Haft 9.0.2

A patch release for the project-profile onboarding defect in conventional
monorepos. Its published predecessor is
v9.0.1.

The defect

The file-metadata detector recognized apps/web/package.json as a software
manifest but accepted production source only when the first path segment was
app, cmd, internal, lib, pkg, or src. A normal path such as
apps/web/src/main.tsx therefore supplied no production-source signal.

In a repository with product and design Markdown, that left an inconsistent
onboarding state:

• haft profile inspect reported mixed, conflicting evidence with no complete
  suggested_scopes;
• haft_onboard(action="profile_prepare") could still materialize the partial
  document suggestion as an exact review;
• an explicit software scope was rejected because the detector had retained a
  partial candidate.

Applying that review would make software specifications inapplicable to the
real product, while the normal recovery path was unavailable.

What changed

apps/<component>/src/** now carries a production-source signal. A conventional
manifest and source tree therefore produces one supported software scope.
Ordinary Markdown beside that implementation remains product material rather
than a separate realization; an explicit document-system manifest can still
establish its own scope.

Profile preparation now uses an explicit scope-identity posture:

• stable identity may produce an automatic review;
• a complete mixed or otherwise underdetermined observation produces
  needs_scope_review with no partial projected scopes and may accept explicit
  reviewed scopes;
• a truncated observation cannot use manual fallback;
• stable detection cannot be replaced through fallback.

An unchanged Haft-generated review from an older detector can be atomically
refreshed. Manual, enriched, and foreign reviews keep the existing no-clobber
protection.

Upgrade from v9.0.1

Install 9.0.2 and reconnect or restart the host so every MCP process loads the
new binary. In an affected project, inspect the profile again:

haft profile inspect --json --full-evidence

Then prepare the non-binding review again through
haft_onboard(action="profile_prepare").

profile_prepare does not apply the profile, change specification lifecycle,
or grant authority. This release adds no database migration.

This committed note describes the release contract; it does not record P13 or
P14 evidence and is not release authority. Tag validation and public GitHub
Release publication remain separate actions.