G-171 note: publish command owns artifact-revision derivation

Extends the dirty-bake provenance follow-on's publish-command endpoint with
the -r<N> derivation duty (user question 2026-08-08: must -Dlibrev be
manual?): the build recipe cannot safely self-derive (deliberate-publish
discipline, no configure-time mutable-state inputs, rev-inside-artifact
means comparison must build AT the published rev and sha1-compare);
publish verdicts current / bump to max+1 / alpha in-situ replace, asserted
on a checked claim. Records the recipe-default-as-published-state
convention (familyrev precedent) and librev's observed drift as the manual
failure mode - default+comment repair due at the r2 publish. goals_lint
clean.

Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com

goals/G-171-bake-writes-land-untracked.md

@@ -243,7 +243,27 @@ types abort with a stated reason.
   homes: the stamp/payload (determinism principle - phantom staleness across
   history, no truthful value in the sanctioned step-(6)-(8) dirty window) and
   the artifact filename (breaks name-keyed deploy/ledger machinery,
-  retroactively false mid-sequence).
+  retroactively false mid-sequence). Extended 2026-08-08 (artifact-revision
+  derivation - user question "must -Dlibrev be manual?"): the same publish
+  command owns lib/family -r<N> revision derivation. The build recipe cannot
+  safely self-derive: revisions bump only on deliberate publish (never per
+  rebuild - auto-increment mints phantom revisions), configure-time probes of
+  the punkbin store would add network/mutable-state inputs (the volatility
+  class the artifacts ban), and the rev rides INSIDE the artifact (the -rN
+  name seeds build_id and the record's revision key), so content-vs-published
+  comparison must build AT the published rev and sha1-compare against the
+  published sidecar - a candidate at rN+1 can never hash-match rN. Publish
+  command verdicts: current (no-op) / differs -> emit at max+1 / differs ->
+  alpha in-situ replace (the punkbin dispensation while zero 3rd-party
+  consumers) - a policy fork the operator asserts on a checked claim, the
+  -expect-projectversion philosophy applied to revisions. Companion
+  convention (the repo's existing half-implementation): the recipe's -D
+  default IS the committed record of published state, bumped in the same
+  work unit as each publish - the familyrev precedent (default 2, "r1
+  published 2026-07-22") - and librev's drift proves the manual failure mode
+  ("default 1 - nothing published yet" while tcllib2.0-*-r1 is published);
+  repair librev's default+comment at the r2 publish, and the publish command
+  stages that default bump inside its one reviewable unit.
 - Approach 10 message-shape template updated 2026-08-08 (git b729ce07 / fossil
   55a54d8b, project 0.65.1): the stale_bootsupport gate it cites now emits via a
   shared helper, punkboot::lib::bootsupport_stale_warning - mechanism-first