codex-workflow-v2 2.0.0-beta.12.14 → 2.0.0-beta.12.15

package/docs/pdf/sources/codex-workflow-v2-architecture-ru.md

@@ -1,10 +1,10 @@
 ---
-title: Codex Workflow V2: архитектура beta.12.14
+title: Codex Workflow V2: архитектура beta.12.15
 subtitle: Источники истины, lifecycle, роли, delegation, зависимости Tasks и границы доверия
 part: Часть 1 из 3 | Архитектура
 document_version: 2.0
 date: 31 августа 2026
-subject: Архитектура и границы Codex Workflow V2 beta.12.14
+subject: Архитектура и границы Codex Workflow V2 beta.12.15
 ---
 
 # 1. Назначение и граница системы
@@ -18,7 +18,7 @@ Codex Workflow V2 - локальный state machine поверх Codex App, Git
 Система рассчитана на одного пользователя и одну машину. Она не предоставляет distributed locking,
 криптографическую идентификацию actor string или безопасную синхронизацию state между компьютерами.
 
-## 1.1. Что beta.12.14 гарантирует
+## 1.1. Что beta.12.15 гарантирует
 
 - exact project-local npm package и совместимый handshake до lifecycle действий;
 - Discovery до materialization Task или Milestone;
@@ -41,7 +41,7 @@ Codex Workflow V2 - локальный state machine поверх Codex App, Git
   один additive remediation Task без нового Human gate; Core сохраняет Milestone semantics и выводит
   authority из текущей Milestone authorization и exact audit evidence.
 
-## 1.2. Что beta.12.14 не гарантирует
+## 1.2. Что beta.12.15 не гарантирует
 
 - правильность продуктовой идеи или автоматически выбранного provider Task;
 - semantic sufficiency Plan, если точные факты нельзя доказать поддерживаемым analyzer;
@@ -323,12 +323,15 @@ manifest/runner hashes, HEAD и dirty allowlist. Exact beta.12.11 update bridge
 Результат — один `replan-required` decision и обычный corrective replan с исполняемой check command;
 повтор старой команды, ручной commit product files и state editing не допускаются.
 
-beta.12.14 устраняет следующий доказанный разрыв этого пути. Corrective-replan credential раздельно
+beta.12.15 устраняет следующий доказанный разрыв этого пути. Corrective-replan credential раздельно
 связывает исходную Knowledge revision/hash Task и целевую active Knowledge revision/hash replacement
 Plan. Различие разрешено только при exact Plan-integrity dependency recovery: текущий system commit,
 package version, failed Step, Plan, полная remediation history, dirty file set и их bytes должны
-совпасть. Следующее dependency-only обновление после corrective yield может перенести ту же compatibility
-на новый HEAD только при точном parent commit и неизменном worktree. Completed corrective-yield journal
+совпасть. Один или несколько последовательных dependency-only updates после corrective yield могут
+перенести ту же compatibility на новый HEAD: Core идёт назад до последнего зарегистрированного system
+commit, проверяет каждый промежуточный commit как exact manifest/lock-only Workflow pin update и
+атомарно регистрирует всю цепочку. Любой product diff, разрыв parent chain или изменённый worktree
+fail-closed. Completed corrective-yield journal
 остаётся историческим prefix-доказательством и не блокирует последующие append-only handoff events.
 Completed corrective-replan journal также остаётся читаемым после эволюции binding manifest, но только
 если его завершённый manifest/runtime/catalog tuple есть в append-only historical registry. Pending и
@@ -343,7 +346,7 @@ Restart Docker Desktop требует отдельного разрешения
 # 10. Operational checklist
 
