Sync Boatstack from Intelligence Flow Labs @ eec4b62c152c

[operator-stack-publisher]

What this sync releases

Coding-effort telemetry, held separate from flow regret (J = J_flow + J_coding)

Delivery reports can now carry coding effort (J_coding) beside navigation cost (J_flow), recorded from
its own best-effort telemetry log rather than derived from the delivery graph. A recorded correction
marks one unit of coding effort; the two costs are stored separately and reported side by side.

The separation is enforced by construction: J_coding is never summed into J_flow, never enters the
regret figure, and is never modeled as a graph, optimized, or gated. Only navigation of the
deterministic delivery state machine is ever optimized; the work of writing a fix is measured, not
steered. The telemetry honors the same kill switch as the trajectory trace and never changes any
command's behavior or exit code.

boatstack flow check gate and flow next advisory over the delivery graph (read-only)

A new read-only flow command surfaces the delivery-flow model. flow check runs a static gate over
the owned transition declaration: it confirms the registry is well-formed and that the delivery graph
is live — from every reachable state the flow can still move and still reach a published delivery, with
no deadlocks and no stranded states — and exits non-zero on drift. It reads no repository state, so the
check is deterministic and side-effect free.

flow next composes the authoritative next-move projection with the shortest-path oracle to advise the
lowest-cost next move toward a published delivery, and the remaining navigation cost from where the
delivery sits now. The advice is explicit about being advisory and resolves the flow position only from
concrete slice-lifecycle stages; an ambiguous or pre-activation stage prints the authoritative
recommendation with no oracle route rather than guessing one. Both subcommands are additive — they
change no existing command, gate, authority, evidence, or exit code.

Flow control steers committed mutations away from proven friction (on by default, kill switch)

Committed delivery mutations now pass through a flow-control choke point before their handler runs.
When the delivery graph proves a move is friction — illegal from the current state, so the real state
machine would reject it anyway — the controller pre-denies it and points at the low-cost next move
instead of letting the attempt fail with a bare error. This is on by default and reversible with the
BOATSTACK_FLOW_CONTROL=0 kill switch, which restores the prior behavior exactly.

Enforcement is deliberately conservative. It acts only on moves whose graph legality provably matches
the real guard — publishing before the review gate, and recording a review gate before the test gate —
so a pre-denied move is always one the state machine would have rejected regardless: guidance and
telemetry change, outcomes do not. It never acts when the flow position is unresolved, never touches
recovery or read-only verbs, and leaves mode-sensitive or re-entrant moves entirely to their existing
handlers. Every guarded attempt is recorded to the shadow trajectory log, so the friction the model was
built to measure is now measured on the real forward path.

boatstack flow report — per-session flow regret and coding effort

A new read-only flow report subcommand renders the current session's delivery-flow navigation from
the shadow logs: how many moves were taken, the observed navigation cost (J_flow), the oracle's cost for
the same start and goal (J_flow*), and the regret between them — with coding effort (J_coding) shown as
a separate figure and never folded into the regret. When the oracle cannot place the session's start
against the goal, the regret line is withheld rather than fabricated.

The report reads only the append-only logs and never fails on an empty session. Its --json form is a
stable, public-safe surface suitable for a downstream retro to consume when attributing where a
session's regret concentrated — closing the observe → derive → compare → advise → control loop with a
measurement an operator can actually read.

Projection provenance

Generated from operatorstack/intelligence-flow@eec4b62c152cc2da37579f891706640bff9cb1a6.
Review provenance, tests, and examples before merging.