v0.17.4

Three places where the protocol asserted more than anyone had observed. All three
were found by running the tool rather than reading it, and one of them shipped in
0.17.3 earlier the same day.

What changed

worker-read does not always give a typed reason. The text promised bounded
terminal output "with a typed fallbackReason". Observed: sometimes
session_not_reported, sometimes null. This mattered because 0.17.3 had just
made the reviewer responsible for saying why a dispatch record could not be
recovered — and a reviewer promised a typed reason has nothing to write when the
field is absent.

A dispatched receipt is not evidence of life. The protocol covered one
direction, that a failed receipt is not evidence a worker is progressing, and
omitted the converse. A worker's turn ended on a harness spend limit; the dispatch
stayed dispatched, the worker read ready, no heartbeat ever arrived, and retry
was refused as task_not_startable.

Reproducing it produced a stronger rule than the incident. A retry against a
dispatch whose worker was alive and progressing is refused identically — so the
refusal is not about the worker's state at all. Retry is refused while the plane
still considers the dispatch live, whether or not the worker still is; the live
terminal is re-engaged instead.

A two-half repair was documented as one half. The Cursor marketplace refresh
needs Uninstall from the Installed tab then install from the Marketplace
tab, and the same section already noted that removing a marketplace leaves the
plugin installed.

How it was verified

The counterexample for the first item is the protocol text of 0.17.3 itself. It
parses, that release's own contract script is green on it, and a keyword check for
fallbackReason passes on it — present, running, returning a pass, and asserting
what the execution plane contradicts. The verbatim pin separates the two releases;
a keyword check does not.

A limit recorded rather than hidden

One correction rests on a single observation that only a coordinator can make: the
error belongs to a role that dispatched workers do not hold, and a worker attempting
it hits a role fence that fires before liveness is evaluated. The review recorded
this as an explicit non-verification rather than letting its own inability to reach
the error read as agreement.

That also exposed a gap in the rule shipped in 0.17.3, which branches on whether
a record can be recovered. Here the record was recoverable and the red run was
unproducible, so the clause never fires. It is recorded and gets its own change.