docs(todo): consolidate the sentry-cluster tasks

Merged the two no-session /schedule tasks (the sentry variant and the unattended inbox check) into one "Unattended /schedule cron contract". They were the same design problem stated for two consumers. Added a foundational "Cross-host agent coordination" task capturing the shared prerequisite behind the roam-conflict task and the two blocked sentry passes: agent-lock is host-local, so nothing coordinates ratio and velox. Cross-linked both dependents to it.

1 files changed, 20 insertions, 15 deletions

diff --git a/todo.org b/todo.org
index fec2a71..808d92b 100644
--- a/todo.org
+++ b/todo.org
@@ -175,22 +175,32 @@ so it's effective. Don't shape the rule before the scouting.
 - *Instance vs rule:* the metrics, self-improvement log, kill criteria, rollout
   dates, and adoption table are home's instance, not rule content.
 
+** TODO [#D] Cross-host agent coordination — a lock across ratio and velox :feature:
+Foundational primitive several deferred features wait on. =agent-lock= serializes agents on ONE host (its locks live on tmpfs, =$XDG_RUNTIME_DIR/agent-locks/=), so nothing coordinates the two daily drivers. When ratio and velox both act on shared state at once, there's no lock to stop them — the roam-write lock and sentry's single-runner lock are all host-local. Design a cross-machine lock (a lock node committed to a shared repo, a tailnet lock service, or a designated-primary election) that the host-local locks escalate to when the operation touches cross-machine-shared state (roam, a sibling-freshness push). Take up when cross-host contention proves real in practice, not speculatively.
+
+Blocks (the shared-prerequisite half of the sentry cluster):
+- [[file:todo.org::*Cross-host roam conflict surfacing][Cross-host roam conflict surfacing]].
+- [[file:todo.org::*Sentry vNext passes][Sentry vNext passes]] items #2 (system-health) and #3 (sibling-freshness) — both need ratio/velox not to run the pass simultaneously.
+
 ** TODO [#D] Cross-host roam conflict surfacing :feature:
 Deferred from the sentry spec (Decision: host-local lock only). The
 roam-write lock serializes same-host agents; a true cross-host race still
 forks a sync-conflict file, surfaced only by roam-sync's rebase abort.
 Investigate making the conflict loud (roam-sync retry-once, or a
 cross-host lock node in the repo) when it proves frequent in practice.
+Shared prerequisite: [[file:todo.org::*Cross-host agent coordination][Cross-host agent coordination]] (the missing cross-machine lock).
 
 ** TODO [#D] KB lesson-detection heuristic :spec:
 Deferred from the sentry spec review (2026-07-14): sentry's KB promotion pass was cut from v1 because "promote recent durable lessons" had no defined lesson source, and an unattended judgment pass writing to the shared KB needs one that doesn't spam or go silent. Design the detection heuristic — candidate source: Session Log entries and memory-dir changes since the last fire, judged against knowledge-base.md's inclusion bar — and define how precision gets verified before the pass ships in a sentry vNext. Blocks re-adding the pass.
 
-** TODO [#D] Sentry unattended /schedule variant :feature:
-Deferred from the sentry spec (Non-Goal). The v1 contract is interactive:
-a live session Craig starts, /loop-driven. A cron variant firing with no
-session needs its own contract (mutation rights, async surfacing, dedup
-state across runs) — same open questions inbox.org logs for unattended
-auto inbox zero. Take up only if the interactive shape proves too narrow.
+** TODO [#D] Unattended /schedule cron contract — no-session variant :feature:
+The design problem shared by two deferred features: a =/schedule= cron pass that fires with *no live session* needs its own contract, distinct from the interactive =/loop= shape. The open questions are the same for both consumers — mutation rights (read-only vs may-mutate =todo.org= / =~/org/roam/inbox.org=), how a find surfaces asynchronously when Craig isn't at the session, how dedup state persists across runs that don't share a session, and what session/auth context a cron run carries (the MCP-auth wall: a detached run can't reach Gmail/Slack/Linear, the same constraint the silent-until-signal spec turned on).
+
+Two consumers, one contract:
+- *Sentry* (deferred from the sentry spec Non-Goal): v1 is interactive, a live session Craig starts, /loop-driven. A cron variant firing with no session is out of v1 scope.
+- *Auto inbox zero* (vNext from the inbox-consolidation spec, Codex finding 1; [[id:a7fe2a10-dfa8-4ba3-a11a-e7b1288b7573][spec]]): v1 =auto inbox zero= is the interactive /loop check that waits for Craig's yes. Its "design after v1 consolidation lands" precondition cleared 2026-06-28 (the inbox engine consolidation 24ca58d and monitor-inbox loop edb545d shipped), so this is actionable backlog.
+
+Design the one contract; both features consume it. Merged 2026-07-20 from the separate "Sentry unattended /schedule variant" and "Fully-unattended scheduled inbox check" tasks — same no-session design problem.
 
