fix(agent-loop): recover unsigned ART planning merge

.agent-loop/REVIEW_LOG.md

@@ -2939,3 +2939,23 @@ The exact Ruff 0.15.22 integration review found one branch-owned `F841`: a
 historical ART contract read remained after its assertion was retired. The
 repair removes only that dead read; focused Ruff passes, all 104 collected
 agent-gate pytest cases pass, and the 100 direct regression cases pass.
+
+## 2026-07-25 - WS-ENG-007-00R6 ART PLAN2 Recovery Review
+
+PR #197 merged planning chunk `WS-ART-001-PLAN2` without its required signed
+planning start, so canonical reconciliation fails closed at merge
+`03a05eeb8f129e0d5f226cc5c058965f43590a81`. After signed AUTH-11 PR #201
+merged, R6 extends the closed recovery engine with schema v6: signed basis
+`bba4ba5f171a4438b072740707a5cf8bde49d9af`, exact PR #197 then exact signed
+PR #201, and only the direct-next R6 activation. All three temporary exemptions
+must be merge-evidence-bound, first-parent adjacent,
+consumed before signing, and absent from replay. ART remains stopped at 03A;
+`WS-CI-001-03`, `WS-ENG-007-01`, and every other successor still require
+ordinary explicit starts. All nine internal tracks reviewed the bounded recovery; exact final-SHA
+evidence and protected GitHub checks remain required.
+
+CodeRabbit's final-head review raised two stale-context findings: it treated the
+superseded `609be24d` revision as current and proposed omitting signed PR #201
+from the first-parent recovery chain. The external-review response records why
+final code review is bound to `f3eab24e` and why exact PR #201 reconciliation is
+mandatory rather than expanded authority.

.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/CHUNK_MAP.md

@@ -6,13 +6,14 @@
 | 0 | `WS-ENG-007-00R2` | Canonicalize repeated trusted check evidence and reconcile PRs #187 and #188 exactly once | L1/P0 | Merged; superseded by mutable-history failure |
 | 0 | `WS-ENG-007-00R3` | Freeze accepted checks at merge time and give explicit starts deterministic recovery parity | L1/P0 | Merged; exposed cross-initiative projection mixing |
 | 0 | `WS-ENG-007-00R4` | Separate global merge evidence from initiative-local authority projections | L1/P0 | Merged as PR #191; awaiting exact R5 reconciliation |
-| 0 | `WS-ENG-007-00R5` | Reconcile exact merged R4 and activate its closed authority-projection repair | L1/P0 | Active fail-closed recovery after R4 merged without signed-start evidence |
-| 1 | `WS-ENG-007-01` | Add deterministic reviewed-patch identity and conservative base-delta review preservation | L1 | Blocked on 00R5 merge, successful reconciliation, and explicit start |
+| 0 | `WS-ENG-007-00R5` | Reconcile exact merged R4 and activate its closed authority-projection repair | L1/P0 | Completed and merged as PR #192 |
+| 0 | `WS-ENG-007-00R6` | Reconcile exact unsigned ART PLAN2 merge and restore ordinary signed starts | L1/P0 | Active fail-closed recovery after PR #197 merged without signed-start evidence |
+| 1 | `WS-ENG-007-01` | Add deterministic reviewed-patch identity and conservative base-delta review preservation | L1 | Blocked on 00R6 merge, successful reconciliation, and explicit start |
 | 2 | `WS-ENG-007-02` | Add structured reviewer-track and upstream-finding reconciliation | L1 | Blocked on 01 merge and explicit start |
 | 3 | `WS-ENG-007-03` | Add merge-group CI parity and queue-readiness proof | L1 | Blocked on 02 merge and explicit start |
 
-Recovery chunks are exceptional ordered prerequisites; `00R5` consumes the
-exact unsigned R4 recovery merge while preserving R4's authority-projection
-repair. Implementation chunks
+Recovery chunks are exceptional ordered prerequisites. `00R6` consumes only
+the exact unsigned ART PLAN2 merge, the later signed AUTH-11 merge, and its own
+activation; it grants no ART, AUTH, or CI implementation authority. Implementation chunks
 remain one PR each and stop after merge. Every successor requires a separate
 explicit signed start.

