supervisor_takeover does not gate pending integration:auto — a (false) success auto-integrated despite takeover

[HenryLach]

Summary

supervisor_takeover pauses the running wave and drains outboxes, but does not gate a pending integration: auto. After a takeover, a batch whose (false) success had already been recorded still auto-integrated into develop.

Severity

P2 — safety/escape-hatch gap. supervisor_takeover is documented as the non-destructive "stop and investigate" control; an integration landing despite it defeats that purpose.

Repro / Observed

1. A batch records a lane as succeeded (in our case a false success — see the P0 issue).
2. supervisor_takeover(reason=...) → reports "Wave paused, outboxes drained, alerts suppressed, worktrees/branches/state preserved".
3. Despite the takeover, the framework then emitted ✅ Integration complete! Fast-forwarded orch/<batch> → develop and the empty change landed on develop.

Expected

While a supervisor takeover is in effect, any pending/queued integration (including integration: auto) should be held until the operator explicitly resumes or integrates. Takeover should suppress auto-integration the same way it suppresses in-transit alerts.

Related

• Real incident: Penster batch 20260719T113450. Recovery required a manual git reset --hard to remove the auto-integrated empty commit.
• See also the P0 (false success on unparseable steps) and P1 (doctor gap) issues from the same incident.

Environment

Taskplane 0.30.4, Runtime V2, integration mode auto.