Plan C: live budget downgrade + concurrency proof + documented run

[adbarc92]

Plan C — Evidence: live budget downgrade, collision proof, documented run

Final engine plan (Plan A #5 and Plan B #6 are already merged to main). Closes the remaining evidence gaps so every resume claim is not just implemented but proven.

What this proves

• Budget auto-downgrade — now live and tested. config/budget.yaml downgrade_paths are injected into the state server; at claim time, once spend crosses 85%, the model is swapped. test_budget_downgrade_live.py runs a real pipeline at --budget-limit 5.0 and asserts the Test-phase agents are downgraded (qa_test→gpt-4o-mini, security→claude-3-5-haiku-20241022) while skip-listed critical agents keep theirs. The crossing is deterministic (Test opens only after all Code spend commits, in the same transaction).
• Collision-freedom under real contention — the marquee proof. test_concurrency_no_collision.py drives 8 real worker subprocesses at a pool of 12 simultaneously-ready tasks, then inspects the persisted SQLite directly: done == total == distinct == spend_rows == state_rows == 12. These assertions are gated by the store's version/owner guards (not by schema), so they genuinely prove exactly-once, collision-free effect.
• Documented run — committed, inspectable, authentic. docs/runs/2026-07-24/ holds a real run's run-summary.md / snapshot.json / dag.md: status done, all six phases complete, gate approved, and the live Test-phase downgrade. (The final reviewer re-derived the downgrade math across all 13 tasks to confirm it's a genuine DB capture, not hand-written.)

Two real bugs the stress test surfaced (and fixed)

1. Store.create_run hardcoded "clarify" as the entry phase → generalized to the order-0 phase (phase_names[0]); behavior-identical for the six-phase config (enforced by PhasesConfig's order-0 validation).
2. The synthetic-agent approach hit the registry's lack of an unknown-id fallback (a legitimate safety boundary — don't silently mock typo'd ids); resolved by using 12 real non-clarify agent ids, so no production registry change was needed.

Also

• APPFORGE_PHASES env override for the phases-config path (enables the synthetic stress config to drive real subprocess workers).
• CI-green: ruff check 0 errors, black --check clean, pytest tests/ at 87.65% coverage (gate 70%).
• Every task went through TDD + an independent spec/quality review; the branch had a final opus whole-branch review (ready to merge, no Critical/Important).

Out of scope (Plan D)

Retiring the legacy LangGraph orchestrator + repointing backend/main.py + migrating its ~25 coupled tests — a destructive cutover the design scoped as its own gated PR. Deliberately excluded so this evidence work stays out of that blast radius.