v4.7.8 — Stop a refresh or pause rebuilding Working Memory under live reviewers
Summary
/PACT:refresh and /PACT:pause wrote the session's own conclusions into the Working Memory block and then shut every teammate down. Bootstrap respawned the secretary, whose spawn step rebuilt the block unconditionally, and then respawned whatever the next phase needed — so a refresh taken mid-review handed reviewers the conclusions of the work they were about to judge.
The propagation rule shipped in 4.7.7 permits a rebuild only at a boundary after which nothing whose value is independent judgement spawns before a later harvest. That rule held only while spawn-time meant session-start, and refresh and pause make one arc span two session frames.
What landed
Two mechanisms, neither sufficient alone. A fieldless resumption marker recorded when a resumption claim surfaces, which the secretary reads at spawn and skips the rebuild — reporting the skip, because a briefing silent about the block reports a failed rebuild rather than a deliberate hold. And propagation removed from refresh and pause entirely.
Wrap-up's propagation is now per branch, not per command. Its open-PR branch writes a paused claim and hands the session back for more review, so it stays quiet; the two branches that end the arc each issue the request themselves, ahead of the steps that can halt. The tripwire's unit changed with it, from command stems to propagating sites.
The secretary is told where its own session directory is. The spawn step named a file to read and no way to resolve its location, in a frame where the implicit resolver returns nothing — and a failed resolution reads as no marker, which reads as no resumption.
A bounded freeze, two ways. Structurally, because the marker is written into the current session's journal while the claim is read one hop back; and by a consumption event that retires the claim on the paths where it shares a journal with it. Neither bound subsumes the other.
The backlog tool's refusal exit code moved off 2. Python exits 2 when it cannot open a script, so a process that never started was indistinguishable from one that deliberately declined — the third such collision in that file, and the first to also break a command file that routed the old value.
Why it took fifteen commits
Four review lanes found three blocking defects; an external reviewer found four more after them, including one this branch introduced and one the fix for it introduced. The recurring shape was a statement true when written and false after the change beside it — in production comments, test docstrings, design sections, a PR body, and dispatch briefs.
Tests added for what could be guarded, with each new guard's bounds stated rather than implied.