XY-948: Separate historical and retryable attention lanes

[yvette-carlisle]

Linear: XY-948

Summary

• Separate current operator attention from history-only terminal Run Ledger attention, so stale terminal rows no longer inflate actionable project attention.
• Keep real current attention for active needs-attention labels, blocked queue rows, retained attention worktrees, and blocked post-review classifications.
• Classify retryable app-server, phase-goal, stalled-run, repo-gate, transport, usage-limit, and dynamic-tool failures through one RunFailureWritebackDisposition before any terminal needs-attention writeback.
• Guard explicit manual-attention exits: issue_label_add(decodex:needs-attention) now records intent only; Decodex applies the label only after a paired validated manual_attention comment.
• Reject manual_attention comments that use runtime-owned retry/repair classes.
• Rebind safe stale retained-review orchestration heads when branch/PR/lineage prove the repaired PR head, instead of converting same-PR repair pushes into manual attention.
• Route retained-review request-pending CI failures to review_repair, and unknown check states to wait/readback, so pre-review CI readback cannot apply passive manual attention or decodex:needs-attention by itself.
• Update runtime/spec/operator docs for ownership precedence, retry semantics, failure-writeback disposition, retained orchestration rebind boundaries, and manual-attention semantics.

Root Cause

The original status bug mixed historical terminal needs_attention ledger rows with current operator-facing attention. Active-label and retained-worktree echoes could keep an old terminal attention row counted even after a non-attention post-review lane owned the current action.

Runtime failures were also classified in several places. Startup transport disconnects, account capacity, zero-evidence startup failures, repo-gate repair loops, stalled runs, and phase-goal terminal-path misses could be retryable in one path but still become terminal attention in another. The unified disposition now decides once whether a failure is retryable, structured retryable recovery, or terminal attention.

The explicit tracker-tool path had another gap: prompts told agents to add decodex:needs-attention directly, and the label tool could mutate Linear before Decodex validated the explanatory manual_attention record. The label call is now only run-local intent; validated comment writeback owns the real label mutation.

A retained-review edge still treated request-pending CI red or unknown check readback as passive manual attention before external review was requested. Since decodex:needs-attention blocks later automatic selection, one transient or repairable PR-check readback could freeze an otherwise owned post-review lane. Red checks now become retained repair; unknown check states wait for a later status tick.

Verification

• cargo make fmt
• cargo make lint-fix
• cargo test -p decodex reconcile_post_review_orchestration_repairs_unhandled_ci_red_before_requesting_external_review -- --nocapture
• cargo test -p decodex classify_post_review_lane_request_pending_repairs_unhandled_ci_red -- --nocapture
• cargo test -p decodex classify_post_review_lane_request_pending_waits_for_unknown_check_state -- --nocapture
• cargo test -p decodex reconcile_post_review_orchestration -- --nocapture
• cargo test -p decodex classify_post_review_lane -- --nocapture
• cargo test -p decodex tracker_tool_bridge -- --nocapture
• cargo test -p decodex failure_writeback_disposition -- --nocapture
• git diff --check origin/main...HEAD
• semantic drift audit: pass; changed post-review lifecycle claim is backed by code/tests; legacy external_review_request_ci_red_manual_attention remains only as historical ledger mapping
• cargo make check on 65cc8345939205fb9e7167532e5da4112b3a1a95: fmt-check, clippy, radar validate, site build/check, vstyle, nextest 1154 passed, 1 skipped