 ** DONE [#B] Triage source activation — per-project source declaration :feature:spec:
 CLOSED: [2026-07-20 Mon]
@@ -214,7 +224,7 @@ Three considerations captured by .emacs.d's own hand-run sentry trial (routed vi
 2. System-health pass. Decide which checks are safe unattended, and how to keep ratio and velox from running it simultaneously (a cross-driver lock/coordination question — agent-lock is host-local tmpfs, so it doesn't coordinate across machines).
 3. Sibling-machine freshness pass. Keep the other daily driver (velox/ratio) up to date during sentry (see daily-drivers.md; same cross-driver coordination question as #2).
 
-Take up with the sentry Living Document refinements once the trial has quiet nights behind it. Related: the sentry /schedule variant above, and Fire 1's triage-probe finding in the approval queue.
+Take up with the sentry Living Document refinements once the trial has quiet nights behind it. Passes #2 and #3 are blocked on [[file:todo.org::*Cross-host agent coordination][Cross-host agent coordination]] (the missing ratio↔velox lock). Related: [[file:todo.org::*Unattended /schedule cron contract][Unattended /schedule cron contract]] (the no-session variant).
 
 ** DONE [#C] Apply suspend.org detach-on-suspend change to canonical :feature:
 CLOSED: [2026-07-20 Mon]
@@ -501,14 +511,9 @@ From Craig via the roam inbox (2026-07-02, routed by archsetup). Teardown-by-def
 :END:
 The work project (2026-06-18) added a "Push each sweep to Craig's phone (ntfy) — the primary delivery" subsection under "Trigger and delivery" in triage-intake.org auto mode, and asks to fold it into the canonical engine plus re-sync. Preserved bundle: [[file:docs/design/2026-06-18-triage-intake-phone-push-note.org][note]] + [[file:docs/design/2026-06-18-triage-intake-phone-push-workflow.org][edited workflow]]. Auto mode is the away-from-desk / vacation mode, so phone-notify becomes the primary delivery each sweep (fuller end-of-sweep output: per-source deltas, open-PR/Linear state, awaiting-ack list, one-line verdict, timestamp; SCAN FAILED banner on any source failure), plus phone-recv polling each sweep for Craig's replies. Falls back to inline when phone-notify is absent. Transport re-pointed 2026-07-13: ntfy is retired; agent-page (shipped today) is the send channel, so the push half is buildable now — substitute agent-page for phone-notify throughout. The reply-polling half (phone-recv) waits on the Signal-pager runbook's read-replies deliverable. Shared template-workflow change, so review-gated.
 
-** TODO [#D] Fully-unattended scheduled inbox check (/schedule cron pass) :feature:
-:PROPERTIES:
-:CREATED: [2026-06-23 Tue]
-:LAST_REVIEWED: 2026-06-28
-:END:
-vNext from the inbox-consolidation spec. =auto inbox zero= (v1) is the interactive =/loop= recurring check that waits for Craig's yes before executing. A fully-unattended =/schedule= cron pass that fires while Craig is away needs its own contract before it can ship: read-only vs may-mutate =todo.org= / =~/org/roam/inbox.org=, how a find surfaces asynchronously when Craig isn't at the session, how dedup state persists across runs that don't share a session, and what session/auth context a cron run carries. From the inbox-consolidation spec-review (Codex finding 1). See [[id:a7fe2a10-dfa8-4ba3-a11a-e7b1288b7573][spec]].
-
-Update 2026-06-28: the "design after v1 consolidation lands" precondition is cleared — the inbox engine consolidation (24ca58d) and the monitor-inbox 15-min loop (edb545d) both shipped. Now actionable backlog rather than blocked; design the unattended contract when prioritized.
+** CANCELLED [#D] Fully-unattended scheduled inbox check (/schedule cron pass) :feature:
+CLOSED: [2026-07-20 Mon]
+Merged 2026-07-20 into [[file:todo.org::*Unattended /schedule cron contract][Unattended /schedule cron contract — no-session variant]]. Same no-session design problem as the sentry /schedule variant (mutation rights, async surfacing, cross-run dedup, cron auth context); its inbox-specific context was absorbed there.
 
 ** TODO [#D] Warn-only pre-commit hook for tooling-path enumeration :feature:
 :PROPERTIES: