Epic-lead Slice F — Auto-retire, post-merge window & ops handoff (#226)

You are being dispatched from flower Brief #236: Epic-lead Slice F — Auto-retire, post-merge window & ops handoff (#226)

Recall pointer:
- Use recall_brief with id 236 for the full folder if you need provenance.

Target:
- project: flower (/Users/mikeferrara/Documents/code/flower)
- branch: flower/236-epic-lead-slice-f
- worktree: not specified
- kind: fresh

Current brief spec:
# Slice F — Auto-retire, post-merge window & ops handoff

Parent epic: #226. Design: `docs/design/226-epic-lead-orchestration.md` (§Auto-retire, §Failure/reset). **Depends on Slices B (#232), C (#233), D (#234).** Target ≤~300 lines. Honors decided fork **#56** (auto-retire on epic completion).

## Deliverable
1. **Epic-complete detection** — terminal = sum of `children_rollup.by_status` over `{complete, cancelled, abandoned}` == `total` (NOT `complete + cancelled`; `childrenRollup()` has no `cancelled` field and `BriefStatus::isTerminal()` = {Complete, Cancelled, Abandoned}, `Deferred` is NOT terminal). **Add an explicit `terminal` count to `RecallService::childrenRollup()`** (:891) so it isn't recomputed everywhere.
2. **Bounded post-merge monitoring window** — after MAIN's `epic_delegate{action:merged}`, the lead watches its feature for `config('flower.epic_lead.post_merge_window_minutes', 30)` (or 2 clean heartbeats): new feedback tagged to the epic/children, health signals on changed files, first real exercise. Serious regression → **report up** (`feedback_promote`/`decision_ask`), do not expand scope.
3. **Lead → ops handoff** — write a concise watch-note into the epic brief (`brief_append`: what shipped, what to watch, known risks, files touched) + hand ongoing monitoring to ops. Boundary: lead = bounded window for its own feature; ops = standing/ongoing.
4. **Cooperative retire (no hard-kill race)** — lead calls `daemon_winddown_ready` on itself (no role gate, `DaemonRosterService.php:548`) + **stops its heartbeat/work loop** (winddown convention), THEN enqueues `epic_return{action:retire}`. MAIN calls `CloseDaemon::close(lead)` — guard already satisfied, **no forced winddown override / no CloseAllDaemons hard-kill**. Epic brief → `complete`; EnsureDaemons never respawns (leads not in expected sets) → durable retirement.
5. **Failure/reset behavior** — stale/dead lead on an open epic → MAIN decides: respawn a fresh lead (idempotent — durable state in epic brief + children + epic branch) or absorb inline. Lead reset mid-epic → make-before-break handshake; successor inherits `epic_brief_id` + epic worktree + drains its `epic_delegate` mailbox by epic id (baton NOT transferred — lead is a subordinate). Epic cancelled → lead retires without a master merge; branch/worktree torn down.

## Tests
- Retire path closes a quiesced lead and marks the epic `complete`.
- EnsureDaemons never respawns a retired lead.
- Respawn of a fresh lead resumes from the epic brief (durable-state recovery).
- Terminal detection counts `abandoned` children.

## Notes
- This closes the finite lifecycle. The end-to-end epic can be demonstrated after this slice.

Recent/key trace events:
[1] participant_joined flower-226-worker: (no body)
[2] note_added flower-226-worker: # Slice F — Auto-retire, post-merge window & ops handoff

Design: `docs/design/226-epic-lead-orchestration.md` (§Auto-retire, §Failure/reset). Depends on Slices B, C, D. Target ≤~300 lines. Honors decided fork **#56** (auto-retire on epic completion).

## Deliverable
1. **Epic-complete detection** — terminal = sum of `children_rollup.by_status` over `{complete, cancelled, abandoned}` == `total` (NOT `complete + cancelled`; `childrenRollup()` has no `cancelled` field and `BriefStatus::isTerminal()` = {Complete, Cancelled, Abandoned}, `Deferred` is NOT terminal). **Add an explicit `terminal` count to `RecallService::childrenRollup()`** (:891) so it isn't recomputed everywhere.
2. **Bounded post-merge monitoring window** — after MAIN's `epic_delegate{action:merged}`, the lead watches its feature for `config('flower.epic_lead.post_merge_window_minutes', 30)` (or 2 clean heartbeats): new feedback tagged to the epic/children, health signals on changed files, first real exercise. Serious regression → **report up** (`feedback_promote`/`decision_ask`), do not expand scope.
3. **Lead → ops handoff** — write a concise watch-note into the epic brief (`brief_append`: what shipped, what to watch, known risks, files touched) + hand ongoing monitoring to ops. Boundary: lead = bounded window for its own feature; ops = standing/ongoing.
4. **Cooperative retire (no hard-kill race)** — lead calls `daemon_winddown_ready` on itself (no role gate, `DaemonRosterService.php:548`) + **stops its heartbeat/work loop** (winddown convention), THEN enqueues `epic_return{action:retire}`. MAIN calls `CloseDaemon::close(lead)` — guard already satisfied, **no forced winddown override / no CloseAllDaemons hard-kill**. Epic brief → `complete`; EnsureDaemons never respawns (leads not in expected sets) → durable retirement.
5. **Failure/reset behavior** — stale/dead lead on an open epic → MAIN decides: respawn a fresh lead (idempotent — durable state in epic brief + children + epic branch) or absorb inline. Lead reset mid-epic → make-before-break handshake; successor inherits `epic_brief_id` + epic worktree + drains its `epic_delegate` mailbox by epic id (baton NOT transferred — lead is a subordinate). Epic cancelled → lead retires without a master merge; branch/worktree torn down.

