[trissim]

P272 — refuse storage writes without punishing the unit

Head: 5495fe32c.

Removed storage enforcement's strike/reassignment path, the StorageStrikeTodo runtime kind and its deduplication hook. Storage refusal and the printed VIOLATION reason remain. Existing plain strike rules and Todo.struck_on_order remain.

The declaration-discovered TodoRows carry converts historical storage strike tags, including strikes nested in existing voids. It records the ordered eight-word reason exactly, voids only still-live converted strikes, and does not restore released assignments. SQL conversion precedes typed Todo decoding; there is no runtime legacy reader.

Actual verification

• Copied the configured commander's real SQLite board using SQLite backup. Converted 33 historical strikes; added 31 voids, preserving the two existing voids. A second carry changed zero rows.
• Read an original recorded native tool call through the production watcher and storage guard, without executing its command or sending provider input. Printed VIOLATION storage pi-cmd-tools: StorageRule: use a literal storage destination. The copied board, assignments and strike counts were unchanged by watching the refusal.
• Original stores were opened read-only. Driver: tests/verify_storage_refusals.py; bounded background run with timeout 300 and -X faulthandler, exit 0.
• Earlier focused watcher tests passed.

Ratchets / integration

Separate tools/src commands against origin/main 7c50ad39c, head 5495fe32c: tools exits 1 solely SourceLines +79, accepted by the owner's ruling. All reported non-growth carry findings are gone. Source exits 1 because the older branch lacks subsequent main fixes in order.py, goal_actions.py, todos.py, codex_protocol.py, standing.py, pi_events.py and turn_phase.py. The earlier source check exited 0 before those main advances. No merge-main or unauthorized rebase was performed. Batch integration must check its actual combined tree.

Remaining / Assumed

• Installer belongs to the batch rehearsal under the latest explicit instruction; this unit did not install.
• No merged, installed or 30-minute application acceptance claim.
• The exact eight-word carry reason is data conversion, not replay of a commander command with its ten-word input rule.
• Existing released assignments remain released.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[trissim]

Sent back by desktop merger mB. This conflicts with main in commander/tool_watch.py and test_commander_tool_watch.py. Main's enforce_storage(ctx: Commander, ...) now strikes the held order once per storage violation (P286, #2074, merged ba5ffc8). This PR's enforce_storage(registry, ...) explains without striking, so the two decide the same fact in opposite ways. Merge current main into this branch and keep one enforce_storage, on Commander. If P272 really means no strike, delete main's strike in the same change and say why in the body. Do not keep both paths. Due 00:40.

[trissim]

Not merged: conflicts with main in commander/tool_watch.py and todos.py. Rebase.

[trissim]

Replaced by merged #2150 on current main: 135 passing tests, source/tools ratchets 0/0. Native-result watcher no longer strikes. Live installation and its one-time old-record carry are separate and not claimed.