[trissim]

P440 — commander authority and fork attribution

Recovers the useful implementation from closed #2540 onto current main for replacement order 51463b6c8ab8. The original branch remains intact. This first checkpoint is a draft: no new test, hosted, installed or live-acceptance claim yet.

CommanderContext retains the parent commander for reads and one typed acting field for attribution. Registered fork authority is resolved before Todo writes. The existing caller/incarnation hierarchy carries that authority while serializing only the actual actor. Shared goal-order binding preserves commander ownership and records the authenticated assigner. Native mutations cannot supply another actor.

Assignment derives SQL field keys from codec/dataclass declarations. One indexed TodoStore.held_in selection serves all open-unit consumers. ProblemNumber owns parsing/formatting; created IDs remain on Todo.id, and the allocation table keeps only unsent issuances. The existing carry preserves its sequence and original Todos.

Patterns: IDEN-1 (commander/actor ambiguity), IMPL-5 (duplicated held-unit query), MEMB-5 (Assignment shape restatement). Replaced context aliases, literal assignment JSON paths and silent malformed-ID handling are deleted.

Source evidence

Baseline 09d45c6. Existing refactor-audit Package parsed 439 Core modules, zero omissions. Declarations, writes, decisions, imports, inheritance and consumers are recorded in owned scratch p440-before-ast.txt; the prior branch's complete patch is p440-prior.diff. Dynamic MRO/SQL binding remains outside syntax proof. NRA's tree_sitter dependency was previously unavailable; this is not a complete NRA result.

Main's OwedAnswer and Settled changes are preserved during recovery. All required behavioural tests and exact-head hosted checks are pending on this draft.

Assumed: the closed draft's useful changes should be retained, not duplicated or discarded; the merger owns fresh installation and installed acceptance. No original or UNKNOWN inputs are replayed. The separate #2543 correction stays on its existing published branch and is not folded into this change.

[trissim]

Superseded by reviewed #2555, which carries all #2540 authority changes and the four copied-bus tests. Per commander replacement order cc6834b63b57, #2555 is the sole implementation and delivery PR. Additional experimental edits on this branch are retained only as a published checkpoint; they are not being ported over the reviewed fix.