eawf 0.7.0.dev1__tar.gz → 0.7.0.dev2__tar.gz

eawf-0.7.0.dev2/.ea/artifacts/audits/2026-09-16-A-P32-closeout.md

@@ -0,0 +1,78 @@
+# P32 closeout audit
+
+## Summary
+
+Phase P32 delivered the 0.7.0.dev2 offline-migration checkpoint in one iter of fifty-three waves. The epoch-2 cutover exists end to end: a read-only plan that seals a strict manifest, a journaled twelve-stage apply with an atomic generation select, recovery and rollback, and a rehearsal over ten corpora that crashes the apply at each of its eleven durable writes. The version reads 0.7.0.dev2 and the changelog section names the migration limits. The out-of-band 0.7.0.dev1 publication is recorded through a typed adoption and stands at `partially_released` with no approval attached.
+
+A fresh-context audit returned **major** against the branch as it stood. Both major findings were repaired inside the phase before close, so the recorded verdict is **minor**: what remains is filed as backlog with its evidence. The CI-mirror gauntlet on the final head reads: pre-commit, deptry and mypy are clean; the parallel coverage leg passes 18,594 tests, failing only a help-text check against a codex CLI installed on the auditing machine, which skips in CI, and a coverage-gate self-test that read a stale local report and passes once the report is regenerated; the 421 TUI snapshot tests and the perf and metrics suites pass; overall coverage holds at 89% and every per-package gate passes, the state package at 99.74% line and 98.70% branch.
+
+## What the audit found
+
+**The receipt floor and the deterministic tier never ran for most waves in this repository.** W43 set out to stop mechanical waves closing without running their gates, and its tests passed. They all modelled a profile with no UI bands. This repository enables the band-scoped `quality` profile, whose resolver narrows a mechanical wave outside the bands to `enforce=False`; the close gate returned on that narrowed flag before W43's tier choice and its receipt floor. W08, W13, W20, W26, W41, W42, W43, W45 and W46 closed with required gates and zero receipts, three of them after W43 landed. W48 repairs it: the gate now returns early only when the merged profile enforces nothing, and the close tests run under both profile shapes. Restoring the old return reds exactly the six band-scoped cases.
+
+**Seven recorded gates could never have passed as written.** Of 117 unique command gates replayed on the phase head, 110 passed. W20's two gates named a test directory a later wave retired, W26's three named files that never existed, and W41 and W42 each selected a test name nothing carries, so pytest exited 5. Because their waves closed without receipts, none of them had run at close. All seven were repointed with the closed-wave argv repair and now pass.
+
+## What the ship pass repaired
+
+The phase PR's CI could not go green, and neither failure was the runner's. The ubuntu coverage leg died twice at 31%: the `sysmon` coverage core keeps every code object it sees, and each in-process CLI invocation rebuilt the command tree and evaluated about six thousand annotations. A full four-worker coverage run retained 14.0 GB on this branch against 12.3 GB on `main`, past the 16 GB runner. W47 builds each tree once per worker, which retains about 0.17 GB. The two twice-green reds were test races, one per run, each reproduced under load and fixed test-side: a refused close left its event loop before the workspace cleanup started, and the feed test raced the application's own daemon probe (41 of 500 loaded runs failed before, 0 of 500 after).
+
+With the leg surviving, the per-package coverage gate would have been next: the state package measured 93.78% branch coverage against a 95% gate, all of it this phase's epoch-2 validators with no error-path tests. W50 covers them, and the package now measures 98.70%.
+
+The PR review of the ship pass then reproduced a refusal W48 had widened: a sampled mechanical wave with an attested criterion that carries a gate, or with only advisory gates, fell through to an auditor verdict no mechanical close ever writes. W51 scores only the criteria the receipt floor obliges, which is what the profile promises such a wave.
+
+The macOS leg then drifted two TUI goldens in consecutive runs. The snapshot harness forced the footer heartbeat lit through a lookup that, after a mode switch, returns the home screen's heartbeat rather than the captured screen's, so every mode-screen golden rode the pulse phase. W52 lights the active screen's heartbeat.
+
+The next twice-green run tripped the CLI cold-import ceiling, 777 ms against 750 ms, for an import that takes about 300 ms on an idle host: the budget ran inside the parallel worker pool. W53 moves both wall-clock budget suites to the serial perf step, with a placement check.
+
+That run also caught two test readers racing their writers: W52's own mode-screen case, whose live heartbeat pulse re-lit the dot before its first capture, and the portalock heartbeat test, which parsed the lockfile while the ticker rewrote it in place. W54 stills the pulse in the one and reads across the rewrite window in the other.
