feat(identity): inspect projection drift after restore

[cursor]

Superseded

This read-only current-projection drift inspection slice is fully contained in #178. Do not merge this predecessor.

Fresh exact ancestry evidence immediately before closure:

• feat(identity): inspect projection drift after restore #169 head: a9136d5dcf67f48859ab56ead6f9e0095d9887ae
• test(identity): free ended subject after inspect and reconcile #178 head: 9e31ca1c347e32054e875cb22a7d0960746bff4a
• test(identity): free ended subject after inspect and reconcile #178 is ahead by 2 commits and behind by 0, with feat(identity): inspect projection drift after restore #169 as the merge base.

#178 retains inspect + reconcile behavior and adds the buyer-path proof that an ended subject remains blocked by stale current state until reconcile, then can be rebound and recovered. #178 remains Draft and subject to unchanged exact-head CI/security/review gates. The divergent #173 test branch is not claimed contained by ancestry here. Closing this PR does not promote successor behavior to protected-main truth.

[cursor]

Stale comment

Verdict

Unique restore-inspect slice is SOUND. Prefer this head (a9136d5) over #158, #147, #133, #124, and #114 for persist + store-wide reconcile + read-only drift inspect. Do not merge this draft until exact-head checks and a non-author last-push approval pass. Do not self-approve. Do not fold HTTP, #160 dual-proof commands, or #166's write-path current-row change into this PR.

What was reviewed

inspect_identity_link_current_projection_drift is read-only: it requires READ COMMITTED, fail-closes through reject_corrupt_unterminated_history (two unterminated holders of one issuer-scoped subject, or two unterminated links on one participant), then counts missing and stale current_participant_identity_link rows with exact five-column equality against unterminated history. The fixture in restore_inspect_reports_missing_and_stale_projections_before_reconcile is a real restore shape (dropped unique enforcer plus a stale ended-link current row) and the expected missing=2 / stale=1 counts match that SQL. After reconcile_identity_link_current_projections, inspect reports zero drift. Isolation and one-participant collision tests are present.

accepts_new_account_link_writes() is a predicate on the inspect result, not a persist write-gate. That is correct for this slice: #158 exact-replay persist remains the per-participant repair, and OPERABILITY already tells operators to inspect then reconcile before accepting new first-inserts. Do not add a global persist refuse here; it would block that exact-replay repair.

Residual (not blocking this slice)

• Inspect has a dedicated one-participant collision test; the two-subject collision path is covered only through the shared helper used by reconcile. A dedicated inspect test would be nicer but is not a defect.
• Inspect does not take FOR SHARE/FOR UPDATE. Acceptable for an operator tool after restore. Do not treat it as a concurrent write-gate.
• #166 remains the write-path stale-current successor (relink/rebind after a leftover ended-link current row). #173 is the rebind-after-reconcile proof. Hosted account-link HTTP must wait until that write path is check-clean; shipping HTTP on this head would still surface “account taken” after restore.

Operator next action

After restore, run inspect_identity_link_current_projection_drift. If it reports drift, run reconcile_identity_link_current_projections before accepting new account-link writes. Keep this PR scoped to inspect. Independent reviewer: approve only an unchanged check-clean head.

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

This is the earlier #158 successor for ADR-0020 Implementation status and restore inspect. Prefer this head over #158 and later #173.

#173's unique lock is restore_reconcile_frees_ended_subject_for_a_new_participant: after unlink, a stale current row for ended keyverse_subject_alpha must return SubjectAlreadyBound until reconcile_identity_link_current_projections runs, then a new participant can bind that account and load_participant_by_current_identity_subject recovers the new participant_ref. Local GREEN 22/22 on PostgreSQL 16 on that branch.

Fold that buyer rebind test into this inspect head. Do not land #173 separately. #166 is a different persist model from #148; do not merge it as if it were this #158-family contract. Do not self-approve.

View PR

  

_{Sent by Cursor Automation: Fix Issues}