[witbrock]

Merge decision: ready — the DGX controller retains failed-attempt blockers independently of task bookkeeping and admits one continuation from a relevant verified repair, authorised inbox follow-up or explicit retry. Installation remains a separate operator handoff.

User outcome

Task archives, closeout evidence, self-reports, unrelated comments and pending status changes previously allowed repeated coding launches against an unchanged prerequisite. Waiting now preserves the reason, recovery owner and retained work, spends no coding model calls, and allows other eligible tasks to proceed.

Native assignment: #V#task_agent_78d57451e04f1ac9ca7acea3800d0e06.

Material changes

• Add a reusable retry policy and optional blocker description. Repair receipts match the task, actor, organisation, failed attempt, revision/profile scope and every required observation. A ready flag with contradictory authentication cannot admit a retry.
• Preserve old text-only failures honestly as unclassified; support an explicit /retry-coding <attempt> <reason> task comment and the existing contextual inbox route. The inbox receives retained attempt evidence and freezes its continuation binding before effects.
• Consume retry source tokens in the running checkpoint before subprocess launch. Reconcile interrupted runs, messages and archives; isolate retained report failures so other tasks continue.
• Support operator-registered cheap read probes with declared time bounds and persistent backoff. Task/model output cannot supply executable commands.
• Preserve coherent-release rollback to workers predating the new module. Document the shared policy contract and the operator-owned Mac bridge handoff.

The restriction addresses observed duplicate paid attempts against the same unrepaired dependency. A whole-task fingerprint does not distinguish those attempts from relevant recovery; the gate is confined to failed/waiting attempts, with explicit retry and independently useful follow-up routes.

Evidence

157 targeted tests passed across worker, inbox, canonical inbox replay, retry admission, execution archives, release installation and deployment recovery. The new acceptance uses the actual controller launch path with a local stand-in executable and isolated canonical task/message services, including recipient read-back. No provider model, competing worker or production disposable task was used.

Covered unchanged polling/bookkeeping, contradictory authentication, stale/wrong-scope/untrusted receipts, exactly one repair/manual/probe continuation, retained worktree and Astra/xhigh settings, cancellation/reassignment during probing, missing state, lost acknowledgements and unrelated-task progress. The release fixture verifies actual module imports and rollback. New retry module/tests and the release helper pass Ruff; git diff --check passes. Existing broader-file lint debt is outside this change.

Ship boundary

• Minimum ship criteria: the bounded cases above pass through controller/canonical read-back, and coherent release/rollback remains possible.
• Stop-ship conditions: new duplicate launches, unrelated repair admission, authority widening, silent task loss or a wedged queue.
• Limitations: semantic inbox interpretation is scripted in acceptance, not a live model-quality claim. Plain legacy task comments need explicit retry or contextual inbox review; receipt producers must actually verify the referenced observations. No production probes are registered by this change.
• Activation: neither DGX installation nor Mac integration/activation is claimed. The installed Mac bridge is outside this repository; its operator must wire the shared policy into its existing locked launch route and return an isolated replay and installation/runtime receipts. Use the existing idle release handoff, preserve current work/settings and retain rollback. No public web deployment, database migration or credential/infrastructure change is requested.