.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/STATUS.md

@@ -1,20 +1,22 @@
 # STATUS: WS-ENG-007 - Concurrent PR Review Reconciliation
 
-- Phase: R4 activation recovery
+- Phase: ART PLAN2 signed-memory recovery
 - Gate: fail-closed automation repair
 - Active planning chunk: none
 - Active implementation chunk: none
 - Reconciled recovery history: `WS-ENG-007-00R1`, `WS-ENG-007-00R2`,
   `WS-ENG-007-00R3`
-- Completed recovery chunk: `WS-ENG-007-00R3`
-- Merged recovery chunk: `WS-ENG-007-00R4`
-- Active recovery chunk: `WS-ENG-007-00R5`
+- Completed recovery chunks: `WS-ENG-007-00R1` through `WS-ENG-007-00R5`
+- Unsigned merge requiring recovery: `WS-ART-001-PLAN2` / PR #197
+- Later signed merge in the exact recovery sequence: `WS-AUTH-001-11` / PR #201
+- Active recovery chunk: `WS-ENG-007-00R6`
 - Proposed implementation successor after recovery: `WS-ENG-007-01`
 - Separate explicit start required: true
-- Current gate: PR #191 merged as
-  `9bf16d478f669d48172810c83cdf6a7d2b8992ed`, but post-merge memory rejected it
-  because recovery chunk R4 had no signed start. Signed state remains at PR #190;
-  no successor is active.
-- Review gate: all nine internal tracks passed exact implementation head
-  `10159497b3f3ca3464cbbbfd10f16945ade1879a`; awaiting external checks and the
-  user-owned merge decision.
+- Current gate: PR #197 merged as
+  `03a05eeb8f129e0d5f226cc5c058965f43590a81` without a signed planning start.
+  Reconciliation fails closed at that merge, so later explicit starts cannot
+  reach current main. Signed state remains based at merge
+  `bba4ba5f171a4438b072740707a5cf8bde49d9af`; AUTH-11 was correctly active
+  there and its later merge is preserved as the second exact predecessor.
+- Review gate: R6 exact-head internal review and protected checks required
+  before the user-owned merge decision.

.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/chunks/WS-ENG-007-00R6-art-plan2-recovery.md

@@ -0,0 +1,98 @@
+# Chunk Contract: WS-ENG-007-00R6 — ART PLAN2 Signed-Memory Recovery
+
+## Parent initiative
+
+`WS-ENG-007` — Concurrent PR Review Reconciliation
+
+## Goal
+
+Reconcile exact merged planning chunk `WS-ART-001-PLAN2` and this activation
+chunk into signed loop memory so ordinary writer-directed starts can resume.
+
+## Why this chunk exists
+
+PR #197 merged without the required signed planning start. Loop-memory replay
+correctly fails closed at that merge and therefore cannot reach later protected
+main or apply any new explicit start.
+
+## Risk class
+
+L1 / P0 signed-memory recovery.
+
+## Start phase
+
+Recovery implementation. Signed state cannot start this chunk until the exact
+unrecorded predecessor is reconciled.
+
+## Allowed files
+
+```text
+.agent-loop/policies/loop-memory-recovery.json
+.agent-loop/REVIEW_LOG.md
+scripts/test_agent_gates.py
+scripts/test_update_post_merge_memory.py
+scripts/update_post_merge_memory.py
+docs/operations_post_merge_memory.md
+.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/**
+.agent-loop/merge-intents/WS-ENG-007-00R6.json
+```
+
+## Not allowed
+
+```text
+workflow, checker, permission, CI, backend test, or coverage behavior changes
+application, API, database, auth, artifact, payment, or product changes
+wildcard, persistent, reordered, reusable, or post-signing exemptions
+automatic ART, CI, AUTH, ENG, or other successor starts
+reinterpretation of PR #197 as implementation authority
+```
+
+## Acceptance criteria
+
+- [ ] Schema-v6 recovery binds signed basis `bba4ba5f…` and names exactly PR
+      #197 / `WS-ART-001-PLAN2` / `03a05eeb…` followed by signed PR #201 /
+      `WS-AUTH-001-11` / `f670b705…` as its two predecessors.
+- [ ] Activation names only `WS-ENG-007-00R6`; the target identity comes from
+      trusted GitHub merge evidence and must be direct-next on first-parent main.
+- [ ] All three records carry successful merge-bound `agent-gates` and `test`
+      provenance; mutable reruns and CodeRabbit are not recovery authority.
+- [ ] All three temporary exemptions are consumed before signing and cannot persist,
+      replay, reorder, broaden, or authorize a fourth or additional merge.
+- [ ] ART PLAN2 reconciles to stopped state with `WS-ART-001-03A` requiring an
+      explicit start; recovery starts no implementation or planning chunk.
+- [ ] Exactly one merge intent stops ENG-007 at its existing `01` gate.
+
+## Verification commands
+
+```bash
+PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 python3 -m pytest -q scripts/test_update_post_merge_memory.py scripts/test_check_loop_memory_state.py scripts/test_agent_gates.py
+python3 scripts/check_internal_review_evidence.py
+python3 scripts/check_markdown_links.py docs/operations_post_merge_memory.md .agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation
+python3 scripts/check_stale_workstream_wording.py
+python3 scripts/update_post_merge_memory.py validate-merge-intent --repository-root . --base-ref origin/main
+git diff --check
+```
+
+## Required reviewers
+
+- senior engineering
+- QA/test
+- security/auth
+- product/ops
+- architecture
+- CI integrity
+- docs
+- reuse/dedup
+- test delta
+
+## Human review focus
+
+Confirm the certificate is exact, first-parent adjacent, merge-evidence-bound,
+fully consumed, and incapable of starting ART PLAN2 successors or unrelated
+work.
+
+## Stop conditions
+
+Stop if recovery requires an intervening merge, wildcard authority, missing
+protected checks, persisted exemption, automatic successor start, or changes
+outside the allowed files.

