Three-column reconciliation of what's actually merged vs each issue's
acceptance checklist. Single source of truth for what closes each
pillar issue.

**Findings:**

- **#90 Recover** — honestly closable. Code side is done (#124 + #130);
  operator-side real rehearsal is an ops action, not a code gap.

- **#97 Prove tier 2** — 85% done. Rehearsal + visibility + hard gate +
  plan_id binding all landed (#127 + #133). Missing: install/smoke
  check (cargo install against the rehearsal registry / consumer
  build). One narrow follow-up PR closes it.

- **#98 Remediate** — 60% done. Receipt schema + plan-yank (from-receipt)
  + yank primitive + fix-forward planning all landed (#121 + #132 +
  #134). Missing: plan-yank's --starting-crate graph mode, plan
  execution for yank + fix-forward. Two narrow follow-ups.

Also captures the two review concerns on #122 (Trusted Publishing)
that were addressed in a follow-up commit to that PR.

Recommended next merge order and follow-up PRs spelled out at bottom.

Three-column reconciliation of what's actually merged vs each issue's
acceptance checklist. Single source of truth for what closes each
pillar issue.

**Findings:**

- **#90 Recover** — honestly closable. Code side is done (#124 + #130);
  operator-side real rehearsal is an ops action, not a code gap.

- **#97 Prove tier 2** — 85% done. Rehearsal + visibility + hard gate +
  plan_id binding all landed (#127 + #133). Missing: install/smoke
  check (cargo install against the rehearsal registry / consumer
  build). One narrow follow-up PR closes it.

- **#98 Remediate** — 60% done. Receipt schema + plan-yank (from-receipt)
  + yank primitive + fix-forward planning all landed (#121 + #132 +
  #134). Missing: plan-yank's --starting-crate graph mode, plan
  execution for yank + fix-forward. Two narrow follow-ups.

Also captures the two review concerns on #122 (Trusted Publishing)
that were addressed in a follow-up commit to that PR.

Recommended next merge order and follow-up PRs spelled out at bottom.

Adds the second \`plan-yank\` selector mode: **given a broken crate
name, walk the workspace's dependency graph to find every crate that
transitively depends on it, and emit a containment plan scoped to
that affected chain.** Complements the existing \`--compromised-only\`
(marker-based) selector.

## What's new

- **\`plan_yank::build_plan_from_starting_crate\`**: takes a receipt,
  a dep-graph (\`BTreeMap<String, Vec<String>>\`), a starting crate,
  and an optional \`reason\`. Returns a \`YankPlan\` in reverse-topo
  order covering the starting crate + every transitive dependent.
  Errors if the starting crate isn't in the receipt.
- **CLI**: \`--starting-crate <CRATE>\` and \`--reason <TEXT>\` on
  \`plan-yank\`. clap \`conflicts_with = \"starting_crate\"\` on
  \`--compromised-only\` rejects combinations at parse time.
- CLI handler reads \`planned.plan.dependencies\` from the current
  workspace metadata for the graph walk.

## Algorithm

Reverse BFS through the dep map: for each currently-reachable crate,
scan the map for crates whose dep list contains it; add those to
the frontier. Final set = starting crate + all transitive dependents.
Then filter the receipt's topo-ordered packages to that set, keep
only \`Published\` entries (Failed/never-shipped yank is a no-op), and
reverse to get dependents-first order.

## Tests

5 new unit tests (10 total in \`plan_yank::tests\`):

- walks all transitive dependents in reverse topo
- ignores unrelated crates (no edge → not in plan)
- skips non-Published entries (dependent that Failed doesn't yank)
- \`--reason\` applies to every entry (falls back to receipt
  \`compromised_by\` otherwise)
- errors when starting crate isn't in receipt

Regenerated \`plan-yank --help\` snapshot.

## Closes half of #98's remaining gap

\`plan-yank --starting-crate <name> --reason <text>\` now matches #98's
issue spec verbatim. Combined with the earlier \`--compromised-only\`
flow (#132), plan-yank fully satisfies the graph vs receipt-filter
ask. Plan execution wrappers for yank/fix-forward are the remaining
piece (#98 PR 5).

Closes the remaining plan-execution gap in #98. \`shipper plan-yank
--format json\` emits a YankPlan; \`shipper yank --plan <PATH>\` walks
that plan and invokes \`cargo yank\` per entry.

## What's new

- \`YankEntry\` / \`YankPlan\` now derive \`Deserialize\` so plans
  round-trip via \`--format json\` → file → \`--plan\`. The \`filter\`
  field moves from \`&'static str\` to \`Cow<'static, str>\` so owned
  strings coming off disk don't require allocation in the construction
  path.
- \`plan_yank::load_plan_from_path\` — thin helper mirroring
  \`load_receipt_from_path\`.
- CLI: \`shipper yank --plan <PATH>\`. Mutually exclusive with
  \`--crate\` / \`--version\` / \`--reason\` (clap \`conflicts_with\`);
  those become optional in plan mode.
- Handler: iterates entries in order, emits \`PackageYanked\` event
  per invocation, halts on first non-zero cargo exit (reverse-topo
  plan means every downstream entry would be failing to yank a
  dependent of a crate we just failed on — continuing is damage).

