S6 - Adjudicate and recover the 359 parked refs

Goal

Drive the plan’s north-star gate: every parked ref reaches exact-head or an explicit reviewed disposition.

Why this section exists

S1-S5 delivered the durability machinery and the forensics. They did NOT recover the parked work, and the measurement below is what makes that a mission gap rather than a cleanup task.

Measured state (2026-07-24, queue-audit --json both repos)

• ZERO refs are exact-in-head, so NONE is auto-droppable and the gate cannot be reached by retirement.
• missing means the parked change never arrived in HEAD: those 220 side-refs are the ONLY surviving copy of that work.
• Re-measure before acting; these counts are a starting point, not a contract.

The human decision this section is blocked on - ABSOLUTE

Two questions are NOT the automation’s to answer, and no consensus between review agents substitutes for them:

1. REVIEW GRANULARITY. Landing 220 recovered changesets as one branch asks one approval to stand for months of unrelated work. Per-ref, per-cluster, and single-branch are all defensible; the choice belongs to whoever reviews it.
2. AUTHORIZATION BOUNDARY. Who may issue a LandingAuthorization, and against which target branches.

Until both are answered and RECORDED in this body, only read-only remeasurement runs. See ## Ordering.

Ordering - ABSOLUTE

Exactly ONE ordering governs this section, and every other statement defers to it:

1. BEFORE the decision, ONLY read-only remeasurement is permitted. queue-audit and the freeze+enumerate manifest read state and write nothing outside this repository.
2. AFTER the decision is recorded in this body, and not before: publish+verify backups, dedup, integrate in a throwaway clone, produce the per-ref disposition record.
3. Landing into a shared target and dropping any ref require the recorded decision AND, per landing, an exact-SHA LandingAuthorization.

This ordering BINDS every work item, including any whose own wording predates it. w-9b6688be names enumeration and publication together; enumeration is step 1 and may run now, while its publish/dedup/integrate steps are step 2 and run only after the decision is recorded. Where an item and this section disagree, the more restrictive reading governs.

Publishing recovery refs is ADDITIVE and destroys nothing, but it is still a live external write, so it sits after the decision rather than before it. An earlier revision of this section described that step as runnable without the decision while the first work item required the decision first; the two readings gave opposite answers to the exact boundary this section exists to fix, so the permissive one is removed rather than reconciled.

After the decision - the recovery pass

• Publish + verify backups to the recovery namespace (recovery_remote.publish_and_verify).
• Dedup on tree-OID identity; integrate survivors on a recovery branch in a throwaway clone.
• Produce a per-ref disposition record so queue_zero_verdict can be evaluated over the full manifest.

Blocked on the decision

• Any live remote publication or integration (the steps immediately above).
• Landing any recovery branch into a shared target. land_recovery_branch already fails closed without an exact-SHA LandingAuthorization; that gate is the mechanism, not the decision.
• Dropping any ref. No verdict here is auto-droppable, so every retirement needs an explicit reviewed disposition.

Verification

• Scope is TOOLING; L1-L11 are N/A (no .ori corpus, no compiler-runtime surface).
• The gate is the plan-wide functional criterion: the parked-ref count, re-measured by queue-audit, with every remaining ref carrying a recorded disposition.
• Never infer queue-zero from an empty eligible set - that is the stranded-entry trap this plan opened with.

Work Items

• Obtain the human decision on review granularity and the authorization boundary, and RECORD it in this section body before any live publication. This item is complete only when both questions are answered by a human; it is not satisfiable by agent consensus.
• Re-measure both queues with queue-audit —json and record the current verdict mix; the 359/220/139/0 figures above are a starting point, not a contract.
• Run the SAFE prefix end to end: freeze+enumerate, publish+verify backups, dedup, integrate in a throwaway clone. Produce the per-ref disposition record. Land nothing.
• Evaluate queue_zero_verdict over the full ref-driven manifest and report which refs still lack a disposition.