Adopt the step identities the store issued

The run's step identities and the store's are different vocabularies, paired by
position. The pairing read the plan built to *send* to the store rather than the
one the store *returned*. Those are the same object on an ordinary write and
need not be on an idempotent one, where the store answers with the revision it
already had — and the identities the run then adopts are ones the store never
issued.

Every later read of such a step is refused with "step does not belong to run
plan": a true sentence about a situation nothing else reports, naming neither
the step nor the cause. It cost two entire ladder passes before the widened
stage trace made it legible at all.

Pairing now reads recorded.Plan.Steps, keeps the local build only as a fallback
for a store that echoes nothing, and traces the mismatch when the lengths
disagree. Together with the earlier change that drops an unpaired step rather
than keeping it, a run carries only steps the store knows about.

Unproven against the ladder: the OpenAI account has no credits remaining and
every run 429s at about fifteen seconds. It explains the symptom and the message
exactly, and the three tests cover the rule without needing a store.

Change-Log: CL-20260803-178
Dev-Log: DL-20260803-188

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: monstercameron

CHANGELOG

@@ -50,9 +50,40 @@ Dev-Log:
 
 Entries
 -------
-Change-ID: CL-20260803-177
+Change-ID: CL-20260803-178
 Commit: pending
 Date: 2026-08-04
+Type: Fix -- LAD-003. The run adopted step identities it generated itself and
+  assumed the store had written the same ones
+Request-or-TODO: LAD-003
+Outcome: The run's step identities and the store's are different vocabularies,
+  paired by position. The pairing read the plan built to send to the store
+  rather than the one the store returned. Those are the same object on an
+  ordinary write and need not be on an idempotent one, where the store answers
+  with the revision it already had -- and the identities the run then adopts are
+  ones the store never issued. Every later read of such a step is refused with
+  "load plan step state: database constraint: step does not belong to run plan",
+  which is a true sentence about a situation nothing else reports and which
+  names neither the step nor the cause. It cost two entire ladder passes on
+  2026-08-04 before the widened stage trace made it legible at all. Pairing now
+  reads recorded.Plan.Steps, falls back to the local build only when the store
+  echoes nothing, and traces the mismatch when the two lengths disagree.
+  Together with CL-20260803-174, which drops an unpaired step rather than
+  keeping it, a run now carries only steps the store knows about.
+Affected-behavior: A run adopts the identities the store issued. A mismatch is
+  visible in the trace instead of surfacing as a constraint violation three
+  attempts later.
+Compatibility-or-migration: None.
+Verification: Three new tests over the extracted pairing: identities come from
+  the store, a short recorded plan leaves the extra steps unpaired and adoption
+  then drops them, and an empty plan pairs nothing rather than half of
+  something. The ladder cannot confirm this today -- the OpenAI account has no
+  credits remaining and every run 429s at about fifteen seconds.
+Dev-Log: DL-20260803-188
+
+Change-ID: CL-20260803-177
+Commit: 622d8c2
+Date: 2026-08-04
 Type: Fix -- a hard gate deferred itself behind every softer one and was never
   reached
 Request-or-TODO: Ladder rung 19

DEVLOG

@@ -25,6 +25,31 @@ Next-safe-step:
 
 Entries
 -------
+Dev-Log: DL-20260803-188
+Date: 2026-08-04
+Status: Committed as CL-20260803-178
+Change-ID: CL-20260803-178
+Request-or-TODO: LAD-003
+Goal: Make the run adopt identities the store actually issued
+Assumptions: That recorded.Plan carries the stored steps. Checked: PlanRevision
+  declares a Plan AgentPlan field, which is the plan as the store holds it
+Decisions: Kept the local build as a fallback for a store that echoes no plan,
+  because removing it would turn a degraded write into no mapping at all. Traced
+  rather than refused on a length mismatch, because the caller already handles a
+  missing pairing by dropping the step and this should not become a second way
+  to end a run
+Files-or-schemas: internal/coordinator/agent_plan_record.go --
+  pairStepIdentities extracted so the rule can be tested without a store
+Validation: Three new tests. The pre-existing PIPE048 failure is unchanged and
+  is LAD-002's, not this
+Failures-or-discarded-approaches: None here, though this took three earlier
+  wrong readings to reach, all recorded in LAD-003
+Known-limitations: Unproven against the ladder. It explains the symptom and the
+  message exactly, and the run that produced them cannot be repeated until the
+  account has credits
+Next-safe-step: Rerun rung 19 once credits are restored, and watch for the new
+  "the recorded plan holds N step(s)" line
+
 Dev-Log: DL-20260803-187
 Date: 2026-08-04
 Status: Committed as CL-20260803-177

