[trissim]

P270 — merged orders inherit their checked contract

Head: 9d3f4af.

Installer discovery correction

The target-only TodoOrderShape parent was wrong: the installed frontend cannot discover a parent it does not already contain. Removed that class entirely; MergedOrders directly extends the existing StoreCarry and declares store = TodoStore. No new parent, registry or dead step-local precedence method.

The actual installed parser at /home/ts/code/projects/agent-comms/tools/cutover/carry.py successfully discovers all 23 target steps, including carry_merged_orders as StoreCarry: rc=0. The nine installed-order/legacy-carry tests pass at this head: 9 passed, rc=0.

Preserved the merger's published integration commit 561f420 as the direct parent. It is the amended counterpart of the reported 5e07d0177 (same two parents); nothing was rebased or force-pushed in this correction.

MergedProblemOrder(CheckedProblemOrder) adds only sha; existing line and require_close remain. The original field and id forwarder are deleted. CheckedProblemOrder.merged() uses copy_as(MergedProblemOrder, sha=sha). The existing transition helper takes the destination's declared fields, so a delivered source does not pass its delivery-only constructor argument into a merged order.

The one-time carry_merged_orders step is discovered by the existing CarryChain. Its SQLite projection is decoded once by TypedRow into CheckedProblemOrder; that owner performs the merged transition and FieldCodec encodes the result. Nested folded provenance is converted too. There is no copied checked-field roster or production reader of the old wrapper. The existing StoreCarry protocol owns snapshot selection and discovery. No stored revision or other order metadata is fabricated.

Verification

Earlier full ratchets at a95e2d7, before the merger's integration commit, against origin/main (7c50ad3); not presented as rerun at the latest correction:

• tools/debt_ratchet.py --root tools --base origin/main --head HEAD: rc=1, solely SourceLines +75, accepted under the growth ruling. Unformatted, LintFindings, FamilyFlattened, StringSubscript and every other introduced finding: zero. Raw exit retained; no budget/checker edit.
• tools/debt_ratchet.py --root src --base origin/main --head HEAD: rc=0, no positive or introduced findings.

tests/test_installed_merge.py tests/test_carry.py: 45 passed, 2 failed. The successful real stored-order/local-Git merge journey covers pending/delivered transitions, legacy root/folded payloads, dry-run rollback, idempotence and current-shape readback. The two remaining carry-suite failures concern an existing assertion that registry_version is the last carry (external_event_times is later), and the removed ThreadOutput.status API. Both were reproduced independently on installed main; they are not claimed green. All nine installed-order/legacy-carry cases passed.

Real saved-bus copy: the existing StoreBackup snapshot owner captured 23,087 files into owned scratch, without using the known-racy raw copy_bus. The registered CarryChain/Ledger ran this actual line:

{"carry":"carry_merged_orders","changed":13,"applied":true,"rewritten":["todos.sqlite3","carries.json"],"merged_orders":13}

Fresh follow-up with P280's exact published copier 6ba0e83 also stopped before carry/rotate: a live .bus_meta.json.*.tmp disappeared during copy_bus. Reported directly to P280 owner pi-cn-load (4046), with full retained stack in P270-p280-proof.log. No retry or competing repair. The unusable 797 MB partial copy was removed only after the existing resource owner reported no active borrowers; concise logs remain.

A full rotate pass is not claimed. After preserving private root/database permissions, the real copied-bus entrypoint stops at CopiedCheckpointSeal.recover: Private bus copied index content revision changed. The copy and original failure logs are preserved; no seal was bypassed, data invented, input replayed or live bus rewritten. The exact clone compatibility failure was handed to the existing #1956 copier owner pi-toad-cancel (3889).

P215 owns the separate unjudged NULL-clock reader; its author reports its actual rotate proceeds to P270's missing-serves failure. P270 does not claim to repair historical timestamp decoding. The copied fleet is parked through existing CommanderConfig policy to prevent standing-rule assignments from waking live owners, and only the infinite rotate loop's final sleep is bounded.

Installer rehearsal explicitly waived by commander message 3644: merger performs it. Nothing installed by this agent.

Source evidence

Before: 381 production modules and 39 tools modules parsed; zero omissions. MergedProblemOrder owned a checked-order wrapper and forwarded id; actual phase readers expected the missing checked fields. After: the existing checked-order transition owns the complete payload, and both normal transitions and the carry consume it. Folded provenance remains a separate order state.

Assumed: P270 scope is inherited checked fields and the saved merged wrapper, not a new acceptance/proof state; P215 and #1956 remain with their existing implementation owners. Peer checkpoint e2bbf37 and its 18-pass result are not this branch's verification.

Agent-Comms-Order: a4bcf7704b1d

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.