fix(agent-loop): recover unsigned ART planning merge

.agent-loop/REVIEW_LOG.md

@@ -2939,3 +2939,16 @@ The exact Ruff 0.15.22 integration review found one branch-owned `F841`: a
 historical ART contract read remained after its assertion was retired. The
 repair removes only that dead read; focused Ruff passes, all 104 collected
 agent-gate pytest cases pass, and the 100 direct regression cases pass.
+
+## 2026-07-25 - WS-ENG-007-00R6 ART PLAN2 Recovery Review
+
+PR #197 merged planning chunk `WS-ART-001-PLAN2` without its required signed
+planning start, so canonical reconciliation fails closed at merge
+`03a05eeb8f129e0d5f226cc5c058965f43590a81`. R6 reuses the closed schema-v5
+recovery engine with signed basis `bba4ba5f171a4438b072740707a5cf8bde49d9af`,
+that one exact recovered merge, and only the direct-next R6 activation. Both
+temporary exemptions must be merge-evidence-bound, first-parent adjacent,
+consumed before signing, and absent from replay. ART remains stopped at 03A;
+`WS-CI-001-03`, `WS-ENG-007-01`, and every other successor still require
+ordinary explicit starts. All nine internal tracks reviewed the bounded recovery; exact final-SHA
+evidence and protected GitHub checks remain required.

.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/CHUNK_MAP.md

@@ -6,13 +6,14 @@
 | 0 | `WS-ENG-007-00R2` | Canonicalize repeated trusted check evidence and reconcile PRs #187 and #188 exactly once | L1/P0 | Merged; superseded by mutable-history failure |
 | 0 | `WS-ENG-007-00R3` | Freeze accepted checks at merge time and give explicit starts deterministic recovery parity | L1/P0 | Merged; exposed cross-initiative projection mixing |
 | 0 | `WS-ENG-007-00R4` | Separate global merge evidence from initiative-local authority projections | L1/P0 | Merged as PR #191; awaiting exact R5 reconciliation |
-| 0 | `WS-ENG-007-00R5` | Reconcile exact merged R4 and activate its closed authority-projection repair | L1/P0 | Active fail-closed recovery after R4 merged without signed-start evidence |
-| 1 | `WS-ENG-007-01` | Add deterministic reviewed-patch identity and conservative base-delta review preservation | L1 | Blocked on 00R5 merge, successful reconciliation, and explicit start |
+| 0 | `WS-ENG-007-00R5` | Reconcile exact merged R4 and activate its closed authority-projection repair | L1/P0 | Completed and merged as PR #192 |
+| 0 | `WS-ENG-007-00R6` | Reconcile exact unsigned ART PLAN2 merge and restore ordinary signed starts | L1/P0 | Active fail-closed recovery after PR #197 merged without signed-start evidence |
+| 1 | `WS-ENG-007-01` | Add deterministic reviewed-patch identity and conservative base-delta review preservation | L1 | Blocked on 00R6 merge, successful reconciliation, and explicit start |
 | 2 | `WS-ENG-007-02` | Add structured reviewer-track and upstream-finding reconciliation | L1 | Blocked on 01 merge and explicit start |
 | 3 | `WS-ENG-007-03` | Add merge-group CI parity and queue-readiness proof | L1 | Blocked on 02 merge and explicit start |
 
-Recovery chunks are exceptional ordered prerequisites; `00R5` consumes the
-exact unsigned R4 recovery merge while preserving R4's authority-projection
-repair. Implementation chunks
+Recovery chunks are exceptional ordered prerequisites. `00R6` consumes only
+the exact unsigned ART PLAN2 merge and its own activation; it grants no ART or
+CI implementation authority. Implementation chunks
 remain one PR each and stop after merge. Every successor requires a separate
 explicit signed start.

