[trissim]

P957 urgent split: editable allocations and recorded board health

6 commits; 22 files, +923/-306 against faaec88. Current head 7f825e3. Rebased current main: the only conflict was CommanderFrame.current in commander_hud.py; removed main's stale-age early refusal so captured recorded failure remains visible, retaining health-bearing missing/incarnation refusals. Review correction deletes the now-unused ServicePasses.stall renderer. ServicePasses.heartbeat_current owns the age window once; ServiceReading reports a stopped heartbeat without recorded failures, and fresh heartbeats remain fresh despite unrelated watch failures. ReadCommanderUnit refuses stale detail reads with the same health evidence. Source delivery only; author controls and application acceptance remain UNRUN. Paired header source: OpenHCSDev/toad#1335 at e7f7ed7032728d5586f5ed6e0070d7e877fdeff2 (+20/-10, 2 files), merged then reverted by #1339. Not currently claimed installed; root owns qualification of actual restored paired source. No early companion approval.

Original #3609 remains preserved on work/hud-repair-pi--P957 at 53d00d3. Its other 55 obligations are deferred, not accepted or deleted. P957 stays open after this urgent disposition.

1. One editable-allocation family

Before: Assignment intersected launch homes; native writing independently accepted present home checkouts. Two units sharing a read/check base could not receive distinct work, while the home spelling itself could grant writes.

After: StorageRule.edit_boundaries derives physical roots from Order/Repository/Goal CheckoutAllocation members, including absent allocations. Assignment consumes a prepared EditWorkplaces cut; the existing StorageProjection consumes those same declarations plus current recorded holder/generation and actual Git identity. Same-owner/incoming-group allowances remain. Physical aliases conflict; shared Git objects and read/check roots do not reserve editing.

EditWorkplaces moves from turn_digests into storage_rules so Todo preparation and original-edit reading import the owner without function-local cycles. Review-only check/qualified PR sources remain evidence of original calls, not write permissions. Capture filters the prepared allocation map once; it no longer overwrites a second ownership derivation.

PreparedTodoStore carries one transient cut through initial creation, AssignTodo and RestoreHolderTodo. Filesystem acquisition stays outside Todo SQLite mutation; current rows and recorded births/generations are checked at mutation. No new persisted table or mutable permission store.

Deleted: the 9-line legacy StorageRule.require_path write grant, the RegisteredStorageProjection alternate subclass, home-based assignment intersection, repeated allocated-map derivation, and the unused family-wide for_goal default. Allocated homes still qualify through their real Order/Goal member; ordinary launch homes do not.

2. Failure data renders itself; the board watches every input it reads

ServicePassStore remains the failure/completion owner. FailingPass owns failure/error/elapsed formatting; ServicePassFailing inherits it. ServiceReading captures that data once. CommanderLoad owns the shared projected header; CommanderHud extends it with rows; ToAD consumes the same header property.

CommanderFrame.current/read_all retain real clocks/counts without rebuilding. BoardUnavailable carries the captured reading for missing/mismatched publication. Own refusals/malformed records are not caught and rewritten as empty or unavailable results. Unjudged collection catches only actual foreign WorkBranchError/OSError reads and returns typed UnavailableOrderEdits beside successful original calls. Existing OrderProgress.require_read prevents an unread preparation from masquerading as a complete empty edit tuple.

CommanderFrameFile owns frame-plus-service source paths. Presentation watches those paths and reuses its existing expiry tick for elapsed age; no new clock, polling loop or UI state mirror. The open board can discover a service-only failure/recovery without a frame rewrite.

Deleted: four introduced function-local imports, the duplicated local ToAD header, the forwarding CommanderLoad.frame, repeated health-raise formatting, own-error catches, and string-coded unavailable rows.

