Delegation detail-fidelity + PM-loop hardening (#541)

* feat(gateway): delegation detail-fidelity — details survive hand-off, both directions

Details thinned out at every delegation hop: a PM child task mapped to no
parent criterion was legal (coverage only surfaced at submit_up, after the
whole wave ran — a 12-subtask docs tree grew through 8 review rounds that
way, one child titled 'docs page and route wrapper' shipping only the
page), and QA could pass work on a gestalt read (a 4-scene video brief
shipped 3 scenes past every gate because the features existed only in
prose). Three chokepoint gates:

- delegate (down): every child must declare covers_parent_criteria
  resolving against the parent's real acceptance criteria — no mapping or
  an unresolvable ref rejects naming every offending child and the valid
  criteria; the success envelope carries parent_ac_coverage
  {covered, uncovered} so a wave-planning PM sees remaining gaps in the
  same turn. Full coverage stays enforced at submit_up (waves stay legal).
- pass_review (up): mandatory criteria_verified — one {criterion,
  evidence} entry per task AC, matched by the findings ledger's
  id-or-exact-text matcher, evidence soup-checked and capped; rejects
  naming the unverified criteria; entries render deterministically into
  qa_notes as '[AC] <criterion> — verified: <evidence>' lines. The old
  count-only ac_verdicts gate is superseded (arg kept for back-compat).
- video briefs (structured detail at origination): an enumerable feature
  list (release highlights, or input_props.highlights carried onto a
  reject re-author) becomes its own scene acceptance criterion, bounded to
  the AC caps; a re-author without highlights carries the
  feedback-addressed criterion instead.

Extracted findings.py's criterion matcher into shared unmatched_criteria /
uncovered_acceptance_criteria instead of duplicating it; criteria_verified
joins the WAF free-text exclusion set like findings/issues.

* fix(gateway): break the block/unblock wedge — four hardening fixes from the live PM loop

A cell task looped fe-pm/main-pm block/unblock for hours (10 cycles, 43
spawns): a transient GitHub API error resolving CI became an unwaivable
blocker finding whose own fix text said no code change was required, the
submit freshness guard then demanded a commit no finding called for,
escalate_up auto-blocked, and main-pm's correct recovery plan 422'd on
the approach length cap, degrading it to a bare unblock. Four fixes:

- pr_pass CI-unresolvable refusal is now explicitly transient-worded:
  retry pr_pass shortly, do NOT pr_fail over a CI-status lookup error —
  a platform blip is not a code finding
- submit freshness guard grants ONE unchanged-head resubmission per
  head sha when the findings ledger has zero open rows (all addressed
  without code changes) — stamped via the resubmit_unchanged_head
  marker so the same head can never loop a second time
- unblock carries a flip breaker: block_flip_count marker, and at the
  third flip a one-shot CEO notification flags the task as structurally
  wedged (unblock itself still succeeds — the breaker signals, it does
  not wedge recovery)
- i_will_plan's approach cap truncates at 800 chars instead of
  rejecting — an over-detailed plan must never cost the PM its turn

