Crew State Integrity — cumulative execution record

One anchor per landed node. Each entry records the commit, the gate measure as executed, the tests, and anything negative found on the way. The evergreen plan holds the design; this record holds what actually happened.

Envelope write safety (locked writes, corrupt refusal, retry backoff)

Commit 22074d2ab1ba978d86050496b853a85ea88c9c58 (2026-08-16, worker codex-a, 479 s, 217 insertions / 27 deletions over reckon/_store.py, reckon/ledger.py, tests/test_store_concurrency.py, tests/test_ledger.py).

• Locked, writer-unique envelope writes. JSON envelope writers hold a path-keyed exclusive lock across the whole read-compare-write cycle and each writer uses its own temporary file. Measure: two simultaneous append_run writers against one ledger landed with consecutive versions 1 and 2; eight simultaneous racers all landed, versions 1 through 8.
• Corrupt-file refusal (decision corrupt-ledger-policy = refuse). An unparseable or structurally invalid envelope now raises CorruptEnvelopeError naming the file, the parse failure, and the recovery (fix the conflict markers or restore from git). Measure: the demonstrated conflicted-ledger-then-promote scenario refuses and leaves both the corrupt ledger bytes and the live pointer intact, instead of loading as empty and overwriting history. Absent files still start fresh at version 0.
• Retry backoff. append_run and record_hold_checks retry with jittered exponential backoff capped at 50 ms, 12 attempts by default (previously 5 immediate attempts).

Tests: 4 added; focused run 78 passed; full suite 1869 passed, 0 failed (88 s). Logs: ~/.config/reckon/crew/runs/r-20260816T204725505930-envelope-write-safety/logs/.

Pointer lifecycle recovery (duplicate promotion, discard, locked pointer writes)

Commit bcc11e2b1d469fd3d798cbc152c6d5f4a0719c2a (2026-08-16, worker codex-a, 578 s, 368 insertions / 96 deletions over reckon/crew.py, reckon/cli.py, tests/test_crew.py; fast-forwarded).

• Duplicate-promotion recovery. complete() detects an existing ledger record for the run id, reports already_promoted=true, and removes the surviving pointer without duplicating the ledger record. Measure: a ledgered-but-pointered run is clearable instead of raising forever.
• reckon crew discard. Removes a live pointer without promoting, prints the removed record and pointer path, leaves the ledger unchanged, and refuses while the recorded pid is alive.
• Pointer write discipline. attach, observe, stop, resume recording, completion and discard all coordinate through a per-run pointer lock and publish through writer-unique temporary files. Measure: a forced observe-before-attach interleaving preserved the task binding.

Tests: 4 added; focused run 84 passed (9 s); full suite 1875 passed, 0 failed (81 s) on the tree that already contained both earlier landings — this run is the integrated-suite evidence for the plan gate. Logs: ~/.config/reckon/crew/runs/r-20260816T205950003711-pointer-lifecycle-recovery/logs/.