Land six ready PRs in one batch

docs/maintenance-holder.md

@@ -0,0 +1,60 @@
+# Process-owned maintenance (P281)
+
+The barrier stores the holder's PID and kernel birth time through the existing
+`ProcessIdentity`/`FieldCodec` implementation. Names are not identities. READY
+records describe completed work and do not depend on the old operator staying
+alive.
+
+A non-READY read checks that exact process. Recovery compares the observed
+record under the existing registry lock, writes `dead_holder_released` with the
+dead PID/birth time, and refuses the detecting input. The following input uses
+READY behavior. The asynchronous ingress borrows the asynchronous registry
+lock; neither path upgrades an admitted shared wire descriptor.
+
+Live installs run in a separate session with private file-backed output, so
+losing the calling session does not kill the installer or break its output
+pipe. The worker records its own identity. Rehearsals remain synchronous.
+
+`TodoStore.writer_connection` admits all todo writers before opening SQLite,
+including commander first-call, hunt, overdue and reconciliation writes.
+
+One registered carry converts version-1 READY witnesses. An old active record
+contains only a name: its holder's death cannot be established. The carry
+refuses that record rather than fabricating a PID or retaining a name fallback.
+The runtime reads only version 2.
+
+## Delivery checklist
+
+- [x] Implementation checkpoint pushed on `fix/p281-maintenance-holder`.
+- [x] Production AST inventory: 381 Core modules and 39 tools; no parse omissions.
+- [x] Migrate all discovered producer and test callers off string operators.
+- [x] Eleven focused real-process/ingress/todo/carry checks passed.
+- [ ] Tools ratchet and src ratchet against `origin/main`.
+- [x] Copied-bus live-phase proof with existing Python, without a build,
+      environment creation or `uv sync`.
+- [x] Calling-session death left the worker alive; SIGKILL of its job mid-drain
+      gave a named `held` refusal, then an accepted and retained second message.
+      The release record retained the dead PID/birth time; original bus unchanged.
+- [x] Draft PR #2072 opened through the commander's canonical PR command.
+
+## Installation wiring follow-up
+
+Normal and unchanged live installs now use the selected interpreter to refresh
+`RuntimePublication`. That existing owner publishes console/skill links and
+calls the declared `Harness.configure` implementations; repeated refreshes are
+safe. Consumers no longer skip refresh merely because the pointer is current.
+
+Actual installed programs, with a private HOME and candidate publication code,
+verified every declared hook on PATH/configuration, including P275 SessionStart
+and P285 UserPromptSubmit. SessionStart exited zero with all 45 packaged files;
+repeated refresh preserved user settings without duplicate hooks. Production
+configuration and services were not changed.
+
+This does not yet fence external bridge watches or session hooks across mutable
+checkout/schema updates. The reported transitional-reader failure remains
+unfixed; publication success is not acceptance of that separate lifecycle gap.
+
+The inventory includes declarations, inheritance, imports, writes, decisions
+and references throughout both production roots. Generated test child programs
+are additionally located by source search; AST does not resolve their runtime
+imports or prove behavior.

plans/commander-native-plan.md

@@ -61,7 +61,7 @@
 | 28 | Measured load and self-report | `capacity.py` unit count | `commander.capacity.Load.of` reports orders, overdue, edits and forks; self-report comparison unverified | `control_plane` |
 | 29 | No handoff of finished, checked work | none; scratch transfer moved P507 after its fix was pushed and checked | Transfer refuses delivered checked work; that owner merges; check is reused | `record_plane` |
 | 30 | A proof is bound to the build it ran on | none; screenshots and logs are bare paths | Build run records runtime and Core/Toad revisions; close requires delivered commit | `record_plane` |
-| 31 | An order states its intent as a deletion target | none; P520 renamed a decision rather than deleting it | Order owns deletion family/site/count; delivery refuses nonzero or renamed decisions | `record_plane` |
+| 31 | An order states its intent as a deletion target | Current order command with a declared FamilyDeletion | CommsTodoCreateTool and CommsOrderDoneTool check the delivered family count | `record_plane` |
 | 32 | Where units' time goes, classified | none; activity.log lacks durations and turn boundaries | `UnitTime`: model, build/check/test/shell, dependency/commander waits and idle; classify large waits | `commander_page`, `control_plane` |
 | 33 | Order progress beside its deadline; the unit never sees a due time | `order.py board`, `overdue`, `due`, `send`; `rotate.py` | Derived `OrderProgress`; merged work draws no strike; first commit 10 min, later progress 15 min STALL; units see no due time | `one_order_owner`, `control_plane` |
 | 34 | Several commanders on one machine and bus, one per project | none; a second commander.json install overwrites the first | Registry commander/project ownership; caller from --from; scoped orders, strikes, load, board, alarms and forks; raw-send guard; duplicate project commander refused | `one_order_owner`, `cutover` |

