Epic-lead Slice A — Lead identity & roster scaffolding (#226)

You are being dispatched from flower Brief #231: Epic-lead Slice A — Lead identity & roster scaffolding (#226)

Recall pointer:
- Use recall_brief with id 231 for the full folder if you need provenance.

Target:
- project: flower (/Users/mikeferrara/Documents/code/flower)
- branch: flower/231-epic-lead-slice-a
- worktree: not specified
- kind: fresh

Current brief spec:
# Slice A — Lead identity & roster scaffolding

Parent epic: #226. Design: `docs/design/226-epic-lead-orchestration.md` (§Identity model). Foundation slice for the epic-lead task-scoped daemon. **No spawn yet.** Target ≤~300 lines. No dependencies — build first.

## Deliverable
1. **`DaemonRole::Lead = 'lead'`** — new enum case (`app/Enums/DaemonRole.php`). Check-in / `registerExpected` already accept the whole enum; only spawn/charter guards reject non-standing roles (relaxed in Slice B, not here).
2. **`daemon_agents.epic_brief_id`** — migration: nullable FK → `briefs`, `nullOnDelete`; index. Standing roles keep it null + their existing `(role,project_id,solo_process_id)` identity unchanged.
3. **Thread `epic_brief_id` through the WHOLE placeholder/identity path** (each keys on `(role,project_id)` only today and would bind the wrong lead to the wrong epic):
   - `DaemonRosterService::daemonIdentityQuery()` (:940) — add `AND epic_brief_id` for leads.
   - `daemonForCheckin()` (:866), `nullIdPlaceholderForUpdate()` (:878) — epic-scoped placeholder selection for leads.
   - `mergeNullIdPlaceholders()` (:887) — never merge placeholders with different `epic_brief_id`.
   - `registerExpected()` (:171) + `checkin()` (:41) — accept & persist `epic_brief_id`.
   - `flower:daemon-checkin` command + `DaemonCheckinTool` — expose `--epic-brief-id` / `epic_brief_id` arg.
4. **`DaemonActorRef::canonical()`** — optional epic segment → lead resolves to `<project>-lead-<epic_brief_id>` (e.g. `flower-lead-226`); standing roles keep `<project>-<role>`. `checkin()`/`registerExpected()` pass `epic_brief_id` in.
5. **Exclude `lead` from EnsureDaemons** — `expectedRolesFor()` reads config `default_roles`/`platform_roles` (`EnsureDaemons.php:109`); `lead` is never in those, so "Water the garden" never spawns/respawns a lead. (Verified: no other role-based reconcile path.)
6. **Roster ordering** — leads sort after the standing three (the CASE buckets unknown roles at order 3 already); optionally give `lead` an explicit slot for readable `/roster`.

## Tests (sqlite unit/feature)
- Two concurrent leads (epics 226 & 227) get distinct expected rows — no collision, `mergeNullIdPlaceholders` does not merge them.
- Canonical actor_ref = `flower-lead-226`; each binds its own pid on check-in.
- `EnsureDaemons::ensure()` never yields a `lead` role.
- Standing-role identity/behavior unchanged (regression).

## Notes
- Keep `php artisan test` green; `./vendor/bin/pint` on touched files.
- Do not change reset/winddown/compaction machinery — reused as-is.

Recent/key trace events:
[1] participant_joined flower-226-worker: (no body)
[2] note_added flower-226-worker: # Slice A — Lead identity & roster scaffolding

Design: `docs/design/226-epic-lead-orchestration.md` (§Identity model). Foundation slice for the epic-lead task-scoped daemon. **No spawn yet.** Target ≤~300 lines.

## Deliverable
1. **`DaemonRole::Lead = 'lead'`** — new enum case (`app/Enums/DaemonRole.php`). Check-in / `registerExpected` already accept the whole enum; only spawn/charter guards reject non-standing roles (relaxed in Slice B, not here).
2. **`daemon_agents.epic_brief_id`** — migration: nullable FK → `briefs`, `nullOnDelete`; index. Standing roles keep it null + their existing `(role,project_id,solo_process_id)` identity unchanged.
3. **Thread `epic_brief_id` through the WHOLE placeholder/identity path** (each keys on `(role,project_id)` only today and would bind the wrong lead to the wrong epic):
   - `DaemonRosterService::daemonIdentityQuery()` (:940) — add `AND epic_brief_id` for leads.
   - `daemonForCheckin()` (:866), `nullIdPlaceholderForUpdate()` (:878) — epic-scoped placeholder selection for leads.
   - `mergeNullIdPlaceholders()` (:887) — never merge placeholders with different `epic_brief_id`.
   - `registerExpected()` (:171) + `checkin()` (:41) — accept & persist `epic_brief_id`.
   - `flower:daemon-checkin` command + `DaemonCheckinTool` — expose `--epic-brief-id` / `epic_brief_id` arg.
4. **`DaemonActorRef::canonical()`** — optional epic segment → lead resolves to `<project>-lead-<epic_brief_id>` (e.g. `flower-lead-226`); standing roles keep `<project>-<role>`. `checkin()`/`registerExpected()` pass `epic_brief_id` in.
5. **Exclude `lead` from EnsureDaemons** — `expectedRolesFor()` reads config `default_roles`/`platform_roles` (`EnsureDaemons.php:109`); `lead` is never in those, so "Water the garden" never spawns/respawns a lead. (Verified: no other role-based reconcile path.)
6. **Roster ordering** — leads sort after the standing three (the CASE buckets unknown roles at order 3 already); optionally give `lead` an explicit slot for readable `/roster`.

