docs(agent): design topic stale-post check for managers (RIG-1714)

[rigel-mintaka]

Summary

Design record for RIG-1714: stop Manager agents from double-answering in a topic. Instead of the per-topic write lock the issue proposed, the record designs an optimistic stale-post check. An agent post carries the newest message the agent has seen in the topic (last_seen_message_id) and a capped set of messages seen out of order (seen_message_ids). The server refuses the post when another author posted a message the agent has not seen. The refusal returns those messages so the model can decide whether to post again. There is no lock state, so nothing can wedge, and human posts are never checked.

Record: docs/designs/agent/compass-topic-write-locks/design.md

Decisions (all pending Matt)

Row	Decision
DL-472	PostMessageRequest.last_seen_message_id = 10, seen_message_ids = 11; refuse when an unseen message from another author exists. No lock, TTL or waiter queue.
DL-473	The check is per topic. Each insert takes a FOR NO KEY UPDATE lock on the topic row, so seq order matches commit order. AnswerAsk locks the topic before the message.
DL-474	The agent's mark moves only on observations contiguous from it. Steers and delivers go into a per-topic seen set. The tracker persists in the session.
DL-475	A refusal is PostMessageResponse.stale_post = 3, the same shape as #2120's cost_estimate. The idempotent retry is checked first. Tools never retry on their own.
DL-476	Every agent account is checked. Human clients never set the fields.

Open questions for Matt (RIG-5137)

OQ1 to OQ6 are load-bearing: feature shape, seen set, whether human authors count, refusal shape, order against the #2120 hold, and whether the public RPC honours the fields. Recommendation: A, A, A, B, A, A. The Plan builds the recommendations, and each OQ lists the Plan change for the other options. This PR must not merge until the OQs are ruled.

Cross-record numbering

• PostMessageRequest 8 and 9 and PostMessageResponse 2 belong to docs(agent): design message fan-out cost estimate and confirm gate (RIG-1713) #2120.
• CommsCallRequest arms 13 and 14 belong to docs(agent): design the per-agent status board #2078.
• This record takes request fields 10 and 11 and response field 3, and adds no relay arm.

Review

• design-critic: 14 findings and 5 forks, all folded in. They covered the field collision with docs(agent): design message fan-out cost estimate and confirm gate (RIG-1713) #2120, high-water-mark gaps from steers and settle holds, tool results applied at turn_start, the AnswerAsk lock order, tracker persistence, the refusal render budget, and merging T1 and T2 so the check never ships without a caller.

Checks

• rumdl is clean on the record and the 5 rows.
• design-ledger gate: OK, 419 decision files, 197 records.

Spec-impact: none
Ledger-impact: adds DL-472 to DL-476 (docs/designs/decisions/agent/)

Refs RIG-1714

Co-authored-by: Matt Wilkinson matt@rigel.build

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[linear-code]

RIG-1714

[github-actions]

Compass engineering docs preview: https://compass-comms-rig-1714-topic.compass-eng-docs.pages.dev

Deployed from compass-comms/rig-1714-topic-locks-design at de50d3f.

Changed pages:

• docs/designs/agent/compass-topic-write-locks/design.md
• docs/designs/decisions/agent/DL-472.md
• docs/designs/decisions/agent/DL-473.md
• docs/designs/decisions/agent/DL-474.md
• docs/designs/decisions/agent/DL-475.md
• docs/designs/decisions/agent/DL-476.md

[rigel-mintaka]

Review at head de50d3f8: high 0, medium 0, low 5, nit 0. Scope: the full record and DL-472 to 476. Lenses: correctness against store, delivery and compass-agent code; consistency; OQ deltas; field numbers vs #2120 and #2078; tests; anchors; hygiene. The first round had 2 high, 7 medium and 11 low; 18 are fixed, 1 is partly fixed (the deadlock-test wait predicate is unscoped, now low N1), and 1 was declined (the README status convention; the gate accepts the string). The 5 remaining lows are test-precision notes, folded at implementation. rumdl and the design-ledger gate are clean. Six load-bearing OQs are for Matt in RIG-5137.

[rigel-mintaka]

Moved to RigelBuild/docs#24 under Matt's directive that design records live in the docs repo, not code repos. Review continues there.