fyaic · veil-chow-fyaic · Sep 1, 2026 · Sep 1, 2026
@@ -2,9 +2,9 @@
 
 Date: 2026-09-01
 
-Current reviewed `main`: `c17c83755c32647eae1a4ed70a075ff56bfc84a5`
+Latest attempted `main`: `e052299c3c0ff4f07f9a27dd23da421fbd95170a`
 
-Classification: three non-completing live attempts; no real autonomous pass
+Classification: four non-completing live attempts; no real autonomous pass
 
 ## Why this record exists
 
@@ -21,10 +21,13 @@ paused run into product evidence.
 | 1 | Product-probe validation rejected the observed adapter-owned product shape | Preflight rejection only; the mismatch was later addressed by [#126](https://github.com/fyaic/threadmesh/pull/126) | Not started | Not asserted by this record |
 | 2 | `threadmesh_durable_turn_intent_evidence_invalid` rejected a numeric Codex `completedAt` value | A real adapter boundary mismatch; Unix-second normalization was later addressed by [#127](https://github.com/fyaic/threadmesh/pull/127) | Not established | Not asserted by this record |
 | 3 | Operator paused the run after the five role sessions had bootstrapped | Five session bootstraps; coordinator counts remained task `0`, turn intent `0`, pump dispatch `0`, and audit event `0` | Not started | The signal path did not run normal cleanup; a one-off exact operator cleanup deleted and absence-confirmed five of five owned sessions and removed the temporary SQLite, WAL, journal, and run-root resources |
+| 4 | The first user-kickoff turn reached lifecycle publication, then failed `threadmesh_lifecycle_publication_action_mismatch` | Five registered tasks; one durable kickoff turn intent; no event-pump dispatch; the live model's selected tool arguments did not reproduce the coordinator-bound lifecycle material | Not started | Normal scenario cleanup deleted and absence-confirmed five of five sessions and removed the coordinator database, journals, and run root |
 
 The fixes in #126 and #127 do not retroactively change the evidence class of
-attempts 1 or 2. Attempt 3 is bootstrap and cleanup evidence only. None of the
-three attempts produced a completed `state=blocked` event-pump gate result.
+attempts 1 or 2. Attempt 3 is bootstrap and cleanup evidence only. Attempt 4
+is the first retained real kickoff/action-binding failure after all five tasks
+registered. None of the four attempts produced a completed `state=blocked`
+event-pump gate result.
 
 ## What the combined work established
 
@@ -36,7 +39,12 @@ three attempts produced a completed `state=blocked` event-pump gate result.
 - zero-to-five partially created role sessions can be represented honestly in
   cleanup evidence;
 - the interrupted attempt's exact ownership could be reconstructed for a
-  one-off cleanup without deleting unrelated user tasks.
+  one-off cleanup without deleting unrelated user tasks;
+- merged [#129](https://github.com/fyaic/threadmesh/pull/129) converts
+  `SIGINT`/`SIGTERM` into a cooperative shutdown checked after each role
+  bootstrap, after kickoff, and between event-pump dispatches;
+- attempt 4 exercised the normal five-role cleanup path successfully after a
+  post-bootstrap live failure, without one-off operator cleanup.
 
 These are valuable fail-closed and cleanup results. They are not evidence that
 real Codex sessions completed the proactive lifecycle chain.
@@ -59,14 +67,22 @@ cleanup behavior. The execution order was imbalanced: generalized durability,
 verification, Git evidence, and recovery work advanced before one uninterrupted
 real proactive chain was retained.
 
-Non-mainline expansion is now frozen. The next checkpoint is one fresh run on
-the existing `c17c837` surface with one user kickoff, zero runner phase or
-business prompts, zero runner direct activation dispatches, exact real
-session/turn/dispatch bindings, an irrelevant zero-turn control, and exact
-cleanup. Only a blocker observed by that run may interrupt this checkpoint.
-The missing bounded SIGINT/SIGTERM cleanup path is already observed and may be
-fixed before the rerun; it must not expand into a general process-supervision
-workstream.
+Non-mainline expansion is now frozen. The bounded signal cleanup fix is merged,
+and attempt 4 proved the normal post-bootstrap cleanup path. The next checkpoint
+is one fresh run after the exact tool-contract correction, with one user
+kickoff, zero runner phase or business prompts, zero runner direct activation
+dispatches, exact real session/turn/dispatch bindings, an irrelevant zero-turn
+control, and exact cleanup. Only a blocker observed by that run may interrupt
+this checkpoint.
+
+Attempt 4 then exposed the next direct blocker: the live model was asked to
+select `threadmesh_publish_artifact`, but the registered dynamic-tool schema
+did not tell it the exact coordinator-owned event and material required by the
+durable lifecycle binding. The bounded correction is to expose those already
+authorized arguments through phase-specific JSON Schemas. It does not relax
+the exact binding, add a new protocol field, or let final prose authorize an
+effect. A fresh run, not deterministic fixtures, must show whether this closes
+the blocker.
 
