chain, and `run --dry-run` and the TUI start-run preview show it.
+- Park a ticket owing human-only actions as `blocked`, never `done`, until
+  `bmad-loop confirm <ref>`; `bmad-loop resolve` re-arms an escalated ticket.
+- Mark ticket plans in every repo-store layout: a store tracked in the checkout inside the
+  unit's commit, an ignored folder or a separate store repository after the code lands.
+  Unit commits carry a `Bmad-Ticket:` trailer and worktree branches are named
+  `bmad-loop/<run>/<epic-slug>/<ref>`.
+- Show tickets in `run --dry-run`, `status`, `status --json` (`ticket` and `tickets`
+  objects) and the TUI (a tickets board, pause badges and viewers, a start-run preview and
+  **Request replan**); `run --epic` / `--story` take an epic id or slug and a ticket ref.
 - Harvest a ticket plan's `deferred:` findings into the initiative's `deferred-work.md`,
-  accept v7 `source_plan:` ledger blocks, and gate tickets by ledger `gate:` refs (a
-  ticket, an epic id or folder). A v6 story-key gate resolves through the ticket's
-  migrated `v6_key`, pausing at `story-gate` only when no single ticket claims it.
-- Run deferred-work sweeps on v7 initiatives: no sprint board, bundle plans in the
-  initiative folder closed at `built`, the sweep pinned to its initiative, and
-  pre-answers kept per initiative in `.bmad-loop/decisions-<initiative>.json`. An answer
-  is refused once another initiative is active than the one its decision was listed
-  from.
-- Show tickets in `status` (a board grouped by epic) and `status --json` (`ticket` and
-  `tickets` objects; schema 1), and in the TUI: a tickets board, `hitl`/`refine`/`tree`
-  badges, pause-reason and epic-closure viewers, a start-run preview, and **Request
-  replan** through `tickets.py mark`.
-- Add the `tickets.initiative-parent` validate finding: a run refuses a parent
-  initiative (`[[initiative]]` children in its `tickets.toml`) and names its children,
-  so `[core] active_initiative` can be set to one child.
+  gate tickets by ledger `gate:` refs, and run deferred-work sweeps on v7 initiatives,
+  each pinned to its initiative with pre-answers in
+  `.bmad-loop/decisions-<initiative>.json`.
 - Ship a `bmod.toml` module record (`bmod-bmad-loop`) so BMAD v7 `bmad setup` can
-  discover, install and update-check bmad-loop; each bundled skill carries its own
-  `[skill]` record.
-- Add every TUI command to the command palette (`ctrl+p`): run control, dashboard,
-  settings-editor, and dialog commands, each listed only where its key is live.
-- Add `bmad-loop plugins [list|enable|accept|revoke] [name]`: list plugins with origin,
-  surface and grant status; grant, re-pin or revoke a project plugin. Hashes only, never
-  prompts, never writes policy.toml (#496, #497).
-- Add `bmad-loop plugins --json`, a schema-versioned plugin roster (#496, #497).
-- Add the `plugins.trust` validate check: an ungranted, changed, enabled-but-ungranted,
-  stale, missing or unreadable project plugin, or an unreadable grant store, is a problem
-  (#496, #497).
-- Add psmux live-gate rows for psmux#774 (a case-only duplicate session is refused),
-  psmux#773 (a pane inherits the server's start `PATH`), psmux#583 (a `-`-leading option
-  value is stored) and psmux#775 (`show-environment NAME` answers for that one name)
-  (#879).
-- Add `bmad-loop resolve <replay-run> --abandon` (DW-535): close a replay run that
-  escalated because its story was finished meanwhile. Uncommitted tracked and
-  untracked changes (plus the run's own spec/board/ledger copies), or commits on a
-  detached HEAD the branch lacks, are parked on a `refs/attempt-preserve-dirty/*-abandon`
-  ref; other git-ignored files are removed with the worktree. The branch is kept and the run is recorded finished.
-  A tree at the recorded path that is not the run's own unit worktree is refused, not removed.
-- Support OpenCode 2.x (`@opencode/cli`) in the opencode-http adapter: sessions, the
-  poll fallback, usage and the token budget, the `[bmad]` transcript and SSE trace over
-  the 2.x `/api/*` server API. The server API major is detected from
-  `opencode --version`; an unsupported or unparseable version fails the session start
-  with a clear error, and `validate` reports it as `adapter.opencode-version` (#847).
-- On OpenCode 2.x, send `effort` as the session model's variant, and refuse a session
-  start whose effort is not one of the model's variants (#847).
-- Write each OpenCode 2.x provider-error event to `logs/<task-id>.provider-errors.log`;
-  classify rate-limit and transport outages there as environment faults and quota
-  failures as a blocking usage limit (#847).
-- Render OpenCode 2.x forms in the `[bmad]` transcript: a `form ask` line naming the form
-  and its questions when one parks the turn, then `form reply` or `form cancelled`.
-- Add the `subagent_transcript_dir` CLI profile field: a subagent transcript tree whose
-  writes count as session activity for the idle notice (#858).
-- Name the tool call an idle Claude session is waiting on: `session-idle` carries
-  `in_tool`, and the TUI shows `· idle <age> · in <tool>` (#858).
-- Add `[verify] command_timeout_min` (default 30): per-command verify timeout,
-  previously fixed at 30 minutes (#857).
-- Add `adapter.codex-version` to `validate`: warn when Codex is older than 0.156 or the
-  profile's `launch_args` drop `--no-daemon` (#901).
-- Journal `session-start-missing` when a session's CLI sends no SessionStart within
-  `[limits] session_start_grace_s` (default 120 s); a Codex sweep session with no hook
-  events names the shared daemon in its escalation text (#901).
-- Journal `session-parked` / `session-unparked` while a session waits on a permission
-  prompt, with the CLI's auto-deny deadline (`auto_deny_patterns` profile key) (#855).
-- Show a parked permission prompt and its auto-deny countdown in the TUI header and Log
-  pane (#855).
-- Answer a parked permission prompt from the TUI (`Y` approve, `N` deny); keys are sent
-  only while a fresh pane capture matches the profile's `[parked_answers]` guards, and
-  journaled as `parked-answered`. Add `TerminalMultiplexer.send_keys` (#855).
-- Add `adapter.permission_mode` (`bypass` default, `sandboxed`): run sessions in a
-  profile's non-blocking sandboxed mode instead of a full permission bypass (claude:
-  `dontAsk` + `Edit(/**)` + the Bash sandbox; codex: a workspace-write permission profile
-  with a `.git` grant + `--ask-for-approval never`; linux/macOS). Profiles declare it in
-  `[permission_modes.<mode>]`; `bmad-loop resolve` sessions keep bypass (#727).
-- Fail `validate` for a role whose profile cannot run its `permission_mode` without
-  prompts (`adapter.permission-mode-unsupported`); report each role's permission posture
-  (`adapter.permission-mode`) and warn on sandboxed Codex under worktree isolation (#727).
+  discover, install and update-check bmad-loop.
+- Add `[adapter] permission_mode = "sandboxed"` (default `bypass`): run sessions in a
+  profile's non-blocking sandboxed mode instead of a full permission bypass, on claude and
+  codex under Linux and macOS (`[permission_modes.<mode>]` profile table). `resolve`
+  sessions keep bypass. `validate` reports each role's posture
+  (`adapter.permission-mode`) and fails a role whose profile cannot run its mode (#727).
+- Show a session parked on a permission prompt, with the CLI's auto-deny countdown, in the
+  TUI header and Log pane, and answer it with `Y` / `N` while the profile's
+  `[parked_answers]` guards still match the pane (#855).
+- Add the `adapter.launch-probe` check to `validate --probes`: launch each role's CLI once
+  with no prompt and fail when its first screen shows a startup dialog an unattended
+  session would park on.
+- Add `[limits] quota_wait_max_min` (default 300; 0 = off): while Claude Code visibly waits
+  out a usage-window reset, freeze the session timeout and hold the stall nudge up to the
+  cap, then pause with a usage-limit reason. The wait and reset time show in
+  `heartbeat.json`, the journal and the TUI header.
+- Add `resolve --at-reset [--margin-min N]`: wait in the foreground until a usage-limit
+  pause's recorded reset plus the margin (default 2 min), then re-arm and resume. Credit
+  exhaustion, an unknown reset and one past `quota_wait_max_min` are refused.
+- Support OpenCode 2.x (`@opencode/cli`) in the opencode-http adapter, picking the server
+  API from `opencode --version` (`validate`: `adapter.opencode-version`). On 2.x `effort`
+  is sent as the model variant, subagent tokens count toward usage and the budget, forms
+  show in the `[bmad]` transcript, and provider errors are logged to
+  `logs/<task-id>.provider-errors.log`, where outages pause as environment faults and
+  quota failures as usage limits (#847).
+- Add `bmad-loop resolve <replay-run> --abandon`: close a replay run that escalated
+  because its story was finished meanwhile, keeping its branch and parking uncommitted
+  work on a preserve ref.
+- Add `bmad-loop plugins [list|enable|accept|revoke] [name]` (and `--json`) to list
+  plugins and grant, re-pin or revoke a project plugin, and the `plugins.trust` validate
+  check (#496, #497).
+- Add `[verify] command_timeout_min` (default 30), previously fixed at 30 minutes; a
+  timed-out command's failure names the limit (#857).
+- Add every TUI command to the command palette (`ctrl+p`).
 
 ### Changed
 
-- Title parked, no-work, usage-limit and environment-fault pause notifications as
-  `Paused (<kind>)` rather than `CRITICAL escalation` (#727).
-- Treat the sandboxed Codex permission args (`--sandbox workspace-write`,
-  `--ask-for-approval never`, `-c` permission overrides) as hook-trust safe, and fire
-  `tickets.store-sandbox` for sandboxed roles too (#727).
-- Read the BMAD v7 `tickets/` folder layout, where each initiative and epic keeps its
-  `tickets.toml`, epics, leaf files and plans; the preview-era flat layout is still read
-  when the installed `tickets.py` uses it.
-- Recommend `bmad-agent-po` (Sofia), which replaces the retired `bmad-ticket`, in the
-  bmod record, pause and preflight messages, and the bundled skills.
-- Move the module skills to a repo-root `skills/` directory so the Vercel `skills` CLI
-  (`npx skills add bmad-code-org/bmad-loop`) discovers them without the plugin
-  manifest. The wheel still bundles them under `bmad_loop/data/skills`; `bmod.toml`
-  sources and `.claude-plugin/marketplace.json` point at the new path. Drop the
-  repo-root `module.yaml` mirror: the BMAD installer finds
-  `skills/bmad-loop-setup/assets/module.yaml` directly.
-- Refuse release versions `bmad setup` cannot order: `scripts/sync_version.py` accepts
-  SemVer `X.Y.Z` with an optional `-` pre-release only (no `.devN`, no `-dev`).
-- Make the setup greeting era-neutral: it names the BMAD v6 and v7 requirements.
-- Refuse to resume a story run whose recorded work source this bmad-loop does not
-  know (a run started by a newer version) instead of resuming it as a sprint run.
-- Start bmad-loop's psmux servers with `PSMUX_NO_WARM=1`: their warm pool and hidden
-  `__warm__` standby were never used, and dropping them cuts an idle project from 16 psmux
-  processes and about 935 MiB of summed working sets to 4 and about 175 MiB. The operator's
-  own psmux keeps its pool (#903).
-- Make an un-enabled builtin `[python]` plugin wholly inert: its hooks, workflows and
-  seeds no longer run without its module (#496, #497).
-- Run granted project plugins from a verified out-of-tree snapshot: `{scripts}` points
-  at it, `[python]` modules compile from the hashed bytes (no `.pyc`), and hooks run
-  with `PYTHONDONTWRITEBYTECODE=1` (#496, #497).
-- Show a project plugin's grant status in the TUI settings screen; toggling it on
-  records its grant after a successful save, toggling it off revokes it (#496, #497).
-- Restructure the docs: FEATURES.md is a feature catalog; configuration, CLI and
-  run-state reference pages live in docs/reference/ (the settings tables generated from
-  the schema); sweep and escalation recovery have their own guides; a docs hygiene test
-  guards links, anchors, tracker refs, block length and the catalog shape.
-- Name the per-command time limit in a timed-out verify command's failure reason;
-  `--reverify` also names the key to raise.
-- **Require psmux 3.4.0 or newer (#879).** `available()` refuses 3.3.8 and below, so **on
-  such a host the psmux backend reports unavailable and selection falls through: upgrade
-  psmux**. 3.3.8 silently unsets an option given a `-`-leading value (psmux/psmux#583).
-- Name the psmux control session `bmad-loop-ctl` again, one per project registry, now that
-  psmux 3.4.0 keys its duplicate-server guard on the registry (psmux#599). A pre-upgrade
-  `bmad-loop-ctl-<digest>` session is still treated as a control session and never pruned,
-  but new launches, the TUI's attach and stop keys and the parked-window sweep use
-  `bmad-loop-ctl`; end the old session once its windows have parked (#733).
-- With `[review] enabled = false`, the skills preflight (`run`, `sweep`, resume,
-  `resolve --reverify`, `validate`, `--dry-run`) no longer checks the review CLI's skill
-  tree unless an active plugin binds an enabled `role = "review"` workflow (DW-380).
-- Write `journal.jsonl` as LF-terminated UTF-8 bytes on every platform, and create it and
-  `state.json` owner-only (`0600`); `state.json` is staged at a unique temp name and
-  fsynced before the replace. A run with no recorded run-dir identity, or one whose device
-  number changed, records one `journal-unpinned` row per writer; `resume` records or
-  re-binds the identity before its first row (DW-559).
-- Refuse `delete` (even `--force`), the TUI delete and `clean` on a run whose state
-  cannot be read, or on an isolated v7 sweep run still holding shared-store ledger
-  closes for unlanded code; a new sweep warns while such a run exists (DW-571).
+- **Require Codex 0.156 or newer.** Codex sessions run with `--no-daemon`, so tools and
+  hooks see the session's `BMAD_LOOP_*` environment instead of a shared app-server
+  daemon's (`validate`: `adapter.codex-version`). A session whose CLI sends no
+  SessionStart within `[limits] session_start_grace_s` (default 120 s) is journaled as
+  `session-start-missing` (#901).
+- **Require psmux 3.4.0 or newer (#879).** On an older psmux the backend reports
+  unavailable and selection falls through: upgrade psmux.
+- Name the psmux control session `bmad-loop-ctl` again, one per project registry. A
+  pre-upgrade `bmad-loop-ctl-<digest>` session is never pruned; `cleanup` and `attach`
+  name it with the command that ends it (#733, #915, #917).
+- Start bmad-loop's psmux servers with `PSMUX_NO_WARM=1`, cutting an idle project from 16
+  psmux processes (~935 MiB) to 4 (~175 MiB); your own psmux keeps its warm pool (#903).
+- Title parked, no-work, usage-limit and environment-fault pause notices
+  `Paused (<kind>)` instead of `CRITICAL escalation` (#727).
+- Move the module skills to a repo-root `skills/` directory so
+  `npx skills add bmad-code-org/bmad-loop` finds them; the wheel still bundles them. The
+  repo-root `module.yaml` mirror is gone: the BMAD installer reads
+  `skills/bmad-loop-setup/assets/module.yaml`.
 - Pass `--allow-all-urls` in copilot's `bypass_args` so unattended sessions fetch URLs
-  without a permission prompt; this changes the copilot default config digest (DW-598).
-- Build a parent initiative's children one run each when `run` targets a parent (was
-  exit 1). Require worktree isolation without the auto retrospective; pause each child
-  at its epic boundaries; close drained children (`status: done`) before every pick;
-  spend one `--max-stories` budget across the chain. Show the chain in `run --dry-run`
-  and the TUI start-run preview, both picking as if the drained children were closed,
-  and a chained run's child on its tickets board (DW-574).
+  without a prompt; this changes the copilot default config digest.
+- Refuse to resume a run whose recorded work source this bmad-loop does not know (one
+  started by a newer version).
+- Refuse `delete` (even `--force`), the TUI delete and `clean` on a run whose state cannot
+  be read.
+- With `[review] enabled = false`, skip the review CLI's skill check in the skills
+  preflight unless a plugin binds an enabled review workflow.
+- Create `journal.jsonl` and `state.json` owner-only (`0600`), and write the journal as
+  LF-terminated UTF-8 on every platform.
+- Make an un-enabled builtin `[python]` plugin wholly inert, run granted project plugins
+  from a verified out-of-tree snapshot, and show and toggle a project plugin's grant in
+  the TUI settings screen (#496, #497).
+- Restructure the docs: FEATURES.md is a feature catalog, and configuration, CLI and
+  run-state references live in `docs/reference/`.
 
 ### Removed
 
@@ -234,241 +125,89 @@ breaking changes may land in a minor release.
 
