docs(server): record reassessment contract and acceptance limits

Co-Authored-By: Paperclip <noreply@paperclip.ing>

doc/idle-native-status-reassessment.md

@@ -0,0 +1,88 @@
+# Native status reassessment without idle polling
+
+Native status reassessment uses committed changes and the shared delivery
+scheduler. It no longer runs on every periodic orphan-recovery pass.
+
+## What creates work
+
+Existing native result, assessment, decision, task and review rows remain the
+source of truth. No new queue table or database migration is required.
+
+| Change | Existing producer boundary |
+| --- | --- |
+| Work-product creation, update, import, removal, attachment or trusted promotion | Work-product/task services and the promotion transaction |
+| Task status/version, assignment, execution state or blocker configuration | Task mutation transaction |
+| Automatic review retirement | Automatic completion review owner |
+| Approval/link or interaction outcome, including OAuth card creation/reopening | Approval/review-state notification boundaries |
+| Accepted/rejected control-plane run evidence | Run-event append transaction |
+| Workspace barrier or physical ownership settlement | Workspace operation, finalizer and verified recovery owners |
+| Coordinator claim/retry, effect settlement or run projection | Native finalization and run-milestone boundaries |
+
+These signals request inspection. They do not grant permission to complete a
+task. Discovery retains the three existing conditions: changed work-product
+history, changed authoritative task status/version, or a retired selected
+completion review. The owner still classifies the selected result and appends
+assessments and decisions through the existing status committer.
+
+A settled worker makes no recurring queries. Insufficient evidence is dormant.
+Real contention or operational failure keeps a retry. A saved retry or lease
+expiry keeps its actual future deadline. Startup reconstructs candidates in
+100-row pages; the coordinator processes bounded batches and retains changes
+through drain/resume and concurrent dispatch. Shutdown uses its existing owner.
+
+## Authority and separate responsibilities
+
+Scheduled commit checks the selected source, current task/run, retry and lease,
+pending effects and native process ownership inside the status transaction.
+Retired-review completion also checks the latest contract, workspace barrier,
+physical workspace ownership, governance and dependencies. Evidence is
+reclassified under source locks. Contention defers instead of blocking an idle
+worker indefinitely or committing stale completion.
+
+The legacy reconciler retains explicit recovery and a one-time startup pass.
+Its periodic call skips reassessment but preserves the superseded historical
+source guard before independent workspace recovery. Workspace/result settlement,
+retained session cleanup, native wake delivery and generic orphan recovery are
+separate duties; their recurring scans have not been removed by this slice.
+
+Case-handoff delivery and lease changes do not improve evidence: every persisted
+non-cancelled state already counts as accepted. Cancellation is negative evidence
+and is fenced by the source lock at scheduled commit. Creation generates the
+handoff identity inside its transaction before returning it. No reassessment wake
+is added to every lease renewal. Target-agent status is also not a classification
+trigger: attention validation checks existence, not whether an agent is invokable.
+Creating an agent does not satisfy result criteria or verification. Missing
+arbitrary target identities have no row to lock; this change does not provide a
+general predicate-lock guarantee for independent identity insertion.
+
+Pending child completion is a guard and a fresh parent-turn obligation. It is not
+silently consumed by completing the old result. New contracts supersede the old
+result's eligibility; creating one does not revive that old result. Direct SQL
+writers and independent replicas do not receive process-local notifications.
+The supported producer model remains the active server and integrated transaction
+owners; this change does not add a distributed notification transport.
+
+## Evidence and limits
+
+The corpus/startup/lifecycle selection passes 246 tests; the existing native
+finalization and retained-cleanup consumers pass 32 tests. Workspace typecheck
+and build pass. Earlier producer suites exercise commit/rollback, first real
+writes, failures, dormant history, saved deadlines and authority races.
+
+A 10,000-task selected-history fixture returns no company candidates in about
+35 ms locally. A 10,000-item real backlog takes 101 queries and about 1.56 seconds
+to reconstruct. The coordinator retains outstanding entries; total memory is
+proportional to the backlog. A permanent 103-item lifecycle case verifies actual
+settlement across batches and SQL quiet afterward. Discovery stops between pages
+when drained or aborted; it does not cancel an already-running SQL statement.
+
+Full local-suite acceptance is not yet established. Embedded PostgreSQL cannot
+bootstrap because the host has exhausted System V semaphores. A direct disposable
+initdb probe reproduces the error before application tests execute. Dedicated
+PostgreSQL 17 tests above pass. Remote CI and review must pass on the PR head.
+
+The [audit](plans/2026-10-26-native-status-reassessment-sleep-audit.md) records
+before-fix failures, repairs, producer evidence, benchmarks and retained limitations.
+The [stack ledger](plans/2026-10-24-recurring-server-sleep-stack.md) tracks other
+duties. Worker quiet does not establish database suspension, Cloud alarm coverage,
+host sleep or fleet cost savings.

