wendkeep 0.77.0 → 0.79.0

package/CHANGELOG.md

@@ -4,6 +4,70 @@ All notable changes to **wendkeep** are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.79.0] — 2026-08-23
+
+### Added
+
+- **Gate único de proveniência.** Archive, delivery, release e cleanup rederivam a autoridade no
+  subject atual com a taxonomia `verified`, `reported`, `legacy-unbound`, `stale`, `conflict` e
+  `unproven`; somente `verified` satisfaz prova obrigatória, com códigos e recovery sanitizados.
+- **Fontes verificáveis.** Adapters injetáveis ligam Git, CI, tag, NPM e GitHub Release ao
+  repositório, target commit, package/version, integrity e notas esperados sem confiar em URL/claim
+  fornecida nem na worktree incidental.
+- **Receipt Ledger v2.** Autorizações de archive e receipts de delivery/cleanup ganham sequência,
+  `previous_hash`, `receipt_hash`, lock, publicação atômica e checkpoint separado, com schema
+  público e replay idempotente.
+
+### Changed
+
+- **Archive fail-closed.** Evidence Envelope v2, pacote deep e verdict completos/canônicos agora
+  são exigidos mesmo sem sensores; uma autorização v2 é encadeada antes da mutação e `--force`
+  continua limitado a tarefa aberta, sem pular proveniência.
+- **Delivery e release ligadas ao destino.** Merge/push observam `<remote>/<branch>`, exigem
+  ancestralidade e preservam origin/worktree/branch do start; tag/publish derivam package e artefato
+  do target e verificam CI → commit → tag → versão/integrity → GitHub Release. Offline
+  permanece `reported` e não grava completion receipt.
+- **Cleanup retomável e causal.** Finish/remove/prune validam o ledger antes da mutação, vinculam
+  todos os contextos, PR/head/merge e ator disponível, e retomam o mesmo operation ID após crash
+  antes/depois do append ou finalize; texto e `--json` preservam códigos e recovery sanitizados.
+- **Compatibilidade explícita.** Ledgers v1 permanecem read-only como prefixo `legacy-unbound`;
+  no Windows com Node 18–22, receipts e operation locks tratam `st_dev=0` como metadado
+  indisponível quando o inode continua idêntico, sem aceitar identificadores de dispositivo
+  não-zero conflitantes; aquisições e liberações concorrentes relêem rotações e sharing
+  violations transitórias com limite estrito, e o release fecha e revalida o marker antes do
+  unlink nas runtimes antigas;
+  README, contrato do harness e guias de changes/verify/profiles/worktrees foram atualizados em
+  PT-BR/EN.
+
+### Security
+
+- Adulteração intermediária, JSON parcial, cauda/checkpoint removidos, colisão de ID, locks
+  trocados por outro owner, writer concorrente e escape por symlink/junction passam a bloquear antes
+  da mutação; diagnósticos não persistem tokens nem paths privados.
+
+## [0.78.0] — 2026-08-22
+
+### Added
+
+- **Evidence Envelope v2.** `verify` liga cada prova a projeto, repositório, worktree, work session,
+  branch, base/HEAD, árvore do índice e digest determinístico de staged/unstaged/untracked por
+  SHA-256 canônico; texto normaliza CRLF/CR para LF e binários preservam bytes.
+- **Proveniência por sensor.** Cada resultado registra comando efetivo sanitizado e hash,
+  timestamps, duração, exit code, digest da saída e tail sanitizado limitado; alteração da
+  configuração invalida o binding anterior.
+- **Diagnóstico causal.** `change status`, doctor, handoff e Observer distinguem evidência `bound`,
+  `stale`, `context-mismatch` e `legacy-unbound`; pacote deep e verdict carregam o mesmo
+  `evidenceEnvelopeId` e `evidenceBinding` completo e não podem ser reutilizados entre worktrees.
+
+### Changed
+
+- **Publicação fail-closed.** Mudança de HEAD durante os sensores preserva a evidência anterior e
+  retorna `WENDKEEP_EVIDENCE_HEAD_CHANGED`. Evidência, pacote, verdict trivial e seals são gravados
+  por temporário path-safe no mesmo diretório e rename atômico.
+- **Compatibilidade explícita.** Evidência v1 continua legível para histórico, mas sensores v1 não
+  satisfazem autoridade v2 no archive. README, schema e guias PT-BR/EN documentam formato,
+  normalização, recovery e vínculo do passe independente.
+
 ## [0.77.0] — 2026-08-22
 
 ### Added

package/README.en.md

@@ -239,7 +239,7 @@ The README is the map; the guides provide syntax, options, exit codes, examples,
 | Group | Use it for | Detailed guide |
 |---|---|---|
 | **Installation and updates** | `init`, `sync`, companions, and the first project↔vault binding | [Installation and first use](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/getting-started.md) |
-| **Managed worktrees** | `worktree create/list/status/open/finish/cleanup/remove/prune`, merge proof, preflight, and receipts | [Managed worktrees](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/worktrees.md) |
+| **Managed worktrees** | `worktree create/list/status/open/finish/cleanup/remove/prune`, merge proof, preflight, crash-safe cleanup/common gate, and receipts | [Managed worktrees](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/worktrees.md) |
 | **Active context** | `active_contexts` by `repository_id`/`worktree_id`/`work_session_id`, causal transition, quarantine, and explicit recovery | [Active context](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/context.md) |
 | **Operating profiles** | `profile`, `flow`, always-on Keep Core, and Wend Runtime governance | [Operating profiles](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/operating-profiles.md) |
 | **Changes and verification** | `change`, specs, sensors, TDD, evidence, and archive | [Changes and verification](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/changes-and-verification.md) |
@@ -352,9 +352,28 @@ an initialized registry never copies a global authorization without proven ident
 ```bash
 npx wendkeep delivery start release-0-74-0 --allow git:merge --allow git:push --allow publish --source-change <slug> --source-commit <sha> --session <id>
 npx wendkeep delivery status release-0-74-0 --session <id>
-npx wendkeep delivery finish release-0-74-0 --target main --ci-url <url> --version 0.74.0 --npm-integrity <sha512> --release-url <url> --session <id>
+npx wendkeep delivery finish release-0-74-0 --target origin/main --ci-url <url> --version 0.74.0 --npm-integrity <sha512> --release-url <url> --session <id>
 ```
 
