docs(governance): document 2.2.3 autonomy guarantees in README (ticket-209)

README.md

@@ -75,6 +75,32 @@ without writing; reviewed managed-file upgrades require `--upgrade`. See
 [`docs/governance-adoption.md`](docs/governance-adoption.md) for the retrofit
 workflow and remaining project-local Docker/ticket steps.
 
+## 🆕 What's New in v2.2.3
+
+> **Autonomous publication completion** — governed `goal -a` now finishes the
+> release it was waiting for, and cannot corrupt a frozen configuration.
+
+- **Publication completion.** On a clean, synchronized base with a
+  pre-bumped release, `goal -a` completes the registry publication (upload +
+  summary) without creating a commit and reports
+  `publication completed on the synchronized base; no pull request needed`.
+- **Registry-baseline fallback.** When a publish-only release leaves no tag on
+  the base branch, a tree version newer than the published registry version
+  counts as pending publication, so the completion still fires.
+- **Cache-safe discovery.** Version-file discovery skips tooling caches and
+  governed runtime state (`.pytest_cache`, `.subactor`, `.worktrees`);
+  release-evidence snapshots are never learned as version carriers, and an
+  explicit non-empty `versioning.files` projection is authoritative.
+- **Frozen config guarantee.** Governed targets load `goal.yaml` from every
+  command, so auto-detection can no longer rewrite a protected configuration
+  as a side effect of `goal publish` or other subcommands.
+- **Dynamic version contracts.** A `__version__` assignment with a non-literal
+  right-hand side is observed, not managed — repositories with dynamic
+  discovery (e.g. heyasa) run the release workflow without selector errors.
+- **Actionable boundary.** Unreleased sources after the last tag fail with
+  "requires a release ticket … run goal -a from its ticket branch" instead of
+  the confusing clean force-publish validation.
+
 ## 🆕 What's New in v2.2.2
 
 > **Monorepo sweep** — run the full `goal -a` workflow across every git repository with uncommitted changes under a folder, in one command.

project/TICKETS.md

@@ -275,4 +275,5 @@ This file indexes governance tickets without taking ownership of
 | **ticket-206** | [`README.md`](./ticket-206/README.md) | - | - | - | - | - |
 | **ticket-207** | [`README.md`](./ticket-207/README.md) | - | - | - | - | - |
 | **ticket-208** | [`README.md`](./ticket-208/README.md) | - | - | - | - | - |
+| **ticket-209** | [`README.md`](./ticket-209/README.md) | - | - | - | - | - |
 <!-- AUTO:TICKET_INDEX:END -->

project/ticket-209/README.md

@@ -0,0 +1,24 @@
+# Ticket 209: Document 2.2.3 autonomy guarantees in README
+
+- **ID**: ticket-209
+- **Owner**: ai-claude
+- **Status**: IN_PROGRESS
+- **Workflow state**: EDIT
+- **Created**: 2026-10-25
+
+## Goal and scope
+
+Governance-owned README section "What's New in v2.2.3" documenting the
+autonomous publication completion, registry-baseline fallback, cache-safe
+discovery, frozen-config guarantee, dynamic __version__ contracts and the
+actionable unreleased-sources boundary delivered by tickets 196 and 199-205.
+
+## Acceptance criteria
+
+- [ ] AC-01: README contains the v2.2.3 section above v2.2.2 with accurate behavior.
+- [ ] AC-02: Governance check passes; tests unaffected.
+
+## Tracking boundary
+
+This directory contains the minimal reviewed intent. Optional participant prose
+and raw command logs are not required delivery output.

project/ticket-209/intent.json

@@ -0,0 +1,79 @@
+{
+  "schema": "new-project.intent/v3",
+  "ticket": "ticket-209",
+  "summary": "Document 2.2.3 autonomy guarantees in README",
+  "workstream": "governance",
+  "classification": {
+    "kind": "SERVICE",
+    "priority": "P2",
+    "origin": "requested"
+  },
+  "allowedPaths": [
+    "project/ticket-209/**",
+    "TODO.md",
+    "project/TICKETS.md",
+    "README.md"
+  ],
+  "forbiddenPaths": [
+    "project/ticket-*/user-*.md"
+  ],
+  "stacks": [],
+  "dependsOn": [],
+  "conflictsWith": [],
+  "integrationTicket": null,
+  "delivery": {
+    "acceptedBaseSha": "6235d30e493ba95fc9b8a6345be5539bae82aef1",
+    "targetBranch": "main",
+    "outcome": "README documents the 2.2.3 autonomy guarantees (publication completion, registry fallback, cache-safe discovery, frozen config, dynamic version contracts, actionable boundary).",
+    "nonGoals": [
+      "No source or version changes",
+      "No CHANGELOG edits in this ticket"
+    ],
+    "complexity": "S",
+    "estimatedMinutes": 20,
+    "budgets": {
+      "maxImplementationFiles": 2,
+      "maxAffectedComponents": 1,
+      "maxPublicInterfaceChanges": 0,
+      "maxRuntimeDependencies": 0
+    },
+    "architecture": {
+      "status": "accepted",
+      "decision": "Documentation-only delta in the existing What's New series.",
+      "components": [
+        {
+          "name": "goal-readme",
+          "paths": [
+            "README.md"
+          ]
+        }
+      ],
+      "responsibilityChanges": false,
+      "interfaceChanges": [],
+      "dataChanges": [],
+      "ui": {
+        "impact": "none",
+        "states": [],
+        "evidence": []
+      },
+      "rollback": "Protected revert of README.md; no data migration."
+    },
+    "runtimeDependencies": [],
+    "validation": [
+      {
+        "criterion": "AC-01",
+        "commands": [
+          "git diff shows only README.md delta besides ticket carriers"
+        ],
+        "evidence": "receipt:goal209/readme"
+      },
+      {
+        "criterion": "AC-02",
+        "commands": [
+          "./project/governance-check.sh"
+        ],
+        "evidence": "receipt:goal209/governance-check"
+      }
+    ]
+  }
+}