 - exact package version установлен, bundled gateway соответствует release и переустановлен;
-- handshake подтверждает protocol 2, state schema 2 и beta.12.14 capabilities;
+- handshake подтверждает protocol 2, state schema 2 и beta.12.15 capabilities;
 - каждый mutation следует свежему `status -> next` и exact option contract;
 - Docker permission failure сначала классифицируется как sandbox boundary, а не как infra retry;
 - semantic unknowns и human gates не маскируются delegation;

package/docs/pdf/sources/codex-workflow-v2-chat-only-guide-ru.md

@@ -1,13 +1,13 @@
 ---
 title: Codex Workflow V2: delegated chat-only guide
-subtitle: Актуальный beta.12.14 путь от нового Discovery до принятого Milestone без ручного CLI
+subtitle: Актуальный beta.12.15 путь от нового Discovery до принятого Milestone без ручного CLI
 part: Часть 2 из 3 | Практика
 document_version: 2.0
 date: 31 августа 2026
-subject: Практическое руководство по delegated Discovery и Milestone в Workflow V2 beta.12.14
+subject: Практическое руководство по delegated Discovery и Milestone в Workflow V2 beta.12.15
 ---
 
-# 1. Рабочая модель beta.12.14
+# 1. Рабочая модель beta.12.15
 
 Пользователь работает в одном Codex Project и формулирует продуктовый outcome. Coordinator выполняет
 CLI, создаёт отдельные Task/Reviewer chats и ведёт supervision loop. Workflow Core остаётся authority
@@ -40,7 +40,7 @@ Blocking unknown, scope change, grant issuance или unrecoverable integrity co
 # 2. Подготовка проекта перед новым Discovery
 
 1. Убедитесь, что checkout чистый и выбран правильный repository root.
-2. Установите beta.12.14 как точную devDependency после публикации release.
+2. Установите beta.12.15 как точную devDependency после публикации release.
 3. Обновите и переустановите bundled `codex-workflow-gateway` этого release.
 4. Проверьте, что declared и installed package versions равны.
 5. Запустите новый Coordinator chat, не fork старого Milestone conversation.
@@ -56,7 +56,7 @@ AGENTS.md
 -> doctor только как дополнительная диагностика
 ```
 
-Handshake beta.12.14 должен сообщать `packageVersion=2.0.0-beta.12.14`, `protocolVersion=2`,
+Handshake beta.12.15 должен сообщать `packageVersion=2.0.0-beta.12.15`, `protocolVersion=2`,
 `stateSchemaVersion=2`, dependency DAG, initial Plan transaction, mechanical feasibility,
 Milestone autonomy и structural replacement disabled capabilities.
 
@@ -117,7 +117,7 @@ delegate, scope, transitions и expiry. DGR передаётся только е
 ```text
 НОВЫЙ COORDINATOR CHAT
 
-Проведи новый Milestone через Codex Workflow V2 beta.12.14 в delegated режиме.
+Проведи новый Milestone через Codex Workflow V2 beta.12.15 в delegated режиме.
 Repository: <ABSOLUTE-REPOSITORY-ROOT>.
 Milestone ID: AUTO.
 Delegate actor: agent:milestone-coordinator.
@@ -360,12 +360,15 @@ Knowledge refresh. Затем выполните advertised credential recovery,
 `task corrective-yield`. Replacement Plan меняет только неисполняемую check на
 `npm run validate:affected -- --files=<Step allowedWrites>` и проходит fresh Plan Risk Audit до нового run.
 
-Если update произошёл уже после `task corrective-yield`, beta.12.14 допускает только advertised
-`update plan-integrity-dependency-recover`: parent должен быть предыдущим зарегистрированным recovery
-commit, а failed Step, Plan, remediation IDs, dirty paths и dirty SHA-256 — полностью совпадать. После
-recovery снова запросите `status -> next`; ожидаемый route остаётся `task corrective-replan-prepare`.
+Если update произошёл уже после `task corrective-yield`, beta.12.15 допускает только advertised
+`update plan-integrity-dependency-recover`. Между последним зарегистрированным recovery commit и HEAD
+может быть один или несколько пропущенных package updates, но каждый обязан менять ровно
+`package.json`/`package-lock.json`, только exact Workflow pin и образовывать непрерывную parent chain.
+Core атомарно регистрирует всю доказанную цепочку; failed Step, Plan, remediation IDs, dirty paths и
+dirty SHA-256 должны полностью совпадать. После recovery снова запросите `status -> next`; ожидаемый
+route остаётся `task corrective-replan-prepare`.
 Если новый package сначала сообщает `TASK_TRANSACTION_INTEGRITY_FAILED` только для terminal
-corrective-replan journals предыдущего release, не repair/delete/edit state. beta.12.14 читает лишь
+corrective-replan journals предыдущего release, не repair/delete/edit state. beta.12.15 читает лишь
 точно зарегистрированные completed manifest/runtime/catalog tuples; pending либо неизвестный tuple
 остаётся блокером. После установки обязательно повторите handshake и последовательные `status -> next`.
 