+For `git:merge` and `git:push` capabilities, `delivery finish` requires
+`--target <remote>/<branch>` (for example, `--target origin/main`). `delivery start` binds the
+`origin` remote to the expected `repository`; during finish, the target is resolved again with
+`git ls-remote`. If the target cannot be resolved or the origin/repository binding diverges, the
+delivery is blocked before provenance adapters run.
+
+The provenance gate re-derives authority against the current subject before archive, delivery,
+release, or cleanup. Its single taxonomy is `verified`, `reported`, `legacy-unbound`, `stale`,
+`conflict`, and `unproven`; only `verified` authorizes required proof. Evidence, a verdict, or a
+receipt captured before amend/rebase, from another branch/worktree/session, or backed only by a
+reported/offline external claim fails closed with objective recovery. New receipts use schema v2,
+`previous_hash`, `receipt_hash`, and a separate checkpoint to detect tampering and truncation.
+Stable codes are `WENDKEEP_PROVENANCE_GATE_BLOCKED`, `WENDKEEP_RECEIPT_LEDGER_BUSY`,
+`WENDKEEP_RECEIPT_LEDGER_CONFLICT`, `WENDKEEP_RECEIPT_LEDGER_CORRUPT`, and
+`WENDKEEP_RECEIPT_LEDGER_TRUNCATED`. Safe recovery reads `state`, `reasonCodes`, `diagnostics`,
+and `repair.command` in `--json` output, runs `npx --no-install wendkeep verify --deep --json` or
+the indicated status command, and recaptures proof; it never prints raw stderr, tokens, private URLs,
+or Vault paths, and never edits the ledger/checkpoint.
+
 If the harness does not record a lease, a small fix remains under the configured profile —
 `GOVERN` by default. `OFF` does not mean “simple task”: it is a persistent human choice that hands
 governance to the native harness. The LLM may temporarily elevate an `OFF` base to a Wend route,
@@ -531,11 +550,47 @@ explore → propose → apply (TDD) → verify → archive
 
 - **Propose** — `wendkeep change new <slug>` scaffolds `08-Mudanças/<slug>/` (`proposta.md`, `design.md`, `tarefas.md`; `--simple` skips the design). `--guide` creates the compact GUIDE contract and omits automatic design/spec/ADR when `contract_impact:none`. It becomes the global *current* change. When the change declares `spec_impact: required`, you author the delta yourself at `specs/<capability>/spec.md` — there is no placeholder to delete. Multiple changes may remain open: `change list`/`status` and the hooks show every pending one, while commands without `--change` act on the current one alone. `change use <slug>` changes focus and `change continue <archived> <new>` creates an auditable continuation.
 - **Apply** — implement each `tarefas.md` task. Mark machine proof with one or more `[sensor:<id>]` tags on the same task: every distinct ID enters the gate once, in declaration order. Also mark satisfied requirements with one or more `[req:<ID>]` tags.
-- **Verify** — `wendkeep verify` runs the sensors your tasks declared (from `wendkeep.sensors.json` at the project root) and writes `evidencia.json`. A red `critical` fails the gate; a red `warning` is advisory. Failures retain only a bounded, sanitized diagnostic; green output is not persisted. `verify --deep` builds a self-contained package with complete effective requirements (living contract + this change's delta), so the independent verifier never needs to reconstruct unarchived requirements from `07-Specs`. Every change needs a `verdict.json` to archive; `verify --deep` writes a trivial one automatically when the change declares no `[req:]`.
+- **Verify** — `wendkeep verify` runs declared sensors and writes an **Evidence Envelope v2** to `evidencia.json`, SHA-256-bound to project/repository/worktree/session, HEAD, index tree, normalized worktree digest, tasks, effective spec, and sensor configuration. Each sensor records a sanitized command, execution window, duration, exit code, output digest, and a sanitized tail bounded to 2,000 characters. If HEAD changes during the run, no new envelope is published. `change status` reports `bound`, `stale`, `context-mismatch`, or `legacy-unbound`; v1 evidence remains readable but cannot satisfy v2 authority. The public schema is [`schema/wendkeep.evidence-envelope-v2.schema.json`](schema/wendkeep.evidence-envelope-v2.schema.json). `verify --deep` binds both package and verdict to the current `envelope_id`.
 - **Archive** — `wendkeep change archive <slug>` **gates** on the evidence (blocks unless every declared critical sensor is green), promotes each applicable spec delta (`ADDED`/`MODIFIED`/`REMOVED`) into the living `07-Specs/<capability>.md` and moves the change to `_arquivo/`. GOVERN/ASSURE mint an ADR in `04-Decisões/`; compact GUIDE with no contract impact does not mint one automatically.
 
 > The gate blocks unless the scaffold is filled, no task is open, evidence is fresh, and every declared requirement is covered. **`--force` waives exactly one of those — the open-task check — and is the human's call, never the agent's.** An unfilled scaffold, a red critical sensor, stale evidence, an orphan requirement or a missing verdict block regardless.
 
