checkpoint: bug-851 root cause + raft TLA+ conformance spec family

Investigation & fixes (failover committed-job loss):
- root-cause bug-851 on an owned 3-node cluster: chaotic failover causes
  silent committed-prefix divergence (WAL hdr.term always 0; two leaders
  per term; no (term,lsn) reconcile). Evidence in repro-851/ + INVESTIGATION.
- live-validated fixes 848/849/850 (recovery-on-promotion, advertise real
  applied_lsn, persist-layer contiguity guard); add waldump WAL inspector.

Specs (strict raft.tla conformance — library owns the log):
- TLA-gap-analysis.md: impl vs raft/raft.tla, gaps G1-G6.
- raft-log-replication, raft-commit-safety, raft-sim-conformance: extend
  src/lib/raft to own log/commit/verification via callbacks (specs generated,
  cross-spec review passed).
- ha-term-safety: controller-side adapter + config marker (R1-R7); design done.
- config-upgrade-snapshot: R8 descoped here (deps entity-bearing-snapshots, bug-857).
- roadmap + buglog (851/854/857) + .wolf knowledge updated.

uninstall-code-review-graph.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# Fully uninstall `code-review-graph` (the Python/uv MCP tool).
+#
+# IMPORTANT: Run this ONLY after closing every Claude Code session that has
+# this worktree registered as an MCP server. While a session is live it
+# re-spawns `uvx code-review-graph serve`, which self-bootstraps: it
+# reinstalls the uv package and rewrites .mcp.json / .claude/settings.json
+# hooks within ~10s. The configs are already cleaned on disk; this script
+# removes the package + binaries + leftover state once nothing is respawning it.
+#
+# This does NOT touch `codegraph` (the separate @colbymchenry/codegraph bun tool).
+set -uo pipefail
+
+WT="/home/rshen/projects/xce/worktrees/persistent_ha"
+UVENV="/home/claude/tools/uv"
+
+echo "==> Killing any running code-review-graph / crg-daemon processes"
+pkill -f "code-review-graph serve"   2>/dev/null || true
+pkill -f "code-review-graph.*daemon" 2>/dev/null || true
+pkill -f "uvx code-review-graph"     2>/dev/null || true
+pkill -f "crg-daemon"                2>/dev/null || true
+sleep 1
+
+echo "==> Uninstalling uv package"
+VIRTUAL_ENV="$UVENV" uv pip uninstall code-review-graph 2>/dev/null || true
+
+echo "==> Removing leftover binaries"
+rm -f "$UVENV/bin/code-review-graph" "$UVENV/bin/crg-daemon"
+
+echo "==> Removing state directories"
+rm -rf "$WT/.code-review-graph" \
+       /home/rshen/projects/xce/xce/.code-review-graph \
+       /home/claude/.code-review-graph \
+       "/home/claude/.cache/claude-cli-nodejs/-home-rshen-projects-xce-worktrees-persistent-ha/mcp-logs-code-review-graph"
+
+echo "==> Removing git pre-commit hook (if it is the code-review-graph one)"
+HOOK="/home/rshen/projects/xce/xce/.git/hooks/pre-commit"
+if [ -f "$HOOK" ] && grep -q "code-review-graph" "$HOOK"; then rm -f "$HOOK"; fi
+
+echo "==> Purging uv cache entries"
+find /home/claude/.cache/uv -maxdepth 4 -iname "*code_review_graph*" -exec rm -rf {} + 2>/dev/null || true
+
+echo "==> Verification"
+if command -v code-review-graph >/dev/null 2>&1; then
+  echo "   STILL PRESENT — a Claude session is probably still respawning it. Close it and re-run."
+else
+  echo "   code-review-graph: GONE"
+fi
+echo "   .mcp.json refs:            $(grep -c code-review-graph "$WT/.mcp.json" 2>/dev/null || echo 0)"
+echo "   settings.json hook refs:   $(grep -c code-review-graph "$WT/.claude/settings.json" 2>/dev/null || echo 0)"
+echo "Done."