Adopt an already-published PR instead of publishing again

Fixes counterexample 5 from specs/orchestrator.qnt. A crash after the
PR was opened but before PR_OPEN was recorded left the agent in
EXECUTING; the restart question's 'continue' and 'start' then published
again, Gitea refused a second PR, and there was no way back to PR_OPEN.
On the live run the executor model happened to notice the existing
work; recovery must not depend on that.

- Boot (A3 step 4): in EXECUTING, if Gitea shows the milestone's PR
  open, adopt it, watch it from the start, and resume in PR_OPEN with a
  notice. Gitea unreachable or the PR closed: the restart question, as
  before.
- MilestonePublisher.publish is idempotent: after pushing, an open PR
  for the branch is adopted (and so updated) rather than a second one
  opened. This also covers a PR opened whose response was lost.
- The model adopts too, gains the lost-response outcome, and now counts
  PRs opened per milestone (one_pr_per_milestone was a flag the fixed
  model could never set). A mutant without adoption fails the new
  scenario; the properties held over 200,000 traces each.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

nisse-dev/tests/test_quint_counterexamples.py

@@ -134,6 +134,12 @@ class Publisher:
             PullRequest(number=20, state="open", head=branch, url="u"), "opened PR #20"
         )
 
+    def published_pull_request(self, task_id: str, milestone: int) -> Any:
+        branch = f"{task_id}/milestone-{milestone}"
+        if branch in self._gitea.prs:
+            return PullRequest(number=20, state="open", head=branch, url="u")
+        return None
+
     def push_followup(self, **kwargs: Any) -> str | None:
         return "abc12345"
 
@@ -249,7 +255,6 @@ def test_an_afterthought_rejects_the_next_plan(tmp_path: Path) -> None:
     assert agent.gate().get("rev") == 2  # arch was rev-1; not re-planned
 
 
-@XFAIL
 def test_crash_after_opening_the_pr_publishes_again(tmp_path: Path) -> None:
     """crashAfterOpeningThePrPublishesAgainTest"""
     gitea = FakeGitea()
@@ -261,9 +266,11 @@ def test_crash_after_opening_the_pr_publishes_again(tmp_path: Path) -> None:
     assert agent.state == EXECUTING  # the PR exists; PR_OPEN was never recorded
 
     agent = Agent(tmp_path, gitea)  # restart: the intent is verified
-    agent.say("continue", "start milestone 1")
-    # There is a PR for this milestone: the agent must end up watching it,
-    # not trying to open another.
+    # There is a PR for this milestone: the agent adopts it on boot and ends
+    # up watching it, never trying to open another.
+    assert agent.state == PR_OPEN
+    assert "PR #20 is open" in agent.transport.outbound[-1].text
+    agent.say("continue", "start milestone 1")  # no longer means anything
     assert agent.publisher.attempts == 0
     assert agent.state == PR_OPEN
 
@@ -321,3 +328,22 @@ def test_the_harness_reaches_pr_open_without_faults(tmp_path: Path) -> None:
     assert agent.state == PR_OPEN
     assert agent.publisher.attempts == 1
     _ = (AWAIT_INPUT, MILESTONE_PLANNING)
+
+
+def test_boot_asks_as_before_when_gitea_cannot_say(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    gitea = FakeGitea()
+    agent = Agent(tmp_path, gitea)
+    agent.say("use demo", "approve", "approve")
+    agent.publisher.crash_after_opening = True
+    with pytest.raises(SystemExit):
+        agent.say("start milestone 1")
+
+    def unreachable(self: Publisher, task_id: str, milestone: int) -> Any:
+        raise GiteaError("gitea is down")
+
+    monkeypatch.setattr(Publisher, "published_pull_request", unreachable)
+    agent = Agent(tmp_path, gitea)
+    assert agent.state == AWAIT_INPUT
+    assert "restarted mid-EXECUTING" in agent.transport.outbound[-1].text