Rehydrate omits overrides and route_decisions (same gap as #149's snapshots)

[P3st83]

Found while reviewing #149. That PR reconstructs persisted snapshots into SnapshotArtefact on reload, which is correct, but the same rehydrate gap exists for two more collections, and there are two minor items from the same scan.

The rehydrate gap is wider than snapshots

_rehydrate_workspace in packages/coordinator-py/chap_coordinator/coordinator.py rebuilds members, tasks, whispers, deliberations, handoffs, audit into their dataclasses, and its exclusion set is:

if k not in {"members", "tasks", "whispers", "deliberations", "handoffs", "audit"}

But _snapshot_workspace persists via asdict(ws), which serialises every collection, and the Workspace dataclass also has typed overrides, snapshots, and route_decisions (types.py). So on reload, overrides and route_decisions are injected into Workspace(**ws_kwargs) as raw dicts, not OverrideArtefact / RouteDecisionArtefact.

• snapshots is the live crash fix: rehydrate persisted snapshot artefacts before rollback #149 fixes (control.rollback reads snap.include).
• overrides and route_decisions are the same omission. They are latent today, because nothing in the coordinator reads them back as typed objects after a reload (only len(ws.overrides) at coordinator.py:838; route_decisions is only ever written). But they come back as raw dicts, they diverge from the TypeScript restore() (which rebuilds all three into Maps), and they will fail the moment any attribute/to_dict() read is added, or if chap-analytics reads a restored store.

Suggested fix (extends #149): reconstruct all three, so the exclusion set becomes {members, tasks, overrides, whispers, deliberations, handoffs, snapshots, route_decisions, audit}, matching what the TypeScript restore() reconstructs.

Minor items from the same scan

• audit.submit_to_scitt is not in _READ_ONLY_METHODS (coordinator.py), so dispatching it appends an entry to the very chain it is submitting. It reads and submits; it should not mutate the log.
• control.supersede skips the paused-assignee check that task.create enforces (coordinator.py if ws.members[assignee].paused), so a successor task can be created for a paused participant.

Related cross-language divergences of the or-vs-?? family are in #152 (control.snapshot/control.rollback empty list) and #151 (handoff empty acceptance).

[brightbeamarsalan]

All three confirmed and fixed, on fix/153-rehydrate-and-scan. Good scan, thank you.

The rehydrate gap. Reproduced against a SQLite store: overrides and route_decisions come back as plain dicts after a restart while the TypeScript restore rebuilds all three. Both are now rebuilt, and the exclusion set names all eight typed collections rather than listing the ones that happened to be handled, so a collection added later cannot be forgotten silently. The test drives a workspace with something in every one of them, asserts the type of every value after a rehydrate, and reads an override's result and rationale back through a real restart.

audit.submit_to_scitt. Confirmed: it appended an entry and moved the chain head, so the receipt attested a log one entry shorter than the workspace then held. It joins the read-only set in both references.

control.supersede. Confirmed: a successor could be handed to a participant whose work control.pause had stopped, while task.create refuses it. The same check now runs on both, with the same error code, and the test asserts the two refusals match.

Verified: 309 TypeScript, 411 Python, 706 chap-analytics, 25 of 25 differential seeds, tsc clean. The TypeScript tests fail without their fixes and the Python ones fail without theirs.

[brightbeamarsalan]

All three merged in #169, so closing this.

The rehydrate gap: overrides and route_decisions are rebuilt, and the exclusion set names all eight typed collections rather than the ones that happened to be handled, so a collection added later cannot be forgotten silently.

audit.submit_to_scitt joins the read-only set in both references. #173 followed it, because readOnlyHint on the MCP surface is defined as exactly that set and had to move with it.

control.supersede applies the participant-paused check that task.create applies, with the same error code.

Main is green. Good scan: three real defects from one read of the persistence path.