Resume held workflows after recording a design decision #1165

Problem

A managed implementation workflow can stop for a design decision but has no supported operation to record the accepted decision and make that Ticket dispatchable again.

At Main bd85a00406f245adffda5b296d4dc8163347cacd, Ticket.Continue immediately returns a non-dispatchable record unchanged. Ticket.Publish advertises resolve_feedback_hold, but that transition is missing.

During #1164, Entry.Run completed Planner → Architect → retained Planner and published a planning hold (needs_decision). After the coordinator recorded the accepted design, it had to submit six separate Entry.Phase calls in the same child REPL. These reused the original native role sessions, but none of their results advanced the managed Ticket. The authoritative record still shows the original three-call planning hold.

Required behavior

Provide the smallest supported workflow operation for resolving this decision/discovery hold and then using normal continuation.

• Identify the exact retained checkpoint and hold being resolved; reject stale, conflicting, wrong-task or unsupported resolutions before dispatch.
• Record the decision, its provenance and accepted input references durably. A recorded design decision is not a permission override or authority to bypass another hold.
• Route accepted or amended decisions through the required original owner, using the validated held result's next/discovery metadata rather than mechanically returning to the role that emitted the hold. Reuse existing phase dispatch, validation, publication and session-identity owners.
• Preserve the original task, role/native sessions, prior results, source/review validity and consumed correction allowances. Any new corrective work is charged according to the existing policy.
• Publish the resulting managed state before authorizing successor work. Repeated resolution and interrupted publication/dispatch must not duplicate completed or uncertain provider effects.
• Keep decision text and evidence in referenced files with bounded metadata. Do not restore large embedded bindings or snapshots.
• Expose an actionable next step when a decision hold is returned, including the supported invocation once its interface is settled.

Supported routing and source boundary

The first version covers retained decision/discovery holds at the clean unchanged launch revision, before implementation source edits or signed feedback. Resolution records and publishes the prepared managed state without invoking a provider. Normal continuation performs the next role call.

The last case is demonstrated by #1164's saved All-owner conflict. That result is standalone, not an actual managed hold; acceptance reproduces the equivalent managed case with deterministic fixtures. Other specialized discovery routes retain their existing owners and policy.

Reject unsupported source-anchor or review-validity cases without changing managed state. General post-edit/post-feedback amendments are deferred and are not a delivery dependency. A decision must never silently preserve an invalid prior PASS or reset source/correction accounting.

Execution failure, uncertain native work, changed-input or source-mismatch holds, exhausted correction bounds and publication failure are excluded from this decision operation. Their existing recovery requirements still apply.

Selected interface

The selected component is:

<Ticket.ResolveDecision record={held}
  decision="/absolute/work/decision.json"
  as="resolved" />

The resolve-decision.md entry takes --props-record and --props-decision, alongside the selected workflow components. The closed ticket-decision.v1 file binds the work, exact continuation descriptor and held-result descriptor to an accept/amend disposition and referenced decision, provenance and accepted-input files. Resolution returns a confirmed envelope for ordinary continue.md --props-steps 1; it starts no provider call. The selected interface is implemented in PR #1198, pending delivery; its exact schema and invocation are documented in the workflow README.

A checkpoint-bound resolution receipt rejects conflicts and retains the recorded successor for a confirmed repeat. Interrupted or uncertain publication remains held; a matching file alone does not establish acknowledgement. Existing dispatch reservations continue to prevent repeated or uncertain role effects.

Existing #1164 recovery — excluded from delivery scope

The user explicitly assigns recovery of the existing #1164 session to Improver as a special case. Do not build automatic historical-session adoption, journal backfilling or a generic recovery mechanism into #1165. Current-run recovery is not an implementation or delivery dependency of this issue.

Preserve the original held checkpoint, saved standalone results, actual source-observation timing, original identities, consumed allowances and joined/active status as honest referenced evidence. Do not claim that later standalone calls advanced the original Ticket. No completed paid work is rerun to manufacture a managed history.

The saved history supplies prospective routing examples. No further live-run investigation or paid design session is needed for this scope decision.

Verification

Prefer executable Markdown acceptance scenarios for:

1. Accepting a Planner decision hold and continuing through the required original sessions.
2. Amending a proposal and routing through original Architect → retained Planner before implementation; accepting an Architect decision returns to that same Architect to finish discovery.
3. Resolving the equivalent managed All-owner case: Implementor needs_discovery at clean unchanged source routes Architect → retained Planner → original Implementor.
4. Rejecting stale, conflicting, wrong-task and unsupported resolutions with no provider dispatch or managed-state change.
5. Repeating or interrupting resolution/publication/continuation without duplicating completed or uncertain effects.

Use deterministic local role fixtures and saved evidence, one canonical scenario per behavior. Lower-level tests cover distinct failure boundaries. No automatic-adoption acceptance requirement, paid exploratory sessions, blanket test deletion or test-framework rewrite.

Scope and sequencing

This is a prospective workflow repair, separate from #1164's Core language feature, Improver's special-case recovery, #1163's fallback implementation and costing. The user now prioritizes #1165 first, followed by the cost-tracking chain and REPL journal bugs, and authorizes implementation through the managed XMD workflow, focused verification, original-role reviews, PR and required CI. The clean source, CLI/runtime and workflow start at verified Main a6c380e45e56b09305510e730b9881747f402790. Claude Opus is the original Implementor. After its bounded CI-repair call hit the provider usage limit without edits, the user explicitly authorized a fresh Codex Implementor for that CI repair only. Preserve Opus's history and the existing three-correction allowance; no silent provider substitution or exploratory paid design sessions are authorized. The agreed bounded design and acceptance remain the implementation contract.

The consumer assessment confirms this bounded contract covers the demonstrated use case with the Implementor-to-Architect routing qualification above. General post-feedback support is optional future scope.

Implementation is tracked in PR #1198, now ready for review at signed head 48e75b99d5c98b5eff3ff044af201fdd400722cd. The original Architect, original Planner and independent Fable reviewer each returned PASS on this exact head. Required CI passed, including green; main health was verified. The additional confirmed-repeat P2 finding was corrected and covered by an origin rewrite/removal regression plus an unfixed-resolver negative control.

The original Node failure passed once on the identical unchanged previous revision; flake #1200 remains open until its cause is fixed. The repeat-origin defect is not established as that cause. Source-correction cycle 3 of 3 is consumed without resetting allowances. Original managed feedback and the older quota-held Fable attempt remain preserved; separate delivery phases record the current head's actual outcomes. The PR has not merged, so this issue stays open until delivery.

Evidence root: /private/tmp/xmd-try-catch-finally-1164-20261107. The read-only index is decision-resolution-evidence-index.json; the consumer verdict is decision-resolution-use-case-assessment.md. The index's entry-7 status is a snapshot, not a completion claim. Preserve a compact portable evidence index with any eventual PR; do not mutate the live run.