src/agent_comms/cli_bridges/codex_protocol.py

@@ -742,7 +742,7 @@ def publication(self) -> RuntimeUpdate:
         if self.completedAtMs is None:
             raise ValueError(f'Item {self.item.id} has not finished')
         event_time = self.started_at.continued_from(self.completedAtMs / 1000)
-        return self.item.completed(self.turnId, self.item.events(event_time.transcript_timestamp()))
+        return self.item.completed(self.turnId, self.item.events(event_time.recorded_at('A Codex item')))
 
 
 class ItemsPage(WireModel):

src/agent_comms/cli_protocol.py

@@ -17,7 +17,7 @@
 from .maintenance_barrier import MaintenanceHeldError
 from .messages import Message
 from .field_codec import TimestampText
-from .recorded_time import MissingTranscriptTimestampError
+from .recorded_time import UnrecordedTimeError
 from .external_transcript import RequestedEarlierPage
 
 if TYPE_CHECKING:
@@ -45,7 +45,7 @@ class TimestampedWire(WireModel):
     @classmethod
     def require_source_time(cls, value):
         if isinstance(value, dict) and value.get('timestamp') is None:
-            raise MissingTranscriptTimestampError(f'{cls.__name__} has no recorded timestamp')
+            raise UnrecordedTimeError(f'{cls.__name__} has no recorded timestamp')
         return value
 
     @field_validator('timestamp', mode='before')

src/agent_comms/commander/capacity.py

@@ -22,14 +22,17 @@ class Load(ToolResult):
     def of(cls, comms: Comms, commander: str) -> Load:
         snapshot, todos, now = comms.registry.snapshot(), comms.goals.todos, time.time()
         owner = snapshot.require(commander)
-        owed = tuple(t for t in todos.held_for_commander(owner.incarnation) if t.pending)
+        held = todos.held_for_commander(owner.incarnation)
+        owed = tuple(t for t in held if t.pending)
         forks = tuple(sorted(
             thread.name for thread in snapshot.threads.values()
             if thread.parent == owner.name and snapshot.status(thread.name).receiving
             and todos.held_for_commander(thread.incarnation)
         ))
-        return cls(len(owed), sum(t.overdue(now) for t in owed),
-                   OrderEditCountRead.count(comms, owner.name), forks)
+        unjudged = sum(
+            read.read() for read in OrderEditCountRead.for_orders(comms.root, snapshot, held)
+        )
+        return cls(len(owed), sum(t.overdue(now) for t in owed), unjudged, forks)
 
     @projected(view="wire")
     def total(self) -> float:

src/agent_comms/commander/order.py

@@ -742,8 +742,8 @@ def due(self, pid: str, at: str, why: str) -> None:
         moved = RecordedEventTime(time.time()).at_clock(at)
         self.call(CommsChangeProblemTool(problem=pid, operation=AssignTodo(
             todo.revision, todo.assignment, moved, todo.order, todo.goal)))
-        self.on_record(f'{time.strftime("%Y-%m-%d %H:%M")} {todo.holder} ({pid} order {todo.order.id} due '
-                  f'{todo.deadline.clock()} moved to {moved.clock()}): {why}', 'Deadline',
+        self.on_record(f'{time.strftime("%Y-%m-%d %H:%M")} {todo.holder} ({pid} order {todo.order.id} '
+                  f'deadline changed): {why}', 'Deadline',
                   VerdictAudience.of(todo.held().owner, todo.goal))
         print(f'{pid}: due {moved.clock()}')
 

