Preserve product intent across maintenance transitions

[bigboateng]

Summary

Maintenance transitions now bind the verified durable product-goal facet as preserved context. They can preserve a known goal or verified absence, but cannot invent or replace product delivery intent.

Motivating legacy-state reproduction: a TaxWeave V2 installation had verified configuration, an old runtime, and no configured product goal. The supported updater refused before admission because installation maintenance required a product goal. Supplying a synthetic bootstrap goal would have crossed the maintenance/product boundary and created false delivery intent.

Root cause

Installation, runtime, configuration, catalog, and recovery transitions shared the product-delivery goal contract. The CLI also supplied a bootstrap goal during initialization. This made product identity an accidental maintenance prerequisite and allowed installation initialization to persist synthetic product intent.

Invariant restored

Boundary: command or SDK maintenance request -> resolver/admission -> effect/recovery -> receipt/replay.

Control law: maintenance may preserve verified product-goal state but never create or replace it. Known state is bound exactly; verified absence remains absent; unknown or malformed evidence fails closed. Command-scoped product goals do not influence maintenance identity.

Authority: existing transition authority contracts remain unchanged. No provider, publication, or merge authority is added.

Implementation

• Add the declarative optional-preserve goal scope to maintenance transition policy.
• Canonicalize maintenance goal identity from verified durable state at the shared admission boundary.
• Bind known/absent goal status into admissions, receipts, events, replay, and stale-state checks.
• Preserve exact goal state through effects and recovery; only goal.configure can create product intent.
• Remove the CLI initialization bootstrap goal.
• Allow installation update and reconcile-update from verified goal absence.
• Keep delivery artifact validation scoped to product transitions.
• Regenerate the readable transition catalog.

Regression coverage

• verified goal absence
• exact known-goal preservation
• conflicting command-scoped goal isolation
• unknown goal evidence fails closed
• reconcile-update -> ordinary update composition
• idempotent replay after absent/known maintenance
• replay refusal after durable goal-state change
• interrupted initialization -> exact rollback with goal absence preserved
• detached and installer end-to-end flows now configure product goals explicitly
• failed authority or obligation checks leave durable state unchanged

Locus result

Before: drv-4ce6f9ff448933feb9a5c49fdbe58c0b60a442fb11e4cba852e2132001c6785e found the current design blocking at legacy_goal_absent and both request/durable-goal refusal states. The bootstrap fallback reached the forbidden product_goal_contaminated state.

After: drv-b594e51e5e6454ce9d8e767a4cb963a5c8659e39cc0cbf6cb210ce95d78ed2f4 is faithful. The forbidden product-contamination state is unreachable, nonblockingness is true, and blocking states are empty. Declared-slice event completeness is discharged by the maintenance path inventory and regressions. The claim remains advisory because fresh behavior across every third-party coding-agent host is outside this run.

The original TaxWeave legacy state was re-observed read-only with the patched bytes: installation.update is PRESCRIBED, the snapshot goal remains verified absent, and the repository remains clean.

Verification

• python3 .github/scripts/run_go_tests.py (147 tests, 10 passing shards)
• go test -race ./...
• go vet ./...
• go build ./...
• python3 -m unittest discover -s .github/tests -p 'test_*.py' (27 passed)
• release-note validation and committed-diff preflight
• generated architecture artifact contract
• git diff --check

Release note: release-notes/2026-08-11-maintenance-goal-isolation.md.

Remaining frontier

Whole-host behavior remains advisory until the released bytes are exercised from a newly loaded coding-agent task. This PR does not merge itself and does not migrate existing product goals or delivery plans.