test(recovery): preserve inbox claim deadline evidence

[cursor]

Why

Protected-main recovery acceptance (#72) still inserts a processing inbox-consumption row without claim_deadline_at. After #81 that column is required, and maintain_inbox_claim_deadline is BEFORE UPDATE only, so the fixture fails the integration_consumption_claim_deadline_shape check. A buyer restore can also drop the wall-clock deadline and give a recovered worker a fresh lease.

This repair is intentionally not on the Created-session persist stack (#106 / #164). Those PRs should not be the landing vehicle for #72 evidence.

What this PR does

• Seed claim_deadline_at on the processing recovery fixture.
• Prove COPY ... FORMAT BINARY restore keeps the exact source deadline.
• Record the schema-level restore boundary in CHANGELOG, QA-REC-01, TRACEABILITY, TEST_STRATEGY, deployment restore acceptance, risk register, and doctoring with PostgreSQL 18 COPY / backup-restore APA 7 references.
• Keep QA-REC-01 honest: this is not a measured Hosted/Enterprise RPO/RTO drill.

Out of scope

• Created-session persist/load/start (feat(session): start created sessions from stored published releases #164, not fix(session): complete created-session persist evidence #106)
• Adding assessment_session to the recovery table list before persist lands
• Full TRACEABILITY rebaseline (docs(traceability): rebaseline shipped persist without a session table #127)
• Closing the backup/restore risk; the production drill remains pending

Test plan

• cargo test --test documentation_architecture_contract --test traceability_active_pr_contract
• cargo test --test postgres_recovery_invariants (needs TEST_DATABASE_URL)

Do not merge until exact-head checks and independent last-push approval are satisfied. Prefer this head over burying the same repair inside #106.

  

[cursor]

Review (PR #177 @ 8a0db46 vs a763735)

This is the recovery landing vehicle. Prefer it over burying the same claim_deadline_at seed inside #109, #106, or #164.

Sound

• After #81/0019, a processing row must carry claim_deadline_at. The trigger is BEFORE UPDATE only, so the fixture seeds the wall-clock instead of inventing an insert trigger.
• Restore asserts exact source/restored timestamp equality. That is the buyer contract: a claimed inbox item must come back with the same deadline, not a refreshed lease.
• QA-REC-01, TRACEABILITY, RISK, TEST_STRATEGY, and deployment restore acceptance stay honest: schema-level COPY ... FORMAT BINARY evidence, not a measured Hosted/Enterprise RPO/RTO drill.
• Doctoring cites the current PostgreSQL 18 backup and COPY pages (APA 7). Those URLs are live official docs and define FORMAT BINARY.

Do next

1. Move the two PostgreSQL references before Temoshok so the doctoring list stays APA 7 author order.
2. Keep this draft off the Created-session persist stack. Do not land #109 as the recovery fix.
3. Independent last-push approval and exact-head checks are still required. This automation does not approve or merge.

Session persist/load/start remains #180. Do not add assessment_session to the recovery table list until that persist lands on protected main.

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Honest QA-REC-01 split. Schema-level COPY evidence is current; measured Hosted/Enterprise RPO/RTO remains missing. Do not promote this test to a GA recovery claim.

[cursor]

APA 7 author sort ignores leading "The", so these PostgreSQL 18 entries belong before Temoshok and both W3C entries. The URLs are the current official PostgreSQL 18 backup and COPY pages, including FORMAT BINARY. Move the pair; do not drop them.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[seonghobae]

Closing as already integrated on protected main. Current protected main is aac99d0b523b8f765846fc6edad834e5cf903ca8; its tests/postgres_recovery_invariants.rs now seeds claim_deadline_at, asserts it is non-null after binary COPY restore, and compares the restored deadline exactly to the source row. #247 also explicitly skipped replaying this recovery fixture because that exact invariant is already on protected main. The remaining documentation-only deltas on this old head do not justify a second landing vehicle for an implemented recovery invariant.