fix(loop-memory): freeze merge-bound evidence

.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/CHUNK_MAP.md

@@ -3,11 +3,13 @@
 | Order | Chunk | Purpose | Risk | State |
 |---:|---|---|---:|---|
 | 0 | `WS-ENG-007-00R1` | Repair planning-intake file/tree parity and recover PR #187 exactly once | L1/P0 | Merged; recovery superseded after rerun-cardinality failure |
-| 0 | `WS-ENG-007-00R2` | Canonicalize repeated trusted check evidence and reconcile PRs #187 and #188 exactly once | L1/P0 | Proposed reliability recovery |
-| 1 | `WS-ENG-007-01` | Add deterministic reviewed-patch identity and conservative base-delta review preservation | L1 | Blocked on 00R2 merge, successful three-merge reconciliation, and explicit start |
+| 0 | `WS-ENG-007-00R2` | Canonicalize repeated trusted check evidence and reconcile PRs #187 and #188 exactly once | L1/P0 | Merged; superseded by mutable-history failure |
+| 0 | `WS-ENG-007-00R3` | Freeze accepted checks at merge time and give explicit starts deterministic recovery parity | L1/P0 | Active fail-closed recovery |
+| 1 | `WS-ENG-007-01` | Add deterministic reviewed-patch identity and conservative base-delta review preservation | L1 | Blocked on 00R3 merge, successful four-merge reconciliation, and explicit start |
 | 2 | `WS-ENG-007-02` | Add structured reviewer-track and upstream-finding reconciliation | L1 | Blocked on 01 merge and explicit start |
 | 3 | `WS-ENG-007-03` | Add merge-group CI parity and queue-readiness proof | L1 | Blocked on 02 merge and explicit start |
 
-Recovery chunks are exceptional ordered prerequisites; implementation chunks
+Recovery chunks are exceptional ordered prerequisites; `00R3` supersedes the
+incomplete mutable-evidence behavior left after `00R2`. Implementation chunks
 remain one PR each and stop after merge. Every successor requires a separate
 explicit signed start.

.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/DECISIONS.md

@@ -1,5 +1,16 @@
 # Decisions: WS-ENG-007 - Concurrent PR Review Reconciliation
 
+## D0R3 - Freeze protected evidence at merge time
+
+Protected check evidence is selected against immutable PR `merged_at`, not the
+latest present-day rerun. Signed records bind the exact selected-run provenance.
+Merge and explicit-start workflows use one bounded reconciliation sequence. The
+remaining backlog is crossed once by an exact four-entry bridge; no wildcard or
+durable bypass is introduced.
+
+This decision supersedes the present-day latest-run portions of D12 and D13
+below. Those decisions remain historical context for 00R2 only.
+
 ## D1 - CI always reruns on the combined tree
 
 Review preservation never preserves CI results across a base advance.

.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/DISCOVERY.md

@@ -3,6 +3,21 @@
 Discovery was performed read-only against trusted `main` at merge
 `9033a97a4be6d762cae4b210018ef81a079395c2`.
 
+## 00R3 recovery addendum — 2026-07-23
+
+- Signed state remains at PR #178 (`73b4579…`) while protected `main` contains
+  PRs #187, #188, and #189 in exact first-parent order.
+- The merge workflow prepares and consumes bounded recovery state; the explicit
+  start workflow replays merges without that recovery sequence.
+- GitHub retains mutable reruns on immutable PR heads. PR #189 acquired failing
+  `agent-gates` reruns after its merge, so present-day latest-run selection can
+  rewrite evidence that existed at merge time.
+- The check-runs API is paginated. One 100-item page cannot prove completeness
+  after later rerun noise accumulates.
+- The root repair needs persisted merge-bound protected-check provenance, one
+  exact four-merge bridge through 00R3, and a shared atomic reconciliation path
+  for merge and explicit-start workflows.
+
 ## Repository behavior found
 