.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/STATUS.md

@@ -1,20 +1,20 @@
 # STATUS: WS-ENG-007 - Concurrent PR Review Reconciliation
 
-- Phase: R4 activation recovery
+- Phase: ART PLAN2 signed-memory recovery
 - Gate: fail-closed automation repair
 - Active planning chunk: none
 - Active implementation chunk: none
 - Reconciled recovery history: `WS-ENG-007-00R1`, `WS-ENG-007-00R2`,
   `WS-ENG-007-00R3`
-- Completed recovery chunk: `WS-ENG-007-00R3`
-- Merged recovery chunk: `WS-ENG-007-00R4`
-- Active recovery chunk: `WS-ENG-007-00R5`
+- Completed recovery chunks: `WS-ENG-007-00R1` through `WS-ENG-007-00R5`
+- Unsigned merge requiring recovery: `WS-ART-001-PLAN2` / PR #197
+- Active recovery chunk: `WS-ENG-007-00R6`
 - Proposed implementation successor after recovery: `WS-ENG-007-01`
 - Separate explicit start required: true
-- Current gate: PR #191 merged as
-  `9bf16d478f669d48172810c83cdf6a7d2b8992ed`, but post-merge memory rejected it
-  because recovery chunk R4 had no signed start. Signed state remains at PR #190;
-  no successor is active.
-- Review gate: all nine internal tracks passed exact implementation head
-  `10159497b3f3ca3464cbbbfd10f16945ade1879a`; awaiting external checks and the
-  user-owned merge decision.
+- Current gate: PR #197 merged as
+  `03a05eeb8f129e0d5f226cc5c058965f43590a81` without a signed planning start.
+  Reconciliation fails closed at that merge, so later explicit starts cannot
+  reach current main. Signed state remains at merge
+  `bba4ba5f171a4438b072740707a5cf8bde49d9af` with AUTH-11 active.
+- Review gate: R6 exact-head internal review and protected checks required
+  before the user-owned merge decision.

.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/chunks/WS-ENG-007-00R6-art-plan2-recovery.md

@@ -0,0 +1,95 @@
+# Chunk Contract: WS-ENG-007-00R6 — ART PLAN2 Signed-Memory Recovery
+
+## Parent initiative
+
+`WS-ENG-007` — Concurrent PR Review Reconciliation
+
+## Goal
+
+Reconcile exact merged planning chunk `WS-ART-001-PLAN2` and this activation
+chunk into signed loop memory so ordinary writer-directed starts can resume.
+
+## Why this chunk exists
+
+PR #197 merged without the required signed planning start. Loop-memory replay
+correctly fails closed at that merge and therefore cannot reach later protected
+main or apply any new explicit start.
+
+## Risk class
+
+L1 / P0 signed-memory recovery.
+
+## Start phase
+
+Recovery implementation. Signed state cannot start this chunk until the exact
+unrecorded predecessor is reconciled.
+
+## Allowed files
+
+```text
+.agent-loop/policies/loop-memory-recovery.json
+.agent-loop/REVIEW_LOG.md
+scripts/test_agent_gates.py
+docs/operations_post_merge_memory.md
+.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/**
+.agent-loop/merge-intents/WS-ENG-007-00R6.json
+```
+
+## Not allowed
+
+```text
+workflow, updater, checker, permission, CI, test, or coverage behavior changes
+application, API, database, auth, artifact, payment, or product changes
+wildcard, persistent, reordered, reusable, or post-signing exemptions
+automatic ART, CI, AUTH, ENG, or other successor starts
+reinterpretation of PR #197 as implementation authority
+```
+
+## Acceptance criteria
+
+- [ ] Schema-v5 recovery binds signed basis `bba4ba5f…` and names only PR #197 /
+      `WS-ART-001-PLAN2` / `03a05eeb…` as the recovered predecessor.
+- [ ] Activation names only `WS-ENG-007-00R6`; the target identity comes from
+      trusted GitHub merge evidence and must be direct-next on first-parent main.
+- [ ] Both merges carry successful merge-bound `agent-gates` and `test`
+      provenance; mutable reruns and CodeRabbit are not recovery authority.
+- [ ] Both temporary exemptions are consumed before signing and cannot persist,
+      replay, reorder, broaden, or authorize a third merge.
+- [ ] ART PLAN2 reconciles to stopped state with `WS-ART-001-03A` requiring an
+      explicit start; recovery starts no implementation or planning chunk.
+- [ ] Exactly one merge intent stops ENG-007 at its existing `01` gate.
+
+## Verification commands
+
+```bash
+PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 python3 -m pytest -q scripts/test_update_post_merge_memory.py scripts/test_check_loop_memory_state.py scripts/test_agent_gates.py
+python3 scripts/check_internal_review_evidence.py
+python3 scripts/check_markdown_links.py docs/operations_post_merge_memory.md .agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation
+python3 scripts/check_stale_workstream_wording.py
+python3 scripts/update_post_merge_memory.py validate-merge-intent --repository-root . --base-ref origin/main
+git diff --check
+```
+
+## Required reviewers
+
+- senior engineering
+- QA/test
+- security/auth
+- product/ops
+- architecture
+- CI integrity
+- docs
+- reuse/dedup
+- test delta
+
+## Human review focus
+
+Confirm the certificate is exact, first-parent adjacent, merge-evidence-bound,
+fully consumed, and incapable of starting ART PLAN2 successors or unrelated
+work.
+
+## Stop conditions
+
+Stop if recovery requires an intervening merge, wildcard authority, missing
+protected checks, persisted exemption, automatic successor start, or changes
+outside the allowed files.