 A completed chain would still report `state=blocked` and
 `liveProductEvidence=false` while verifier custody and Git effects remain

@@ -25,17 +25,21 @@ kickoff while the runner supplies no later phase prompt or direct activation?
 
 The older product canary proved real multi-tool turns, same-A reuse, a bounded
 Git chain, controls, and cleanup, but its four prompts were runner-submitted.
-The newer event-pump gate has not completed a live chain. Its three attempts
-stopped at product-probe validation, timestamp evidence validation, and an
-operator pause after five-session bootstrap respectively. The paused attempt
-had zero coordinator tasks, turn intents, and pump dispatches before five of
-five sessions and exact temporary resources were cleaned.
+The newer event-pump gate has not completed a live chain. Its first three
+attempts stopped at product-probe validation, timestamp evidence validation,
+and an operator pause after five-session bootstrap. A fourth fresh attempt on
+`e052299` registered all five tasks and started the sole kickoff, then failed
+the exact lifecycle-action binding before any event-pump dispatch because the
+dynamic-tool schema did not expose the coordinator-bound arguments. Normal
+cleanup deleted and absence-confirmed all five sessions and removed the exact
+temporary resources.
 
 Execute in this order:
 
-1. Close the already observed bounded SIGINT/SIGTERM cleanup gap, then run the
-   current `c17c837` event-pump surface fresh. Do not add another prerequisite
-   that was not exposed by a live run.
+1. The bounded SIGINT/SIGTERM cleanup gap is closed by #129. Expose the exact
+   already-authorized lifecycle arguments through phase-specific tool schemas,
+   then run the event-pump surface fresh. Do not add another prerequisite that
+   was not exposed by a live run.
 2. Retain exact real session, native-turn, model-action, durable-dispatch,
    dependent-ordering, irrelevant-control, and cleanup evidence. The required
    behavioral counts are one kickoff, zero runner phase/business prompts or

@@ -62,7 +62,7 @@ until this outcome is demonstrated.
 | M5.2 Git evidence foundation | Independent temporary bare repo and role worktrees, same-worktree implementer fix, SQLite v5 evidence chains, SQLite v6 turn/cursor recovery, SQLite v7 bound verifier-only atomic unlock, private signed-result recovery journal, five controlled coordinator-reopen checkpoints, and a preconfigured-key child verifier bound to exact commits/finding/test | Deterministic safety, persistence, model-action receipt, authority, and coordinator-reopen recovery seams passed; integrated process-crash recovery and coordinator-driven real loop pending |
 | M5.2 real Codex model/tool canary | Five persistent roles; four real A/R/same-A/V turns; seven model-selected tool calls; exact two-commit chain; same-A identity/worktree; dependent and irrelevant zero-turn controls; five-of-five cleanup on base `1155fc8` | Canary completed; intentionally `blocked` with `liveProductEvidence=false` because the runner submitted four phase prompts and ThreadMesh performed no lifecycle handoff |
 | M5.2 autonomous no-plan fixture | One user kickoff; durable SQLite attention drives A→R→same-A→V→dependent; zero fixture-runner activation dispatches or phase/business prompts; zero manual relay and polling; pump starts protected receiver turns; trusted finalization precedes dependent turn; exact cleanup | Deterministic in-process fixture at `711da66`; per-dispatch recovery durable, global chain absent; OS kill/heartbeat/live products/external verifier pending |
-| M5.2 real event-pump attempts | Three attempts: product-probe rejection; timestamp-evidence rejection; operator pause after five-session bootstrap with task/turn/dispatch counts `0/0/0` | No proactive-chain evidence; attempt 3 established five-of-five session absence and exact temporary-resource cleanup only; M5.2 remains open |
+| M5.2 real event-pump attempts | Four attempts: product-probe rejection; timestamp-evidence rejection; operator pause after five-session bootstrap; exact lifecycle-action mismatch after five tasks and the sole kickoff registered | No event-pump dispatch or proactive-chain evidence; attempt 4 used normal five-of-five deletion, absence verification, and exact temporary-resource cleanup; M5.2 remains open |
 | Gemini CLI headless | Official package 0.56.0 integrity, required flags, isolated-home cleanup | Real no-model preflight passed |
 | Gemini live model behavior | Exact marker script requires explicit provider key | Not authorized, not run |
 | Multi-product admission | One mailbox/acceptance/claim/evidence path across ACP, Codex, and Gemini fakes | Merged experimental implementation |