v7.224.3

• T-1000: _outbox_blocks and _hash_or_empty were definition-only after the strict OUTBOX and lifecycle rewrites; a repo-wide reference scan found zero uses and no dynamic contract, so both were deleted. SAICREW, Ruff and the full scenario suite stay green.

v7.224.2

• T-1001: the canonical sub-sync ownership receipt is now the one whose OWN created_at is newest, never the operation.json filesystem mtime -- a copy or touch can push an older committed inventory's mtime forward and feed the wrong obsolete reconciliation. Receipts sharing the newest committed second with different inventories are ambiguous and fail closed (sync refuses, zero writes); a receipt with a broken durable timestamp is never selected and a fresh sync self-heals. Six hostile lineage controls plus the obsolete-delete and crash-resume controls pass.

v7.224.1

• T-1002: the crew snapshot now binds the exact selected sub-sync ownership receipt (path + bytes) into the finalizer's CAS alongside the epoch and release receipts. Deleting or mutating that receipt after the green snapshot and before APPLY returns STALE_STATE with zero Core writes; the positive finalizer is unchanged.

v7.224.0

• T-999: sc / saipen crew is now a mechanically resumable serial circuit over the full built-in crew. Its durable converge_target: crew state is derived from live role, OUTBOX, shared-contract, release and Core evidence instead of a mutable stage counter.
• T-999: shared-contract sync now has receipt-bound ownership, safe regular-file inventory, exact obsolete-path reconciliation and source/read CAS. Spawn establishes that contract first; collect treats a truly empty targeted OUTBOX as a truthful no-op while refusing malformed or non-ready evidence.
• T-999: crew snapshots and finalization close every evidence race found in REVIEW. File/tree/source identities, role packages, pending operations and release receipts are captured before the snapshot barrier and rechecked at APPLY; stale proof writes zero Core bytes.
• T-999: journal recovery now covers directory and missing-file dependencies plus the crash boundary where a target already carries its after-hash. The hostile matrix carries 138 SAICREW controls and the full scenario suite passes.

v7.223.16

• T-998: _surface_dirty now includes untracked non-ignored files (git ls-files --others) so a scope whose only change is a new file can never round into NEEDS_CLOSURE and skip its content commit (v7.223.15 false-success). Regression test 14 proves an untracked-only scope now creates content commit A.
• T-998: ship the pending content v7.223.15 omitted: KNOWLEDGE/HABITS-browser-hang.md, the executor deletion-scope support, the T-996 scope record.

v7.223.14

• T-997: delete the tracked orphan .saipen/SAIUI_CORE_INTEGRATION_COMMAND_V2.md (zero references) via the release executor scope deletion path.
• T-996/T-997 wave: board scrub pruned 11 stale ## DONE tickets, kept the T-549 barrier anchor.

v7.223.13

• T-994: release executor is one SAIOPS recovery operation (release-) under .saipen/recovery/ops/; every external fact is classified expected-BEFORE / expected-AFTER / CONFLICT and recovery never repeats a side effect (crash A->B->tag edges proven).
• T-994: release scope = the exact reviewed ticket scope recorded at REVIEW->SHIP (saipen scope) + mechanical release metadata; a real source change now ships into a fresh clone.
• T-994: no-publish matches ship.md exactly (zero staging/commit/tag/push, local validation, truthful skipped-publish event, digest, SHIP->DONE, works git-less).
• T-994: first publish is a journaled canonical WAIT with confirmation evidence, never chat memory.
• T-994: every public refusal returns a code from errors.CODES; internal stage failures collapse to RELEASE_FAILED.
• T-995: release receipt write failure surfaces through the public result (RELEASE_FAILED) with zero later remote stages.

v7.223.12

saipen ship and saipen push now dispatch to ONE release executor (saipen_engine/release.py). A frozen ReleasePlan owns the decision: release version, branch, commit message, tag, the exact release metadata surface (VERSION + README + CHANGELOG + all 32 mechanically mirrored locale badges), foreign pre-existing staging detection, and the pre-ship index snapshot. plan_release builds the plan with ZERO writes and validates version parity; execute_release is the only place bytes change: exact staging -> --gate ship -> git diff --cached --check -> commit -> current-branch push -> tag push, in that order. Foreign pre-existing staged paths refuse the plan before any write (never committed, pushed or tagged) and stay byte-identical. Dry-runs are zero-write and, after invocation-name normalization, ship and push produce structurally identical plans. Scenario controls prove plan parity, dry-run no-mutation, foreign-staging refusal + preservation. (T-635)

v7.223.11

The foundation wave (T-992 provenance chain, T-991 role freshness, T-639 audit isolation, T-638 pre-apply integrity) is sealed with a REAL cold role=critic Improve lifecycle run through the public CLI path only: admit -> submit (NO_FINDINGS run) -> complete (bound bar) -> verify PASS -> cycle-complete -> clean/archived, with zero raw evidence edits. The EVIDENCE_ADVERSARY lens joins SAICRITIC: adversarially falsify a green claim's proof linkage (stale fingerprint, wrong seat, duplicate identity, missing gate receipt, wrong source, malformed-but-parseable ledger) -- a gate that stays green is a finding, never a PASS. Every T-638/T-992/T-991/T-639 claim was adversarially falsified and every gate went red as required; NO foundational P0/P1 reproduced. claim_to_proof_VI.md documents the five-dimensional repaired claims (UNIT/COMPOSITION/CANONICAL/GATE/PROVENANCE). One ordinary post-fix sequential release (this one) is the stability seal; its exact commit is recorded for the T-442 v8 gate. Full gates ran fresh TWICE. (T-625)

v7.223.10

Every Improve lifecycle mutator now validates BASE then PROPOSED state before ANY byte is written. load_valid_manifest reads, validates and snapshots a cycle manifest in ONE pass (no first-read/second-read ambiguity) with an allowed-status gate; abort/complete/archive validate their own proposed manifest before journaling, and create_cycle refuses an invalid created_at/project_identity with ZERO writes (no directory left behind). write_sweep_entry validates the existing SWEEP ledger and the owning report via the bound bar before appending, and validates the proposed ledger -- a malformed SWEEP or malformed COMPLETE report is never extended. validate_bound_report is the ONE shared proof bar (structural + roster-bound provenance + source freshness), wired into resume, append, complete_report, verify_cycle, complete_cycle and the validator's ACTIVE strict scan; a report's agent is compared to the ROSTER seat (its owning directory), never to itself. create_report and prepare_audit_seat DERIVE protocol fingerprint/version from the installed SAIPEN -- a caller-supplied digest is refused on mismatch, so fabricated provenance can never be created, resumed, completed, verified or sealed. Resume refuses forged metadata with INVALID_REPORT/STALE_REPORT. cycle_aborted has one legal meaning (ARCHIVED + canonical draft-preserved); ACTIVE/COMPLETE+aborted, duplicates and unknown values are invalid. Canonical CLEAN pruned 9 stale DONE tickets (keeping the needs-chain) so the board is back under the soft cap. The warn-ownership harness proves isolation by asserting the WARN slug SET delta, never just returncode. Ticket-ID allocation reads STRUCTURED records only (BOARD ticket lines + LOG [T-###] field) -- prose mentions of T-NNN can no longer poison the allocator. Hostile controls cover the full mutator matrix. (T-638)