[Docs] Add lifecycle verification GAP report and remediation blocks - #1626

No actionable comments were generated in the recent review. 🎉

❌ Failed checks (1 error, 1 warning)

• Fix all pre-merge checks with AI

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

Review status

This PR was opened by an automated account. A human maintainer must verify the change intent, provenance, and validation before merging.

Current step: Address automated review findings and push fixes.

After fixes are pushed and required CI passes, automated review restarts.

Review-state labels are managed by this workflow; do not edit them manually.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

Reconciled #1626 with #1623 and runtime-fix PR #1625 in commit fed91bb86. The checker now claims only selector/write-side coverage, retains a divergent task/provider-mode witness for the downstream obligation, and the traceability docs and PR description explicitly assign environment/tool reader correctness to #1625. pnpm lifecycle:model-check, typechecking, lint, and the full test suite pass; no UI proof applies.

Completed the lifecycle coverage audit in commit 70d7ac60a. Every protocol area and issue row now states its evidence class, production/model relationship, bounds, omitted consumers, and remaining obligations; passed is explicitly defined as bounded success rather than issue closure. README now links the authoritative tracker, and child model docs link back to its audit. pnpm lifecycle:model-check, typechecking, lint, and the full test suite pass; visual proof is not applicable.

Completed the live-state traceability re-audit in commit 48644f714. Retained open #1469, #1021, #1623, #369/#372, and #612 because production or enforcement gaps remain. Moved closed #1453/#1279, #921, #920, and #1468 to verified history, preserving all bounded/proxy limitations and redirecting adjacent open risks to their active issues. pnpm lifecycle:model-check, typechecking, lint, and the full test suite pass; visual proof is not applicable.

Re-scoped #1626 to documentation/formal-model audit only at 20aebc49f. All runtime, shared-type, scheduler, production-test, and Zoo-Code-Docs changes introduced during the attempted implementation were reverted; the net PR diff contains only architecture docs, model-check scripts, and command wiring. The root README has no lifecycle tracker link. pnpm lifecycle:model-check, typechecking, and lint pass; visual proof is not applicable.

Completed the repository-wide lifecycle-verification GAP report in 8d00b944f. It inventories lifecycle owners, persistence/mutation/queue/delegation/stream/event boundaries, copied vocabulary, tests/models/CI, and ranks 34 stable LIFE-GAP-* items with severity, confidence, impact, witnesses, dependencies, and objective closure criteria. Primary TLA+, Quint, Alloy, Jepsen, and SQLite references are translated into repository-specific audit rules. Formatting, relative link targets, pnpm lifecycle:model-check, typechecking, and lint pass; scope remains documentation/formal-model-only and visual proof is not applicable.

Completed the subtask todo audit in 378abeeb5. Normal creation does not copy the parent list: child todos are explicit model-supplied new_task.todos, parsed into a fresh list and forwarded as initialTodos. The distinct IDE-side gap is that initial todos are process-local and disappear on rehydration before the first persisted update_todo_list; no existing model covers todo ownership, publication scoping, or rehydration equivalence. Added LIFE-GAP-035 with reproduction controls, impact, boundary, and objective closure criteria. Formatting, pnpm lifecycle:model-check, typechecking, and lint pass; no runtime or UI changes were made.

Completed the tool-state ownership audit in 63150c68e. LIFE-GAP-035 now covers durable tool-originated child initialization, with initial todo loss as its confirmed witness; distinct 036–038 cover uncorrelated approval edits, singleton partial-handler state, and lossy tool-ID correspondence across persistence/execution/replay. PR #1625's mode bug can influence prompt/validation and therefore model output indirectly, but no production path transfers parent todos based on mode. No new green checker was added because these boundaries lack faithful unified production transitions; explicit witness/closure criteria are retained instead. Formatting, link targets, pnpm lifecycle:model-check, typechecking, and lint pass.

Completed the portfolio remediation plan in 7ea3edd9e. All 38 gaps are assigned to eight root-cause programs with calibrated effort/risk, subsystem ownership, dependencies, objective evidence, safe consolidation boundaries, critical path, four parallel workstreams, quick wins, architectural programs, and a first tranche. Recommended serial-contract portfolio scale is 85–145 engineer-days; full fan-out is 105–175. Formatting, link targets, pnpm lifecycle:model-check, typechecking, and lint pass; scope remains documentation/model-only.