Reconcile capture text before disposition stamps

[Chris0Jeky]

Summary

• Reconcile the exact CAS-written queue text into immutable durable source lineage before Keep, Archive, Reactivate, or Cancel can advance the aggregate stamp.
• Make disposition and cancellation retries use the same optimistic queue guard, including already-cancelled rows, so stale requests cannot mutate durable state and truthful queue fallback is recoverable.
• Leave divergent archived captures honestly outstanding, and move SQLite exclusions ahead of an exact LIMIT batchSize through one json_each parameter.
• Restore the strong Context Fabric configuration claims now that the masking defect is closed.

Verification

• Application capture/disposition/backfill filter: 121 passed
• API capture/backfill/repository filter: 96 passed
• Focused SQLite store/backfill filter: 15 passed
• Red-first regressions covered stale Keep/Archive results, archived false reconciliation, SQL exclusion/bound behavior, stale CAS loss, and already-cancelled recovery
• node scripts/check-docs-governance.mjs
• git diff --check origin/main...HEAD
• Two bounded fresh-context review rounds; the round-1 HIGH on already-cancelled recovery is fixed and round 2 found no CRITICAL/HIGH defect
• dotnet test backend/Taskdeck.sln -c Release -m:1 --no-restore: 8,725 passed and five declared skips; one command-shape instrumentation test failed because hosted-worker SQL entered its uncorrelated capture window. The exact test then passed twice on clean main and once on this branch. Existing issue [Backend][Testing] Isolate intermittent batch command-shape samples on Windows #2399 now carries the evidence.
• Frontend/typecheck/build/Playwright: not applicable; no frontend or browser surface changed

Documentation

• Restored the three CF-01c: reconcile capture text before stamping dispositions — an out-of-band divergence followed by keep/archive is currently masked forever #2347-narrowed claims in CaptureService, ContextFabricSettings, and docs/platform/CONFIGURATION_REFERENCE.md
• docs/STATUS.md is intentionally left to the canonical docs lane; a post-merge Claude sync packet will remove CF-01c: reconcile capture text before stamping dispositions — an out-of-band divergence followed by keep/archive is currently masked forever #2347 from the open CF-01 residual

Tracking

• Closes CF-01c: reconcile capture text before stamping dispositions — an out-of-band divergence followed by keep/archive is currently masked forever #2347
• Project status will move from Now to Review while this PR is open

Risk notes

• Archived source lineage remains immutable. If an archived aggregate disagrees with the queue text, the durable mutation fails closed and the queue row remains the truthful fallback/backlog item.
• CAS-loss tests are deterministic mocks rather than real two-context races. Real SQLite coverage pins exclusion parameterization and the exact materialization bound.
• No migration, API shape, authentication, frontend, or worker protocol changes.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-03T04:46:58.662907Z	64a0aac	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Chris0Jeky]

Bounded fresh-context review complete.

Round 1 found one HIGH: already-cancelled retries bypassed the new CAS and could leave a pre-fix masked archived mismatch serving stale durable text. Commit 7062a89a removes that early return and adds a red-first recovery regression.

Round 2 reviewed exact head 7062a89a76159c5d8dcb827529905decbc19ae4f against 468d76dc8e7a7859324c40e6369c3caae57fe647. The prior HIGH is closed and no new CRITICAL/HIGH defect remains. CAS loss rolls back before durable access; a successful idempotent CAS reloads the exact payload and advances queue freshness; archived repair rejection leaves the aggregate unmodified and restores truthful queue fallback.

Verified at this head: Application capture filter 121/121, API capture/queue filter 96/96, focused command-shape test 1/1, docs governance, and diff check. The full solution had one separately tracked #2399 instrumentation failure after 8,725 passes and five declared skips; the exact test passed twice on clean main and once here.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7062a89a76

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

Current-base interaction check for pushed head 64a0aace70e629095e5640c3a0fb7056c3be4e2c against 4f0f0525f7e789f3a68a77ebb4fdcad55dac5f96 is clean.

The landed base delta is limited to the Smart CI schema/planner/test files from #2415. The PR diff remains the same ten #2347 files, with no reference or execution-path overlap. Re-proved after the merge: Application 121/121, API 96/96, Smart CI planner 41/41, docs governance, and diff check. The prior HIGH remains closed; no new CRITICAL/HIGH interaction was found.