feat(protocol): tell the worker it is rework, and repair a stale anchor

[rafael-adcp]

Implements the two genuinely-better findings of DESIGN-REVIEW-2026-08.md (c1
and c13), the two prose contradictions it verified on the way (c4), and the
doc realignment already sitting on this branch. The review itself is committed
here as the record of what was checked — including the ten claims it rejected.

Both findings are the same doctrine applied to the two places that lagged behind
it: mechanics belong to the program, and silence never lands on the operator.

c1 — carry what the program already knows into the envelope

acquire_next held the full state record at claim time and returned
{issue, title, body}; the resume path read the record, decided the verdict from
it, and dropped it too. So two things the program had computed exactly were left
for the model to rediscover:

• Bounce detection. SKILL.md promised "an execute envelope carries
  everything you need, so you never fetch the task again", then asked for one
  more gh issue view --comments and a judgment call to notice a task was coming
  back — while TaskState.requeued() had already answered it with two integers.
• Prior-delivery handover. DELIVERY.md had the model hunt the earlier branch
  and PR in brief.body and the thread, though record.pr has been a first-class
  sticky field since protocol/9. The console got that field; the worker never did,
  and a model that misses it opens a second, orphan PR beside the first.

The won payload gains bounced and pr, and next-action emits both on
execute — from the acquire path and the resume path alike.

• bounced rides every execute, false included: an absent key would read as
  an older program that could not tell.
• pr is omitted when there is none — the rule the markers already follow. No
  delivery is not an empty delivery.
• A bounce survives the claim that answered it: a first claim writes no record
  (§3.1), so every resume reports the same verdict its acquisition did, rather
  than telling the agent halfway through that its rework is a fresh task.

Worker-side ergonomics (§12): no wire-contract change, no PROTOCOL_VERSION bump.

The two skill paragraphs shrink to what is actually left for judgment — "on
bounced, read the thread; the newest feedback is the ask; escalate if nothing is
actionable", and "continue on the envelope's pr".

Independent follow-ups from the same finding:

• contract boundary prints PROTOCOL.md §11 verbatim, and SKILL.md's
  subagent-handover paragraph points at it instead of asking the driver model to
  reproduce the prose from memory. A contract field that produces nothing is a
  broken install, not an empty answer, so it exits non-zero — a caller piping this
  into a prompt must fail loudly rather than paste a blank where the authorization
  rules go.
• main() refuses a placeholder slug (^OWNER/, or anything still wearing <>)
  before any read or write, so the guard triplicated across three SKILL.md files
  becomes a pointer to a program error. Keyed on the positional repo,
  because contract takes one as an option and defaults it to the doc placeholder
  on purpose.

c13 — an anchor the thread can no longer reach

Requeue is strictly total > record.comments, and the derivation is memoryless by
design. Verified sequence:

step	thread total	anchor	verdict
task escalates	N	N	held — correct
operator deletes an old noise comment	N-1	N	held — correct
operator answers	N	N	held — wrong

The task then sits in needs-decision indefinitely while the operator believes
they replied, and nobody is watching that silence except them. That is exactly the
failure class protocol/8 was written to eliminate.

§6 gains a fourth reconciler rule: an open task whose held record's anchor
exceeds the live comment total is rewritten with comments = that total.
Re-anchoring only — the hold is not lifted, because a deleted comment is not an
answer — so the next reply requeues instead of being absorbed. Strictly
additive, which the versioning rule amends in place: no PROTOCOL_VERSION bump and
no HISTORY.md entry.

One deviation from the review's recommendation, and it is load-bearing. The
rule keyed directly on the walk's count would fire on a GraphQL response that
failed to return totalCount: _comment_total floors that to 0, which is below
every anchor ever written, so the reconciler would re-anchor the whole queue to
zero and hand it all back on the next good response. So the walk proposes and the
applier confirms over REST (Api.comment_count, which answers None rather than
0) before writing — the same surface every transition anchors from, so the number
written is comparable to the ones transitions write. Two extra calls, and only when
the rule actually fires.

Three docstrings claimed the low side fails open when it fails closed:
_comment_total, comment_total_of and TaskState.requeued all repeated the
inverted claim — most recently in 497d681's own commit message. Corrected, with the
asymmetry now stated outright: the REST reader's None fails open because it is
one task; the walk's 0 fails closed because it is the whole queue on one bad
response.

c4 — two verified prose contradictions

• README.md said init "installs the task template and its four coordination
  workflows" — contradicting the same README ten lines later ("no workflows") and
  init's actual behaviour: it deletes the retired ones
  (test_init_prunes_every_retired_workflow).
• skills/status/SKILL.md documented a legacy: tag no code has emitted since
  protocol/9 — the example line, its explanation, and two claims that the console
  paginates comment threads, contradicted later in the same file and by
  status.py, which reads no comment at all.

One pre-existing flake, found by running the suite

test_a_renewal_and_a_steal_cannot_both_win failed once under full-suite load.
Reproduced on a clean tree at HEAD before any of this landed: the stub held
every ref create at the CAS barrier, so on the branch where the thief wins, its
follow-up state-record write (§3.1) waits alone for the barrier's full 30s timeout
— a dead tie with the client's own 30s HTTP timeout, which under load wins and
reports a transport failure the protocol never had. The barrier now covers claim
refs only, which is what it exists to synchronize.

Side effect: the test goes from ~32s to ~3.4s, and the conformance suite from 307s
to 205s.

Also on this branch

Two earlier docs commits, unchanged by the above:

• docs: realign the worker docs with protocol/9 — four statements that drifted
  as protocol/8 and /9 landed (the inline authorization block omitting the state
  record, DELIVERY.md's retired "comment and remove the label" gesture, §12's
  missing exit codes 3 and 13, AGENTS.md's summary).
• docs(readme): make the comparison table the FAQ answer that asks for it.

Not in scope

The remaining review items, deliberately left for their own PRs: the validation
anchor refresh (cmd_validate honoring §3.1's SHOULD), KRAKEN_UNDER_TEST in the
conformance harness (c9), GraphQL $variables (c6 extract), and the optional
items — the unit-test split, the rate-limit-aware watcher backoff, the doctor
preflight, the --operator mention.

Verification

286 unit tests        OK   (was 269)
133 conformance tests OK   (was 130)
skill-lint            OK

New coverage, all in tests/COVERAGE.md:

• c1 — test_a_bounced_task_arrives_flagged_and_carrying_its_pr pins the
  envelope end to end, including that the bounce survives the claim; the
  acquire_next payload it comes off is pinned by ClaimNextIterationTests;
  contract boundary, protocol_section and the slug guard by their own unit
  classes.
• c13 — test_a_deletion_buries_every_reply_until_the_anchor_is_repaired pins
  the bug first (the operator's answer absorbed by 4 > 5), then that reap
  moves the anchor without lifting the hold or recovering the reply it already
  absorbed, then that the next reply is seen. Plus four planner cases, four
  applier cases (including the REST confirmation refusing a proposal the walk
  made), and an idempotence pass.

The conformance fixtures moved off the literal OWNER/tasks placeholder onto
acme/* — the slug guard now refuses the former, and test_loop_fast_release.py
already used a real-looking slug for exactly this reason. That rename is the bulk
of the diff's line count and is purely mechanical.

🤖 Generated with Claude Code