+
+## What did not land
+
+W21 was scoped to cut, publish and observe dev2 to BAKED. Approving the live record refuses on an unmerged branch because the ancestry signal is red, and BAKED needs the tag pushed to live registries after the merge. The operator split the wave: W21 closes on the three criteria met on this branch, and the BAKED observation moves verbatim to P33-I01-W01, which leads P33 because dev3 opens only from a terminal dev2. Nothing was published and no tag was pushed.
+
+## Verification integrity
+
+Twenty-four closed waves carry a pinned commit that is not an ancestor of the phase head. Each has a landed commit with the same subject and trailer, and outside `.ea/` the pinned and landed diffs are identical; the drift comes from folding close bookkeeping into the wave commit by amend. A rebase merge restales every pin, so the repin belongs after the merge. The receiptless closes above cannot be re-receipted: no verb re-runs a closed wave's gates, which is backlog B134.
+
+## Deferred follow-ups
+
+| Row | Priority | Follow-up |
+|---|---|---|
+| B134 | P1 | Bind receipts to the waves that closed without running gates |
+| B135 | P1 | Clean up a close workspace before the terminal commit, and the way it was made |
+| B136 | P1 | Classify the epoch-2 generation tree before the native path lands |
+| B137 | P2 | Run a band-narrowed wave's gates on the daemonless close path |
+| B138 | P2 | Gate the release adoption path |
+| B139 | P2 | Wire or drop the eight idle functions this phase added |
+| B140 | P2 | Narrow the migration fixture secrets exclusion |
+| B141 | P2 | Move the last in-process gate paths into the sandboxed child |
+| B142 | P2 | Normalise the auditor's criterion echo |
+| B143 | P2 | Bump the state schema for `Release.adoption` |
+| B144 | P2 | Add a verb for the release DRAFT to CANDIDATE edge |
+| B145 | P2 | Stop the test harness leaving the binder's degraded flip pending |
+| B146 | P3 | Split `scale_band` into its two concepts |
+| B147 | P3 | Allow a bounded file-scope repoint on a closed wave |
+| B148 | P3 | Correct W09's criterion text and mark W11's invented fixture rows |
+
+## References
+
+| Ref | Location | What it establishes |
+|---|---|---|
+| R1 | `src/eawf/runtime/daemon/methods/state.py` | the close gate's early return, now keyed on the merged profile |
+| R2 | `src/eawf/workflow/verify/readiness.py` | the band resolver that narrows a non-band wave |
+| R3 | `tests/integration/workflow/verify/test_gate_execution_stability.py` | the close tests under both profile shapes |
+| R4 | `tests/conftest.py` | the per-worker command-tree cache |
+| R5 | `src/eawf/kernel/migration/epoch2/` | the offline cutover: manifest, apply, recovery, rollback |
+| R6 | `tests/integration/kernel/migration/test_v07_rehearsal.py` | the ten-corpus rehearsal |
+| R7 | `CHANGELOG.md` | the 0.7.0.dev2 section, its migration notes and limitations |
+| R8 | `tests/unit/kernel/state/test_epoch2_values.py` | the epoch-2 validator error paths the branch gate counts |
+
+## Provenance
+
+Compiled 2026-09-16 at the close of P32-I01 on branch `feature/eawf-v0.7`, from a fresh-context audit of the phase range, two load-reproducing investigations of the CI failures, and the session's own gate runs. Every claim the audit refuted was re-verified in the source before being acted on, and every repair was proven by reverting it and watching its test red.
+
+## Scrub
+
+- status: clean
+- references: repo-relative
+- credentials, PII, machine-specific paths: none

eawf-0.7.0.dev2/.ea/artifacts/evidence/2026-09-11-dev1-burn/2026-09-11-burn-basis.md

@@ -0,0 +1,52 @@
+# Burn basis — the three read-backs that make `REL-0.7.0.dev1` a spent version
+
+## Summary
+
+This is the evidence the burn of `REL-0.7.0.dev1` rests on: an independent read-back of each of the three targets the `0.7.0.dev1` checkpoint configuration declares, taken before any state mutation for W01.
+
+The burn is the transition `RECOVERING -> PARTIALLY_RELEASED`. Its guard is `recovery_exhausted` — nothing is left to retry. That guard is satisfied here not because a budget ran out but because every leg has already been *observed*, and an observed leg has no retry edge at all: the version is in the world in whatever state the read-back found it, and no further publication under this version number can change that. PyPI forbids filename reuse, so the one leg that diverges cannot be corrected in place even in principle.
+
+What this document does **not** record is an approval of the release. No operator ever approved `0.7.0.dev1` against a manifest digest; the artifacts were published by a tag push with no Release record open at all.
