Complete autonomous recovery controls

AUDIT.md

@@ -36,23 +36,31 @@ released agent, or reject a valid completion.
   dropping the live session. `TaskBlocked` remains terminal for an explicit
   operator block. `TestNeedsAttentionRetainsFencedLeaseForLateCompletion`
   covers the durable recovery path.
-- **Retries:** expiry bypasses `Router.HandleEvent`; attempts/backoff are
-  in-memory and unsynchronised. Project durable `attempt`, `next_retry_at`,
-  and failure class; route every reclaim through one transition.
-- **Launch:** repeated start failures hold a lease for up to 30 minutes.
-  Workers must ACK start or NACK with typed evidence; retry transient failures,
-  block invalid handoffs, and immediately free unusable capacity.
-- **Completion:** `.orchestra/done` is the only worker completion signal.
-  Combine an explicit completion intent with native idle/exit identity, the
-  worker-owned quality gate, verified commit, and verified push.
-- **Quota:** worker sessions do not retain a usage source, so live receipts
-  are zero and quota routing is ineffective. Record per-lease deltas and
-  publish both 5-hour and weekly projections; unknown quota fails closed.
-- **Approvals:** the continuity probe required six manual grants. Add audited
-  per-project policy for safe worktree-local reads, edits, tests, and Git;
-  keep destructive, secret, network, and out-of-worktree actions gated.
-- **Observability:** replace release/rotation `continue` paths with durable
-  phase, last error, retry time, lease epoch, pane state, and anchor fields.
+- **Retries:** **Closed 2026-07-30.** Hand-off-less `TaskReleased` is the
+  single durable reclaim transition. It projects exponential `attempt`,
+  `next_retry_at`, and `failure_class`; router assignment reads those fields,
+  so coordinator restarts cannot reset a backoff or retry limit.
+  `TestReclaimPersistsAttemptAndBackoffAcrossReopen` covers replay.
+- **Launch:** **Closed 2026-07-30.** Workers emit a fenced
+  `TaskLaunchAcknowledged` only after a local start/prompt is persisted.
+  Typed NACKs immediately reclaim transient unusable capacity, terminally
+  block invalid handoffs, and retain uncertain live panes for reconciliation.
+- **Completion:** **Closed 2026-07-30.** `.orchestra/done` is explicit
+  intent only; the worker also requires native non-busy identity, runs its
+  quality gate, verifies immutable `TASK.md`, commits, pushes, and checks
+  the remote SHA before it emits completion.
+- **Quota:** **Closed 2026-07-30.** Completion receipts contain native
+  per-lease deltas plus a known/unknown marker. Five-hour and weekly
+  projections are published from the same receipts; any bounded harness
+  without fresh known usage fails routing closed.
+- **Approvals:** **Closed 2026-07-30.** Projects have a validated audited
+  `safe_operations` policy limited to worktree-local read/edit/test/Git.
+  Workers inject it into the task prompt; network, secrets, destructive
+  actions, and paths outside the worktree remain operator-gated.
+- **Observability:** **Closed 2026-07-30.** Task projections now retain
+  lifecycle phase, last error, retry time/failure class, lease epoch, pane
+  state, and anchor. Release/anchor certification faults enter durable
+  `needs_attention` instead of disappearing through retry `continue` paths.
 
 ## P2 — performance