do, run, session: codeaf do edits in place, commits nothing, and stops at a price

[santoshkumarradha]

The codeaf do door and the harness landing on santos/dev2: defects a reviewer verified at 3f46952d4. With the bash belt now the default, every codeaf do runs on the run engine, so these reach everyone.

What changed

Finding 2 (blocker): codeaf do committed the person's own uncommitted work. The run road called runengine.Land on the person's own --dir, which staged the whole git status and committed it on the checked-out branch, including the person's edits and untracked files. The run road now keeps the contract --dir documents ("the directory to work in, edited in place") and the older road keeps: it edits in place and commits nothing. The folder is read before the run starts and again after it (session.SnapshotRunTree), so the files the envelope names are the ones the run changed: a file it wrote, a file it edited further, and anything it committed itself. The person's own edits and untracked files are never named and never touched. run.Land is no longer called from do.

• Why this contract and not a copy that lands: --dir promises in-place editing, the older road never commits, and scripts that run codeaf do read the result in the directory they handed it. Working in a copy and landing it would bring back a commit on the person's branch, which neither the help text nor the older road ever promised.
• Tests: TestDoOnTheRunEngineNeverCommitsThePersonsOwnWork, TestARunTreeSnapshotNamesOnlyTheRunsChanges, TestARunTreeSnapshotOutsideARepositoryNamesNothing. The e2e lane TestDoOnTheRunEngine now asserts HELLO.md is in the working tree, listed in files, and that HEAD did not move.

Finding 3: changes to *.lock files never landed. beltTreeWork dropped every path ending in .lock, and every bench-results/ path, by name. What the harness itself writes is now answered in one place, harnessWrote: its own .codeaf folder, its plan store and the files the store's engine keeps beside it, and the shim it arms. Project lockfiles and project folders land. Test: TestABeltLandingCarriesTheProjectsOwnLockfiles, which also found that plandb.db-wal was being staged as work.

Finding 4: no spending control on the default road. runSpendBound: without --yes-spend (or CODEAF_PREAUTHORIZE_SPEND=1), a run is capped at the nearer of the plan-price figure (PlanConsentUSD) and what is left of today's limit. Reaching the plan-price cap exits 3 with stop: price, and reaching the daily cap exits 3 with stop: budget. In both cases blocked_on gives the figure and says to rerun with --yes-spend. A day whose limit is already spent starts nothing. --db is refused with exit 1 and a sentence that points to the older engine. --keep prints record kept at <dir>/.codeaf/plandb.db. The stale comment claiming the older errand is the default is fixed, and so is the --db/--keep help text.

• Tests: TestDoOnTheRunEngineStopsAtThePlanPriceWithoutYesSpend, TestDoOnTheRunEngineStopsAtTodaysLimitWithoutYesSpend, TestDoOnTheRunEngineYesSpendRunsPastThePlanPrice, TestDoOnTheRunEngineRefusesDbInWords, TestDoOnTheRunEngineKeepSaysWhereTheRecordIs.

Finding 11 (minor): an approved hand-off fell back to the older engine with no word about it. The fix is in task.go only. When startKnownTaskRun fails with anything other than the different-ground refusal, the work still starts on the older engine, and the receipt now says It runs on the older task engine, because the run engine could not start it: <reason>. Test: TestAnApprovedHandoffTheRunEngineCouldNotStartSaysSo. The typed /task path (startTaskRun in task_run_belt.go) falls back the same silent way. That file belongs to the run-lifecycle work, so I left it alone.

Finding 14 (minor): CODEAF_CHECK_MODEL did not reach chat /task runs. The chat's engine (run/enginewire.go) now seats checks through config.CheckSeat with no flag, so the environment value reaches them. Test: TestTheChatDoorsCheckRidesTheCheckModelVariable.

Wave 6 change entry: by the time this branch merged dev2, c084b60d7 (#1381) had rolled the entry up into CHANGELOG.md v0.4.0 and deleted it from docs/changes/unreleased/. The merge takes the deletion. The false claims now sit in the released v0.4.0 record: the node engine deleted, CODEAF_TASK_BELT gone, the four node-engine tools gone. So this PR's own change entry carries an invalidates line that corrects each of them. The released record is left untouched.

Manual: worker-harness.md gets three new sections: do edits in place and commits nothing, how much a do run can spend, and --db plus where the store lives. It also covers the check seat for /task and the fallback receipt. The adaptive-runs.md flag table and store section are updated, two probes are added, and the plan-price figure is quoted through the truth table.

Evidence (the shared test box, fresh clones)

RED on the tests-only commit 167df7ef7 (on top of dev2 3f46952d4), log ~/src/trees/do-door-red-167df7ef7/red.log:

• TestDoOnTheRunEngineNeverCommitsThePersonsOwnWork FAIL: the run committed on the person's branch: HEAD moved ... (author codeaf).
• ...StopsAtThePlanPriceWithoutYesSpend and ...StopsAtTodaysLimitWithoutYesSpend FAIL: exit 2, want 3.
• ...RefusesDbInWords FAIL: exit 2, want 1. ...KeepSaysWhereTheRecordIs FAIL: no record kept at.
• TestTheChatDoorsCheckRidesTheCheckModelVariable FAIL: seated on [vendor/chat-plan vendor/profile-careful].
• TestABeltLandingCarriesTheProjectsOwnLockfiles FAIL: yarn.lock, Cargo.lock, poetry.lock, flake.lock and bench-results left behind, and plandb.db-wal staged.
• TestAnApprovedHandoffTheRunEngineCouldNotStartSaysSo FAIL: the receipt hides the fallback.

GREEN on the merged head db90b1b20, all with -count=1, log ~/src/trees/do-door-db90b1b20/green.log: every test above passes, alongside the existing TestDoOnTheRunEngine* tests and the session law TestOnlyRepositoryRootAsksGitWhereTheRepositoryIs. The snapshot asks for the repository through repositoryRoot, so a scratch folder inside somebody else's checkout never reads as theirs.

Gate on the merged head db90b1b20 (this branch merged with origin/santos/dev2 at 525b77fde), in a fresh clone:

• go build ./... EXIT 0, go vet ./... EXIT 0, go vet -tags e2e ./internal/e2e/ EXIT 0, gofmt -l cmd internal empty, go test -count=1 ./internal/manual/ EXIT 0.
• make test-touched BASE=origin/santos/dev2 EXIT 0. That covered ./cmd/codeaf ./internal/e2e ./internal/manual ./internal/run ./internal/session with -count=1, and all five came back ok.
• make check EXIT 0, with 119 packages ok. Log: ~/src/trees/do-door-db90b1b20/gate-check2.log.
• Two earlier make check attempts on the same head failed on tests outside this change, both while the box was under heavy load:
  • TestAnAcceptedFolderFamilyRefusesAFolderThatMovedUnderIt failed with a TempDir RemoveAll cleanup: ... directory not empty race. It is node-engine mirror mode and none of its files are touched here. It passes 10 of 10 alone on both the base and the head.
  • internal/resident's TestRunnerPreemptsPracticeWhenUserWorkArrives failed with user dispatch = 2.
  • Those logs are gate-check.log and gate-check-run2.log in the same folder. Both tests look load-dependent and should be reported as bugs of their own.

After the gate, the only commit is 77d00f2c5, which renames this PR's change entry to 1416 and changes no Go. On that head, make changelog-check (30 entries, all well formed) and go build ./... are both EXIT 0. Log: ~/src/trees/do-door-77d00f2c5/proof.log.