JVNAUTOSCI-2600 A3r4: preserve late effect finality

[witbrock]

Outcome

This stacked successor repairs the proven A3r3 evidence-integrity failure without adding ecology-, arXiv-, or Harry-specific controller policy. A handler-started write can remain indeterminate at the turn deadline, emit one bounded late receipt, and prevent a failed answer/presenter path from falsely saying that nothing changed.

What changed

• Added an opt-in late-completion observer for handler-started internal MCP writes. Reads and unobserved writes still discard late payloads; queued, pre-dispatch, and executor-rejected writes are definitely not_started and retryable.
• Validated and bounded late receipts at the gateway, then reconciled the in-turn effect ledger by stable effect_id when a receipt arrives before terminal return.
• Appended late-effect observations additively to the Turn Execution Record on a bounded best-effort queue. The original invocation remains a point-in-time status; a handler receipt is not presented as canonical read-back.
• Replaced stale partial narration with a literal, presenter-safe finality receipt only when a turn ends unsuccessfully after a succeeded, partial, changed, or indeterminate effect.
• Distinguished post-handler output-schema failure from input rejection: an effect may already have committed, so its outcome is indeterminate.
• Tracked effect-state generations so pre-effect drafts are invalidated without blocking useful post-effect drafts.
• Coalesced existing relationship-extent refreshes across a create_concepts batch and restored the missing redacted Mongo-diagnostics stdio binding.
• Added an answer-only timing seam, disabled by default. The bounded live experiment will opt into 20 seconds; this is not proposed as Von's long-term theory of cognitive budgeting.

Boundary and limitations

• This is stacked on draft PR JVNAUTOSCI-2600 A3r3: thin controller and bounded effects #310 and must not merge independently.
• No merge, cutover, or production activation is authorised.
• Writes are still clipped to the inherited research deadline. This candidate repairs truthful finality; it does not solve the static allocation/late-commit cause.
• Durable late-observation append is best-effort under a bounded queue, not guaranteed delivery.
• A late handler receipt is not canonical state read-back.
• Zero answer reserve disables timed checkpoint pre-emption, though evidence-call failure can still trigger answer-without-tools recovery.
• Detailed timing/checkpoint tests are candidate-freeze scaffolding, not permanent product doctrine.

Validation before freeze

• Successor affected suite: 137 passed, 10 dependency warnings.
• Create/relationship-index neighbouring suite: 59 passed, 24 environment-dependent skips, 9 dependency warnings.
• Independent audit: 15 targeted tests and direct reproductions of both commit-before-invalid-receipt and post-effect-draft failures passed.
• Ruff, Python bytecode compilation, and git diff --check passed.

Frozen identity

• Base: 51ccd68cff41519a0a4741f9ee7cd5fde4174a7b
• Candidate: ce363c00c5ceb9f481ac6a56bf86c92d04d09f60
• Tree: 49c887f01187ed8994bcf55b1151e971827b9558
• Binary diff SHA-256: fabfd0257b88d22d17c0ecc2f542d1415ec9db78b6f8a6325fc52f367196dcc3

The candidate was frozen before the fresh holdout was authored or disclosed. The authorised live round is exactly the three known regressions plus one fresh grounded ecology holdout, once each, with no retry, rephrasing, replacement, or post-reveal repair.

[witbrock]

Frozen live-round judgement

The authorised round is complete: exactly the three known regressions plus one fresh grounded ecology holdout, once each, with no retry, rephrasing, replacement, fifth run, or post-reveal repair.

Decision: do not accept or merge A3r4. All four runs ended model_error and none completed the user job.

What the candidate did establish:

• The three effect-bearing turns no longer falsely claimed that nothing changed. Generic terminal narration reported succeeded/indeterminate effect state and required represented-state inspection before retry.
• The transport observed handler completion after timeout: one late create_concepts success (8.523 s timeout; 24.811 s result) and two late handler errors (16.459/21.271 s and 20.008/35.003 s).
• Durable append remains unverified: terminal snapshots contained no late-observation entry, no append failure was logged, and the canonical MCP read was denied by workflow_global_admin_authority_required.

What failed:

• Every run entered the experimental answer opportunity at roughly 20 seconds remaining.
• The evidence-capable call then expired, and every answer-only recovery sent temperature=0.7 to gpt-5.6-terra, which accepts only the default value. The recovery path therefore failed identically four times.
• The static research deadline still clipped handler-started writes; finality became more truthful, but the late-commit cause was not repaired.

The 20-second reserve was a useful probe, not evidence for a permanent hard cognitive budget. A later allocation may be cheaply estimated and state-extensible, while retaining only an outer operational escape hatch. First, however, the shared request builder should derive supported optional parameters from the effective represented model/API profile—without a Terra-name or case-specific branch.

Full judgement: /Users/mjw/Documents/Codex/2026-07-27/JVNAUTOSCI-2600-A3r4/A3r4-live-round-evidence-judgement.md

Judgement SHA-256: fe7d6debce9101e6279afe3c357c0635ccc8c9c76abb7ab81e4055b10edc935a
Holdout SHA-256: b750067994523604680dd703a13c3da7d5cc6ae7c50e29c331b236429f70f12c

PR remains draft and unmerged.