 - Branch protection requires `agent-gates` and `test`, uses strict up-to-date

.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/RISKS.md

@@ -15,3 +15,7 @@
 | Legitimate check reruns block signed memory | Critical | Validate every same-name candidate, order completed trusted invocations by parsed start instant and positive check-run ID, then require the unique latest candidate to succeed. |
 | A stale success hides a later failure | Critical | Latest validated run wins; an in-progress, failed, cancelled, foreign-app, malformed, or timestamp-ambiguous latest run fails closed. |
 | Three-merge repair becomes general authority | Critical | Schema v3 permits at most two recovered merges and production names only PR #187, PR #188, and 00R2; require exact first-parent adjacency, unique identities, full consumption before signing, and no serialization. |
+| Mutable post-merge reruns rewrite accepted evidence | Critical | Select protected runs at immutable merge time, persist exact selected provenance and digest, and ignore only runs provably started after the cutoff. |
+| Recovery cannot cross PR #189 and its own activation | Critical | Use one schema-v4 exact four-entry bridge from signed PR #178 through PRs #187–#189 to 00R3, then consume it completely. |
+| Explicit starts reconcile differently from merge automation | High | Use one plan/prepare/update/assert implementation and prove atomic parity before applying authority. |
+| Later reruns hide evidence beyond the first API page | High | Bounded complete pagination with total, overlap, drift, and exhaustion rejection. |

.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/STATUS.md

@@ -1,16 +1,18 @@
 # STATUS: WS-ENG-007 - Concurrent PR Review Reconciliation
 
-- Phase: canonical check-evidence recovery
+- Phase: merge-bound check-evidence recovery
 - Gate: fail-closed automation repair
 - Active planning chunk: none
 - Active implementation chunk: none
 - Completed but unreconciled recovery chunk: `WS-ENG-007-00R1`
-- Proposed recovery chunk: `WS-ENG-007-00R2`
+- Merged but unreconciled recovery chunk: `WS-ENG-007-00R2`
+- Active recovery chunk: `WS-ENG-007-00R3`
 - Proposed implementation successor after recovery: `WS-ENG-007-01`
 - Separate explicit start required: true
-- Current gate: PR #188 merged at
-  `c65633f8f0991dbefe7b0635e053aab0df8f9af8`. Its tree normalization repair is
-  correct, but signed reconciliation still fails because PR #187 has two
-  successful trusted `agent-gates` reruns and planning intake incorrectly
-  treats repeated check evidence as ambiguous. Signed state remains at
-  `73b457925b02301587b83d01ced0adb66319d134`; no successor is active.
+- Current gate: PRs #187–#189 are merged, but signed reconciliation still fails
+  because mutable post-merge check history is re-evaluated and the explicit
+  start workflow lacks the merge workflow's recovery path. Signed state remains
+  at `73b457925b02301587b83d01ced0adb66319d134`; no successor is active.
+- Review gate: all required internal tracks passed reviewed implementation
+  `4a3eee7fdd80970675ae2574542073b8a92e1ef9`; awaiting external checks and the
+  user-owned merge decision.

.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/chunks/WS-ENG-007-00R3-merge-bound-evidence-recovery.md

