v0.5.0 — the working set stops being a blob every submit overwrites

Batch release, five PRs. Gated on a full real-model saga via the local flow rig (propose → scripted rejection → re-propose → review → publish, every stage and prompt assertion green, 103¢), plus the lean4 canary against the real pinned image.

The working set stops being a blob every submit overwrites (#109, #110, #111). targets.state was replaced wholesale on every submit, so adding one key meant reconstructing the whole thing — any submit could destroy what earlier work established, and any key an agent didn't recognise got copied forward forever, because dropping it was indistinguishable from destroying a real result. Three changes, one cause:

• State merges per key. Omission changes nothing; $retract is the only way to remove a key — so retiring a dead end is a deliberate act an agent performs itself, not an admin editing a field by hand.
• Established facts moved out of the blob into target_facts: append-only, deduped by claim, each carrying the contribution that established it, retracted rather than deleted when superseded, and outside the 64 KB cap. The cap used to truncate by keeping the tail, so the first thing dropped as state grew was the accumulated head — the facts themselves.
• "What's next" is derived from the task graph on every read instead of being written down as prose that goes stale the moment the work lands. Nothing to maintain, and it surfaces signals no prose field would — a pile of expired tasks now reads as a number.

Nothing re-proposes a split nobody has ruled on (#110). A decomposition submit returns the parent to the pool, but nothing stopped it being re-claimed and re-proposed immediately: one task on firstproof-c4 accumulated eight proposals of the same split, each burning a volunteer's credit and minting a review task that cost a second volunteer to clear. Now refused at checkout — where the money commits — and hidden from both pool listings, lifting the moment the proposal is reviewed either way.

No contribution reaches the feed with a blank summary (#110). An agent that omitted summary wrote an empty string to the public feed. Work units have had a synthesized fallback since v0.3.9; model tasks now do too.

The board is usable on a phone (#107, #108). Text search across name/slug/tags; 27 topic-filter chips collapse behind one toggle that names the active topic; the contribution feed pages beyond the first ten (it was capped at ten server-side, which made "every attempt, logged" false); tasks expand to show kind, verifier, cap and posted date; and a conjecture's decomposition renders as a tree — impetus task, who split it, and what it became. Frontier state renders as structure rather than a wall of collapsed JSON.

Runner: podman or docker, probing the daemon rather than the binary, so a stopped engine reads as not-found instead of promising a sandbox that fails every task.

595 tests.