Fix reporting proposal failures and support staff-directed product corrections

Investigate worker contract-v6 failures reported as proposal_schema for duplicateNumber and topics without weakening validation or exposing report text. Establish schema/prompt mismatch or obtain safe diagnostics before claiming a cause; add regression coverage and run worker validation. Current authorized follow-up: fix plain-language human retriage routing in both directions, including General-to-Spiritech for intake #967 without affected-client naming in the original report. Use private intake repository access as the authorization boundary; remove the extra staff-ID allowlist and product-instruction-ID mechanism. Human command comments remain distinct from bot output and untrusted player report/discussion content. Apply coordinated coordinator/worker changes in isolated worktrees, preserve existing routing lifecycle/privacy/ownership protections, and add regression coverage. A move must close the owned developer issue in the old repository as well as hide/withdraw it, preserve intake and evidence, and create a fresh destination-scoped handoff. Verify repeat processing and failure handling for old-issue closure. User subsequently authorized commits, pushes and pull requests through /open-pr. Deployment and live issue mutation remain unauthorized. Preserve ownership, privacy, repeat-processing and destination-scoped analysis protections. No implicit production deployment or issue mutations. Implementation is committed and pushed. User reports both coordinator and worker deployed; deployed revisions and live behavior have not yet been independently verified. Engines commit cfabd4698; worker commit 21db1e1. Engines branch fix/staff-directed-product-routing; sibling player-reporting-worker branch fix/staff-routing-and-proposal-validation from origin/main 3a14f11. V7 proposals cite productInstructionId from an offered authenticated nonempty retriage comment; coordinator binds it to the claim, executor rechecks current staff allowlist/source integrity and reuses canonical retirement/fresh destination analysis. V1-v6 remain compatible; controller negotiates v7 or falls back to v6. Worker supplies machine-readable schema, explicit target/topic guidance, one schema-only correction turn with tools disabled inside original budgets, and allowlisted schemaIssue/valueType/reportId diagnostics. No coercion or relaxed validation. Validation: worker TypeScript build plus 53 JS and 20 Python tests pass. Full PlayerPortal-filtered suite passes 262 tests with 54 SQL/configuration-dependent skips using .NET 8 container (host has only .NET 10 runtime); workflow build succeeds with zero warnings/errors. Initial container asset-path failures resolved by mounting the real absolute checkout path; v7 API/readiness tests updated with unsupported-v8 negative case. Engines static patch review found no actionable findings, explicitly excluded sibling worker behavior. No real model/provider analysis, SQL integration, browser acceptance, deployment or issue mutation performed. User authorized committing, pushing and opening PRs through /open-pr. Both complete branch diffs contain only the session changes, start directly from current origin/develop and origin/main respectively, and are clean/synchronized after push. Pull requests (ready, open, cross-linked): engines #2922 https://git.project-rk.com/prk/engines/pulls/2922 (fix/staff-directed-product-routing -> develop); player-reporting-worker #13 https://git.project-rk.com/prk/player-reporting-worker/pulls/13 (fix/staff-routing-and-proposal-validation -> main). Coordinator release must precede enabling v7 reverse routing; worker can fall back to v6 for schema correction. Opening PRs does not resolve the pending live-failure verification. Blocker: supplied live logs contain only failed field names, not rejected shapes. Exact production duplicateNumber/topics violations and real-model recovery are still unverified. Local synthetic regressions cover missing/string targets, invalid/string/duplicate topics, one-attempt cap, semantic authorization rejection and diagnostic privacy. Both releases are user-reported deployed. Still requires targeted live analysis with the new safe diagnostics before claiming these particular live failures resolved. Intake #967 diagnosis: human comment 57454 requested General-to-Spiritech routing; bot decision 57463 recognized it but product correction was unavailable, retaining General canonical #627. The original feature covered only staff-directed Spiritech-to-General moves; the opposite path depended on original report client naming. PR #2922 confirmed this asymmetry. This was an implementation gap, not user misuse or a demonstrated deployment failure. Authorized follow-up is implemented, locally verified, committed and pushed on fix/private-repository-product-routing in /home/mathias/Projects/worktrees/engines-private-repo-routing (3268b3a92) and /home/mathias/Projects/worktrees/player-reporting-private-repo-routing (a937732). Both branches start directly from their current remote defaults, develop and main respectively, contain only session changes, and are clean/synchronized after push. Private repository access now authorizes all positive-ID non-bot human command comments; StaffUserIds and its startup requirement are removed. V8 human retriage allows either destination without proposal instruction-ID requirements or original affected-client naming. V7 fields/validation remain only for older workers and stored decisions; the new worker omits that field and negotiates v8 or falls back to v6 on older coordinators. Existing verified legacy stock-client boundaries remain enforced. Source hashes/leases, sticky privacy, evidence validation and ownership checks remain intact. Product moves now hide and close the owned old canonical before changing routing, withdraw its cache and queue fresh destination-scoped analysis. Closure failures retry without advancing routing; lost replies reconcile against already-closed state. Original intake stays open with unchanged body/evidence. Explicitly held canonicals are not closed; retry-owned retirement markers distinguish bot withdrawal from a preexisting hide. Moving a duplicate never closes another report's canonical. Tests cover both directions with/without PrivateOnly, destination handoff, resolution synchronization after old closure, non-allowlisted human authors, bot/marker-only/legacy negatives, changed instructions, closure failures/lost replies, holds, duplicate ownership, stock origin and v7 compatibility. Removing the v8 routing fix produced four expected regression failures; restoring it passes. Final validation: .NET 8 full PlayerPortal-filtered suite with disposable MSSQL passed 344 tests, 12 unrelated cash/trade database-dependent skips, zero failures. Workflow and portal warnings-as-errors builds passed with zero warnings/errors. Worker npm test passed 54 JS tests and 20 Python tests, including v8 proposal submission without instruction IDs and v7-coordinator fallback to v6. Both diffs pass whitespace checks. Temporary test containers/credentials/generated untracked build files removed; main checkouts unchanged. Companion ready pull requests opened and cross-linked: engines #2961, "fix: Honor human product corrections and close retired issues", https://git.project-rk.com/prk/engines/pulls/2961 (fix/private-repository-product-routing -> develop); player-reporting-worker #14, "fix: Follow human retriage routing in both product directions", https://git.project-rk.com/prk/player-reporting-worker/pulls/14 (fix/private-repository-product-routing -> main). Worker validation repeated successfully after committing: 54 JS and 20 Python tests. No deployment, real-provider inference, browser acceptance or live issue mutation was performed. Opening these PRs does not resolve the outstanding production-verification blocker. Deploy coordinator first, then worker; completed #967 needs fresh human retriage. Original live duplicateNumber/topics diagnosis/provider verification remains blocked as recorded above; the new routing implementation checklist is complete, not that older production verification. Completed reports are not automatically reprocessed by deployment; a fresh authorized retriage comment can exercise #850. Acceptance: verified schema failure handling, staff-directed reverse routing with unauthorized negative tests, relevant worker/coordinator tests passing; live failures remain unverified until safe evidence or deployment validation.