docs(trekresearch): document STORM mechanisms across four surfaces

docs/architecture.md

@@ -12,6 +12,8 @@ Imported from `CLAUDE.md` via pointer.
 - `lib/stats/event-emit.mjs` — single-source stats event emitter for autonomy-gate transitions and main-merge-gate (v3.4.0)
 - `lib/validators/{brief,research,plan,progress,session-state}-validator.mjs` — schema validators with CLI shims (`node lib/validators/X.mjs --json <path>`)
 - `lib/validators/architecture-discovery.mjs` — drift-WARN external-contract discovery for `architecture/overview.md`
+- `lib/util/research-loop-cap.mjs` — stateful, **default-off** turn budget for the `/trekresearch` bounded conversation loop. `allowTurn()` derives the used-turn count from its own append-only JSONL ledger; it never asks the caller how many turns it has spent, because a cap that does is not a cap. Budget = `TREKRESEARCH_MAX_CONV_TURNS` (default `3`, invalid values fall back to `3`) × `maxDimensions` (8, `settings.json:16`). Grants 0 unless `VOYAGE_STORM_ENABLED=1`; missing `CLAUDE_PLUGIN_DATA` denies (fail-closed — the opposite of `event-emit.mjs`, which is telemetry and must never block). CLI shim: `node lib/util/research-loop-cap.mjs --run-id ID --dimension D --effort E`
+- `lib/validators/query-privacy-gate.mjs` — gates **every** outbound research query before it leaves the machine; the hard-block tier (secret-shaped strings) is not operator-overridable, so a query that trips it must be reformulated rather than forced through. CLI shim: `node lib/validators/query-privacy-gate.mjs "<query>"`
 
 Wiring points (replaces previous prose-grep instructions):
 - `/trekbrief` Phase 4g → `brief-validator` (post-write sanity check)

docs/command-modes.md

@@ -30,6 +30,22 @@ Always interactive. Phase 3 is a section-driven completeness loop (no hard cap o
 
 Flags combine: `--project <dir> --local`, `--external --quick`.
 
+### Bounded conversation loop (Phase 4.5 + Phase 5) — env-vars
+
+Dimension discovery and the multi-turn follow-up loop are **default-off** and
+have no flag; they are environment-gated, because turning them on costs turns.
+They run only at `effort: high` (resolved from the brief's `phase_signals`).
+
+| Env-var | Default | Behavior |
+|---------|---------|----------|
+| `VOYAGE_STORM_ENABLED` | _(unset — default-off)_ | `=1` grants the loop a non-zero turn budget. Unset, `research-loop-cap.mjs` grants 0 turns and the loop is inert: doing nothing keeps the mechanism off. |
+| `TREKRESEARCH_MAX_CONV_TURNS` | `3` | Max turns per under-illuminated dimension. Budget = this × `maxDimensions` (8, `settings.json:16`). Empty, non-numeric, zero, or negative values fall back to `3` — never to unbounded. |
+| `VOYAGE_DISABLE_CAP_HOOK` | _(unset)_ | `=1` disables `hooks/scripts/pre-agent-cap.mjs`, the `PreToolUse` enforcement of the turn budget. The cap primitive still applies; only the second gate is switched off. |
+
+Adoption of the loop as a default is gated on a pre-registered measurement —
+protocol, thresholds, and the exact commands in
+[`docs/storm-measurement.md`](storm-measurement.md).
+
 ## /trekplan modes
 
 | Flag | Behavior |