## Scope — what this PR does and doesn't

**Does:**
- Execute yank plans end-to-end.
- Correct halt-on-failure semantics.
- Events-as-truth: every invocation writes a PackageYanked event
  (with real exit code) to events.jsonl, including failures.

**Does not:**
- Resume interrupted plan runs. First yank is destructive on the
  registry; re-running the plan with the same reason is idempotent
  (cargo yank of an already-yanked version is a no-op), so the
  simplest fix is to just re-run the plan, and operator discipline
  picks up the rest.
- Add a \`fix-forward\` executor. That requires Cargo.toml version
  bumps which are workspace-edit territory — deserves its own PR
  with --dry-run / --apply / git-cleanliness guards.

## Tests

3 new unit tests (8 total in \`plan_yank::tests\`):
- YankPlan JSON round-trips: serialize, write, load → entries + order
  preserved, per-entry reason preserved.
- \`load_plan_from_path\` errors cleanly on missing file.
- \`load_plan_from_path\` errors cleanly on malformed JSON.

Regenerated \`yank --help\` snapshot.

## Closes the rest of #98's open gap

With PR #138 (starting-crate) and this one, #98's acceptance checklist is fulfilled:

- [x] Receipt fields (compromised_at/compromised_by/superseded_by) — PR #132
- [x] plan-yank --from-receipt + --starting-crate + --reason — PR #132 + #138
- [x] shipper yank executes a plan — **this PR**
- [ ] shipper fix-forward --plan executes a plan — follow-on (needs Cargo.toml edit tooling)
- [x] Docs distinguish yank semantics — PR #134

The fix-forward executor is the last remaining #98 piece. It's cleanly deferred because it adds workspace-edit scope; this PR keeps the execution story for yank self-contained.

Adds the second \`plan-yank\` selector mode: **given a broken crate
name, walk the workspace's dependency graph to find every crate that
transitively depends on it, and emit a containment plan scoped to
that affected chain.** Complements the existing \`--compromised-only\`
(marker-based) selector.

## What's new

- **\`plan_yank::build_plan_from_starting_crate\`**: takes a receipt,
  a dep-graph (\`BTreeMap<String, Vec<String>>\`), a starting crate,
  and an optional \`reason\`. Returns a \`YankPlan\` in reverse-topo
  order covering the starting crate + every transitive dependent.
  Errors if the starting crate isn't in the receipt.
- **CLI**: \`--starting-crate <CRATE>\` and \`--reason <TEXT>\` on
  \`plan-yank\`. clap \`conflicts_with = \"starting_crate\"\` on
  \`--compromised-only\` rejects combinations at parse time.
- CLI handler reads \`planned.plan.dependencies\` from the current
  workspace metadata for the graph walk.

## Algorithm

Reverse BFS through the dep map: for each currently-reachable crate,
scan the map for crates whose dep list contains it; add those to
the frontier. Final set = starting crate + all transitive dependents.
Then filter the receipt's topo-ordered packages to that set, keep
only \`Published\` entries (Failed/never-shipped yank is a no-op), and
reverse to get dependents-first order.

## Tests

5 new unit tests (10 total in \`plan_yank::tests\`):

- walks all transitive dependents in reverse topo
- ignores unrelated crates (no edge → not in plan)
- skips non-Published entries (dependent that Failed doesn't yank)
- \`--reason\` applies to every entry (falls back to receipt
  \`compromised_by\` otherwise)
- errors when starting crate isn't in receipt

Regenerated \`plan-yank --help\` snapshot.

## Closes half of #98's remaining gap

\`plan-yank --starting-crate <name> --reason <text>\` now matches #98's
issue spec verbatim. Combined with the earlier \`--compromised-only\`
flow (#132), plan-yank fully satisfies the graph vs receipt-filter
ask. Plan execution wrappers for yank/fix-forward are the remaining
piece (#98 PR 5).

Closes the remaining plan-execution gap in #98. \`shipper plan-yank
--format json\` emits a YankPlan; \`shipper yank --plan <PATH>\` walks
that plan and invokes \`cargo yank\` per entry.

