fix(dispatcher): preserve child identity through setup failures

[coreplane-switchboard]

Coordinator children now reserve a durable run identity before an ID is acknowledged, and setup failures finish that same child record with a typed reason.

Why: Issue #2236 recurred when an advertised coding or review child vanished before its model turn while a separate setup-failure record survived. The repair follows released #2359 and precedes the separate recovery extension.

Where to look

1. Reservation before acknowledgment The coordinator child obtains its durable reservation before registration exposes the run ID.
2. Pre-ack reservation refusal Provisioning returns a typed failure without advertising a child ID when reservation cannot be secured.
3. Durable promotion Ledger promotion keeps the same child identity and makes an unpromoted claim an explicit failure.
4. Claim boundary A coordinator child must complete durable promotion before its model loop proceeds.
5. Same-ID setup finalizer A post-ack setup failure writes the original child ID, parent and typed refusal into its record.
6. Red-first lifecycle coverage Production-shaped dispatcher cases cover failures, replay and the no-second-child invariant.
7. Refusal inventory coverage The new reservation refusal is included in the renderer's exhaustive gate-sentence test.

Feedback wanted: Verify the pre-ack and post-ack boundary, promotion failure behavior, exact-ID parent reads and replay with no second child or budget.

Risk: This changes coordinator-child creation and early failure recording. An incorrect promotion path could again orphan a child or admit duplicate work; inspect the failure-order tests and live release separately.

Verified: At head f57dcb3, all GitHub checks passed and exact-head re-review resolved F1. Post-merge release and live behavior remain separate gates.

Decisions (3)

• Reserve before advertising. The child ID is only useful to the parent if the durable ledger already owns that exact identity when acknowledgment is sent.
• Finish failures on the same record. A post-ack setup failure must retain the advertised ID, parent, idempotency key and typed cause so read-record and replay agree.
• Keep the extension separate. This PR repairs producer identity for P0 ship: the runner dies on a read-record 404 after a review verdict, stranding an approved unit mid-pipeline #2236 only. The one-time 90-minute extension and original-unit continuations follow their own reviewed gate.

Validation (4 criteria)

Criterion	Proof
Pre-ack reservation failure advertises no child ID or model turn.	Dispatcher red-first tests cover reservation refusal and assert no child registration, model call or duplicate spawn.
Post-ack setup and promotion failures finish the advertised same-ID child.	Dispatcher, claim and ledger tests cover original parent/idempotency fields, typed refusal and failure-before-model ordering.
Replay cannot create a second child or consume a second budget.	The same-unit dispatcher regression covers retry during setup and after failure; current-head CI is green.
Exact-head review passes before the person merge gate.	Switchboard re-review recorded LGTM with no findings at f57dcb3; GitHub shows exact-head approval. Live behavior awaits post-merge release.

For agents

Original #2236 unit/ref: plan-deliver-the-focused-p0-p-071515:U1 / plan/deliver-the-focused-p0-p-071515/u1. Do not adopt or mutate unrelated draft #1625, retry the terminal migration unit, or implement the separate extension here. Preserve the person merge gate after current-head CI and review.

🤖 Generated with Claude Code

[coreplane-switchboard]

Changes requested: The child setup finalizer is disabled before durable promotion, leaving an acknowledged coordinator child able to run without a durable identity.

Warning

Changes requested · head ff5b315 · 1 finding: 1 major

Severity	Finding	Where
major	F1 Keep the setup finalizer active until durable promotion succeeds	src/core/dispatcher.ts:2776

Full review

F1 — runLoopStarted becomes true before claimRun promotes the reservation. If promotion fails, open() abandons the durable row and returns untracked, while the setup finalizer is already disabled and the model proceeds. A process crash can then erase the acknowledged child identity; replay may create another child and consume another budget. Keep the finalizer active through promotion, and fail the same-id child with a typed reason unless promotion succeeds.

[justinhelmer]

Exact-head CI receipt for ff5b315dbcc3899b9e667cf4ea12048b5733fe14: ci / bot / test 3 of 4 failed in src/core/dispatch/reply.test.ts, renderRefusal — renders every gate sentence and all eight reference reasons byte-identical. The assertion is expected ['child_reservation_failed'] to deeply equal []; 2,887 tests passed and one failed in that shard. Depot job log.

Please carry this deterministic failure into the existing plan-deliver-the-focused-p0-p-071515:U1 fix round alongside review F1, then require fresh exact-head CI and re-review. The current PR body is also the fallback three paragraphs and still needs the repository's strict-ready sections. This comment grants no merge, extension, deployment, or migration replay.

[coreplane-switchboard]

Same-unit repair is pushed at f57dcb3b02bbbdd03df2df8f438b2e4b4e6f8ee9 on the existing branch.

• F1 fixed: the child reservation survives failed promotion, and setup retains finalization until promotion, seed and working-state commit succeed. Failed setup finishes the same ID with a typed reason; a fence leaves the new owner's row untouched.
• Reported shard failure fixed: child_reservation_failed is covered by the refusal sentence inventory.
• Fresh exact-head CI: all four test shards and the bot, workers, image, web, docs and package gates passed in Depot CI. Local changed-set validation passed 788 tests.

Re-review requested at this exact head, especially the reservation-to-loop handoff and fence behavior. The prior review at ff5b315d is not evidence for this head. The strict map description has been resubmitted with the existing title; rendering requires no further commit. No merge, approval, deployment, extension or migration replay was performed.

[coreplane-switchboard]

LGTM: F1 is resolved at the exact head, with the setup finalizer retained through durable promotion and pre-loop setup and with the refusal inventory repaired.

Note

Approved · head f57dcb3 · no findings

Full review

F1 is resolved, and the refusal inventory fix is present at the exact reviewed head. No findings remain.

[github-actions]

Auto-approved: coreplane-switchboard[bot] reviewed this PR and posted an LGTM verdict (see its review). This repository opted in through its REVIEW_BOT_LOGIN and REVIEW_BOT_ID variables.