 ### Fixed
 
-- Count OpenCode 2.x subagent (child) session tokens, at every nesting depth, in recorded
-  usage and the budget guard's samples; a failed child walk is a `usage-capture-failed`
-  (`stage=children`) fault, never a parent-only figure. A child still running at capture
-  is journaled as `usage-child-active` (DW-540).
-- Ignore an Antigravity `Stop` sent with `fullyIdle: false` (a yield to a foreground
-  subagent) instead of completing the session while the subagent still works; the
-  relay forwards `fully_idle`, and `hook-stop-yield-ignored` journals the skip.
-- Ignore an Antigravity subagent conversation's `Stop` instead of letting its final turn end
-  complete the parent early: the new profile key `subagent_spawn_marker` identifies a child
-  by the spawn file its parent wrote, and `subagent-stop-ignored` journals each child.
-- Count an Antigravity subagent's writes as its parent's activity, so a parent blocked on a
-  long foreground subagent no longer journals a false `session-idle`: the idle notice walks
-  each child conversation the parent's `subagent_spawn_marker` files list.
-- Classify OpenCode 2.x provider 5xx errors (`provider.internal`), rejected credentials
-  (`provider.auth`) and unroutable models (`provider.no-route`) as environment faults
-  instead of charging the session as a code failure.
-- Let sandboxed Codex sessions commit under worktree isolation: grant them write access to
-  the linked worktree's gitdir and the main repo's `.git`. `validate` warns only when
-  `extra_args` drops the grant or the profile's grant misses either path.
-- Pause a tickets resume at `ticket-tree` (`binding-moved`) when an in-flight unit's ticket
-  was moved with `tickets.py move` or its plan is gone, naming the old and new ref and plan,
-  instead of re-dispatching a ref the tree no longer holds (DW-575).
-- Refuse to archive a sweep run holding unlanded ledger closes, and leave such a run's unit
-  worktree and artifacts alone on every `clean` arm, reporting it protected (DW-572, DW-573).
-- Show policy.toml deprecation notices in the TUI dashboard as a warning toast (DW-603).
-- Nudge a stalled session whose permission prompt was approved: a transcript write after
-  the PermissionPrompt latch now clears it, instead of the stall pausing as parked (DW-594).
-- Windows installs now depend on tzdata, so usage-limit resets that name a time zone
-  resolve (DW-593).
-- validate's hooks.trust now checks the permission-mode launch args each role runs with (DW-602).
-- Show the legacy `[engine]` deprecation notice to CLI users: it was a `DeprecationWarning`,
-  which Python hides outside `__main__`. It is now `policy.PolicyDeprecationWarning` (a
-  `FutureWarning`), printed once on stderr as `bmad-loop: warning: …`, and `validate` reports
-  it as `policy.deprecated` (#835).
-- Pause instead of retrying a review, fix, blocking-workflow, triage or migration session
-  that produced no work (#727).
-- Match parked-prompt and usage-limit patterns across wrapped pane rows, so a dialog
-  footer wrapped in a narrow window still withholds the stall nudge (#727).
-- Mark a session still parked on a prompt at its timeout as parked, so it pauses instead
-  of retrying (#727).
-- Let `resolve` re-arm, adopt or abandon a story left escalated after a `resume` cleared
-  the run's pause and its engine exited before run end (#958). Warn on `resume` and hint
-  in `status` and the TUI header when a story is still escalated; restore the pause
-  (journaling `resume-aborted`) when a resume fails before its engine starts; report a
-  live engine before the pause stage.
-- Pause a Claude session seen blocked by a usage limit (credit exhaustion or a
-  session-window limit) with a `usage limit:` reason instead of charging a dev attempt;
-  a live pane sighting is exempt from the token veto. Add the profile fields
-  `usage_limit_patterns` and `usage_wait_patterns`, seeded from lines captured in
-  community reports (#610).
-- Pause an OpenCode 2.x session that fails on a provider quota as a usage limit, never
-  charged, even after it did work: the adapter matches each provider-error line against
-  the profile's usage lists as it writes it, a live sighting exempt from the token veto.
-- Read an epic the initiative declares but has not sliced yet: `status` no longer
-  faults the board on its folderless row, and it triggers no retrospective or closure.
-- Name the T1 ticket plan an interrupted commit window left `done` or `blocked` when
-  the resumed commit fails, instead of a bare `commit failed:` (DW-555).
-- Commit a v7 sweep's own ledger writes (bundle closes, reopened closes, harvested
-  deferrals) in a T3/T4 ticket store's repository, best effort, instead of leaving
-  them uncommitted (DW-556, DW-567, DW-570).
-- Reopen an isolated sweep bundle's close in a shared ticket store's ledger when the
-  bundle escalates, defers or is vetoed, instead of leaving entries `done` for code
-  that never landed (DW-567, DW-569).
-- Stop pausing an isolated sweep on `artifact publication intent is missing` when its
-  artifacts dir is in a shared ticket store (DW-557).
-- Resolve a relative v6 config path against the project root instead of the process
-  cwd (DW-551).
-- Re-validate an ordinary unit's merge against the target on replay instead of trusting its
-  `unit-merged` journal row; missing evidence pauses the run (`unit-merged-unverified`)
-  (DW-558).
-- Replace a pane's existing pipe instead of toggling it, so a tmux or psmux config hook that
-  already logs the pane no longer leaves the run log empty (#947).
-- Read a window whose pane exited as dead even when a `remain-on-exit on` config keeps it
-  listed, so the session ends `crashed` instead of `stalled` (#950).
-- Turn `destroy-unattached` off on each session bmad-loop creates, so a config that sets it
-  globally no longer destroys the detached session (#951).
-- TUI: record a resume or resolve window as the run's control window only once its child
-  accepts the run, so a resume refused as "still live" no longer sends attach and `x` to
-  its own window while the engine runs in another (#920).
-- TUI: journal `ctl-window-claim-failed` when a TUI-launched resume or resolve cannot
-  prove it runs in a control session, or exits before accepting the run, instead of
-  keeping the previous launch's window record and leaving no trace (#925).
-- TUI: hand the control-window record back to the previous window when an interactive
-  resolve's session cannot start, and journal `ctl-window-claim-failed` when a finished
-  run's `--reverify` replay claims a window named for the finished run, which attach and
-  `x` cannot find (#937).
-- TUI: start a launch that lost the race to create the control session in the session the
-  other launch created, instead of refusing it as "ctl-session setup failed" (#952).
-- Report a pre-upgrade control session in this project's own registry at
-  `cleanup --json` `sessions.superseded_ctl_sessions` and in its own TUI toast, not in
-  `sessions.legacy_leftovers` or the `not migrated` line, which again name only what a
-  legacy registry still holds (#917).
-- Cap verify-command and `[environment]`-probe output at 32 MiB per stream while it is
-  captured, not only after the command exits, so a chatty command's memory no longer
-  grows with its runtime (DW-549).
-- Make `bmad-loop probe-adapter` search for codex rollouts under `$CODEX_HOME/sessions`,
-  as live sessions do, instead of always `~/.codex/sessions` (DW-546).
-- Report psmux's empty or `ERROR:` session-listing row, printed at exit 0 for a server it
-  could not read, as a listing fault instead of dropping it: the removal guard, `cleanup`
-  and the ownership-tag readers now warn rather than read a live session as silently
-  absent (#919). On a psmux that instead names an unread server on stderr and exits 1
-  (psmux/psmux#809), keep the names that answered and report the unread ones.
-- Name `opencode.db` and say to move it aside when an OpenCode 1.x server dies at
-  startup on a database a 2.x server created, instead of reporting only `rc=1` (DW-544).
-- Save a dotted plugin name's settings from the TUI under `[plugins."<name>"]`, not in
-  nested tables the policy loader never reads. Values saved the old way are not
-  migrated — re-enter them (DW-550).
-- Start a run's mux session at the project root, not in the first session's working
-  directory. Under worktree isolation on Windows psmux, the session held the first unit's
-  worktree, so its teardown journaled `worktree-teardown-degraded` and left an empty
-  `worktrees/1` behind (#902).
-- Resolve a miscased full run ref to the run id's on-disk spelling on a case-insensitive
-  filesystem, so `stop` and `attach` reach the run's multiplexer session (#904).
-- Refuse psmux option values shaped `-X=value`, `-t…` or `--`: psmux 3.4.0 rewrites the
-  first silently and rejects the others, so the value is now warned about and its key freed
-  (#905).
-- Stop `cleanup` and the TUI from calling the sessions in a displaced registry `not migrated`
-  when it is another project's derived `PSMUX_DATA_DIR` (or this project's from before a
-  rename): name it as such and say its control session and untagged sessions most likely
-  belong to that project, while a session tagged as this project's is yours but may still be
-  running; the stderr
-  note names it too (#906).
-- Report a pre-upgrade `bmad-loop-ctl-<16 hex>` control session left in the project's own
-  psmux registry: `cleanup` names it on stderr and in `sessions.superseded_ctl_sessions`
-  with the command that ends it (`sessions.legacy_kill_commands`), and `attach` names it
-  when it finds nothing to attach (#733).
-- Print no kill or attach command for a pre-upgrade control-session name that may be a run's
-  own session (a run of this project has that id, or the session carries a run's project tag,
-  as a neighbour's run can in a shared registry), still check the project's own registry
-  when legacy-registry discovery fails, and have `attach` name the pre-upgrade control session
-  when it finds no run at all (#915).
-- Fire the TUI's stale state-root note on psmux too: the psmux backend now answers which
-  value a new pane inherits through psmux 3.4.0's named `show-environment` (#660).
-- Fix the OpenCode V2 SSE-reconnect end-to-end test failing on slow runners (Windows): the
-  gap's HTTP probe completed the session before the reader reconnected. The fake now
-  holds the turn busy until the reconnect is up.
-- Resolve a codex session's rollout by session id when the hook's transcript path is
-  missing or unreadable, so its usage is captured and the token budget guard arms
-  (#775).
-- Decode hook stdin as UTF-8 bytes instead of the locale code page, and record an
-  unreadable hook payload in `session-lifecycle.jsonl` (#775).
-- Count codex subagent rollouts in session usage. Codex writes each subagent to its
-  own rollout and leaves its usage out of the parent's totals, so subagent-heavy
-  sessions were under-counted by half or more. Codex totals and budgets can roughly
-  double for those sessions, so budgets tuned on old figures may trip differently.
-  A subagent rollout that cannot be read is named in `usage_unread` on the
-  `session-end` journal entry (#775).
-- Stop failing every opencode-http session start against OpenCode 2.x with a health
-  timeout (#847).
-- Keep probing an opencode-http session over HTTP after an event-stream reconnect
-  until its turn end is seen, so a turn end lost in the gap no longer runs to the
-  session timeout (#847).
-- Charge and retry a session whose log tail shows a provider error but whose tracked
-  usage is nonzero, instead of pausing the run as an environment fault (#764).
-- Count Claude Code session usage once per API response and include subagent
-  transcripts (`<session>/subagents/**/*.jsonl`). Per-session and per-story totals
-  were over-counted ~2× without subagents and under-counted with them, so budgets
+- Count Claude Code usage once per API response and include subagent transcripts:
+  totals were over-counted ~2× without subagents and under-counted with them, so budgets
   tuned on old figures may trip differently (#836).
-- Bind the re-drive's own spec on a fixable repair when a resolved re-drive
-  began with no spec, instead of crashing the engine with "attempt-owned spec
-  became unreadable" (#860).
-- Open the TUI settings screen when a plugin's name or `[[settings]]` key is not a valid
-  widget id (a space or a dot): its toggle, status, settings-group and setting-field ids
-  are encoded (#496, #497, DW-539).
-- Spawn tmux with `-u` so window and session listings parse when bmad-loop runs
-  without a UTF-8 locale (`LANG` unset, `LC_ALL=C`, cron, systemd). tmux printed
-  each field tab as `_`, so every window read as nameless and untagged (#881).
-- psmux: run the parked-window trailer's psmux calls through the absolute path
-  bmad-loop resolved, not by bare name on the pane's `PATH`, so a psmux missing
-  from the pane's `PATH` no longer silently skips the client return and leaks the
-  return-target key (#877).
-- Keep `cleanup` (and the TUI's cleanup) from closing a control window whose command
-  is still running, such as an interactive `resolve` of a paused run: a window is
-  closed only once its screen shows the park banner. A window whose screen cannot be
-  read stays open and is reported (`ctl_windows.undetermined` in `--json`) (#876).
-- Fix `bmad-loop resolve <finished-run> --reverify` refusing to replay a kept unit after
-  the project was moved, as if `repo_root` had changed (DW-525): the kept worktree and
-  code root are now located on the live project, a `repo_root` above the project
-  included when the whole repository was renamed.
-- Fix preservation snapshot commits inheriting `GIT_COMMITTER_DATE`/`GIT_AUTHOR_DATE`
-  from the environment, which let `scm.preserve_keep` retention prune a fresh snapshot
-  first.
-- Fix `bmad-loop delete` leaving a paused run's kept worktree registered with git
-  (DW-538): the stale admin entry is now pruned; a prune that fails is reported.
-- Make the test suite pass on WSL2: skip the pidfd reap tests when the Python build
-  has no `os.pidfd_open`, and spawn `sys.executable` instead of a bare `python` (#883).
+- Count Codex subagent rollouts in session usage (totals for subagent-heavy sessions can
+  roughly double), find a rollout by session id when the hook's transcript path is
+  missing, and decode hook stdin as UTF-8 (#775).
 - Count Claude subagent and workflow-agent transcript writes as session activity, so a
-  session waiting on a foreground subagent no longer journals `session-idle` (#858).
-- Send nudges to the agent's own pane, pinned by pane id at launch, instead of the
-  window's active pane, so an operator split or floating pane no longer receives them;
-  a failed pin falls back to the window and is crumbed `pane-pin-failed` (#948).
-- Refuse to type a nudge into a pane in copy or clock mode, which swallowed it while
-  it counted as sent; the nudge is now recorded as not delivered (#949).
-- Run Codex sessions with `--no-daemon` so tools and hooks see the session's
-  `BMAD_LOOP_*` environment, not a shared app-server daemon's; require Codex >= 0.156.
-  A Codex run paused across the upgrade prints the config-changed advisory once on
-  resume (#901).
-- Keep a deferred finding's severity when the dev session qualifies it: `high (unverified)`
-  files `severity: high` and keeps the declared text in `reason:`. An unrecognized
-  severity (`P1`) files the entry without the line and journals
-  `spec-deferrals-severity-unrecognized` instead of dropping it silently; a collection
-  or NUL severity marks the item malformed (#913).
-- Keep a parked story's follow-up review recommendation: the park record, the
-  `story-awaiting-operator` journal row, the park notification, `confirm --list`/`--json`,
-  `confirm`'s success output and `status --json` now carry `followup_review_recommended`,
-  and the escalations and tickets guides give the post-confirm review procedure. A park
-  still never runs the review (#888).
+  session waiting on a foreground subagent no longer journals `session-idle`; the idle
+  notice names the tool it waits in (`subagent_transcript_dir` profile field) (#858).
+- Antigravity: ignore a `Stop` sent by a subagent or with `fullyIdle: false`, and count a
+  subagent's writes as its parent's activity, so a parent no longer completes early or
+  reads as idle while a subagent works (`subagent_spawn_marker` profile field).
+- Pause a Claude session blocked by a usage limit with a `usage limit:` reason instead of
+  charging a dev attempt (`usage_limit_patterns`, `usage_wait_patterns` profile fields);
+  Windows installs now depend on tzdata so a named reset time zone resolves (#610).
+- Pause instead of retrying a review, fix, blocking-workflow, triage or migration session
+  that produced no work or is still parked on a prompt at its timeout, and match
+  parked-prompt patterns across wrapped pane rows (#727).
+- Nudge a stalled session after its permission prompt was approved instead of pausing it
+  as parked.
+- Charge and retry a session whose log tail shows a provider error but whose tracked usage
+  is nonzero, instead of pausing as an environment fault (#764).
+- Let `resolve` clear a story left escalated after a `resume` cleared the pause and its
+  engine exited early; `resume`, `status` and the TUI now point at it, and a resume that
+  fails before its engine starts restores the pause (#958).
+- Bind the re-drive's own spec on a fixable repair when a resolved re-drive began with no
+  spec, instead of crashing the engine (#860).
+- Re-validate a unit's merge on replay instead of trusting its journal row; missing
+  evidence pauses the run (`unit-merged-unverified`).
+- Keep a deferred finding's qualified severity (`high (unverified)` files
+  `severity: high`); an unrecognized severity is filed without one and journaled, not
+  dropped (#913).
+- Keep a parked story's follow-up review recommendation on the park record, the
+  notification, `confirm` and `status --json` (#888).
+- Show the legacy `[engine]` deprecation notice: once on stderr as
+  `bmad-loop: warning: …`, as a TUI toast, and as `validate`'s `policy.deprecated` (#835).
+- Fix `resolve <finished-run> --reverify` refusing to replay a kept unit after the project
+  was moved.
+- Fix `delete` leaving a paused run's kept worktree registered with git.
+- Fix preservation snapshots inheriting `GIT_COMMITTER_DATE`/`GIT_AUTHOR_DATE`, which let
+  `scm.preserve_keep` prune a fresh snapshot first.
+- Resolve a relative v6 config path against the project root, not the process cwd.
+- Cap verify-command and `[environment]`-probe output at 32 MiB per stream while it is
+  captured, not only after the command exits.
+- Make `probe-adapter` look for codex rollouts under `$CODEX_HOME/sessions`, as live
+  sessions do.
+- opencode-http: keep probing over HTTP after an event-stream reconnect until the turn end
+  is seen (#847), and name `opencode.db` when a 1.x server dies on a database a 2.x server
+  created.
+- TUI: save a dotted plugin name's settings under `[plugins."<name>"]` (values saved the
+  old way must be re-entered), and open the settings screen when a plugin name or key is
+  not a valid widget id (#496, #497).
+- TUI: make a resume or resolve window the run's control window only once its child
+  accepts the run, journal `ctl-window-claim-failed` when it cannot, and join a control
+  session another launch created first (#920, #925, #937, #952).
+- tmux and psmux: replace a pane's existing pipe so a config that already logs the pane no
+  longer empties the run log (#947); read a pane that exited as dead under
+  `remain-on-exit on` (#950); turn `destroy-unattached` off on bmad-loop's sessions
+  (#951); spawn tmux with `-u` so listings parse without a UTF-8 locale (#881).
+- Send nudges to the agent's own pane, pinned at launch, not the window's active pane
+  (#948), and record a nudge typed into a copy- or clock-mode pane as not delivered (#949).
+- psmux: start a run's session at the project root, so a Windows worktree teardown no
+  longer leaves `worktrees/1` behind (#902); reach a miscased run ref's session (#904);
+  refuse option values psmux 3.4.0 mangles (#905); report an unreadable session listing
+  instead of reading sessions as absent (#919); call the parked-window trailer's psmux by
+  absolute path (#877); fire the stale state-root note (#660).
+- Name a displaced psmux registry that belongs to another project (or this one before a
+  rename) as such in `cleanup` and the TUI, instead of calling its sessions `not migrated`
+  (#906).
 
 ### Security
 
-- Trust plugins by origin and pin project plugins by content (#496, #497). A project
-  plugin with hooks, workflows, seeds or `[python]` now runs only under an operator
-  grant — a sha256 of its whole directory, stored out of tree and read once per launch.
-  Builtins stay trusted by provenance. Grants are per machine and keyed by project path.
+- Trust plugins by origin and pin project plugins by content: a project plugin with hooks,
+  workflows, seeds or `[python]` runs only under an operator grant (a sha256 of its
+  directory, stored per machine out of tree); builtins stay trusted. Startup fails when a
+  granted plugin changed or lost its executable surface, naming `plugins accept` or
+  `plugins revoke` (#496, #497).
 - **Upgrade:** a project plugin listed in `[plugins] enabled` without a grant now fails
-  startup; run `bmad-loop plugins enable <name>`. This includes a project copy of
-  `unity`.
-- **Upgrade:** an ungranted project plugin with hooks, workflows or seeds is inert (a
-  `note:` and a `plugin-refused` journal row) until `bmad-loop plugins enable <name>`.
-- Fail startup when a granted project plugin changed since its grant, naming
-  `bmad-loop plugins accept <name>`; refuse before any plugin code runs (#496, #497).
-- Fail startup when a granted project plugin loses its whole executable surface or its
-  dir disappears, naming `bmad-loop plugins revoke <name>` (#496, #497).
-- Pin the run journal and `state.json` to the run dir's recorded identity
-  (`run_dir_identity`) at every engine, CLI, TUI and re-arm writer: a run dir swapped for
-  a link or another directory refuses the append or save instead of writing outside the
-  run, and an append never recreates a deleted run dir. Windows appends hold
-  `FILE_APPEND_DATA` without `FILE_WRITE_DATA`. The first `state.json` read and the other
-  run-dir files (`engine.pid`, `ATTENTION`, heartbeats, adapter records, `logs/`) stay
-  path-based (DW-559, DW-560).
-- Pin `state.json` re-reads and pinned journal reads to the run dir's recorded identity:
-  a run dir swapped after the first read raises `UnconfinedReadError` instead of
-  acting on a foreign record; the TUI journal pane flags the swap (DW-564).
-- Write Windows verify-stream logs through the journal's pinned, handle-anchored run-dir
-  open, refusing junctions; stream files keep `\n` line endings (DW-563).
+  startup, and an ungranted one with hooks, workflows or seeds is inert; run
+  `bmad-loop plugins enable <name>`. This includes a project copy of `unity`.
+- Pin the run journal and `state.json` to the run dir's recorded identity: writes and
+  re-reads refuse a run dir swapped for a link or another directory instead of acting
+  outside the run, and Windows verify-stream logs refuse junctions.
 
 ## [0.13.2] — 2026-10-09
 
@@ -571,10 +310,10 @@ breaking changes may land in a minor release.
 
 - Tag hook events with relay-side process lineage; once the launched session's first
   `SessionStart` reads `match`, a nested CLI's `mismatch` events (id-less included) are
-  dropped. Untrusted lineage writes one `hook-lineage-untrusted` crumb (DW-507).
+  dropped. Untrusted lineage writes one `hook-lineage-untrusted` crumb.
 - Write one `pinned-session-id-mismatch` crumb when a pinned session's first non-rebind
   `SessionStart` reports an id other than the pin, so the drop of its own events as
-  foreign is no longer silent; a nested CLI's `mismatch`-tagged start is skipped (DW-509).
+  foreign is no longer silent; a nested CLI's `mismatch`-tagged start is skipped.
 - Record opt-in per-worker test metrics with `pytest --test-metrics-dir=PATH`, keeping
   wall-clock apart from summed worker-seconds; bound a run with a tree-stopping deadline
   via `scripts/run_test_benchmark.py`. Upload metrics and JUnit from every CI test job,
@@ -587,7 +326,7 @@ breaking changes may land in a minor release.
 
 - A tmux coding-CLI pane's start command now shows the
   `/bin/sh -c 'BMAD_LOOP_LAUNCH_PID=$$; …'` prelude; the command itself runs under
-  `default-shell` exactly as before (DW-507).
+  `default-shell` exactly as before.
 - Run each Windows CI leg as two shards plus a serial psmux-gate job; fail the
   `test (windows, py3.x)` aggregator on a missing or red shard or gate, a test run in no
   shard or two, a skipped live-gate test, or a shard or gate job whose latest attempt
@@ -610,7 +349,7 @@ breaking changes may land in a minor release.
   `session_id_flag` (claude: `--session-id`) makes the generic adapter pass a minted UUID4
   and treat an identified `SessionStart`/`SessionEnd` from any id the session never had
   as foreign (a `clear`/`compact` rebind still counts as its own), so a nested child's
-  `SessionEnd` without a prior `SessionStart` no longer crashes the parent (DW-505/508).
+  `SessionEnd` without a prior `SessionStart` no longer crashes the parent.
   A same-name `.bmad-loop/profiles/claude.toml` overlay replaces the packaged profile and
   stays unpinned until it adds `session_id_flag = "--session-id"`. A claude run paused
   before upgrading reports the host-exec config changed on resume: its launched argv
@@ -633,16 +372,16 @@ breaking changes may land in a minor release.
   Refuse rows in a flow-style `{...}` mapping (`mapping-is-flow`) instead of publishing
   invalid YAML, and any anchored value (`value-is-anchored`), aliased or not. A quoted value
   with a glued comment (`'backlog'#c`) is now refused (`unreadable-value`) rather than
-  rewritten (DW-514, DW-516).
+  rewritten.
 - Advance the sprint-status row the reader reads, matched by its parsed key rather than
   its text (`advance`'s epic lift now lifts a lone `epic-01` row as epic 1). Refuse two
   distinct keys that read as one (`"2001-01-04"` and the date `2001-01-04`; `epic-1` and
   `epic-01`) as `key-ambiguous`, publishing nothing, instead of rewriting a row the reader
-  ignores or regressing a `done` epic (DW-515).
+  ignores or regressing a `done` epic.
 - Retry the transient Windows errors `delete`/`archive` (CLI and TUI) hit while removing a
   run dir — a sharing violation from a concurrent reader's handle, and the WinError 145 a
   parent `rmdir` hits while a child is still delete-pending — instead of failing on the
-  first one (DW-519, DW-520).
+  first one.
 - Return `bmad-loop validate`'s coding-CLI probe at its timeout on a Windows `.cmd` launcher
   and kill the launcher's descendants, instead of waiting for the launched program to exit
   (120 s observed in CI).
@@ -650,7 +389,7 @@ breaking changes may land in a minor release.
   version files as UTF-8 with LF line endings, and exchange `git`/`gh` text — release
   notes included — as UTF-8 rather than the ANSI code page. A portability guard now
   refuses file `open` / `read_text` / `write_text` without an explicit encoding in
-  `src/bmad_loop` (DW-513, DW-517, DW-518).
+  `src/bmad_loop`.
 