+After the fix, archive requires a **final** recapture with
+`wendkeep verify --deep --change <slug>`. The package is complete and canonical; the verdict must
+also be complete and canonical, with both bound to the same checkout, change, tasks, spec, and sensors. Before any mutation, the command
+writes an authorization receipt to the separate `change-archive-receipts-v2` ledger; only after
+that receipt is valid may it promote the spec/ADR or move the change. `change archive --json`
+returns the serializable `state`, `reason_codes`, `diagnostics`, and `repair` fields. Corruption
+or truncation in any ledger fails closed before mutation. `--force` does not bypass provenance,
+integrity, package, verdict, corruption, or truncation; the exact recovery is the recapture above.
+
+Archive sealing uses the runtime lock and a private ASCII transaction at
+`.brain/runtime/archive-transactions/<uuid>/{original,authorized}`: it atomically renames the live
+change to `original`, checks the digest, and promotes only `authorized`. On a seal or divergence
+failure, it removes the snapshot and restores `original` without partial promotion. Multi-spec
+promotion is one atomic unit: it captures before-images/digests, rolls back before/after writes,
+and permits retry only after reconciliation and fresh verification. The post-release finalizer
+validates original/destination digests, but the `completed` journal keeps the `original` retained;
+no destructive cleanup is automatic. A failure leaves `published-recovery-required`. Text and --json
+keep the same sanitized diagnostic (code, operation, state, blocker, expected, observed, recovery).
+
+The archive uses a `directory lock` with a token-specific marker and lease: acquisition prepares a
+sibling `.pending` directory and publishes it by atomic rename, uses no hardlink, and allows at most
+3 topology attempts. A live owner returns `WENDKEEP_ARCHIVE_BUSY`, a dead owner is safely reaped,
+an invalid marker returns `WENDKEEP_ARCHIVE_LOCK_UNAVAILABLE`, and ownership loss returns
+`WENDKEEP_ARCHIVE_LOCK_OWNERSHIP_LOST`. The transaction keeps `archive-transaction.json` with
+phases `prepared` → `isolated` → `copied` → `sealed` → `published` → `promotion-prepared` →
+`promotion-applied` → `completed` or `recovery-required`. A pending journal blocks a new archive for
+the same slug before the gate. On
+a collision/post-publication failure, `original` is retained and the state is
+`published-recovery-required`; `operation_id` and `transaction_phase` are sanitized. Inspect it
+with `wendkeep change archive recover <operation-id> --change <slug> [--spec-action rollback|resume] [--json]`:
+without `--spec-action`, this is a read-only, fail-closed, idempotent operation that returns
+sanitized actions without promoting or deleting. `rollback` restores before-images and `resume`
+converges after-images for a `promotion-prepared` promotion, while retaining the journal for
+reconciliation. When an operation ID exists, `repair.command` points to that recovery; do not treat
+`command:null` as the normal flow.
+
 `wendkeep init` seeds process skills into the vault's `.brain/skills` and delivers identical copies to `.claude/skills/` and `.agents/skills/`; Codex gets the agent definitions (`.brain/agents/*.toml` → `.codex/agents/`) plus a managed section in `AGENTS.md` that indexes the skills. Every skill carries source hash/version metadata; `doctor` warns when reseed + agent restart is required.
 
 ### The loop in five minutes

package/README.md

@@ -239,7 +239,7 @@ The README is the map; the guides provide syntax, options, exit codes, examples,
 | Group | Use it for | Detailed guide |
 |---|---|---|
 | **Installation and updates** | `init`, `sync`, companions, and the first project↔vault binding | [Installation and first use](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/getting-started.md) |
-| **Managed worktrees** | `worktree create/list/status/open/finish/cleanup/remove/prune`, merge proof, preflight, and receipts | [Managed worktrees](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/worktrees.md) |
+| **Managed worktrees** | `worktree create/list/status/open/finish/cleanup/remove/prune`, merge proof, preflight, crash-safe cleanup/common gate, and receipts | [Managed worktrees](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/worktrees.md) |
 | **Active context** | `active_contexts` by `repository_id`/`worktree_id`/`work_session_id`, causal transition, quarantine, and explicit recovery | [Active context](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/context.md) |
 | **Operating profiles** | `profile`, `flow`, always-on Keep Core, and Wend Runtime governance | [Operating profiles](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/operating-profiles.md) |
 | **Changes and verification** | `change`, specs, sensors, TDD, evidence, and archive | [Changes and verification](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/changes-and-verification.md) |
@@ -352,9 +352,28 @@ an initialized registry never copies a global authorization without proven ident
 ```bash
 npx wendkeep delivery start release-0-74-0 --allow git:merge --allow git:push --allow publish --source-change <slug> --source-commit <sha> --session <id>
 npx wendkeep delivery status release-0-74-0 --session <id>
-npx wendkeep delivery finish release-0-74-0 --target main --ci-url <url> --version 0.74.0 --npm-integrity <sha512> --release-url <url> --session <id>
+npx wendkeep delivery finish release-0-74-0 --target origin/main --ci-url <url> --version 0.74.0 --npm-integrity <sha512> --release-url <url> --session <id>
 ```
 
+For `git:merge` and `git:push` capabilities, `delivery finish` requires
+`--target <remote>/<branch>` (for example, `--target origin/main`). `delivery start` binds the
+`origin` remote to the expected `repository`; during finish, the target is resolved again with
+`git ls-remote`. If the target cannot be resolved or the origin/repository binding diverges, the
+delivery is blocked before provenance adapters run.
+
+The provenance gate re-derives authority against the current subject before archive, delivery,
+release, or cleanup. Its single taxonomy is `verified`, `reported`, `legacy-unbound`, `stale`,
+`conflict`, and `unproven`; only `verified` authorizes required proof. Evidence, a verdict, or a
+receipt captured before amend/rebase, from another branch/worktree/session, or backed only by a
+reported/offline external claim fails closed with objective recovery. New receipts use schema v2,
+`previous_hash`, `receipt_hash`, and a separate checkpoint to detect tampering and truncation.
+Stable codes are `WENDKEEP_PROVENANCE_GATE_BLOCKED`, `WENDKEEP_RECEIPT_LEDGER_BUSY`,
+`WENDKEEP_RECEIPT_LEDGER_CONFLICT`, `WENDKEEP_RECEIPT_LEDGER_CORRUPT`, and
+`WENDKEEP_RECEIPT_LEDGER_TRUNCATED`. Safe recovery reads `state`, `reasonCodes`, `diagnostics`,
+and `repair.command` in `--json` output, runs `npx --no-install wendkeep verify --deep --json` or
+the indicated status command, and recaptures proof; it never prints raw stderr, tokens, private URLs,
+or Vault paths, and never edits the ledger/checkpoint.
+
 If the harness does not record a lease, a small fix remains under the configured profile —
 `GOVERN` by default. `OFF` does not mean “simple task”: it is a persistent human choice that hands
 governance to the native harness. The LLM may temporarily elevate an `OFF` base to a Wend route,
@@ -531,11 +550,47 @@ explore → propose → apply (TDD) → verify → archive
 
