ancongui · Oct 30, 2026 · Oct 30, 2026 · Oct 30, 2026 · Oct 30, 2026 · Oct 30, 2026
diff --git a/README.md b/README.md
diff --git a/docs/api.md b/docs/api.md
@@ -208,6 +208,9 @@ After grant confirmation, refresh the final-allowance candidate and include `cod
 | GET | `/runs/{id}/checkpoint-continuations/requests/{request_id}/candidate` | Inspect a retained checkpoint and original ticket without admitting work |
 | POST | `/runs/{id}/checkpoint-continuations/requests/{request_id}/actions/{action_id}` | Save a reviewed finite continuation on the same execution request |
 | GET | `/runs/{id}/checkpoint-continuations/requests/{request_id}/status` | Read the saved checkpoint-continuation action and worker status |
+| GET | `/runs/{id}/worker-completion-settlements/candidate` | Review eligible known-worker V1 or consumed-terminal V2 custody without settling output |
+| POST | `/runs/{id}/worker-completion-settlements/{request_id}` | Submit exact V1 settlement or strict V2 local-postprocessing consent under one saved request identity |
+| GET | `/runs/{id}/worker-completion-settlements/{request_id}` | Read the same retained settlement/recovery receipt without dispatch or resubmission |
 | GET | `/runs/{id}/final-outcome-continuations/requests/{request_id}/candidate` | Review an already-consumed final result and current eligibility |
 | POST | `/runs/{id}/final-outcome-continuations/requests/{request_id}/actions/{action_id}` | Save one same-ticket final-result acceptance action |
 | GET | `/runs/{id}/final-outcome-continuations/requests/{request_id}/status` | Read final-result acceptance status without another submission |
@@ -241,6 +244,14 @@ The [original-result recovery guide](recovery.md#explicit-closed-text-implementa
 
 The [uncertain run-submission guide](recovery.md#settle-an-uncertain-run-submission) explains exact admission, cancellation and decision readback. The same enabled user can read or settle cancellation with current read access after signing in again. Replaying admission also requires the original authentication method and current execution authority.
 
+### Consumed-terminal recovery
+
+Consumed-terminal recovery uses the existing worker-completion endpoint family
+with a strict `version: 2` request; there is no query selector or new execution
+grant. The Python SDK, CLI and MCP provide explicit V2 candidate, request and
+status operations. See [the guided recovery flow](checkpoint-verification.md#recover-a-consumed-terminal-result-after-failure)
+for the five digest bindings, required acknowledgments and lost-response readback.
+
 ## Use explicit recovery from the Python SDK
 
 `ForgeClient` exposes the same original-request and checkpoint contracts. Retain

diff --git a/docs/architecture.md b/docs/architecture.md
diff --git a/docs/checkpoint-verification.md b/docs/checkpoint-verification.md
@@ -195,3 +195,74 @@ The automatic producer changes the protected runtime and admission closure.
 Historical registered profiles remain unchanged; a fresh source-qualified
 profile and native transaction proof are required before adopting this source.
 The existing bulk-journal retention boundaries remain unchanged.
+
+
+## Recover a consumed terminal result after failure
+
+A failed run may already hold its complete final model output. Version 2 of the
+worker-completion settlement contract lets an authorized operator review that
+saved result and request its remaining local postprocessing. It does not ask the
+provider to produce the result again. The version-1 known-worker settlement
+contract above remains available for its original eligible runs.
+
+The shared candidate endpoint returns the contract supported by that run:
+`GET /api/v1/runs/{run_id}/worker-completion-settlements/candidate`. The V2 SDK,
+CLI and MCP adapters require a version-2 response. They refuse a version-1
+candidate instead of treating it as permission for this recovery.
+
+1. Review the candidate's run, task attempt, source and complete custody hashes.
+   The response contains references and digests, not the terminal report or
+   provider output.
+2. Choose and retain one request identifier. Submit the candidate, policy, run,
+   journal and proof digests with all three explicit acknowledgments to
+   `POST /api/v1/runs/{run_id}/worker-completion-settlements/{request_id}`.
+3. Read that same request path to follow `queued`, `claimed` and `accepted`.
+   If the submission response is lost, use this readback; do not select a new
+   identifier or automatically repeat the POST.
+
+The worker performs only the admitted local postprocessing of the known output,
+keeping the same task attempt. It then pauses before QA. An accepted receipt
+means that this recovery was accepted; it does not establish that the product
+passed verification or was released. Current authorization and the reviewed
+source, journal and custody bindings still apply. The request grants no new
+model calls, tools, verification, publication or execution authority.
+
+### Python SDK
+
+`ForgeClient.consumed_terminal_candidate(run_id)` reads the candidate.
+`request_consumed_terminal(run_id, request_id, request)` accepts the native
+`ConsumedTerminalInputV2` model or its exact JSON object.
+`consumed_terminal_status(run_id, request_id)` reads the receipt. The client
+validates the V2 contracts and the requested run/request scope before returning
+results; a POST receipt must also match the body that was submitted.
+
+### Operator CLI
+
+Use `forge consumed-terminal-completions candidate RUN` to review the saved
+candidate. Submission requires the five reviewed hashes and three explicit
+acknowledgments; there is no opaque input document or automatic candidate
+selection:
+
+```sh
+forge consumed-terminal-completions request RUN REQUEST \
+  --candidate-digest "$CANDIDATE_DIGEST" \
+  --policy-digest "$POLICY_DIGEST" \
+  --expected-run-digest "$RUN_DIGEST" \
+  --journal-digest "$JOURNAL_DIGEST" \
+  --proof-digest "$PROOF_DIGEST" \
+  --acknowledge-known-worker-output \
+  --acknowledge-no-execution-grant \
+  --acknowledge-local-postprocessing
+forge consumed-terminal-completions status RUN REQUEST
+```
+
+Replace `RUN`, `REQUEST` and the hash variables with the exact reviewed values.
+The CLI does not create additional authority or retry a failed delivery.
+
+### MCP
+
+`get_consumed_terminal_candidate` and `get_consumed_terminal_status` are
+read-only tools. `request_consumed_terminal` is explicitly mutating and exposes
+the strict version-2 input schema. All three call the same authenticated SDK and
+REST routes. They add no separate credentials or transport-based privileges.
+The descriptions are versioned resources in the packaged prompt catalog.
diff --git a/docs/knowledge.md b/docs/knowledge.md
@@ -13,7 +13,7 @@ The [framework refresh guide](framework-knowledge-refresh.md) covers the impleme
 