 ## [0.13.0] — 2026-09-28
 
@@ -664,43 +403,42 @@ breaking changes may land in a minor release.
   an `epic-N-retro-*.md` doc; only the doc and board are committed, and leftover dirt
   pauses. The verdict rides `retro-auto-finished` and the done notice (a `rejected` epic
   adds an `ATTENTION` line). `validate` and `status --json` name the retro role, and
-  `config_digest` covers it (DW-389, DW-487, DW-488).
+  `config_digest` covers it.
 - Ingest sprint-status retro `action_items` into the deferred-work ledger: a fresh
   `bmad-loop sweep` files each not-`done` item as a `DW-<n>` entry
-  (`origin: retro action item <id>`) before triage, never re-filing a twin (DW-388).
+  (`origin: retro action item <id>`) before triage, never re-filing a twin.
 - Document the `_bmad/custom/bmad-retrospective.toml` override that points the retro at
-  run-dir journals and session logs (setup guide) (DW-387).
+  run-dir journals and session logs (setup guide).
 - Add `bmad-loop resolve <run> --adopt-branch`: finish an escalated worktree story from
   its kept branch (spec set `done`, board mirrored, branch squashed and merged) with no
   new session. Review, `[verify]` and `pre_commit_gate` are not re-run. A resume that
   drains the queue past an ESCALATED story now pauses instead of recording the run
-  `finished` (DW-386).
+  `finished`.
 - Add `bmad-loop resume <run> --accept-baseline`: restarted in-place stories adopt the
   current HEAD as their baseline, so commits above the old one are kept rather than
   parked and reset (`baseline-accepted`). Restart resets that do park work now notify
   (`ATTENTION`) naming the `attempt-preserve/*` / `attempt-preserve-dirty/*` refs with
-  recovery hints, and a failed preserve leg journals `attempt-preserve-fallthrough`
-  (DW-371, DW-480, DW-481, DW-482).
+  recovery hints, and a failed preserve leg journals `attempt-preserve-fallthrough`.
 - Add `[operator] on_review_demotion = "escalate" | "park"` (default `escalate`): under
   `park`, a review that finalizes a `done` story at `awaiting-operator` moves the board
-  back, commits and parks (DW-383).
+  back, commits and parks.
 - Seed antigravity workspace trust per unit worktree via a profile's `[workspace_trust]`
   table, so `isolation = "worktree"` works with antigravity (journals
   `worktree-trust-seeded` / `-unseeded`); add `probe-adapter --workspace PATH` for a
-  read-only trust verdict (DW-390).
+  read-only trust verdict.
 - Add parked-session detection: a canonical `Notification` event with
   `PermissionPrompt`/`IdlePrompt`/`QuotaPrompt` kinds, a
   `[hooks.notification_types]` profile table, and `parked_prompt_patterns` matched
   against the pane at every stall-grace expiry. A parked session ends `stalled` +
   `parked` and pauses instead of being nudged. The claude profile maps its permission,
   idle, quota and MCP elicitation dialogs; re-run `bmad-loop init` to register the
-  relay (DW-348, DW-350, DW-433, DW-434).
+  relay.
 - Add a `post_review_verify` plugin hook stage publishing every review verify gate's
-  `[verify] commands` results (DW-357).
+  `[verify] commands` results.
 - Expose `ctx.delivery_id` on `post_migrate` and `ctx.rollback_outcome` on
   `post_rollback` (declarative: `BMAD_LOOP_DELIVERY_ID`, `BMAD_LOOP_ROLLBACK_OUTCOME`);
   `post_rollback` now fires once for every `pre_rollback`, also on a paused or failed
-  rollback (DW-317, DW-322).
+  rollback.
 - Add a free-form `effort` key to `[adapter]` and `[adapter.<stage>]`; `opencode-http`
   sends it as the per-prompt `variant` (shown on the `run --dry-run` launch line), and
   `validate` warns (`policy.effort-unsupported`) for tmux stages (#643).
@@ -708,7 +446,7 @@ breaking changes may land in a minor release.
   `limits.dev_stall_grace_s`), with `transcript_idle_s` on `heartbeat.json` and the TUI
   agent line (#680).
 - Add opt-in `bmad-loop validate --render-probe`: runs each renderer stub's render
-  command in a throwaway copy and fails on a render `HALT:` (DW-381).
+  command in a throwaway copy and fails on a render `HALT:`.
 - Add `validate` warnings: `policy.bypass-dropped` when `adapter.extra_args` drops the
   profile's `bypass_args` (also warned and journaled at real launches);
   `policy.isolation-shared-artifact-dir` for artifact dirs shared with the main checkout
@@ -716,8 +454,8 @@ breaking changes may land in a minor release.
   `deferred.ledger-ignored-isolated` for a ledger that bmad-loop's commits would sweep in
   or lose; `hooks.relay-path-unsafe` for a relay path with shell metacharacters on
   Windows; `policy.extra-args-unservable` for `opencode-http` `extra_args` repeating an
-  adapter-owned serve flag (DW-349, DW-410, DW-485, DW-361, DW-375, DW-346, DW-483).
-- Show auto-sweep outcomes (refused with reason, or ran) in the TUI run header (DW-366).
+  adapter-owned serve flag.
+- Show auto-sweep outcomes (refused with reason, or ran) in the TUI run header.
 
 ### Changed
 
@@ -731,15 +469,15 @@ breaking changes may land in a minor release.
   (a monorepo's `<repo>/app`): unit worktrees provision at the project's offset. The
   `policy.isolation-repo-root` refusal now fires only when the project is outside
   `repo_root`, and `validate`/the TUI launch guard now require a clean `repo_root`, as
-  `run` and `sweep` do (DW-379).
+  `run` and `sweep` do.
 - For the claude profile, an idle dev/review/workflow session now pauses as parked at
   stall-grace expiry instead of receiving the stall wake nudge; opt out by dropping
-  `idle_prompt` from `[hooks.notification_types]` in a project overlay (DW-348).
+  `idle_prompt` from `[hooks.notification_types]` in a project overlay.
 - Commit hooks in the ledger-publication candidate worktree now see only the target
-  file: a hook that reads other tracked files may fail the publication (DW-401).
+  file: a hook that reads other tracked files may fail the publication.
 - Name an earlier attempt's parked work in the retry dev prompt once Git confirms the
   ref still resolves on this task's baseline (#777).
-- Name every mux session's window 0 `shell` on tmux and psmux (DW-351).
+- Name every mux session's window 0 `shell` on tmux and psmux.
 - Document the live-session removal guard's ceiling: `delete`, `archive` and `clean` can
   still remove a run whose live session a listing omits (#732).
 
@@ -750,76 +488,67 @@ breaking changes may land in a minor release.
   `session-end` carry `produced_work` (#727).
 - Stop charging an attempt for a session that times out having consumed zero tokens (a
   provider quota stall): it is now an environment fault that pauses, and usage with no
-  signal is journaled as untracked (`null`), not 0 (DW-364).
+  signal is journaled as untracked (`null`), not 0.
 - Count Copilot shutdown metrics, increased Codex output-token totals and new or changed
   Gemini model messages as work when a dev session exits before the next transcript
   heartbeat (#822).
 - Honor a hard `bmad-loop stop` inside verify commands and declarative plugin hooks, and
   kill the whole process tree (including descendants that outlive their shell) on stop or
-  timeout; on Windows the post-kill drain no longer blocks on a held pipe (DW-353,
-  DW-477, DW-478).
+  timeout; on Windows the post-kill drain no longer blocks on a held pipe.
 - Escalate an isolated unit before a Codex session starts in a worktree Codex does not
   trust, instead of starting a session whose Stop hook is silently skipped; trust the
-  worktree, then `resolve --no-interactive` and `resume` (DW-340, DW-341).
+  worktree, then `resolve --no-interactive` and `resume`.
 - Report stale or unverifiable Codex hook trust in `validate` and `probe-adapter` before
   a live probe launches (#461).
 - Tighten hook-registration checks: `validate`/`probe-adapter` report hooks registered
   only when every Stop-mapped event runs an executed relay naming `Stop`, and refuse a
   managed relay reporting `Stop` (or a wrongly mapped event) under another native event
-  or any antigravity hook group; `init` strips or warns about them (DW-342, DW-343,
-  DW-344, DW-345, DW-391, DW-392, DW-409, DW-490).
+  or any antigravity hook group; `init` strips or warns about them.
 - Preflight the complete bundled `bmad-loop-sweep` skill before `sweep`, a sweep resume
   or an auto-sweep, naming `bmad-loop init --force-skills`, instead of every triage
-  session stalling at `Unknown command`; `validate` reports `skills.sweep*` (DW-367).
+  session stalling at `Unknown command`; `validate` reports `skills.sweep*`.
 - Re-merge on resume a worktree story saved DONE before its merge started, instead of
-  letting GC discard the unit branch (DW-385).
+  letting GC discard the unit branch.
 - Stop worktree teardown and the run-end GC from silently discarding a story's edit to a
   `skip-worktree`-pinned hook config: success paths pause with the worktree kept
   (`pinned-config-edit-refused`), and DEFERRED or merge-escalated units carry the edit in
-  `changes.patch`. A GC pause now leaves the run resumable (DW-368, DW-479, DW-501,
-  DW-502).
+  `changes.patch`. A GC pause now leaves the run resumable.
 - Protect the tracked ledger and board at the merge pre-flight only when the task writes
   them, and park an operator's uncommitted edit to a path the branch changes under
-  `refs/merge-preflight-preserve/<sha>` before restoring it (DW-354, DW-356).
+  `refs/merge-preflight-preserve/<sha>` before restoring it.
 - Prove ledger ownership on every harvested-deferral carry retry, pausing
-  (`harvest-carry-foreign-dirt`) rather than committing an operator's ledger edit
-  (DW-355, DW-413).
+  (`harvest-carry-foreign-dirt`) rather than committing an operator's ledger edit.
 - Seed a leaf-symlinked ledger or board at its configured path, ending the #426 defer
-  loop, and name a link to outside the project in `worktree-seed-dropped` (DW-377,
-  DW-432).
+  loop, and name a link to outside the project in `worktree-seed-dropped`.
 - Keep deferred-work ledger ids and dedupe keys stable: mint ids from `### DW-<n>`
   headings only, refuse a migration that edits an entry's `origin:`/`source_spec:`,
   ignore fenced examples when checking for a field, and restore severity when reopening
-  an old archive stub (DW-334, DW-363, DW-384, DW-394, DW-408).
+  an old archive stub.
 - Harden sweep-migration recovery: resume a migration interrupted mid-retry, mid-triage
   or after escalating from `committing` by restoring its durable snapshot (or replaying
   its idempotent commit tail) instead of escalating or triaging over unaccepted text;
   replay `sweep-migrated` / `post_migrate` after a host death past `DONE`; re-raise a
-  ledger publish whose `git status` fails (DW-313, DW-314, DW-315, DW-317, DW-336,
-  DW-405, DW-407, DW-426, DW-436, DW-439).
+  ledger publish whose `git status` fails.
 - Never rewind a sweep migration over a HEAD that moved past the task baseline or over
   unrelated dirt: recovery resets pause instead, dirt is parked under
   `refs/attempt-preserve-dirty/*`, and an escalated restart that finds a newer ledger
-  re-pauses (`sweep-migration-restore-diverged`) (DW-427, DW-428, DW-429, DW-430,
-  DW-435).
+  re-pauses (`sweep-migration-restore-diverged`).
 - Pause a sweep migration before dispatch when its tracked ledger differs from the
   committed one (`migrate-ledger-dirty`: commit it, then resume), and finish one with
-  nothing to convert as DONE with no session (DW-437, DW-440).
+  nothing to convert as DONE with no session.
 - Make the exact-path ledger publication robust: hold `index.lock` across the target
   compare and reset, read past `git replace` refs, refuse a live exec-bit mismatch
   (chmod the ledger to match), bind attempt-owned spec normalization to one inode, and
-  prune or name leftover candidate worktrees on failure (DW-319, DW-323, DW-324,
-  DW-325, DW-326, DW-327, DW-328, DW-329, DW-330, DW-331, DW-398, DW-399, DW-400,
-  DW-402, DW-403, DW-404).
+  prune or name leftover candidate worktrees on failure.
 - Skip the candidate cleanup's `git worktree remove --force` / `prune` when
   `<git-common-dir>/worktrees/` holds a symlinked or junction entry, which git would
-  empty the target of; remove the link, then prune (DW-494).
+  empty the target of; remove the link, then prune.
 - Report undelivered nudges as failed (`nudge-send-failed`) instead of sent, in the
   generic and `opencode-http` adapters; heartbeat `stall_nudges_sent` counts delivered
-  nudges only (DW-449, DW-503).
+  nudges only.
 - Stop recording a failed session probe as a vanished session: only a window listing
   that proves the session gone writes `session-vanished`; otherwise
-  `session-probe-failed` (DW-459).
+  `session-probe-failed`.
 - Distinguish confirmed missing tmux-family sessions from failed window listings (#525).
 - Journal observation faults instead of folding them into a healthy-looking empty
   answer. Generic adapter: `liveness-probe-failed`, `parked-probe-failed`,
@@ -827,25 +556,22 @@ breaking changes may land in a minor release.
   `transcript-scan-failed`, `spec-readback-failed`, `env-fault-scan-failed`,
   `spec-reconcile-skipped-status`, and a `liveness_unknown` flag on over-budget and kill
   verdicts. `opencode-http`: `usage-sample-failed`, `usage-capture-failed`,
-  `sse-stream-failed`, `sse-frame-dropped`. Verdicts are unchanged (DW-382, DW-447,
-  DW-448, DW-450, DW-451, DW-452, DW-453, DW-454, DW-455, DW-456, DW-457, DW-460,
-  DW-461, DW-462).
+  `sse-stream-failed`, `sse-frame-dropped`. Verdicts are unchanged.
 - Warn instead of reading as "nothing there" when a mux session listing, pane or option
   read, or backend probe fails (`mux` and `validate` report `mux.backend-probe`), and
-  when the removal guard cannot list sessions (DW-458, DW-463, DW-464, DW-466).
+  when the removal guard cannot list sessions.
 - Report an unreadable runs dir, run dir, legacy registry or orphan sweep instead of "no
   runs" / "nothing orphaned": `list`, `status`, `clean`, `cleanup` and the TUI say so,
   with additive `--json` keys `listing_fault`, `sessions.legacy_unverified`,
   `worktree_faults` and `state_dir_fault`. An unreadable `engine.pid` reads as liveness
-  `unknown`, and `resume` warns about an unreadable config baseline (DW-465, DW-467,
-  DW-468, DW-469, DW-470, DW-471).
+  `unknown`, and `resume` warns about an unreadable config baseline.
 - Surface TUI read faults: a stale run header (`⚠ state stale`),
   `decisions unreadable`, `agent unreadable`, and notes for unreadable `ATTENTION` or
-  journal files (DW-472, DW-473, DW-474, DW-475).
+  journal files.
 - Shape every notice through `gates.notify`/`gates.notice_line`: control characters
   become visible escapes, multi-line faults and pause reasons fold onto one line, a
   4000-character cap applies, and lone surrogates never raise. `state.json`, `--json`
-  and the journal keep the raw text (DW-13, DW-332, DW-417, DW-419, DW-491, DW-492).
+  and the journal keep the raw text.
 - Resolve artifact paths from BMAD's central `_bmad/config.toml`, falling back to
   `_bmad/bmm/config.yaml` only for missing keys, and refuse malformed values; sweep
   triage reads the orchestrator's resolved ledger (#154, #769).
@@ -870,17 +596,16 @@ breaking changes may land in a minor release.
   the base client; key the `run --dry-run` preview on adapter kind.
 - Honour `launch_args` before `serve` for `opencode-http` wrapper profiles
   (`npx -y opencode-ai`), with `adapter.launch-args-unservable` in `validate`; report a
-  deeply nested pattern entry as a `ProfileError` (DW-373, DW-374).
+  deeply nested pattern entry as a `ProfileError`.
 - Fit TUI dialogs to narrow and short terminals (down to 39×9): long titles and paths
-  truncate with `…`, and button rows wrap or scroll instead of going off-screen (DW-358,
-  DW-359, DW-414, DW-415).
+  truncate with `…`, and button rows wrap or scroll instead of going off-screen.
 - Decode unity plugin child output as UTF-8 with replacement, so a cp932 Windows
-  codepage no longer raises `UnicodeDecodeError` (DW-365).
+  codepage no longer raises `UnicodeDecodeError`.
 - On Windows, stop a DW bundle pausing at baseline capture when the artifacts root
-  reports no inode (`artifact-observation-unpinned`) (DW-444).
-- Alias commit and snapshot refs in `diagnose` dumps (DW-318, DW-337, DW-435).
+  reports no inode (`artifact-observation-unpinned`).
+- Alias commit and snapshot refs in `diagnose` dumps.
 - Correct docs: why `resume` tolerates a dirty tree while `run`/`sweep` refuse one, and
-  `gates.on_escalation` is reserved (only `pause`, no effect) (DW-360, DW-376).
+  `gates.on_escalation` is reserved (only `pause`, no effect).
 
 ### Security
 
@@ -891,18 +616,15 @@ breaking changes may land in a minor release.
   writes and ledger restores now refuse a root, mount or `.bmad-loop/` subdirectory
   swapped for a link instead of writing outside the repository. Older state records its
   roots at the first `resume` (`root-identity-recorded`). Parent directories above the
-  worktree, and operator-chosen roots, may still be links (DW-338, DW-423, DW-445,
-  DW-446, DW-486, DW-497, DW-498, DW-500).
+  worktree, and operator-chosen roots, may still be links.
 - Harden the exact-path candidate worktree: check it out without running smudge filters
   or fsmonitor, and pin its root, `.git` gitfile, admin dir and `commondir` so a swap
   before a later git call is refused instead of steering it into another repository;
-  on Windows, refuse junctions when creating its parents (DW-401, DW-420, DW-425,
-  DW-442, DW-493, DW-495).
+  on Windows, refuse junctions when creating its parents.
 - Create missing artifact directories through no-follow opens pinned to the accepted
-  root, and on Windows refuse a junction at or below the artifacts directory (DW-421,
-  DW-422).
+  root, and on Windows refuse a junction at or below the artifacts directory.
 - Pass `--` before notify-send positionals and shape the Unity dialog probe's line, so
-  an untrusted window title cannot forge `ATTENTION` lines (DW-418).
+  an untrusted window title cannot forge `ATTENTION` lines.
 
 ## [0.12.0] — 2026-09-20
 
@@ -915,11 +637,10 @@ breaking changes may land in a minor release.
   as `O_NOFOLLOW` refuses a link; `platform_util.HANDLE_ANCHORED_WRITES` joins that arm
   to the POSIX `dir_fd` one behind `open_at`/`stat_at`/`replace_at`/`unlink_at`, so the
   confined spec writers and `open_dir_confined` anchor at a handle on both hosts. The
-  DW-309/DW-310 refusal now fires only on a host with neither arm; its journaled
+  handle-anchoring refusal now fires only on a host with neither arm; its journaled
   `problem` reads `lacks handle-anchored writes`.
 
-- Accept a session-asserted artifact-only sweep bundle at the dev proof-of-work gate
-  (DW-273). A bundle whose only deliverable lives under a gitignored
+- Accept a session-asserted artifact-only sweep bundle at the dev proof-of-work gate. A bundle whose only deliverable lives under a gitignored
   `implementation_artifacts` (a spec-only erratum) burned every attempt on
   `no changes in worktree since baseline commit`. The bundle dev session may assert
   `Artifact only: true` in its `## Auto Run Result` marker (`Artifact only`,
@@ -932,23 +653,22 @@ breaking changes may land in a minor release.
   snapshot degrades to `bundle-artifact-baseline-unavailable` with the attempt still
   driven. Under `scm.isolation = "worktree"` the accepted ignored spec and its
   declared `artifact_deliverables` are published to the main checkout before the
-  success teardown (DW-283); undeclared ignored residue is not copied. The review
+  success teardown; undeclared ignored residue is not copied. The review
   gate's every-id-`done` check is unchanged.
 
 - Announce a ledger publish that publishes nothing (`sweep-ledger-commit-clean`), for every
   outcome that publishes nothing. An ignored path reads clean, so a project
   that gitignores its `implementation_artifacts` skipped every ledger commit with no
-  journal row at all (DW-191).
+  journal row at all.
 
 - Name the published file on every `_commit_ledger` journal row with a `file` field —
   the lexical basename, never the resolved symlink target's name — so a scrubbed
   `bmad-loop diagnose` dump still says which of the two published files went
-  uncommitted, where `repo`, `message` and `error` all collapse to presence booleans
-  (DW-192).
+  uncommitted, where `repo`, `message` and `error` all collapse to presence booleans.
 
 - Write each repeat-loop stop's token as a closed-slug `stop_cause` beside
   `sweep-repeat-done`'s existing `reason`, so a diagnostics dump tells the five stops
-  apart instead of rendering one `reason_present` boolean (DW-201).
+  apart instead of rendering one `reason_present` boolean.
 
 - Declare a journal schema for the five sweep kinds `bmad-loop diagnose` prints as a JSON
   block in the default Markdown dump (`sweep-ledger-commit`, `-clean`, `-refused`,
@@ -960,8 +680,7 @@ breaking changes may land in a minor release.
   arguments it holds — not write calls, so `append(kind, **a, **b)` counts 2 — and a
   second unresolvable splat inside an already-declared position now reddens instead of
   being waived on arrival, whether it arrives as a new call or as a second `**` on an
-  existing one; the field inventory moves to a sibling `JOURNAL_SPLAT_FIELDS` table
-  (DW-150).
+  existing one; the field inventory moves to a sibling `JOURNAL_SPLAT_FIELDS` table.
 
 - Enforce the bare-function-name key the five journal position tables rest on: the
   scan emits each journal write's enclosing def identity and a guard reddens if one
@@ -971,23 +690,22 @@ breaking changes may land in a minor release.
   file read as a journal write, so a same-named twin that never journals still routes
   its callers' keywords into the field inventory and, emitting nothing, stays invisible
   to the guard. Qualifying those keys to `class.method` stays deliberately deferred;
-  the guard is what makes the writer-pair half of that deferral safe (DW-152).
+  the guard is what makes the writer-pair half of that deferral safe.
 
-- Grade the real harvest exclusion producer through the stories plan-halt observation (DW-153).
+- Grade the real harvest exclusion producer through the stories plan-halt observation.
 
