[witbrock]

Merge decision: ready for the code slice — the durable naming consumer is runnable and its schedule-to-effect path passes fixture acceptance. JVNAUTOSCI-2698 remains incomplete pending live activation and Michael-scoped acceptance.

User outcome

The generic tool-calling workflow selected for hourly conversation naming contains actions the durable worker cannot execute. Add #V#unnamed_conversation_naming_workflow using existing executable actions and conversation primitives, without changing workflow validity or actor checks.

Material changes

• Add reviewable workflow/prompt release seeds and the existing-style missing-authority startup bootstrap. Runtime authority remains in Vontology; bootstrap creates no actor schedules.
• Search owned unnamed conversations, inspect bounded evidence, use llm.action for titles, and apply evidence-bound batch renames with canonical read-back. Follow empty discovery pages, preserve partial results, and retain execution-required evidence/cursors across checkpoints.
• Require an explicit launch model; document an initial non-Sol gpt-5.4/medium configuration. The workflow does not silently use the active model preference.

Evidence

49 focused tests pass across the naming consumer, MCP conversation handlers, conversation management, schedule command service and startup integration. The consumer tests publish/load the represented definition, run the real executable verifier and actor-owned schedule service, deduplicate a due occurrence, claim and execute it, interrupt before rename and resume from its checkpoint, and verify canonical titles, existing/concurrent names, partial inspection and actor denial. The durable test uses the actual LLM-step wrapper with a scripted client; this establishes model propagation and wiring, not live title quality.

Formatting, pdm lock --check, minimum Python 3.11 grammar (1,520 files), and diff checks pass. A broader run exposed two unchanged-test limitations: an obsolete turn-runtime support-action expectation (also fails independently from the baseline test) and intermittent signature-tampering test failure when its final-character replacement changes only unused base64 bits. Neither changes the naming code merge decision.

Ship boundary

Code acceptance covers runnable publication, source paging, bounded effects, retries and canonical fixture read-back. Actor bypass, loss of existing names, false exhaustive completion or loss of execution evidence across checkpoints would block this slice. The existing transition limit still reports non-success with a resumable checkpoint; it is not an exhaustive-coverage claim.

Live delivery remains blocked in this coding session: no Von MCP tools are exposed, and the worker instructions prohibit shell-based Von mutation or live-service deployment. The controller additionally accepts deployment only for completed results, while this task explicitly requires live acceptance before completion. The coordinator must deploy the merged revision through the authorised controller/operator route, verify server/worker provenance and bootstrap read-back, then use Michael's normal actor-bound schedule route with:

{
  "workflow_id": "#V#unnamed_conversation_naming_workflow",
  "schedule_type": "interval",
  "interval_seconds": 3600,
  "idempotency_key": "hourly-owned-unnamed-conversation-naming-v1",
  "default_inputs": {
    "requested_model": "gpt-5.4",
    "requested_model_parameters": {"reasoning_effort": "medium"}
  }
}

Read back the owner, SAIL namespace, workflow, enabled state, cadence, next run and retry identity, then observe an actual occurrence and canonical title effects with pre-named controls unchanged. Preserve the enabled hourly configuration. Retain the deployment rollback receipt; pausing this actor schedule is the bounded effect rollback. No schedule or live rename was created by this PR's tests.

Generic scheduler redesign, the already-merged JVNAUTOSCI-2754 discovery repair, JVNAUTOSCI-2750 controller work and zero-downtime infrastructure are outside this change.