.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/reviews/WS-ENG-007-00R6-external-review-response.md

@@ -0,0 +1,42 @@
+# External Review Response: WS-ENG-007-00R6
+
+## Comments addressed
+
+- CodeRabbit reported that review evidence should bind `609be24d`. That SHA was
+  the obsolete pre-PR-201 recovery revision named by the stale PR description.
+  All nine internal tracks reran against final recovery code SHA
+  `f3eab24ecac32f959933369c1b5342bc901c7153`; the evidence-only publication
+  commit is `1917b6f825e1f96376e939f7bbba4c6f275fa58d`. The PR description is updated
+  from the current trust bundle.
+- CodeRabbit proposed limiting schema v6 to PR #197 alone. That would be
+  incorrect because protected main contains signed AUTH-11 PR #201 immediately
+  after PR #197. Recovery cannot skip that first-parent commit. Schema v6
+  accepts exactly two recovered records, and the production certificate pins
+  them to PR #197 then PR #201. Runtime plan equality, first-parent adjacency,
+  merge-bound checks, uniqueness, consumption, replay, reorder, and extra-merge
+  tests prevent broader authority.
+
+## Comments deferred
+
+None.
+
+## Human decisions needed
+
+None. Both findings were based on stale PR context rather than a valid code or
+policy defect.
+
+## Commands rerun
+
+```bash
+PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 python3 -m pytest -q scripts/test_update_post_merge_memory.py scripts/test_check_loop_memory_state.py scripts/test_agent_gates.py
+python3 scripts/check_internal_review_evidence.py
+python3 scripts/check_markdown_links.py docs/operations_post_merge_memory.md .agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation
+python3 scripts/check_stale_workstream_wording.py
+python3 scripts/update_post_merge_memory.py validate-merge-intent --repository-root . --base-ref origin/main
+git diff --check
+```
+
+## Remaining risks
+
+PR #202 must remain the direct-next main merge. Any intervening main merge
+invalidates the exact certificate and requires another reviewed reconciliation.