+
+The operator approval that carries the record through `APPROVED` on its way to the burn is an approval **of the burn path**: of walking the spent version to its terminal state so the train has a predecessor. The `approval_ref` and the burn `reason` both say so in those words. A reader who takes the `APPROVED` row as evidence that the release itself was approved would be reading it wrong, and this paragraph exists so that they cannot.
+
+### The three observed target states
+
+| Target | Observed state | What the read-back found |
+| --- | --- | --- |
+| `pypi` | `observed_mismatch` | The index carries a `0.7.0.dev1` wheel and source distribution uploaded 2026-09-07T23:00, built from a commit that is neither of the two commits the tag was later moved to. The filename is occupied under a digest that does not match the tag target, and filename reuse is refused, so no retry can reconcile it. |
+| `npm` | `observed_success` | `next` resolves to `0.7.0-dev.1`, published 2026-09-08T14:27 from the final tag target. This leg is correct. `latest` still resolves to `0.6.8`, so no consumer on the default channel was affected. |
+| `github` | `observed_mismatch` | The source-host release `v0.7.0.dev1` exists but carries zero assets and is flagged `prerelease: false`, and its target is `main` rather than the commit the artifacts were built from. The leg's three declared artifact kinds — release notes, checksums and the plugin bundle — are absent. |
+
+Two legs contradicted, one matched. A contradicted read-back routes the record to `RECOVERING`; with every leg observed, no leg has a retry edge left, and the burn is the only move the status machine still offers.
+
+### Why the version is not republished
+
+A burned version is superseded by the next version and never republished. The correction for `0.7.0.dev1` is `0.7.0.dev2`, whose record carries `supersedes_release_ref` pointing back at the burned one. The burned record's `source_sha`, `source_tree_sha`, `manifest_ref` and `manifest_digest` are frozen by the burn's own signature, which accepts no field updates, so the historical claim about what was built stays exactly as recovery found it.
+
+### What the operator runs
+
+The burn is driven by `eawf release burn REL-0.7.0.dev1 --release <record.json> --reason "<why>" --idempotency-key <key>`, which dispatches to the `release.burn` daemon method. The reason is mandatory and is written to both durable rows the call appends — the abandoned publication operation and the burned record — so the terminal status is never left to be read as an outcome.
+
+## References
+
+| Ref | What it anchors |
+| --- | --- |
+| `.ea/artifacts/incidents/2026-09-11-dev1-published-outside-release-machinery.md` | The incident this burn closes out; the source of the four-target read-back tabulated above |
+| `src/eawf/workflow/release/publication.py` | `burn_release`, the terminal burn and its `recovery_exhausted` guard |
+| `src/eawf/workflow/release/lifecycle.py` | `RECOVERING -> PARTIALLY_RELEASED` is the only edge into the burn; `PARTIALLY_RELEASED` has no out-edges |
+| `src/eawf/workflow/release/target_machine.py` | The two `observed_*` statuses are terminal per leg, which is why an observed leg offers no retry edge |
+| `src/eawf/runtime/daemon/methods/release.py` | `release.burn`, the operator-facing verb that reaches the burn |
+| `tests/integration/workflow/release/test_dev1_burn.py` | The walk to the terminal state, this document's chassis, and the train's refusal to close a burned rung |
+| `INC-P32-01` | The incident's typed row |
+| `P32-I01-W01` | The wave that wires the burn and records this basis |
+
+## Provenance
+
+Compiled 2026-09-11 for wave P32-I01-W01. The three read-back rows restate the point-in-time inspection recorded in the incident report, which was taken by reading the public registries and the source-host release before any state mutation for this wave. No write was made to any publication target while compiling it, and the record transitions the document describes are driven separately by the operator.
+
+## Scrub
+
+- status: clean
+
+No absolute local paths, no machine hostnames, no credentials and no PII. Every reference is repo-relative or an eawf-internal id, and the only external names are the public package indexes the published artifacts already live on.

eawf-0.7.0.dev2/.ea/artifacts/evidence/2026-09-11-dev2-cut/2026-09-11-dev2-publication-handoff.md

@@ -0,0 +1,63 @@
+# Publication handoff — what the `0.7.0.dev2` cut proves, and what only the operator can finish
+
+## Summary
+
+The `0.7.0.dev2` checkpoint is cut but not published. This document separates the two, because the difference is the difference between a claim a test can settle and a claim only an outward-facing act can settle.
+
+**Settled here.** The version module and the changelog agree at `0.7.0.dev2`; the changelog section names the migration and its limitations; the tag chokepoint passes over a checkout shaped like the cut commit after the merge. The dev2 Release opens as a distinct DRAFT only over a terminal `REL-0.7.0.dev1`, carries channel `dev`, `authority_epoch` 1 and empty `membership_refs`, and reaches `APPROVED` against a green twelve-gate dev2 sweep. The dev2 readiness reports `waiver_count` zero-or-explained, and a non-zero count with no explanation reds the `waiver_count` gate and denies the approval.
