[trissim]

Before: P935 sits at MergedProblemOrder(#3596, 33bd05c64) although its own edit 8 says #3596 was only the worker/parser prerequisite. AssignTodo to claude-nra is refused ("Only an undelivered order can change owner": Todo.assigned -> ProblemOrder.require_reassignment -> CheckedProblemOrder.require_transfer). CorrectCheckTodo/CorrectRunTodo keep the wrong merged state, and CorrectOrderTodo.corrected[Order](order: Order) -> Order could not express a state change at all.

After: CorrectMergedLinkTodo joins the existing CorrectOrderTodo family (src/agent_comms/todos.py).

• previous is a MergedLink(link, sha): the exact linked PR plus the merge commit the order recorded. part reads it from the order (OpenProblemOrder.merged_link refuses an unmerged order; MergedProblemOrder.merged_link refuses an unlinked PR), so an absent link, a different link, a different merge or a stale Todo revision is refused before any write.
• replaced is MergedProblemOrder.unmerged(link): copy_as(PendingProblemOrder) with the same id, check, run, edits, scope and times, and only that link removed. Any other linked PR stays on the order, so the watcher reads its merge from the forge again (MergedProgress.found needs every linked PR merged); a real implementation merge is never dropped.
• The correction contract returns OpenProblemOrder (CorrectOrderTodo.corrected/replaced, OpenProblemOrder.corrected), so the state change is typed, with no cast of the old type to itself.
• Commander, open problem and reason checks are the family's own (require_commander, require_open, OrderCorrectionReason). The removed merge is recorded in the order's existing corrections history. StoredOrderStory.archive runs in the write but keys on order id, and the id is unchanged, so it adds no row. No new ledger, no new tool (it decodes through comms_todo as kind: correct_merged_link_todo), no reassignment permission for merged orders.

Control (unrun, per order): tests/test_holder_standing_rules.py::test_merge_through_a_prerequisite_link_is_taken_back_and_the_order_changes_owner. Real TodoStore: wrong merge with a prerequisite link and a real link; stale revision, different link, different merge and an unmerged order are all refused without writes; the correction keeps the real link and every other order field; then TodoStore.assign gives P1 to the outsider under its actual goal, and both Goals are unchanged.

Not in this PR: grouped P935+P872 assignment. The transaction group belongs to a different owner (AssignTodo.group/TodoStore.apply_together), and no public entry exposes it for commands with different orders. Reported separately.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RnH6dR85kyFKcc2tQAJLhK

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.