-- Name the three harvest exclusion grading rows in the producer docstring (DW-154).
+- Name the three harvest exclusion grading rows in the producer docstring.
 
-- Grade the real harvest exclusion producer through the sweep bundle proof-of-work gate (DW-168).
+- Grade the real harvest exclusion producer through the sweep bundle proof-of-work gate.
 
-- Correct the harvest exclusion docstring to name both `repo_root` override shapes (DW-169).
+- Correct the harvest exclusion docstring to name both `repo_root` override shapes.
 
-- Prove real-tmux teardown reaps the exact detached child after identity publication fails (DW-149).
+- Prove real-tmux teardown reaps the exact detached child after identity publication fails.
 
 - Pin dynamically generated journal kind spellings in `recovery_flow` and detect
-  renames independently of write counts (DW-151).
+  renames independently of write counts.
 
-- **The accepted-park arm's `_harvest_gate_exclude` join is now graded engine-side**
-  (DW-139). `tests/test_verify.py::test_verify_dev_park_zero_diff_excludes_the_orchestrators_own_writes`
+- **The accepted-park arm's `_harvest_gate_exclude` join is now graded engine-side**. `tests/test_verify.py::test_verify_dev_park_zero_diff_excludes_the_orchestrators_own_writes`
   hand-spells its `engine_written`, so the producer is never invoked and re-rooting it
   left that row green. `tests/test_engine.py` gains
   `test_accepted_park_observation_excludes_the_nested_ledger_under_the_monorepo_shape`,
@@ -997,16 +715,15 @@ breaking changes may land in a minor release.
   real ledger. Its control trips the producer's stand-down disjunct through the same
   join, so `park_zero_diff is True` is attributable to the pathspec.
 
-- **The `_usage` stash is now pinned to survive teardown** (DW-129) — the invariant
-  DW-117's cap placement rests on, since `read_usage(result)` runs after `run()`/`kill()`
+- **The `_usage` stash is now pinned to survive teardown** — the invariant
+  the budget cap's placement rests on, since `read_usage(result)` runs after `run()`/`kill()`
   return. `tests/test_opencode_http.py` gains a row that stashes a session's usage,
   drives a real `kill()` -> `_teardown()` (nothing stubbed) over a live child process and
   a real log handle, and asserts `read_usage` still resolves that session id. Until now
   the invariant was only observed incidentally, by three fake-binary E2E rows that happen
   to read usage after teardown; this one pins it directly at the kill seam.
 
-- **Verify-command seam coverage for the legs the earlier passes left unpinned**
-  (DW-55). `tests/test_verify.py` gains a row driving all three exits of
+- **Verify-command seam coverage for the legs the earlier passes left unpinned**. `tests/test_verify.py` gains a row driving all three exits of
   `run_verify_commands`' loop body — completed, timed out, never spawned — in a single
   call with a further command after each fault, so the timeout arm's `continue` is
   load-bearing and the two "no exit status" sentinels (`-1` vs `SPAWN_FAULT_RC`) are
@@ -1017,7 +734,7 @@ breaking changes may land in a minor release.
   and an all-green control keeps their absence assertions honest.
 
 - **A fresh mount that supersedes an accepted-but-uncommitted spec now journals
-  `accepted-spec-write-unreachable`** (DW-101). The `pause_after_spec` gate hands the
+  `accepted-spec-write-unreachable`**. The `pause_after_spec` gate hands the
   operator a spec that is uncommitted by construction; a re-drive's worktree is a
   checkout of a commit, so for a tracked artifacts dir it delivers the pre-approval
   bytes and the existing delivery probe passes on existence alone. The mount's copy is
@@ -1027,7 +744,7 @@ breaking changes may land in a minor release.
   pauses nothing and overwrites nothing.
 
 - **A mount that cannot be shown to carry the accepted spec at all now journals
-  `accepted-spec-delivery-unreachable`** (DW-104, DW-115). Fires only for a spec the
+  `accepted-spec-delivery-unreachable`**. Fires only for a spec the
   task already spells project-relative — the spelling a resume persists, and the one
   leg with no escalating guard above it — when the mounted parent escapes the
   worktree, or the spec could not be resolved at all (a swallowed filesystem fault,
@@ -1069,7 +786,7 @@ breaking changes may land in a minor release.
   another. A recorded spelling that traverses out through `..` stays external and
   unchanged.
 
-- **A failed re-arm commits probe now journals `rearm-commits-probe-failed`** (DW-81).
+- **A failed re-arm commits probe now journals `rearm-commits-probe-failed`**.
   The warn-only probe that lists the commits an abandoned attempt left below the re-drive's
   new baseline used to swallow its `GitError` and write nothing — byte-identical to finding
   no commits at all. It now records the baseline and the typed error, and both operator
@@ -1089,8 +806,7 @@ breaking changes may land in a minor release.
   line. Deliberately not widened to `run_verify_commands`, which has three legitimate callers
   on two roots.
 
-- **Source-scan parity guards for three invariants previously held only by docstring prose**
-  (DW-65, DW-66, DW-82). The task-directory artifact names move to one shared
+- **Source-scan parity guards for three invariants previously held only by docstring prose**. The task-directory artifact names move to one shared
   `journal.TASK_CYCLE_ARTIFACTS` that both adapters and `resolve._gather_escalations` iterate,
   and `tests/test_portability_guard.py` gains three detectors: a bare artifact literal outside
   that constant, a session task id composed outside `engine._session_task_id`, and a journal
@@ -1143,14 +859,14 @@ breaking changes may land in a minor release.
 ### Changed
 
 - Organize decision-answer and publication documentation into navigable operator sections
-  for stale answers, store validation, publication refusals and recovery (DW-240).
+  for stale answers, store validation, publication refusals and recovery.
 
 - Display scrubbed sweep publication and repeat-stop details in the default Markdown diagnostic report.
 
 - Pin the real-tmux xdist grouping guard at EXACT per-module gated-def counts instead of
   floors: `_EXPECTED_E2E_FLOORS` becomes `_EXPECTED_E2E_DEF_COUNTS` and the assertion is
   equality, so adding a tmux-gated def now fails the guard just as deleting one does
-  rather than letting the pin silently start trailing again (DW-173).
+  rather than letting the pin silently start trailing again.
 
 - Grade `tests/test_stories_e2e.py`'s own module-level AST for the detach-ceiling splice:
   a third `tests/test_conftest.py` scanner requires the `detach_ack_ceiling_s=` fragment
@@ -1158,12 +874,12 @@ breaking changes may land in a minor release.
   with a named expected-site inventory that fails a scan finding nothing. A hardcoded
   `90` renders byte-identically to the splice and passed the existing rendered-text
   assert unnoticed; `_run_detach_gate`'s deliberately varying in-def budget stays out of
-  scope because the scan is module-level only (DW-174).
+  scope because the scan is module-level only.
 
-- **The deferred-work ledger-read contract is settled repo-wide** (DW-146).
+- **The deferred-work ledger-read contract is settled repo-wide**.
   `deferredwork` now owns both arms as named readers — `read_for_write` (repair/write:
   absence is `None`, OS metadata/text-read faults raise `LedgerReadFault`
-  with the original `OSError` chained (DW-279), undecodable bytes raise
+  with the original `OSError` chained, undecodable bytes raise
   `LedgerReadError` with the codec error chained) and `read_for_observation`
   (observation: never raises, degrading to an empty text plus an attributed fault) —
   documented once in the module docstring alongside the advisory pre-lock probes that
@@ -1175,12 +891,12 @@ breaking changes may land in a minor release.
   traceback (never a fabricated empty listing), and `verify.verify_review_bundle`
   plus the TUI's deferred pane reach their existing degrade arms for it. Pre-lock
   presence probes, lock acquisition and writes retain raw `OSError`; authoritative
-  reads now distinguish OS faults through `LedgerReadFault` (DW-279).
+  reads now distinguish OS faults through `LedgerReadFault`.
   Observation sites degrade on OS faults as well as on undecodable bytes, so an
   `OSError` that used to escape `decisions.pending_missed_decisions` or abort
   `sweep --dry-run` with a bare traceback now yields an empty result or an
   attributed `error:` instead. The observation arm probes with `stat` + `S_ISREG`
-  inside its own guard (DW-254), so a metadata refusal — `EACCES` on every
+  inside its own guard, so a metadata refusal — `EACCES` on every
   supported interpreter, Python 3.14 included — becomes an attributed fault;
   only `ENOENT`/`ENOTDIR` and a present non-regular file still mean absence, and a
   symlink loop at the ledger is an attributed fault rather than a clean empty
@@ -1198,7 +914,7 @@ breaking changes may land in a minor release.
   names are aliased explicitly, excluded and merge filenames are counted, overloaded
   paths are presence-only, and derived fields win same-named raw-field collisions.
 
-- **Remove the unused whole-artifact-folder exclusion helper** (DW-15). Proof-of-work
+- **Remove the unused whole-artifact-folder exclusion helper**. Proof-of-work
   exclusions remain file-granular and rollback protection keeps its workspace-rooted
   path derivation.
 
@@ -1384,8 +1100,7 @@ breaking changes may land in a minor release.
   next publish then treated as already published. `prepare` warns when a section
   will be truncated.
 
-- Bind legacy migration dispatch and publication to the ledger bytes actually accepted
-  (DW-311, DW-316). Retire stale recovery authority when the ledger changes before
+- Bind legacy migration dispatch and publication to the ledger bytes actually accepted. Retire stale recovery authority when the ledger changes before
   the true post-hook adapter-launch boundary, then publish a validated one-path,
   clean-filter-normalized candidate through a prepared expected-old transaction on
   the captured terminal direct branch. Resolve lost commit acknowledgements by
@@ -1409,23 +1124,22 @@ breaking changes may land in a minor release.
   migration in COMMITTING for good.
 
 - Refuse no-descriptor attempt-owned spec restoration before staging or lifecycle
-  normalization, preserving the existing target bytes for manual recovery (DW-310).
+  normalization, preserving the existing target bytes for manual recovery.
 
 - Fail closed after no-descriptor attempt-owned spec publication and pause for
-  manual adoption instead of trusting a path-based readback (DW-309).
+  manual adoption instead of trusting a path-based readback.
 
 - Refuse attempt-owned spec recovery when final prepublication validation observes an
-  existing target was edited in place, preserving the competing bytes (DW-308).
+  existing target was edited in place, preserving the competing bytes.
 
 - Restore the accepted commit chain and index when the post-squash HEAD identity
-  probe fails, retaining the probe fault if rollback also fails (DW-305).
+  probe fails, retaining the probe fault if rollback also fails.
 
 - Preserve accepted tracked artifact identities through target merge, squash,
   fast-forward, hooks, and crash replay; snapshot the complete target transaction
   into aggregate-limited streamed sidecars, preserve exact index/worktree and
   cleanup-phase state, and refuse drift with verified, retained-source recovery
-  when ref, index, worktree, ignored-path, topology, or submodule evidence is unsafe
-  (DW-302/DW-303). The incoming paths are held to the integrated commit too — a
+  when ref, index, worktree, ignored-path, topology, or submodule evidence is unsafe. The incoming paths are held to the integrated commit too — a
   target hook's rewrite of an ordinary incoming source file, staged, left in the
   checkout, or sealed into the squash leg's own commit, is refused and restored
   rather than recorded as `unit-merged`; so is an incoming path the unit deletes
@@ -1638,13 +1352,13 @@ breaking changes may land in a minor release.
   and keeps its bare row).
 
 - Recover sweep migration publication faults without persisting unearned `DONE`
-  state (DW-296/DW-297). Persist accepted baseline/rewrite records, clear a
+  state. Persist accepted baseline/rewrite records, clear a
   pre-dispatch baseline after publication refusal, restore result-faulted ledgers
   by compare-and-set, and resume a durable `COMMITTING` task through the commit-only
   tail.
 
 - Bind tracked and pending-tracked isolated bundle deliverables to their accepted
-  Git-normalized bytes and validate their exact staged entries before commit (DW-300).
+  Git-normalized bytes and validate their exact staged entries before commit.
   Drift now pauses with path-only recovery evidence and retains the source mount;
   the validated index is committed without a second working-tree staging pass. The
   no-op arm is validated too: an index reset to baseline after the staged validation
@@ -1654,27 +1368,27 @@ breaking changes may land in a minor release.
   The integrated target commit and post-hook index are validated ahead of `unit-merged`
   as well, so a target-side hook rewriting a tracked deliverable in the integration's own
   commit never lands it under the bundle's name (the receipt-backed refusal and restore
-  are DW-302/DW-303's, below).
+  are below).
 
 - Sample destination pathname identity after streamed artifact probes, refusing observed
-  detachment while retaining checked-fallback races (DW-301).
+  detachment while retaining checked-fallback races.
 
 - Stream artifact destination hashing and equality checks in fixed-size chunks, bounding
   baseline-capture and publication memory even when operator-owned files are large or grow
-  during validation (DW-298/DW-299).
+  during validation.
 
 - Restore attempt-owned specs through descriptor-capable parent-anchored publication and
   verification on POSIX, preventing late parent substitution from redirecting bytes; retain
-  checked path-based restoration on no-descriptor platforms (DW-295).
+  checked path-based restoration on no-descriptor platforms.
 
 - Bind explicitly published ignored bundle deliverables to the exact bytes accepted by final
-  dev, repair, or review verification (DW-290). Preparation now refuses post-verification byte
+  dev, repair, or review verification. Preparation now refuses post-verification byte
   or declaration drift before freezing a payload, retains the source mount and evidence for
   recovery, and cannot refresh authority by replaying the same accepted result after a crash.
   It re-derives the tracked declaration set too, so a spec outside `implementation_artifacts`
   cannot swap one tracked deliverable for another after acceptance (Codex P1 on #795).
 
-- Bound isolated artifact publication payload preparation (DW-289) to measured raw-byte
+- Bound isolated artifact publication payload preparation to measured raw-byte
   defaults of 5 MiB per ignored file and 10 MiB aggregate. Preflight now rejects an
   oversize selection before any base64 encoding, bounded reads catch file-growth races,
   and the existing refusal pause retains the source for a no-redispatch resume. Tracked
@@ -1682,48 +1396,48 @@ breaking changes may land in a minor release.
   replay idempotently.
 
 - Refuse concatenated `Artifactonly: true` assertions while preserving accepted
-  separated spellings (DW-291). The artifact-only line's gaps now take the same
-  horizontal-whitespace class as `Status:` (DW-285), so a vertical separator such as
+  separated spellings. The artifact-only line's gaps now take the same
+  horizontal-whitespace class as `Status:`, so a vertical separator such as
   `\x0b` between the label and `true` no longer mints the receipt.
 
 - Preserve attempt binding and seed-delivery observer fallbacks when named path
-  resolution guards receive embedded-NUL or lone-surrogate faults (DW-292/DW-294).
+  resolution guards receive embedded-NUL or lone-surrogate faults.
 
 - Distinguish ownership-path resolution faults from proven-external paths at the
   residual deferred-work and sprint-board probes, preserving conservative recovery
-  and carry behavior (DW-293).
+  and carry behavior.
 
 - Handle embedded-NUL and lone-surrogate faults at the named observation,
-  configuration, stories, worktree, restore, and recovery resolution guards (DW-287).
+  configuration, stories, worktree, restore, and recovery resolution guards.
 
 - Route terminal isolated sweep harvest-carry read faults through the sweep
   story-gate repair pause while preserving the engine route for direct defer and
-  ordinary story carries (DW-286).
+  ordinary story carries.
 
 - Parse independently bold Auto Run `Status` values without allowing bare labels
-  to consume next-line tokens (DW-285).
+  to consume next-line tokens.
 
 - Preserve explicit ignored bundle artifacts before isolated worktree teardown; capture
   destination baselines, refuse conflicting edits, and replay interrupted publication
-  without losing recoverable sources (DW-283). This lifts the interim refusal of the
+  without losing recoverable sources. This lifts the interim refusal of the
   artifact-only receipt for an artifacts dir rebased into a unit worktree: the
   accepted spec is carried by publication, so the receipt stands under isolation.
 
 - Advertise conditional artifact-only receipts in all bundle prompts and sweep
-  triage guidance, including verification gates and isolated-publication limits (DW-284).
+  triage guidance, including verification gates and isolated-publication limits.
 
 - Show unreadable sweep-ledger refusals and repair guidance on dashboard resume
-  before launching a detached window (DW-270).
+  before launching a detached window.
 
 - Pause existing engine and sweep locked-read repair routes on OS metadata and
-  text-read faults, preserving task phase, pending work and ledger bytes (DW-279).
+  text-read faults, preserving task phase, pending work and ledger bytes.
   Wrap these faults as `LedgerReadFault(LedgerReadError)` with the original
   `OSError` chained; retain absence/decode handling, OS refusal attribution, and
   raw `OSError` from pre-lock probes, lock acquisition and writes.
 
 - Resume a pending review-timeout salvage refile over the preserved product after
   ledger repair, rerunning verification without rebuilding or new dev/review sessions
-  under either rollback policy; retain ordinary commit gates (DW-278). The latch is
+  under either rollback policy; retain ordinary commit gates. The latch is
   set at every salvage's handoff save — the first, fault-free salvage included, not
   only the repair-pause arm — so a host lost between that save and the commit
   (notification, a `pre_commit_gate` workflow) replays the salvage with zero sessions
@@ -1733,12 +1447,11 @@ breaking changes may land in a minor release.
   forced a review the fresh attempt never asked for.
 
 - Notify operators when a ledger snapshot outage leaves story-declared deferred
-  closes unapplied, naming the story, every declared ID, and the fault (DW-277).
+  closes unapplied, naming the story, every declared ID, and the fault.
 
 - Fold a `ValueError` from the publisher target resolve into `target-unreadable` at
   the three publisher arms — `engine._publication_refusal`, `SweepEngine._commit_ledger`,
-  `decisions.apply_pre_answer` — instead of letting it escape best-effort bookkeeping
-  (DW-275). `Path.resolve()` raises `ValueError` for an embedded NUL, and its
+  `decisions.apply_pre_answer` — instead of letting it escape best-effort bookkeeping. `Path.resolve()` raises `ValueError` for an embedded NUL, and its
   `UnicodeEncodeError` subclass for a lone surrogate, on CPython 3.11-3.14 POSIX; the
   arms caught `(OSError, RuntimeError)` only. The refusal row, journal row and cause
   are unchanged; the fault text rides in `error`.
@@ -1746,11 +1459,10 @@ breaking changes may land in a minor release.
 - Pause at the story gate under `sweep-bundle-close-refused` with a `-locked` site,
   instead of `run-crash`, when a deferred-work ledger turns undecodable inside the
   locked window of one of the sweep's three bundle-close mutator calls — the
-  accepted-dev close, the review-leg reclose, the isolated close carry (DW-280,
-  the DW-259 residual). The task's phase and recorded close intent are left
+  accepted-dev close, the review-leg reclose, the isolated close carry. The task's phase and recorded close intent are left
   untouched, so `bmad-loop resume` re-drives the close — with no session spent at
   the accepted-dev close and the carry; through the sweep's restart arm (the
-  bundle re-driven from dev) at the reclose. DW-279 extends the same locked-read
+  bundle re-driven from dev) at the reclose. A later fix extends the same locked-read
   route to OS metadata/text-read faults, and the row keeps that classification:
   `reason="ledger-inaccessible"` with a permissions-or-storage steer for an OS
   refusal, `reason="ledger-unreadable"` with a UTF-8 steer for undecodable bytes,
@@ -1760,13 +1472,12 @@ breaking changes may land in a minor release.
   `run-crash`, when a deferred-work ledger turns undecodable inside a mutator's own
   locked window — the harvest's seen-again mark and append, the commit-boundary
   `closes_deferred:` close, the review-timeout salvage refile, the isolated harvest
-  and close carries (DW-259). `bmad-loop resume` retries the write; the notice now
-  names a declared close. DW-279 extends the same locked-read route to OS
+  and close carries. `bmad-loop resume` retries the write; the notice now
+  names a declared close. A later fix extends the same locked-read route to OS
   metadata/text-read faults; lock/write failures remain raw `OSError`.
 