+
+**Not settled here, and not fakeable.** `BAKED` requires three independent read-backs of three live registries. It cannot be reached from an unmerged branch: `ancestry` reds while the checkpoint commit is not an ancestor of `origin/main`, so the live record's approval is refused, and the tag push that starts the publication is an outward-facing act reserved to the operator. Nothing in this wave writes to `.ea/state.json`, opens a live Release record or contacts a registry.
+
+### What the operator runs after the merge
+
+Every step is run from the merged `main` checkout standing on the cut commit. The record document each step consumes is the JSON body the previous step emitted under `--json`.
+
+| # | Command | What it records |
+| --- | --- | --- |
+| 1 | `uv run eawf release create 0.7.0.dev2 --json` | Appends the DRAFT record to the release-record collection, after checking that `MCT-26091101` is promoted and that `REL-0.7.0.dev1` is recorded at a terminal status. The reply's `supersedes_release_ref` names the burned dev1 record. |
+| 2 | Pin the draft to `CANDIDATE` — no operator verb exists (see the gap below) | Sets `source_sha`, `source_tree_sha`, `manifest_ref` and `manifest_digest` on the record. Until this lands as a verb the candidate document is assembled by hand from the release manifest the build produced. |
+| 3 | `uv run eawf release preflight 0.7.0.dev2 --json` | Recomputes the twelve-signal sweep over the merged checkout. Exits non-zero while any of the seven required dev2 rows is red, printing the whole repair list first. |
+| 4 | `uv run eawf release approve REL-0.7.0.dev2 --release <candidate> --readiness <sweep> --approval-ref <receipt>` | Appends the record at `APPROVED`, binding the manifest digest the publication must reuse. Denies `release_not_ready` naming the first red gate otherwise. |
+| 5 | `uv run eawf release tag 0.7.0.dev2 --push` | Recomputes the chokepoint sweep, refuses on any red row, then creates and pushes `v0.7.0.dev2`. **The push is the publication decision**: the release workflow fires on the tag and runs the same sweep again before its publish job. |
+| 6 | `uv run eawf release publish REL-0.7.0.dev2 --release <approved> --approved-manifest-digest <digest> --proof-digest <digest> --idempotency-key <key>` | Opens the publication episode and queues the three legs. Returns the operation reference immediately; a slow registry cannot hold the call open. |
+| 7 | `uv run eawf release observe REL-0.7.0.dev2 --target pypi --release <record> --manifest <frozen> --idempotency-key <key>` | Reads PyPI back through the `package_index` adapter and settles the leg. Only an independent read-back may write an `observed_*` status. |
+| 8 | The same `observe` call with `--target npm` | Reads the npm registry back through the `npm_registry` adapter, resolving `0.7.0-dev.2` on the `next` dist-tag. `latest` must stay on the last stable. |
+| 9 | The same `observe` call with `--target github` | Reads the source-host release back through the `source_host_release` adapter, which must find the release notes, checksums and plugin bundle the leg declares. |
+| 10 | `uv run eawf release show 0.7.0.dev2 --json` | Confirms `status: baked` with `observed_success` on all three targets — the wave's fourth criterion. |
+| 11 | `uv run eawf release advance --release <baked record> --receipt <one per required gate>` | Walks the train onto the dev3 rung, re-validating that every required dev2 gate receipt still binds the exact `source_sha` and `manifest_digest`. `current_checkpoint_index` moves by one. |
+
+### The gap step 2 names
+
+There is no verb between `release create` and `release approve`. `approve` takes a serialized candidate, so the `DRAFT -> CANDIDATE` pin — the move that binds the source commit, its tree and the manifest digest — happens outside the CLI. Every other status move on the ladder has an operator surface; this one does not, and the approval that follows is only as trustworthy as the document somebody hand-assembled. It is worth closing before dev3.
+
+### Why the train index does not move here
+
+`ADVANCING_STATUSES` admits only `baked` and `released`, and `REL-0.7.0.dev1` stands at `partially_released` — terminal, but abandonment rather than a shipped rung. So the train's index still points at dev1 and will move only when the dev2 record itself bakes, at step 11. Opening dev2 does not depend on that index: admission is gated on measurement and on the predecessor being finished with, which is a different question from whether the train ever walked past it.