---------

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

tests/unit/gateway/test_unblock_flip_breaker.py

@@ -0,0 +1,151 @@
+"""The block/unblock flip-flop breaker.
+
+Live wedge: fe-pm's escalate_up auto-blocks a task and main_pm's unblock
+resolves it, repeat — 10 flips, 43 spawns, no forward progress, no cycle
+breaker. ``unblock`` now stamps a per-task flip counter
+(``markers.block_flip_count``) and, at exactly the 3rd flip, best-effort
+alerts the CEO once — the unblock itself always still succeeds.
+"""
+
+from __future__ import annotations
+
+from datetime import UTC, datetime
+from typing import Any
+from unittest.mock import AsyncMock, MagicMock
+from uuid import uuid4
+
+import pytest
+from roboco.foundation.policy.content import markers
+from roboco.services.gateway.choreographer import Choreographer, ChoreographerDeps
+from roboco.services.notification import NotificationService
+
+# Named constants — ruff PLR2004 forbids magic-value comparisons.
+_TWO_FLIPS = 2
+_THREE_FLIPS = 3
+_FOUR_FLIPS = 4
+
+
+def _make_deps(**overrides: Any) -> ChoreographerDeps:
+    base: dict[str, Any] = {
+        "task": AsyncMock(),
+        "work_session": AsyncMock(),
+        "git": AsyncMock(),
+        "a2a": AsyncMock(),
+        "journal": AsyncMock(),
+        "audit": AsyncMock(),
+        "evidence_repo": AsyncMock(),
+    }
+    base.update(overrides)
+    base["journal"].has_decision_for_task.return_value = True
+    base["journal"].latest_decision_at.return_value = datetime.now(UTC)
+    return ChoreographerDeps(**base)
+
+
+def _flip_setup() -> tuple[Choreographer, Any, Any, Any]:
+    """A blocked task whose ``unblock_with_restore`` returns the SAME mock
+    object each call, so the flip-counter marker persists across repeated
+    unblock() calls the way it would on one real ORM row across requests.
+    """
+    pm_id = uuid4()
+    task_id = uuid4()
+    t = MagicMock(
+        id=task_id,
+        status="blocked",
+        pre_block_state="in_progress",
+        pre_block_assignee=uuid4(),
+        pre_block_metadata={},
+        dependency_ids=[],
+        orchestration_markers=None,
+    )
+    task_svc = AsyncMock()
+    task_svc.get.return_value = t
+    task_svc.unblock_with_restore.return_value = t
+    task_svc.unmet_dependency_ids.return_value = []
+    c = Choreographer(_make_deps(task=task_svc))
+    return c, pm_id, task_id, t
+
+
+async def _unblock_once(c: Choreographer, pm_id: Any, task_id: Any, t: Any) -> Any:
+    """Re-block before each call — a fresh flip in the cycle."""
+    t.status = "blocked"
+    return await c.unblock(pm_id, task_id, "resolved upstream; restoring")
+
+
+@pytest.mark.asyncio
+async def test_first_and_second_unblock_do_not_notify() -> None:
+    c, pm_id, task_id, t = _flip_setup()
+    cc: Any = c
+    notify = AsyncMock()
+    cc._notify_ceo_block_flip = notify
+
+    for _ in range(2):
+        env = await _unblock_once(c, pm_id, task_id, t)
+        assert env.error is None, env.as_dict()
+
+    notify.assert_not_awaited()
+    assert markers.get_block_flip_count(t) == _TWO_FLIPS
+
+
+@pytest.mark.asyncio
+async def test_third_unblock_notifies_ceo_once() -> None:
+    c, pm_id, task_id, t = _flip_setup()
+    cc: Any = c
+    notify = AsyncMock()
+    cc._notify_ceo_block_flip = notify
+
+    for _ in range(3):
+        env = await _unblock_once(c, pm_id, task_id, t)
+        assert env.error is None, env.as_dict()
+
+    notify.assert_awaited_once_with(task_id, _THREE_FLIPS)
+    assert markers.is_block_flip_notified(t) is True
+
+
+@pytest.mark.asyncio
+async def test_fourth_unblock_does_not_renotify() -> None:
+    c, pm_id, task_id, t = _flip_setup()
+    cc: Any = c
+    notify = AsyncMock()
+    cc._notify_ceo_block_flip = notify
+
+    for _ in range(4):
+        env = await _unblock_once(c, pm_id, task_id, t)
+        assert env.error is None, env.as_dict()
+
+    notify.assert_awaited_once()
+    assert markers.get_block_flip_count(t) == _FOUR_FLIPS
+
+
+@pytest.mark.asyncio
+async def test_notification_failure_does_not_fail_unblock(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """The real ``_notify_ceo_block_flip`` swallows a notify-service failure —
+    unblock still succeeds on the 3rd flip."""
+    c, pm_id, task_id, t = _flip_setup()
+    monkeypatch.setattr(
+        NotificationService,
+        "send_block_flip_notification",
+        AsyncMock(side_effect=RuntimeError("notification service down")),
+    )
+
+    env = None
+    for _ in range(3):
+        env = await _unblock_once(c, pm_id, task_id, t)
+        assert env.error is None, env.as_dict()
+
+    assert env is not None
+    assert env.error is None
+    assert markers.is_block_flip_notified(t) is True
+
+
+@pytest.mark.asyncio
+async def test_counter_persists_via_marker_across_calls() -> None:
+    c, pm_id, task_id, t = _flip_setup()
+    cc: Any = c
+    cc._notify_ceo_block_flip = AsyncMock()
+
+    await _unblock_once(c, pm_id, task_id, t)
+    assert markers.get_block_flip_count(t) == 1
+    await _unblock_once(c, pm_id, task_id, t)
+    assert markers.get_block_flip_count(t) == _TWO_FLIPS