 - Route a deferred-work ledger read the OS refuses (EACCES, EIO, ELOOP) at the
-  engine's four direct `read_for_write` sites the way DW-231 routes a decode fault
-  (DW-258), instead of ending the run as `run-crash` with the completed session's
+  engine's four direct `read_for_write` sites the way a decode fault is routed, instead of ending the run as `run-crash` with the completed session's
   work on disk. The observation reads (proof-of-work digest, pre-harvest and defer
   snapshots, both restores) degrade to a typed `_UnreadableLedger` that carries no
   digest and journal `ledger-read-degraded`; the two publish reads (spec-deferral
@@ -1779,10 +1490,9 @@ breaking changes may land in a minor release.
   after the repair cannot pass a session that wrote nothing.
 - Arm the sweep's persisted ledger doubt when the ledger's path cannot be resolved,
   so the cycle's bundles are withheld instead of crashing at the bundle intent's
-  own ledger read (DW-260). A git-fault degrade after a successful resolve stays
+  own ledger read. A git-fault degrade after a successful resolve stays
   un-armed; the `sweep-ledger-commit-unavailable` row is unchanged on both arms.
-- Make a resumed sweep honour and announce its own persisted ledger doubt (DW-246,
-  DW-244, DW-251). The three ledger publishers that run on a resume ahead of the
+- Make a resumed sweep honour and announce its own persisted ledger doubt. The three ledger publishers that run on a resume ahead of the
   dispatch gate — the already-resolved close's own publish, its stranded-close
   republish, and the publisher above the loop body (the post-recovery publish, and
   the persisted commit-debt settle it shares — the only trigger that still reaches
@@ -1799,7 +1509,7 @@ breaking changes may land in a minor release.
   arming class never wrote one, so the run that withheld said nothing — with its
   rows and return unchanged.
 - Gate the nothing-open exit's stranded-close publisher whole on the run's persisted
-  ledger doubt, and probe its decision ids individually (DW-250, DW-249).
+  ledger doubt, and probe its decision ids individually.
   `_publish_stranded_close` now reads `_ledger_unfit_to_publish()` once, above BOTH of
   its probes, after the triage cache validates and the plan names at least one id:
   a doubted resume journals `sweep-ledger-commit-withheld` with the close message,
@@ -1814,7 +1524,7 @@ breaking changes may land in a minor release.
   an empty list still authorizes nothing, and read faults still degrade to
   `sweep-resolved-close-unavailable` with the union of ids.
 - Route a deferred-work ledger read fault at the engine's own sites and at the resume
-  gate (DW-231, DW-234). The base engine now catches `LedgerReadError` at its four
+  gate. The base engine now catches `LedgerReadError` at its four
   direct `read_for_write` sites: observation reads (proof-of-work digest, pre-harvest
   and defer snapshots, both restores) degrade to a typed answer nothing can write back
   and journal `ledger-read-degraded`; the two publish reads (spec-deferral harvest,
@@ -1823,23 +1533,20 @@ breaking changes may land in a minor release.
   instead of crashing as `run-crash` — replaying the recorded session result where
   one exists (dev and review legs), re-driving the leg otherwise. The residual —
   `deferredwork` mutators' own locked re-reads and the review-timeout salvage refile
-  still raised — was recorded as a deferral and is closed by DW-259 (entry above).
+  still raised — is closed by the entry above.
   `runs.unreadable_sweep_ledger` gains the `except OSError` arm — its own
   permissions-or-storage attribution on the `bmad-loop sweep`
   route the sweep's own stop already gives — a recorded reversal: the arm was
-  written, struck by the DW-204 resolution on scope grounds, and is restored under
-  DW-234's accepted decision; the TUI's stopgap `except OSError` around the probe is
+  written, struck on scope grounds, and is now restored; the TUI's stopgap `except OSError` around the probe is
   removed as dead.
-- Propagate ledger metadata refusals consistently across supported Python versions
-  (DW-221). Treat ELOOP and EBADF as errors; a cyclic ledger symlink is a refusal
+- Propagate ledger metadata refusals consistently across supported Python versions. Treat ELOOP and EBADF as errors; a cyclic ledger symlink is a refusal
   rather than an absence at every `read_for_write` site — routed where the harvest
-  reads (DW-258 above: degraded observation, paused publish); where no publish read
+  reads (as above: degraded observation, paused publish); where no publish read
   is reached, the story completes and a declared close journals the outage.
 - Report refused sweep ledger metadata as `ledger-inaccessible` with error details
-  and arm ledger doubt through the existing reader handlers (DW-253).
+  and arm ledger doubt through the existing reader handlers.
 - Report directories, FIFOs and sockets at the ledger path as `target-not-a-file`.
-  Preserve `target-unreadable` when metadata becomes inaccessible between probes
-  (DW-238).
+  Preserve `target-unreadable` when metadata becomes inaccessible between probes.
 - Guard the five remaining `verify.commit_paths` callers with the publishable-target
   check their sibling publishers already take, so a directory left at a ledger, board,
   spec or park-record name is no longer handed to `git add` as a literal pathspec and
@@ -1851,39 +1558,38 @@ breaking changes may land in a minor release.
   (`target-undecodable`, a fourth `refuse_cause`) from a TRANSIENT OS fault
   (`target-unreadable`), so the harvested-deferral carry refuses the former outright
   and hands only the latter back to git, where its commit latch survives — an
-  undecodable ledger no longer reaches HEAD through that fall-through (DW-237).
+  undecodable ledger no longer reaches HEAD through that fall-through.
 - Probe operand presence in `commit_paths` with `lstat`, which suppresses nothing on
   any interpreter, so a tracked candidate under an unsearchable parent is reported as
-  uncertain instead of being ruled missing and staged as a deletion on Python 3.14
-  (DW-239).
+  uncertain instead of being ruled missing and staged as a deletion on Python 3.14.
 - Take the readable-ledger refusal at `bmad-loop resolve`'s entry and at the TUI's
   re-arm gesture, ahead of the interactive session and of `rearm_escalation`, so an
   escalated sweep over an undecodable ledger keeps its escalation instead of spending
   it; one shared probe now serves all three surfaces, and `docs/FEATURES.md` documents
-  the refusal, its declines and its precedence (DW-229, DW-230, DW-235).
+  the refusal, its declines and its precedence.
 - Screen an adopted `build` answer against the ledger's live open set before it mints a
   bundle, dropping an id the ledger no longer holds open under a fifth `drop_cause`,
   `entry-not-open`; a ledger read that refuses screens nothing and journals
-  `sweep-decision-open-set-refused` (DW-214).
+  `sweep-decision-open-set-refused`.
 - Recover stranded decision closes at the sweep's no-open exit, withholding the
   whole recovery publish — its already-resolved term too, since the commit is of
   the file — while the run retains ledger doubt; the close phase's own two commit
   arms read the same verdict, so a resume that inherited a doubt no longer walks a
-  half-landed decision flip into HEAD ahead of the dispatch gate (DW-222).
+  half-landed decision flip into HEAD ahead of the dispatch gate.
 - Retry ledger publication before repeating sweeps stop on `no-progress` or
   `max-cycles`; rename the commit message to
-  `chore(sweep): commit ledger at the sweep cycle boundary` (DW-223).
+  `chore(sweep): commit ledger at the sweep cycle boundary`.
 - Degrade triage-cache metadata read failures to `sweep-triage-reload-failed` and
-  fresh triage, with absent caches remaining silent (DW-224).
+  fresh triage, with absent caches remaining silent.
 - Degrade a refused triage-cache write-back to a new `sweep-triage-cache-write-failed`
   journal kind and still return the validated plan, instead of crashing the sweep
   after a healthy triage; a directory planted at the cache path lands on the same
-  row (DW-247).
+  row.
 - Pause a resume at the story gate when an in-flight bundle's intent document must
   be regenerated and the ledger read refuses, journaling `sweep-intent-ledger-refused`
   (`ledger-unreadable` / `ledger-inaccessible`) and leaving the run resumable and the
   bundle task PENDING, instead of crashing at that read ahead of every cycle gate;
-  `bmad-loop resume` after the repair re-drives the same bundle (DW-243).
+  `bmad-loop resume` after the repair re-drives the same bundle.
 - Screen every bundle reaching the final keep loop — a cached plan's own bundles
   included — against the ledger's live open set, skipping one whose ids are not all
   open under `sweep-bundle-skipped` `reason="entry-not-open"`; `_write_intent` now
@@ -1891,25 +1597,25 @@ breaking changes may land in a minor release.
   ledger entry, and the regeneration path journals that refusal as
   `sweep-intent-regen-refused` and pauses the run the same way rather than dispatching
   a session briefed on an empty entries section or letting fresh triage run beside
-  the refused bundle (DW-252).
+  the refused bundle.
 - Unlink a triage cache whose read faults before re-triaging
   (`sweep-triage-cache-invalidated`, or `sweep-triage-cache-unlink-failed` on a refused
   unlink) and write the cache back atomically, so a refused or short overwrite can no
-  longer leave an older or torn plan for the next resume to replay (DW-263).
+  longer leave an older or torn plan for the next resume to replay.
 - Probe `<run>/decisions.json`'s metadata with `stat()` rather than `is_file()` so a
   refusal of that probe degrades to `sweep-decisions-reload-failed` and the pending path on
-  Python 3.11–3.13 instead of aborting the sweep over a bookkeeping read (DW-248).
+  Python 3.11–3.13 instead of aborting the sweep over a bookkeeping read.
 - Degrade a refused SEEDED write-back of `<run>/decisions.json` (a directory planted at
   the store; a refused or redirected parent — `UnconfinedWriteError`, the #593 confinement
   refusal) to a new `sweep-decisions-store-write-failed` journal kind naming the adopted
   ids, and carry on with the answers in memory, instead of aborting an otherwise healthy
   sweep; the interactive write-back stays bare so a human's answer whose write FAILS still
-  stops the sweep loudly (DW-262).
+  stops the sweep loudly.
 - Withhold the seeded `<run>/decisions.json` write-back for the cycle when the store's
   metadata probe or content read was refused with an `OSError`, journaling
   `sweep-decisions-store-write-withheld` with the adopted ids whose answers stay in memory,
   so a transient read refusal no longer replaces a store of valid answers with an empty
-  map; decode faults and a non-object top level still replace the file wholesale (DW-264).
+  map; decode faults and a non-object top level still replace the file wholesale.
   In the same cycle the interactive prompt is not put at all
   (`sweep-decisions-prompt-withheld`, ATTENTION notice): an answer that cannot be
   persisted is not taken, so a crash can no longer lose a `build` authorization held only
@@ -1922,31 +1628,31 @@ breaking changes may land in a minor release.
   archived nothing, `record_decision` answering "no such entry" — and ELOOP and EBADF
   move to the fault side on Python 3.11–3.13 too, so a symlink loop at the ledger's name
   now raises out of all five instead of taking the no-op return. An absent ledger still
-  returns the no-op value without a lock (DW-255).
+  returns the no-op value without a lock.
 - Answer the publishable-target guard's store leg from one `lstat()`, so a refused
   store is `target-unreadable` on Python 3.14 too, where the
   `is_file()`/`is_symlink()`/`exists()` probes suppressed the refusal and degraded it to
   `target-absent`; a regular file and the 3.13+ symlink-loop link entry still publish,
-  a directory or FIFO is still `target-not-a-file` (DW-257).
+  a directory or FIFO is still `target-not-a-file`.
 - Probe the project-level pre-answer store's metadata inside `load_pre_answers`' own
   guard, so a refusal degrades to `{}` as the docstring promises instead of re-raising
-  out of `_decisions_phase` on Python 3.11–3.13 (DW-261).
+  out of `_decisions_phase` on Python 3.11–3.13.
 - Probe the ledger's metadata with `stat()` + `S_ISREG` in `read_for_observation`, so a
   refused ledger degrades to an attributed `PermissionError:` fault on Python 3.14
   instead of silent absence; `ENOENT`/`ENOTDIR` and a non-regular file stay absence,
   and a symlink loop is now an attributed fault at the observation arm as it already
-  was at the write arm (DW-254).
+  was at the write arm.
 - Probe the ledger's metadata with `stat()` + `S_ISREG` inside `Engine._refuse_gated_story`'s
   own `try`, so a refused ledger pauses the run at `PAUSE_STORY_GATE` on Python 3.14 too,
   where `is_file()` suppressed the refusal and the `gate:` hard gate failed OPEN — the story
   dispatched and `story-gate-unreadable` was unreachable; `ENOENT`/`ENOTDIR` and a
   non-regular file stay the empty ledger, and a symlink loop at the ledger's name now
-  pauses at the gate instead of passing it (DW-266; also closes DW-276). A configured
+  pauses at the gate instead of passing it. A configured
   ledger path the OS cannot encode takes the same pause instead of crashing the run.
 - Same probe inside `validate`'s deferred-ledger read and `verify_review_bundle`'s, so on
   Python 3.14 a refused ledger is the `deferred.ledger-unreadable` problem rather than a
   clean deferred check, and the non-fixable "deferred-work ledger unreadable" retry rather
-  than the fixable "entries not marked done" one (DW-267). A configured ledger path the
+  than the fixable "entries not marked done" one. A configured ledger path the
   OS cannot encode is that problem and that retry rather than a crash.
 - Take ledger absence from the observation reader's own answer in `sweep --dry-run` and
   `SweepEngine._non_write_state`, and probe the archive's post-report presence inside its
@@ -1955,8 +1661,8 @@ breaking changes may land in a minor release.
   deferred-work ledger" / "the ledger file is gone" on Python 3.14, and at the two CLI
   sites not a `PermissionError` traceback on 3.11–3.13 (`_non_write_state` already
   degraded there). A 0-byte ledger now reads as "no deferred-work ledger" in the dry-run
-  listing (DW-265).
-- Retire the two decision non-write `is_file()` probes that DW-265 left behind: the
+  listing.
+- Retire the two decision non-write `is_file()` probes left behind: the
   sweep's interactive decision arm now takes its `sweep-decision-effect-unavailable`
   sentence from `_non_write_state`, and `bmad-loop decisions`' outcome line asks the
   observation reader, so a refused ledger reads "holds no entry for this id" and
@@ -1968,22 +1674,21 @@ breaking changes may land in a minor release.
   a present 0-byte ledger reads "holds no entry" at both — the recorder reached it and
   found nothing — through a presence-aware sibling of the observation reader
   (`deferredwork.observe_ledger`, `None` text for absence) rather than the text-only
-  reader's empty text, which had made an empty ledger read as gone (DW-281, DW-282).
+  reader's empty text, which had made an empty ledger read as gone.
 - Absorb pathlib's ignored winerrors (21 `ERROR_NOT_READY`, 123 `ERROR_INVALID_NAME`,
   1921 `ERROR_CANT_RESOLVE_FILENAME`) and the `ValueError` a non-encodable path raises as
   ABSENCE at the ledger's repair/write reader, the five mutators' pre-lock guard and both
   legs of the publishable-target guard, through one shared `deferredwork.probe_absence`
   — the set `is_file()` absorbed before the `stat()` probes replaced it — so a ledger on
   a disconnected mapped drive or at a lexically invalid Windows path now READS AS ABSENCE
-  (an empty ledger) at every `read_for_write` consumer, as it did before DW-221: the
+  (an empty ledger) at every `read_for_write` consumer, as it did before: the
   sweep's cycle gates end on `no-open` instead of `ledger-inaccessible`, the resume entry
-  gate admits the resume instead of refusing with the DW-234 storage-fault route, and the
+  gate admits the resume instead of refusing with the storage-fault route, and the
   mutators take their no-op return. A NUL in the store path no longer escapes the guard
   as a `ValueError` (the publishers' own `resolve()` arms still raise it on POSIX,
   unchanged).
   `EACCES`/`EIO`/`ESTALE`/`EBADF`/`ELOOP` and every other winerror still raise or fold
-  to `target-unreadable`; `commit_paths` keeps reporting the winerrors into uncertainty
-  (DW-256, DW-268).
+  to `target-unreadable`; `commit_paths` keeps reporting the winerrors into uncertainty.
 
 - Mirror a sweep cycle's ledger-in-doubt verdict onto run state at every site that
   ARMS it — not at the dispatch gate, and not at the decision phase's tail publish,
@@ -2001,10 +1706,10 @@ breaking changes may land in a minor release.
   own commit is a whole-tree `git add -A` — and is journaled as withheld and then
   stranded rather than dispatched around the gate. Legacy prose met on such a
   resume is not migrated either: the rewrite session and its commit are refused
-  on the doubt's own `ledger-unreadable` stop and repair notice (DW-218/219).
+  on the doubt's own `ledger-unreadable` stop and repair notice.
 
 - Withhold sweep bundles and ledger commits after close, re-apply, or idle decision
-  faults; preserve pre-answers while the ledger is in doubt (DW-216/217/220).
+  faults; preserve pre-answers while the ledger is in doubt.
 
 - Publish the out-of-band decisions answer ONE OPERAND AT A TIME, each rooted at that
   operand's own resolved parent, and report a publish git could not make. One
@@ -2017,7 +1722,7 @@ breaking changes may land in a minor release.
   `PublishFailure` that the CLI line and the TUI toast both print through the shared
   `publish_note()`, under a `commit-unavailable` token beside the existing refusals.
   A `build`/`keep-open` answer whose operands share a repository now makes two commits
-  carrying the same message (DW-225, DW-226).
+  carrying the same message.
 
 - Refuse to publish a decisions store that is present but not a REGULAR FILE, under a
   third `refuse_cause` token, `target-not-a-file`, preserving the existing symlink-loop
@@ -2026,7 +1731,7 @@ breaking changes may land in a minor release.
   and `commit_paths` handed that literal pathspec to `git add`, which stages the
   directory's descendants recursively. `is_file()` follows symlinks, so a store
   symlinked to a regular file still publishes, and the store's bytes are still never
-  examined (DW-211, DW-228).
+  examined.
 
 - Fold a metadata-probe fault into a refusal instead of letting it escape a best-effort
   publisher. On Python 3.11-3.13, `Path.exists()`/`is_file()`/`is_symlink()` raise on
@@ -2035,28 +1740,27 @@ breaking changes may land in a minor release.
   store guard now answers `target-unreadable` and `commit_paths` omits only the faulted
   candidate, raising just when no usable operand survives. Python 3.14 suppresses all OS
   errors inside those three convenience probes, so both sites have since moved to `lstat`
-  instead (`commit_paths` under DW-239, the store guard under DW-257), which reports the
-  fault on every interpreter and makes this fold uniform across them
-  (DW-227).
+  instead (`commit_paths` and the store guard), which reports the
+  fault on every interpreter and makes this fold uniform across them.
 
 - Refuse `bmad-loop resume` for a sweep run whose deferred-work ledger does not decode,
   naming the file, the decode fault and the repair. Such a resume used to arm the run (pid
   publication, policy re-stamp, `run-resume` row) and only then meet the ledger, stopping
   with no repair route offered from this surface. An absent ledger is not a refusal and
-  story runs are unaffected (DW-204). DW-234 also routes OS refusal at this entry
-  gate with a permissions/storage repair notice; DW-279 preserves that attribution
+  story runs are unaffected. OS refusal at this entry gate also gets a
+  permissions/storage repair notice, and that attribution is preserved
   when `read_for_write` wraps the original `OSError` as `LedgerReadFault`. The
-  metadata probe reports refusal on every supported interpreter since DW-221.
+  metadata probe reports refusal on every supported interpreter.
 
 - Diagnose a `null` or bare-string member of a migration result's `mapping` list as the
   shape fault it is — `mapping[0] not an object: NoneType` — instead of reporting
   `mapping invents unknown key ''` into the migrate-decision journal record, the retry
   feedback the next migration session is handed, and the attempt-cap escalation
-  reason (DW-190).
+  reason.
 
 - Prevent out-of-band decision answers from committing a vanished ledger's deletion
   or files the answer did not write. Report refused publication in the CLI and TUI,
-  preserving the recorded count and decision walk (DW-209, DW-213).
+  preserving the recorded count and decision walk.
 
 - Commit an already-resolved close whose ledger write landed but whose commit never
   ran. A crash between the two left the resume replaying a triage plan that flipped
@@ -2068,7 +1772,7 @@ breaking changes may land in a minor release.
   now also happens at the sweep loop's nothing-open exit, gated on this cycle's
   triage cache already being on disk: a fresh sweep has none and still spawns no git,
   and a cache or probe fault there journals `sweep-triage-reload-failed` /
-  `sweep-resolved-close-unavailable` and publishes nothing (DW-193).
+  `sweep-resolved-close-unavailable` and publishes nothing.
 
 - Degrade a sweep's ledger read when the OS refuses it, at the three sites that GATE a
   cycle: the pre-answer prune and `_loop`'s two top-of-cycle reads. The other
@@ -2077,10 +1781,10 @@ breaking changes may land in a minor release.
   earlier cycles had completed — as crashed. The refusal is journaled
   (`sweep-preanswer-prune-refused` / `sweep-cycle-ledger-refused`) and ends a run on a
   new `ledger-inaccessible` stop token, kept distinct from `ledger-unreadable` because
-  the operator repair differs. `deferredwork.read_for_write` is unwidened (DW-197).
+  the operator repair differs. `deferredwork.read_for_write` is unwidened.
 
 - Withhold sweep bundles when a decision effect leaves the ledger unfit to publish,
-  and stop repeating sweeps with repair instructions (DW-194/202/210).
+  and stop repeating sweeps with repair instructions.
 
 - Stop a decision effect that never landed from speaking for the human at its two
   stored-answer consumers. A stored `close` for an entry the ledger still lists as
@@ -2088,7 +1792,7 @@ breaking changes may land in a minor release.
   the answer write and the effect no longer leaves the decision permanently
   unapplied and never re-asked (`sweep-decision-effect-reapplied`; the write order is
   unchanged, and an unreadable or absent ledger re-applies nothing and journals one
-  `sweep-decision-effect-unavailable` per candidate id) — DW-167. That replay is the
+  `sweep-decision-effect-unavailable` per candidate id). That replay is the
   one caller of `record_decision`'s new keyword-only `require_open`, which re-checks
   the still-open premise inside the same locked read/edit/write as the mutation, so a
   rival writer closing the entry between the walk's gate and its write is refused
@@ -2097,13 +1801,13 @@ breaking changes may land in a minor release.
   diagnostic probe from aborting the sweep. A `build` answer whose `record_decision`
   reported writing no line now takes a fourth drop lane
   (`drop_cause: effect-unlanded`) rather than materializing a bundle and spending a
-  dev session on an id the ledger holds no entry for — DW-200. That verdict is
+  dev session on an id the ledger holds no entry for. That verdict is
   persisted where it is observed (`sweep_unlanded_decisions` on run state, cleared by
   the drop that announces it), so an interruption between the non-write and the drop
   resumes into the same refusal instead of reviving the bundle.
 
 - Report a ledger that took no `decision:` line at the two surfaces that answer
-  decisions outside a sweep (DW-198). `decisions.apply_pre_answer` returns
+  decisions outside a sweep. `decisions.apply_pre_answer` returns
   `record_decision`'s boolean instead of discarding it, so `bmad-loop decisions` no
   longer prints `closed now` and the TUI modal no longer counts the answer into
   `recorded N decision(s)` when the ledger file is gone or a rival writer retired the
@@ -2113,7 +1817,7 @@ breaking changes may land in a minor release.
 
