docs(cr-dd-016): closeout — record completed lifecycle

docs/change/change_log.md

@@ -6,6 +6,8 @@ This file provides a chronological, human-readable record of applied codebase an
 
 ## [Unreleased]
 
+- Closed out CR-DD-016 after merge (documentation only): CR-DD-016 is complete, accepted, and merged into `main` across three PRs on 2026-08-11 — the requirements contract through PR #155 as merge commit `a3bdd7ca6b940e48a8271d11de7ec5e166494615` (parents `e842ed598a78b6481c7201d0ac43a72832658016` and `afbd47046e43eb89392cfc206263780a25588542`), a corrective amendment through PR #156 as merge commit `35de5068f97090e5e32c24f8a8285a3cd86705f2`, and the bounded implementation through PR #157 as merge commit `7c7fb720aea546763fe062dd08438125d81bdd8c` (implementation commit `01e8b14`, merge-safe status wording `b2d56e3`). The CR defined its own completion as merge of the implementation PR into `main`; that condition was satisfied at `7c7fb72`, and this entry records the resulting final bounded state. Unlike the CR-131, CR-DD-013, and CR-OC-001C closeouts, this entry **retires no false status language**: commit `b2d56e3` deliberately rephrased the status, implementation-authority, and evidence wording before merge so the same text would stay true on both sides of it, so the document needed no post-merge correction and this closeout adds a completion record rather than repairing one. What the merge actually delivered is narrow and text-only. `docs/daily_driver_quickstart.md` gained an "Understand local-capability probing" operator section stating the three-case contract — a `[capability]` declaration with a resolved model binding permits `local_fast`/`local_heavy` route consideration **by itself** and records `Configured`, an operator assertion rather than a checked observation; a fresh probe whose path is also set as `[capability].local_probe_record_path` upgrades that to `ObservedAvailable`, or on an unreachable result conclusively suppresses the declared route the declaration alone would have permitted; and with neither usable, capability is `Unknown` and `local_only` work fails closed — together with the consequence that a probe record older than the 300-second default `freshness_seconds` window is treated identically to no probe at all. `triage_core/tc_cli.py` changed by exactly one `argparse` `help=` string, on `tc probe --output`, which now names `[capability].local_probe_record_path` as the required follow-up config key and states that writing the output file alone has no effect on `tc run`. `tests/test_tc_cli.py` gained one regression test, `test_tc_probe_help_names_capability_probe_record_path`, asserting that against whitespace-normalized help output with `COLUMNS` pinned so the assertion does not depend on ambient terminal width. The four-path Authorized Implementation Allowlist held exactly: the union of files across all five CR-DD-016 commits is the CR document, `docs/daily_driver_quickstart.md`, `tests/test_tc_cli.py`, and `triage_core/tc_cli.py`, and all five named exclusions — `local_backend_probe.py`, `capability_evidence.py`, `config.py`, `client.py`, and `routing/resilience_router.py` — were untouched. No schema, CLI flag shape, default value, command dispatch, probe execution, capability resolution, routing decision, or persistence behavior changed, and CR-DD-013 remains the governing runtime semantics, unreopened. The corrective amendment carried in PR #156 is preserved as part of the durable record rather than applied as a silent fix: the CR as originally merged in PR #155 cited two trials as one root cause, and read-only reconciliation against `resolve_capability` and this repository's own tracked `triagecore.toml` **withdrew** the Aug-8 trial (`task_id` `12fe348e-94fd-43da-8bb8-2aa61a3eb949`) as evidence for a probe-absence-causes-blocking claim, because both routes were declared and bound there and the block traced instead to a sensitivity-driven routing selection; Day-1 Trial 001, which ran before CR-DD-014 added the declarations, remains a genuine no-declaration/no-probe fail-closed instance. That amendment restated the CR's finding as a discoverability gap about what probing assures, not an undiscoverable prerequisite for local