v0.72.0

• The implement stage must be worked, not just driven. A session could always judge its own implement work too small to delegate and author it inline — flow verify proved the tree, never who wrote it. Now a normal feature's verify refuses unless every commit the branch holds falls inside a flow_stage worker's recorded run window: each finished worker appends its window to a dev-flow-owned stage-sessions/delegations.log (a session cannot sign its own proof — the ledger is refused to edit/write tools and counted as state tampering in bash), and an after-the-fact amend or rebase surfaces as an uncovered sha no write guard could ever see. While a normal feature is at implement, its own worktree is closed to its driver's edit/write tools and open to the worker that was sent to do it; the injected implement hint, the playbook and the skill no longer offer the inline escape. --docs and --patch — the operator-granted inline modes — are exempt, and there is no flag or yolo path around the rule. Heads-up for flows already at implement when you upgrade: their existing commits precede any ledger, so their next flow verify refuses — delegate a worker that finishes (or redoes) the work.
• A session inside a feature worktree is judged by the main checkout's flow truth. Workers run with cwd = the worktree, whose own tracked .dev-flow/ holds only project.md — so the guard found zero features and every worker since worktrees existed heard no active flow when it reached for the edit tool: real workers authored everything through bash, the one surface the guard never policed. A linked worktree now resolves to its main checkout for feature, binding and state reads, and the write guard's worker half fires for the first time. A plain human session opened inside a worktree reads as a driver there — deliberate: worker-ness is a registration, not a location.