fix(run-hardening): break PM decision-gate, stale-agent, and empty-diff loops (#255)

Forensic triage of a 24h run reconstructed the dominant gateway.rejected
loops from the audit_log. After earlier deploys fixed the i_will_plan crash
and the open_pr push-gap, three real, recurring-capable burn loops remained.
This fixes them at the architecture level, not by prompt-nagging.

journal:decision write-then-gate (the dominant completion-path blocker):
PM decision-point verbs required a separate note(scope='decision') call
before the verb, which loaded/weak models forget to chain — so complete and
unblock hit a tracing_gap (journal:decision missing) and respawn-looped,
stranding finished tasks forever. Each verb now auto-records its OWN
rationale as the journal:decision before the gate runs (the proven
i_am_blocked -> write_struggle pattern), so the gate passes off real,
persisted reasoning. unblock gains a required `reason` (threaded MCP tool ->
request schema -> routes -> choreographer); delegate derives the decision
from its title + description; complete/submit_up/submit_root/escalate_up/
escalate_to_ceo reuse their existing notes/reason. The gate still runs as
defense-in-depth; the auto-record is idempotent within the decision window
and best-effort. Adds JournalService.write_decision and
Choreographer._ensure_pm_decision.

open_pr empty-diff 422: an overlapping-decomposition leaf with zero commits
vs its base makes GitHub 422 "No commits between ...". The generic
invalid_state "retry" looped the dev 15x on one task. open_pr now steers to a
terminal i_am_blocked hand-off so the PM completes or cancels the redundant
leaf.

owns_task stale-agent loop (41x): a superseded agent (task reassigned away)
calling i_am_done/open_pr got a PRECONDITION_OWNERSHIP tracing_gap it read as
a fixable precondition and retried forever. Both verbs now short-circuit with
the clear not_authorized "no longer yours -> give_me_work" steer that
resume/unclaim already use.

RAG docs updated for the new unblock(reason) signature; CHANGELOG entries
added under 0.11.0 (unreleased). open_pr refactored into
_open_pr_preflight_rejection + _open_pr_failure_env to stay within the
return-count and complexity budgets.

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

tests/unit/gateway/test_open_pr.py

@@ -117,7 +117,14 @@ async def test_open_pr_pushes_and_opens_pr() -> None:
 
 
 @pytest.mark.asyncio
-async def test_open_pr_rejects_when_not_assigned() -> None:
+async def test_open_pr_reassigned_steers_to_give_me_work() -> None:
+    """A stale agent (task reassigned away) gets a clear not_authorized that
+    steers to give_me_work — NOT the owns_task tracing_gap it would retry.
+
+    The reassignment short-circuit runs before the spec gate, so the agent
+    never sees the misleading 'fixable precondition' framing that drove the
+    observed open_pr owns_task retry-loops.
+    """
     aid = uuid4()
     other = uuid4()
     tid = uuid4()
@@ -141,10 +148,48 @@ async def test_open_pr_rejects_when_not_assigned() -> None:
 
     git_svc.push_branch.assert_not_awaited()
     git_svc.create_pr.assert_not_awaited()
-    # Spec's PRECONDITION_OWNERSHIP surfaces as tracing_gap (owns_task missing)
-    # rather than the previous bespoke not_authorized message.
-    assert env.error == "tracing_gap"
-    assert env.missing == ["owns_task"]
+    assert env.error == "not_authorized"
+    assert "no longer assigned" in (env.message or "").lower()
+    assert "give_me_work" in (env.remediate or "")
+
+
+@pytest.mark.asyncio
+async def test_open_pr_empty_diff_steers_to_blocked_not_retry() -> None:
+    """An empty-diff subtask (branch has no commits vs base → GitHub 422
+    'No commits between') gets a terminal i_am_blocked steer, not a generic
+    'retry' invalid_state that loops the dev forever."""
+    aid = uuid4()
+    tid = uuid4()
+    t = MagicMock(
+        id=tid,
+        status="in_progress",
+        assigned_to=aid,
+        plan="x",
+        commits=[{"sha": "abc"}],
+        pr_number=None,
+        parent_task_id=None,
+        branch_name="feature/backend/abc12345",
+    )
+    task_svc = AsyncMock()
+    task_svc.get.side_effect = [t, t]
+    task_svc.agent_for.return_value = MagicMock(role="developer", team="backend")
+    _wire_savepoint(task_svc)
+    git_svc = AsyncMock()
+    git_svc.push_branch.return_value = ("feature/backend/abc12345", 1)
+    git_svc.create_pr.side_effect = Exception(
+        'GitHub API refused PR creation (422): {"message":"Validation Failed",'
+        '"errors":[{"message":"No commits between feature/backend/abc12345 and '
+        'feature/backend/abc12345--child"}]}'
+    )
+    deps = _make_deps(task=task_svc, git=git_svc)
+    c = Choreographer(deps)
+
+    env = await c.open_pr(aid, tid)
+
+    assert env.error == "invalid_state"
+    assert "no commits" in (env.message or "").lower()
+    assert "i_am_blocked" in (env.remediate or "")
+    assert "do not retry" in (env.remediate or "").lower()
 
 
 @pytest.mark.asyncio