Embedded mol-witness-patrol / mol-refinery-patrol formulas ship an unsafe 'bd mol wisp gc --age 1h --force' that deletes live polecat wisps

Summary

The formulas embedded in the gt binary at internal/formula/formulas/mol-witness-patrol.formula.toml and internal/formula/formulas/mol-refinery-patrol.formula.toml both mandate, as the first step of every patrol cycle:

bd mol wisp gc --closed --force
bd mol wisp gc --age 1h --force

bd mol wisp gc --age <d> --force has no owner/creator/assignee filter — its only selection criterion is "not updated within --age, and not closed." That means it deletes every open wisp regardless of owner, including a live polecat work molecule and its step wisps. --exclude-type doesn't help either: a polecat work molecule is type molecule, but its steps are type task, so excluding molecule still deletes the steps mid-flight.

This directly conflicts with the swim-lane rule stated immediately below it in the same formula step ("Do NOT close wisps you didn't create... Wisp lifecycle management... is the reaper Dog's responsibility, NOT yours").

Real-world impact

We hit this in production: a witness/refinery patrol cycle ran this command with live polecat work present, which deleted 33 issues in one incident with no owner filter applied. In a separate incident, it silently deleted the durable agent-identity bead backing our refinery's gt agents resolve, which then broke gt patrol new/gt patrol report for that role until manually diagnosed and fixed (missing gt:agent label after the wisp that used to satisfy resolution was reaped).

The fix (already deployed locally, works)

We patched both formulas locally by changing the second command from --force to --dry-run and adding an explicit warning. This has been running safely in production since. Exact text from our locally-patched mol-refinery-patrol.formula.toml:

First, clean up wisps from previous cycles (closed wisps + abandoned wisps):
​```bash
bd mol wisp gc --closed --force
bd mol wisp gc --age 1h --dry-run
​```

WARNING: the second command is DRY-RUN ONLY and must stay that way.
`bd mol wisp gc --age <d> --force` has NO owner, creator or assignee filter. Its only
selection criterion is: not updated within --age, and not closed. So it deletes EVERY
open wisp of any owner, including a LIVE polecat work molecule and its step wisps.
`--exclude-type` does NOT save you: a polecat work molecule is type `molecule` but its
steps are type `task`, so excluding `molecule` still deletes the steps mid-flight.
The reaper Dog owns abandoned-wisp lifecycle, and its own --max-age default is 24h,
so anything this dry-run surfaces is reaper Dog work, not yours.
If the dry-run lists anything, REPORT it to deacon and delete nothing yourself.
Re-adding --force here is an Overseer decision, not a patrol tidy-up.

(mol-witness-patrol.formula.toml carries the equivalent fix.)

Suggested fix

Apply the same --force → --dry-run change (plus the warning block) to the embedded copies of both formulas in internal/formula/formulas/, so it ships as the safe default rather than requiring every installation to independently discover and hand-patch this. As-is, gt doctor --fix won't touch a town's locally-patched copy (correctly, since it's locally modified) — but a fresh install or a town that hasn't hit this yet gets the unsafe default.

Repro

1. Fresh gt install, inspect internal/formula/formulas/mol-witness-patrol.formula.toml or mol-refinery-patrol.formula.toml.
2. Note the mandatory step-1 command includes bd mol wisp gc --age 1h --force with no scoping.
3. Have any live polecat work in progress when a witness/refinery patrol cycle runs this step — its wisps get deleted.