.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/reviews/WS-ENG-007-00R6-internal-review-evidence.md

@@ -0,0 +1,76 @@
+# Internal Review Evidence: WS-ENG-007-00R6
+
+## Chunk
+
+`WS-ENG-007-00R6` — ART PLAN2 Signed-Memory Recovery
+
+open sub-agent sessions: none
+
+valid findings addressed: yes
+
+## Reviewed Revision
+
+Reviewed code SHA: 7a22070fe66770fc229671421ab0a899c9b2c97d
+
+Reviewed at: 2026-07-26T00:27:00Z
+
+After the reviewed SHA, only this evidence and trust reconciliation changed.
+
+Reviewer run IDs: senior-engineering=`ci02b_lane_runner`;
+QA/test=`ci02b_cr_arch`; security/auth=`ci02b_cr_ci`;
+product/ops=`ci02b_cr_docs`; architecture=`ci02b_cr_arch`;
+CI-integrity=`ci02b_cr_ci`; docs=`ci02b_cr_docs`;
+reuse/dedup=`ci02b_cr_reuse`; test-delta=`ci02b_cr_test_delta`.
+
+## Reviewer Results
+
+| Reviewer | Result | Blocking findings | Notes |
+|---|---:|---|---|
+| senior engineering | PASS | None | Three-record cardinality and direct-next merge wording are exact. |
+| QA/test | PASS | None | Cross-initiative ART, AUTH, and ENG recovery and stopped projections are covered. |
+| security/auth | PASS | None | Certificate is exact, ordered, merge-bound, consumed, and non-reusable. |
+| product/ops | PASS | None | No product authority or lifecycle behavior changes. |
+| architecture | PASS | None | Existing closed recovery path is extended to schema v6 without a parallel mechanism. |
+| CI integrity | PASS | None | No workflow or gate weakening; merge-bound checks remain authority. |
+| docs | PASS | None | Runbook, map, status, contract, review log, and trust evidence agree. |
+| reuse/dedup | PASS | None | No new reducer, policy path, or exemption store. |
+| test delta | PASS | None | Exact policy assertion changed; no test was removed, skipped, or weakened. |
+
+The first review pass found stale evidence wording and a missing exact
+cross-initiative recovery proof. The repair models signed-active AUTH-11,
+ART PLAN2 recovery, AUTH-11 completion, and ENG R6 while proving all successors
+remain stopped. The final pass resolved a cardinality wording ambiguity. All
+reviewers passed recovery code SHA `f3eab24ecac32f959933369c1b5342bc901c7153`.
+All tracks then reviewed the CodeRabbit disposition and durable review-log
+delta at exact SHA `7a22070fe66770fc229671421ab0a899c9b2c97d`;
+no authority, code, test, CI, or product behavior changed in that delta.
+
+## Commands Run
+
+```bash
+PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 python3 -m pytest -q scripts/test_update_post_merge_memory.py scripts/test_check_loop_memory_state.py scripts/test_agent_gates.py
+python3 scripts/check_internal_review_evidence.py
+python3 scripts/check_markdown_links.py docs/operations_post_merge_memory.md .agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation
+python3 scripts/check_stale_workstream_wording.py
+python3 scripts/update_post_merge_memory.py validate-merge-intent --repository-root . --base-ref origin/main
+git diff --check
+```
+
+## Results
+
+- 301 recovery, checker, and Agent Gate tests passed.
+- Merge-intent validation, Markdown links, stale wording, and diff integrity
+  passed.
+- Exact policy equality pins schema v6, the signed basis, PR #197, signed PR
+  #201, and R6 activation. The cross-initiative regression proves exact order,
+  full consumption, inert replay, stopped projections, and rejection of a
+  reordered or additional merge.
+
+## Remaining Risks
+
+- R6 must be the direct-next protected-main merge. Any intervening merge
+  invalidates the certificate and requires a new reviewed recovery plan.
+- All three target heads must retain merge-bound successful `agent-gates` and
+  `test` evidence.
+- Successful post-merge automation, not this PR, proves exemption consumption
+  and restored signed-state continuity.