 - **Propose** — `wendkeep change new <slug>` scaffolds `08-Mudanças/<slug>/` (`proposta.md`, `design.md`, `tarefas.md`; `--simple` skips the design). `--guide` creates the compact GUIDE contract and omits automatic design/spec/ADR when `contract_impact:none`. It becomes the global *current* change. When the change declares `spec_impact: required`, you author the delta yourself at `specs/<capability>/spec.md` — there is no placeholder to delete. Multiple changes may remain open: `change list`/`status` and the hooks show every pending one, while commands without `--change` act on the current one alone. `change use <slug>` changes focus and `change continue <archived> <new>` creates an auditable continuation.
 - **Apply** — implement each `tarefas.md` task. Mark machine proof with one or more `[sensor:<id>]` tags on the same task: every distinct ID enters the gate once, in declaration order. Also mark satisfied requirements with one or more `[req:<ID>]` tags.
-- **Verify** — `wendkeep verify` runs the sensors your tasks declared (from `wendkeep.sensors.json` at the project root) and writes `evidencia.json`. A red `critical` fails the gate; a red `warning` is advisory. Failures retain only a bounded, sanitized diagnostic; green output is not persisted. `verify --deep` builds a self-contained package with complete effective requirements (living contract + this change's delta), so the independent verifier never needs to reconstruct unarchived requirements from `07-Specs`. Every change needs a `verdict.json` to archive; `verify --deep` writes a trivial one automatically when the change declares no `[req:]`.
+- **Verify** — `wendkeep verify` runs declared sensors and writes an **Evidence Envelope v2** to `evidencia.json`, SHA-256-bound to project/repository/worktree/session, HEAD, index tree, normalized worktree digest, tasks, effective spec, and sensor configuration. Each sensor records a sanitized command, execution window, duration, exit code, output digest, and a sanitized tail bounded to 2,000 characters. If HEAD changes during the run, no new envelope is published. `change status` reports `bound`, `stale`, `context-mismatch`, or `legacy-unbound`; v1 evidence remains readable but cannot satisfy v2 authority. The public schema is [`schema/wendkeep.evidence-envelope-v2.schema.json`](schema/wendkeep.evidence-envelope-v2.schema.json). `verify --deep` binds both package and verdict to the current `envelope_id`.
 - **Archive** — `wendkeep change archive <slug>` **gates** on the evidence (blocks unless every declared critical sensor is green), promotes each applicable spec delta (`ADDED`/`MODIFIED`/`REMOVED`) into the living `07-Specs/<capability>.md` and moves the change to `_arquivo/`. GOVERN/ASSURE mint an ADR in `04-Decisões/`; compact GUIDE with no contract impact does not mint one automatically.
 
 > The gate blocks unless the scaffold is filled, no task is open, evidence is fresh, and every declared requirement is covered. **`--force` waives exactly one of those — the open-task check — and is the human's call, never the agent's.** An unfilled scaffold, a red critical sensor, stale evidence, an orphan requirement or a missing verdict block regardless.
 
+After the fix, archive requires a **final** recapture with
+`wendkeep verify --deep --change <slug>`. The package is complete and canonical; the verdict must
+also be complete and canonical, with both bound to the same checkout, change, tasks, spec, and sensors. Before any mutation, the command
+writes an authorization receipt to the separate `change-archive-receipts-v2` ledger; only after
+that receipt is valid may it promote the spec/ADR or move the change. `change archive --json`
+returns the serializable `state`, `reason_codes`, `diagnostics`, and `repair` fields. Corruption
+or truncation in any ledger fails closed before mutation. `--force` does not bypass provenance,
+integrity, package, verdict, corruption, or truncation; the exact recovery is the recapture above.
+
+Archive sealing uses the runtime lock and a private ASCII transaction at
+`.brain/runtime/archive-transactions/<uuid>/{original,authorized}`: it atomically renames the live
+change to `original`, checks the digest, and promotes only `authorized`. On a seal or divergence
+failure, it removes the snapshot and restores `original` without partial promotion. Multi-spec
+promotion is one atomic unit: it captures before-images/digests, rolls back before/after writes,
+and permits retry only after reconciliation and fresh verification. The post-release finalizer
+validates original/destination digests, but the `completed` journal keeps the `original` retained;
+no destructive cleanup is automatic. A failure leaves `published-recovery-required`. Text and --json
+keep the same sanitized diagnostic (code, operation, state, blocker, expected, observed, recovery).
+
+The archive uses a `directory lock` with a token-specific marker and lease: acquisition prepares a
+sibling `.pending` directory and publishes it by atomic rename, uses no hardlink, and allows at most
+3 topology attempts. A live owner returns `WENDKEEP_ARCHIVE_BUSY`, a dead owner is safely reaped,
+an invalid marker returns `WENDKEEP_ARCHIVE_LOCK_UNAVAILABLE`, and ownership loss returns
+`WENDKEEP_ARCHIVE_LOCK_OWNERSHIP_LOST`. The transaction keeps `archive-transaction.json` with
+phases `prepared` → `isolated` → `copied` → `sealed` → `published` → `promotion-prepared` →
+`promotion-applied` → `completed` or `recovery-required`. A pending journal blocks a new archive for
+the same slug before the gate. On
+a collision/post-publication failure, `original` is retained and the state is
+`published-recovery-required`; `operation_id` and `transaction_phase` are sanitized. Inspect it
+with `wendkeep change archive recover <operation-id> --change <slug> [--spec-action rollback|resume] [--json]`:
+without `--spec-action`, this is a read-only, fail-closed, idempotent operation that returns
+sanitized actions without promoting or deleting. `rollback` restores before-images and `resume`
+converges after-images for a `promotion-prepared` promotion, while retaining the journal for
+reconciliation. When an operation ID exists, `repair.command` points to that recovery; do not treat
+`command:null` as the normal flow.
+
 `wendkeep init` seeds process skills into the vault's `.brain/skills` and delivers identical copies to `.claude/skills/` and `.agents/skills/`; Codex gets the agent definitions (`.brain/agents/*.toml` → `.codex/agents/`) plus a managed section in `AGENTS.md` that indexes the skills. Every skill carries source hash/version metadata; `doctor` warns when reseed + agent restart is required.
 
