Carry main fixes into redesign main (#746)

[thomasluizon]

Carries main commit 649c9dbe6b873d77ba071134b725a36e81a0a3b0 from orbit-api#702, for thomasluizon/orbit-tickets#1215, onto redesign/main with git cherry-pick -x. The carry is 75081cbc0549624e1a4e0a5adf0ff0546119e6e4 and retains the source SHA trailer. Confirmed bulk creation defaults omitted recurring quantities to one and rolls back approval consumption with failed writes, allowing retry.

Conflict resolutions

Conflicted path	Redesign changes retained	Resolution
src/Orbit.Application/Chat/Tools/IAiTool.cs	Clarification prechecks from orbit-api#666 and argument checks from orbit-api#670	Keep IClarificationPrecheckTool and IArgumentCheckTool, and add main's ITransactionalAiTool. Keep the existing concurrency retry interface.
src/Orbit.Application/Chat/Tools/Implementations/BulkCreateHabitsTool.cs	Argument checks from orbit-api#670 and preview validation from orbit-api#703	The class implements IAiTool, IArgumentCheckTool, ITransactionalAiTool. Retain check-only validation, preview item handling, and empty-title preview parsing; apply main's recurring quantity default to parents and children. Explicit quantities and one-time tasks retain their existing semantics.
src/Orbit.Infrastructure/Services/AgentOperationExecutor.cs	Editable previews from orbit-api#588, execution notifications from orbit-api#613, and chat approval holds from orbit-api#666	Keep clarification checks, chat holds, preview enrichment and fingerprints. Move the execution-start notification into the allowed policy/tool path, preserving its consumed-confirmation cancellation fallback. Carry policy evaluation and writes inside the bulk transaction, rollback failed outcomes, and handle exceptions outside it so original exception types reach retry and timeout handling. Keep main's current-policy audit state and redacted failure logging with operation/correlation IDs.

The redesign's per-operation reversibility from orbit-api#701 and invalid-batch approval validation from orbit-api#703 remain intact, including confirm/execute HTTP 400 responses. Their production code and tests are unchanged and passed in the full suite.

The other five carried paths are RedactedOperationException.cs, ToolOutcomeRollbackException.cs, BulkCreateHabitsToolTests.cs, AgentExecutionAndSanitizerTests.cs, and BulkCreateAgentOperationTests.cs. Both sides' tests are retained. The only adjustment to a carried test is one IPendingOperationChangePreviewer substitute passed to the executor constructor in BulkCreateAgentOperationTests.cs, because redesign adds that dependency.

No commit was skipped. No DTO, endpoint or persistence model changes are included. The build's OpenAPI generator ran and left src/Orbit.Api/openapi.json unchanged; no manual contract merge was needed. No migrations or snapshot files changed and there is no migration ordering question.

Validation

All four commands ran from the repository root; exit codes were read directly. Logs are outside the worktree under /private/tmp/ticket-746-*.log.

Command	Exit code	Result
env -u LANG dotnet build Orbit.slnx	0	0 errors
env -u LANG dotnet test	0	9,414 passed, 0 failed, 0 skipped
env LC_ALL=en_US.UTF-8 dotnet build Orbit.slnx	0	0 errors
env LC_ALL=en_US.UTF-8 dotnet test	0	9,414 passed, 0 failed, 0 skipped

env -u LANG dotnet ef migrations has-pending-model-changes --project ../Orbit.Infrastructure --startup-project . --no-build, run from src/Orbit.Api, exited 0 and reported no changes since the last migration. Pre-commit formatting, dash, timeless text, root allowlist and suppression checks passed. The changed C# files contain no bare narration comments.

Test evidence

• Before the cherry-pick, unchanged tests ran against the defect: env -u LANG dotnet test --filter 'FullyQualifiedName~BulkCreateHabitsToolTests|FullyQualifiedName~AgentExecutionAndSanitizerTests' exited 0 with 34 passed. They did not catch the carried regressions.
• After importing main's regression tests, temporarily restoring the two pre-carry implementations and retaining the new interface declarations allowed a direct regression run: env -u LANG dotnet test --filter 'FullyQualifiedName~BulkCreateHabitsToolTests|FullyQualifiedName~AgentExecutionAndSanitizerTests|FullyQualifiedName~BulkCreateAgentOperationTests' exited 1 with 14 failed and 39 passed. FrequencyQuantity_DefaultsOnlyForRecurringItems and RecurringSubHabitWithoutQuantity_DefaultsToOne observed missing defaults; ConfirmedDailyItemsWithoutQuantity_CreateEveryItemWithQuantityOne observed failed creation; ValidationFailure_LeavesPendingOperationApprovable, PayGateFailure_LeavesPendingOperationApprovable and FailureAfterWrite_RollsBackHabitsAndConfirmationBeforeRetry observed consumed approval after failure. Exception-identity and policy-state regression cases also failed. The resolved implementations were restored immediately after the run.
• With the resolution in place, env -u LANG dotnet test --filter 'FullyQualifiedName~BulkCreateHabitsToolTests|FullyQualifiedName~AgentExecutionAndSanitizerTests|FullyQualifiedName~BulkCreateAgentOperationTests|FullyQualifiedName~AgentChatWriteHoldTests|FullyQualifiedName~AgentCatalogServiceTests|FullyQualifiedName~HeldWriteArgumentCheckTests|FullyQualifiedName~PendingOperationRevisionServiceTests|FullyQualifiedName~PendingOperationItemContractTests|FullyQualifiedName~PendingOperationChangePreviewerTests' exited 0 with 208 passed. Both full locale suites then passed all carried regressions and redesign tests.

Refs thomasluizon/orbit-tickets#746
Refs thomasluizon/orbit-tickets#1215

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
91.9% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[pullfrog]

✅ No new issues found.

Reviewed changes Reviewed the complete carry onto redesign/main, including conflict resolutions and regression coverage.

• Recurring defaults: Bulk creation now defaults omitted recurring quantities to one for parents and children while preserving explicit values and one-time task behavior.
• Atomic approval and writes: Transactional bulk execution rolls back approval consumption and writes on failed outcomes, preserving successful retry and original exception propagation.
• Redesign compatibility: Clarification checks, chat approval holds, editable previews, and execution-start notifications remain in place; failure logging is redacted and retry audits use the current policy evaluation.
• Verification: The solution build completed with zero errors, and all 9,414 unit tests passed with no failures or skips. No DTO, endpoint, or persistence contract changes were introduced.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}