Step 2.5: Inbox substrate + dumb v1 ordering + operator-action logging

[heavygee]

Goal

Land the inbox_items substrate and a deliberately dumb v1: promote per-session terminal states into persistent operator attention items, ordered oldest-first with category labels (no learned salience), and log every operator action as a training signal. This is the instrumented training ground for the future cross-session salience model — not a smart prioritizer.

Spec

• docs/plans/2026-06-03-overseer-build-sequence.md Step 2.5
• docs/plans/2026-06-03-overseer-contracts.md §3 (inbox item model), §1 (attention_candidate promotion gate), §11 (provenance)
• docs/plans/2026-06-03-overseer-prioritization.md §5 (v0 simplifications; implicit/explicit operator signals)
• docs/plans/2026-06-05-overseer-rollout-and-diagrams.md §4 (attention-inbox mocks + confirmed v1 decisions) — primary for v1 scope
• Upstream: tiann Voice roadmap: picker -> provider abstraction -> local stack -> fleet command centre tiann/hapi#691 (the "priority model" = category taxonomy + coarse rank; learned salience is later)

Acceptance (v1 — deliberately dumb)

• Migration adds inbox_items table (per contracts §3, full-model schema) + a join/index path from events.id to inbox_items.source_event_ids. Schema is designed for the full salience model; v1 leaves the learned fields inert.
• Per-session promotion: each session terminal/turn state with attention_candidate = 1 becomes one attention item. No cross-session dedupe / merge / root-cause rollup in v1 — deferred to the Overseer (Step 3: Read-only Overseer wired to voice #25).
• Dumb ordering: default sort is oldest-first (email discipline). Category badge (QUESTION / BLOCKED / ERROR / FINALE / STALE / needs-approval) is a label, not computed priority. No learned weights. The coarse permission > blocked > completion rank exists only as an optional grouping (the Triage-Stack view), not the default.
• Operator-action logging from day one: open / snooze / done / dismiss / delete / route / retry are recorded against the item as training signal (per inbox_items status + operator_feedback), even though nothing consumes them yet. The dataset is the point.
• Artifact-centric title where available: when an item carries an artifact_ref (PR / issue / branch / deploy), surface that as the title; fall back to the session name otherwise.
• Lightweight explain_priority/provenance: "why am I seeing this?" answerable from category + age + source event IDs (full aging/criticality reasoning is a later layer).

Out of scope (deferred)

• Learned salience / per-operator weights — later, trained from the logged operator actions.
• Cross-session merge / dedupe / event_links root-cause ("5 blocked → 1 fleet item") — owned by the read-only Overseer (Step 3: Read-only Overseer wired to voice #25).
• The first-class attention-inbox pane UI (desktop+mobile) — separate issue; this issue is the substrate it renders.
• Overseer entity, voice, dispatch (Step 3: Read-only Overseer wired to voice #25, Step 4: Disagreement-capable Overseer + voice dispatch with confirm #26).

Dependencies

• Blocks: Step 2.75: Replay harness v0 + CI gate #24 (replay asserts against promotion), Step 3: Read-only Overseer wired to voice #25 (Overseer queries + later owns cross-session rollup)
• Blocked by: Step 2: Events table + worker emission #22 (events substrate; per-turn summary carrier)
• Part of: Fleet Overseer architecture — umbrella #19

Suggested PR breakdown

1-2 PRs: inbox schema migration; per-session promotion + oldest-first ordering + category labels + operator-action logging.

Risks

• "Becomes email" — unread-count anxiety. Guardrails: stale expiry, severity-label discipline, FYI ⇒ captured-only (never queued), bulk handling, "why am I seeing this?" answerable. (See rollout doc §4 failure-mode list.)
• Resisting premature smartness: the temptation to add priority inference in v1 defeats the purpose — the first useful dataset is operator response, not agent judgement.

[heavygee]

Ordering decision (2026-06-05, supersedes the "oldest-first default" line in the body): v1 default ordering is the coarse category rank (permission > blocked > error/needs-decision > completion) with oldest-first within each tier — i.e. the "severity stack, oldest inside each bucket" shape, renderable as a flat list (rank-then-age) or as severity buckets.

• Still deliberately dumb: the rank is a fixed, hand-set category order, NOT learned salience. No per-operator weights in v1.
• Email discipline preserved: oldest-first still forces acknowledgement within a tier.
• Category badge is therefore both a label and the coarse priority tier (not "label, not priority" as the body currently says).
• Keeps faith with the Voice roadmap: picker -> provider abstraction -> local stack -> fleet command centre tiann/hapi#691 "priority model first" commitment — the coarse rank is the priority model, shipped in v1; only learned salience is deferred (trained later from the logged operator actions).

Everything else in the body stands (strictly per-session, no cross-session merge/root-cause → #25, operator-action logging from day one, artifact-centric titles).