Reconcile docs with reality; fix module graph, token compare, health #1

Open
kami wants to merge 216 commits from webui-and-audit-reconciliation into master
Showing only changes of commit 294cbcb078 - Show all commits
+60
View File
@@ -1482,3 +1482,63 @@ F31 DEPLOYED, still awaiting a first rotation
F32 DEPLOYED, live-proven, slot reaped and freed
F33 fixed in 32220d9, needs a rebuild, BLOCKS every launch nondeterministically
```
## Run 5, second attempt: two more layers, 2026-08-28
The stuck launch was recovered by hand, one Enter into the pane. That is an
operator recovery of a keystroke Orchestra believed it had already delivered,
not a lifecycle intervention, and F35 turns it into an action for next time.
### F34, live-proven while being written
```text
01:33:37 first renewal allowed, no baseline, lease extends 21:43 -> 22:03
```
The pane had not changed since 01:13 and held unsent text. The renewal gate
exempts a lease with no baseline, which grants a full free period to exactly
the case the gate exists to catch. Fixed in `92f32d6` by baselining the
progress hash at launch.
### F35: nothing could re-poke a pane
The UI offered `grant_approval`, `deny_approval`, `handoff`, `release`, `block`
and `complete`. Orchestra can put text in an editor and be wrong about whether
it landed, and the only recovery was to destroy the lease and wait out expiry.
`resubmit` presses Enter on text Orchestra itself submitted. No lifecycle
change, so no event; fenced like an approval, on a live worker-owned pane at
the capture revision the operator was looking at. In `92f32d6`.
### The gate, half cleared
```text
01:36:35 phase request accepted: frame to research
01:36:35 acceptance delivered, confirmation=queued
01:36:35 phase changed: session rotating
```
Further than any previous run. `work_phase` reached `research` and the request
artifact was consumed.
### F36: the two halves of the handoff contract disagreed
```text
before adapter: invalid handoff answer: invalid handoff authored field: prose smuggled into list
after adapter: upload handoff: invalid handoff meta
```
F31 cleared the parse, and the release then failed one stage later.
`handoffReason` has emitted `phase_changed` since phase rotations landed. The
validator's `reasons` list was never extended, so every phase rotation built a
handoff it then refused.
Fixed in `b9ca365`. The test asserts the property, not the constant: every
reason the adapter can produce must survive `Validate`, including its fallback.
### Pattern worth naming
Six defects tonight, each hidden behind the one before it. F30 was reachable
only once F29 let an operator act, F32 only once F30 tried to reap, F34 and F36
only once F33 and F31 let execution get that far. Tests passed throughout. The
only thing that surfaced any of them was running the system.