## Tests (sqlite unit/feature)
- Two concurrent leads (epics 226 & 227) get distinct expected rows — no collision, `mergeNullIdPlaceholders` does not merge them.
- Canonical actor_ref = `flower-lead-226`; each binds its own pid on check-in.
- `EnsureDaemons::ensure()` never yields a `lead` role.
- Standing-role identity/behavior unchanged (regression).

## Notes
- Keep `php artisan test` green; `./vendor/bin/pint` on touched files.
- Do not change reset/winddown/compaction machinery — reused as-is.
[3] parent_set flower-226-worker: Grouped under epic #226.
[4] plan_proposed flower-226-worker: # Slice A — Lead identity & roster scaffolding

Parent epic: #226. Design: `docs/design/226-epic-lead-orchestration.md` (§Identity model). Foundation slice for the epic-lead task-scoped daemon. **No spawn yet.** Target ≤~300 lines. No dependencies — build first.

## Deliverable
1. **`DaemonRole::Lead = 'lead'`** — new enum case (`app/Enums/DaemonRole.php`). Check-in / `registerExpected` already accept the whole enum; only spawn/charter guards reject non-standing roles (relaxed in Slice B, not here).
2. **`daemon_agents.epic_brief_id`** — migration: nullable FK → `briefs`, `nullOnDelete`; index. Standing roles keep it null + their existing `(role,project_id,solo_process_id)` identity unchanged.
3. **Thread `epic_brief_id` through the WHOLE placeholder/identity path** (each keys on `(role,project_id)` only today and would bind the wrong lead to the wrong epic):
   - `DaemonRosterService::daemonIdentityQuery()` (:940) — add `AND epic_brief_id` for leads.
   - `daemonForCheckin()` (:866), `nullIdPlaceholderForUpdate()` (:878) — epic-scoped placeholder selection for leads.
   - `mergeNullIdPlaceholders()` (:887) — never merge placeholders with different `epic_brief_id`.
   - `registerExpected()` (:171) + `checkin()` (:41) — accept & persist `epic_brief_id`.
   - `flower:daemon-checkin` command + `DaemonCheckinTool` — expose `--epic-brief-id` / `epic_brief_id` arg.
4. **`DaemonActorRef::canonical()`** — optional epic segment → lead resolves to `<project>-lead-<epic_brief_id>` (e.g. `flower-lead-226`); standing roles keep `<project>-<role>`. `checkin()`/`registerExpected()` pass `epic_brief_id` in.
5. **Exclude `lead` from EnsureDaemons** — `expectedRolesFor()` reads config `default_roles`/`platform_roles` (`EnsureDaemons.php:109`); `lead` is never in those, so "Water the garden" never spawns/respawns a lead. (Verified: no other role-based reconcile path.)
6. **Roster ordering** — leads sort after the standing three (the CASE buckets unknown roles at order 3 already); optionally give `lead` an explicit slot for readable `/roster`.

## Tests (sqlite unit/feature)
- Two concurrent leads (epics 226 & 227) get distinct expected rows — no collision, `mergeNullIdPlaceholders` does not merge them.
- Canonical actor_ref = `flower-lead-226`; each binds its own pid on check-in.
- `EnsureDaemons::ensure()` never yields a `lead` role.
- Standing-role identity/behavior unchanged (regression).

## Notes
- Keep `php artisan test` green; `./vendor/bin/pint` on touched files.
- Do not change reset/winddown/compaction machinery — reused as-is.
[5] participant_joined flower-orchestrator: (no body)
[6] status_change flower-orchestrator: (no body)

Recommended linked context:
{
    "todos": [],
    "scratchpads": []
}

Execution notes:
- Treat the brief as the source of truth.
- Keep work scoped to this dispatch request.
- Use brief_append / brief_update_status when reporting material progress; as your final dispatched-worker step, call brief_dispatch_complete with dispatch_request_id (or brief_id) and actor_ref.
- Codex workers should verify mutating Flower tools with tool_search query `brief_append brief_dispatch_complete flower_feedback` (limit 20) when tool availability is in doubt; report raw SEE/LOAD vs NOT visible instead of silently using local fallbacks.
- Add a git commit trailer `Brief: #231` to every commit for this brief so flower can exact-link commits back to the brief.