fix(dispatcher): recover durable pushed heads

[coreplane-switchboard]

Legacy merge-ready continuations can now recognize the durable branch push that a completed unit actually recorded, even when its synthesized final-head field is absent. The existing exact-unit, reviewed-head, live-head, budget, CAS, and ownership fences remain unchanged.

Why: Merged PR #2336 could not recover the production record shape behind #2265: findings children retained the published SHA in pushed[], not headSha. This closes only that residual and does not retry or unblock nominal#3589.

Where to look

1. Unit identity and branch checks admit only completed children bound to the exact unit, requester, repository, PR, and branch. ⚠ A weaker filter could import evidence from a standalone or foreign run.
2. Durable push evidence intersects valid unit-branch pushes or legacy final heads with a posted approval at the same SHA. ⚠ Multiple or mismatched heads must still fail closed.
3. Production-shaped fixture records pushed[] without synthesizing headSha, matching the retained U1 evidence shape.
4. Ownership transfer proof pins the recovered binding to the new attempt through the token-scoped reservation transfer. ⚠ A stale or foreign owner must never be displaced.
5. Normal publication boundary proves unit-start and the subsequent coding spawn receive the exact publication binding.
6. Fail-closed matrix rejects standalone, foreign, mismatched, ambiguous, wrong-branch, and wrong-PR evidence before GitHub or ownership mutation.
7. Behavioral contract binds the production record shape and unchanged fail-closed guarantees to their proofs.

Feedback wanted: Check that pushed[] is admitted only as exact unit-branch evidence and that the expanded whole-path matrix leaves no route for moved or foreign heads.

Risk: Incorrect filtering could attach an unrelated SHA to a legacy unit and grant publication authority. Roll back this commit to restore the stricter headSha-only refusal; no migration, state injection, or production mutation is included.

Verified: 563 dispatcher tests and scoped format, type, hygiene, and spec checks passed; all 30 current-head CI checks passed. Merge, release, deployment, and live validation are human-gated.

Decisions (3)

• Treat pushed[] as publication evidence, not thread context. It is the durable projection of a proven push; the entry must name the exact unit branch and still pass every parent, idempotency, requester, repository, and PR check.
• Keep the historical approval as the binding anchor. The live PR head must still equal the uniquely attested SHA, so this change cannot adopt a moved head or make a standalone review unit-bound.
• Reuse the existing recovery transaction. Reservation, full-row CAS, transfer, rollback, budget, and publication fences remain unchanged; only the coding-evidence reader changes.

Validation (6 criteria)

Criterion	Proof
A real completed unit child with only exact-branch pushed[] evidence recovers its posted approved head	dispatcher.test.ts::a legacy merge-ready row recovers one exact approved child head…; red-first and final-pass receipt in coding run
Legacy top-level headSha evidence remains compatible	dispatcher.test.ts::legacy merge-ready recovery retains a coding record's exact final-head evidence
Recovery transfers ownership into a new attempt and reaches normal unit-start/coding publication authorization	dispatcher.test.ts::a real reissue transfers…
Missing, unreadable, standalone, foreign, wrong-unit/ref/PR, ambiguous, mismatched, and moved evidence starts no writer or binding write	Fail-closed matrix plus the existing CAS/transfer/rollback cases in the same suite
Whole-path review found no findings at the exact head	Review run and posted approval
Repository gate passes at the exact head	CI bot gate, workers gate, and CodeQL passed

For agents

The triggering production-shaped evidence is recorded in /Users/justin/worklog/resume/3589-post2336-refusal.md, outside the repository. The implementation deliberately does not add review-only current-head recovery, loosen parent binding, inject state, grant new authority, or claim nominal#3589 readiness. A body-only follow-up failed to update GitHub metadata and changed no code or head; this description was applied afterward through the shepherd's GitHub-bookkeeping path.

[coreplane-switchboard]

LGTM: The pushed-head recovery remains fail-closed and the expanded tests cover the required whole-path authorization and ownership behavior.

Note

Approved · head ae8c6fb · no findings

Full review

No findings. The recovery remains fail-closed while supporting the durable branch-specific pushed[] evidence shape.

[github-actions]

Auto-approved: coreplane-switchboard[bot] reviewed this PR and posted an LGTM verdict (see its review). This repository opted in through its REVIEW_BOT_LOGIN and REVIEW_BOT_ID variables.