+
+## References
+
+| Ref | What it anchors |
+| --- | --- |
+| `src/eawf/_version.py` | The version literal this checkpoint cuts |
+| `CHANGELOG.md` | The `0.7.0.dev2` section, its migration outcome and its limitations |
+| `src/eawf/workflow/verify/checkpoint_succession.py` | The guard that a checkpoint opens only over a recorded, terminal predecessor |
+| `src/eawf/runtime/daemon/methods/release.py` | `release.create`, where that guard runs and where `supersedes_release_ref` is derived |
+| `src/eawf/runtime/release/chokepoint.py` | The sweep `release tag --push` and `release preflight` both gate on |
+| `src/eawf/workflow/verify/release_readiness.py` | The twelve-signal sweep and the `waiver_block` gate verdict |
+| `src/eawf/workflow/release/train.py` | The dev2 checkpoint configuration and its twelve-gate binding table |
+| `src/eawf/workflow/release/advance.py` | `ADVANCING_STATUSES` and the receipt re-validation step 11 runs |
+| `tests/integration/workflow/release/test_dev2_checkpoint.py` | The open-and-approve walk and the waiver-block cases |
+| `tests/integration/runtime/release/test_tag_chokepoint.py` | The chokepoint over the cut commit, and the red paths that earn it |
+| `.ea/artifacts/evidence/2026-09-11-dev1-burn/2026-09-11-burn-basis.md` | Why `REL-0.7.0.dev1` is terminal and never republished |
+| `MCT-26091101` | The measured contract dev2 admission asserts over |
+| `P32-I01-W21` | The wave that cut this checkpoint |
+
+## Provenance
+
+Compiled 2026-09-11 for wave P32-I01-W21, from the code paths tabulated above rather than from a prior document. The command sequence was read off the shipped verb signatures, not off a design note: each row names options the verb actually declares. No state mutation, tag push or registry write was made while compiling it, and every claim about what is settled is backed by a test in this wave's diff.
+
+## Scrub
+
+- status: clean
+
+No absolute local paths, no machine hostnames, no credentials and no PII. Every source reference is repo-relative, and the only external names are the public registries the checkpoint declares as publication targets.

eawf-0.7.0.dev2/.ea/artifacts/incidents/2026-09-11-dev1-published-outside-release-machinery.md

@@ -0,0 +1,83 @@
+# Incident — the 0.7.0.dev1 version published to four targets with no Release record
+
+## Summary
+
+The `v0.7.0.dev1` tag was pushed and the publication pipeline ran against four targets, while the release machinery that is supposed to govern a checkpoint held no record of it at all. `eawf release show 0.7.0.dev1` reports `record: none (never opened)`, and the train still stands at `index=0` with the dev1 rung `status=open`. The version is therefore spent in the world and absent from the model.
+
+Compounding it, the tag was force-moved at least twice *after* artifacts had already been published under it, so the four targets do not agree on which commit `0.7.0.dev1` denotes.
+
+Verdict: **functional impact moderate, process impact high.** Nothing downstream is broken today — the npm leg is correct and the published wheel installs — but the version number is unusable for a clean checkpoint, and no gate noticed that a release had happened without a release record.
+
+### What is live, and from which source
+
+| Target | Holds | Built from | Matches the tag target |
+| --- | --- | --- | --- |
+| PyPI `eawf` | `0.7.0.dev1` wheel + source distribution, uploaded 2026-09-07T23:00 | a commit predating both later tag targets | No |
+| npm `@elementarno/eawf` | `next` -> `0.7.0-dev.1`, published 2026-09-08T14:27 | the final tag target | Yes |
+| plugins-dist branch | `versions/0.7.0.dev1` | the 2026-09-07 render | No |
+| Source-host release `v0.7.0.dev1` | release exists, `prerelease: false`, zero assets | target `main` | No |
+
+`latest` on npm correctly still points at `0.6.8`, so no consumer on the default channel was affected.
+
+### Timeline
+
+- **2026-09-07T16:02** — the source-host release for `v0.7.0.dev1` is created.
+- **2026-09-07T23:00** — a wheel and a source distribution for `0.7.0.dev1` are uploaded to PyPI. This is the build that still occupies the filename today.
+- **2026-09-08T12:53** — the tag is pushed again at a second commit. The Release workflow fails at the tag-chokepoint preflight, so its PyPI leg is skipped. The plugin workflow's plugins-dist leg refuses (the version directory already exists) and its npm leg fails.
+- **2026-09-08T14:27** — the tag is pushed a third time at a third commit. Preflight passes, but the PyPI upload returns `400 File already exists` because the 09-07 upload occupies the filename under a different digest. plugins-dist refuses again. The npm leg succeeds.
+- **2026-09-11** — inspection for W01 finds no dev1 Release record and the train still on its first rung.
+
+Both 2026-09-08 pipeline failures are idempotency refusals working exactly as designed. They are a symptom, not the defect.