 - Commit a ledger write an interrupted sweep phase left unpublished. The
   already-resolved close and the decision phase gate their commit on the write THIS
-  invocation made (DW-183/DW-185), and a process that died between the publish and
+  invocation made, and a process that died between the publish and
   the commit replayed as a phase that wrote nothing — the ids already `done`, the
   answer already saved — leaving the closure dirty ahead of the cycle's bundles, to
   be absorbed by a story commit, discarded by a rollback, or left at run end. Both
@@ -2127,12 +1831,12 @@ breaking changes may land in a minor release.
   is never retracted by a replay that closes nothing.
 
 - Handle non-dictionary session result documents through existing empty-document
-  paths (DW-206/DW-207). Share read-time normalization across engine, stories,
+  paths. Share read-time normalization across engine, stories,
   sweep, and verification consumers so malformed results reach the existing
   refusal paths instead of crashing; preserve dictionary identity and snapshots.
 
 - Validate the target before publishing it in every sweep ledger/pre-answer-store
-  commit (DW-199/203/205). `commit_paths` keeps a missing-but-tracked path as a
+  commit. `commit_paths` keeps a missing-but-tracked path as a
   deletion to stage, so a ledger removed after the phase wrote it was committed AWAY
   under a `chore(sweep):` message — at the decision phase's commit gate and at the
   repeat boundary — and a resume whose ledger held undecodable bytes published them
@@ -2144,14 +1848,14 @@ breaking changes may land in a minor release.
   only the publish that preceded it is gone.
 
 - Make `escalation._escalation_list` and `sweep._normalize_bundle_names` total on a
-  non-dict JSON result document (DW-181). Return their existing empty results (`[]`
+  non-dict JSON result document. Return their existing empty results (`[]`
   and `()`) for wrong-shaped documents, preserving dictionary and `None` behavior.
   The normalizer previously guarded only `None`, so falsy non-dicts now return
   `()` too. This hardened direct helper calls only; the earlier engine dereference
   still crashed before a malformed session document could reach the sweep
-  validators, which DW-206 above closes.
+  validators, which the entry above closes.
 
-- Close the two ledger write-fault arms the DW-166 pass left bare (DW-182/186). A
+- Close the two ledger write-fault arms an earlier pass left bare. A
   deferred-work ledger holding undecodable bytes raised out of the pre-answer prune —
   the LAST call of a sweep cycle — and reported a fully completed cycle as crashed;
   it now takes the existing `sweep-preanswer-prune-refused` row under a second fixed
@@ -2173,8 +1877,7 @@ breaking changes may land in a minor release.
   the undecodable bytes stay dirty for a human to repair. The absent-ledger arm is
   unchanged: it stays cycle-local and the next cycle ends on `no-open`.
 
-- Narrow every sweep bookkeeping commit to the file the phase actually published
-  (DW-183/185/187/188). `_commit_ledger` now takes that FILE rather than a root: it
+- Narrow every sweep bookkeeping commit to the file the phase actually published. `_commit_ledger` now takes that FILE rather than a root: it
   resolves it — following symlinks, as the atomic writer already does, so a ledger
   symlinked out of the project commits in the repository holding its target — roots
   both git calls at the resolved parent, and pathspecs the dirty check and the commit
@@ -2186,11 +1889,11 @@ breaking changes may land in a minor release.
   spawns no git.
 
 - Sanitize bundle, untriaged-ID, and migration diagnostics so object values print
-  their position or type instead of their contents (DW-178–180). Preserve string
+  their position or type instead of their contents. Preserve string
   wording and acceptance behavior; render non-string scalar mapping keys without
   stringification quotes.
 
-- Keep a sweep running when the deferred-work ledger will not read (DW-166). An
+- Keep a sweep running when the deferred-work ledger will not read. An
   undecodable ledger during the already-resolved close, or during an attended
   decision's effect, ended the whole sweep as crashed — on the decision path after the
   human's answer had already been saved and journaled. Both now journal the fault
@@ -2205,7 +1908,7 @@ breaking changes may land in a minor release.
   `os.close`), which the same arm had read as "nothing was written" while the closure
   was already on disk.
 
-- Commit the deferred-work ledger in the tree that owns it (DW-175). `implementation_artifacts`
+- Commit the deferred-work ledger in the tree that owns it. `implementation_artifacts`
   is configurable to any absolute path, so the ledger may sit under the project, inside
   a disjoint `repo_root`, or in no git repository at all — and a single fixed root is
   wrong in two of the three. Ledger commits now name the ledger's own directory and let
@@ -2218,21 +1921,18 @@ breaking changes may land in a minor release.
   re-rooting — the cycle's bundles would otherwise run against the dirty baseline the
   commit was meant to clean. The store's commits keep degrading on both.
 
-- Stop a sweep wiping every recorded pre-answer when the ledger vanishes mid-cycle
-  (DW-176). An absent ledger read as "nothing is open" and dropped the whole store,
+- Stop a sweep wiping every recorded pre-answer when the ledger vanishes mid-cycle. An absent ledger read as "nothing is open" and dropped the whole store,
   committing the wipe; it now journals `sweep-preanswer-prune-refused` and writes
   nothing. An empty-but-present ledger still prunes.
 
-- Withhold the decision phase's ledger commit when the LAST decision effect faulted
-  (DW-166), so the ledger bytes that would not parse are never published; a later
+- Withhold the decision phase's ledger commit when the LAST decision effect faulted, so the ledger bytes that would not parse are never published; a later
   effect that reads and writes the ledger settles the doubt and the commit happens,
   carrying the earlier decisions' lines with it. The attended hand-back no longer
   prints `✓ decisions recorded` when any effect missed the ledger — it reports that
   the answers are saved, that not every decision reached the ledger, and which
   journal kind names the misses.
 
-- Stop a re-dispatched sweep bundle from carrying the SUPERSEDED bundle's state
-  (DW-162, DW-163, DW-165). `Sweep._run_bundle` already adopted a different bundle's
+- Stop a re-dispatched sweep bundle from carrying the SUPERSEDED bundle's state. `Sweep._run_bundle` already adopted a different bundle's
   `dw_ids` onto a task `_recover_inflight_bundle` had reset to PENDING, but every other
   per-bundle field stayed: `bundle_closes_intended` (which the DONE-leg ledger carry and
   the engine's replay predicate both read, so it closed ids this task never ran),
@@ -2247,7 +1947,7 @@ breaking changes may land in a minor release.
   ownership. Defensive: no reachable sequence was demonstrated for the `spec_file` /
   `restore_patch` half.
 
-- Grade a persisted sweep bundle intent document against the task that owns it (DW-164).
+- Grade a persisted sweep bundle intent document against the task that owns it.
   `_run_bundle` writes `task.bundle_file` and only then `_save()`s the adopted ids, so a
   crash between them left `_ensure_bundle_intent` reusing a still-existing document whose
   `dw_ids:` line named ids the task no longer carried. Re-ordering the two writes only
@@ -2260,7 +1960,7 @@ breaking changes may land in a minor release.
   the field's whole purpose. An EMPTY `task.dw_ids` (the pre-`dw_ids` `state.json` shape)
   is not an authority and keeps its real document.
 
-- Serialize the project pre-answer store's three writers (DW-161). `record_pre_answer`,
+- Serialize the project pre-answer store's three writers. `record_pre_answer`,
   `prune_pre_answers` and `drop_pre_answer` each did an unlocked `load_pre_answers` ->
   `_write_store`, so a `bmad-loop decisions` answer, a TUI decision modal or a second sweep
   landing in that window was overwritten wholesale — the store read-modify-writes the WHOLE
@@ -2274,7 +1974,7 @@ breaking changes may land in a minor release.
   mtime untouched. Readers stay lock-free; a real write can now surface a lock-acquisition
   failure where none was possible before.
 
-- Commit the sweep's pre-answer prunes in the store's own tree (DW-160). Both prune sites
+- Commit the sweep's pre-answer prunes in the store's own tree. Both prune sites
   resolve the store under `_project_of_run_dir(self.run_dir)` but committed through
   `_commit_ledger`, which checked and committed `self.workspace.root`: where `repo_root`
   names a tree DISJOINT from the project those diverge, the clean check passed against the
@@ -2293,7 +1993,7 @@ breaking changes may land in a minor release.
   child still inside the pane's session, covering the weaker same-pgid case. Both
   detached fakes now bounded-poll the child's observed `/proc` session id, off the
   shared real-tmux hang ceiling, and fail loudly rather than publish an ungraded
-  identity (DW-159). Three local-process rows drive that fragment directly — the
+  identity. Three local-process rows drive that fragment directly — the
   detached, the late-detaching and the never-detaching child — and the stories module's
   xdist-group floor is re-pinned from 30 to its actual gated-def count, so it no longer
   carries fourteen deletions' worth of silent slack. Synchronize retry coverage, grade
@@ -2309,15 +2009,15 @@ breaking changes may land in a minor release.
   previous release accepted: such a plan is re-driven, and a cached `triage*.json`
   written before this release that carries such a value stops contributing its
   decisions to `decisions --list`, `status` and the TUI until the next sweep re-triages
-  the still-open ids (DW-156).
+  the still-open ids.
 
 - Name a triage decision by its position when its `id` is not a string, in every
   diagnostic the decisions loop emits, so an object-valued `id` can no longer print its
   own contents into messages that promise type names only. Acceptance is unchanged: the
   same plans validate and are refused, and a string id — the empty string included —
-  keeps today's wording byte for byte (DW-157).
+  keeps today's wording byte for byte.
 
-- **Refuse a migration result whose top level is the wrong shape** (DW-170), the DW-155
+- **Refuse a migration result whose top level is the wrong shape**, the
   guard `validate_triage` got and its twin one function over did not. `rj = rj or {}`
   substituted only on a falsy document, so a truthy non-object result — a list, a
   string, a number — reached `.get` and raised `AttributeError` out of
@@ -2329,7 +2029,7 @@ breaking changes may land in a minor release.
   through `critical_escalations` first, which raises on a truthy non-dict before this
   guard is reached.
 
-- Extend DW-157's positional naming to the triage diagnostics it missed (DW-171): the
+- Extend positional naming to the triage diagnostics it missed: the
   `already_resolved`, `blocked` and `skip` loops, the open-set mismatch's `not open in
 the ledger` list and the `workflow must be ...` refusal in BOTH validators used to
   interpolate LLM-authored objects verbatim into strings that reach the journal. A
@@ -2340,15 +2040,14 @@ the ledger` list and the `workflow must be ...` refusal in BOTH validators used
   refused — and a string identifier, the empty string included, plus a scalar `workflow`
   (`got None`, `got 'wrong'`) keep today's wording byte for byte.
 
-- Re-offer a decision hand-seeded as `effect: "close"` in `.bmad-loop/decisions.json`
-  (DW-147), instead of counting it answered while no sweep ever built, closed or re-asked
+- Re-offer a decision hand-seeded as `effect: "close"` in `.bmad-loop/decisions.json`, instead of counting it answered while no sweep ever built, closed or re-asked
   it. Re-answer it with `bmad-loop decisions`; the file is journaled, never edited.
 
 - Adopt the current bundle's deferred-work ids before writing a reset sweep task's
-  intent (DW-144). Keep dispatch and ledger-close ids aligned, and journal both
+  intent. Keep dispatch and ledger-close ids aligned, and journal both
   old and new ids as `sweep-bundle-dwids-adopted` when they differ.
 
-- **Retire stale keep-open pre-answers when dropped** (DW-143), so decisions are
+- **Retire stale keep-open pre-answers when dropped**, so decisions are
   offered again and fresh sweeps stop repeating stale-answer notifications. Journal
   the removal and preserve run-local answers and ledger history. A read-only project
   store raises `PermissionError` after the drop is announced and quarantined; a fresh
@@ -2356,22 +2055,22 @@ the ledger` list and the `workflow must be ...` refusal in BOTH validators used
   it still holds the value that was dropped: a paused run's stale run-local copy wins
   over the store on resume, so a replacement a human recorded out of band meanwhile
   is left in place for the next run instead of being deleted and committed away. The
-  compare and the delete are one step under the store's lock (DW-161 below), so that
+  compare and the delete are one step under the store's lock (see below), so that
   compare-and-delete and a concurrent `bmad-loop decisions` re-answer cannot interleave.
 
-- **Skip an unreadable cached triage instead of failing the read** (DW-145). Widen
+- **Skip an unreadable cached triage instead of failing the read**. Widen
   `decisions.pending_missed_decisions`' except tuple to include `UnicodeDecodeError` —
   a `ValueError`, not an `OSError`, so non-UTF-8 bytes in one run's `triage*.json`
   escaped past `cmd_decisions` and `cmd_status` (which catch `BmadConfigError` alone,
   leaving `main`'s backstop to exit 1 with no `--json` document) and out of the TUI
   uncaught. Degrades per file: the bad cache is skipped, the other runs still count.
 
-- **Refuse a triage plan whose free-text scalars are not strings** (DW-148). Type-check
+- **Refuse a triage plan whose free-text scalars are not strings**. Type-check
   bundle `name`/`intent`, option `effect`/`intent`/`label`/`resolution`/`bundle_name`
   and decision `context`/`recommendation` in `validate_triage` instead of `str(...)`-ing
   them — a list `intent` used to become a truthy Python repr that passed the
   `effect == "build"` intent gate and rode into `Bundle.intent`, `intent.md` and a dev
-  session (the DW-141 harm, on the plan-input surface). Errors name the decision id or
+  session. Errors name the decision id or
   the bundle's position, the field and the type name only, one per fault. Identifiers
   and ledger-bound notes (`key`, `question`, `id`, `evidence`, `blocker`, `reason`,
   `dw_ids` members) deliberately keep `str(...)`. Note: a pre-existing cached triage
@@ -2379,7 +2078,7 @@ the ledger` list and the `workflow must be ...` refusal in BOTH validators used
   decision drops out of `decisions --list`, `status` and the TUI until the next sweep
   re-triages the still-open entry.
 
-- **Refuse a triage plan whose CONTAINERS are the wrong shape** (DW-155, DW-158), instead
+- **Refuse a triage plan whose CONTAINERS are the wrong shape**, instead
   of raising out of `validate_triage` and every caller of it. `rj = rj or {}` substituted
   only on a falsy document, so a non-object top level raised `AttributeError`; a `null`
   `open_ids`/`bundles`/`already_resolved`/`blocked`/`skip`/`decisions`/`options`/`dw_ids`
@@ -2393,13 +2092,12 @@ the ledger` list and the `workflow must be ...` refusal in BOTH validators used
   double-reports its own `has no dw_ids` / `needs at least 2 options` value error.
   `pending_missed_decisions` degrades per file, as it does for an unreadable cache.
 
-- **Close the last reuse-exposed test child identities** (DW-136, DW-137). Share the
+- **Close the last reuse-exposed test child identities**. Share the
   pidfd-authentication helpers, publish identities atomically, and sweep authenticated
   children abandoned during pre-bind failures. The OpenCode row is now Linux-only,
   and no executable `os.kill(` call remains in `tests/`.
 
-- **A stored decision answer is now screened by SHAPE, not just by container type**
-  (DW-140/141/142). Three gaps behind DW-134's container-level check: a project
+- **A stored decision answer is now screened by SHAPE, not just by container type**. Three gaps behind the container-level check: a project
   `.bmad-loop/decisions.json` holding non-UTF-8 bytes raised `UnicodeDecodeError` out of
   `load_pre_answers` and aborted the whole sweep that read it; the build lane stringified
   `key`/`label`/`intent`/`bundle_name`, so a list `intent` shipped its truthy Python repr
@@ -2420,7 +2118,7 @@ the ledger` list and the `workflow must be ...` refusal in BOTH validators used
   the human's file.
 
 - **The re-stamp row that settles an owed code-root record now records THAT a move
-  happened** (DW-128) — not which trees: the row's `repo` is the new root and a dump
+  happened** — not which trees: the row's `repo` is the new root and a dump
   reduces it to `repo_present`. `runs.restamp_code_root`'s trailing `rearm-code-root-restamped`
   append writes `code_root_changed` about THIS call, so the one path where the row is a
   real move's sole durable trace — call one re-points the root, persists, and its append
@@ -2431,7 +2129,7 @@ the ledger` list and the `workflow must be ...` refusal in BOTH validators used
   (which already assert `code_root_changed=true`) are untouched, so an absent key on those
   rows means "not stated", not `false`.
 
-- **A regenerated sweep bundle no longer vanishes into a finished bundle's key** (DW-125).
+- **A regenerated sweep bundle no longer vanishes into a finished bundle's key**.
   `_run_bundle`'s terminal-task early return compared only the derived `dw-<name>` key, and
   the key is a pure function of `(name, cycle)` — so a resume that lost `<run>/triage.json`
   re-triaged, re-authored the remaining ids under freely chosen names, and any bundle that
@@ -2447,7 +2145,7 @@ the ledger` list and the `workflow must be ...` refusal in BOTH validators used
   (the one it ran under, or the terminal one it was skipped at) rather than one re-derived
   from the plan's name.
 
-- **A sweep's decision dispositions now survive a pause/resume of the same run** (DW-124).
+- **A sweep's decision dispositions now survive a pause/resume of the same run**.
   The two quarantines — ids journaled `decision-skipped-unattended`, and ids whose recorded
   answer was journaled `sweep-decision-answer-dropped` — moved from `SweepEngine.__init__`
   set state onto `RunState` (`sweep_skipped_decisions` / `sweep_dropped_decisions`),
@@ -2458,7 +2156,7 @@ the ledger` list and the `workflow must be ...` refusal in BOTH validators used
   run-scoped: a NEW run still re-evaluates every decision, the human's answer in
   `<run>/decisions.json` is untouched, and a pre-upgrade `state.json` loads both empty.
 
-- **Degrade a malformed `<run>/decisions.json` instead of aborting the sweep** (DW-134).
+- **Degrade a malformed `<run>/decisions.json` instead of aborting the sweep**.
   An unreadable file, a non-object top level or a non-object value journals
   `sweep-decisions-reload-failed` (one record per fault class; per-value records name their
   store and affected ids) and drops only the unusable answers; the well-shaped rest answer
@@ -2466,17 +2164,16 @@ the ledger` list and the `workflow must be ...` refusal in BOTH validators used
   per-value drop is re-published unchanged by the phase's own write-backs; a whole-file fault
   has nothing per-value to carry. `bmad-loop decisions` re-offers an id whose stored
   pre-answer value is unusable, instead of counting the bare key as answered. Also count
-  every decision-answer drop as repeat progress (DW-135): `_cycle` previously counted only
+  every decision-answer drop as repeat progress: `_cycle` previously counted only
   the keep-open lane, so a `--repeat` cycle whose sole event was a `no-intent` or
   `name-collision` drop stopped at `no-progress` even though the drop frees the id for a
   later cycle's fresh triage. All three lanes now signal, still bounded to one drop per id
   per run.
 
 - **Make stories E2E reap identity reuse-proof and clean up a live child when either
-  protected reap assertion fires** (DW-126, DW-127).
+  protected reap assertion fires**.
 
-- **`runs.restamp_code_root` now warns only when THAT call moved the code root**
-  (DW-114). A set `code_root_restamp_pending` with the mirror already equal to the
+- **`runs.restamp_code_root` now warns only when THAT call moved the code root**. A set `code_root_restamp_pending` with the mirror already equal to the
   incoming root made the function fall past the "already agrees" exit, discharge the
   owed record with a hardcoded `code_root_changed=True`, and return the "the code root
   in `_bmad/bmm/config.yaml` has changed" warning that `bmad-loop resolve` and the TUI's
@@ -2493,13 +2190,13 @@ the ledger` list and the `workflow must be ...` refusal in BOTH validators used
   root with `code_root_changed=True`. A genuine move still warns.
 
 - **Stop stale `keep-open` answers from suppressing later deferred-work bundles**
-  when triage options are renumbered or removed (DW-123).
+  when triage options are renumbered or removed.
 
 - **A stored deferred-work decision answer is now validated against the triage
-  option its key resolves to before the two are blended** (DW-118). `Decision.option`
+  option its key resolves to before the two are blended**. `Decision.option`
   matches on key alone and a key is a position in a list every triage re-authors, so a
   renumbering re-triage attributed one question's answer to another question's option:
-  on DW-55 a stored `build` answer keyed "1" met a fresh option "1" spelled "Close as
+  a stored `build` answer keyed "1" met a fresh option "1" spelled "Close as
   decayed", and the bundle shipped the stale review intent under the close label while
   quoting a question the human never answered. The answer's own `label` and `effect` —
   the two fields both provenances carry — are now compared first, and a disagreeing
@@ -2524,36 +2221,35 @@ the ledger` list and the `workflow must be ...` refusal in BOTH validators used
   `drop_cause: name-collision` and notified.
 
 - Inventory keyword and splat journal kinds only over an empty positional slot,
-  preserving literalness and field findings (DW-109); give unresolved-kind failures
-  call-site advice and prohibit sentinel declarations (DW-113); remove stale guard
-  counts (DW-110, DW-112) and pin every kind covered by the by-name `patch` drop
-  (DW-78).
+  preserving literalness and field findings; give unresolved-kind failures
+  call-site advice and prohibit sentinel declarations; remove stale guard
+  counts and pin every kind covered by the by-name `patch` drop.
 
 - Name the property instead of counting siblings in the portability guard's last three
-  journal-kind comments (DW-120): a kind-only write is one passing no keyword arguments
+  journal-kind comments: a kind-only write is one passing no keyword arguments
   at all, not even a `**` splat, and the other class is a literal reaching a declared
   dynamic-kind position from outside its body — a caller's `kind=` keyword or the
   position's own parameter default. A fifth of either no longer falsifies the prose.
 
