Add bounded partial-decomposition recovery capability for issue 2737

[eanz17]

Summary

Issue #2737 reached a partial decomposition state: the modern child issues exist, while the settled retain-modern transition still requires a fixed sequence of comments on the modern/legacy pairs and closure of only legacy issues #2772, #2773, and #2774 as not_planned.

This fork PR A (dev <- fix/issue-2737-partial-decomposition-recovery, commit 9f12a49) installs a reviewed, disposable code capability for that one incident. It does not contain occurrence data, does not run recovery, and performs no GitHub lifecycle effect.

Authority boundary

The design deliberately requires two independent keys:

• PR A alone owns the closed nine-effect algebra, literal targets/requests, exact order, and singleton changed-path rule for a future PR B.
• A mandatory, separately authored and reviewed PR B will own the immutable occurrence record: incident and prefix-zero baseline, exact PR-A binding, PR-B coordinates, expiry, and cleanup obligation. That data does not exist in this PR.
• Existing live owner projections remain authoritative for PR merge topology, exact-head reviews and required checks, checkout state, canonical codex-refactor-loop:增加大 issue 自动分解为可独立处理子 issue 的能力(共识门控) ChronoAIProject/consensus-rnd#403 decomposition state, target state, [goal] 多设备并发协作 — 多台机器同时安全跑 codex-refactor-loop(下次发版) ChronoAIProject/consensus-rnd#191 controller ownership, authenticated actor/repository, and item-write admission.

Neither PR A nor PR B authorizes a write by itself. Recovery admits only an empty, conflict-free canonical IssueDecompositionApplyProjection, requires two equal complete bindings plus immediate fresh revalidation, performs at most one literal effect per invocation, and accepts an ambiguous transport only when a fresh complete read proves exactly the next public prefix. All drift or incomplete evidence fails closed without retry, compensation, or a later effect.

The capability cannot represent changes to ChronoAIProject/consensus-rnd, parent issue #2737, PR #2752, modern issue state, or any target/action outside the fixed nine effects.

Scope

• skills/consensus-loop/scripts/codex_refactor_loop/issue_decomposition.py adds the generic immutable apply projection; controller_actions.py makes ordinary codex-refactor-loop:增加大 issue 自动分解为可独立处理子 issue 的能力(共识门控) ChronoAIProject/consensus-rnd#403 execution consume that same projection and adds one private incident bridge.
• skills/consensus-loop/scripts/codex_refactor_loop/issue_2737_recovery.py contains the closed parser, binder, live reader, prefix classifier, literal effect port, and private one-effect coordinator.
• skills/consensus-loop/scripts/test_issue_2737_recovery.py, test_issue_2737_cleanup_contract.py, and fixtures/issue_2737_pr_a_cleanup_contract.json cover the production boundary, response-loss behavior, and exact later subtraction.
• test_controller_actions.py and test_skill_reference_anchors.py extend generic behavior and ownership guards.
• SKILL.md and authorizations/runtime-exceptions.md document the temporary fork-only boundary and mandatory cleanup without duplicating effect or occurrence authority.

Operational non-goals are explicit: no public CLI, daemon or wakeup action, host flag, generic executor, receipt/ledger/ticket, durable permit, compatibility wrapper, rollback/compensation, alternate mutation route, or reusable incident framework is added. The future occurrence record is intentionally absent.

Verification

• Implementation run: 34 focused recovery/cleanup tests passed in 39.526s; 953 impacted recovery/cleanup/codex-refactor-loop:增加大 issue 自动分解为可独立处理子 issue 的能力(共识门控) ChronoAIProject/consensus-rnd#403/controller/[goal] 多设备并发协作 — 多台机器同时安全跑 codex-refactor-loop(下次发版) ChronoAIProject/consensus-rnd#191/actor/check/authorization/anchor/wakeup tests passed in 261.389s; full discovery passed 2,621 tests in 386.132s with one pre-existing skip. git diff --check, compileall, imports, and skill validation passed.
• Independent architect review: approve; 34 focused tests and 453 impacted authority/route tests passed.
• Independent security review: approve; 34 focused tests and the full 2,621-test discovery passed with the same one pre-existing skip.
• Independent tests/behavior review: approve; 34 focused tests, 983 impacted matrix tests, and the full 2,621-test discovery passed with the same one pre-existing skip.

The terminal reviewer gate is therefore architect approve + security approve + tests approve. The earlier cleanup-topology blocker was resolved by proving distinct reviewed heads and ordered two-parent PR merges, singleton PR-B contents, exact occurrence/live-PR binding, and cleanup subtraction from the admitted PR-B merge.

Follow-up

The required sequence after this capability PR is reviewed and merged is:

1. Create a separate fork PR B containing only the canonical immutable occurrence record at the code-permitted singleton path, bound to the exact merged PR-A identities and fresh prefix-zero observations; independently review its final head and merge it with the required topology.
2. From a clean detached checkout at the exact PR-B merge SHA, run verify-only and require prefix zero, complete admission, and zero transports.
3. Invoke recovery once per cycle, rebuilding every live gate each time, until the exact public prefix reaches nine; never batch effects.
4. Obtain two independent full terminal P09 invocations, each with zero target writes and zero local durable authority writes.
5. Open, independently review, and merge a cleanup PR that exactly deletes the PR-B record and every incident-specific capability, bridge, test/fixture, path rule, and documentation guard, restores frozen base bytes, and retains only the generic codex-refactor-loop:增加大 issue 自动分解为可独立处理子 issue 的能力(共识门控) ChronoAIProject/consensus-rnd#403 projection/execution behavior and generic tests.

This PR completes only the first step: installation of reviewed code capability in eanz17/consensus-rnd. It creates no PR-B data, executes no recovery, mutates no GitHub item, and makes no change to the upstream repository.

⟦AI:AUTO-LOOP⟧