release: v0.30.6 — review-boundary supervisor notifications, fail-closed review gate, verified recovery

[HenryLach]

release: v0.30.6

Patch bump (semver): bug fixes and additive, backward-compatible behaviour — no breaking API/config changes. The one operational change is fail-closed by design (see migration note).

Highlights

• Review-boundary supervisor notifications — every review start/end surfaced with disposition, round and severity trend; spiral detection + adjudication signals (steer-delivered). Live-verified on Penster (three feedback rounds folded in).
• Review gate can't fail open (bug: review-boundary path emits spurious "Reviewer unavailable" (review_failed) on every successful review (0.30.5) #624): review_step APPROVE only from an explicit Verdict line; no spurious "Reviewer unavailable"; finalize refuses .DONE over an outstanding REVISE/RETHINK (feat(gate-integrity): task must not finalize succeeded while steps lack an explicit APPROVE in their review files #626 minimal) with a real remediation path (orch_retry_task resets the task record but not the v2 segment record, so orch_resume skips the wave (single-wave batch cannot be re-driven after a finalize-gate refusal) #629).
• Recovery actually works: retry resets v2 segment records (orch_retry_task resets the task record but not the v2 segment record, so orch_resume skips the wave (single-wave batch cannot be re-driven after a finalize-gate refusal) #629); a replacement supervisor can resume an inherited batch under one verified engine-ownership gate (Replacement supervisor cannot orch_resume the batch it inherits: activation imports phase 'executing' into memory and the in-memory guard overrides disk eligibility #631); holds are hold-aware with an explicit acknowledgement contract (Worker exits when an expectsReply escalation times out; lane-runner does not relaunch it and registry/lane state stay 'running' #630); pause never skips tasks or completes the batch, and resume merges succeeded-but-unmerged work (orch_pause on an owned batch converted a held task to skipped, completed the batch 0/1 and removed its worktree #633).
• Safety: worktree cleanup refuses to destroy uncommitted work (supervisor_takeover destroys the paused lane: task marked skipped, batch completed 0/1, worktree+branch removed, uncommitted work lost #628 minimal); audit trail via log_recovery_action (bug(supervisor): actions.jsonl timestamps are fabricated by the LLM — no tool exposes logRecoveryAction() #625); engine no longer crashes Pi on a stale ctx (fix(orch): engine-worker IPC crashes Pi on stale extension context #620); no stale integration prompts (Auto-integrate: suppress "Ready for integration / run orch_integrate()" banner when the batch already auto-integrated #610).

Issues closed / advanced

Closes #620, #624, #625, #629, #610, #633. Advances #626, #628, #630, #631 (Tier-2 scope remains open on each; see issue comments).

Migration note

Batches created before 0.30.6 have no engine.json; the first recovery tool or fresh /orch against one refuses until /orch-confirm-engine-shutdown [--batch <id>] <note> records an out-of-band verification (once per legacy batch). New batches never need it.

Validation

• Full suite 3957 pass / 0 fail / 1 skip; typecheck, format, lint (284 warnings — below the 286 baseline) clean; CLI help/doctor OK.
• TP-114 smoke run end-to-end; three Penster live batches (20260906T194514, 221045, follow-up) on the deployed build with no detrimental outcomes.
• Every risky seam Sage-reviewed to sign-off (Replacement supervisor cannot orch_resume the batch it inherits: activation imports phase 'executing' into memory and the in-memory guard overrides disk eligibility #631: nine rounds; pause fix: seven).