feat: recover interrupted dispatches in pickup and handoff

[vunm-dev]

PDN-0004, slice S5 (pickup and handoff recovery). Design: docs/design/PDN-0004-v05-acceptance-recovery.md §13, §21–§23, §26.2 S5. Issue #12. It builds on S4 (#18): classes are carried out through dispatch Reconcile.

What changes

• passdown-pickup:
  • Reads the attempt store read-only in every plan repository: list --unresolved, claims, and probe for C2/C3/C8.
  • New Recovery classes table (C1–C11) with ownership risk and one proposed action each. C9 is computed from session, age and the handoff's open_attempts.
  • Reports a handoff attempt that is missing from the store.
  • The completion check follows the S4 dispatch rule: an unresolved attempt means not accepted, and the latest Dispatched: line decides as a v0.5, host or legacy line (legacy only without receipts).
  • Mutating helper commands are forbidden by name, and pickup never proposes a retry.
• passdown-handoff:
  • Optional open_attempts frontmatter key, and every open attempt named in Caveats / traps with class, location and ownership risk.
  • Never resolves an attempt, and never ticks a task that has one.
  • Applies the same accepted-line rule.
• Both skills say "attempt store not readable: jq missing" instead of guessing.
• Example workspace: a second handoff log with one open attempt. The example ships no store, so pickup there shows the missing-store case.
• Docs: docs/SMOKE_TEST.md gains items for pickup and handoff against a live attempt. README, CHANGELOG and the S5 implementation notes are updated.

Acceptance check (§26.2: "pickup classification uses the same class names the skill defines")

New harness scenario tests/interrupt.sh PICKUP:

1. The class names in the helper's CLASS_JQ plus the reference pickup's C9 must equal the rows of the pickup skill's table and of dispatch Reconcile.
2. Every verdict word the reference pickup prints (accepted, unaccepted, unconfirmed, inconsistent) must be defined in the skill.
3. With a live writer (C3) and a handoff naming an attempt that is not in the store, pickup must leave every file under docs/, src/ and the attempt store byte-identical.

Mutation-checked by hand: dropping | C7 from the pickup skill, dropping | C10 from Reconcile, or letting pickup append to the plan each fails the scenario.

ref-host pickup now reads open_attempts from a real handoff log's frontmatter (F16 was updated to write one).

Review focus

1. Pickup's class table vs §13.2 and vs dispatch Reconcile: is any proposed action stronger than "propose" (pickup must stay read-only), or weaker than Reconcile?
2. Completion-authority wording in pickup and handoff vs the S4 dispatch rule (feat: run delegated dispatch through the v0.5 attempt protocol #18 round 1, finding chore: prepare passdown for public marketplace #1).
3. The C9 threshold: cards have no budget field (§18), so the skill falls back to one hour when none is recorded. Is that acceptable, or should the budget be recorded in the receipt?
4. The example log: showing the missing-store case in examples/basic-workspace versus keeping the example attempt-free.

Tests (local, macOS, bash 3.2)

• tests/interrupt.sh: 35/35 (PICKUP added).
• tests/skills.sh: 142. tests/docs.sh: 32. tests/openspec-apply.sh: 6. tests/install.sh: 7. tests/version.sh: 4.
• shellcheck, sync-bundled --check and validate-plugin are clean.

🤖 Generated with Claude Code

[vunm-dev]

Two recovery issues need adjustment before merging. Validation: 142 skill checks, 32 documentation checks, and interruption scenarios PICKUP and F16 passed. The interruption scenarios required execution outside the sandbox to inspect processes correctly.

[vunm-dev]

[P2] Preserve unresolved handoff IDs when their store is missing

The helper returns an empty array successfully when the store does not exist, so rebuilding open_attempts solely from list --unresolved and omitting the key on an empty result loses previously known attempts. For example, pickup reports an ID from the previous handoff as missing with ownership risk, but the next handoff drops that ID even though nobody has confirmed the worker stopped. Subsequent pickup uses the latest handoff and loses that recovery signal. Carry forward previously recorded IDs whose ownership remains unresolved, including missing receipts, and distinguish an absent/unreadable store from a verified empty store. Please cover pickup followed by handoff with a missing store.

[vunm-dev]

Fixed in 3029311 (skill and helper) and 32b0ff6 (harness).

• passdown-attempt list now warns "absent, not empty" when the store directory does not exist (it still prints []), so the two cases can be told apart.
• Handoff builds open_attempts from two sources: the store's unresolved attempts, plus every ID from the previous handoff whose receipt does not show it resolved. An ID with no receipt stays listed as # receipt missing until the owner confirms no worker remains. An absent store is never evidence that nothing is open. When jq is missing, the previous IDs are carried forward unchanged.
• Pickup treats the handoff's IDs as missing when the store is absent.
• Covered by the new scenario HANDOFF:
  • With a store: the live attempt is listed, the receipt-less ID is carried forward, and the resolved ID is dropped.
  • With no store at all, pickup and then handoff: pickup reports the missing attempt and sees the absent store, handoff keeps the ID, and neither one creates the store.
• tests/attempt.sh checks the warning. HANDOFF fails when the carry-forward of receipt-less IDs is removed.

[vunm-dev]

[P2] Base C9 on inactivity rather than creation age

Section 13.2 requires no update for longer than the budget, but this rule uses the attempt's age, and the helper's age_seconds is measured from created_at. An attempt created two hours ago and updated moments ago by another session is therefore classified as orphaned under the one-hour fallback if it is absent from the latest handoff. Use the last recorded update (for example, the latest receipt transition) for the inactivity threshold and add a case with an old creation time and a recent transition; the existing F16 only covers an old attempt without a subsequent update.

[vunm-dev]

Fixed in 3029311 / 32b0ff6.

• list now reports idle_seconds, measured from the receipt's last transition, next to age_seconds. The pickup C9 row and the reference pickup use it.
• tests/attempt.sh creates an attempt, waits 2 s, arms it, and requires age_seconds >= 2 and idle_seconds <= 1.
• New scenario F16b: another session's attempt is created, and 3 s later that session updates it (observe unknown). With budget 2 it is not C9. After 3 more idle seconds it is C9. F16b fails with the old age-based rule.