Orchestrator checkpoint blocked_reason enum cannot express a substantive halt #601

Summary

The orchestrator checkpoint's blocked_reason field is a fixed enum pinned to VALID_BLOCKED_REASONS:

none, spawn_agent_unavailable, delegation_launch_failed, delegate_no_receipt, delegate_contract_incomplete, validator_failed, user_requested_stop

Every member describes a mechanical delegation or validator failure. None can express a substantive halt, in which every delegation succeeded, every validator passed, and the work nonetheless cannot proceed because measurement falsified the plan's premise.

Where this bit

Epic child #511 (winformspumphost-suite-determinism-511) halted on 2026-08-22 in exactly that state. Phases 0 through 4 executed, every delegation returned a receipt, every validator returned ok:true — and then measurement proved the plan's central premise false: the remedy forced a window handle that ItemViewer construction had already created via Designer-emitted ISupportInitialize.EndInit() calls. See #592.

Because no enum member fit, the orchestrator recorded blocked_reason: "none" to keep the checkpoint schema-valid and put the real reason in free-form halt and blocking_findings keys. That is the least-bad option available, but it means:

• a reader scanning blocked_reason sees none on a checkpoint that is genuinely halted;
• any tooling that gates on blocked_reason cannot distinguish "not blocked" from "blocked for a reason the vocabulary cannot name";
• the substantive reason survives only in keys no validator checks.

Recording a mechanical member instead would have been worse: it would misrepresent what happened.

Proposed direction

Add at least one member that names a substantive halt — for example premise_falsified — or make the field a two-part shape carrying a category plus a required free-text justification when the category is substantive. The specific vocabulary is a design decision; the requirement is that a halt in which nothing mechanical failed be expressible.

Note on where the fix belongs

.claude/** in this repository is push-down-owned: roughly 166 files, including the orchestration rules and hooks, are overwritten from the drm-copilot upstream with no templating. A fix applied only here would be reverted by the next push-down. The change belongs upstream, with this issue tracking the requirement and the local evidence.

Acceptance Criteria

• blocked_reason (or its replacement shape) can express a halt in which every delegation and validator succeeded but the plan premise was falsified.
• The vocabulary change is made in the upstream drm-copilot source, not only in this repository's .claude/ copy.
• .claude/rules/orchestrator-state.md and the orchestrator-state validator agree on the new member set.
• A halted checkpoint no longer has to record blocked_reason: "none" to stay schema-valid.