docs(compass): design topic stale-post check for managers (RIG-1714)

[rigel-mintaka]

Moved

• Moved from docs(agent): design topic stale-post check for managers (RIG-1714) compass#2136: design records now live in this repo, under docs/designs/compass/.
• Links to compass records that have not moved point at compass main blob URLs.

Summary

Design record for RIG-1714: stop Manager agents from double-answering in a topic. Instead of the per-topic write lock the issue proposed, the record designs an optimistic stale-post check. An agent post carries the newest message the agent has seen in the topic (last_seen_message_id) and a capped set of messages seen out of order (seen_message_ids). The server refuses the post when another author posted a message the agent has not seen. The refusal returns those messages so the model can decide whether to post again. There is no lock state, so nothing can wedge, and human posts are never checked.

Record: docs/designs/agent/compass-topic-write-locks/design.md

Decisions (all pending Matt)

Row	Decision
DL-472	PostMessageRequest.last_seen_message_id = 10, seen_message_ids = 11; refuse when an unseen message from another author exists. No lock, TTL or waiter queue.
DL-473	The check is per topic. Each insert takes a FOR NO KEY UPDATE lock on the topic row, so seq order matches commit order. AnswerAsk locks the topic before the message.
DL-474	The agent's mark moves only on observations contiguous from it. Steers and delivers go into a per-topic seen set. The tracker persists in the session.
DL-475	A refusal is PostMessageResponse.stale_post = 3, the same shape as #2120's cost_estimate. The idempotent retry is checked first. Tools never retry on their own.
DL-476	Every agent account is checked. Human clients never set the fields.

Open questions for Matt (RIG-5137)

OQ1 to OQ6 are load-bearing: feature shape, seen set, whether human authors count, refusal shape, order against the #2120 hold, and whether the public RPC honours the fields. Recommendation: A, A, A, B, A, A. The Plan builds the recommendations, and each OQ lists the Plan change for the other options. This PR must not merge until the OQs are ruled.

Cross-record numbering

• PostMessageRequest 8 and 9 and PostMessageResponse 2 belong to #2120.
• CommsCallRequest arms 13 and 14 belong to #2078.
• This record takes request fields 10 and 11 and response field 3, and adds no relay arm.

Review

• design-critic: 14 findings and 5 forks, all folded in. They covered the field collision with #2120, high-water-mark gaps from steers and settle holds, tool results applied at turn_start, the AnswerAsk lock order, tracker persistence, the refusal render budget, and merging T1 and T2 so the check never ships without a caller.

Checks

• rumdl is clean on the record and the 5 rows.
• design-ledger gate: OK, 419 decision files, 197 records.

Spec-impact: none
Ledger-impact: adds DL-472 to DL-476 (docs/designs/decisions/agent/)

Refs RIG-1714

Co-authored-by: Matt Wilkinson matt@rigel.build

[linear-code]

RIG-1714

[github-actions]

Rigel public design docs preview: https://compass-comms-rig-1714-topic.docs-2ui.pages.dev

Deployed from compass-comms/rig-1714-topic-locks-design at 47c7af6.

[rigel-mintaka]

Head note at 47c7af65f217dc92e8ba4f377a6b19bcf9831aa0 (base main b752ded3).

• Rebased onto main with no conflicts.
• 19c6cc2a points five compass blob links at in-repo records, since the compass URLs now 404. A delta review found 0 findings.
• 43026888 folds in the five lows left open by the compass#2136 review at de50d3f8:
  • N1: the lock-wait test waits only on a backend blocked by its own pid (pg_blocking_pids).
  • N2: commitStaged() runs at the top of #flushTurnEnd, which covers strand recovery.
  • N3: refused ids get an ack only, with no DELIVER injection.
  • N4: the list tool names the topic from resolveTopicId.
  • N5: session entries are written at commit points only.
• The delta review found 0 high, 0 medium and 1 low (cite the helper symbol). 47c7af65 fixes it by citing waitForBlockedCoordinationTransactions.
• Local: rumdl, the design-ledger gate and ref-gate are clean. CI check is green.
• OQ1-6 are still open for Matt in RIG-5137.