@@ -0,0 +1,140 @@
+# Chunk Contract: WS-ENG-007-00R3 — Merge-Bound Evidence Recovery
+
+## Parent initiative
+
+`WS-ENG-007` — Concurrent PR Review Reconciliation
+
+## Goal
+
+Restore signed reconciliation and explicit starts without allowing mutable
+post-merge check reruns to rewrite the evidence accepted for an already merged
+PR.
+
+## Why this chunk exists
+
+PRs #187–#189 are on protected `main`, but signed memory remains at PR #178.
+The recovery path re-queries mutable check history, rejects later rerun shapes,
+and exists only in the merge workflow. PR #189 also merged without completed
+pre-merge `agent-gates` evidence. Consequently an ordinary explicit start cannot
+reconcile the same trusted history and unrelated ENG-006 work is blocked.
+
+## Risk class
+
+L1 / P0 reliability repair.
+
+## Start phase
+
+Recovery implementation. This contract records the exact fail-closed repair
+needed to restore the signed start mechanism that is itself unavailable.
+
+## Allowed files
+
+```text
+.github/workflows/loop-memory.yml
+.github/workflows/loop-memory-start.yml
+scripts/update_post_merge_memory.py
+scripts/check_loop_memory_state.py
+scripts/test_update_post_merge_memory.py
+scripts/test_check_loop_memory_state.py
+scripts/test_agent_gates.py
+docs/operations_post_merge_memory.md
+.agent-loop/policies/loop-memory-recovery.json
+.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/**
+.agent-loop/merge-intents/WS-ENG-007-00R3.json
+```
+
+## Not allowed
+
+```text
+application, API, database, product, auth, payment, or coverage changes
+repository permissions, secrets, branch protection, or cancel authority changes
+weakening required checks, signed starts, internal review, or human merge approval
+any wildcard, reusable, reorderable, or persistent recovery exception
+automatic successor starts
+```
+
+## Acceptance criteria
+
+- [ ] For each protected name, classify every candidate against immutable
+      `merged_at`; ignore only candidates started after the merge. Select the
+      latest candidate started no later than the merge by normalized RFC3339
+      instant and positive unique ID, and require it to have completed
+      successfully no later than the merge. An older success cannot hide a
+      newer eligible failure or incomplete run.
+- [ ] Malformed timestamps or identities that prevent trustworthy boundary
+      classification, incomplete pagination, forged app, wrong head, duplicate
+      ID, non-successful selected evidence, and ambiguity fail closed.
+- [ ] Check retrieval is completely paginated with deterministic deduplication,
+      explicit page/item bounds, and rejection of total drift, overlap, or bound
+      exhaustion. More than 100 later reruns cannot hide eligible evidence.
+- [ ] Signed merge records persist selected run ID, protected name, head SHA,
+      pinned app, normalized start/completion instants, conclusion, merge cutoff,
+      and a canonical evidence digest; the independent checker validates them.
+- [ ] CodeRabbit remains supplementary external evidence and is not converted
+      into signed start or merge authority.
+- [ ] Merge reconciliation and explicit-start reconciliation use one shared,
+      deterministic recovery sequence and consume the recovery inventory before
+      signing or publishing.
+- [ ] A schema-v4 closed recovery certificate binds signed basis
+      `73b457925b02301587b83d01ced0adb66319d134`, exact PR #187 / `PLAN` /
+      `8928ba80…`, PR #188 / `00R1` / `c65633f8…`, PR #189 / `00R2` /
+      `d3321698…`, and direct-next activation `00R3`. It requires exact adjacent
+      order `[8928ba8…, c65633f…, d332169…, target]` and a four-entry bounded
+      ephemeral transport. All entries are consumed before signing and none is
+      serialized or reusable.
+- [ ] Protected merge-bound evidence is required for PRs #187, #188, and the
+      new `00R3` activation PR. Only exact historical PR #189 may carry the
+      closed `historical-recovery-only` evidence mode: its exact merge/head/chunk,
+      absence reason, and certificate digest are independently validated. That
+      mode is impossible for `00R3` or any future merge.
+- [ ] Policy v4 has exactly `schema_version`, `signed_basis`, `activation`, and
+      three ordered `recovered_merges`; transport v3 has exactly four
+      chronological unique identities. Policy/transport v1 and v2 bounds remain
+      unchanged. Unknown keys, basis mismatch, collisions, 0–3/5 entries,
+      reordering, wrong parents, and legacy-version widening reject.
+- [ ] Once history is reconciled, distinct idle initiatives can start
+      independently and a later rerun on an older PR cannot block them.
+- [ ] Repeated reconciliation and repeated start dispatch remain idempotent or
+      fail closed with a stable, actionable error.
+- [ ] Both workflows call one shared reconciliation implementation in this
+      order: plan, prepare recovery, update every merge with the same inventory,
+      assert consumption, then sign/publish or apply the start. Failure publishes
+      neither partial state nor authority event.
+- [ ] Exactly one schema-v2 merge intent names `WS-ENG-007-01` with
+      `next_requires_explicit_start: true`; ENG-006 and ENG-007 successors remain
+      inactive after recovery.
+
+## Verification commands
+
+```bash
+PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 python3 -m pytest -q scripts/test_update_post_merge_memory.py scripts/test_check_loop_memory_state.py scripts/test_agent_gates.py
+python3 scripts/check_markdown_links.py
+python3 scripts/check_stale_workstream_wording.py
+python3 scripts/update_post_merge_memory.py validate-merge-intent --repository-root . --base-ref origin/main
+git diff --check origin/main...HEAD
+```
+
+## Required reviewers
+
+- senior engineering
+- QA/test
+- security/auth
+- product/ops
+- architecture
+- CI integrity
+- docs
+- reuse/dedup
+- test delta
+
+## Human review focus
+
+- Is historical evidence frozen at the merge boundary without accepting a
+  failing or untrusted pre-merge run?
+- Can the explicit-start path reconcile exactly as safely as the merge path?
+- Does this remove the global mutable-history lock without weakening the
+  initiative-local signed-start rule?
+
+## Stop conditions
+
+Stop if the repair requires weakening protected checks, adding a new historical
+PR exemption, changing GitHub authority, or allowing unsigned implementation.