+
+### Root cause
+
+1. **The publication path does not require a Release record.** A pushed tag is sufficient to start the pipeline, so the record-keeping side of the checkpoint is advisory in practice. W24 closed having proved the record machinery against a git fixture standing on merged main; it never cut a live record, and nothing detected the gap.
+2. **A tag was moved over already-published artifacts.** Once a filename exists on an immutable index, re-tagging cannot re-publish it. Moving the tag therefore guaranteed divergence between targets rather than correcting anything.
+3. **`burn_release` has no caller.** The model implements the terminal burn at `src/eawf/workflow/release/publication.py:406` and exports it, but no CLI verb and no daemon method reach it, so the one transition that honestly describes this situation was unreachable when it was needed. This is the same built-without-a-producer shape the project has hit before.
+
+### Disposition
+
+The version is spent. Per the correction rule recorded on W01, a burned version is superseded by the next version and never republished. W01 therefore wires the burn to an operator surface, walks `REL-0.7.0.dev1` to the terminal `PARTIALLY_RELEASED` state so the train has a predecessor, and advances the train. W21 opens `REL-0.7.0.dev2` from that terminal record with `supersedes_release_ref` pointing back at dev1; its criteria need no change because they already require only a *terminal* dev1 record.
+
+The `APPROVED` transition in that walk carries an operator approval of **the burn path**, not a retroactive approval of a release that was never approved. The reason field on the transition and this artifact both say so, so the record never claims an approval that did not happen.
+
+### Follow-ups this incident does not close
+
+- The publication pipeline should refuse a tag whose version has no open Release record; nothing enforces that today.
+- The tag chokepoint should refuse a tag push whose version already has published artifacts under a different digest.
+- `W01.file_scopes` still reads `.ea/artifacts` alone, which predates the discovery that the burn needs wiring; the wave's real surface includes the release workflow, its CLI command and its daemon method.
+
+## Attempting the disposition proved the gap is total
+
+The operator approved walking dev1 to the terminal burn. The attempt reached only `DRAFT`, and the walk is blocked in both directions.
+
+`eawf release create 0.7.0.dev1` opened the record at `REL-0.7.0.dev1@0`. `eawf release preflight 0.7.0.dev1` then returned `ready=False` with `ancestry` red and `tree_cleanliness` red: this is a feature branch that has not merged, so `approve` refuses. That refusal is correct, and `PARTIALLY_RELEASED` sits behind it.
+
+`CANCELLED` is the only other terminal state reachable from `DRAFT`, and it fails on two counts. Every edge into it carries the guard `NO_EXTERNAL_EFFECT`, documented as "No tag, upload or other external effect has" occurred -- which is false for dev1 on four targets. The guard would nonetheless pass, because it reads the record and the record knows nothing of the publication; the guard being satisfied is itself the defect. And there is no operator surface to cancel at all: `ReleaseStatus.CANCELLED` appears nowhere under `src/eawf/runtime` or `src/eawf/surfaces`, the same built-but-unreachable shape `burn_release` had.
+
+So the live record has **no reachable, truthful terminal state** and stays at `DRAFT`. No gate was waived and no approval was fabricated to move it.
+
+This is the strongest form of the third root cause. The release model assumes every publication passes through it, so it can neither describe nor dispose of one that did not. What it needs is an adoption path: a way to record that a version was published out of band, carrying the observed per-target facts, and to land it in a terminal state without asserting an approval or a readiness sweep that never happened.
+
+## References
+
+| Ref | What it anchors |
+| --- | --- |
+| `src/eawf/workflow/release/publication.py:406` | `burn_release`, the terminal burn; no caller in the tree |
+| `src/eawf/workflow/release/lifecycle.py` | `RECOVERING -> PARTIALLY_RELEASED` is the only edge into the burn; `PARTIALLY_RELEASED` has no out-edges |
+| `src/eawf/kernel/spec/release.py` | `PARTIALLY_RELEASED` documented as "Recovery exhausted; the version is burned"; `supersedes_release_ref` carries correction lineage |
+| `src/eawf/workflow/release/train.py:95` | `V07_TRAIN`, the source-resident ladder |
+| `INC-P32-01` | This incident's typed row |
+| `P32-I01-W24` | The wave that proved the record machinery on a fixture without cutting a live record |
+| `P32-I01-W01` | The wave that records the burn and advances the train |
+| `P32-I01-W21` | Opens dev2 from the terminal dev1 record |
+
+## Provenance
+
+Compiled 2026-09-11 from read-only inspection of the four live publication targets, the source-host workflow run history for the `v0.7.0.dev1` tag, and the release model in the source tree. No write was made to any publication target. The registry and run-history readings are point-in-time and were taken before any state mutation for W01.