@@ -401,7 +404,7 @@ Task/project DGR. `dependencyBinding` для standalone handoff равен null.
 
 # 14. Итоговый checklist пользователя
 
-- beta.12.14 exact package и новый bundled gateway установлены;
+- beta.12.15 exact package и новый bundled gateway установлены;
 - новый Coordinator chat не является fork старого Milestone;
 - bootstrap DGR, если нужен, выдан отдельным exact human confirmation;
 - Discovery не materialized при blocking unknowns;

package/docs/pdf/sources/codex-workflow-v2-technical-reference-ru.md

@@ -1,10 +1,10 @@
 ---
-title: Codex Workflow V2: технический справочник beta.12.14
+title: Codex Workflow V2: технический справочник beta.12.15
 subtitle: Protocol 2, state schema 2, transactions, credentials, dependency authority, review и recovery
 part: Часть 3 из 3 | Technical reference
 document_version: 2.0
 date: 31 августа 2026
-subject: Технический контракт Codex Workflow V2 beta.12.14
+subject: Технический контракт Codex Workflow V2 beta.12.15
 ---
 
 # 1. Runtime contract
@@ -13,9 +13,9 @@ Workflow V2 предоставляет локальные revisioned transitions
 и `value` либо структурированную ошибку с `code`, `message` и `details`. Chat, PDF и gateway не создают
 authority сами: mutating permission определяется runtime state и свежим `next`.
 
-| Параметр beta.12.14 | Значение |
+| Параметр beta.12.15 | Значение |
 |---|---|
-| npm package | `codex-workflow-v2@2.0.0-beta.12.14` |
+| npm package | `codex-workflow-v2@2.0.0-beta.12.15` |
 | protocolVersion | 2 |
 | stateSchemaVersion | 2 |
 | lifecycle epoch | 2 |
@@ -37,7 +37,7 @@ Gateway выполняет:
 5. вызов только package-local `dist/src/cli.js --repo <root>`;
 6. `gateway handshake` до lifecycle действий.
 
-Ключевые beta.12.14 capabilities:
+Ключевые beta.12.15 capabilities:
 
 | Группа | Capabilities |
 |---|---|
@@ -468,7 +468,7 @@ corrective-derived reconcile/approval; прочий drift fail-closed. Product b
 переносятся. Fresh route продолжается через credential replacement, `plan-integrity-recover`, yield и
 corrective replan с selector-bearing check.
 
-# 13.6. beta.12.14 source/target Knowledge binding
+# 13.6. beta.12.15 source/target Knowledge binding
 
 Corrective-replan receipt теперь включает две разные пары. `knowledgeRevision/knowledgeHash` связывает
 исходное состояние Task; `targetKnowledgeRevision/targetKnowledgeHash` связывает active Project
@@ -477,9 +477,12 @@ Knowledge Map и replacement Plan. Executor проверяет source под Tas
 