.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/reviews/WS-ENG-007-00R6-pr-trust-bundle.md

@@ -0,0 +1,61 @@
+# PR Trust Bundle: WS-ENG-007-00R6
+
+## Intent
+
+Restore signed-memory continuity after unsigned planning merge PR #197 without
+granting ART, CI, AUTH, ENG, or product implementation authority.
+
+## Exact Scope
+
+- Signed basis: `bba4ba5f171a4438b072740707a5cf8bde49d9af`.
+- First recovered predecessor: PR #197 / `WS-ART-001-PLAN2` /
+  `03a05eeb8f129e0d5f226cc5c058965f43590a81`.
+- Second recovered predecessor: signed PR #201 / `WS-AUTH-001-11` /
+  `f670b7058c71ad4d11a68c6e242e9fe501ae3aaf`.
+- Activation: only `WS-ENG-007-00R6` as the direct-next main merge.
+- Successors remain stopped: ART at `WS-ART-001-03A`, AUTH at
+  `WS-AUTH-001-11A`, and ENG at `WS-ENG-007-01`; `WS-CI-001-03` still requires
+  its own signed planning start.
+
+## Reviewed Revision
+
+`7a22070fe66770fc229671421ab0a899c9b2c97d`
+
+Recovery code revision: `f3eab24ecac32f959933369c1b5342bc901c7153`.
+
+## Evidence
+
+- 301 recovery, checker, and Agent Gate tests passed.
+- Policy regression asserts the complete schema-v6 object exactly.
+- Existing behavior tests prove signed-basis matching, ordered adjacency,
+  merge-bound check selection, exemption consumption, wrong-basis rejection,
+  and inert replay.
+- The exact cross-initiative regression proves ART PLAN2 recovery while AUTH-11
+  is signed-active, AUTH-11 completion, ENG R6 activation, and stopped successor
+  projections for all three initiatives.
+- Merge intent, Markdown links, stale wording, and diff checks passed.
+
+## Reviewer Results
+
+All nine required internal tracks completed. No implementation blocker remains.
+CI/security and senior engineering retain only the operational risk that any
+intervening main merge or missing protected evidence invalidates recovery.
+
+CodeRabbit's two comments were dispositioned as stale-context findings. The
+external-review response records why the reviewed SHA is `f3eab24e` and why
+signed PR #201 is a mandatory exact predecessor rather than broadened recovery
+authority.
+
+## Human Review Focus
+
+- Confirm PR #197 then signed PR #201 are the only recovered predecessors.
+- Confirm R6 is direct-next on main before merging.
+- Confirm both recovered predecessors and the activation head have successful merge-bound
+  `agent-gates` and `test` evidence.
+- Confirm the policy and generated result contain no persistent exemption or
+  automatic successor start.
+
+## Stop Conditions
+
+Do not merge if main advances, required checks fail, the reviewed SHA changes
+outside evidence-only files, or recovery would need broader authority.

.agent-loop/merge-intents/WS-ENG-007-00R6.json

@@ -0,0 +1,9 @@
+{
+  "chunk_id": "WS-ENG-007-00R6",
+  "chunk_title": "ART PLAN2 Signed-Memory Recovery",
+  "initiative_id": "WS-ENG-007",
+  "next_chunk_id": "WS-ENG-007-01",
+  "next_chunk_title": "Reviewed Patch and Base-Delta Reconciliation",
+  "next_requires_explicit_start": true,
+  "schema_version": 2
+}

.agent-loop/policies/loop-memory-recovery.json

@@ -1,16 +1,22 @@
 {
   "activation": {
-    "chunk_id": "WS-ENG-007-00R5",
+    "chunk_id": "WS-ENG-007-00R6",
     "initiative_id": "WS-ENG-007"
   },
-  "signed_basis": "a3eecadcf847ac70fc28c58dad642f2d761015e0",
+  "signed_basis": "bba4ba5f171a4438b072740707a5cf8bde49d9af",
   "recovered_merges": [
     {
-      "chunk_id": "WS-ENG-007-00R4",
-      "initiative_id": "WS-ENG-007",
-      "merge_sha": "9bf16d478f669d48172810c83cdf6a7d2b8992ed",
-      "pr_number": 191
+      "chunk_id": "WS-ART-001-PLAN2",
+      "initiative_id": "WS-ART-001",
+      "merge_sha": "03a05eeb8f129e0d5f226cc5c058965f43590a81",
+      "pr_number": 197
+    },
+    {
+      "chunk_id": "WS-AUTH-001-11",
+      "initiative_id": "WS-AUTH-001",
+      "merge_sha": "f670b7058c71ad4d11a68c6e242e9fe501ae3aaf",
+      "pr_number": 201
     }
   ],
-  "schema_version": 5
+  "schema_version": 6
 }