roadmap: #281 filed

ROADMAP.md

@@ -17169,3 +17169,15 @@ Distinct from #266 (typed-error-kind enumeration — the runtime needs typed dis
 Required fix shape: (a) extend `run_prompt_json` envelope at `main.rs:4699-4724` with a top-level `hooks: [HookInvocationReceipt]` array where each entry is `{ event: "pre_tool_use" | "post_tool_use" | "pre_tool_use_failure" | "post_tool_use_failure", tool_name, tool_use_id, command, started_at, completed_at, duration_ms, outcome: "completed" | "cancelled" | "denied" | "failed", exit_code: Option<i32>, stdout_preview: Option<String>, stderr_preview: Option<String>, updated_input_changed: bool, permission_override: Option<String> }`; (b) add a JSON-mode `HookProgressReporter` impl that buffers `HookProgressEvent`s into a `Vec<HookInvocationReceipt>` instead of writing to stderr, attached unconditionally in `prepare_turn_runtime` (drop the `emit_output` gate at `main.rs:7726`); (c) align the `hooks` field with the existing `tool_uses`/`tool_results` array schema so consumers who already index by `tool_use_id` can correlate hook receipts to the tool they fired around; (d) extend `run_prompt_compact_json` (`main.rs:4665-4688`) to include either the full `hooks` array or a `hook_invocations: N` count so the compact envelope does not silently strip a fourth observability dimension on top of the six already documented in #260; (e) add a top-level `hooks_summary: { pre_tool_use_count, post_tool_use_count, denied_count, failed_count, cancelled_count }` for cheap aggregate consumers; (f) regression-test a workspace whose `settings.json` defines a `PreToolUse` hook that denies one tool and a `PostToolUse` hook that runs on success, asserting the `--output-format json` envelope contains exactly two hook receipts with the correct outcomes and stdin/stdout previews; (g) document the `hooks` field in `--help` and the wire-format docs alongside `tool_uses`/`tool_results`; (h) close the loop with #107 by having `claw doctor --output-format json` add a `hooks_subsystem` block describing configured hooks (audit-once) so #107 + #280 collectively close the hook-observability-spanning-doctor-and-runtime pair. Acceptance: an operator scripting `claw -p "x" --output-format json | jq '.hooks[]'` can enumerate every hook invocation that fired during the turn with its outcome, and a security-audit hook can prove it ran without scraping stderr or reverse-engineering tool_result reason strings.
 
 **Status:** Open. No source code changed. Filed 2026-04-26 17:05 KST. Branch: feat/jobdori-168c-emission-routing. HEAD: `bdcf3fa` before filing (post fast-forward onto gaebal-gajae's #279 unknown-fields silent-drop pinpoint). Cluster delta: founds NEW `Hook-execution-event-envelope-coverage` cluster (1 member, #280 solo founder); pair-bundle with #107 (doctor-side hook opacity); seventh complementary-pinpoint-pair-bundle in the discovery-pattern catalogue (turn-budget #262+#264 + WebSearch #245+#250 + 4 prior pairs + hook-observability #107+#280); cross-cluster with silent-fallback family (structurally-absent-evidence axis), with #265 (JSON-output-completeness pair: missing-mode vs missing-field-in-existing-mode), and with #260 (third strip dimension on top of compact-envelope's six). Concrete delta this cycle: ROADMAP-only pinpoint appended after static audit of `prepare_turn_runtime`/`build_runtime`/`CliHookProgressReporter`/`Conversation::run_pre_tool_use_hook` showing reporter is conditionally `None` in JSON mode and the JSON envelope at `:4699-4724` carries zero hook fields. Concurrent-dogfood-rebase parity will be confirmed local==origin==fork at HEAD `bdcf3fa+#280` after push.
+
+## Pinpoint #281 — Dogfood filing is not a two-phase transaction: a subagent can commit/push ROADMAP successfully, crash before Discord reporting, and leave the public cycle in an ambiguous half-committed state with no recovery receipt
+
+Dogfooded 2026-04-26 17:30 KST from the live #407 recovery incident. The #407 subagent successfully filed #280, pushed commit `cf32b83` to origin/fork, then crashed during Discord posting after a gateway restart / WebSocket closure. Jobdori had to manually recover by checking origin/fork parity, reading ROADMAP to learn what #280 was, and posting a recovery message. The git state was correct, but the public coordination state was incomplete until manual repair.
+
+Concrete failure mode: ROADMAP commit/push and channel report are currently independent side effects with no shared transaction id or durable outbox. If the agent dies between them, downstream claws see neither a guaranteed success nor a guaranteed failure: git may contain the filing, chat may not, and the next nudge may duplicate or skip the item depending on which source it trusts. This is distinct from #269 (payload chunking/delivery receipts) and #277 (channel target resolution): those cover message delivery mechanics; #281 covers the atomicity boundary between repository mutation and public report publication.
+
+Gap. There is no dogfood filing transaction ledger with phases like `planned`, `roadmap_committed`, `pushed_origin`, `pushed_fork`, `report_posted`, `recovered`. There is no durable outbox entry containing the report body before send, no idempotency key keyed by commit SHA/pinpoint id, and no automatic recovery worker that posts the missing report after restart. Manual recovery worked only because Jobdori noticed the crash and re-read git.
+
+Required fix shape: (a) before committing, create a durable filing transaction record with `pinpoint_id`, branch, expected commit message, report body, target channel, and idempotency key; (b) update it after commit, origin push, fork push, and Discord send, including message id(s); (c) on agent/gateway restart, scan for records stuck at `pushed_*` but not `report_posted` and publish an idempotent recovery report; (d) include the transaction id in both commit body and Discord post so duplicates can be suppressed; (e) add tests simulating crash-after-push-before-post to prove the report is recovered exactly once. Acceptance: a successful ROADMAP push can never remain silently unreported after a crash; recovery is automatic and machine-auditable.
+
+**Status:** Open. No source code changed. Filed 2026-04-26 17:32 KST. Branch: feat/jobdori-168c-emission-routing. HEAD: `cf32b83` before filing. Cluster delta: dogfood-filing-transactionality +1; sibling to #269/#277 delivery-layer gaps, distinct git↔chat two-phase atomicity layer. Concrete delta this cycle: ROADMAP-only pinpoint appended from #407 crash-after-push-before-post evidence.