 Source и target могут различаться только при exact `dependencyProvenanceRecoveries.planIntegrity` для
 текущего HEAD и package version. Record обязан совпасть по Plan, failed Step, всей remediation event ID
-последовательности, dirty paths и повторно вычисленному dirty SHA-256. Для последовательного package
-update после corrective yield Core переносит compatibility лишь с зарегистрированного `HEAD^`; любое
-изменение product bytes, Step status, Plan, decision или C1 posture отключает route.
+последовательности, dirty paths и повторно вычисленному dirty SHA-256. После corrective yield Core может
+восстановить один или несколько ещё не зарегистрированных package updates: он просматривает trailing
+Git suffix от HEAD до последнего зарегистрированного system commit, проверяет каждый элемент как
+непрерывный manifest/lock-only exact Workflow pin update и одной Core mutation добавляет каждый commit
+и его фактическую package version в provenance history. Любое изменение product bytes, разрыв ancestry,
+Step status, Plan, decision или C1 posture отключает route.
 
 Completed corrective-yield transaction проверяет неизменный canonical yield event как prefix текущей
 append-only handoff history. Это сохраняет tamper detection, но разрешает новый handoff после успешного
@@ -555,7 +558,7 @@ Docker socket/CLI `EPERM`, `operation not permitted` или `permission denied`
 После каждой successful mutation обязателен sequential `status`, затем fresh `next`. Failed status/next
 не разрешает direct mutation. Syntax help read-only и не заменяет navigation authority.
 
-# 18. Public command surface beta.12.14
+# 18. Public command surface beta.12.15
 
 | Область | Actions |
 |---|---|
@@ -583,10 +586,10 @@ Exact options берутся из fresh `next`; command help используе
 Перед package update project-local `update preflight` должен вернуть `safe=true`: clean checkout, нет
 running Step и active/stale writer lease. Исключения — документированный alpha.7 rescue, beta.12.6
 active-downstream-proof bridge, beta.12.7 exact stranded-replan bridge, beta.12.9 historical-Step
-dependency bridge и beta.12.14 Plan-integrity bridge; все они fail-closed и не дают общего разрешения
+dependency bridge и beta.12.15 Plan-integrity bridge; все они fail-closed и не дают общего разрешения
 dirty update.
 
-Перед beta.12.14 tag обязательны `npm ci`, `npm run validate`, `npm run test:signal-remediation-e2e`, `npm run pack:check`,
+Перед beta.12.15 tag обязательны `npm ci`, `npm run validate`, `npm run test:signal-remediation-e2e`, `npm run pack:check`,
 `npm run smoke:downstream`, `npm run plugin:check`, official plugin/skill validators,
 `npm run docs:pdf:check`, `npm run release:check` с exact tag binding и validation
 append-only real-agent lifecycle log.

package/docs/validation-report.md

@@ -1,112 +1,107 @@
-# V2 beta.12.14 Validation Report
+# V2 beta.12.15 Validation Report
 
-Release candidate `2.0.0-beta.12.14` was validated on 2026-08-31 (Europe/Moscow) with
+Release candidate `2.0.0-beta.12.15` was validated on 2026-08-31 (Europe/Moscow) with
 Node.js 24.17.0.
 
