docs/plans: dogfood route manual interventions, dispositioned

[gunbai-bot]

A plan only: one new file, docs/plans/dogfood-route-manual-interventions.md, agreed with the operator on 2026-10-03.

The first end-to-end attempt on srv2 (01feb0b65dee1377) did its work but never reached a PR, and it took six kinds of hand intervention. For each intervention, the doc records:

• what it exposed;
• what must become automatic;
• what stays with the operator;
• its owning module;
• the test that must go red first.

The frame: safe-to-retry and convergent are required everywhere; automatic repair is a policy choice, and today it is no. gunbc.ensure EnsureObserveOnly already carries that distinction. Failures converge to a safe incident state that awaits an operator disposition, and the disposition is keyed by incident identity so repeating it is a no-op.

Operator rulings recorded:

• manual resume, for now;
• Wi-Fi is a valid serving medium for the Sparks;
• Spark auth must be bound to the seat grant;
• event-driven over the belt timer;
• an explicitly admitted branch revision is valid for the deployment it is admitted to.

Most urgent: item 6 (the monolithic belt_run_once tick, which is why the attempt has no PR) and item 3 (the second door onto group-b).

Each functional row lands under the home it names. factory-dogfood-route (#13077, bold-bee-114) consumes their receipts, or carries dependency edges where they gate the qualifying route; it coordinates route integration, not every underlying capability. The 2026-10-03 side-chat corrections are applied: one PR per logical work item; automation described as owed, not established; prod named by ProdRoleSelection, never by host.

🤖 Generated with Claude Code