-- Retire two unpinned prose claims in the portability guard (DW-130, DW-131): the
+- Retire two unpinned prose claims in the portability guard: the
   dynamic-kind literalness docstring no longer counts the writes it governs, keeping only
   the ablation-pinned position count, and the kind-literal probe's ablation now maps each
   feeding emit to the rows it reddens instead of crediting one emit with all of them.
 
 - Pin each declared dynamic-kind position's journal-write count in the portability
-  guard (DW-138). `JOURNAL_DYNAMIC_KIND_ALLOW` is now a mapping from position to its
+  guard. `JOURNAL_DYNAMIC_KIND_ALLOW` is now a mapping from position to its
   expected number of `journalkind` findings, held against the tree by a new row, so a
   write added or removed inside an already-declared position reddens instead of only
   falsifying a comment — the waiver is granted per position, so the declaredness gate
   passes on such a write by construction. Waiver semantics are unchanged.
 
 - Probe both existence arms of the accepted-spec worktree seed through the total
-  `_is_file` (DW-103), matching its structural siblings and the DW-101 supersession
+  `_is_file`, matching its structural siblings and the supersession
   warning. On Python <=3.13 a raw `Path.is_file` raises on an unreadable path, and
   this call site sits outside every `except` in `run_isolated`, so the fault ended
   the run instead of allowing dispatch to continue. No change on non-faulting paths.
 
-- Name the two silent refusals on the accepted-spec delivery path (DW-104, DW-115).
+- Name the two silent refusals on the accepted-spec delivery path.
   The worktree seed's containment refusal now nominates its rel anyway, so
   `worktree-seed-dropped` reports it — the copier re-checks destination containment
   itself, so still nothing is written outside the mount — and both that refusal and a
@@ -2564,17 +2260,16 @@ the ledger` list and the `workflow must be ...` refusal in BOTH validators used
   the operator's spec and fell back to the bare story key. Nothing new escalates.
 
 - Probe the accepted spec for file-ness inside `relativize_project_local_accepted_spec`'s
-  own `except` (DW-116). `run_isolated` calls the method before its first `try`, so a
+  own `except`. `run_isolated` calls the method before its first `try`, so a
   TOCTOU or non-EACCES `OSError` at that probe ended the run; it now leaves the
   spelling unchanged, as a false probe already did.
 
 - Discharge an owed code-root re-stamp record under its original root before
-  resuming (DW-100), preserving the record and integrity pin for retry on failure.
+  resuming, preserving the record and integrity pin for retry on failure.
   Warn only when the configured root differs from the recorded root; a pending
   record alone no longer triggers the code-root warning.
 
-- **Stopped the real-tmux E2Es contending with each other under `-n logical`**
-  (DW-95). They shared the box with every other worker and could starve past their
+- **Stopped the real-tmux E2Es contending with each other under `-n logical`**. They shared the box with every other worker and could starve past their
   fixed waits — a load flake, not a defect. All 23 collected cases now carry one
   `xdist_group`, so loadgroup scheduling serializes them while the rest of the suite
   still fans out; `--dist loadgroup` is declared in `pyproject.toml` `addopts`, without
@@ -2587,10 +2282,9 @@ the ledger` list and the `workflow must be ...` refusal in BOTH validators used
   walls from returning while preserving the deliberate 6s triggers. Tests only; no
   production change.
 
-- **Put the last two load-sensitive real-tmux walls on the shared hang ceiling**
-  (DW-108). The descendant-reap polls in `tests/test_stories_e2e.py` deadlined on a
+- **Put the last two load-sensitive real-tmux walls on the shared hang ceiling**. The descendant-reap polls in `tests/test_stories_e2e.py` deadlined on a
   fixed `time.monotonic() + 10`, which a starved scheduler can blow through — the class
-  DW-95 removed from the generic-tmux waits but left in the one module its guard
+  already removed from the generic-tmux waits but left in the one module its guard
   excludes. Both now spell the imported `REAL_MUX_HANG_CEILING_S`; the trade-off is
   deliberate, a merely slow reaper is caught at 90s rather than at 10s while a broken
   one still fails. A second scanner in `tests/test_conftest.py` keeps them there,
@@ -2600,7 +2294,7 @@ the ledger` list and the `workflow must be ...` refusal in BOTH validators used
   The subprocess `timeout=` budgets in that file stay out of scope. Tests only; no
   production change.
 
-- **Bound launch-marker snapshot retention in the dev adapters** (DW-96). Each dev
+- **Bound launch-marker snapshot retention in the dev adapters**. Each dev
   session start stored a park-marker snapshot under its task id and nothing removed it;
   an unpinned launch (no `expected_spec`) snapshots every `*.md` in the artifacts dir,
   so an adapter driving N such sessions over M files retained O(N x M) entries for its
@@ -2609,7 +2303,7 @@ the ledger` list and the `workflow must be ...` refusal in BOTH validators used
   launch is untouched, and lands after `_post_kill_reconcile`, the last in-lifecycle
   reader. No verdict changes.
 
-- **Bound four more per-task dev-adapter stores to the session** (DW-106, DW-107).
+- **Bound four more per-task dev-adapter stores to the session**.
   `_fm_fallback_obs`, `_fm_transition_obs`, `_contract_nudge_sent` and the OpenCode
   transport's `_server_procs` (a live `Popen` per task) grew one entry per session for
   the adapter's lifetime. All four are now evicted through one `_evict_task_state` seam
@@ -2618,10 +2312,9 @@ the ledger` list and the `workflow must be ...` refusal in BOTH validators used
   the returning task id, so a concurrent session keeps its entries; within-session
   semantics (the exactly-once contract nudge included) are unchanged.
   `OpencodeHttpAdapter._usage` is a separate case: it is keyed by session id and read
-  after `run()` returns, so it cannot use this seam — it is capacity-bounded instead
-  (DW-117).
+  after `run()` returns, so it cannot use this seam — it is capacity-bounded instead.
 
-- **Bound the OpenCode HTTP adapter's session usage stash** (DW-117).
+- **Bound the OpenCode HTTP adapter's session usage stash**.
   `OpencodeHttpAdapter._usage` was written once per session in `_capture_usage` and
   never popped, so it grew O(sessions) for the adapter's lifetime. It cannot join the
   `_evict_task_state` seam — it is keyed by session id, not task id, and the engine
@@ -2632,9 +2325,9 @@ the ledger` list and the `workflow must be ...` refusal in BOTH validators used
   session count, and `read_usage`'s contract — signature, idempotence, `None` for a
   missing or absent session id — is unchanged.
 
-- Prevent harvest races from filing cross-spec duplicates for one fingerprint (DW-98).
+- Prevent harvest races from filing cross-spec duplicates for one fingerprint.
 
-- **A partial journal flush no longer swallows the writer's next record** (DW-97). A
+- **A partial journal flush no longer swallows the writer's next record**. A
   partially flushed `Journal.append` left an unterminated fragment, the next append
   concatenated its own record onto it, and both readers dropped the combined line — so
   one fault lost a record that was written whole (a swallowed `unit-merged` re-drives
@@ -2751,24 +2444,23 @@ the ledger` list and the `workflow must be ...` refusal in BOTH validators used
   `resultless-stops.jsonl` or `session-lifecycle.jsonl`, which the inherited result-file
   mixin writes; the three names now live in one `RESULT_FILE_ARTIFACTS` tuple both adapters
   validate.
-- Serialize run deletion/archive against resume (DW-94), refusing a newly live
+- Serialize run deletion/archive against resume, refusing a newly live
   engine under the per-run lock and preventing a waiting resume from recreating a
   run cleanup already removed.
 
-- Serialize every run-state writer and control read-modify-write transaction with one canonical per-run advisory lock (DW-93).
+- Serialize every run-state writer and control read-modify-write transaction with one canonical per-run advisory lock.
 
 - Let interactive resolve present `paused_reason` when watermark filtering leaves no newer
-  recorded escalation detail, without recovering or inventing an escalation (DW-91).
+  recorded escalation detail, without recovering or inventing an escalation.
 
-- Reject malformed session escalation/result artifacts and non-finite resolve JSON
-  (DW-86, DW-89).
+- Reject malformed session escalation/result artifacts and non-finite resolve JSON.
 
-- **Confine built-in adapter task directories** (DW-74), refusing unsafe task ids and
+- **Confine built-in adapter task directories**, refusing unsafe task ids and
   symlink- or junction-redirected task directories before prompt, artifact, log, or
   transport side effects.
 
 - **Treat embedded-NUL verify commands and working directories as typed environment
-  faults** (DW-53, DW-54), while documenting that stream retention degrades but
+  faults**, while documenting that stream retention degrades but
   journal record writes remain fail-loud.
 
 - Make successful escalation re-arms return authoritative ordered notices and a resume-hold
@@ -2873,8 +2565,7 @@ add` failed on the held branch anyway, which is the harm the guard exists to pre
 - **`docs/FEATURES.md` no longer promises a ledger entry the review-budget damping does not
   file.** The bounded-review-loop bullet said a lingering follow-up recommendation is re-filed
   to the deferred-work ledger; `_journal_review_budget_spent` journals the spent budget and
-  deliberately files nothing, on the damping path and on plain budget exhaustion alike (the
-  DW-55/64/90 class showed such rows re-litigate a converged story's review). FEATURES.md is a
+  deliberately files nothing, on the damping path and on plain budget exhaustion alike (such rows re-litigate a converged story's review). FEATURES.md is a
   behavior contract, so the bullet now matches the shipped behavior and names the review
   _timeout_ salvage as the one path that does still file.
 
@@ -2889,20 +2580,17 @@ add` failed on the held branch anyway, which is the harm the guard exists to pre
   can re-file them, keeps `seen_again` naming only entries that actually took a sighting, and
   journals `spec-deferral-sighting-stale`.
 
-- **Document spec baseline frontmatter as an optional `verify_dev` attestation**
-  (DW-51), with no-claim acceptance and no-work refusal regressions anchored to
+- **Document spec baseline frontmatter as an optional `verify_dev` attestation**, with no-claim acceptance and no-work refusal regressions anchored to
   the orchestrator-recorded baseline.
 
-- **Restore the original spec when a TUI replan cannot strip its stale result**
-  (DW-33), keeping the status reset and result removal atomic before resume.
+- **Restore the original spec when a TUI replan cannot strip its stale result**, keeping the status reset and result removal atomic before resume.
 
 - **Document the three story-spec path resolvers and their distinct ownership
-  contracts** (DW-17, DW-18, DW-36). Persisted-task anchoring, session-reported
+  contracts**. Persisted-task anchoring, session-reported
   candidate probing, and exact attempt recovery binding now cross-reference one
   another and spell out their different bare-basename results; production prose
   also names the real implementation-artifacts-relative layout.
-- **An artifact the escalation walk cannot stat is recorded as unreadable rather than absent**
-  (DW-11). `resolve._gather_escalations` classified each task-cycle artifact with
+- **An artifact the escalation walk cannot stat is recorded as unreadable rather than absent**. `resolve._gather_escalations` classified each task-cycle artifact with
   `Path.is_file()` outside its guard, and that probe's answer to EACCES splits by interpreter.
   Through 3.13 it re-raises anything outside `pathlib._IGNORED_ERRNOS`, so an artifact under an
   unreadable directory escaped `build_context` and `cmd_resolve` to the top-level backstop as
@@ -2918,8 +2606,7 @@ add` failed on the held branch anyway, which is the harm the guard exists to pre
   into a durable claim. The regular-file check stays, because `stat` succeeds where `is_file()`
   answered False — without it a directory at an artifact path would raise `IsADirectoryError`,
   and a FIFO would block the read forever, wedging the interactive command.
-- **An aborted re-arm no longer leaves the spec re-armed against an escalated task**
-  (DW-79, DW-83, DW-85). `runs.rearm_escalation` published the status flip and stripped the
+- **An aborted re-arm no longer leaves the spec re-armed against an escalated task**. `runs.rearm_escalation` published the status flip and stripped the
   stale `## Auto Run Result` about 250 lines before `save_state`, and only two of the aborts
   in that window undid those writes — a failing `journal.append` from the stale-restore
   residue pass, a non-git fault from the commits probe, or a failing `save_state` each escaped
@@ -2975,8 +2662,7 @@ argument` and failed the story; a `ts` key did not raise and instead silently re
   the mount regardless of live policy, but the defer routed on live policy alone: it
   reset the main repo, skipped the carry, and the findings died with the deleted
   worktree. `_defer` now routes on the tree in hand, matching `_run_story`.
-- Stop a second resolve cycle re-presenting escalations the human already answered
-  (DW-11). Only a re-arm that accepted a `resolution.json` watermarks the session
+- Stop a second resolve cycle re-presenting escalations the human already answered. Only a re-arm that accepted a `resolution.json` watermarks the session
   trail; later cycles show what came after it and print how many were withheld. A
   cycle whose walk could not read a session artifact records no coverage at all, so
   a transient read fault no longer buries the escalations it hid.
@@ -3359,7 +3045,7 @@ decisions` and the TUI decision modal now also catch the state-root failure that
 ### Security
 