 ## Automated release evidence
 
-- A clean `npm ci` completed from the exact lockfile and reported zero vulnerabilities. The first
-  sandboxed attempt failed only on registry DNS (`ENOTFOUND`); the exact network-enabled retry passed.
-- `npm run validate` passed typecheck and `349/349` sequential tests with no failures, skips,
-  cancellations or todos in 2,224,925.03 ms.
-- The new regression case completes a corrective-replan transaction, rewrites its self-bound
-  identity and phase chain to the exact beta.12.12 historical tuple, and proves observation remains
-  clean. An unknown tuple and the same historical tuple on a pending transaction both remain
-  `journal-invalid`.
-- The full suite still includes the beta.12.13 Signal-shaped E2E: repeated selector-contract
-  failures, consecutive dependency-only updates, exact carried compatibility, source/target
-  Knowledge separation, corrective replan, fresh authorization/C1, selector-bearing validation,
-  Core Step commit and strict Step review.
-- `npm run test:signal-remediation-e2e` passed `2/2`; `npm run
-  test:signal-t03-replan-e2e` passed `1/1`; and `npm run test:signal-t04-recovery` passed `11/11`.
-- Package dry-run passed with 281 files (approximately 1.1 MB packed and 4.3 MB unpacked), and the
-  disposable downstream installation returned `ok=true` for the exact beta.12.14 tarball.
-- `npm run plugin:check`, `npm run docs:pdf:check`,
-  `RELEASE_TAG=v2.0.0-beta.12.14 npm run release:check`, and `git diff --check` all passed. PDF
-  freshness reported an empty stale set and exact beta.12.14 package binding.
+- A clean `npm ci` completed from the exact lockfile and reported zero vulnerabilities.
+- The first full `npm run validate` run passed every behavioral assertion except two diagnostics
+  whose text still described the superseded one-commit boundary. The messages were corrected without
+  changing transition behavior. The second full run passed typecheck and `349/349` sequential tests
+  with no failures, skips, cancellations or todos in 2,169,018.255 ms.
+- The focused dependency-provenance suite passed `11/11`. It covers a two-commit unregistered
+  dependency suffix, exact oldest-to-newest recovery, per-commit package-version provenance and
+  fail-closed product/payload/ancestry drift.
+- `npm run test:signal-t04-recovery` passed `11/11`; `npm run
+  test:signal-t03-replan-e2e` passed `1/1`; and `npm run test:signal-remediation-e2e` passed `2/2`.
+- Package dry-run passed with 281 files (approximately 1.1 MB packed and 4.3 MB unpacked).
+- Disposable downstream installation returned `ok=true` for the exact beta.12.15 tarball. The first
+  sandboxed run failed only because registry DNS was unavailable; the exact network-enabled retry
+  passed.
+- `npm run plugin:check` and `npm run docs:pdf:check` passed. PDF freshness reported an empty stale
+  set and exact beta.12.15 package binding.
 
 ## Live Signal reproduction
 
-The beta.12.13 package was published and installed into Signal through one dependency-only commit
-`51e5e61b39ff9a234dcc9ccb80d81da710570f55`. Declared, locked, installed, Task-branch and `main`
-versions all became exact `2.0.0-beta.12.13`; the three uncommitted STEP-001 product files retained
-their original SHA-256 values.
+Signal Task `TASK-01M1B79C660YMNSRRZ236NTR1T` is blocked after a completed corrective yield. Its
+three allowlisted STEP-001 product files remain uncommitted and unchanged. The repository contains
+two consecutive Workflow dependency-only commits that Core could not register:
 
-Fresh beta.12.13 handshake succeeded with protocol/state schema `2/2`, but read-only `status` failed
-closed with `TASK_TRANSACTION_INTEGRITY_FAILED`. It identified exactly three `journal-invalid`
-completed Task transactions:
+- beta.12.13: `51e5e61b39ff9a234dcc9ccb80d81da710570f55`;
+- beta.12.14: `96c3bd22e818873c1de59cd42b466efde0947d23`.
 
-- `TASK-01M0HVJ4S7GF6JNCNDHPMAVG8Y` / `c66a4bf6b4e67c2b406cccd8229e827a96b7c99e5609d9e025b835817c45e523`;
-- `TASK-01M0HVNAWGQGSSXCDJ4DDGEZXV` / `52838ab5e81da7e471a377ff29828f0ad5326bcb20581c9ee65387e617e1446d`;
-- `TASK-01M0WXJ2GHGYRH86HR7FMKWSTS` / `d5024dc6ab5b2d85da57b6c7d44b8927e0c1558e890ee434f3911712f6faa56a`.
+Fresh beta.12.14 observation is otherwise coherent: no pending or corrupt transactions and no active
+leases. Nevertheless, `next` advertised dependency recovery while its preflight rejected the route
+because it expected the current update commit's parent to be an already registered system commit.
+The beta.12.13 parent could not be registered earlier because the beta.12.13 transaction-observation
+defect prevented all workflow commands before beta.12.14 was installed.
 