- \`YankEntry\` / \`YankPlan\` now derive \`Deserialize\` so plans
  round-trip via \`--format json\` → file → \`--plan\`. The \`filter\`
  field moves from \`&'static str\` to \`Cow<'static, str>\` so owned
  strings coming off disk don't require allocation in the construction
  path.
- \`plan_yank::load_plan_from_path\` — thin helper mirroring
  \`load_receipt_from_path\`.
- CLI: \`shipper yank --plan <PATH>\`. Mutually exclusive with
  \`--crate\` / \`--version\` / \`--reason\` (clap \`conflicts_with\`);
  those become optional in plan mode.
- Handler: iterates entries in order, emits \`PackageYanked\` event
  per invocation, halts on first non-zero cargo exit (reverse-topo
  plan means every downstream entry would be failing to yank a
  dependent of a crate we just failed on — continuing is damage).

**Does:**
- Execute yank plans end-to-end.
- Correct halt-on-failure semantics.
- Events-as-truth: every invocation writes a PackageYanked event
  (with real exit code) to events.jsonl, including failures.

**Does not:**
- Resume interrupted plan runs. First yank is destructive on the
  registry; re-running the plan with the same reason is idempotent
  (cargo yank of an already-yanked version is a no-op), so the
  simplest fix is to just re-run the plan, and operator discipline
  picks up the rest.
- Add a \`fix-forward\` executor. That requires Cargo.toml version
  bumps which are workspace-edit territory — deserves its own PR
  with --dry-run / --apply / git-cleanliness guards.

3 new unit tests (8 total in \`plan_yank::tests\`):
- YankPlan JSON round-trips: serialize, write, load → entries + order
  preserved, per-entry reason preserved.
- \`load_plan_from_path\` errors cleanly on missing file.
- \`load_plan_from_path\` errors cleanly on malformed JSON.

Regenerated \`yank --help\` snapshot.

With PR #138 (starting-crate) and this one, #98's acceptance checklist is fulfilled:

- [x] Receipt fields (compromised_at/compromised_by/superseded_by) — PR #132
- [x] plan-yank --from-receipt + --starting-crate + --reason — PR #132 + #138
- [x] shipper yank executes a plan — **this PR**
- [ ] shipper fix-forward --plan executes a plan — follow-on (needs Cargo.toml edit tooling)
- [x] Docs distinguish yank semantics — PR #134

The fix-forward executor is the last remaining #98 piece. It's cleanly deferred because it adds workspace-edit scope; this PR keeps the execution story for yank self-contained.

…#139)

Closes the remaining plan-execution gap in #98. \`shipper plan-yank
--format json\` emits a YankPlan; \`shipper yank --plan <PATH>\` walks
that plan and invokes \`cargo yank\` per entry.

- \`YankEntry\` / \`YankPlan\` now derive \`Deserialize\` so plans
  round-trip via \`--format json\` → file → \`--plan\`. The \`filter\`
  field moves from \`&'static str\` to \`Cow<'static, str>\` so owned
  strings coming off disk don't require allocation in the construction
  path.
- \`plan_yank::load_plan_from_path\` — thin helper mirroring
  \`load_receipt_from_path\`.
- CLI: \`shipper yank --plan <PATH>\`. Mutually exclusive with
  \`--crate\` / \`--version\` / \`--reason\` (clap \`conflicts_with\`);
  those become optional in plan mode.
- Handler: iterates entries in order, emits \`PackageYanked\` event
  per invocation, halts on first non-zero cargo exit (reverse-topo
  plan means every downstream entry would be failing to yank a
  dependent of a crate we just failed on — continuing is damage).

**Does:**
- Execute yank plans end-to-end.
- Correct halt-on-failure semantics.
- Events-as-truth: every invocation writes a PackageYanked event
  (with real exit code) to events.jsonl, including failures.

**Does not:**
- Resume interrupted plan runs. First yank is destructive on the
  registry; re-running the plan with the same reason is idempotent
  (cargo yank of an already-yanked version is a no-op), so the
  simplest fix is to just re-run the plan, and operator discipline
  picks up the rest.
- Add a \`fix-forward\` executor. That requires Cargo.toml version
  bumps which are workspace-edit territory — deserves its own PR
  with --dry-run / --apply / git-cleanliness guards.

3 new unit tests (8 total in \`plan_yank::tests\`):
- YankPlan JSON round-trips: serialize, write, load → entries + order
  preserved, per-entry reason preserved.
- \`load_plan_from_path\` errors cleanly on missing file.
- \`load_plan_from_path\` errors cleanly on malformed JSON.

Regenerated \`yank --help\` snapshot.

With PR #138 (starting-crate) and this one, #98's acceptance checklist is fulfilled:

- [x] Receipt fields (compromised_at/compromised_by/superseded_by) — PR #132
- [x] plan-yank --from-receipt + --starting-crate + --reason — PR #132 + #138
- [x] shipper yank executes a plan — **this PR**
- [ ] shipper fix-forward --plan executes a plan — follow-on (needs Cargo.toml edit tooling)
- [x] Docs distinguish yank semantics — PR #134

The fix-forward executor is the last remaining #98 piece. It's cleanly deferred because it adds workspace-edit scope; this PR keeps the execution story for yank self-contained.