fix(consent): fail closed on reordered stored history

[cursor]

Prefer this head over #140 for consent-ledger reload.

#140 reconstructed stored events by occurred_at then created_at then event_ref. That silently reorders a grant@20000 / revoke@19000 fixture into revoke-then-grant, so ConsentLedger::record accepts both and the latest decision becomes a grant. The same identity tail can also invent grant-latest when two rows share created_at.

This successor keeps the reload slice (no outbox, no HTTP, no new tables) and:

• reconstructs by physical created_at insertion order
• fails closed on a created_at collision instead of ordering by event identity
• lets non-monotonic insertion-order occurred_at become CorruptHistory
• rejects whitespace-padded participant aliases instead of trimming them into another identity
• documents that FOR SHARE does not serialize with persist-side header inserts

Local evidence: cargo test --lib -- postgres_consent, postgres_consent_reload, postgres_consent_persistence, and postgres_consent_error_contract are green against PostgreSQL 16.

Do not fold #142 outbox composition or consent HTTP into this PR. Do not self-approve. Independent last-push review and exact-head required checks still gate merge.

  

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[cursor]

Stale comment

Review (COMMENT, not approval)

This head closes the #140 fail-open. Reconstruct by physical created_at, not occurred_at plus event_ref. A later-inserted same-millisecond research revoke stays latest. A created_at collision or non-monotonic insertion-order occurred_at returns CorruptHistory instead of inventing a grant. Whitespace-padded participant aliases fail closed. Outbox and HTTP consent stay out of this slice.

Do not merge #140. Do not self-approve this head. Independent last-push review and exact-head required checks still gate merge.

Residual risk (not a reconstruct defect)

created_at defaults to clock_timestamp(). Two inserts in one persist transaction can theoretically share a microsecond and become unloadable after restart. That is fail-closed, not a silent grant. A monotonic insertion key belongs in a later persist-lock/outbox slice, not a third reload PR.

There is still no PostgreSQL test that participant B’s events are absent when loading participant A. The WHERE participant_ref = $1 predicate is correct; add that isolation fixture when extending persist/outbox, not here.

Next buyer-visible gap after this lands

Keep consent outbox on #142, then make persist_consent_ledger_with_outbox the sole write path. Consent HTTP stays later. This run continues with item-delivery restart reload on protected main: persist exists, but a restarted runtime cannot reconstruct already-shown items, so a mid-assessment restart can re-present or skip items.

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Stale comment

This is the correct consent-reload landing over #140. Reconstruct by physical created_at insertion order, fail closed on a created_at collision instead of sorting by event_ref, and reject whitespace-padded participant aliases at the persist boundary. No HTTP or outbox leaked into this slice.

Keep outbox composition on #142. Consent write-path landing is #170. Do not open another reload PR.

One later evidence gap, not a land blocker: persist participant A and B with different research decisions, load A, and prove B's events and research scope never appear. The WHERE participant_ref = $1 predicate already looks correct.

Do not self-approve. Independent last-push review and exact-head required checks still gate merge.

View PR

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Review (7fa917c)

SOUND. Prefer this head over closed #140 for consent-ledger reload. Do not open another consent-reload successor.

Verified

• load_consent_ledger reconstructs by physical created_at, not occurred_at / event_ref. Same-millisecond grant-then-revoke stays revoke-latest (same_millisecond_research_revoke_remains_the_latest_decision_after_reload).
• Shared created_at fails closed as CorruptHistory instead of ordering by event identity.
• Non-monotonic insertion-order occurred_at fails closed as CorruptHistory rather than being reordered into a newer grant.
• Missing ledger is None, not an empty grant.
• Caller aliases must already be canonical: required_reference rejects whitespace-padded participant refs instead of trimming them into another identity.
• Rustdoc states the FOR SHARE header lock does not serialize with persist-side header inserts. That honesty is correct for this slice.

Residual (later, not this PR)

Persist still inserts the ledger header without FOR UPDATE. A concurrent persist append can race the share lock. Do not fold #142 outbox composition or consent HTTP here.

Keep this ready head until exact-head required checks and an independent last-push review land. Never self-approve.

  

_{Sent by Cursor Automation: Fix Issues}

[seonghobae]

Pushed the #81 recovery fixture: processing restore rows now seed claim_deadline_at, and COPY must keep the exact source deadline. This unblocks integration_consumption_claim_deadline_shape. Do not merge until exact-head checks and independent last-push approval succeed. Never self-approve.