+
+## Scrub
+
+- status: clean
+
+No absolute local paths, no machine hostnames, no credentials and no PII. References are repo-relative or eawf-internal ids. The only external names are the public package indexes the published artifacts actually live on, and the package and release identifiers are themselves public.

eawf-0.7.0.dev2/.ea/artifacts/research/2026-09-11-dev2-gate-profile-binding.md

@@ -0,0 +1,110 @@
+# The dev2 gate profile: twelve names, twelve evidence sources
+
+> Status: binding record · Decision: `D45`, ACTIVE · Scope: the `0.7.0.dev2` checkpoint's preflight gates and the REL-037 admission legs · Evidence: the committed cutover rehearsal, the daemon-hosted close, the epoch-2 strictness census · Date: 2026-09-11
+
+## Summary
+
+A gate profile that names checks nobody computes is decoration. `dev1` proved the shape: eight gate names, each bound to exactly one evidence source, refused at load if any name is unbound [1]. `dev2` extends that to twelve — the `dev1` eight plus `migration`, `hosted_gate_runner`, `schema_strictness` and `waiver_count` — and this record is the table of what each of the twelve reads [2].
+
+Two things are new rather than incremental.
+
+The first is that the `dev2` configuration is **generated** from the train template and the rung, not overlaid onto the `dev1` file. The overlay is the obvious shortcut and it is silently wrong: the copy keeps `dev1`'s profile and `dev1`'s eight-name required list under the `dev2` version's name, so the new checkpoint runs the old profile's gates.
+
+The loader already refuses that specific overlay, because the declared profile contradicts the train's [3]. Rendering removes the class of mistake rather than the instance, since the required list is read off the profile and exists in exactly one place [4].
+
+The second is a fourth evidence kind. Eleven of the twelve gates read a readiness row, a named component of one, or a proof command run at the pinned revision. `waiver_count` reads none of those: waivers are counted per checkpoint rather than probed, so a thirteenth signal row would have needed a producer that cannot exist. It binds the waiver block the readiness receipt already carries beside the twelve rows [2].
+
+## The binding table
+
+| Gate | Kind | Reads | Green when |
+|---|---|---|---|
+| `version_consistency` | signal | `version_consistency` | Tag, request, package and configuration spell one version |
+| `changelog_entry` | signal | `changelog` | The version's changelog section carries at least one entry |
+| `dependency_inventory` | signal component | `dependencies.inventory` | The lock-derived inventory receipt agrees with the swept lock |
+| `artifact_reproducibility` | signal | `artifacts` | Two clean builds produced the same digests |
+| `security_review` | signal component | `dependencies.vulnerability` | A vulnerability report exists, is readable, and blocks nothing |
+| `epoch1_stabilization` | proof command | `epoch1_stabilization_suite` | The suite runs green at the pinned revision |
+| `telemetry_producer` | proof command | `telemetry_turn_cost_record` | The turn-cost producer emits a record over the live corpus |
+| `front_door_journey` | proof command | `front_door_install_smoke` | A fresh tool-install of the published distribution runs the CLI |
+| `migration` | signal | `migration` | Ten corpora rehearsed, every leg holds, the changelog states the outcome |
+| `hosted_gate_runner` | proof command | `hosted_close_runs_the_gates` | A close with no attached session runs the gates in the daemon |
+| `schema_strictness` | proof command | `epoch2_strictness_census` | Every model in the epoch-2 entity package forbids unknown keys |
+| `waiver_count` | waiver block | `readiness:waivers` | Nothing is counted, or every counted waiver is explained and acknowledged |
+
+Each name resolves to exactly one binding at load and to exactly one row on a computed sweep; the loader refuses a duplicate, a stray and an unbound name with three distinct typed codes [1][2][8].
+
+## What makes `migration` provable
+
+The row is green only when the whole declared corpus set was rehearsed and every leg of every rehearsal holds [5].
+
+| Claim | Where it is read |
+|---|---|
+| Ten corpora, each with a committed record | The declared roster, cross-checked against the set the rehearsal iterates |
+| Dry run reproducible | A second seal over the same bytes produced the same manifest digest |
+| Apply published a generation across every recorded stage | The recorded stages equal the stages the cutover's own enum declares |
+| Rerun inert | Nothing applied, no journal row appended, the tree byte-identical |
+| Rollback complete | Outcome `surfaces_restored`, epoch 1, no generation left, every surface matching the restore point |
+| Refusal reproducible and inert | The two refusing corpora refuse with one code on all three attempts and leave the target untouched |
+
+A corpus with no record, a leg that was never rehearsed, and an unreadable record each report the row **unavailable**; a leg that ran and disagrees reports it **failed**. Both carry `migration_unproven`, so neither reads as a pass, and they are distinguished because the repairs differ: run the rehearsal versus fix the cutover [5].
