Sync Boatstack from Intelligence Flow Labs @ 4dcec85043e6

[operator-stack-publisher]

What this sync releases

repair-state recovery for stuck malformed drafts

The repair-state recovery the guard prescribes is now real and reachable. When an unregistered feature draft is authored by hand — a plan.md that never passed through the helper, so there is no plan.lock.json and no delivery state — a malformed plan makes the guard fail closed at INVALID_STATE and deny every product mutation. Previously repair-state existed only as a next_operation label: it was neither implemented as a helper subcommand nor allowlisted in the guard, so the prescribed recovery was itself blocked and even rm of the untracked directory was denied. The workflow was stuck behind the lock the recovery was meant to open.

boatstack-helper repair-state [--feature <slug>] now quarantines the offending draft: it moves the directory out of .product-loop/features/ into <git-common-dir>/boatstack/quarantine/<feature>/<timestamp> (reversible, never a hard delete) and returns the workflow to auto-plan. When --feature is omitted it resolves the sole malformed unregistered candidate and refuses ambiguously when more than one is present.

Recovery is bounded and self-guarding. It acts only on a directory that carries no durable authority: it refuses any feature with a valid saved plan, a plan.lock.json, a pr.md, a managed delivery state, git-tracked files, or an active/published delivery. The guard allowlists repair-state independent of stage but still rejects shell metacharacters and non-helper executables, and gating for registered, active, or published deliveries is unchanged — an unregistered malformed draft still blocks product mutation, but the escape hatch is now genuine and one command away.

Projection provenance

Generated from operatorstack/intelligence-flow@4dcec85043e6fec7558e7bdff97cb2babe3af7c2.
Review provenance, tests, and examples before merging.