diff --git a/TODO.md b/TODO.md
index 8a25e46..d827a5c 100644
--- a/TODO.md
+++ b/TODO.md
@@ -61,9 +61,9 @@
 - [x] Deliver [ticket-020](project/ticket-020/README.md): record Goal 2.1.291
   release notes and publication evidence without another version change.
   State: `DONE / PUBLICATION`; classification: `SERVICE / integration`.
-- [ ] Deliver [ticket-021](project/ticket-021/README.md): detect only writable
+- [x] Deliver [ticket-021](project/ticket-021/README.md): detect only writable
   Python `__version__` declarations and support conventional version modules.
-  State: `IN_PROGRESS / VALIDATION`; classification: `BUG / application`.
+  State: `DONE / PUBLICATION`; classification: `BUG / application`.
 - [ ] After governance bootstrap, execute the sequential phases defined in
   [the refactoring plan](docs/GOAL_KORU_SUBACTOR_REFACTORING_PLAN.md), with one
   narrowly scoped ticket active at a time.
@@ -74,7 +74,7 @@
 > `ticket-010 DONE`; `ticket-011 DONE`; `ticket-012 DONE`;
 > `ticket-013 DONE`; `ticket-014 CANCELLED`; `ticket-015 DONE`;
 > `ticket-016 DONE`; `ticket-017 DONE`; `ticket-018 DONE`;
-> `ticket-019 DONE`; `ticket-020 DONE`; `ticket-021 IN_PROGRESS`.
+> `ticket-019 DONE`; `ticket-020 DONE`; `ticket-021 DONE`.
 
 > **Recently shipped (manual note):** `goal all [PATHS...]` monorepo sweep —
 > runs `goal -a` in every git repo with uncommitted changes under the given
diff --git a/project/ticket-021/README.md b/project/ticket-021/README.md
index b890310..a9a9fa5 100644
--- a/project/ticket-021/README.md
+++ b/project/ticket-021/README.md
@@ -2,8 +2,8 @@
 
 - **ID**: ticket-021
 - **Owner**: unresolved:human
-- **Status**: IN_PROGRESS
-- **Workflow state**: VALIDATION
+- **Status**: DONE
+- **Workflow state**: PUBLICATION
 - **Created**: 2026-08-10
 
 ## Goal and scope
@@ -31,6 +31,10 @@ from rewriting a valid `goal.yaml` to an unreadable selector.
 - The detector run against `wellmanifest/wellm` selects
   `src/wellmanifest/version.py:__version__` and excludes the compatibility
   re-export in `src/well/__init__.py`.
+- PR #39 passed Python 3.12/3.13 CI and exact-head validator approval for
+  `05ef1167cf43e43fbe1b512ea9808a7ed458adfe`.
+- Protected merge completed as
+  `c48ff33d12dd9797868959caa3fda4adeec766ff`.
 
 ## Session authorization
 
diff --git a/project/ticket-021/ai-codex-logs.txt b/project/ticket-021/ai-codex-logs.txt
index 1e81d5a..6569c52 100644
--- a/project/ticket-021/ai-codex-logs.txt
+++ b/project/ticket-021/ai-codex-logs.txt
@@ -2,3 +2,7 @@
 src/well/__init__.py and made goal check-versions unreadable.
 2026-08-10: New detector selects src/wellmanifest/version.py:__version__.
 2026-08-10: Focused tests 26 passed; full suite 512 passed, 2 skipped.
+2026-08-10: PR #39 passed Python 3.12/3.13 CI; validator run 31385618905
+approved exact head 05ef1167cf43e43fbe1b512ea9808a7ed458adfe.
+2026-08-10: Protected merge completed as
+c48ff33d12dd9797868959caa3fda4adeec766ff; ticket closed.
diff --git a/project/ticket-021/changelog.md b/project/ticket-021/changelog.md
index 2cb2f77..662d62d 100644
--- a/project/ticket-021/changelog.md
+++ b/project/ticket-021/changelog.md
@@ -9,3 +9,7 @@
 - Import-only compatibility modules are no longer selected as version files.
 - Conventional Python version modules now participate in discovery and
   synchronization when they contain a literal assignment.
+- PR #39 passed both target CI jobs; validator run 31385618905 approved exact
+  head `05ef1167cf43e43fbe1b512ea9808a7ed458adfe`.
+- Protected merge completed as
+  `c48ff33d12dd9797868959caa3fda4adeec766ff`.
diff --git a/project/ticket-021/intent.json b/project/ticket-021/intent.json
index 6cf3543..f23a265 100644
--- a/project/ticket-021/intent.json
+++ b/project/ticket-021/intent.json
@@ -31,7 +31,7 @@
   "conflictsWith": [],
   "integrationTicket": null,
   "delivery": {
-    "acceptedBaseSha": "97a27a5cbaff522d078bef2390358741f7b8eed4",
+    "acceptedBaseSha": "c48ff33d12dd9797868959caa3fda4adeec766ff",
     "targetBranch": "main",
     "outcome": "Goal detects the real writable Python version carrier and never mistakes an import-only module for one",
     "nonGoals": [