feat(response): reload persisted snapshots after restart

[cursor]

Why

Protected main can persist one immutable completed response prefix per session, but it cannot reconstruct that prefix after process restart. Scoring dispatch after a crash would have no durable snapshot to pin, so a buyer who finished a two-item path would not get a score.

This is independent of Active PR #140 (consent-ledger reload), #137/#119 (result reload), and #149 (session HTTP). Do not fold those slices into this head.

What

• ResponseSnapshot::from_persisted rebuilds the same freeze that ScoringRequest::from_snapshot already accepts.
• load_response_snapshot and load_response_snapshot_for_session reconstruct the unique prefix from response_snapshot / response_snapshot_entry under READ COMMITTED after FOR SHARE on the header.
• Entry order is snapshot_sequence ASC, so a later event identity cannot hide the first answer.
• A missing snapshot is absent. Header/entry mismatches, gapped sequences, noncanonical stored digests, blank aliases, and stronger isolation fail closed.
• RED PostgreSQL tests cover the two-item scoring path, session lookup, corrupt history, isolation, and missing relations.
• TRACEABILITY / ERD / UML / AS_BUILT / ADR-0015 / doctoring record this reload slice and cite PostgreSQL transaction isolation (APA 7).

This does not change response bodies, invent scores, add HTTP transport, or mutate historical snapshots.

Verification

• cargo test --test response_snapshot_persisted --test response_ledger
• cargo test --lib postgres_response_snapshot
• cargo test --test postgres_response_snapshot_reload --test postgres_response_snapshot_error_contract
• cargo clippy --all-targets -- -D warnings
• full Runtime CI, exact statement/branch coverage, docs, security and independent review on the exact head

Next after this lands: keep session HTTP on #149 and result reload on #137. Do not start scoring HTTP on this branch.

Independent non-author approval and required checks on the unchanged exact head remain merge gates. Never self-approve.

  

[cursor]

Review — PR #151 d63f023 (response-snapshot reload)

This slice does what a buyer needs after a completed two-item path and a process restart: reconstruct the unique frozen prefix and keep it acceptable to ScoringRequest::from_snapshot.

What holds

• ResponseSnapshot::from_persisted rebuilds the same value freeze_as produced, including server order when a later event identity would sort first.
• load_response_snapshot / load_response_snapshot_for_session take FOR SHARE on the header, require READ COMMITTED, and order entries by snapshot_sequence ASC.
• Missing snapshot is absent. Header/entry count mismatch, gapped sequences, noncanonical stored digests, blank/numeric aliases, stronger isolation, and missing relations fail closed.
• Physical objects are unchanged (response_snapshot / response_snapshot_entry already on protected main). No HTTP scoring, no invented scores, no historical rewrite.

Residuals (not merge blockers for this slice)

• Domain reconstruction does not re-check unique event_ref; the table already has UNIQUE (snapshot_ref, event_ref).
• A persisted scoring request still cannot be reloaded after restart. That is a later worker-pin slice, not this snapshot freeze.
• Independent last-push review and exact-head required checks remain the merge gate. Do not self-approve.

Do not fold into this head

Keep consent reload on #140, result reload on #137/#119, session HTTP on #149, and response-event persist on #53. Do not start scoring HTTP here.

  

_{Sent by Cursor Automation: Fix Issues}