-All three were terminal corrective-replan transactions created by the prior 28-field binding model.
-Their exact common identity was manifest SHA-256
-`edab7ee7ac4018e759f5fc702a11a0fd113ef4f2cf8ed8fa823a59fde3012a1a`, runtime fingerprint
-`bd4e7a0ddfcb6abc0c5eb107775e6aea7e08c4606dda4d945d77af8a4520710d`, and catalog hash
-`fa1d11860d4f07978c3b8e85d1f91cd3d15b17284b05f41e05d462d3bb092aed`.
-
-The beta.12.14 implementation was built locally and its transaction observer was run read-only
-against the real Signal external state. It returned `pending=0`, `corrupt=0`. No state, journal,
-sidecar, Git history or product file was modified by this reproduction.
+The beta.12.15 implementation was built locally and run read-only against this exact Signal state.
+Preflight returned `eligible=true`, action `update plan-integrity-dependency-recover`, and the exact
+two-commit chain above in oldest-to-newest order. No Signal state, journal, sidecar, Git history or
+product file was modified by this reproduction.
 
 ## Root cause corrected
 
-beta.12.13 expanded the live corrective-replan binding manifest from 28 to 30 fields so source Task
-Knowledge and target replacement-Plan Knowledge could differ under exact Plan-integrity compatibility.
-The transaction journal validator compared every stored journal with only the current manifest hash.
-Consequently, already completed and otherwise intact beta.12.12 transactions became unreadable after
-the legitimate manifest evolution.
+The beta.12.14 carried-compatibility and dependency-recovery logic assumed a single unregistered
+Workflow update at `HEAD`, with an already registered parent at `HEAD^`. That assumption is false
+when an earlier release was installable but its recovery route was unreachable because observation
+itself failed. Installing the observer fix then creates a bounded consecutive suffix of two
+unregistered dependency-only commits.
 
-The problem was not corrupted Signal state and not a missing repair operation. It was missing
-versioned read compatibility for consumed, terminal Core transaction authority. Repairing, deleting or
-rewriting those journals would have destroyed evidence and hidden the product defect.
+The resulting blocker was not invalid Signal product work, a stale lease or corrupt Core state. It
+was an incomplete dependency-provenance boundary: navigation advertised a route that the route's own
+single-hop preflight could never accept.
 