.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/reviews/WS-ENG-007-00R3-external-review-response.md

@@ -0,0 +1,36 @@
+# External Review Response: WS-ENG-007-00R3
+
+## Comments addressed
+
+- Added an explicit statement that the `eng006_*` reviewer sessions were
+  inherited and reassigned to this exact ENG-007 review.
+- Extended the shared-reconciliation test to prove only exact PR #189 is
+  collected with `historical_recovery=True`.
+- Extracted the duplicated PR #189 predicate into
+  `_is_r3_historical_recovery()` and reused it in both production call sites.
+- Expanded the PR description to expose the complete trust-bundle sections.
+
+## Comments deferred
+
+- CodeRabbit's docstring-coverage warning is stale. The authoritative backend
+  preflight ran the repository docstring gate successfully on the exact PR head.
+- Usage-limit notices are service availability metadata, not code findings.
+
+## Human decisions needed
+
+None. All valid comments are in scope and addressed without changing authority.
+
+## Commands rerun
+
+```bash
+PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 python3 -m pytest -q scripts/test_update_post_merge_memory.py -k 'shared_reconcile_orders or historical_recovery'
+python3 scripts/test_agent_gates.py
+PR_HEAD_SHA="$(git rev-parse HEAD)" python3 scripts/check_internal_review_evidence.py
+python3 scripts/check_markdown_links.py
+git diff --check origin/main...HEAD
+```
+
+## Remaining risks
+
+CodeRabbit may remain rate-limited. Internal reviews and repository checks remain
+the blocking evidence; CodeRabbit is supplementary under repository policy.

.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/reviews/WS-ENG-007-00R3-internal-review-evidence.md

