v0.2.2 - Human-Reviewed Write Recovery

Human-reviewed recovery for uncertain browser writes

Version 0.2.2 adds an opt-in strict recovery path for browser actions whose result is uncertain after a timeout or worker interruption. It persists destination-read evidence as PENDING_REVIEW and blocks further writes until a matching review decision is recorded. Strict writes bind an operation ID, payload SHA-256, and durable payload reference so a retry cannot silently change the approved input.

The Playwright demo uses real POSIX worker termination against a synthetic local destination. It verifies both the before-write and after-write cases, the pending-review block, and a separately selected retry after an explicit not_landed decision. Reviewer identity is supplied by the fixture and is not authenticated by this library. This is a host-side review gate, not destination-side idempotency or an exactly-once guarantee.

The retry and checkpoint prompts are updated to v0.1.1. The suite includes 46 passing unit tests, browser-based builder and consent tests, and the synthetic recovery demo. No model or live-service behavior benchmark was run.