doc/plans/2026-10-26-native-status-reassessment-sleep-audit.md

@@ -2,7 +2,11 @@
 
 Parent: governed-review response recovery, draft #17702 at `be6ca6151b`.
 This audit starts the next reason in the recurring-server migration stack.
-Parent CI remains in progress; Greptile is 5/5 with no unresolved threads.
+Parent #17702 has passing checks and Greptile 5/5 at that head; it remains unmerged.
+
+Current summary: [worker contract](../idle-native-status-reassessment.md).
+Entries below preserve chronological checkpoints, including earlier incomplete
+states and failures; the latest checkpoints supersede their progress status.
 
 ## Obligation and ownership
 
@@ -926,3 +930,38 @@ sweep still runs for the other listed duties, so this is not whole-process SQL
 quiet or host suspension. Remaining producer/authority audit, final acceptance,
 publication and remote PR gates remain open, along with the older stack findings
 and every remaining recurring-server obligation. No merge occurred.
+
+
+## Producer closeout and PR validation checkpoint
+
+The final source audit distinguishes reactivation from negative evidence. Handoff
+creation uses a fresh identity in its transaction; delivery/renewal/completion
+preserve accepted evidence. Cancellation can only revoke it and is locked by the
+scheduled evidence guard. Existing task cancellation/assignment writers signal
+through the task boundary. No permanent lease-renewal wake was introduced.
+Target-agent existence affects attention validation, not criterion/verification
+acceptance, so lifecycle status changes do not activate the three reassessment
+predicates. Arbitrary missing identities have no row lock; the worker contract
+states this limit rather than claiming a general identity-insertion fence.
+Child completion remains a fresh-turn obligation enforced at status commit.
+Latest-contract creation can invalidate an old result, not make it eligible again.
+The only dormant retired-review prerequisites that can be restored in normal
+operation are current run/task authority and workspace settlement/ownership;
+their real transaction producers and lifecycle tests are recorded above.
+
+At 0337779e6d, workspace typecheck and build pass, in addition to the 278 selected
+integration/consumer tests. Evidence: /tmp/sleep50-workspace-types.log/.status and
+/tmp/sleep50-build.log/.status. All handles are terminal. Fresh origin/master is
+still 1fbbef45a8d399771add7a27a04b12f3a20e264c; the PR base remains slice 49.
+No duplicate reassessment PR was found; related automatic-review migrations are
+#17679 and #17680. Full-stack master reconciliation remains separate unfinished
+work; the PR is not represented as a direct-master diff.
+
+A direct disposable embedded initdb probe explains earlier full-suite failures:
+FATAL could not create semaphores, No space left on device (semget), before tests.
+/tmp/sleep50-pg-init-probe.log/.status preserves the failure. Read-only IPC/process
+inspection found a candidate orphan group, but automatic approval review rejected
+its removal because it changes shared OS resources and PID checks can race.
+Explicit approval for those exact IDs is pending; no cleanup was executed. This
+blocks local embedded-database acceptance, not dedicated PostgreSQL validation or
+remote PR validation. The full goal is still incomplete and no merge is authorized.