 ### The loop in five minutes

package/docs/en/commands/changes-and-verification.md

@@ -30,7 +30,8 @@ npx wendkeep change status [slug] [--session <id>]
 npx wendkeep spec effective [--change <slug>] [--session <id>]
 npx wendkeep sensors list
 npx wendkeep verify [--deep] [--change <slug>] [--session <id>]
-npx wendkeep change archive <slug> [--session <id>]
+npx wendkeep change archive <slug> [--json] [--session <id>]
+npx wendkeep change archive recover <operation-id> --change <slug> [--spec-action rollback|resume] [--json]
 ```
 
 ## Options and exit codes
@@ -47,6 +48,10 @@ npx wendkeep change archive <slug> [--session <id>]
   only one unambiguous active context for the worktree is accepted; ambiguity returns exit `2`.
 - `change relink [--apply]` and `change backlink [--apply]` repair graph links; preview is default.
 - `change abandon <slug>` drops work without an ADR; `archive --force` needs explicit human choice.
+- `change archive recover <operation-id> --change <slug> [--spec-action rollback|resume]` inspects a
+  pending transaction by default; with `rollback` or `resume`, it converges only the spec
+  promotion prepared in the journal, under the operation lock and validation. It never promotes the
+  change, deletes the journal, or invents reconciliation.
 - `wendkeep spec list|show|effective|migrate|rebase` manages living contracts and deltas.
 - `wendkeep sensors list|add` manages executable proof.
 - Exit `0` means completion; gates use exit `1` for red proof and exit `2` for invalid
@@ -76,7 +81,72 @@ npx wendkeep sensors add api-contracts "npm run test:contracts" --severity criti
 An archived change promotes its delta into the living spec when applicable and preserves proposal,
 tasks/proof, and design when present. GOVERN/ASSURE mint an ADR; compact GUIDE with no contract
 impact does not mint one automatically. Archive passes only with closed tasks, green required
-sensors, and a fresh verdict.
+sensors, and a fresh verdict bound to the same Evidence Envelope v2. V1 evidence is reported as
+`legacy-unbound`; `change status <slug>` also diagnoses `bound`, `stale`, and `context-mismatch`.
+Archive compares the package/verdict `evidenceEnvelopeId` and complete `evidenceBinding` with the
+proven checkout. On a mismatch, return to the correct worktree/session and rerun `verify`,
+`verify --deep`, and `wk-verify`. Fields, text/binary normalization, error codes, and recovery are
+detailed in the [verify guide](verify.md).
+
+The common gate reclassifies the envelope, package, and verdict as `verified`, `reported`,
+`legacy-unbound`, `stale`, `conflict`, or `unproven`; only `verified` permits archive. A block
+returns `WENDKEEP_PROVENANCE_GATE_BLOCKED`: stabilize/recover the context, run `verify`, then
+`verify --deep`, and request a fresh `wk-verify` pass. `--force` may waive only an open task; for
+provenance, integrity, package, and verdict it does **not** change the result or promote a spec/ADR.
+Ledger errors are `WENDKEEP_RECEIPT_LEDGER_BUSY`, `WENDKEEP_RECEIPT_LEDGER_CONFLICT`,
+`WENDKEEP_RECEIPT_LEDGER_CORRUPT`, and `WENDKEEP_RECEIPT_LEDGER_TRUNCATED`. On a block, use the
+sanitized `--json` output (`state`, `reasonCodes`, `diagnostics`, `repair.command`), execute the
+indicated recovery, and run `npx --no-install wendkeep verify --deep --json`; preserve and recapture
+proof without editing the ledger/checkpoint or exposing stderr, tokens, private URLs, or Vault paths.
+
+### Post-fix archive contract
+
+Before mutation, perform the final recapture with `wendkeep verify --deep --change <slug>`. The
+package and verdict must be complete and canonical, bound to the same checkout, change, tasks,
+spec, and sensors. Archive first writes an authorization receipt to the separate
+`change-archive-receipts-v2` ledger; only after it validates may it promote the spec/ADR or move
+the change. `change archive --json` returns the serializable `state`, `reason_codes`,
+`diagnostics`, and `repair` fields. Corruption or truncation in the proof or archive ledger fails
+closed before any write. `--force` does not bypass provenance or integrity, package/verdict,
+corruption, or truncation. The exact recovery is to repeat
+`wendkeep verify --deep --change <slug>` in the correct checkout.
+
+The mutation acquires the runtime lock `.brain/runtime/change-archive-operation.lock` and opens a
+private ASCII transaction at `.brain/runtime/archive-transactions/<uuid>/{original,authorized}`.
+It atomically renames the live change to `original`, checks the digest, and promotes only the
+`authorized` copy; the public namespace is never a publication source. On a seal or divergence
+failure with `WENDKEEP_ARCHIVE_INPUT_CHANGED` before promotion, the `authorized` snapshot is
+removed and `original` is restored without partial promotion. A successful archive keeps the
+`completed` journal; the post-release finalizer validates the digests of `original` and the
+published destination but retains `original` and the transaction, with no automatic destructive
+cleanup.
+
+The archive lock is a `directory lock`: the canonical directory contains a token-specific marker
+and lease. Acquisition prepares a sibling `.pending` directory, writes owner/lease, and publishes
+it by atomic rename; it uses no hardlink and re-observes collisions for at most 3 topology attempts.
+A live owner returns `WENDKEEP_ARCHIVE_BUSY`; a dead owner may be safely reaped without deleting a
+successor. Invalid structure or marker returns `WENDKEEP_ARCHIVE_LOCK_UNAVAILABLE`; ownership loss
+returns `WENDKEEP_ARCHIVE_LOCK_OWNERSHIP_LOST`.
+
+Each operation keeps an `archive-transaction.json` manifest with phases `prepared` → `isolated` →
+`copied` → `sealed` → `published` → `promotion-prepared` → `promotion-applied` → `completed` or
+`recovery-required`. A pending journal blocks a new archive for the same slug before the gate. On a
+collision or post-publication failure, `original` is retained and the state is
+`published-recovery-required`. Use the fail-closed, idempotent inspection
+`wendkeep change archive recover <operation-id> --change <slug> [--spec-action rollback|resume] [--json]`;
+without `--spec-action` it only returns sanitized actions. `rollback` converges before-images and
+`resume` converges after-images for a `promotion-prepared` promotion; both retain the journal for
+further reconciliation.
+
+Multi-spec promotion is one atomic unit: it captures before-images/digests for every capability,
+rolls back every target (including state/README) on a before- or after-write failure, and permits a
+retry only after journal reconciliation and fresh verification. The post-release finalizer validates
+the original/destination digests but retains the `completed` journal and `original`; no destructive
+cleanup is automatic. Sanitized `operation_id` and
+`transaction_phase` fields accompany the diagnostic; `repair.command` points to
+`wendkeep change archive recover <operation-id> --change <slug>` when an operation is identified.
+Text and --json use the same sanitized diagnostic with code, operation, state, blocker, expected,
+observed, recovery, reason_codes, diagnostics, and repair.
 
 ## Tool-scope fence
 
@@ -105,6 +175,8 @@ selection/lease; never carry authorization from another conversation.
 - Sensor not executed: keep one or more `[sensor:id]` tags on the same checkbox line. Every
   distinct ID on that line is required and runs once, in declaration order.
 - Stale evidence: rerun `verify` and `verify --deep` after task/spec edits.
+- Evidence from another worktree/session: return to the correct causal context; it cannot satisfy
+  the current archive even when every sensor is green.
 - Rebase conflict: resolve the delta or use `--accept-current` only when that is the decision.
 
 ## Next steps

package/docs/en/commands/operating-profiles.md

@@ -59,7 +59,7 @@ npx wendkeep flow finish <id> [--session <id>]
 npx wendkeep flow promote <id> [--change-slug <slug>] [--session <id>]
 npx wendkeep delivery start [id] --allow <capability> [--source-change <slug>] [--source-commit <sha>] [--session <id>]
 npx wendkeep delivery status [id] [--session <id>]
-npx wendkeep delivery finish [id] [--target <ref>] [--ci-url <url>] [--version <x.y.z>] [--npm-integrity <sha512>] [--release-url <url>] [--session <id>]
+npx wendkeep delivery finish [id] [--target <remote>/<branch>] [--ci-url <url>] [--version <x.y.z>] [--npm-integrity <sha512>] [--release-url <url>] [--session <id>]
 npx wendkeep delivery abandon [id] --reason <text> [--session <id>]
 ```
 
