Sync Boatstack from Intelligence Flow Labs @ 666b0631c31e

[operator-stack-publisher]

What this sync releases

Re-activating an amended plan reconciles delivery progress instead of erasing it

Boatstack binds a feature's delivery state to its plan lock hash, so any re-activation that changes the lock — widening a not-yet-built slice, adding a phase, even an incidental edit — re-derives the slice list from the amended plan. Until now that re-derivation reset the active pointer to 0 and dropped every slice back to BUILD, guarded only against the fully-published case. A partially delivered feature — slice one merged, slice two mid-build — silently lost the record of what had already shipped. The consequence was a hard deadlock: undo correctly refuses to reverse the reset because a live delivery gate would be stranded, and every forward verb (run-preflight, record-delivery-gate, the next activate-plan) re-derives the same wrong state, so the agent loops with no legal move. This is the delivery-state cousin of the transactional-mutation and publication-nonblocking boundaries: a supervisor that re-derives state must never erase the terminal record of what it already shipped.

Re-activation now reconciles the amended plan against the existing delivery state. The already-published prefix [0, ActiveIndex) is preserved verbatim — each slice keeps its PUBLISHED status and its PR and branch bookkeeping — the active pointer holds where it was, and only the recomputable tail is re-derived from the amended definitions (the active slice restarts at BUILD, the rest at PENDING). The superseded lock is appended to the delivery's lock history. Re-activating the identical plan stays a no-op, and amending before anything is published still recomputes cleanly at the head.

An amendment that would drop, reorder, rename, or change an already-published slice, or any edit to a fully-published (immutable) delivery, is refused — and refused before the transactional promote, so a rejected amendment leaves the plan lock and delivery state byte-for-byte unchanged, never half-applied. The refusal names the offending slice and directs the operator to a corrective child delivery, the standing forward-correction path for terminal work. Throughout, "published" is determined from the active pointer and slice status, never from pr_state — real projects were observed to leave pr_state empty even on merged PRs, so keying the published prefix off it would misclassify shipped work as freely amendable.

The boundary ships with a conformance suite covering the preserved published/merged prefix through activate-plan, the no-half-apply refusal, drop/reorder/rename/change rejection, fully-published immutability, the identical-plan no-op, and the benign pre-publication amendment.

Projection provenance

Generated from operatorstack/intelligence-flow@666b0631c31ee9509a4b3cb0f1242fe865a97c24.
Review provenance, tests, and examples before merging.