+
+Two claims the rehearsal itself corrected are not restated here. There is no `migration_reference_unresolved` code anywhere in the source: a dangling canonical reference raises `migration_fabrication_detected`, which is what the refusing corpus's record pins. And `close_attempts` is an explicit drop, so a close attempt does not import as an immutable legacy record — the closing `agent_sessions` row does [6].
+
+## What `security_review` does with a missing report
+
+The recorded risk for this wave is that `security_review` reads a vulnerability report and a stubbed or absent one passes the gate. It does not, and the three cases are separated [5]:
+
+| Report state | Row | Gate |
+|---|---|---|
+| Never written | `unavailable`, naming the producing job and the receipt path | Not passing |
+| Present but not a vulnerability report | `blocked`, naming the parse failure | Not passing |
+| Present with a blocking advisory | `fail`, naming the advisory, package and upgrade | Not passing |
+
+The only passing case is a report that was produced, parsed, and found nothing blocking.
+
+## REL-037: one leg per rung that builds its surface
+
+The measured-before-build rule assigns each probed surface to the rung that builds it, rather than demanding all three at the first covered rung [7].
+
+| Rung | Contract | Surface |
+|---|---|---|
+| `0.7.0.dev2` | `MCT-26091101` | The importer, re-measured over the production corpus at the thousands scale band |
+| `0.7.0.dev3` | `MCT-26081302` | Cross-provider conformance |
+| `0.7.0.dev3` | `MCT-26081303` | Daemon RPC under concurrent dispatch |
+
+The importer leg is a **revision**, not an edit: the 2026-08-13 contract measured a read-only census of the epoch-1 document and stays as it was recorded. The revision cites the committed corpus pin the rehearsal is judged against — 4,638 rows, multiplier 1.319 against a 1.60 ceiling, apply 3.849 s against a 30 s budget, residual document 396,720 B against a 1.6 MB bound — and its boundary names both what was measured and where it stops [7].
+
+The `dev3` refusal names **every** missing contract in one message, with its operator-facing label and the exact promotion command. Naming only the first would send an operator back to the same wall once per contract, which is the round-trip the per-contract naming exists to remove [7].
+
+## References
+
+[1] `src/eawf/kernel/release/gate_binding.py` — the four evidence kinds, the profile gate sets, and the loader that refuses an unbound, duplicated or stray gate.
+
+[2] `src/eawf/workflow/release/train.py` — the authored `dev2` binding table and the rendered `dev2` checkpoint configuration.
+
+[3] `src/eawf/kernel/spec/release_config.py` — the checkpoint loader, including the profile-agreement check that refuses a version-and-channel overlay onto the `dev1` file.
+
+[4] `src/eawf/kernel/release/checkpoint_template.py` — the train-wide template and the per-rung renderer.
+
+[5] `tests/integration/workflow/verify/test_migration_signal.py` — the migration signal over the ten corpora, and the three `security_review` cases.
+
+[6] `tests/integration/kernel/migration/test_v07_rehearsal.py` — the four-leg rehearsal that produces the committed records.
+
+[7] `src/eawf/workflow/release/admission.py` — the REL-037 admission table and the exhaustive refusal.
+
+[8] `tests/integration/workflow/verify/test_dev2_profile.py` — the deterministic gate over the twelve names, the rendering, and the refused overlay.
+
+## Provenance
+
+- kind: research
+- slug: 2026-09-11-dev2-gate-profile-binding
+- wave: P32-I01-W20
+- method: binding record written alongside the implementation; every table row is asserted by a test named in the references, and no number here was estimated
+- decision: `D45`, which assigns the `dev2` gate profile and the REL-037 legs; recorded there, documented here
+- gates: the two suites named in references 5 and 8, plus the REL-037 integration test
+
+## Scrub
+
+- status: clean
+- references: repo-relative only
+- credentials, PII, machine-specific paths, hostnames: none

eawf-0.7.0.dev2/.ea/config.yaml

@@ -0,0 +1,38 @@
+acceptance:
+  commands:
+    build: null
+    lint: null
+    tests: just test
+    typecheck: null
+  required_before_ship:
+  - state
+flow:
+  advance_after:
+    audit: true
+    polish: false
+    research: true
+mcp:
+  enabled: []
+planning:
+  max_parallel_waves: 10
+profiles:
+  enabled:
+  - core
+  - python
+  - research
+  - agent_driven
+  - quality
+research:
+  agent_count: 10
+  default_depth: deep
+runtime:
+  adapters:
+  - claude-code
+  preference:
+  - claude-code
+schema_version: '1.0'
+verify:
+  juror_wall_clock_seconds: 1800.0
+  odr_blocking: true
+  require_iter_audit_accepted: true
+  waiver_mode: B