@@ -0,0 +1,80 @@
+# Internal Review Evidence: WS-ENG-007-00R3
+
+## Chunk
+
+`WS-ENG-007-00R3` — Merge-Bound Evidence Recovery
+
+open sub-agent sessions: none
+
+valid findings addressed: yes
+
+## Reviewed Revision
+
+Reviewed code SHA: 4a3eee7fdd80970675ae2574542073b8a92e1ef9
+
+Reviewed at: 2026-07-23T10:30:00Z
+
+The `/root/eng006_*` sessions were inherited from the ENG-006 reviewer pool and
+explicitly reassigned to this WS-ENG-007-00R3 review. Every track is rebound to
+the exact reviewed implementation SHA below; the session name grants no
+cross-initiative authority.
+
+Reviewer run IDs: senior-engineering=/root/eng006_senior_arch_docs; QA/test=/root/eng006_qa_ci_tests; security/auth=/root/eng006_security_ops_reuse; product/ops=/root/eng006_security_ops_reuse; architecture=/root/eng006_senior_arch_docs; docs=/root/eng006_senior_arch_docs; CI-integrity=/root/eng006_qa_ci_tests; reuse/dedup=/root/eng006_security_ops_reuse; test-delta=/root/eng006_qa_ci_tests
+
+## Reviewer Results
+
+| Reviewer | Result | Blocking findings | Notes |
+|---|---:|---|---|
+| senior engineering | PASS AFTER FIXES | None | Merge cutoff and recovery architecture accepted. |
+| QA/test | PASS AFTER FIXES | None | CodeRabbit is supplementary; proof matrix accepted. |
+| security/auth | PASS AFTER FIXES | None | Exact one-use authority and replay boundaries accepted. |
+| product/ops | PASS | None | No product lifecycle behavior changed. |
+| architecture | PASS AFTER FIXES | None | One shared reconciliation reducer. |
+| CI integrity | PASS AFTER FIXES | None | No CI, coverage, or required-check weakening. |
+| docs | PASS AFTER FIXES | None | Runbook and durable artifacts aligned. |
+| reuse/dedup | PASS AFTER FIXES | None | Workflow duplication removed. |
+| test delta | PASS AFTER FIXES | None | Cutoff, pagination, checker, certificate, and reducer tests added. |
+
+## Valid Findings Addressed
+
+- Filtered classifiable post-merge reruns before validating eligible protected
+  evidence, and removed the redundant mutable planning-intake validator.
+- Removed CodeRabbit from planning and recovery authority while retaining it as
+  diagnostic external evidence.
+- Persisted and independently validated exact protected-run provenance with a
+  strict merge cutoff and canonical RFC3339 timestamps.
+- Bound PR #189's sole recovery-only mode to its exact PR, merge, head, chunk,
+  signed basis, activation, policy schema, reason, and certificate digest.
+- Added bounded complete pagination with stable totals and global ID overlap
+  rejection.
+- Replaced duplicated YAML reducers with one atomic `reconcile` command shared
+  by merge and explicit-start workflows.
+- Added cutoff poisoning, pagination drift, mandatory-cutover, strict timestamp,
+  certificate mutation, and shared-reducer tests.
+
+## Commands Run
+
+```bash
+PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 python3 -m pytest -q scripts/test_update_post_merge_memory.py scripts/test_check_loop_memory_state.py
+python3 scripts/test_agent_gates.py
+python3 scripts/check_markdown_links.py
+python3 scripts/check_stale_workstream_wording.py
+git diff --check origin/main...HEAD
+python3 -m py_compile scripts/update_post_merge_memory.py scripts/check_loop_memory_state.py
+```
+
+Final exact-head verification passed 278 updater-gate tests at 90.10 percent
+branch coverage and the independent checker at 90.41 percent. Agent Gates
+passed all 98 standalone scenarios. All reviewer tracks reapproved exact head
+`4a3eee7fdd80970675ae2574542073b8a92e1ef9` after the CodeRabbit repairs.
+
+## Remaining Risks
+
+The schema-v4 bridge is intentionally exact. Any intervening protected-main
+merge before this chunk invalidates adjacency and requires a freshly reviewed
+certificate rather than reinterpretation.
+
+## Stop Condition
+
+No successor is active. ENG-006 documentation work and ENG-007-01 each require
+their ordinary explicit signed start after successful reconciliation.

.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/reviews/WS-ENG-007-00R3-pr-trust-bundle.md

@@ -0,0 +1,43 @@
+# PR Trust Bundle: WS-ENG-007-00R3
+
+## Intent
+
+Restore signed loop-memory reconciliation without allowing mutable post-merge
+reruns to block unrelated initiatives or rewrite accepted merge evidence.
+
+## Scope
+
+- Freeze protected `agent-gates` and backend `test` evidence at PR merge time.
+- Persist selected-run provenance in signed records.
+- Recover exact PRs #187–#189 plus this activation once from signed PR #178.
+- Use one atomic reconciliation reducer in merge and explicit-start workflows.
+
+## Reviewed Revision
+
+`4a3eee7fdd80970675ae2574542073b8a92e1ef9`
+
+## CI Integrity
+
+- No test, coverage floor, required reviewer, human merge checkpoint, or signed
+  start rule was removed or weakened.
+- CodeRabbit remains supplementary external evidence.
+- Both workflows fail before signing, publication, or authority application if
+  reconciliation or recovery consumption fails.
+
+## Reviewer Result
+
+All nine required internal tracks passed after fixes. No Critical or High
+finding remains open.
+
+## Human Review Focus
+
+- Confirm only exact historical PR #189 receives recovery-only evidence.
+- Confirm the new activation PR still requires ordinary protected evidence.
+- Confirm both workflows invoke the same `reconcile` command before authority or
+  publication.
+- Confirm the four-entry bridge is exact, consumed, and non-reusable.
+
+## Remaining Risk
+
+An intervening `main` merge invalidates the exact recovery bridge and must fail
+closed.