RFC-015 P1-S2: consolidation protection parity, marker inheritance, playbook advisory

[lantisprime]

Implements RFC-015 Phase 1 slice 2 by mechanical transcription of the frozen, review-ACCEPTed plan docs/plans/rfc-015-p1-s2.md.

What lands

• Protection parity (R4b). Every consolidation path — legacy apply, legacy dry-run, clerk apply, --fold, --all-projects — now derives protected ids through the single shared resolveProtectionOrAbort helper instead of per-path ad-hoc logic. The clerk path's bare catch {} around computeProtectedIds is replaced with a real failure path that aborts and releases the lock.
• Marker inheritance (R4a). A digest inherits playbook: true when any member carries it, on both the legacy and clerk paths, through the frontmatter serializer, the index row builder, and the clerk merge builder.
• Marker-preferring canonical (REQ-8b). Dedupe selects a marker-bearing member as canonical over build order, deterministically.
• Playbook advisory (REQ-9). New exported buildConsolidationAdvisory() in scripts/lib/playbook-registration.mjs, wired into all three envelopes: dry-run, legacy apply, and clerk apply. It names the causing declaration and the recovery path when a cluster is skipped by class-e protection, and flags marker inheritance when a marked-but-undeclared episode is folded.
• CI registration. The new suite runs in the substrate job.

Verification

CI green across all three workflows (Tests, Plugin + schema validation, RFC registry validation) on d660624.

Suite	Result
tests/test-rfc-015-p1-s2-consolidation.mjs	29/29 pass, 1 pending
tests/test-em-consolidate.mjs	8/8
tests/test-store-write-concurrency.mjs	46/46
tests/test-rfc-009-p4-apply.mjs	30/30
tests/test-fold-superseded.mjs	11/11
tests/test-fold-all-projects.mjs	8/8
tests/test-ci-suite-registration.mjs	16/16

Workflow YAML re-parsed after the CI edit (yaml.safe_load resolves all six jobs), since a YAML-invalid workflow edit is how #613 broke.

Two things CI caught after this PR was opened

1. --include-pinned regression (fixed in 9ed38da). Centralizing protection added gating to the legacy dry-run and apply paths, where main had none. Class-0 pinned protection then re-skipped rows the pre-lock row filter had already admitted, so --include-pinned silently became a no-op and a pinned-during-lock-wait race stopped folding. Two suites that pass on main went red: test-em-consolidate.mjs (7/8) and test-store-write-concurrency.mjs test 46 (45/46). Verified against a detached worktree at main to confirm the regression was ours.

liftPinnedGate() strips only the pinned reason, only from the two protectedIds maps those newly-gated paths feed to partitionProtectionSkips. It is a no-op in the default case because the row filter already excludes pinned rows before clustering. protection.mjs, the clerk path and the fold paths are untouched, and every other protection class including playbook-referenced passes through unchanged.

2. t4b_abort_message_discriminates marked pending (d660624). It exposes a real product gap rather than a bad assertion: scripts/em-consolidate.mjs:808 loads the index at module-init with no guard, so the EISDIR fixture throws inside relevance.mjs:100 before resolveProtectionOrAbort runs and the process dies with a raw stack trace and empty stdout. Filed as #626. Closing it is a production change outside this frozen plan, so the leg's fixture and all four assertions are kept verbatim behind a single T4B_PENDING_626 constant; the runner prints a distinct PEND line naming the issue and tallies honestly as 29/29 pass, 1 pending rather than claiming 30/30. Re-enabling is flipping that constant to false.

Review

Adversarial review by an independent GLM-5.2 seat, two rounds, every finding backed by a runtime probe rather than code reading.

Round 1 returned ACCEPT-WITH-MOD with one P2: the clerk apply envelope emitted neither playbook_advisory nor protection_skips, leaving REQ-9 ("both apply paths") half-met. Round 1 also independently proved by probe that the clerk marker chain is correct despite its suite leg passing vacuously, that canonical selection is stable across insertion order, that the abort path releases the lock with no double-release, and that buildConsolidationAdvisory never throws on malformed input.

The P2 was fixed by implementing Listing L11's clerk-envelope prose, and t7b_clerk_marker_inherit was de-vacuumed with a state-D fixture that actually reaches the clerk merge path. Round 2 returned ACCEPT with no findings above NIT, confirming content parity with the legacy envelope, correct negative polarity (both keys omitted, not null), no canonical-superseded leak into protection_skips, and that the rewritten t7b would fail against the pre-fix envelope.

Note that the review rounds predate the two CI-caught items above, which were found by CI rather than by review.

Filed alongside

• em-consolidate module-init loadIndex is unguarded: a corrupt store crashes with a raw stack trace instead of the R4d abort envelope #626 — the module-init loadIndex gap behind the pending t4b.
• Plan-authoring: a verify grep must not count a string its own Listing contains, and prose is not a Listing (both hit in RFC-015 P1-S2) #627 — two plan-authoring defects this slice hit: a verify grep that counts a string its own Listing contains (step 1.13's criterion could never pass as written), and a step whose prose names more edit sites than its Listing supplies blocks (Listing L11's clerk half).
• Recurrence evidence added to em-consolidate --apply discloses no blast radius: no resolved store path, and --confirm authorizes unbounded scale #623.

🤖 Generated with Claude Code