ACTIVITY-WP-0043: owner-return pickup adapter (STATE-WP-0094-T03 owner side)

Disabled reviewed definition, pinned profile/grant, server-side unique
submission adapter with receipts, and opt-in activation plan. No schedule,
deployment or dispatch.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 671493@bnt-lap001
Assistant-Session: 60d7b11f-78f9-4731-9367-918511b2762d

docs/owner-return-pickup-activation-plan.md

@@ -0,0 +1,60 @@
+# Owner-Return Pickup — Activation Plan (opt-in, founder-reviewed)
+
+Status: **proposed, not executed.** Workplan ACTIVITY-WP-0043; State Hub
+STATE-WP-0094-T03. Nothing below has been applied.
+
+## What exists at source level
+
+| Item | Identity |
+| --- | --- |
+| ActivityDefinition | `activity-definitions/owner-return-pickup.md`, id `owner-return-pickup`, `enabled: false`, rule condition `False` |
+| Definition UUID | `uuid5(uuid5(NAMESPACE_URL,"activity-core:activity-definition"),"owner-return-pickup")` (`owner_return_pickup.ACTIVITY_DEFINITION_ID`) |
+| Harness profile | `harness.agent-dev-local@1.0.0` |
+| Repository grant | v1, `allowed_paths: [workplans]`, commits 1..1, `publish: false` |
+| Adapter | `activity_core.owner_return_pickup.submit_owner_returns(session, candidates, collection_complete=...)` |
+| Gate | env `ACTIVITY_CORE_OWNER_RETURN_PICKUP_ENABLED` (unset = refuse before any write) |
+
+## Preconditions (all required before activation)
+
+1. State Hub C-25 message collection paginated to completion per awaited agent
+   (current cap: 200 replies). Owned by state-hub; ACTIVITY-WP-0043-T03.
+2. A caller that builds `current_tasks` from fresh authoritative source bound to
+   the scanned repository revision, resolving every predecessor and decision
+   (contract: "Current eligibility guard"). No manufactured empty predecessor lists.
+3. The caller runs inside the existing supported runner (Custodian dependency
+   monitor / established Activity Core worker); no new schedule is introduced.
+4. Founder review of this plan and of the definition/grant above.
+
+## Exactly what would be enabled
+
+1. Set `ACTIVITY_CORE_OWNER_RETURN_PICKUP_ENABLED=true` on the single process
+   that invokes the planner-to-adapter handoff (no other component reads it).
+2. Leave `owner-return-pickup.md` at `enabled: false`; the definition row is
+   synced only so the `activity_definition_id` foreign identity exists.
+3. First run: one repository, operator-triggered, with the planner output saved
+   alongside the adapter receipts.
+
+No Helm values, CronJob, Temporal schedule or credential changes are part of
+this plan; any such change needs its own reviewed workplan.
+
+## Evidence to capture (per run)
+
+- Planner input: checker report revision, `observed_on`, `current_tasks` source
+  revision, and pagination completeness proof (reply counts per agent, last page).
+- Planner output candidates (dispositions incl. `stopped` with reasons).
+- Adapter receipts: `triggering_event_id`, `idempotency_key`, `status`
+  (`inserted`/`duplicate`/`skipped`), `ops_run_id`, `state`.
+- Re-run of the same input proving every prior `inserted` becomes `duplicate`
+  and no new rows appear (server-side uniqueness).
+- Ops-run close evidence via existing exact-repeat terminal close.
+Store under `docs/evidence/ACTIVITY-WP-0043-*.md` and post a State Hub progress event.
+
+## Rollback
+
+1. Unset `ACTIVITY_CORE_OWNER_RETURN_PICKUP_ENABLED` — the adapter refuses
+   immediately, before any write.
+2. Open/claimed owner-return rows (`source_type = state_hub_owner_return`) are
+   failed/closed through the normal ops-run close path; never deleted, so the
+   unique keys keep blocking re-insertion of the same messages.
+3. No workplan field is changed by the pickup itself (review preparation only),
+   so there is no repository state to revert.