fix: deterministic reconciliation tooling and primary write lease

docs/process-hardening.md

@@ -12,8 +12,14 @@ The reusable procedure is [`docs/reconciliation-playbook.md`](reconciliation-pla
   cleanup. It uses cached Git refs, never fetches, and reports primary/worktree dirty state,
   detached worktrees, ahead/behind counts, and operation markers. Add `--include-processes` only
   when ownership could block cleanup; that path emits metadata/counts and never raw command lines.
-- `workflow:lifecycle -- --phase reconcile` selects the preflight locally and lists remote fetch as
-  a separate approval-required action.
+- `node scripts/reconciliation-evidence-pack.mjs --output <path>` writes one deterministic secret-safe
+  local evidence pack (atomic) covering dispositions, markers, archive refs, bundle verification,
+  hashes, worktree counts, and local/base tree equality without fetching or deleting.
+- `node scripts/primary-checkout-lease.mjs --check` is the cooperative primary-write gate: refuse a
+  second primary writer while another live owner or dirty/operation state exists; keep read-only
+  work and independent feature worktrees unblocked.
+- `workflow:lifecycle -- --phase reconcile` selects the preflight and evidence pack locally and lists remote fetch as
+  a separate approval-required action. `start`/`cleanup` select the primary-checkout lease check.
 - Candidate filtering is cheap-first: owner/open-PR/review-ledger/ancestry before patch comparison;
   `merge-tree` remains a last resort. This avoids repeating the slow all-ref sweep that dominated the
   historical reconciliation.

docs/productivity-workflows.md

@@ -24,9 +24,13 @@ The repository exposes seven offline-first workflow planners. Each planner inspe
 - Use `-- --files pathA,pathB` to plan an explicit proposed change before editing.
 - Use `workflow:triage -- --log <path>` to classify a captured failure.
 - Use lifecycle phase `reconcile` for broad multi-worktree work. It selects the report-only
-  `node scripts/reconciliation-preflight.mjs` locally and keeps `git fetch --prune origin` approval-gated. Add
+  `node scripts/reconciliation-preflight.mjs` and
+  `node scripts/reconciliation-evidence-pack.mjs --output .local/reconciliation-evidence/pack.json`
+  locally and keeps `git fetch --prune origin` approval-gated. Add
   `--include-processes` to the preflight only when process ownership may block cleanup; it never
-  serializes raw command lines.
+  serializes raw command lines. Lifecycle `start`/`cleanup` select
+  `node scripts/primary-checkout-lease.mjs --check` so primary writes fail closed under another
+  owner or dirty/operation state without blocking read-only or feature worktrees.
 
 The existing shared `workflow:run`, `workflow:status`, `workflow:verify`, `workflow:deps`, `workflow:clean-state`, `workflow:export`, and `workflow:handoff` commands now resolve their shared implementation through the repository's Git common directory. This keeps them portable in linked and detached Codex worktrees. Set `CODEX_LOCAL_WORKFLOW_ROOT` only when the shared tools live somewhere non-standard.
 

docs/reconciliation-playbook.md

@@ -9,12 +9,27 @@ focused verification path.
 ```powershell
 npm run workflow:lifecycle -- --phase reconcile --write-evidence
 node scripts/reconciliation-preflight.mjs
+node scripts/reconciliation-evidence-pack.mjs --output .local/reconciliation-evidence/pack.json
 ```
 
 The preflight is local, read-only, and cached-ref-only. It inventories the primary checkout,
 worktrees, dirty entries, detached state, ahead/behind counts, and Git operation markers. It never
 fetches, scans providers, deletes anything, or treats a preserved branch as approved.
 
+The evidence pack writes one deterministic JSON report (atomic rename) with frozen base/HEAD,
+per-worktree dispositions, operation markers, archive refs, optional bundle path/size/SHA-256/verify,
+retained worktree counts, and local/base tree equality. Secrets are redacted; interrupted runs leave
+only a `.partial` file, never a false completion record at the final path.
+
+Before any primary checkout write, branch switch, fast-forward, or cleanup:
+
+```powershell
+node scripts/primary-checkout-lease.mjs --check
+```
+
+That cooperative lease refuses a second primary writer while another live owner or dirty/operation
+state exists. Read-only commands and independent feature worktrees stay unblocked.
+
 When process ownership may block cleanup, add the explicit process check:
 
 ```powershell

package.json

@@ -181,6 +181,9 @@
     "workflow:rag-lab": "node scripts/productivity-workflow.mjs rag-lab",
     "workflow:operator-closeout": "node scripts/productivity-workflow.mjs operator-closeout",
     "workflow:lifecycle": "node scripts/productivity-workflow.mjs lifecycle",
+    "reconciliation:preflight": "node scripts/reconciliation-preflight.mjs",
+    "reconciliation:evidence-pack": "node scripts/reconciliation-evidence-pack.mjs",
+    "check:primary-checkout-lease": "node scripts/primary-checkout-lease.mjs --check",
     "skill:create": "node scripts/skill-create.mjs",
     "branch:cleanup": "node scripts/sweep-merged-branches.mjs",
     "skills": "node scripts/list-database-skills.mjs",