 - **Confine the sweep's triage-cache write-back and bundle intent write to the project
-  root** (DW-269). `_ensure_triage`'s `<run>/triage{suffix}.json` write-back and
+  root**. `_ensure_triage`'s `<run>/triage{suffix}.json` write-back and
   `_write_intent`'s `<run>/bundles/<dirname>/intent.md` still went through the plain
   `atomic_write_text`, which resolves every directory above the file by name, so a link
   planted at any directory component below the project root (`.bmad-loop/`, `runs/`, the
@@ -3369,11 +3055,11 @@ decisions` and the TUI decision modal now also catch the state-root failure that
   against the project that owns the run dir. The cache write-back's refusal degrades on
   its existing `sweep-triage-cache-write-failed` row (`UnconfinedWriteError` is an
   `OSError`), costing the cycle its cache and nothing else; the intent write's refusal
-  propagates exactly as any other write fault there does (DW-243). No new journal kind,
+  propagates exactly as any other write fault there does. No new journal kind,
   pause stage or policy field.
   A link (or symlink loop) planted at the file's OWN name is no longer followed either:
   the plain writer resolved it and rewrote its target, the confined writer replaces the
-  name (DW-247's `RuntimeError` loop arm goes with the `resolve()` it guarded), and the
+  name (the `RuntimeError` loop arm goes with the `resolve()` it guarded), and the
   file lands `0600` with no mode inherited.
   On POSIX the `sweep-triage-cache-write-failed` `errors[0]` text now names the bare
   filename rather than the full path — the replace is dir_fd-relative.
@@ -3381,7 +3067,7 @@ decisions` and the TUI decision modal now also catch the state-root failure that
   and `ATTENTION` — still go through plain writers. The intent's preceding `mkdir` can
   still create directories through a redirected parent; a failed cache read can still
   unlink `triage{suffix}.json` through one. This change confines only the two file writes.
-- **Confine migration run-directory record writes to the project root** (DW-288).
+- **Confine migration run-directory record writes to the project root**.
   `_ensure_migration`'s `<run>/migrate-manifest.json` and
   `<run>/migrate-result.json` used bare `Path.write_text`, so a link planted at any
   parent beneath the project could aim either record outside it. Both now publish
diff --git a/docs/FEATURES.md b/docs/FEATURES.md
index 9056f72c3..280959d96 100644
--- a/docs/FEATURES.md
+++ b/docs/FEATURES.md
@@ -50,14 +50,14 @@ bmad-loop drives a BMAD sprint unattended: a deterministic Python loop launches
 - **Description:** An opt-in third story source for BMAD v7 projects. It drives the same pipeline from the active initiative's ticket tree through the project's own `tickets.py`, dispatching each ticket as `/<dev skill> ticket <ref>` in initiative build order, and, under the default `mark_done`, marks a verified ticket `done` itself.
 - **Properties:**
   - A run is pinned to `[core] active_initiative` at start; a changed initiative pauses the run at `ticket-tree` instead of building another initiative's ticket.
-  - The tree is read in the layout the installed `tickets.py` uses: a `tickets/` folder inside each initiative and epic, or the preview-era flat layout. A parent initiative passes the preflight only under worktree isolation without `gates.retrospective = "auto"`, with the store checks run for each sliced child (`tickets.initiative-parent`), and an epic declared but not sliced yet holds no tickets.
-  - `run` on a parent initiative builds its children one run each in build order, writing every drained child's initiative `status: done` before each pick (one a stopped chain left open included), under one `--max-stories` budget; a child run that does not finish holds the chain until `resume` or `resolve` drives it to finished, and the chain's end names what each waiting child waits on. Each child's run pauses at `epic-boundary` after every epic it finishes, as a one-initiative run does.
-  - `run --dry-run` on a parent initiative writes nothing: it lists the children in build order with a tag, the child a run builds first and that child's dry run; the TUI start-run preview lists the children and the first ready child's board, and a chained child run's dashboard board shows that child.
+  - The tree is read in the layout the installed `tickets.py` uses: a `tickets/` folder inside each initiative and epic, or the preview-era flat layout.
+  - `run` on a parent initiative builds its children one run each in build order under one `--max-stories` budget, and needs worktree isolation without `gates.retrospective = "auto"` (`tickets.initiative-parent`). A child run that does not finish holds the chain until it is resumed or resolved.
+  - `run --dry-run` and the TUI start-run preview on a parent initiative list its children in build order and the child a run builds first.
   - A hitl ticket pauses at `ticket-hitl` and a ticket that needs refining at `ticket-refine`, both before any session runs for it.
-  - bmad-loop writes a plan's `status` and `blocked_*` only through `tickets.py mark`, under a lock, read back afterwards and checked against one plan transition table; it never writes `dropped` or an epic file.
+  - bmad-loop writes a plan's `status` and `blocked_*` only through `tickets.py mark`, checked against one plan transition table; it never writes `dropped` or an epic file.
   - Tickets this run did not start are never dispatched or marked.
-  - A resume never rebinds a unit it started: a ticket moved with `tickets.py move`, or a plan gone, while the run was paused pauses it at `ticket-tree`, naming the old and new ref and plan.
-  - A store tracked in the checkout is marked inside the unit's commit; a shared store's mark is latched and made after the code lands, and a store with its own repository gets a plan-only commit.
+  - A resume never rebinds a unit it started: a ticket moved or a plan gone while the run was paused pauses it at `ticket-tree`.
+  - A store tracked in the checkout is marked inside the unit's commit; any other store is marked after the code lands.
   - `run` refuses a tracker store and the multi-repo workspace layout before creating a run directory; resume and resolve refuse a store whose layout changed.
   - When a run without `--story` finishes an epic, it runs the retrospective and pauses once at `epic-boundary` for a person to close the epic; a `rejected` verdict pauses every later pick while the epic stays open, and an epic gated on an open one waits for its closure.
 - **Config:** `[stories] source = "tickets"`, `[core] active_initiative`, `[tickets] mark_done`, `[tickets] thorough_review`, `[gates] retrospective`; `bmad-loop run --epic ID|SLUG`, `--story REF`, `--dry-run`; `bmad-loop confirm <ref>`
@@ -103,12 +103,10 @@ bmad-loop drives a BMAD sprint unattended: a deterministic Python loop launches
   - A dev attempt that fails only its verify commands keeps its tree, and the failing output is handed to the retry as feedback.
   - A session silent for `dev_stall_grace_s` (default 600) gets up to `dev_stall_nudges` wake nudges, then ends `stalled` and is charged as a failed attempt.
   - Every dev and review session ends as `timeout` after `[limits] session_timeout_min` (default 90).
-  - A dev, review, fix, triage, migration or blocking-workflow session that did no work, or sat parked on a prompt only a human should answer, pauses the run instead of being charged; a non-blocking workflow's is journaled and the run continues.
-  - Parked-prompt and usage-limit patterns match a pane line even when a narrow window wraps it across two or three rows, so a wrapped dialog footer still withholds the stall nudge.
-  - `validate --probes` launches each distinct role launch whose `generic`-adapter profile declares `parked_prompt_patterns` once, with its permission args and no prompt, never types into it, and fails when the first screen shows a startup dialog that would park an unattended session. A profile without patterns is reported as not launched.
-  - A permission-prompt latch clears once the transcript is written after it, so a session that was approved and then went silent gets the stall nudge instead of ending `stalled` and parked.
-  - A session whose window is alive when the timeout fires ends `timeout` marked parked, and pauses instead of retrying, when a parked hook signal is latched and the transcript has not been written since it, or when a parked-prompt pane pattern is present and the transcript is idle. A latch the transcript has been written past is no evidence, at any idle age.
-  - While the visible pane shows the coding CLI waiting out a usage-limit reset and the transcript is idle, the session timeout is frozen and the stall nudge held, for at most `[limits] quota_wait_max_min` (default 300; 0 = off) cumulative minutes per session; past the cap, or when the parsed reset lies beyond it, the session pauses with a usage-limit reason.
+  - A session that did no work, or is still parked on a prompt only a human should answer when it stalls or times out, pauses the run instead of being charged; a non-blocking workflow's is journaled and the run continues.
+  - A session approved past its permission prompt that then goes silent gets the stall nudge, not a parked pause.
+  - `validate --probes` launches each role's CLI once with no prompt and fails when its first screen shows a startup dialog that would park an unattended session.
+  - While the pane shows the CLI waiting out a usage-limit reset, the session timeout and stall nudge are held for at most `[limits] quota_wait_max_min` (default 300; 0 = off) minutes; past that the session pauses with a usage-limit reason.
   - Before an attempt is reset, its commits go to an `attempt-preserve/<run>-<tip8>` branch and uncommitted work to a `refs/attempt-preserve-dirty/*` snapshot.
 - **Config:** `[limits] max_dev_attempts`, `[limits] max_review_cycles`, `[limits] session_timeout_min`, `[limits] dev_stall_grace_s`, `[limits] dev_stall_nudges`, `[limits] dev_stall_nudges_cap`, `[limits] quota_wait_max_min`, `[scm] preserve_keep`
 - **Tested by:** `tests/test_escalation.py`, `tests/test_engine.py`, `tests/test_generic_tmux.py`, `tests/test_panematch.py`, `tests/test_sweep.py`, `tests/test_verify.py`, `tests/test_recovery_flow.py`
@@ -136,13 +134,13 @@ bmad-loop drives a BMAD sprint unattended: a deterministic Python loop launches
   - A CRITICAL escalation marks the story `escalated`, sends a `CRITICAL escalation: <story>` notice and pauses the run at `escalation`.
   - A pause that is not a CRITICAL contradiction is titled by its reason: `Paused (parked prompt): <story>`, `Paused (no work): <story>`, `Paused (usage limit): <story>` or `Paused (environment fault): <story>`.
   - A PREFERENCE escalation is journaled as `preference-escalation` and the run continues.
-  - Resolve also admits an unfinished story run with no pause stage and a story still escalated, as a resume whose engine exited before run end leaves it; `resume` warns of each escalated story it skips, and `status` and the TUI header name the resolve that clears it.
-  - A resume that fails before its engine starts puts back the pause it cleared and journals `resume-aborted`.
+  - A story still escalated after a resume cleared the pause can still be resolved; `resume`, `status` and the TUI header point at it.
+  - A resume that fails before its engine starts puts back the pause it cleared.
   - `--abandon` (in-progress) closes an escalated replay run unmerged, keeping its branch and parking dirty work on a preserve ref.
   - Re-arming resets the story to `pending` with fresh dev-attempt and review-cycle budgets.
   - `--reverify` re-runs `[verify]` on a deferred or environment-fault story's kept work without a dev session; on a finished run it replays a kept worktree unit in a new run.
-  - In tickets mode the re-arm moves the ticket's plan through `tickets.py mark` and clears its `blocked_*` fields; a refused move puts the plan back byte for byte.
-  - On a tickets `epic-boundary` pause, resolve opens bmad-agent-po on the paused epic (`--no-interactive`: no session), then resumes only when the epic reads `done` or `dropped` and its epic folder has no uncommitted change; the session's exit code is never trusted, and a failed check exits 1 with the run still paused.
+  - In tickets mode the re-arm moves the ticket's plan through `tickets.py mark` and clears its `blocked_*` fields.
+  - On a tickets `epic-boundary` pause, resolve opens bmad-agent-po on the epic and resumes only when the epic reads `done` or `dropped` with its folder committed; otherwise it exits 1 with the run still paused.
 - **Config:** `bmad-loop resolve --story`, `--no-interactive`, `--restore-patch`, `--adopt-branch`, `--reverify`, `--resume` / `--no-resume`, `--force`, `--abandon`, `--at-reset`, `--margin-min`
 - **Tested by:** `tests/test_engine.py`, `tests/test_cli.py`, `tests/test_escalation.py`, `tests/test_resolve.py`, `tests/test_runs.py`, `tests/test_tui_app.py`, `tests/test_tickets_source.py`, `tests/test_tickets_e2e.py`
 - **Docs:** [Escalations](escalations-guide.md#escalations), [Resolving an escalation](escalations-guide.md#resolving-an-escalation), [Replay a finished run's kept unit](escalations-guide.md#resolve-reverify-finished), [Abandon a replay run](escalations-guide.md#abandon-a-replay-run), [Resolve in tickets mode](escalations-guide.md#resolve-in-tickets-mode), [Epic closure in tickets mode](escalations-guide.md#epic-closure-in-tickets-mode), [resolve CLI reference](reference/cli.md#resolve)
@@ -157,7 +155,7 @@ bmad-loop drives a BMAD sprint unattended: a deterministic Python loop launches
   - `bmad-loop confirm --list` shows each parked story and what it owes; `--json` emits it as a machine-readable document.
   - A confirmation adds an `## Operator Confirmation` section, moves spec and board to `done`, and commits.
   - `confirm --reverify` runs the environment probes and `[verify]` commands first; a failure blocks the confirmation.
-  - A park keeps the build's follow-up review recommendation on the park record and shows it in `confirm`, `status --json` and the park notification. The park never runs that review: after confirming, the operator invokes the build skill on the spec to run it.
+  - A park keeps the build's follow-up review recommendation and shows it in `confirm`, `status --json` and the park notification; it never runs that review itself.
   - `[operator] on_review_demotion = "park"` lets a review demote a `done` story to `awaiting-operator` (sprint and tickets mode); the default `escalate` rejects the demotion.
 - **Config:** `[operator] enabled`, `[operator] on_review_demotion`, `bmad-loop confirm --list`, `bmad-loop confirm --yes`, `bmad-loop confirm --reverify`, `bmad-loop confirm --json`
 - **Tested by:** `tests/test_engine.py`, `tests/test_cli.py`, `tests/test_operatoractions.py`, `tests/test_tickets_engine.py`
@@ -172,11 +170,10 @@ bmad-loop drives a BMAD sprint unattended: a deterministic Python loop launches
   - `bmad-loop resume` re-runs the probes; if they pass, the withheld session launches with no rollback, and otherwise the run pauses again unchanged.
   - A verify command exiting 126, 127 or `[verify] env_fault_rc` is an environment fault, not a code failure.
   - A non-completed session whose log tail matches its profile's `env_fault_patterns` pauses instead of spending a dev attempt.
-  - opencode is classified from model-free files only: the server's stdout, plus on OpenCode 2.x the adapter-written `provider-errors.log` (one line per provider-error event). Its 2.x environment-fault patterns cover the `provider.rate-limit`, `provider.transport`, `provider.internal` (a provider 5xx), `provider.auth` and `provider.no-route` error types; `provider.quota` is a usage limit, and error types the session's own request can cause (`provider.invalid-request`, `provider.invalid-output`) stay unclassified.
+  - On OpenCode 2.x, provider outages (rate limit, transport, 5xx, auth, no route) are environment faults and a provider quota failure is a usage limit; errors the session's own request can cause stay unclassified.
   - A pattern match is overruled when the session's tracked token usage is nonzero; that session is charged like any failure.
-  - A session that times out, stalls or crashes after a live usage-limit sighting pauses with a `usage limit:` reason and is never charged, whatever its token usage. A live sighting is a match for the profile's `usage_limit_patterns` or `usage_wait_patterns` from one of two sources: the visible pane of a tmux-hosted CLI such as claude, on an idle session at stall-grace expiry or when the timeout fires; or an opencode 2.x provider-error line, matched as the adapter writes it while the session runs (opencode's shipped profile lists `provider.quota` there as a blocking limit). The same line found only in the log tail stays subject to the overrule.
-  - When the usage-limit line names a reset time, the pause reason ends its evidence with `; resets <time>` (ISO-8601 when the time resolves, the raw text otherwise).
-  - `bmad-loop resolve --at-reset` on a usage-limit pause the CLI waits out waits in the foreground until the recorded reset plus `--margin-min` (default 2), then re-arms and resumes; a credit-exhaustion pause, an unresolved reset or one past `[limits] quota_wait_max_min` is refused before any wait.
+  - A session that times out, stalls or crashes after a live usage-limit sighting (its profile's `usage_limit_patterns` or `usage_wait_patterns` on the pane, or an opencode 2.x quota error) pauses with a `usage limit:` reason and is never charged; the reason names the reset time when the line gives one.
+  - `bmad-loop resolve --at-reset` waits until a usage-limit pause's reset plus `--margin-min` (default 2), then re-arms and resumes; credit exhaustion and an unknown or too-distant reset are refused.
 - **Config:** `[environment] probes`, `[environment] probe_timeout_s`, `[verify] env_fault_rc`, `[limits] quota_wait_max_min`; profile keys `env_fault_patterns`, `usage_limit_patterns`, `usage_wait_patterns`
 - **Tested by:** `tests/test_engine.py`, `tests/test_cli.py`, `tests/test_escalation.py`, `tests/test_env_fault_patterns.py`, `tests/test_env_fault.py`, `tests/test_generic_tmux.py`, `tests/test_opencode_http.py`, `tests/test_usagereset.py`
 - **Docs:** [Environment faults](escalations-guide.md#environment-faults), [Usage-limit pauses](escalations-guide.md#usage-limit-pauses), [Usage-limit signals](adapter-authoring-guide.md#usage-limit-signals), [[environment] reference](reference/configuration.md#environment), [[verify] reference](reference/configuration.md#verify), [Profile field reference](adapter-authoring-guide.md#cliprofile)
@@ -191,7 +188,7 @@ bmad-loop drives a BMAD sprint unattended: a deterministic Python loop launches
   - `bmad-loop stop` signals the engine and kills the agent session; a wedged engine is force-killed after 10 s only while its process identity still matches.
   - `stop --graceful` lets the in-flight story or bundle finish through commit, suppresses pending auto-sweeps, then stops resumable.
   - `resume --accept-baseline` keeps commits above an in-place story's baseline instead of parking and resetting them, for that resume only.
-  - A run's two durable records, `state.json` and `journal.jsonl`, are written only into the run directory recorded at its creation: with that identity on record, a link at, replacement of, or removal of that directory refuses the write. A run with no usable record still refuses a link at the directory but cannot detect a replacement; its journal writes one `journal-unpinned` row. Re-reads of `state.json` and pinned journal reads refuse a run directory swapped after the first, path-based read; the TUI journal pane flags the swap instead.
+  - `state.json` and `journal.jsonl` are written and re-read only in the run directory recorded at the run's creation; a directory swapped for a link or another directory is refused.
 - **Config:** `bmad-loop resume --accept-baseline`, `bmad-loop stop --graceful`, `bmad-loop stop --cancel-graceful`, `[adapter] cleanup_session_on_finish`
 - **Tested by:** `tests/test_engine.py`, `tests/test_cli.py`, `tests/test_runs.py`, `tests/test_journal.py`
 - **Docs:** [Stopping a run](reference/run-state.md#stopping-a-run), [Derived run status](reference/run-state.md#derived-run-status), [Run inventory](reference/run-state.md#run-inventory), [resume CLI reference](reference/cli.md#resume), [stop CLI reference](reference/cli.md#stop)
@@ -208,7 +205,7 @@ bmad-loop drives a BMAD sprint unattended: a deterministic Python loop launches
   - `per-story-spec-approval` also pauses each story after its verified dev pass and before review and commit. On resume the story goes straight to review.
   - In stories mode, a `stories.yaml` entry with `spec_checkpoint: true` pauses after planning, before any code. On resume the implementation leg runs.
   - `done_checkpoint: true` pauses after the story commits. It is skipped for the last story to dispatch, at `--max-stories`, or when a graceful stop is pending.
-  - In tickets mode, an entry's `plan_checkpoint` follows the BMAD v7 contract. A refined ticket pauses before dispatch, and resuming approves its story file. An unrefined ticket pauses after a `Halt after planning.` leg, and resuming dispatches it again on the uncommitted plan. `done_checkpoint` pauses after the ticket commits, with the same skips as stories mode.
+  - In tickets mode, `plan_checkpoint` pauses a refined ticket before dispatch and an unrefined one after its planning leg; `done_checkpoint` pauses after the ticket commits, with the same skips as stories mode.
   - `[gates] on_escalation` is reserved. It is parsed but has no effect, and CRITICAL escalations always pause whatever its value.
 - **Config:** `[gates] mode`, `[gates] on_escalation` (reserved); stories.yaml per-entry `spec_checkpoint` / `done_checkpoint`; ticket-entry `plan_checkpoint` / `done_checkpoint`; `bmad-loop resume <run_id>`
 - **Tested by:** `tests/test_engine.py`, `tests/test_stories_engine.py`, `tests/test_checkpoints.py`, `tests/test_tickets_engine.py`, `tests/test_policy.py`, `tests/test_settings_schema.py`
@@ -224,7 +221,7 @@ bmad-loop drives a BMAD sprint unattended: a deterministic Python loop launches
   - An auto retro succeeds only if the session completed, result.json says done, the board reads done and a retro doc exists. It is then committed as `chore(retro): epic N retrospective`.
   - A failed or refused auto retro (unless already done) tells you to run it by hand and never fails the run. If it leaves uncommitted changes, the run pauses at the epic boundary.
   - The retro doc's verdict is reported in the done notice. A `rejected` verdict sends an extra attention notice, and the run continues.
-  - Tickets mode keys the epic by slug. Once this run finishes an epic, `auto` runs `/bmad-retrospective -H <epic-slug>` and commits only `<epic-slug>-retrospective.md`; a valid document already there counts as done. Whatever the mode, the run records the verdict and pauses at `epic-boundary` for you to close the epic with bmad-agent-po, which `bmad-loop resolve` opens and then verifies before it resumes. A `rejected` verdict pauses again at every pick while the epic stays open; any other pauses once.
+  - In tickets mode `auto` runs `/bmad-retrospective -H <epic-slug>`, and whatever the `retrospective` value the run pauses at `epic-boundary` for you to close the epic with bmad-agent-po. A `rejected` verdict pauses again at every pick while the epic stays open.
 - **Config:** `[gates] retrospective`, `[adapter.retro] name` / `model` / `effort` / `extra_args`
 - **Tested by:** `tests/test_engine.py`, `tests/test_policy.py`, `tests/test_tickets_engine.py`, `tests/test_tickets_e2e.py`, `tests/test_cli.py`
 - **Docs:** [Escalations: epic closure in tickets mode](escalations-guide.md#epic-closure-in-tickets-mode), [Tickets guide: retrospective and closure](tickets-guide.md#epic-retrospective-and-closure), [Configuration: [gates]](reference/configuration.md#gates), [Configuration: [adapter.retro]](reference/configuration.md#adapterretro), [Pointing retrospectives at run journals](setup-guide.md#pointing-retrospectives-at-run-journals), [Roadmap: automate epic retro action items](ROADMAP.md#automate-epic-retro-action-items)
@@ -328,8 +325,8 @@ bmad-loop drives a BMAD sprint unattended: a deterministic Python loop launches
 - **Properties:**
   - Bundled profiles: claude, codex, gemini, copilot, antigravity and opencode-http. The names `opencode` and `claude-code-tmux` resolve as aliases.
   - A `.bmad-loop/profiles/*.toml` file whose `name` matches a bundled profile overrides it; a new `name` adds a CLI. Project files win over packaged and entry-point profiles.
-  - opencode runs as a headless `opencode serve` over HTTP/SSE. It needs no tmux window and registers no hooks. It speaks both OpenCode server APIs, 1.x and 2.x, picked per session from `opencode --version`; an unsupported major fails the session start with a clear error, and `validate` reports it as `adapter.opencode-version`.
-  - codex runs with `--no-daemon` (Codex ≥ 0.156), so shell tools and hooks run in the session's own process and see its `BMAD_LOOP_*` environment instead of a shared app-server daemon's. `validate` reports the version floor and a profile that drops the flag as `adapter.codex-version`; a session whose CLI never sends `SessionStart` is journaled as `session-start-missing` after `[limits] session_start_grace_s`.
+  - opencode runs as a headless `opencode serve` over HTTP/SSE. It needs no tmux window and registers no hooks. It speaks the OpenCode 1.x and 2.x server APIs; `validate` reports an unsupported version as `adapter.opencode-version`.
+  - codex runs with `--no-daemon` (Codex ≥ 0.156), so tools and hooks see the session's `BMAD_LOOP_*` environment; `validate` reports an older Codex or a profile that drops the flag as `adapter.codex-version`.
   - `bmad-loop probe-adapter <cli>` does a zero-launch scan by default. `--probe` opts in to one live, content-free turn. Every report is sanitized before it is printed.
   - Antigravity (experimental) never reports token usage. Under worktree isolation, it trusts each unit worktree only when the project root is already trusted.
 - **Config:** `[adapter] name`; `[limits] session_start_grace_s`; `bmad-loop probe-adapter <cli> --probe`; `bmad-loop probe-adapter <cli> --workspace <path>`; `bmad-loop adapters`
@@ -361,8 +358,7 @@ bmad-loop drives a BMAD sprint unattended: a deterministic Python loop launches
   - A stage inherits the base mode even when it switches client; `[adapter.<stage>] permission_mode` overrides it.
   - `bmad-loop resolve` sessions, where a human is present, keep the bypass flags whatever the mode.
   - `validate` reports each role's permission posture as `adapter.permission-mode`, suggesting `sandboxed` for an unsandboxed role without worktree isolation when the profile maps it. The note is advisory: a worktree is not a security boundary.
-  - A sandboxed Codex session in a linked worktree (`scm.isolation = "worktree"`) gets exact-path write grants for that worktree's gitdir and the main repo's shared `.git`, so git add and commit work. `validate` warns only when the grant cannot ride: an `extra_args` override replaces the mode's args and drops it, or the profile's mode declares no `linked_worktree_args` or a grant missing `{gitdir}` or `{common_dir}`.
-  - `tickets.store-sandbox` also warns when a sandboxed role writes a ticket store outside its cwd.
+  - A sandboxed Codex session under worktree isolation can commit: it gets write grants for the worktree's gitdir and the main repo's `.git`.
 - **Config:** `[adapter] permission_mode`, `[adapter.dev]` / `[adapter.review]` / `[adapter.triage]` / `[adapter.retro]` `permission_mode`; profile table `[permission_modes.<mode>]`
 - **Tested by:** `tests/test_policy.py`, `tests/test_profile.py`, `tests/test_runsetup.py`, `tests/test_cli.py`, `tests/test_codex_trust.py`, `tests/test_install.py`
 - **Docs:** [Configuration reference: [adapter]](reference/configuration.md#adapter), [Permission modes](adapter-authoring-guide.md#permission-modes), [validate check ids](reference/cli.md#validate-checks)
@@ -476,9 +472,8 @@ bmad-loop drives a BMAD sprint unattended: a deterministic Python loop launches
   - The dashboard has no private channel to the engine. It reads the files a run writes, so runs started from a shell show up exactly like TUI-started runs.
   - The settings editor checks edits with the same policy parser a run uses, and will not save an invalid value.
   - Resized pane sizes are saved per project under `[tui]` in policy.toml and restored on the next launch.
-  - In tickets mode the middle pane is a tickets board, read off the UI thread only when the initiative's files change, and **Request replan** goes through `tickets.py mark`.
-  - A session parked on a permission prompt shows in the header with its age and the CLI's auto-deny countdown, and the Log pane leads with a parked note.
-  - `Y` approves and `N` denies a parked prompt only when the session's profile declares `[parked_answers]` and a fresh pane capture still matches every guard pattern; each answer is journaled as `parked-answered`.
+  - In tickets mode the middle pane is a tickets board, and **Request replan** goes through `tickets.py mark`.
+  - A session parked on a permission prompt shows in the header with the CLI's auto-deny countdown. `Y` approves and `N` denies it only while a fresh pane capture still matches the profile's `[parked_answers]` guards.
 - **Config:** `bmad-loop tui --low-frame-rate`, `[tui] low_frame_rate`; profile keys `auto_deny_patterns`, `[parked_answers]`
 - **Tested by:** `tests/test_tui_app.py`, `tests/test_tui_launch.py`, `tests/test_tui_settings.py`, `tests/test_tui_data.py`, `tests/test_parked_answer.py`
 - **Docs:** [TUI guide](tui-guide.md), [Observer/launcher architecture](tui-guide.md#architecture-observerlauncher-never-the-engine), [TUI: tickets mode](tui-guide.md#tickets-mode), [Answering a parked permission prompt](tui-guide.md#answering-a-parked-permission-prompt), [CLI: tui](reference/cli.md#tui)
@@ -506,7 +501,7 @@ bmad-loop drives a BMAD sprint unattended: a deterministic Python loop launches
   - `init` appends only the `.gitignore` lines that are missing, so running it again changes nothing.
   - `validate` exits 1 only when a finding has severity `problem`. Warnings never change the exit code.
   - Every finding carries a stable check id taken from a fixed, documented registry.
-  - `validate` runs no project-controlled commands, and launches no coding CLI, unless `--render-probe` or `--probes` is given. The one exception is tickets mode, which runs `tickets.py next` while an unlanded ledger entry declares a `gate:`.
+  - `validate` runs no project-controlled commands, and launches no coding CLI, unless `--render-probe` or `--probes` is given; tickets mode may run `tickets.py next` to resolve ledger `gate:` refs.
   - On a BMAD v7 project `validate` reports the era, the active initiative, the ticket-store layout and the `tickets.*` preflight.
 - **Config:** `bmad-loop init --cli PROFILE --no-skills --force-skills`; `bmad-loop validate --spec FOLDER --render-probe --probes --json`
 - **Tested by:** `tests/test_cli.py`, `tests/test_install.py`
@@ -519,7 +514,6 @@ bmad-loop drives a BMAD sprint unattended: a deterministic Python loop launches
 - **Properties:**
   - In `--json` mode stdout holds exactly one JSON object, or nothing when `--out` redirects it. On an error stdout stays empty and the exit code is nonzero.
   - Every document carries an integer `schema_version` owned by its command. Breaking changes bump it; new fields are only ever added.
-  - Tickets mode added fields without a bump: `validate --json` gains `era`, `initiative` and `ticket_store`, and `status --json` gains a run-level `tickets` and a per-task `ticket` object, null outside tickets runs.
   - Exit codes are limited to 0 (OK), 1 (FAILURE), 2 (USAGE) and 130 (INTERRUPTED).
   - `diagnose` defaults to the latest run. Its dump contains no code, specs, prompts, paths or PII; story keys and branches are pseudonymized.
   - If the final leak check finds PII or a secret, `diagnose` emits no dump and exits 1.