@@ -180,13 +180,36 @@ ownership to the native LLM harness.
   `contract_impact`, and `operation_risk` are independent dimensions. `delivery start` captures
   repo, branch/worktree, SHA, source change, and capabilities in `.brain/runtime/deliveries/`;
   it creates no `08-Changes` folder, delta, spec, or ADR.
-- `delivery finish` requires a clean worktree, proves that the target contains the source commit,
-  and for `publish` requires CI, version, npm integrity, and GitHub Release evidence. Receipts are
-  append-only in `.brain/runtime/delivery-receipts.jsonl`. If code/config must change, delivery
-  stops with `WENDKEEP_DELIVERY_IMPLEMENTATION_REQUIRED` and work returns to implementation.
+- For `git:merge` and `git:push` capabilities, `delivery finish` requires `--target
+  <remote>/<branch>` (for example, `--target origin/main`). `delivery start` binds the `origin`
+  remote to the expected `repository`; `finish` resolves the target with `git ls-remote` and blocks
+  the delivery before provenance adapters if the target cannot be resolved or the binding diverges.
+- `delivery finish` requires a clean worktree and re-derives source/target. Merge/push proves
+  ancestry; tag proves package/version and the target tag; `publish` queries CI, NPM, and GitHub
+  Release bound to the same commit, version, integrity, and notes. Offline, a claim remains
+  `reported` and never becomes `verified`; completion blocks without writing a receipt. New
+  receipts form `.brain/runtime/delivery-receipts-v2.jsonl`, with a hash chain and checkpoint; v1
+  is only `legacy-unbound`. `WENDKEEP_PROVENANCE_GATE_BLOCKED` provides recovery. If code/config
+  must change, `WENDKEEP_DELIVERY_IMPLEMENTATION_REQUIRED` returns work to implementation.
+  The gate uses the same taxonomy: `verified`, `reported`, `legacy-unbound`, `stale`, `conflict`, and
+  `unproven`. Ledger errors are `WENDKEEP_RECEIPT_LEDGER_BUSY`,
+  `WENDKEEP_RECEIPT_LEDGER_CONFLICT`, `WENDKEEP_RECEIPT_LEDGER_CORRUPT`, and
+  `WENDKEEP_RECEIPT_LEDGER_TRUNCATED`; inspect sanitized `state`, `reasonCodes`, `diagnostics`, and
+  `repair.command` in `--json`, execute the indicated recovery, and recapture proof without editing
+  the ledger/checkpoint or exposing stderr, tokens, private URLs, or Vault paths.
 - In a multi-context Vault, `active_contexts[].delivery_id` is authoritative. `--session <id>`
   selects the work session explicitly; without it, only one unambiguous active context for the
   worktree may be used. Implicit status, finish, and abandon resolve that binding, not a global pointer.
+- `delivery` failures expose the same PROV-8 diagnostic in text and in `delivery --json`: a stable
+  `code`, `operation`, `state`, first `blocker`, sanitized `expected`/`observed`, and an objective
+  `recovery`. Git stderr, tokens, private URLs, and private paths are not propagated.
+- `delivery.completed` and `delivery.abandoned` receipts bind `repository_id`, the public
+  `repository` in `owner/repo` form, `worktree_id`, `work_session_id`, `change_slug`, and `branch`.
+  The private worktree path never enters the receipt. During contextual finalization, the receipt
+  enters the ledger and durable state is written before clearing `active_contexts[].delivery_id`.
+  A retry converges to the same receipt whether the binding is already clear or still bound. For
+  `delivery abandon`, the free-form reason becomes `reason_digest`; raw text does not enter the
+  ledger or state.
 - `CURRENT_DELIVERY` is only a derived projection: it contains the ID for one single, unambiguous
   active context with delivery and stays empty with zero or multiple contexts.
   `WENDKEEP_DELIVERY_CONTEXT_MISMATCH` means the explicit ID belongs to another context; neither
@@ -275,6 +298,27 @@ remain available and run their own contracts. A completed FLOW leaves a durable,
 receipt; a promoted FLOW enters the normal change lifecycle. Completed delivery leaves a receipt
 without an ADR; compact GUIDE archives its result without artificial spec/design/ADR.
 
