[zy95-12]

Written-by: Codex

Fixes #2526. Target: delivery/ai-centric-development-service.

A merged PR no longer forces completion of its whole Task. Chief can explicitly accept the current Attempt with completed scope, evidence and remaining work. The committed receipt requests a fresh Chief judgement; Chief may then choose a new Attempt from the verified current target SHA containing the accepted merge, preserving Task-role context and old PR history while allocating a new publication identity. Whole-Task closure retains the existing criteria, dependency and input gates.

The actual Chief job receives scoped legal prechecks at projectFacts.tasks[].repositoryRecovery.nextActions and continuationOptions. Public TaskView.nextActions remains the caller's service-command list; TaskView.deliveryChoices projects the same decision prechecks. A board listing only chief.inspect does not limit Chief to inspection. Stale facts require a reread, and a rejected rework never authorizes clearing publicationBinding. Host facts/preconditions can suggest legal choices; Chief selects the action. Personal Agent → human remains the last resort chosen by Chief.

Repeated Chief refusals under the same delivery scope reuse the existing configurable no-progress threshold and task-attention warning path. Summaries disclose at most five exact current failed actions. Changed facts or resolved reasons retire the old warning, so current legal choices do not conflict with historical refusals. No new timer, counter store, planner, fixed role sequence or automatic human escalation.

Current authority, snapshot, candidate/test/independent Review/provider merge, exit and external-write guards remain in force. Save failure rolls back provisional acceptance; original Effects/scheduler/quotas/request receipts provide replay, restart and failed-admission handling. Updated memory, architecture, API/OpenAPI, decision, changelog and canonical mirrors; original context budget retained.

Validation (current head c0fcf9d7a916921f0b932b8140098dd34feceaaa):

• Base-red reproducer; additional meaningful reds for principal revocation, queued TaskView and repeated Chief refusals.
• Final-head full root verify: 5128 passed, 0 failed, including 8 actual DSH runtime checks. Lint/architecture ownership, generated builds, canonical patches, API/OpenAPI and regression stages all passed.
• Five affected suites: 257/0 on 2ed6f54 (same delivery execution logic); final-source Chief/options/warnings refinement: 92/0, API:10/0, original role-budget:6/0. Final doc-only commit archives duplicate evidence links verbatim; production/test code equals 8377946. The actual two-turn Chief context test asserts both legal actions and disambiguation from board commands.
• Measured coverage: shipping-head shared helper line100/branch96.19/function100%; Chief92.58/76.48/79.81; warnings98.43/80.68/87.23 in the 92-test refinement run. The 257-test delivery run measured Delivery96.77/79.52/86.67, TaskView95.27/79.47/76.19, ReviewedMerge100/84.42/96 (line/branch/function). These are whole-module measurements, not 100% added-branch claims. Helper defaults/shortcircuit variants and existing broad-module branches remain unexecuted; covered critical cases include stale/missing evidence, exact failures, revoked rights, unknown exit, rollback, target advancement/squash/missing objects, pending writes and duplicate/restart recovery. No coverage exclusions or weaker assertions.
• Pairing self-review covers correctness, security and conventions; no independent Verifier PASS is claimed. Owner-authorized basic delivery-branch CI, no policy/protection changes.
• Earlier final-core run had an ENOTEMPTY cleanup hook failure in unchanged remote-room.test.js; reasoned full rerun passed. First CI had an unchanged role-GitHub FIFO credential test timeout. Final-head CI attempt1 had one unchanged native group restart wait-condition failure; isolated probe1/0, failed jobs rerun with evidence retained. The final-head role-budget growth failure was repaired by verbatim archival of duplicate historical reference links, preserving the 384000-byte cap and required rules; budget6/0 and full verify now pass. CI Test run 42040426463, attempt2 passed on the exact final head: Node24 and tests-ok both success. No assertion, credentials or CI policy weakened.

Provenance/limits: real Git, actual Runtime/Store restart and OS SDK-protocol subprocess fixtures demonstrate two Dev→Tester→Reviewer deliveries and distinct PR identities; these are deterministic fixtures, not vendor-model/onsite acceptance. Owner explicitly deferred broader mandatory-context-package cleanup to separate work. No live OpenToday mutation, deploy/restart, external provider writes or paid inference. Approved exact target Git objects must be provisioned; missing objects expose scoped repository/branch/SHAs rather than arbitrary fetch or host-HEAD fallback.