Exact-head review corrections

• Restored PlainText.REFUSED's original custody/admission literals; prepared is no longer rejected. Fixed the duplicated edit word in Assignment's docstring. The identifier ratchet never required changing this literal.
• Removed ServicePasses.stall (8 lines); its no-failure explanation now lives in ServiceReading.service_status. FailingPass remains the only recorded-failure renderer.
• Freshness is derived only from heartbeat age through ServicePasses.heartbeat_current. CommanderLoad uses it for STALE; ServiceReading.require_current uses it to refuse stale unit details in ReadCommanderUnit.
• UnavailableOrderEdits retains the original WorkBranchError/OSError as a transient typed cause. Only its projected wire error becomes text; CommsUnjudgedTool no longer flattens the cause.
• Authored controls for stale heartbeat with no recorded failure, stale detail refusal, and a fresh heartbeat with an unrelated failing watch. All UNRUN under root-only qualification.

Source closure searched across src/tests: stall had no callers; the HUD contained the single inline freshness window; ReadCommanderUnit is the detail read consumer; CommsUnjudgedTool is the unavailable-edit producer. No new AST execution or checker was run under the author execution restriction.

Source closure and root-only selectors

Production: assignment/create/restore → prepared TodoStore → EditWorkplaces/CheckoutAllocation; CodingToolOwner/checkout CLI/automatic work creation → StorageProjection; HUD/load/unjudged → ServiceReading; frame observation → CommanderFrameFile.source_paths; ToAD CommanderFrameView → shared header. Changed constructors migrate across src/tests; no compatibility aliases.

Author controls UNRUN:

• tests/test_edit_allocations.py: public distinct missing allocations, actual source preflight, physical alias refusal, same-owner group, changed generation and reborn holder.
• tests/test_recorded_board_health.py: actual watch publication, recorded error/age and retained clocks/counts, nonempty independent edits, repeated failure, actual worker recovery, missing publication, mixed readable/unreadable source.
• Existing affected selections: tests/test_commander_forks.py, tests/test_commander_notifications.py, tests/test_storage_rules.py, tests/test_unowned_checkout_work.py; ToAD tests/textual/test_commander_page.py.

No author tests, checker, import probe, build, environment, provider, GUI, install, live registration mutation or input replay. Hosted run40964517634 on35de539a2 reports BroadSwallow at storage_rules.py:740 and TypeErrors:storage_rules.py +1 without an individual type diagnostic. ProgressRead.unread now accepts Iterable[Todo] and the original Exception, recording every affected UnreadProgress at its existing owner. HeldBranchRule.prepare passes (todo,); EditWorkplaces.capture passes affected.values() directly, deleting the handler-local loop. Root's focused check on b5bb6ca identified the new type diagnostic at storage_rules.py:725: tuple[Path, ...] assigned to inferred tuple[Path] | tuple[()]. The existing readable local at :723 now explicitly uses tuple[Path, ...], matching OrderProgress.readable_paths. Same filtering, empty answers, qualification and error reporting. Four older missing-annotation diagnostics remain; no globally green module is claimed. This source correction is author-unrun. Root owns the combined changed-owner qualification, public P963 assignment, matched installed failure/recovery and actual live acceptance. Historical HTTP500 source trace is not established here.

Assumed: root records #1335 as this order's qualified companion, judges the exact paired heads, and restores #3609 continuation after urgent acceptance.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[github-actions]

debt-src at 8dee0da, every finding:

::warning file=src/agent_comms/commander_frame_file.py::LintFindings +1 (warns, never blocks)
::warning file=src/agent_comms/commander_hud.py::LintFindings +3 (warns, never blocks)
::warning file=src/agent_comms/order_tools.py::LintFindings +1 (warns, never blocks)
::warning file=src/agent_comms/service_passes.py::LintFindings +2 (warns, never blocks)
::warning file=src/agent_comms/storage_rules.py::LintFindings +6 (warns, never blocks)
::warning file=src/agent_comms/todos.py::LintFindings +1 (warns, never blocks)
::warning file=src/agent_comms/turn_digests.py::LintFindings +2 (warns, never blocks)
grew TypeErrors:src/agent_comms/storage_rules.py +1