Extract PRISM block candidate submission

[kiwidream]

Position in the stack

PR 4 of 9. Base: prism-audit-artifact-owner. Depends on PR 75. Next: PR 77.

Review this PR against its configured base. See the stack guide for the complete order.

Why this slice exists

The PostgreSQL outbox is the durable authority for block-worthy work, but replay, submission, retry, terminalization, and candidate-only credit were implemented inside the coordinator. This slice gives that state machine one owner while leaving the coordinator as wiring and facade.

What changes

• Move candidate encoding, durable replay, bounded wakeups, submission, retry classification, and terminalization into block_candidates.
• Introduce BlockCandidateService and narrow BlockCandidatePorts for ledger, writer admission, submission, audit preview, and credit decisions.
• Preserve candidate-only credit, same-hash recovery, poison-row cleanup, parent-before-child replay, and bounded retry semantics.
• Replace coordinator-owned candidate machinery with lazy service construction and thin delegates.
• Keep demonstrated coordinator attribute compatibility through explicit descriptors backed by the service.

Reading the diff

The roughly 940 additions and 520 deletions are mostly one state-machine move: the new owner is about 575 lines, while the coordinator loses about 524 lines and gains explicit wiring/delegates. Start with block_candidates.py and its focused tests, then confirm the removed coordinator methods map to narrow service calls.

Behavior and risk

This is a medium-risk mining and payout slice. A share and its required candidate intent remain atomic in the ledger; the in-memory queue remains only a bounded wakeup. Retryable failures stay pending, terminal failures are abandoned once, and restart replay remains idempotent.

Validation

• 82 focused block-candidate tests passed at this boundary.
• Candidate, audit, restart, and replay regressions pass in cumulative PRISM discovery.
• git diff --check passed.

Operator impact

No schema or configuration action is introduced by this slice; it depends on the ledger migration in PR 75.

---

Note

Medium Risk
Touches mining payout paths (durable outbox, block submit, share credit on accept, retry/finalize); behavior is intended to be equivalent but regressions would affect block landing and miner credit.

Overview
Moves durable block-candidate work out of prism_coordinator into new block_candidates: intent encode/decode, bounded queue wakeups, ledger replay, submit/retry/finalize, and credit-on-accept actor handling.

PrismCoordinator now lazy-builds BlockCandidateService via BlockCandidatePorts (ledger, writer admission, submit, preview, share writer) and delegates enqueue, replay, submit loop, backoff, and metrics; legacy attribute names stay on compatibility descriptors backed by the service.

Replay adopts share credit before publishing a decoded candidate for poison cleanup, and a failed adoption on one row no longer blocks replay of the rest. Tests cover standalone codec round-trip, service ownership, and replay edge cases.

^{Reviewed by Cursor Bugbot for commit 76e54d9. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b668e77. Configure here.}