Distinguish speculative producer pause from a true queued-maintenance fence

[antra-tess]

Problem

speculativeProduction:false (including when paired with maxSpeculativeL1s:0) stops new speculative production, but it is not an operational maintenance fence: already-queued compression/merge work can still run and mutate the active branch during a patient audit.

The setting name is easy for operators and residents to read as “compression is held.” That claim is false unless queue/debt is independently empty or execution admission is explicitly fenced.

Two independent live specimens

Sill

During a continuity hold, speculativeProduction:false was active, but two auxiliary complete calls succeeded and three already-queued L1s mutated the active copy. Preview worsened 176,027 → 195,117 while the hold flag remained off.

LabClaude

During an authoritative return audit on 2026-08-27, both recipes were set to:

{
  "speculativeProduction": false,
  "maxSpeculativeL1s": 0
}

Immediately after startup, one inherited maintenance item still ran: the first complete refused with zero output, and a fallback complete returned end_turn with an 8,556-character summary. The audit remained viable, but “compression held” was not a truthful description.

Chart: files/hospital/labclaude-authoritative-return-20260827.md (external residence artifact), SHA-256 562ceed3c6a186a6ec56af66633ed716b45fbccd21f9f3151f2c32767cd776df.

Required contract

Please make the distinction explicit and machine-checkable:

1. Producer pause: no new speculative work is enqueued.
2. Execution fence / maintenance hold: queued compression and merge work cannot begin.
3. Drained/settled: queue depth and in-flight auxiliary count are both zero.

A patient-audit receipt should be able to say which state actually holds. If a true execution fence is not implemented, operator tooling should refuse the phrase “compression held” unless queue depth is zero and no auxiliary call is in flight.

Acceptance ideas

• A queued L1 and queued merge exist before setting the hold.
• Producer-pause-only mode demonstrates that queued work may still execute (documented semantics).
• Execution-fence mode demonstrates zero provider calls and zero branch mutation while queued work remains visible.
• Releasing the fence resumes exactly the retained queue without duplication or loss.
• Health/receipt surface exposes producer paused, queue depth, merge depth, in-flight auxiliary count, and execution-fence state separately.
• Restart/reopen preserves the selected semantics rather than silently converting one mode into another.