§1 — Why

The crew ledger (docs/state/<project>/crew.json) is appended to by every orchestrator session on this workstation, and the live pointers under <config-home>/crew/live/ are mutated by observe, attach, stop and resume — yet neither store has any concurrency control beyond an optimistic version integer whose check-and-write is itself racy. The fleet review demonstrated by execution that a merge-conflicted ledger silently loads as empty at version 0 and the next promotion overwrites the whole run history. Pushing more concurrent work through workers makes every one of these windows wider, so this plan gates the throughput work.

✓ landed 2026-08-16

§2 — Deliverables

All five deliverables landed in commits 22074d2 and bcc11e2: locked writer-unique envelope writes (2 and 8 simultaneous writers land consecutive versions), typed corrupt-ledger refusal naming the recovery, jittered retry backoff, duplicate-promotion recovery plus reckon crew discard, and per-run-locked pointer mutations. 8 tests added; full suite 1875 passed, 0 failed on the integrated tree. Full record: landed record.

§ Decisions

What should a writer do when the committed ledger is unparseable?

Refusal is safest but blocks promotion until a human repairs the file; quarantine (move aside, start fresh, surface loudly) keeps the fleet moving but risks the aside copy being forgotten.

The plan's own §2 deliverable prose commits to refusal ('ledger.load and every writer refuse to write over an unreadable ledger; the error message names the recovery'), and the sprint item's done-when is 'a corrupt ledger refuses instead of resetting'. Quarantine would contradict both. Refusal is recoverable in one human step (fix conflict markers or restore from git) and the error message is required to name that step.

§ Followups

Implement ledger and pointer write safety

All five deliverables in §2; the corrupt-ledger reset and the shared-temp-name race have demonstrated reproductions in the fleet review to turn into regression tests first.

/reckon-ship crew-state-integrity

All five §2 deliverables landed and demonstrated under test across commits 22074d2 and bcc11e2: locked writer-unique envelope writes (consecutive versions under 2 and 8 concurrent writers), typed corrupt-ledger refusal naming the recovery, jittered retry backoff, duplicate-promotion recovery plus crew discard, and locked pointer read-modify-write. Sprint gate measures all produced. done — no followup

envelope-write-safety landed — commit 22074d2; gate passed; measures: two simultaneous append_run writers landed consecutive versions 1,2 and eight racers landed 1–8; conflicted ledger now refuses via CorruptEnvelopeError naming file+recovery instead of resetting history; jittered backoff (12 attempts, 50ms cap) on append_run/record_hold_checks; 4 tests added, focused 78 passed, full suite 1869 passed. Evidence: docs/evidence/archive/crew-state-integrity-landed.html#envelope-write-safety
pointer-lifecycle-recovery landed — commit bcc11e2; gate passed; measures: ledgered-but-pointered run clearable via complete() (already_promoted=true, pointer unlinked) and via new crew discard (refuses while pid alive, prints what it removed); attach/observe/stop/resume/complete/discard serialize through a per-run pointer lock with writer-unique temp files; forced observe-before-attach interleaving preserved the task binding; 4 tests added, focused 84 passed, full suite 1875 passed on the integrated tree. Evidence: docs/evidence/archive/crew-state-integrity-landed.html#pointer-lifecycle-recovery