[trissim]

P448 follow-up: execution identity and installed stop proof

Original Core #2529 / Toad #1133 and Core #2564 are merged. This follow-up is not installed acceptance.

Changes

• Delete the completed one-shot carry_goal_execution executable and its migration test. The stale P448 migration note was independently deleted on main by Delete the P448 Toad migration note; the pair landed #2569.
• Stop rejects a human through the existing ThreadRole.require_executable before selection can unregister, signal or retire it. Keep existing lock scopes and process fences.
• Fix BOUND-8 in goal_presentation.py: an untagged execution union lost nominal identity. Before: both RunningExecution and AttemptUnresolvedExecution encoded as {goal_id: ...} and decoded as RunnableExecution. Use DeclaredFamily and the existing FieldCodec tagged mechanism; delete the untagged record/null mixins.
• Compare GoalSnapshot using dataclass equality, not asdict, which erased execution class differences.
• Compose RetryableExecution only into executions whose ledger permits Retry. An unresolved attempt remains blocked but has no control capability. No new codec, identity roster or compatibility path.
• Keep current successor and explicit-reissue fixture APIs.

Source evidence

NRA Package/Repository AST inventory: 440 Core and 283 Toad production modules, zero parse omissions. Enumerated GoalExecution/GoalSnapshot declarations, imports and consumers; no direct GoalExecution.from_wire/schema callers. Runtime-dynamic dispatch outside those resolved sites is not an AST proof.

execution-wire-before.log demonstrates the identity loss. execution-final-pure.log independently shows tagged Running and Unknown round trips, with Unknown not offering a control.

Verification

• Installed Core 7dc1894: real native worker held at the controlled provider, then whole-group stop: 1 passed in 15.48s, goal stays Active, 0/2 orders reissued, UNKNOWN unchanged. This qualifies that installed version, not the new codec changes.
• After main integration, 19 targeted owner/fixture checks passed in 8.28s. A first post-merge attempt exposed a deleted cross-test fixture import and a missing error-type import (five setup errors, one failure); the copied bus fixture now lives once in goal_owner_fixture, exposed by pytest's existing plugin mechanism. AST inventory: 471 test modules, zero omissions. One pytest warning remains: the already-imported fixture module cannot be assertion-rewritten; the helper contains no assertions.
• Earlier broader source batch before that main integration: 16 passed, 1 failed. Five declaration-derived same-shape execution cases verify codec identity and change detection; the human stop test verifies unchanged registry bytes. The unsuccessful case printed the correct owner-pause refusal, then its CLI process exceeded a 10-second exit timeout. Do not call this batch green.
• An earlier batch was 17 passed before the final Retry-capability factoring. The broader 21-case attempt had five stale test setup failures (fixed) and four existing source native-prefix refusals. No prefix guard was weakened.
• Current diff check passed. No full suite or local ratchets.

Remaining acceptance

A fresh installation of this pushed head must qualify the new wire family. P448 remains open for a fleet installation carrying #2577 with zero forced Retries, and for unfinished native/UI acceptance in Toad #1135: failure repaint, real Retry click, mention return and DM feedback/reply. The CLI exit timeout remains owned by unit-goalblock pending diagnosis. Existing saved sessions and uncertain inputs were not replayed.

Assumed: no new-head installation or UI success is inferred from source checks or the older 7dc stop run.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.