execution. Verification at closeout on 2026-08-29 re-ran the pinned regression against merged `main` at `fa66c64`: `test_tc_probe_help_names_capability_probe_record_path` passes, and `tests/test_tc_cli.py` with `tests/test_capability_binding.py` is 55 passed, 0 failed. No backlog retirement was required — CR-DD-016 appears in neither `docs/backlog.md` nor `docs/current_backlog.md`, so unlike the CR-131 and CR-DD-013 closeouts this slice touches no backlog file. Proposal acceptance, the bounded implementation authority, and merge are recorded as granted or decided and now spent; closeout authority was granted by the human operator on 2026-08-29, scoped to exactly this entry and the CR document, and does **not** include merge authority for the closeout PR, which remains a separate human decision. Tracks B and C named in the CR's Sequencing section — the classifier terminal `"refactor"` fallback and the hardcoded `privacy_level="local_ok"` in `_build_resilience_route_input` — are explicitly **not** closed, addressed, or resolved by this closeout; no separate investigation record for either exists under `docs/` as of this entry, and CR-DD-017 independently records both as remaining separately scoped. This entry changes no code, tests, workflow, schema, dependency, fixture, or configuration.
+
 - Closed out CR-131 after merge (documentation only): CR-131 is complete, accepted, and merged through PR #168 as merge commit `2ac5814b37401d3c5ec13b44d9ac961a04bdfbf4` (parents `25734855afd4aca9e28dcfd344731637b2ead39e` and `1da8bc03a2347992d910d9907e193d3050b0e47a`). This entry records the final bounded state now that implementation, merge, release-applicability, and closeout are all resolved. What the merge actually delivered: the repository-root `AGENTS.md`, previously an inherited, generic "Global Orchestration Configuration" document (a Local Worker Council / Cloud Supervisor feedback loop and an unrelated "Cybernetic Ecology Rubric" referencing domain-specific concerns such as water intakes and tribal layers), was replaced in full with a TriageCore-specific repository-governance document — 61 lines, SHA-256 `58d83280245b053718b04cab0fe84c8d9640c09780018761bcf880add088a77e` — covering repository authority precedence, before-acting preflight and worktree hygiene, the full CR lifecycle chain (proposal acceptance through closeout), writable-scope versus read-only-verification separation, evidence and current-state rules, stop-and-request-direction triggers, a pointer to `docs/verification_guide.md` rather than a restatement, non-authority of agent verdicts and instructions, optional tooling, and explicit exclusions. The replacement was reconstructed fresh from then-current `main`, not by committing or cherry-picking a pre-existing uncommitted draft found on the unrelated `codex/agents-governance-separation` checkout, which was consulted read-only as source material only and left untouched throughout. Release was determined **not applicable**: CR-131 changes repository-governance documentation only, with no package, deployment, runtime rollout, or artifact-publication action associated with it. Proposal acceptance, design acceptance, implementation authority, implementation acceptance, merge authority, the release-applicability decision, and closeout are all recorded as **granted or decided and now spent**; the lifecycle-record corrections that kept CR-131's durable status in sync with each stage were carried through PR #167, PR #169, PR #170, and PR #171. This entry does not claim CR-131 resolved every reference to the prior `AGENTS.md` content elsewhere in the repository: `triage_core/project_steward.py`'s embedded "Cybernetic Ecology" escalation-packet language, `docs/operations/control-plane-invariant-checklist.md`'s stale `AGENTS.md §7` citation, and `docs/submission/claim_boundaries.md`'s definition of the now-orphaned `ARTIFACT_REVIEW_PASSED` term were identified during closeout triage and remain explicitly out of scope, tracked separately. The current backlog's stale PR #140-era `AGENTS.md` description is updated in this same closeout slice to a compact current-state record. This entry changes no code, tests, workflow, schema, dependency, fixture, or runtime configuration.
 