## Tests
- Retire path closes a quiesced lead and marks the epic `complete`.
- EnsureDaemons never respawns a retired lead.
- Respawn of a fresh lead resumes from the epic brief (durable-state recovery).
- Terminal detection counts `abandoned` children.

## Notes
- This closes the finite lifecycle. The end-to-end epic can be demonstrated after this slice.
[3] parent_set flower-226-worker: Grouped under epic #226.
[4] dependency_added flower-226-worker: Now depends on #232 (Epic-lead Slice B — Lead charter & spawn path (#226)).
[5] dependency_added flower-226-worker: Now depends on #233 (Epic-lead Slice C — Coordination signals epic_delegate / epic_return (#226)).
[6] dependency_added flower-226-worker: Now depends on #234 (Epic-lead Slice D — Epic-branch merge + baton coexistence (#226)).
[7] plan_proposed flower-226-worker: # Slice F — Auto-retire, post-merge window & ops handoff

Parent epic: #226. Design: `docs/design/226-epic-lead-orchestration.md` (§Auto-retire, §Failure/reset). **Depends on Slices B (#232), C (#233), D (#234).** Target ≤~300 lines. Honors decided fork **#56** (auto-retire on epic completion).

## Deliverable
1. **Epic-complete detection** — terminal = sum of `children_rollup.by_status` over `{complete, cancelled, abandoned}` == `total` (NOT `complete + cancelled`; `childrenRollup()` has no `cancelled` field and `BriefStatus::isTerminal()` = {Complete, Cancelled, Abandoned}, `Deferred` is NOT terminal). **Add an explicit `terminal` count to `RecallService::childrenRollup()`** (:891) so it isn't recomputed everywhere.
2. **Bounded post-merge monitoring window** — after MAIN's `epic_delegate{action:merged}`, the lead watches its feature for `config('flower.epic_lead.post_merge_window_minutes', 30)` (or 2 clean heartbeats): new feedback tagged to the epic/children, health signals on changed files, first real exercise. Serious regression → **report up** (`feedback_promote`/`decision_ask`), do not expand scope.
3. **Lead → ops handoff** — write a concise watch-note into the epic brief (`brief_append`: what shipped, what to watch, known risks, files touched) + hand ongoing monitoring to ops. Boundary: lead = bounded window for its own feature; ops = standing/ongoing.
4. **Cooperative retire (no hard-kill race)** — lead calls `daemon_winddown_ready` on itself (no role gate, `DaemonRosterService.php:548`) + **stops its heartbeat/work loop** (winddown convention), THEN enqueues `epic_return{action:retire}`. MAIN calls `CloseDaemon::close(lead)` — guard already satisfied, **no forced winddown override / no CloseAllDaemons hard-kill**. Epic brief → `complete`; EnsureDaemons never respawns (leads not in expected sets) → durable retirement.
5. **Failure/reset behavior** — stale/dead lead on an open epic → MAIN decides: respawn a fresh lead (idempotent — durable state in epic brief + children + epic branch) or absorb inline. Lead reset mid-epic → make-before-break handshake; successor inherits `epic_brief_id` + epic worktree + drains its `epic_delegate` mailbox by epic id (baton NOT transferred — lead is a subordinate). Epic cancelled → lead retires without a master merge; branch/worktree torn down.

## Tests
- Retire path closes a quiesced lead and marks the epic `complete`.
- EnsureDaemons never respawns a retired lead.
- Respawn of a fresh lead resumes from the epic brief (durable-state recovery).
- Terminal detection counts `abandoned` children.

## Notes
- This closes the finite lifecycle. The end-to-end epic can be demonstrated after this slice.
[8] participant_joined flower-234-worker: (no body)
[9] unblocked flower-234-worker: Unblocked — #234 reached complete.
[10] participant_joined flower-orchestrator: (no body)
[11] status_change flower-orchestrator: (no body)

Recommended linked context:
{
    "todos": [],
    "scratchpads": []
}

Execution notes:
- Treat the brief as the source of truth.
- Keep work scoped to this dispatch request.
- Use brief_append / brief_update_status when reporting material progress; as your final dispatched-worker step, call brief_dispatch_complete with dispatch_request_id (or brief_id) and actor_ref.
- Codex workers should verify mutating Flower tools with tool_search query `brief_append brief_dispatch_complete flower_feedback` (limit 20) when tool availability is in doubt; report raw SEE/LOAD vs NOT visible instead of silently using local fallbacks.
- Add a git commit trailer `Brief: #236` to every commit for this brief so flower can exact-link commits back to the brief.