internal/coordinator/agent_plan_record.go

@@ -137,13 +137,53 @@ func (execution *AgentExecution) recordDurablePlan(
 	// The loop's step identities and the durable plan's are different
 	// vocabularies, so they are paired by position. A run attributing its work
 	// to a step the plan does not have would be worse than no attribution.
-	result := durablePlan{Revision: recorded.Revision, Steps: map[string]string{}}
+	//
+	// Paired against what the store returned, not against the plan built to
+	// send it. Those are the same object on an ordinary write and need not be
+	// on an idempotent one, where the store answers with the revision it
+	// already had — and the identities the run then adopts would be ones the
+	// store never issued. Every later read of such a step is refused with
+	// "step does not belong to run plan", which is a true sentence about a
+	// situation nothing else reports and which names neither the step nor the
+	// cause. See LAD-003.
+	durableSteps := recorded.Plan.Steps
+	if len(durableSteps) == 0 {
+		// A store that does not echo the plan back leaves nothing to pair
+		// against; the locally built one is all there is, and using it is what
+		// this has always done.
+		durableSteps = plan.Steps
+	}
+	return durablePlan{
+		Revision: recorded.Revision,
+		Steps:    pairStepIdentities(steps, durableSteps),
+	}, nil
+}
+
+// pairStepIdentities maps each of the run's step identities onto the durable
+// one at the same position.
+//
+// By position, because the two are different vocabularies with nothing in
+// common to join on. That is safe only while the two lists describe the same
+// steps in the same order, which is true of a plan the store has just written
+// and is worth saying out loud when the lengths disagree: a step with no
+// durable identity is one every later read is refused for, and the refusal —
+// "step does not belong to run plan" — names neither the step nor the reason.
+func pairStepIdentities(
+	steps []agentloop.PlanStep,
+	durable []storage.AgentPlanStep,
+) map[string]string {
+	if len(durable) != len(steps) {
+		tracef("plan", "the recorded plan holds %d step(s) and the run holds "+
+			"%d, so %d will have no durable identity",
+			len(durable), len(steps), len(steps)-len(durable))
+	}
+	paired := make(map[string]string, len(steps))
 	for index, step := range steps {
-		if index < len(plan.Steps) {
-			result.Steps[step.ID] = plan.Steps[index].ID
+		if index < len(durable) {
+			paired[step.ID] = durable[index].ID
 		}
 	}
-	return result, nil
+	return paired
 }
 
 // durablePlanStepKind maps a loop step onto the plan vocabulary.

internal/coordinator/plan_identity_pairing_test.go

@@ -0,0 +1,85 @@
+package coordinator
+
+import (
+	"testing"
+
+	agentloop "codeflux.dev/codeflux/internal/agent"
+	"codeflux.dev/codeflux/internal/storage"
+)
+
+// TestStepIdentitiesArePairedWithWhatTheStoreHolds is the assumption behind an
+// error that names neither the step nor the cause.
+//
+// The run's step identities and the store's are different vocabularies, paired
+// by position. The pairing used to read the plan that was built to *send* to
+// the store rather than the one the store *returned*. Those are the same object
+// on an ordinary write and need not be on an idempotent one, where the store
+// answers with the revision it already had — and the identities the run then
+// adopts are ones the store never issued.
+//
+// Every later read of such a step is refused with "step does not belong to run
+// plan". That is a true sentence about a situation nothing else reports, and it
+// cost two whole ladder passes on 2026-08-04 before it was even legible. See
+// LAD-003.
+func TestStepIdentitiesArePairedWithWhatTheStoreHolds(t *testing.T) {
+	steps := []agentloop.PlanStep{
+		{ID: "edit-1"}, {ID: "edit-2"}, {ID: "verify"},
+	}
+	stored := []storage.AgentPlanStep{
+		{ID: "stp_a"}, {ID: "stp_b"}, {ID: "stp_c"},
+	}
+
+	paired := pairStepIdentities(steps, stored)
+	for local, want := range map[string]string{
+		"edit-1": "stp_a", "edit-2": "stp_b", "verify": "stp_c",
+	} {
+		if paired[local] != want {
+			t.Errorf("%s paired to %q, want %q — the run would attribute its "+
+				"work to a step the store never issued",
+				local, paired[local], want)
+		}
+	}
+}
+
+// TestAShortRecordedPlanLeavesTheExtraStepsUnpaired is the case that has to
+// stay visible rather than silent.
+//
+// A step with no durable identity cannot be attributed to and every read of it
+// is refused. Pairing must not invent one, and the mismatch must not pass
+// unremarked — the whole cost of this defect was that it did.
+func TestAShortRecordedPlanLeavesTheExtraStepsUnpaired(t *testing.T) {
+	steps := []agentloop.PlanStep{
+		{ID: "edit-1"}, {ID: "edit-2"}, {ID: "verify"},
+	}
+	stored := []storage.AgentPlanStep{{ID: "stp_a"}}
+
+	paired := pairStepIdentities(steps, stored)
+	if paired["edit-1"] != "stp_a" {
+		t.Errorf("the recorded step was not paired: %v", paired)
+	}
+	if _, present := paired["edit-2"]; present {
+		t.Error("a step the store never wrote was given a durable identity")
+	}
+	if _, present := paired["verify"]; present {
+		t.Error("a step the store never wrote was given a durable identity")
+	}
+	// adoptDurablePlanSteps drops what pairing leaves out, so the two together
+	// mean the run carries only steps the store knows.
+	adopted := adoptDurablePlanSteps(steps, durablePlan{Steps: paired})
+	if len(adopted) != 1 || adopted[0].ID != "stp_a" {
+		t.Errorf("the run kept steps the store never wrote: %+v", adopted)
+	}
+}
+
+// TestPairingAnEmptyPlanPairsNothing keeps the degraded path honest.
+//
+// A store that wrote no steps leaves nothing to pair against. Pairing has to
+// answer with an empty map rather than a partial one, so the caller's own
+// fallback decides what happens rather than inheriting half a mapping.
+func TestPairingAnEmptyPlanPairsNothing(t *testing.T) {
+	paired := pairStepIdentities(
+		[]agentloop.PlanStep{{ID: "edit-1"}}, nil)
+	if len(paired) != 0 {
+		t.Errorf("want no pairings, got %v", paired)
+	}
+}