next/committed-authority: non-blocking robustness follow-ups from the #3825 landing squad

[stijn-dejongh]

Summary

Non-blocking robustness/consistency follow-ups surfaced by the second-opinion review squad on #3825 (next-committed-state-authority; fixes #2947 + #3780). None are correctness or fail-closed breaches — the squad cleared #3825 to ship — but each is worth tidying in the next/committed-authority surface. Filed as one issue per landing discipline (fold the majors, batch the rest).

The board-crash regression and two docstring corrections the squad also raised were folded directly into #3825; the items below are the residual.

Items

1. next short-circuit changes the error shape for traversal-unsafe mission handles. _merged_mission_short_circuit now runs read_primary_meta on every next invocation before _dn_bootstrap, so a traversal handle (../foo) raises a bare ValueError from _compose_primary_feature_dir (_read_path_resolver.py:~845) ahead of query_current_state's typed MISSION_NOT_FOUND / read-path-code classification. Valid slugs never trip it, and it still fails closed — but it's a non-byte-identical error-contract change on that malformed-handle edge. Classify the raw ValueError into the typed path-error result, or validate the handle before the short-circuit.

2. blocked_conflict surfaces no operator remediation affordance. For a merged mission with a non-accepted committed WP, spec-kitty next returns kind: blocked indefinitely (correct fail-closed — far better than the next restarts a merged mission when a stale coordination worktree remains #2947 restart/data-loss). The reason string is descriptive but names no recovery command; consider surfacing the remedy (e.g. agent status materialize / how to resolve the straggling WP).

3. agent tasks status board renders a mixed-authority row. After fix(next): resolve state from committed authority — no restart of merged missions, no stall on operator-cancel (#2947, #3780) #3825 the row's lane comes from the committed authority, but the companion fields (resolved_agent_profile/resolved_model via reconstruct_wp_view, and readiness/dependency reduction) still read the possibly-stale coordination feature_dir. On a not-yet-cleaned coord checkout a merged mission shows the correct committed lane beside stale companion fields — display-only, no loop-decision impact, but internally inconsistent. Source the whole row from one committed reduction indexed by wp_id.

4. Two primary-dir resolvers in mission_terminal_verdict can disagree. mission_number is read via read_primary_meta (which has a _canonicalize_handle fallback for bare mid8/ULID/numeric handles) while the status event-log dir is read via _primary_runtime_feature_dir (no such fallback). For composed-slug handles (what the loop/board pass today) they resolve identically; for a non-composed handle they can diverge → has_event_log false → verdict "none" (fail-safe fall-through, never fake-terminal). Unify on one resolver, or assert the two dirs are equal.

Provenance

Surfaced by the #3825 landing second-opinion squad (reviewer-renata correctness lens, paula-patterns boundary lens, architect-alphonso state-authority-design lens). Refs #3825, #2947, #3780, parent epic #1619. Non-blocking; suggest priority:P3 / tech-debt.