[trissim]

P286: automatic objective strikes, with working replacement dispatch

Head: c24cca65982ae2b3c4d7be03cbb5408fe89a5328, rebased onto batch45 main ef4cc72da8d52548b2a594a78200749f0fc878bf.

Merger's held failure is fixed

The real Connector worker first recorded the two objective failures and released the worker, then asked a held-only query for stalled work. The newly unowned order disappeared from that query, so the available spare never received it. This was a lifecycle ownership defect, not a baseline failure or merely an outdated assertion.

• TodoStore.reassignable replaces/deletes TodoStore.stalled: the one assignment-candidate query includes pending work released by the declared Core watcher identity, as well as stalled held work. It does NOT automatically reassign a commander's deliberately released backlog.
• UnownedWheelSpin.after_stall uses that query and the existing paired/ReusedWorkDispatch/enforce path; main's WorkDispatch lifecycle is retained, not copied or bypassed. No new unit, queue, timer, store or dispatcher is introduced.
• StallWatcherIncarnation.assigned owns Core's replacement effect: it strikes/releases only when displacing a holder. Claiming already-Core-released work does not invent another release or another strike. Todo.reassigned retains its original held-owner contract.
• MissedDeadlineStrike.late uses the existing checked order's issue time: a new owner cannot miss a deadline that expired before that owner's order was issued. No new deadline, grace window or clock is stored; first-call timing remains the existing reissued order's timing.

The original objective-strike family remains: original first-tool timestamps, typed failed-check source attribution, existing strike history for deduplication (including voided attempts), existing ReleaseTodo for the second live strike and existing post-record publication. Only NoCommitProgress owns deadline absence-of-work behavior. Pushed/open-PR/committed/merged/unread progress does not get an absence-of-work strike. Delivery-time deadline punishment remains deleted. The P271 reconciliation type filter and P301 timing/unit-deadline visibility work are untouched.

Source and ownership evidence

Reused ChangedSource/AST across443 production/tool modules, no parse omissions. Evidence enumerates the existing Todo/GoalAction/actor/dispatch owners and all selected consumers. TodoStore.stalled is deleted; the unrelated progress and watchdog stalled methods remain. Dynamic codec, declaration dispatch and external transcript/native custody are behavior boundaries, not claimed as AST proof.

Actual ownership searches:

• rg -n 'def deadline_strikes|MissedDeadlineStrike.late' src/agent_comms/todos.py: base no-action behavior plus the single NoCommitProgress policy.
• rg -n 'def reassignable|todos.reassignable|todos.stalled' src: one candidate-query owner and one consumer; no old TodoStore consumer.
• rg -n 'def assigned|def reassigned' src/agent_comms/thread_identity.py src/agent_comms/todos.py: actor-owned Core replacement policy and the existing held-owner transition.

Verification at this exact head

Background timeout300 + faulthandler, using existing shared dependencies and the already initialized exact audit pin:

tests/test_stall_watcher_strike.py tests/test_objective_strikes.py tests/test_deadline_progress_strikes.py tests/test_commander_problem_orders.py tests/test_standing_rules.py

116 passed, 1 failed in101.22s. The sole failure is the existing withdrawn-order closure defect, reproduced separately on exact main ef4cc72 in1.71s:
test_a_withdrawn_order_is_neither_open_nor_overdue_and_strikes_no_one -> Closing requires recorded installed application evidence.

That fix is independently owned in ready #2073; land #2073 before/with this PR. No branch-only failure remains in this selected set. This is not a full-suite claim.

The merger's test_three_connector_passes_allow_real_store_maintenance_between_passes now passes. It uses a real Connector and real copied bus/store/native records, runs three worker passes and obtains maintenance locks between each; the original root remains unchanged. It now requires exactly the two typed automatic failures on the original worker and one release, rather than the old single manual takeover strike. Repeated passes do not punish the replacement for the inherited expired deadline.

Added real-store coverage verifies Core-released work remains pending when no spare exists, is assigned when a spare appears, and is unchanged on the next observer/dispatcher pass. The manual-release test now supplies a genuinely eligible spare and still verifies no automatic reassignment.

Separate final ratchets against ef4cc72, head c24cca6:

• tools: exit0, positive delta {}, introduced {}.
• src: exit0, positive delta {}, introduced {}.

Initial checkpoint2b3414b78's source ratchet correctly reported one new NoneAbsence. The coherent correction moved the assignment-vs-displacement decision into the existing watcher incarnation instead of making Todo.reassigned silently accept an unowned row; no exemption, alias or suppressed check was added. The first broader run also had three missing-catalog failures in the uninitialized P304 checkout. Final verification reused the already initialized P286 checkout; no clone, sync, install or new dependency tree was created.

Receipts under owned scratch: p286-release-ast-{before,after}.txt, p286-replacement-deadline-before.txt, p286-replacement-final-{tools,src}.log/.exit, p286-replacement-final-tests.log/.exit, p286-main45-withdraw.log/.exit. Owned scratch/checkouts measured about1.03GiB total against the3GiB cap. The prescribed resource helper is absent on this host; direct checks showed13GiB free disk and6.8GiB available memory before the bounded checks.

Assumed:

• Core-only release authorizes automatic replacement; a commander release does not.
• The current order's recorded issue time defines when its owner became responsible for its deadline.
• The merger owns fresh-environment rehearsal, installation and actual retained-production-bus acceptance. The isolated real-Connector proof is not an installed-live claim.

Agent-Comms-Order: 4b67fff60615

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[trissim]

merger: held out of batch 44. At head 471cd3e, tests/test_stall_watcher_strike.py::test_three_connector_passes_allow_real_store_maintenance_between_passes fails at tests/test_stall_watcher_strike.py:207 (assert None == 'spare'); it passes on main 26c083b.