 - Closed out CR-DD-013 after merge (documentation only): CR-DD-013 is complete, accepted, and merged through PR #116 as merge commit `98df9c1a51d8d67999517eb8e1008cd55c51e738`. This entry records the final bounded state and retires the pre-merge status language that became false at the moment of merge; before it, the CR's status section still read "Approved for implementation. The bounded implementation is complete on its branch" and the backlog still carried CR-DD-013 as "proposed; documentation only; implementation unauthorized" in the active list, in the daily-driver recommendation paragraph, and in the next-candidate-slices list. What the merge actually delivered is stated narrowly. `tc run` resolves local capability once, before governed route selection, by **reading an already-recorded local-runtime observation** — the existing validated `local_backend_probe_record.v1` from the merged CR-114/CR-118/CR-119 probe lane — through a new `[capability]` section in `triagecore.toml` read via the existing `Config.get_global` mechanism. It performs **no probe of its own**: no automatic probe, completion, chat, embedding, model execution, or provider expansion, no circuit-breaker behavior, and no new ledger schema, with capability provenance carried additively through the existing open `route_decision` payload while the closed `route-worker-ledger.v1` contract stays untouched and `choose_resilience_route`'s decision logic is unmodified. Explicit `declare_local_fast` and `declare_local_heavy` declarations can declare `local_fast` and `local_heavy` for route consideration; ordinary backend configuration — an endpoint, an enabled backend entry, a model name — deliberately does not qualify and still resolves to unknown. **Observed runtime reachability and configured route-class availability remain distinct evidence**, as separate variants of a validated discriminated union: a reachable runtime records `ObservedAvailable` with its source type, evidence tier, `observed_at`, and the applied freshness bound, while a declaration standing in for an absent observation records `Configured` with `source_type=operator_config` and a `config_reference`, and is forbidden at construction from carrying a probe evidence tier or an `observed_at`, so configured capability can never serialize as observed health. Missing, `probe_disabled`, stale, malformed, freshness-indeterminate, and otherwise insufficient evidence all remain **unknown rather than healthy**, through the closed reason set `missing`, `probe_disabled`, `stale`, `invalid_record`, and `insufficient_model_evidence`; a record carrying no `observed_at` — which the probe contract forbids for `synthetic_fixture` records — resolves to unknown with reason `stale`, covering both an expired observation and one whose freshness cannot be established at all. The two asymmetries the CR exists to protect are enforced in the merged precedence: **a fresh observed-unavailable result overrides declarations** and suppresses every route depending on that runtime, so a declaration cannot revive an unavailable runtime; and **a fresh reachable runtime does not by itself prove `local_fast` or `local_heavy`**, because a metadata probe measures neither the memory nor the context envelope those classes imply, so reachability confirms the runtime only and class availability comes from the declarations. With no usable observation and no declaration, all three availability booleans are false and local-only work fails closed through the existing `LocalRouteUnavailableError` path rather than through a second enforcement path. **Direct `TriageClient.run_task` callers that omit the optional capability object retain the previous library behavior exactly** — the prior route-input literals are preserved for them and no observation is inferred on their behalf — so the behavioral change is scoped to the `tc run` construction path, which always supplies a resolution. Two boundaries remain explicitly outside the slice and require new authority: **class-to-model evidence is G3 work**, since nothing here binds a route class to a specific model, and **runtime disappearance after the single pre-route resolution is G6 work**, since capability is resolved once before routing and nothing claims the selected route is still executable when the worker runs — no retry, re-probe, re-route, or execution-time verification exists. Implementation and merge authority for CR-DD-013 are recorded as **exercised and now spent**; any correction, expansion, or downstream integration requires new, separate, explicit authority, and CR-DD-012B remains an independent lane that receives none of it, keeping its own CR-YK-002 atomic-claiming gate and its own separate approval requirement. Historical proposal text is preserved rather than rewritten: the "Proposed Field Shape", "Recommended Design", "Explicit Exclusions", "Provisional Implementation File Allowlist", "Deferred To The Implementation CR", and "Open Questions" sections keep their original wording under supersession notes recording that each was true when written, which parts the merge settled, and which remain open — Open Question 2, whether `local_fast` and `local_heavy` can ever be distinguished from probe evidence alone, is recorded as still unresolved G3 work rather than quietly closed. The merged path set is also recorded against the provisional allowlist in both directions rather than smoothed over: nine paths changed, and `triage_core/config.py` and `triage_core/tc_cli.py` were among them although the provisional section had named `tc_cli.py` as deliberately excluded, while `triage_core/local_backend_probe.py` and `tests/test_local_only_routing.py` were not changed by the merge. The backlog moves CR-DD-013 out of the active list into the completed status section as a compact entry, with design history left in the CR document. This entry changes no code, tests, workflow, schema, dependency, fixture, or configuration, and touches no README or architecture file.