src/agent_comms/commander_parity/deletion.py

@@ -0,0 +1,261 @@
+"""Deletion intent parity through real orders, pushed commits and native delivery checks."""
+
+from __future__ import annotations
+
+import contextlib
+import io
+import json
+import shlex
+import sys
+import tempfile
+from abc import ABC, abstractmethod
+from dataclasses import dataclass, replace
+from pathlib import Path
+
+from ..change_report import FileLine
+from ..child_process import CountPrinted, ExitedOutcome
+from ..commander.order import OrderFile, deadline
+from ..field_codec import FieldCodec
+from ..goal_actions import CreateProblemGoalAction
+from ..goals import CountCheckResult, OrderCheck
+from ..plan_phases import RecordPlanePhase
+from ..progress_claims import MergedClaim
+from ..repo import Repo
+from ..todos import (
+    CheckedCommitDelivery,
+    CommitDelivery,
+    DeliveredProblemOrder,
+    FamilyDeletion,
+    MechanicalOrderRun,
+    Todo,
+)
+from ..tool_caller import ThreadCaller
+from ..tools import CommsOrderDoneTool, CommsTodoCreateTool, ProblemOrdered
+from . import ParityComparison, ParityRow
+from .lifecycle import LifecycleObservation, LifecycleRun, MeasuredCommander
+
+
+@dataclass(frozen=True)
+class DeletionComparison(ParityComparison):
+    current: LifecycleObservation
+    native: LifecycleObservation
+
+    @property
+    def passed(self) -> bool:
+        return (
+            self.current.passed and self.native.passed and self.current.checks == self.native.checks
+        )
+
+    def describe(self) -> str:
+        return f"current: {self.current.describe()}; native: {self.native.describe()}"
+
+    @classmethod
+    def read(cls) -> DeletionComparison:
+        return cls(CurrentDeletionPath.read(), NativeDeletionPath.read())
+
+
+class DeletionPath(ABC):
+    """Both adapters exercise the same scenario on independent LifecycleRun copies."""
+
+    @classmethod
+    @abstractmethod
+    def send(cls, run: LifecycleRun, document: OrderFile) -> Todo: ...
+
+    @classmethod
+    @abstractmethod
+    def delivery_command(cls, run: LifecycleRun, todo: Todo, commit: str) -> tuple[str, ...]: ...
+
+    @staticmethod
+    def commit(repository: Path, text: str, message: str) -> str:
+        (repository / "family.py").write_text(text)
+        Repo.git(repository, "add", "family.py")
+        Repo.git(repository, "commit", "-qm", message)
+        Repo.git(repository, "push", "-q", "origin", "main")
+        return Repo.git(repository, "rev-parse", "HEAD").strip()
+
+    @classmethod
+    def read(cls) -> LifecycleObservation:
+        with LifecycleRun.open() as original:
+            # Keep source checkouts out of the copied worker's storage accounting.
+            # Limits remain unchanged; all detached checks use this persistent owned base.
+            rule = original.commander.comms.registry.storage_rule
+            with tempfile.TemporaryDirectory(
+                prefix="parity-deletion-", dir=rule.checkout_base
+            ) as checkouts:
+                root = original.commander.root
+                (root / "storage.json").write_text(
+                    json.dumps(FieldCodec.encode(replace(rule, checkout_base=Path(checkouts))))
+                )
+                (root / "commander.json").write_text(original.commander.model_dump_json())
+                run = replace(original, commander=MeasuredCommander.read_root(root))
+                return cls.exercise(run)
+
+    @classmethod
+    def exercise(cls, run: LifecycleRun) -> LifecycleObservation:
+        repository = Path(run.commander.comms.registry.require(run.worker).worktree)
+        remote = repository.parent / "deletion-origin.git"
+        Repo.git(repository, "init", "-q", "-b", "main")
+        Repo.git(repository, "config", "user.name", "Deletion parity")
+        Repo.git(repository, "config", "user.email", "deletion-parity@localhost")
+        Repo.git(repository, "init", "--bare", "-q", "--initial-branch=main", str(remote))
+        Repo.git(repository, "remote", "add", "origin", str(remote))
+        family = "class RetiredDecision:\n    pass\n\n"
+        cls.commit(
+            repository,
+            family + "def decisions():\n    return [RetiredDecision()]\n",
+            "Declare the obsolete decision family and its caller",
+        )
+        count = OrderCheck(
+            str(repository),
+            shlex.join(
+                (
+                    sys.executable,
+                    "-c",
+                    "import ast;from pathlib import Path;"
+                    "print(sum(isinstance(node,ast.ClassDef) for node in "
+                    "ast.walk(ast.parse(Path('family.py').read_text()))))",
+                )
+            ),
+            CountCheckResult(0),
+        )
+        deletion = FamilyDeletion(
+            "obsolete decision family", FileLine(str(repository / "family.py"), 1), count
+        )
+        initial = OrderFile.read(run.document.read_text())
+        order = replace(
+            initial.order,
+            check=OrderCheck(
+                str(repository),
+                shlex.join((sys.executable, "-c", "import family;assert not family.decisions()")),
+            ),
+            run=MechanicalOrderRun(),
+            deletes=deletion,
+        )
+        document = replace(initial, order=order)
+        run.document.write_text(json.dumps(FieldCodec.encode(document)))
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output):
