feat(item-delivery): reload persisted ledgers after restart

[cursor]

Superseded

Close this predecessor without merge. The restart/reload product slice moved through #186/#216 and is now carried by #224; the unrelated inbox recovery fixture has its own bounded vehicle on #177.

Fresh evidence immediately before closure:

• feat(item-delivery): reload persisted ledgers after restart #110 exact head: cbba9a2ba5d88dbda0b3e8841bae8028985fdb72
• fix(item-delivery): reject padded persist tenant aliases #224 exact head: 9b47a0f779b53f98fffd9fffff65120a1c3761e6
• protected main: a7637351be8f0f90c12651d3bcafd959bc52ac81
• review on feat(item-delivery): reload persisted ledgers after restart #110 explicitly selected successor feat(item-delivery): reload persisted ledgers after restart #186, then fix(item-delivery): reject padded reconstruction identities #216, rather than this head as the landing vehicle; those product changes were subsequently carried forward into fix(item-delivery): reject padded persist tenant aliases #224.
• fix(item-delivery): reject padded persist tenant aliases #224 retains restart reconstruction and exact reload behavior and adds persist-side exact-identity rejection. Its own latest review still requires a later live-domain exactness correction before it can become a landing head, so closing feat(item-delivery): reload persisted ledgers after restart #110 does not promote fix(item-delivery): reject padded persist tenant aliases #224 to protected-main truth.
• feat(item-delivery): reload persisted ledgers after restart #110's late claim_deadline_at recovery-fixture change is intentionally separated on test(recovery): preserve inbox claim deadline evidence #177 and must not keep an obsolete item-delivery predecessor open.

Do not merge this predecessor in parallel with the successor line.

[cursor]

Stale comment

Item-delivery reload is the right buyer slice: persist already exists on main, and a restart must reconstruct the stored prefix so a later deliver cannot invent a new form. Domain from_durable_evidence / from_durable_events, load_item_delivery_ledger under READ COMMITTED, tenant mismatch as ConflictingReplay, and recovery COPY of item_delivery_ledger / item_delivery_event match the persist contract.

Do not merge this draft. Exact-head Runtime CI, 100% owned line/branch coverage, and an independent last-push review are still required. This review is not that approval.

Must-fix before merge: is_canonical_sha256 is new production code and the contract tests only feed sha256:not-a-digest (prefix present, length != 64). The strip_prefix miss path and the 64-byte non-hex .all() path are unexercised. This repository fails closed on incomplete branch coverage, so Production branch coverage will reject 75bacee until those cases exist.

Keep out of this PR: session item-set authority (#99 / #94), HTTP delivery, and instrument_version_ref on the ledger header.

Operator next action: add the two digest-reconstruction cases, re-run cargo test --test item_delivery_contract and the coverage jobs on the unchanged head, then request an independent last-push review. After merge, call load_item_delivery_ledger before deliver so a restarted worker continues the stored form.

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Review (COMMENT)

This slice is real: persist exists on main, and a restart must reconstruct already-shown items. Prefer #186 60ca077 as the landing vehicle instead of merging this head in parallel.

#186 keeps the same buyer outcome and adds:

• FOR SHARE on the ledger header, with honest rustdoc that persist still does not take FOR UPDATE
• exact-spelling session/tenant aliases (whitespace padding fails closed)
• tenant-scoped event load, not session-only
• dedicated restart-reload fixtures plus the recovery COPY/restore identity proof that started here
• ADR-0015 / ERD / UML / as-built schema updates

Do not merge #110 and #186 together. Independent last-push review still gates #186. Do not self-approve.

View PR

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Superseded for item-delivery restart reload by #216 4634523.

#216 keeps restart reconstruction and adds exact stored spelling so a padded alias cannot become another session or item. Prefer #216 over this head. Do not merge in parallel. Do not self-approve.

  

_{Sent by Cursor Automation: Fix Issues}

[seonghobae]

Exact-head cbba9a2b recovery fixture is locally green: clean_restore_preserves_provenance_deduplication_and_fencing_state now inserts claim_deadline_at and satisfies integration_consumption_claim_deadline_shape. Item-delivery persist/reload contracts also passed locally (17 persist + 13 contract + error contract).

The previous Runtime CI fail was on 75bacee7 (null claim_deadline_at). The fixture-head Runtime CI on cbba9a2b was cancelled in the queue, not re-run here. Do not merge until exact-head rust/coverage and independent last-push approval succeed. Never self-approve.