 ## Implemented compatibility contract
 
-- The current binding manifest remains mandatory for every new, pending or in-flight
-  corrective-replan transaction.
-- An append-only registry records exact historical completed identities as a three-value tuple:
-  manifest SHA-256, runtime semantic fingerprint and runtime catalog hash.
-- A non-current identity is accepted only when the journal phase is `completed` and the full tuple is
-  present in that registry.
-- Existing schema validation, path identity, intent hash, phase hash chain, target inventory, owned
-  preimage/postimage digests, sidecar anchors, completion result and canonical-target readback remain
-  mandatory. Historical registration bypasses none of them.
-- Unknown tuples and historical tuples on nonterminal transactions remain fail closed. A historical
-  completed journal is read evidence only; it cannot mint a new receipt, resume execution or become
-  current transition authority.
-- Protocol and state schema remain `2/2`; no state migration or repair command is required.
-
-## Existing beta.12.13 contract retained
-
-- Corrective-replan credentials still separate source `knowledgeRevision`/`knowledgeHash` from target
-  `targetKnowledgeRevision`/`targetKnowledgeHash`.
-- Source/target difference still requires an exact current Plan-integrity recovery matching HEAD,
-  package version, system commit, Plan, failed Step, full remediation history, dirty paths and dirty
-  worktree hash.
-- Consecutive package-only updates can still carry compatibility only from one exact registered
-  recovery at `HEAD^`, with unchanged product bytes and no C1 posture.
-- Completed corrective-yield journals still require their owned event bytes to be an exact prefix of
-  a valid current append-only handoff history.
+- Preflight discovers the complete trailing unregistered suffix after the exact recorded Task
+  history instead of assuming one commit.
+- Every suffix element must form an uninterrupted parent chain and change exactly `package.json` and
+  `package-lock.json`, only as an exact `codex-workflow-v2` pin update. Product bytes, additional
+  dependency changes, merge ancestry and unexplained commits remain blockers.
+- The terminal suffix commit must match the declared, locked and installed package version.
+- Carried Plan-integrity compatibility is derived by walking through the bounded suffix to the last
+  registered system commit. The original recovery, failed Step, Plan, remediation history, dirty
+  allowlist, dirty SHA-256, C1 posture and completed corrective-yield history must still match.
+- Recovery atomically registers the entire chain in `systemCommits` and appends one provenance record
+  per commit using that commit's actual package version. Partial registration is not permitted.
+- A failed atomic recovery leaves all Core state unchanged. No product file, Plan, Step, lease,
+  review or Git history is edited by this route.
+- Protocol and state schema remain `2/2`; no migration or manual state repair is required.
+
+## Existing beta.12.14 contract retained
+
+- Current binding manifests remain mandatory for pending and in-flight corrective-replan
+  transactions.
+- Historical manifest/runtime/catalog identities are accepted only for exact registered completed
+  journals and cannot create new authority.
+- Corrective-replan credentials still separate source Task Knowledge from target replacement-Plan
+  Knowledge.
+- Completed corrective-yield journals still require their canonical event bytes to be an exact prefix
+  of the append-only handoff history.
+- After dependency recovery, the blocked Task must still pass normal corrective-replan preparation,
+  confirmation, execution, fresh authorization/C1, selector-bearing checks, Core-owned Step commit and
+  strict external review.
 
 ## PDF release documentation evidence
 
-- All three tracked Russian PDFs were regenerated from beta.12.14 sources.
+- All three tracked Russian PDFs were regenerated from beta.12.15 sources.
 - Architecture is 9 pages, delegated chat-only guide is 10 pages, and technical reference is 14
-  pages. All 33 pages were rendered and visually inspected; the release-gate appendix has an explicit
-  page boundary, and no clipping, overlap or unreadable content was observed.
+  pages. All 33 rendered pages were visually inspected; no clipping, overlap or unreadable content
+  was observed.
 
 ## Boundaries and non-claims
 
-- The historical registry is not a wildcard, schema migration, state repair or permission to accept
-  arbitrary old bytes. Each prior identity must be added explicitly and tested.
-- The patch does not weaken pending transaction recovery, current Core authority, dirty-worktree
-  boundaries, review gates or product checks.
-- This report does not claim commit/tag/push, npm publication, live beta.12.14 installation, dependency
-  recovery or STEP-001 completion before each operation receives its own readback.
-
-Confidence is high for historical completed-journal compatibility because the focused test, full
-349-test gate and read-only real Signal state inspection agree. End-to-end confidence remains
-conditional on publication, exact Signal installation, fresh repository-local `status -> next`, and
-completion of the blocked STEP-001 through Core-advertised routes.
+- The suffix scan is not generic history adoption. Only the contiguous, exact Workflow-pin-only
+  prefix between registered Task history and current HEAD is eligible.
+- The patch does not weaken dirty-worktree boundaries, Plan identity, remediation evidence, C1
+  authority, checks or review gates.
+- This report does not claim commit/tag/push, npm publication, live beta.12.15 installation,
+  dependency recovery or STEP-001 completion before each operation receives its own readback.
+
+Confidence is high for consecutive dependency-provenance recovery because the focused tests, full
+349-test gate and read-only real Signal reproduction agree. End-to-end confidence remains conditional
+on publication, exact Signal installation, fresh repository-local `status -> next`, and completion of
+the blocked STEP-001 through Core-advertised routes.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-workflow-v2",
-  "version": "2.0.0-beta.12.14",
+  "version": "2.0.0-beta.12.15",
   "description": "Requirements-first Codex development workflow with local state and explicit Git ownership.",
   "repository": {
     "type": "git",