+For archive in GOVERN/ASSURE, the `directory lock` uses a token-specific marker and lease:
+acquisition prepares a sibling `.pending` directory and publishes it by atomic rename, uses no
+hardlink, and allows at most 3 topology attempts. A live owner returns `WENDKEEP_ARCHIVE_BUSY`, a
+dead owner may be safely reaped, an invalid marker returns `WENDKEEP_ARCHIVE_LOCK_UNAVAILABLE`, and
+ownership loss returns `WENDKEEP_ARCHIVE_LOCK_OWNERSHIP_LOST`. The `archive-transaction.json`
+journal moves through `prepared` → `isolated` → `copied` → `sealed` → `published` →
+`promotion-prepared` → `promotion-applied` → `completed` or `recovery-required`; a pending journal
+blocks a new archive for the same slug before the gate.
+`original` is retained on collision/post-publication failure and `published-recovery-required`
+requires inspection. `operation_id` and `transaction_phase` appear only sanitized. Use
+`wendkeep change archive recover <operation-id> --change <slug> [--spec-action rollback|resume] [--json]`:
+without `--spec-action`, read-only, fail-closed, idempotent inspection with no promotion, deletion,
+or invented reconciliation; `rollback` restores before-images and `resume` converges after-images
+for `promotion-prepared`, retaining the journal. When an operation ID exists, `repair.command` points
+to that recovery; do not treat `command:null` as the normal flow.
+
+Multi-spec promotion is atomic, with before-images/digests, rollback of targets before/after writes,
+and retry only after reconciliation and fresh verification. The post-release finalizer validates
+original/destination digests, but the `completed` journal keeps the `original` retained; no
+destructive cleanup is automatic.
+
 ## Common errors and diagnosis
 
 - Unknown profile: use exactly `OFF`, `FLOW`, `GUIDE`, `GOVERN`, or `ASSURE`.

package/docs/en/commands/verify.md

@@ -42,7 +42,8 @@ npx wendkeep change use <slug>
 - **Exit 0:** all required sensors passed and evidence was written.
 - **Exit 1:** the gate ran, but at least one critical sensor was red or a mutant survived.
 - **Exit 2:** invalid usage/context, including `no change (--change or active)`, missing vault,
-  unknown change, or invalid `wendkeep.sensors.json`.
+  unknown change, a project outside a Git repository, invalid `wendkeep.sensors.json`, or
+  `WENDKEEP_EVIDENCE_HEAD_CHANGED`.
 
 `verify --deep` writes `verificacao.json`; it does not replace the reviewer. The `wk-verify` skill
 must be run by a different author and writes `verdict.json`.
@@ -72,10 +73,60 @@ npx wendkeep memory status --gate --vault .MyApp-vault
 
 ## Expected result
 
-`evidencia.json` contains sensor results and a seal binds proof to the current `tarefas.md` hash.
-When a sensor is red, its entry receives only a local, sanitized diagnostic bounded to 2,000
-characters; stdout/stderr from green sensors is not persisted. Deep mode packages requirements,
-tasks, and evidence for read-only review; the verdict covers every `[req:]` before archive.
+`evidencia.json` follows the [public v2 schema](../../../schema/wendkeep.evidence-envelope-v2.schema.json).
+The envelope binds `project_id`, `repository_id`, `worktree_id`, `work_session_id`, change, and
+branch to `base_sha`, `head_sha`, `index_tree_sha`, `worktree_digest`, tasks, effective spec, and
+sensor configuration with complete SHA-256 digests. The worktree digest covers staged, unstaged,
+untracked, rename, and delete state; paths use `/`, text normalizes CRLF/CR to LF, and binaries keep
+their bytes. Binary classification honors Git `binary`/`-text` attributes and known binary
+extensions (including `.bin`); ignored files are excluded.
+
+Each sensor records its sanitized command and hash, start/end, duration, exit code, output digest,
+and a sanitized tail bounded to 2,000 characters. Authority artifacts publish through a path-safe
+temporary in the same directory and an atomic rename. In deep mode, `verificacao.json` and
+`verdict.json` carry the same `evidenceEnvelopeId` and complete `evidenceBinding`; the independent
+reviewer must preserve both.
+
+V1 evidence remains readable as `legacy-unbound`, never as equivalent authority. Run
+`wendkeep change status <slug>` to inspect `bound`, `stale`, or `context-mismatch`.
+
+The provenance gate normalizes that legacy view into one taxonomy: `verified` when every required
+proof is fresh and bound; `reported` for a recorded claim without an authoritative observation;
+`legacy-unbound` for v1; `stale` for an earlier snapshot; `conflict` for incompatible identity or
+content; and `unproven` for missing or insufficient proof. Precedence is `conflict` > `stale` >
+`legacy-unbound` > `unproven` > `reported` > `verified`, and only `verified` closes the gate.
+
+For post-fix archive, the final pass is `wendkeep verify --deep --change <slug>`. It must leave a
+complete and canonical package and verdict bound to the same checkout, change, tasks, spec, and
+sensors. Archive writes the authorization receipt before mutation to the separate
+`change-archive-receipts-v2` ledger. Its `change archive --json` output is serializable and
+exposes `state`, `reason_codes`, `diagnostics`, and `repair`; ledger corruption or truncation
+fails closed. `--force` does not bypass provenance or integrity. The exact recovery is to repeat
+`wendkeep verify --deep --change <slug>` after stabilizing the context.
+
+Archive uses a `directory lock` with a token-specific marker and lease. Acquisition prepares a
+sibling `.pending` directory and publishes it by atomic rename, uses no hardlink, and allows at most
+3 topology attempts. A live owner produces `WENDKEEP_ARCHIVE_BUSY`; a dead owner is reaped only
+after safe observation; invalid marker/structure produces `WENDKEEP_ARCHIVE_LOCK_UNAVAILABLE`;
+ownership loss produces `WENDKEEP_ARCHIVE_LOCK_OWNERSHIP_LOST`. The `archive-transaction.json`
+manifest records `prepared` → `isolated` → `copied` → `sealed` → `published` → `promotion-prepared` →
+`promotion-applied` → `completed` or `recovery-required`. A pending journal blocks a new archive for
+the same slug before the gate. On a
+collision or post-publication failure, `original` is retained and the
+`published-recovery-required` state blocks destructive retry. `operation_id` and `transaction_phase`
+are sanitized fields. Inspect it with
+`wendkeep change archive recover <operation-id> --change <slug> [--spec-action rollback|resume] [--json]`:
+without `--spec-action`, this is a read-only, fail-closed, idempotent operation with no promotion,
+deletion, or invented reconciliation. `rollback` restores before-images and `resume` converges
+after-images for a `promotion-prepared` promotion while retaining the journal for reconciliation.
+When an operation ID exists, `repair.command` points to `wendkeep change archive recover <operation-id>
+--change <slug>`; do not treat `command:null` as the normal flow.
+
+Multi-spec promotion is one atomic unit: it captures before-images/digests for every capability,
+rolls back every target (including state/README) on a before- or after-write failure, and permits a
+retry only after journal reconciliation and fresh verification. The post-release finalizer validates
+original/destination digests, but the `completed` journal keeps the `original` retained; no
+destructive cleanup is automatic. A failure retains `published-recovery-required`.
 
