Fix post-apply stand-down and verify installed Herdr integration

[Steel-tech]

After a successful Stage 3 apply, the installed argument-free stand-down action failed with bookkeeping_unknown: its default abandonment reason is invalid for a terminal applied run. Default that state to normal_completion; preserve every other default, explicit reason refusal, journal boundary, close-identity check, and archive/replay rule. A regression reproduces the original failure and verifies refusal without effects, completed archival, target retention, and effect-free replay.

A fresh isolated Herdr 0.7.5 developer smoke reproduced the bug on bf67d318 and passed all seven installed actions on runtime candidate 0f0e907742292b733d3bb8cf569096fbe265beba, including argument-free stand-down and replay. The dated developer smoke record records exact scope and limitations. This is bounded developer observation with synthetic work and operator-authored reports, not a formal independent-human release review or replacement for historical evidence.

Update README and readiness guidance to distinguish this fresh bounded developer smoke from the separate formal release-evidence contract. Earlier validation/readiness changes are already merged in PR #6. Package/manifest remain 0.4.0 with exactly Herdr 0.7.5/protocol 17/schema 1 support.

Validation:

• New stand-down regression failed before the fix and passes on Node 20.
• Node 24 targeted Stage 3 actions/lifecycle checks: 21/21 passed.
• Fresh isolated installed-action smoke: seven actions, single apply target transition, receipt consumption before publication, two worker panes closed, three worktrees retained, replay without another target move.
• Documentation, manifest, historical evidence, ShellCheck, pinned Actionlint, and diff checks passed.
• Full updated Node 24.18.0 npm run check: 543/543 tests passed, zero failures, with all subsequent shell/Python/manifest/docs/historical-evidence checks passing. Both current final-head CI workflows (push and pull request) are fully green. Linux Node 20/LTS and macOS Node 20/system Bash 3.2 each pass 543 full-check tests and 497 explicit Stage 2/3 matrix tests, with zero failures.
• Independent agent code and evidence/sanitization reviews by Guard found no actionable defects. No substantive CodeRabbit review is claimed; its success status accompanies a rate-limit notice.

Base: fb835bb6722a05ada181e766aea698fed683d50c (includes merged PR #6). Final head: ad170ee8e00be8979a7e1ae20bc6375e5e6f94d3. Runtime change is limited to selecting the already-legal default stand-down reason from the observed applied state. No new effect/crash/recovery boundary is introduced. Source/security/private-state/role contracts and historical evidence remain unchanged; the new developer record has its own path and does not assert validation by the formal release checker.

Limitations remain cooperative same-UID records, final-check/pane-close TOCTOU, assertion-only worker results, retained resources, SHA-1-width Git, and no ambiguous-operation recovery outside the bounded Stage 3 apply publication. The fresh smoke does not prove adversarial same-UID isolation, autonomous model work, arbitrary workloads, or live crash recovery. No suite adapter, unattended operation, product cleanup, Browser integration, site code, push/tag/release automation, CI configuration, or security-policy behavior change is included. Suite website updates are separate.

[coderabbitai]

Warning

Review limit reached

Next included review available in 5 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 3342c7c8-d013-4db9-bd9c-877f1d7fbfe5

📥 Commits

Reviewing files that changed from the base of the PR and between fb835bb and ad170ee.

📒 Files selected for processing (5)

• README.md
• docs/evidence/2026-09-14-developer-installed-action-smoke.md
• docs/readiness.md
• scripts/stage1-runtime.mjs
• tests/stage3-actions.test.mjs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}