+            before = cls.send(run, document)
+        partial = cls.commit(
+            repository,
+            family + "def decisions():\n    return []\n",
+            "Repair the caller but leave one obsolete family site",
+        )
+        refused = run.invoke_command(
+            cls.delivery_command(run, before, partial), env=run.python_environment()
+        )
+        after_refusal = run.commander.comms.goals.todos.get(before.id)
+        remaining = count.recorded(partial, str(repository))
+        complete = cls.commit(
+            repository,
+            "def decisions():\n    return []\n",
+            "Delete the last obsolete family declaration",
+        )
+        accepted = run.invoke_command(
+            cls.delivery_command(run, before, complete), env=run.python_environment()
+        )
+        after_acceptance = run.commander.comms.goals.todos.get(before.id)
+        zero = count.recorded(complete, str(repository))
+        primary = order.check.recorded(partial, str(repository))
+        delivered = after_acceptance.order
+        checks = (
+            ("native order retained deletion intent", before.order.checked().deletes == deletion),
+            (
+                "partial commit passed primary check",
+                bool(primary) and order.check.result.distance(primary[0]) == CountPrinted(0),
+            ),
+            (
+                "partial commit retained one family site",
+                bool(remaining) and count.result.distance(remaining[0]) == CountPrinted(1),
+            ),
+            ("nonzero delivery refused", refused.outcome == ExitedOutcome(1)),
+            ("refusal preserved pending order", before == after_refusal and after_refusal.pending),
+            (
+                "zero count checked on delivered commit",
+                bool(zero) and count.result.distance(zero[0]) == CountPrinted(0),
+            ),
+            (
+                "zero delivery accepted",
+                accepted.outcome == ExitedOutcome(0) and not after_acceptance.pending,
+            ),
+            (
+                "accepted delivery names the zero-site commit",
+                isinstance(delivered, DeliveredProblemOrder)
+                and isinstance(delivered.delivery, CheckedCommitDelivery)
+                and delivered.delivery.delivered_commit == complete,
+            ),
+            ("accepted delivery retained deletion intent", delivered.checked().deletes == deletion),
+        )
+        return LifecycleObservation(
+            CommsOrderDoneTool.__qualname__,
+            len((refused, accepted)),
+            checks,
+            output.getvalue() + f"partial={partial}; zero={complete}; "
+            f"refused={refused.outcome.summary}: "
+            f"{refused.stdout.decode(errors='replace')}{refused.stderr.decode(errors='replace')}; "
+            f"accepted={accepted.outcome.summary}: "
+            f"{accepted.stdout.decode(errors='replace')}{accepted.stderr.decode(errors='replace')}",
+        )
+
+
+class CurrentDeletionPath(DeletionPath):
+    @classmethod
+    def send(cls, run: LifecycleRun, document: OrderFile) -> Todo:
+        return run.create()
+
+    @classmethod
+    def delivery_command(cls, run: LifecycleRun, todo: Todo, commit: str) -> tuple[str, ...]:
+        return (
+            sys.executable,
+            "-c",
+            "import sys;from agent_comms.commander.order import Commander,DoneVerb;"
+            "DoneVerb(unit=sys.argv[2],message=sys.argv[3],sha=sys.argv[4]).run("
+            "Commander.read_root(sys.argv[1]))",
+            str(run.commander.root),
+            run.worker,
+            todo.order.checked().id,
+            commit,
+        )
+
+
+class NativeDeletionPath(DeletionPath):
+    @classmethod
+    def send(cls, run: LifecycleRun, document: OrderFile) -> Todo:
+        result = run.commander.call(
+            CommsTodoCreateTool(
+                owner=run.worker,
+                order=CreateProblemGoalAction(
+                    problem="P1",
+                    repo=Repo.of(Path(document.order.check.directory)).github,
+                    text=document.defect,
+                    order=document.order,
+                    request=document.order.request(
+                        run.commander.comms.registry.require(run.commander.commander), ("P1",)
+                    ),
+                    deadline=deadline(run.due),
+                    commander=run.commander.commander,
+                ),
+            )
+        )
+        if not isinstance(result, ProblemOrdered):
+            raise TypeError("Native creation returned no ordered problem")
+        return result.todo
+
+    @classmethod
+    def delivery_command(cls, run: LifecycleRun, todo: Todo, commit: str) -> tuple[str, ...]:
+        request = CommsOrderDoneTool(
+            problem=todo.id,
+            order_id=todo.order.checked().id,
+            delivery=CommitDelivery(commit=commit, delivered_commit=commit),
+            claims=(MergedClaim(commit),),
+        )
+        return request.cli_command(ThreadCaller(run.commander.commander)).argv(run.commander.root)
+
+
+class DeletionTargetParityRow(ParityRow):
+    number = 31
+    capability = "An order states its intent as a deletion target"
+    current = "Current order command with a declared FamilyDeletion"
+    native = "CommsTodoCreateTool and CommsOrderDoneTool check the delivered family count"
+    phases = (RecordPlanePhase,)
+    comparison = DeletionComparison.read