 ## Common errors and diagnosis
 
@@ -85,6 +136,17 @@ tasks, and evidence for read-only review; the verdict covers every `[req:]` befo
 - Red gate: inspect the bounded `note` field on the `evidencia.json` entry, fix the cause, and
   rerun; never choose `archive --force` on your own.
 - Missing/stale verdict: regenerate `--deep` and request a fresh independent pass.
+- `WENDKEEP_EVIDENCE_HEAD_CHANGED`: HEAD moved while sensors ran; stabilize the checkout and rerun.
+  The previous evidence was not replaced.
+- `legacy-unbound`, `stale`, or `context-mismatch`: return to the correct worktree/session, recover
+  the context when needed, and rerun `verify` plus `verify --deep`.
+- `WENDKEEP_PROVENANCE_GATE_BLOCKED`: inspect `state`, `reasonCodes`, and `repair`; do not reuse
+  proof from another branch/worktree/session. Run the proposed command and recapture the envelope.
+- `WENDKEEP_RECEIPT_LEDGER_BUSY`, `WENDKEEP_RECEIPT_LEDGER_CONFLICT`,
+  `WENDKEEP_RECEIPT_LEDGER_CORRUPT`, and `WENDKEEP_RECEIPT_LEDGER_TRUNCATED` require preserving
+  the ledger/checkpoint and executing the objective recovery in `repair.command` (or
+  `npx --no-install wendkeep verify --deep --json` for fresh proof); text/JSON output remains
+  sanitized and contains no raw stderr, tokens, private URLs, or Vault paths.
 - Surviving mutants: strengthen the discriminating test; after three rounds, review manually.
 
 ## Next steps

package/docs/en/commands/worktrees.md

@@ -58,6 +58,31 @@ idempotent; when the directory vanished between steps, the interrupted reservati
 the proven head; divergence or an unavailable network blocks the operation. An already-absent branch
 is idempotent success. `--open-main` opens the main worktree only after completion.
 
+### Post-fix cleanup: crash-safe resume
+
+Cleanup is **crash-safe** and resumable before the receipt, after the receipt and before
+finalize, and after finalize: a crash at any boundary preserves operation/state and lets the same
+proof be retried without duplicating removal or a receipt. Every operation subject includes all
+active contexts, actor, pr, head, and merge. The canonical PR authority is the PR resolved by the
+GitHub adapter; caller-provided text cannot replace that authority.
+
+HEAD is re-derived before finalize from the checkout and compared with the proven head/merge. The
+reason is sanitized and receives a digest for audit, without storing private paths, tokens, or
+stderr. An absent or invalid checkpoint is WENDKEEP_RECEIPT_LEDGER_TRUNCATED. V1 remains
+legacy-unbound and never authorizes cleanup.
+
+Text and --json always expose operation, state, blocker, recovery, and the stable codes
+WENDKEEP_WORKTREE_CLEANUP_BUSY, WENDKEEP_RECEIPT_LEDGER_CORRUPT, and
+WENDKEEP_RECEIPT_LEDGER_TRUNCATED; recovery resumes the reservation or names the objective repair.
+
+The common cleanup gate classifies the operation and blocks before mutation, including finish,
+remove, and cleanup --apply. After append, the receipt is classified by the same gate before
+finalize; a provenance failure neither finalizes nor reports success. A cleaned state without a v2
+receipt is blocked as unproven; a v1 receipt never authorizes and remains legacy-unbound.
+
+Text and --json blockers keep the same sanitized diagnostic: code, operation, state, blocker,
+expected, observed, recovery, reason_codes, diagnostics, and repair.
+
 ## Cleanup, remove, and prune
 
 `cleanup --merged` and `prune` are dry-run by default. `--dry-run` makes that intent explicit; only
@@ -70,10 +95,20 @@ keeps every preflight and preserves both local and remote branches.
 
 The registry lives in the Git common-dir at `wendkeep/worktrees-v1.json`, protected by a
 multi-process lock. It stores repository/worktree identity, canonical binding, PR, and transient
-cleanup state; `.wendkeep.json` stays unchanged. Receipts live at
-`wendkeep/worktree-cleanup-receipts-v1.jsonl`. `.worktrees/` is added to both the versioned ignore
-and the repository-private exclude. JSON `list`/`status` output exposes neither Vault paths nor
-contents.
+cleanup state; `.wendkeep.json` stays unchanged. New receipts live at
+`wendkeep/worktree-cleanup-receipts-v2.jsonl`: every line carries `previous_hash` and
+`receipt_hash`, while a separate checkpoint fixes the last validated sequence/hash/byte length.
+V1 remains readable as `legacy-unbound`, with no silent append or rewrite.
+`WENDKEEP_RECEIPT_LEDGER_CORRUPT` reports tampering/partial JSON and
+`WENDKEEP_RECEIPT_LEDGER_TRUNCATED` reports a removed tail. Both block before removal and require
+diagnosing the store, never inventing a receipt. `.worktrees/` is added to the versioned ignore and
+repository-private exclude; JSON `list`/`status` exposes neither Vault paths nor contents.
+Cleanup uses the `verified`, `reported`, `legacy-unbound`, `stale`, `conflict`, and `unproven` states;
+`WENDKEEP_PROVENANCE_GATE_BLOCKED` and `WENDKEEP_RECEIPT_LEDGER_BUSY`,
+`WENDKEEP_RECEIPT_LEDGER_CONFLICT`, `WENDKEEP_RECEIPT_LEDGER_CORRUPT`, and
+`WENDKEEP_RECEIPT_LEDGER_TRUNCATED` fail closed. Objective recovery reads sanitized
+`worktree status <slug> --json`, executes `repair.command` when present, and recaptures proof; never
+edit the ledger/checkpoint or expose stderr, tokens, private URLs, or Vault paths.
 
 `create` is idempotent when slug, path, and branch already match. Collisions fail closed. Failures
 after reservation remain `failed`; run `worktree status <slug>` and follow `recovery`. `doctor`