 ## Pinned service and SDK
 
-The managed installer verifies the published flycanon `26.10.6` server, source archive, runtime requirements and configuration before installation. forge uses the matching Python SDK. The server runs in a separate framework environment; its qualified pyfly `26.09.04` event contract does not replace forge's pyfly `26.10.7` dependency.
+The managed installer verifies the published flycanon `26.10.6` server, source archive, runtime requirements and configuration before installation. forge uses the matching Python SDK. The server runs in a separate framework environment; its qualified pyfly `26.09.04` event contract does not replace forge's pyfly `26.10.21` dependency.
 
 Workspace creation requires the body `id` to equal `X-Workspace-Id`. The knowledge connection selects the target workspace before creating it, including project-scoped learning workspaces. A mismatch returns `400 workspace_scope_mismatch` before storage or event publication. Existing credentials, corpora and saved run configuration retain their original state; upgrading the SDK does not authorize a retry of an unknown remote effect.
 

diff --git a/docs/model-profiles.md b/docs/model-profiles.md
@@ -106,15 +106,15 @@ The original MCP `save_task_routing` tool accepts only `bindings` and rejects `e
 
 The model writes the complete update: a specific title, an explanation, the available results and the next supported decision. forge applies Markdown formatting; it does not append the old status card. The pinned [Humanizer adaptation](agent-roles.md#pinned-community-instructions) is included in the actual agent instructions, and its revision and content digest are retained with the message.
 
-Each eligible update uses a tool-free drafting request and an independent semantic classification against the same facts. If the classifier finds unsupported claims or uncertainty, one additional AI request corrects the message and returns the final response. There is no second semantic veto or correction loop. All requests use the selected profile with SDK retries disabled. The draft allows 1,400 output tokens; the review allows 700. One total deadline, capped at 120 seconds, covers queue time and all requests. It does not restart for the review. The effective timeout is retained in the communication receipt. Use a 60-second profile timeout for local subscription workers; a shorter configured limit remains in force.
+Each eligible update uses a tool-free drafting request and an independent factual and editorial review against the same facts and current question. A factually accurate reply still needs correction if jargon, irrelevant recaps or repeated warnings obscure the answer. If the reviewer rejects the reply or finds a material uncertainty, one additional AI request corrects the message and returns the final response. There is no second semantic veto or correction loop. All requests use the selected profile with SDK retries disabled. The draft allows 1,400 output tokens; the review allows 700. One total deadline, capped at 120 seconds, covers queue time and all requests. It does not restart for the review. The effective timeout is retained in the communication receipt. Use a 60-second profile timeout for local subscription workers; a shorter configured limit remains in force.
 
-The fact packet contains the recorded state, active stage, recovery attempt, check totals and provenance, known source-safety blockers and native delivery state. A pending human decision also supplies a bounded, safely escaped quotation of the question, context and choices. The generated decision must preserve that quotation and every choice; it cannot supply an answer. Questions that cannot fit the public quotation bounds hold AI delivery rather than silently shortening the options. Customer briefs, raw errors, source, logs and credentials are withheld.
+The fact packet contains the recorded state, active stage, recovery attempt, check totals and provenance, known source-safety blockers and native delivery state. A pending human decision also supplies a bounded, safely escaped quotation of the question, context and choices. The generated decision must preserve that quotation and every choice; it cannot supply an answer. Questions that cannot fit the public quotation bounds hold AI delivery rather than silently shortening the options. The current human question reaches both writer and reviewer as quoted context, separate from execution authority. Arbitrary raw errors, provider summaries, source files and credentials stay private. Recorded final-check commands can supply selected diagnostic excerpts. Output excerpts are offered only for nonzero exit codes; successful output remains in the complete activity history rather than a status-card snippet. For eligible excerpts, local paths and destinations are removed, sensitive-looking assignments or private keys withhold the excerpt, and known-credential checks still apply. The model references an existing excerpt instead of generating code or a traceback.
 
