S1 - Kill deferred-to-queue-as-success

Goal

S1 - Kill deferred-to-queue-as-success.

Implementation Sketch

Contract SSOT: scripts/commit_push/design/2026-07-24-durability-redesign-tp-discuss.md (locked S1-S5 spec) + mission.md north-star. Read both before touching code.

Seven wired sites (remove deferred_to_queue-as-success from ALL)

• Site 1 dispatcher: commit_push_dispatch.classify_commit_push_exit :206-215 deferred_to_queue branch (routes via _classify_apply_done). Highest-fanout node in scope (58 direct tests) — wide-blast-radius edit.
• Site 2 SSOT: halt_classification.DEFERRED_TO_QUEUE_EXIT_REASON :224 — the constant the other sites derive from.
• Site 3 schema: next_action.schema.json action enum + payload.deferred_to_queue / payload.recovery_partial_failure.
• Site 4 tests: dispatcher + state-machine suites (13 tests, sanctioned positive-test rewrite — see Test discipline).
• Site 5: halt_strings.COMMIT_PUSH_HALT_STRINGS union :58-62. Removing site 2 ImportErrors here — a fail-loud forcing function, not a silent gap.
• Site 6: halt_reasons._QUARANTINE_STRINGS :196-199 — deferred_to_queue currently double-classifies as a quarantine halt-string via that same union; no test pins the membership.
• Site 7 (highest severity): closure_services.COMMIT_EXITS + submit_commit_result :68,383-387 — treats a parked local-only ref as plan/bug CLOSURE publication evidence. The mission-inverting bug recurring one layer up, at the layer that marks a section durably done.

Replacement mechanism (do NOT invent new plumbing)

• Mirror the existing PRESENCE-class retry-and-warn branch state_machine.py:~1716-1731: build warnings.append({...}), call _retry_stage_and_commit(bypass_reason), persist via cache_refresh_all(..., warnings_to_record=warnings).
• cache_refresh._WARNING_TARGET_BY_REASON ALREADY maps test_all_fail->tests, extended_check_fail->lint — the known-state destination pre-exists.
• Add the retry branch for the DEFERRABLE (today CORRECTNESS-class) set by reusing DEFERRABLE_HALT_REASONS / extending the classify_halt_reason 3-way dispatch, NOT a 4th standalone is_X_eligible predicate (§5 MISSING_ABSTRACTION twin).
• Co-change risk: every historical commit_push_dispatch.py edit co-touched roadmap.py + test_commit_push_dispatch_repeat_halt.py — re-run that repeat-halt suite even though it targets no deferred_to_queue assertion directly.

Preserve-constraints (S3/S4/S5 depend on these — do NOT touch)

• defer_path.drain_on_entry / state_machine._drain_on_entry_all / queue_git._deferred_commit_queue_enabled materialize+retire the existing 264 parked refs. S1 kills NEW parking only; it must not disable the drain gate.
• Do NOT lean on queue_audit.py’s CURRENT superseded==landed verdict — S4 rewrites it as unsound.

Test discipline (INVERTED-TDD)

• The 13+ existing tests asserting deferred_to_queue IS success are a SANCTIONED positive-test rewrite (the spec itself inverted per the converged design), NEVER delete-to-green.
• Each inverted test pairs with a fresh negative pin asserting the OPPOSITE invariant (per CLAUDE.md §Fix Completeness): flip test_closure_services.py::test_deferred_to_queue_is_publication_evidence to assert a park is NEVER closure evidence; add the pre-existing-gap pin that deferred_to_queue is NOT a member of _QUARANTINE_STRINGS.
• Do NOT widen the DESIGN:connascence-nonlocal producer-set-shared-across-two-consumers pattern while touching it (localizing the SSOT further is out of S1 scope).

Scope boundaries + coordination

• S2 owns structural/durability hard halts — do NOT widen DEFERRABLE_HALT_REASONS to swallow an S2-protected reason.
• BUG-07-532 (open): S1 landing structurally removes its DEFERRABLE-branch instance (nothing defers, nothing strands); its hard-halt-branch instance stays S2’s. Add a HISTORY note on BUG-07-532 once S1 lands — not a blind close.
• AI-seam doc-sync (text-only, direct-editable per tooling-first.md §0.A): .claude/skills/commit-push/SKILL.md + .claude/skills/continue-roadmap/SKILL.md name the current dispatch entry + test_commit_push_dispatch_deferred_to_queue.py path — update once S1 lands.

Layer coverage

• L12 production entry point: real python -m scripts.commit_push run (+ --self-test for the schema-enum removal), NOT a seam-injected unit.
• S1 STOPS the parked-ref count from growing; it does NOT drain the existing 264 (that is S4+S5). Do NOT conflate “S1 done” with the north-star count-0 gate.

Work Items

• Remove deferred_to_queue from every terminal SUCCESS/publication classification site verified in the intel dossier — not only the four originally named (dispatcher, halt_classification, schema, tests) but all seven wired sites: (1) commit_push_dispatch.classify_commit_push_exit’s deferred_to_queue branch; (2) halt_classification.DEFERRED_TO_QUEUE_EXIT_REASON, the SSOT constant; (3) next_action.schema.json’s action enum + payload.deferred_to_queue / payload.recovery_partial_failure descriptions; (4) the dispatcher and halt_classification test suites; (5) halt_strings.COMMIT_PUSH_HALT_STRINGS, which unions the constant into the recognized-string set independently of any force-breaking chain; (6) halt_reasons._QUARANTINE_STRINGS, which currently misclassifies deferred_to_queue as a quarantine-disposition workflow-engine halt string via that same union; and (7) workflow_engine.closure_services.COMMIT_EXITS and submit_commit_result, which currently treat a parked local-only queue ref as publication evidence for durably closing a plan/bug section — the same success-inversion recurring at the closure layer, and the highest-severity of the seven sites since it governs plan/bug CLOSURE, not merely commit routing.
• Resolve state_machine._try_defer_push_failure, which its own docstring documents as a structural no-op today (is_snapshot_deferrable is never true for any push halt_reason) — delete the dead branch or record an explicit dead-branch justification, as part of this section’s own scope per the dossier’s finding, since it is directly adjacent to and shares the mechanism with the code this section rewrites.
• On a deferrable hook failure (test_all_fail, extended_check_fail), commit staged work via internal —no-verify retry
• Record {failed_gate, stderr_tail, scoped_paths, bypass_cause} in the commit body AND known-state warning arrays
• Push that repo immediately after the dirty commit
• Pin: the dispatcher test proving deferred_to_queue is no longer an apply_done-equivalent success (sc-208273ea’s named probe), PLUS negative pins at the other classification sites the rewritten removal touches: invert scripts/workflow_engine/tests/test_closure_services.py::test_deferred_to_queue_is_publication_evidence to assert deferred_to_queue is NEVER accepted as publication/closure evidence, and add a negative pin asserting deferred_to_queue is no longer a member of halt_reasons._QUARANTINE_STRINGS (a genuine pre-existing coverage gap the dossier flags — no test today pins that membership in either direction).

Intel dossier — pointer and tier disposition

Dossier: kill-deferred-success--s-8cf8f007.intel.md (this section’s content/intel/ sidecar)

Read that dossier from line 1 through EOF before acting on this section. This block is a pointer and an audit record, never a substitute: not the BLUF, not a summary, not selected tiers.