test(identity): free ended subject after inspect and reconcile

[cursor]

Why

PR #169 inspects missing or stale unique-enforcer rows after restore. PR #173 asked to fold the buyer rebind path onto that inspect line instead of landing a third persist vehicle: after unlink plus dump restore, a stale current row for the ended Keyverse subject must keep that account occupied until inspect reports drift and restore reconcile rebuilds the unique enforcer. Only then can a later participant bind the freed subject.

TDD

RED restore_inspect_then_reconcile_frees_ended_subject_for_a_new_participant plants a stale current row for ended keyverse_subject_alpha, proves inspect reports drift and persist returns SubjectAlreadyBound, then after reconcile inspect is clean and the new participant_ref recovers. GREEN is the existing #169 inspect + reconcile contract; this PR only locks the buyer path and ADR-0020 Implementation status to the TRACEABILITY landing PR.

Scope

• Successor of feat(identity): inspect projection drift after restore #169. Prefer this head over test(identity): rebind ended subject after restore reconcile #173, feat(identity): inspect projection drift after restore #169, feat(identity): rebuild current projections after restore #158, fix(identity): restore current projection on exact replay #147, fix(identity): recover participant from unterminated history #133, fix(identity): persist unlink+relink in lifecycle order #124, and feat(identity): persist append-only account-link history #114.
• Buyer-path test lock: inspect drift, refuse the ended-subject rebind, reconcile, inspect clean, persist and recover the later participant.
• ADR-0020 Implementation status must name the TRACEABILITY identity-link landing.

Out of scope

• HTTP account-link transport / OpenAPI
• fix(identity): reconcile stale current before relink or rebind #166 write-path current-row change
• feat(identity): persist dual-proof write and recover commands #160 dual-proof persist/recover commands
• Live Keyverse token verification

Operator next action

After restore, run inspect_identity_link_current_projection_drift. If it reports drift, run reconcile_identity_link_current_projections before accepting new account-link writes, including a later participant binding an ended subject. Prefer this head over #173 and #169. Do not merge #173, #169, #158, #147, #133, #124, or #114. Do not merge this PR until exact-head checks and independent last-push approval are satisfied. Never self-approve.

  

[cursor]

Review (COMMENT)

Verdict: unique slice SOUND. This is the identity-link landing vehicle.

9e31ca1 / b0bdaff lock the buyer restore path on the #169 inspect line: a stale current_participant_identity_link row for ended keyverse_subject_alpha keeps the unique enforcer occupied, inspect_identity_link_current_projection_drift reports drift and refuses new writes, persist of participant_identity_epsilon returns SubjectAlreadyBound, and only after reconcile_identity_link_current_projections does inspect go clean and the later participant bind and recover. ADR-0020 Implementation status names TRACEABILITY landing #178.

Prefer this head over #173, #169, #158, #147, #133, #124, and #114. Do not merge those. Do not fold HTTP or #166 write-path reconcile into this PR.

Do not merge until exact-head checks and independent last-push approval are satisfied. Never self-approve.

Operator next action: after restore, run inspect_identity_link_current_projection_drift. If it reports drift, run reconcile_identity_link_current_projections before accepting new account-link writes, including a later participant binding an ended subject.

Next slice (not this PR): hosted account-link HTTP on this line after #166 stays a separate write-path vehicle.

  

_{Sent by Cursor Automation: Fix Issues}