-Native checks validate the message structure, citation identities, public quotation and current authority. A separate structured AI review classifies the complete candidate as supported, unsupported or uncertain. It checks meaning in context, including negations, numbers, saved versus current results, delivery claims and pending human decisions. It does not classify prose with keyword lists. A supported classification proceeds directly; otherwise the AI makes its single correction and responds, explaining missing information or asking a specific question when needed. The original review is explicitly bound to the original candidate; it is not relabeled as an independent approval of the correction. The receipt retains the candidate digest, review prompt digest, verdict, issues and rationale. This is a fallible model review, not independent product QA or proof of every sentence. With an AI profile selected, forge never substitutes a generic template. A provider outage, exhausted quota, malformed result or failed native authority/framing check holds delivery with its recorded reason, without a remote comment or automatic repeated model calls. A new explicit request can try again. Choosing recorded updates without an AI profile remains a separate configuration mode. There is no automatic provider substitution.
+Native checks validate the message structure, citation identities, public quotation and current authority. A separate structured AI review classifies the complete candidate as supported, unsupported or uncertain. It checks meaning in context, including numbers, saved versus current results, delivery claims, exact excerpts and pending human decisions. It also reviews whether the wording and structure explain the answer clearly. It does not classify prose with keyword lists. The reviewer must also supply five strict boolean `reader_checks`: `answers_question`, `relevant_detail`, `no_redundancy`, `plain_language` and `useful_excerpts`. A factual `supported` verdict proceeds directly only when all five pass. Any false check triggers the same single AI correction, even when the facts are supported. Missing, non-boolean or extra reader fields hold delivery; they are never treated as a pass. A factual refusal or uncertainty also triggers that correction, explaining missing information or asking a specific question when needed. The original review is explicitly bound to the original candidate; it is not relabeled as an independent approval of the correction. The receipt retains the candidate digest, review prompt digest, verdict, reader checks, issues and rationale. This is a fallible model review, not independent product QA or proof of every sentence. With an AI profile selected, forge never substitutes a generic template. A provider outage, exhausted quota, malformed result or failed native authority/framing check holds delivery with its recorded reason, without a remote comment or automatic repeated model calls. A new explicit request can try again. Choosing recorded updates without an AI profile remains a separate configuration mode. There is no automatic provider substitution.
 
 The receipt retains `feedback_intent.communication`: its mode and any hold reason, fact packet and digest, selected profile revision, prompt digest and applied skill provenance. The exact final body and its SHA-256 are saved before the remote comment is attempted. If the run changes while drafting, configured AI delivery is held without a template replacement or another automatic model call. Unknown remote delivery remains held for reconciliation; a second comment is not sent automatically.
 
-The same selection also controls the initial pull-request title and complete description. Its publication context adds the worker's bounded change summary and exact verified source-tree and checkpoint identities after credential admission. The summary is a worker report, not independent proof that the product works. Customer briefs, source and raw logs remain excluded. The selected profile uses the same tool-free drafting, separate classification and single-correction limit. Recorded mode keeps the recorded summary and check list without AI wording. In both AI and recorded modes, missing or invalid publication facts hold publication before any model call, separately from a selected provider failure.
+The same selection also controls the initial pull-request title and complete description. Its publication context adds the worker's bounded change summary and exact verified source-tree and checkpoint identities after credential admission. The summary is a worker report, not independent proof that the product works. Customer briefs, source and raw logs remain excluded. Publication writer and review templates use version `1.0.1`. Their five required reader checks assess the concrete PR objective, useful change and verification detail, absence of repetition, professional American English and relevant recorded excerpts. They use the same tool-free drafting, separate factual classification and single-correction limit. Recorded mode keeps the recorded summary and check list without AI wording. In both AI and recorded modes, missing or invalid publication facts hold publication before any model call, separately from a selected provider failure.
 
 Before publication intent or branch push, `publication_draft` retains the exact title, body, their SHA-256 digests and communication evidence. Current release authority, destination, source, checkpoint, checks and selected profile are checked again before push and before PR creation. A failed selected writer or changed facts before push hold publication with empty public text and no template fallback while the original execution owner and expected publication state remain current. Custody changes compare the saved draft, actor, status and PR URL; a stale owner cannot replace later custody with an empty hold or a late response. An existing publication intent or unknown remote outcome requires reconciliation; repeating the request does not regenerate a message or send another PR. Inspect the original draft and publication state before taking further action.