.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/reviews/WS-ENG-007-00R6-internal-review-evidence.md

@@ -0,0 +1,70 @@
+# Internal Review Evidence: WS-ENG-007-00R6
+
+## Chunk
+
+`WS-ENG-007-00R6` — ART PLAN2 Signed-Memory Recovery
+
+open sub-agent sessions: none
+
+valid findings addressed: yes
+
+## Reviewed Revision
+
+Reviewed code SHA: 609be24d3b5a4825e9dd8f70f3f3f219d041b430
+
+Reviewed at: 2026-07-25T18:29:10Z
+
+After the reviewed SHA, only this evidence and trust reconciliation changed.
+
+Reviewer run IDs: senior-engineering=`ci02b_lane_runner`;
+QA/test=`ci02b_cr_arch`; security/auth=`ci02b_cr_ci`;
+product/ops=`ci02b_cr_docs`; architecture=`ci02b_cr_arch`;
+CI-integrity=`ci02b_cr_ci`; docs=`ci02b_cr_docs`;
+reuse/dedup=`ci02b_cr_reuse`; test-delta=`ci02b_cr_test_delta`.
+
+## Reviewer Results
+
+| Reviewer | Result | Blocking findings | Notes |
+|---|---:|---|---|
+| senior engineering | PASS | None | Direct-next merge and protected evidence remain operational prerequisites. |
+| QA/test | PASS | None | Exact basis, adjacency, consumption, replay, and stopped projections are covered. |
+| security/auth | PASS | None | Certificate is exact and non-reusable; final evidence was pending during review. |
+| product/ops | PASS | None | No product authority or lifecycle behavior changes. |
+| architecture | PASS | None | Existing closed schema-v5 recovery path is reused without a parallel mechanism. |
+| CI integrity | PASS | None | No workflow or gate weakening; merge-bound checks remain authority. |
+| docs | PASS | None | Runbook, map, status, contract, review log, and trust evidence agree. |
+| reuse/dedup | PASS | None | No new reducer, policy path, or exemption store. |
+| test delta | PASS | None | Exact policy assertion changed; no test was removed, skipped, or weakened. |
+
+The architecture/QA and docs/CI reviewers initially reported the expected
+absence of this final evidence file as blocking publication. This evidence and
+the paired trust bundle resolve that publication gate; they do not change the
+reviewed recovery behavior.
+
+## Commands Run
+
+```bash
+PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 python3 -m pytest -q scripts/test_update_post_merge_memory.py scripts/test_check_loop_memory_state.py scripts/test_agent_gates.py
+python3 scripts/check_internal_review_evidence.py
+python3 scripts/check_markdown_links.py docs/operations_post_merge_memory.md .agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation
+python3 scripts/check_stale_workstream_wording.py
+python3 scripts/update_post_merge_memory.py validate-merge-intent --repository-root . --base-ref origin/main
+git diff --check
+```
+
+## Results
+
+- 300 recovery, checker, and Agent Gate tests passed.
+- Merge-intent validation, Markdown links, stale wording, and diff integrity
+  passed.
+- Exact policy equality pins the signed basis, PR #197 identity, recovered
+  merge SHA, R6 activation, and schema version.
+
+## Remaining Risks
+
+- R6 must be the direct-next protected-main merge. Any intervening merge
+  invalidates the certificate and requires a new reviewed recovery plan.
+- Both target heads must retain merge-bound successful `agent-gates` and `test`
+  evidence.
+- Successful post-merge automation, not this PR, proves exemption consumption
+  and restored signed-state continuity.

.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/reviews/WS-ENG-007-00R6-pr-trust-bundle.md

@@ -0,0 +1,48 @@
+# PR Trust Bundle: WS-ENG-007-00R6
+
+## Intent
+
+Restore signed-memory continuity after unsigned planning merge PR #197 without
+granting ART, CI, AUTH, ENG, or product implementation authority.
+
+## Exact Scope
+
+- Signed basis: `bba4ba5f171a4438b072740707a5cf8bde49d9af`.
+- Recovered predecessor: PR #197 / `WS-ART-001-PLAN2` /
+  `03a05eeb8f129e0d5f226cc5c058965f43590a81`.
+- Activation: only `WS-ENG-007-00R6` as the direct-next main merge.
+- Successors remain stopped: ART at `WS-ART-001-03A`, ENG at
+  `WS-ENG-007-01`; CI-03 still requires its own signed planning start.
+
+## Reviewed Revision
+
+`609be24d3b5a4825e9dd8f70f3f3f219d041b430`
+
+## Evidence
+
+- 300 recovery, checker, and Agent Gate tests passed.
+- Policy regression asserts the complete schema-v5 object exactly.
+- Existing behavior tests prove signed-basis matching, ordered adjacency,
+  merge-bound check selection, exemption consumption, wrong-basis rejection,
+  and inert replay.
+- Merge intent, Markdown links, stale wording, and diff checks passed.
+
+## Reviewer Results
+
+All nine required internal tracks completed. No implementation blocker remains.
+CI/security and senior engineering retain only the operational risk that any
+intervening main merge or missing protected evidence invalidates recovery.
+
+## Human Review Focus
+
+- Confirm PR #197 is the only recovered merge.
+- Confirm R6 is direct-next on main before merging.
+- Confirm both recovered and activation heads have successful merge-bound
+  `agent-gates` and `test` evidence.
+- Confirm the policy and generated result contain no persistent exemption or
+  automatic successor start.
+
+## Stop Conditions
+
+Do not merge if main advances, required checks fail, the reviewed SHA changes
+outside evidence-only files, or recovery would need broader authority.

