Selection policy carries a bounded hotfix obligation

Refs #16448

Context

Sub of #16448, from D#16304's OQ2 resolution. This ticket owns the selection half, and the obligation @neo-kimi-phoebe named as load-bearing:

the bounded hotfix obligation attaches to selection under either policy — rolling or promoting … it is what makes "no tag exists" loud and time-limited instead of a silent terminal.

The Problem

A selection step can silently omit the class of fix a lagging plane most needs. Starvation, contention and backoff-bound repairs never read as release-worthy at cut time, because their value is invisible until someone is already suffering their absence. #16224 is the measured instance: merged, in no tag, and a deployment stuck behind exactly that gap.

Without a bounded obligation, "nobody promoted it" and "it is not needed" are indistinguishable — and the plane waits indefinitely on the first while being told the second.

The Architectural Reality

• The sibling availability sub produces staged candidates with a stageReceiptId; this lane consumes them and decides.
• buildScripts/release/publish.mjs is the release authority for the promoting policy; it binds an already-staged digest and must not re-resolve.
• This lane selects and records only. Mutation belongs to D#15758's activation kernel.

The Fix

At an external window, policy either takes the latest compatible staged cohort, or a release authority promotes one by binding an already-staged exact digest — re-resolution or rebuild at activation is failure. Under either policy, a required operational fix that is not selected must produce an explicit, time-bounded ineligibility decision naming a reason and an owner.

Contract Ledger Matrix

Decision Record impact

none — implements the graduated shape.

Acceptance Criteria

• At a window, policy selects the latest compatible staged cohort, or a promotion binds an already-staged exact digest.
• Activation binding re-resolves or rebuilds ⇒ failure, proven by spec.
• The #16224 fixture: a fix present in a candidate but in no tag is either selected, or produces an explicit ineligibility decision carrying reason, owner and expiry. "No tag exists" is never a silent terminal.
• The obligation holds under both policies — a spec per policy, not one shared happy path.
• An ineligibility record that expires without resolution is itself surfaced.
• A refusal caused by unreadable cohort evidence carries its sourceError into the ineligibility record, distinct from a refusal caused by a genuine incompatibility. "We could not read the candidate" and "the candidate does not fit this target" are different facts and an operator acts on them differently — collapsing them reintroduces the silence this lane exists to remove. (The predicate's public JSDoc precision and its final module home moved to #16505 — they share none of this lane's blocker on the staged-candidate shape, so holding them here would stall them for an unrelated dependency.)

Out of Scope

• Candidate production and retention — the availability sub.
• The mutation itself — D#15758's activation kernel; this lane never mutates.
• Whether arbitrary dev cohorts are admissible — the admissibility-contract sub supplies that predicate.

Avoided Traps

• "Stage continuously, tag the activation points." Refuted twice in D#16304: it relocates the obligation one layer later without bounding it, reproducing the omission.
• Treating the obligation as an ornament on the promotion policy. It attaches to selection under both, which is precisely @neo-kimi-phoebe's correction.

Related

• #16448 (parent) · D#16304 (source) · #16224 (the fixture).

Origin Session ID: 9f05cd72-5457-4ec2-926c-ef1406041f19

Retrieval Hint: query_raw_memories("selection policy bounded hotfix obligation ineligibility reason owner promotion staged digest")