feat: implement Phase 19 dynamic re-dispatch

[404khai]

Behavior

Logical-time order, traffic, readiness, availability, cancellation and observed road-delay events now invoke committed-work recovery before the next effective-plan action. Unstarted pickup/dropoff pairs can move to available riders; active travel/wait/service and picked-up custody stay pinned. Whole-plan feasibility and original acceptance protections remain mandatory.

Healthy recovery requires positive road saving after explicit versioned reroute/stability penalties, minimum improvement and cooldown. Hard/unavailable-owner repair can bypass optional churn thresholds, but cannot weaken protections. Complete bounded neighborhoods produce an atomic owner/plan replacement; missing inputs, stale context or budget exhaustion publish nothing. Recovery evidence is read-only so callers cannot rebind evaluated proposals.

Schema 4 adds explicit dynamic inputs, delayed-arrival generation invalidation, pre-pickup cancellation/refusals, terminal population metrics and fleet-window responsibility exposure. Phase 17/18 admission APIs retain their existing contracts. Root/crate READMEs and architecture/API docs include runnable commands.

Validation and evidence

• cargo fmt --all -- --check
• cargo +1.99.0 clippy --workspace --all-targets --locked -- -D warnings
• cargo +1.99.0 test --workspace --locked: 195 passing tests, including an immutable-evidence compile-fail API test.
• Independent tiny recovery oracle: 32/32 owner-placement comparisons; 16 generated multi-order invariant/reordering cases.
• 13 CLI scenarios, each with 11 measured byte-identical replays, plus all-fixture readable/JSON integration tests.
• Release build and measured collector completed; raw hardware/hash/build/configuration/percentile/work evidence committed. Memory explicitly unmeasured; timing includes process launch/graph loading/simulation/JSON capture.

Completion report and every gate · Recovery contracts · Scenario expectations · Measured record.

Scope limits

This is a bounded local recovery heuristic, not a global VRP optimum or impossibility proof. Repairs requiring multiple moves through infeasible intermediate states may return scoped NoRecovery. Unknown required existing inputs block recovery. Offline means unavailable for new work, not physical immobilization; unchanged obligations continue if recovery fails. Custody handoffs, returns/disposal, active/onboard cancellation, mid-leg diversion and Phase 20 are deferred.

Generated semantic replay artifacts are isolated in the final evidence commit; implementation/API protection and evidence are separate commits.