[j3w1]

Part of #110.

Summary

An owner-authorized Orca stop or restart ends every live terminal, including each open objective's coordinator. Until now each such objective needed its own owner decision (R105 handoff) before a new coordinator could continue it. This change adds a third coordinator-change path, pod continue --objective ID --json (internal window-continuation). It continues an open objective whose recorded coordinator a verified owner-authorized window ended, with derived provenance and no per-objective owner decision.

• Verified window. The configured authorization verifier must confirm an owner-authorized, session-ending stop or restart (action orca_window, schema ce-orca-window/v1). That window's pre-stop runtime must be the objective's recorded runtime, and it must have seen the recorded coordinator live at its final read. A drain that ended no session, an unauthorized or unverifiable restart, or a missing verifier each refuses with a named condition.
• Fresh proofs. Pod proves the rest itself:
  • the recorded coordinator is stale or gone, and the caller is live, not a worker, and in the recorded worktree;
  • the Run is unchanged, and no other open objective records it;
  • every admission's identity is unchanged.
  • Admissions are recorded settled, unknown or absent, and none is stamped or settled.
• One transition. Under the objective lock the command preflights capacity and consumes one relay receipt. It writes a pending window_continuation row, rebinds the existing Run with run-use and rereads it, then writes the row done. Reruns finish an interrupted attempt; a lost pending claimant is replaced; a second claimant is refused; a done replay writes nothing. Each ended attempt keeps its observation.
• Cross-holds. At most one coordinator change is pending: a pending owner handoff holds continuation and vice versa. A pending continuation also fences successor claims. R118 treats a done continuation as authority movement.
• Discovery. These surfaces lead with the window step, or a lead task, never an owner question:
  • pod status --objective;
  • every non-owner authority refusal;
  • pod status --list inside a live Orca terminal with a verifier.
  • Outside Orca the list stays read-free.
  • The list returns within one deadline. Discovery runs in a single read-only daemon worker. Unfinished, late or failed rows read continuation unknown with a reason. A closed peer sharing the Run is left to status and the command to prove.

Spec

• R159 and scenarios A532 to A537, with coverage rows.
• R02, R29 and R105 now name the third path.
• The R108 and R148 listing text is amended for the bounded in-Orca discovery.
• VERSION is 0.21.14.

Verification

• Full local gate on the exact candidate, run in an assigned slot under the host lock: Python 3.13 and 3.14 both exit 0 across unit, lanes, incidents, PTY, installer, compile, whitespace, skill, catalog, source and traces.
• Independent review: one design challenge, a full final audit, then affected-scope re-audits through round 7. All required corrections are resolved; one advisory remains, cooperative reads inside the bounded discovery worker.
• New tests: tests/test_window_continuation.py, tests/test_window_status.py, tests/test_discovery_bound.py and tests/test_discovery_git_budget.py. One wall-clock test moves into the serial lane; no budget or target changes.
• NOT_RUN: hosted CI (this PR), installation, and a genuine owner-authorized window. The live window proof waits for the host-side window record.

🤖 Generated with Claude Code