I3390 — One conservation reading counts completions per issue, unreachable task commits, stranded claims and multiply-consumed handovers, each violation with its records

✕BLOCKED wave 1 · p1 · implementation profile · parallel safe

Part of recovery-from-injected-faults-is-proven — A killed worker, a cut connection and a conflict are injected on purpose, and recovery is proven without lost work or duplicate completion.

Objective

Add apps/majordomus-cli/src/economics/conservation.rs and a conservation section in economics tasks: over a window, per issue the count of task.finished with outcome completed (a second is a duplicate completion); every commit on a task's branch inside its span reachable from a branch or refs/rescue/ ref (else lost); every exclusive claim in mesh state released, expired or held by a live session (else stranded); every handover whose consumed_by holds more than one session. Each violation names its ledger lines, shas, claim or handover ids.

Why

T5 of the owner's report of 2026-10-19 asks to prove recovery without loss or duplicate completion. Nothing counts either today; the mesh already keeps consumed_by and handover digests, so the reading only folds existing records.

Current state

apps/majordomus-cli/src/mesh/state.rs:274 and :313 carry consumed_by; mesh/handover.rs:15 says materializing twice writes one file; share/events.yaml:152-158 declares session.recovered. No reading counts completions per issue.

Desired state

economics tasks --format json carries conservation with zero violations on a clean fixture and each violation named on a broken one.

Scope

• apps/majordomus-cli/src/economics
• apps/majordomus-cli/src/economics/mod.rs
• apps/majordomus-cli/tests/economics.rs
• docs/ECONOMICS.md
• docs/generated/openapi.json
• docs/generated/openapi.yaml
• site/data/generated/openapi.json

Out of scope

• Repairing a violation
• Lease-based assignment (I3198)

Dependencies

• I3376○READY One capability states each task's wall time and episodes from every checkout's ledger, and names every field it cannot yet fill as not observed

What waits on this

• I3391✕BLOCKED The T5 protocol registers three fault kinds, the trials each needs and what a trial must show, before any fault is injected
• I3392✕BLOCKED The mesh lab injects the three faults into work in progress, and its evidence holds the conservation reading of each scenario
• I3393✕BLOCKED Each fault is injected into real coding-agent sessions on one host, and each trial's recovery and conservation reading are committed

Acceptance criteria

• Fixtures produce each violation kind, each naming its records
• A clean fixture reads zero violations
• Two ledgers each finishing the same issue completed read one duplicate completion
• A commit reachable only from refs/rescue/ is not lost

Validation

• cargo test --manifest-path apps/majordomus-cli/Cargo.toml --test economics
• majordomus generate --check

Evidence required

• test_conservation_violations

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I3390.yaml. Read it back with majordomus plan show I3390.