[trissim]

P282: service-owned commander heartbeat

Head: bef8d1c49. Rebased onto requested main 15ba6edce, without merging main.

Owners and deletions

• Deletes session-supervised commander/rotate.py, its test and discovered CLI verb, and the packaged rotation-Monitor instruction.
• Coordination.watch_worker owns minute scheduling, worker admission, joined retirement and error reporting. Connector.watch_orders starts and retires both maintenance jobs.
• CommanderHeartbeat discovers living registered owner-request holders and keys reviews by thread incarnation. Stopped/replaced commanders receive no heartbeat.
• CommanderReview owns a frozenset[StandingRule] and next-unit cursor. It publishes only added/removed violations. Every wake_key declaration/call is deleted; no string fingerprint or parallel rule roster remains.
• Dataclass equality excludes changing measurements, unread counts and rendered explanations. DiskLow classifies its single observation into cleanup-only or DiskFloorLow. The latter owns the allocation-floor warning and is not separately discovered. Crossing either way changes the typed value; movement within the same band stays silent. The competing rendering-time floor decision is deleted.
• Existing connector sender publishes without manufacturing owner directives or registering a fake agent.

Verification

• Required background timeout 300 run: 11 passed, 9.21 seconds, exit 0. Actual worker/publication/inbox checks cover both floor-crossing directions, same-band silence, delta-only text, next-unit review, independent commanders, stopped-thread retirement and joined resource release.
• Source ratchet pinned to 15ba6edce: exit 1 solely permitted SourceLines 76 -> 116 (+40). No other increase; introduced findings empty. No budget/baseline/suppression changes.
• Tools ratchet against that same base: 0.
• Existing refactor-audit Package parser inventories declarations, fields, inheritance, imports, writes, decisions and consumers. Zero production parse omissions. Dynamic discovery is exercised through the real connector; external stdlib generated hash/equality internals are outside that inventory.

Actual connector proof

Real aiohttp connector application, normal 60-second workers, registered living owner-request holder, actual rule family and inbox. Only the external disk observation is controlled: 6 -> 4 -> 3.9 GiB across the unchanged 5 GiB floor; no real disk is filled. Memory measurements remain real, with a scratch-only 1024 GiB threshold holding MemoryLow true.

The crossing produced one new floor warning and removed the cleanup-only warning. From 21:51:26 through 21:56:26 -0400: 300.0856 seconds, zero additional wakes, exit 0. Ordinary unit received none; cleanup joined both workers and retired the endpoint. This proves Core publication/inbox behavior, not a model/provider reply or production installation.

The proof started at a45849f6e. Final publication changes only a return annotation and literal wrapping: complete production AST comparison differs only by that annotation, and compiled factory/renderer runtime bytecode and constants are identical. Current-head focused checks passed after that correction.

Evidence: /home/ts/.cache/agent-scratch/pi-cn-phase6/p282-floor-evidence.md, p282-floor-live/receipt.json, p282-floor-proof.log, p282-floor-final-tests.log, p282-floor-final-src-ratchet.log, p282-floor-tools-ratchet.log, p282-floor-owner-evidence.txt, p282-floor-final-source-equivalence.txt.

The two earlier UNKNOWN operations were read back as having no effect. Commander message 4610 authorized fresh attempts; source edit, draft conversion and warning comment all succeeded. The floor regression is repaired.

Assumed

• Commanders are registered living owner-request holders; an initially empty set is silent.
• Deduplication belongs to the service lifetime; an uncertain publication is not replayed while unchanged.
• Merger owns installation and installed acceptance. Not installed here.
• Pi-connector retains the separate MergeGrowth bounded Git-read repair; its implementation is untouched here.

The canonical order owner created this PR using the actual reused P1 checkout after the CLI incorrectly derived a nonexistent P282 checkout. Immutable order identity is preserved below. Withdrawn P243 page work was not resumed.

Agent-Comms-Order: 8669274958e8

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[trissim]

Held for the allocation-floor notification repair. Frozen rule values replaced every wake_key, but the initial measurement exclusion also silenced a floor crossing. That behavior is being restored through a typed disk-floor violation before this PR becomes ready again. Both earlier UNKNOWN attempts were read back as having no effect; commander message 4610 authorizes these fresh attempts. No installation or current-main acceptance is claimed.