feat(operator-cli): simard goal wip — bind done-gate anchors to goals (coverage-goal triage)

[rysweet]

Overseer escalation triage — course-correct the stalled coverage goal

Executes the course-correction for the blocked goal audit-simard-s-test-coverage-and-raise-it-to-70-4d27c91a per prompt_assets/simard/overseer/escalation_triage.md. Decision: rewrite-done-gate.

What was executed (not just proposed)

1. Machine-checkable done-gate created — acceptance-anchor issue [coverage-audit] Acceptance anchor — Simard test coverage ≥70% (per-group), whole-audit DONE gate #4616, whose closing checklist encodes Specs/COVERAGE_AUDIT.md §2/§3. It must be closed by the final audit-complete PR (Closes #4616) so the completion gate observes a merged PR and a closed issue on the same merge.
2. Binding tool shipped (this PR) — round 1 could not bind the anchor because there was no CLI to attach a wip_ref to a goal. This adds simard goal wip add|remove|list, mirroring goal label:
   • add <goal-id> <kind> <ref-id> [label...] [--url <url>] — idempotent on (kind, ref-id); uses the anti-clobber with_board flock path + memory-cache refresh, so it is safe against a concurrent OODA daemon cycle.
   • remove <goal-id> <ref-id> — idempotent no-op when absent.
   • list <goal-id> — one ref per line ((none) if bare).
   • kinds validated against pr|issue|branch|session|engineer.
3. Operator notified — four jargon-free Signal messages sent (all type: SUCCESS), with every internal marker translated to plain English.

Root-cause refinement (surfaced during execution)

Binding the anchor to the goal revealed the true churn mechanic: the goal is a phantom — simard status shows it (read from the goal-board:snapshot cognitive fact) but simard goal … not found on active board (the authoritative goal_board.json read by advance-goal via load_or_migrate). The two stores have diverged, so Observe/Decide re-escalates every cycle while advance-goal has nothing to attach a worker/PR/WIP to — the typed blocker 019f6c08 can never clear. Whether to re-instate vs retire a goal that has fallen off the authoritative board is a scope call the operator owns, so it was surfaced as a single plain-English Signal question rather than force-writing into a live daemon's board.

Full course-correction record: ai_working/investigation/tertiary_architecture_DONE_GATE_coverage-audit-4d27c91a_HEAD_6ae1547fd.md §9.

Tests

cargo test --lib wip — 22 passed (5 new: simard_goal_wip_add_list_remove_round_trips_on_persisted_board, simard_goal_wip_add_rejects_bad_kind_and_unknown_goal, format_wip_list_renders_refs_or_none, extract_wip_flags_splits_url_from_label, extract_wip_flags_rejects_dangling_url). cargo fmt --check and cargo clippy --release -- -D warnings clean (pre-commit + pre-push gates passed).

Additive and non-breaking; no behaviour change to existing subcommands.

[github-actions]

📊 Coverage Summary

Generated by cargo llvm-cov --workspace --summary-only (nightly, excluding test files)

Module	Lines	Covered	Coverage
Total	198684	167279	84.2%

_{Coverage data from CI run. Test files matching tests?/ are excluded from line counts.}

[rysweet]

Crusty review — CHANGES-REQUIRED (superseded by merged #4510 + point-in-time docs).

Two blocking issues:

1. Duplicate mechanism. This PR adds a simard goal wip operator command in src/operator_cli/goal.rs to bind done-gate anchors to goals. feat(goal): 'set-done-gate' operator command to bind a machine-checkable finish line #4510 just merged, adding a set-done-gate operator command in the same file that does the same job — bind a goal to a machine-checkable finish line (PR/issue + criteria) via a durable pin store (goal_done_gate_pins.json). We should not ship two competing commands for one capability. Please reconcile onto the merged set-done-gate mechanism: either rebase and express this goal's coverage-anchor ([coverage-audit] Acceptance anchor — Simard test coverage ≥70% (per-group), whole-audit DONE gate #4616) through set-done-gate, or make a focused case for why goal wip is a distinct primitive.

2. Point-in-time docs violate repo policy. The diff commits four ai_working/investigation/course_correction_*.md / secondary_patterns_*.md / tertiary_architecture_*.md files. Repo policy: do not commit point-in-time investigation/triage reports — they go stale. Drop them from the PR (capture as an issue/memory if the findings matter).

Holding merge. Rebase onto current main (post-#4510), drop the investigation docs, and re-request review.