.agent-loop/merge-intents/WS-ENG-007-00R6.json

@@ -0,0 +1,9 @@
+{
+  "chunk_id": "WS-ENG-007-00R6",
+  "chunk_title": "ART PLAN2 Signed-Memory Recovery",
+  "initiative_id": "WS-ENG-007",
+  "next_chunk_id": "WS-ENG-007-01",
+  "next_chunk_title": "Reviewed Patch and Base-Delta Reconciliation",
+  "next_requires_explicit_start": true,
+  "schema_version": 2
+}

.agent-loop/policies/loop-memory-recovery.json

@@ -1,15 +1,15 @@
 {
   "activation": {
-    "chunk_id": "WS-ENG-007-00R5",
+    "chunk_id": "WS-ENG-007-00R6",
     "initiative_id": "WS-ENG-007"
   },
-  "signed_basis": "a3eecadcf847ac70fc28c58dad642f2d761015e0",
+  "signed_basis": "bba4ba5f171a4438b072740707a5cf8bde49d9af",
   "recovered_merges": [
     {
-      "chunk_id": "WS-ENG-007-00R4",
-      "initiative_id": "WS-ENG-007",
-      "merge_sha": "9bf16d478f669d48172810c83cdf6a7d2b8992ed",
-      "pr_number": 191
+      "chunk_id": "WS-ART-001-PLAN2",
+      "initiative_id": "WS-ART-001",
+      "merge_sha": "03a05eeb8f129e0d5f226cc5c058965f43590a81",
+      "pr_number": 197
     }
   ],
   "schema_version": 5

docs/operations_post_merge_memory.md

@@ -314,6 +314,25 @@ The ephemeral recovery-file transport preserves schema v1 at its original
 two-entry maximum; schema v2 is emitted only for this exact three-entry result
 and requires exactly three unique entries on every reload.
 
+## WS-ENG-007 ART PLAN2 Recovery
+
+`WS-ENG-007-00R6` uses the closed schema-v5 certificate after PR #197 merged
+planning chunk `WS-ART-001-PLAN2` without its required signed planning start.
+The certificate begins at signed basis
+`bba4ba5f171a4438b072740707a5cf8bde49d9af` and permits exactly this adjacent
+order:
+
+1. PR #197 / `WS-ART-001-PLAN2` /
+   `03a05eeb8f129e0d5f226cc5c058965f43590a81`;
+2. the direct-next `WS-ENG-007-00R6` activation merge.
+
+Both records require merge-bound successful `agent-gates` and `test` evidence.
+The two temporary exemptions are consumed before signing and cannot persist or
+replay. Recovery records ART PLAN2 as completed and stopped at its explicit
+`WS-ART-001-03A` gate; it does not start ART, CI, ENG, or any other successor.
+Any intervening main merge invalidates adjacency and requires a newly reviewed
+certificate.
+
 ## Historical WS-ENG-006 Exact Root Repair
 
 `WS-ENG-006-00` uses the closed two-merge recovery certificate to reconcile

scripts/test_agent_gates.py

@@ -2305,16 +2305,16 @@ def test_ws_eng_007_recovery_policy_is_exactly_pinned() -> None:
     policy = json.loads(Path(".agent-loop/policies/loop-memory-recovery.json").read_text())
     assert policy == {
         "activation": {
-            "chunk_id": "WS-ENG-007-00R5",
+            "chunk_id": "WS-ENG-007-00R6",
             "initiative_id": "WS-ENG-007",
         },
-        "signed_basis": "a3eecadcf847ac70fc28c58dad642f2d761015e0",
+        "signed_basis": "bba4ba5f171a4438b072740707a5cf8bde49d9af",
         "recovered_merges": [
             {
-                "chunk_id": "WS-ENG-007-00R4",
-                "initiative_id": "WS-ENG-007",
-                "merge_sha": "9bf16d478f669d48172810c83cdf6a7d2b8992ed",
-                "pr_number": 191,
+                "chunk_id": "WS-ART-001-PLAN2",
+                "initiative_id": "WS-ART-001",
+                "merge_sha": "03a05eeb8f129e0d5f226cc5c058965f43590a81",
+                "pr_number": 197,
             },
         ],
         "schema_version": 5,