feat(identity): persist dual-proof write after inspect

[cursor]

Why

PR #178 inspects projection drift and reconciles the unique enforcer after restore. A hosted adapter still had no command that refuses a new dual-proof write while that inspect reports drift, then authorizes both current proofs, persists the history, and recovers the same product-owned participant from a later valid Keyverse account.

TDD

RED restore_drift_refuses_dual_proof_write_until_operator_reconciles plants a stale current row for ended keyverse_subject_write, proves persist_authorized_account_link returns CurrentProjectionDrift without mutating the in-memory participant, then after reconcile the later participant_identity_write_epsilon binds and recovers. GREEN inspects first, authorizes both proofs, persists, and recovers.

Scope

• Successor of test(identity): free ended subject after inspect and reconcile #178. Prefer this head over test(identity): free ended subject after inspect and reconcile #178, test(identity): rebind ended subject after restore reconcile #173, feat(identity): inspect projection drift after restore #169, feat(identity): persist dual-proof write and recover commands #160, feat(identity): rebuild current projections after restore #158, fix(identity): restore current projection on exact replay #147, fix(identity): recover participant from unterminated history #133, fix(identity): persist unlink+relink in lifecycle order #124, and feat(identity): persist append-only account-link history #114.
• Hosted write/recover commands: inspect drift, refuse the ended-subject rebind, reconcile, persist, recover.
• Keep HTTP and live Keyverse verification out of this slice.

Out of scope

• HTTP account-link transport / OpenAPI
• fix(identity): reconcile stale current before relink or rebind #166 write-path current-row auto-reconcile
• Live Keyverse token verification

Operator next action

After restore, run inspect_identity_link_current_projection_drift. If it reports drift, run reconcile_identity_link_current_projections before calling persist_authorized_account_link. Prefer this head over #178 and #160. Do not merge those. Do not merge this PR until exact-head checks and independent last-push approval are satisfied. Never self-approve.

  

[cursor]

Review of #192 (b8f43a8)

Prefer this inspect-then-write head over #183, #178, #166, and #160. Do not merge those predecessors.

What holds

• persist_authorized_account_link inspects current-projection drift before dual-proof authorization, so a stale unique enforcer cannot accept a new first-link and the in-memory participant stays unlinked on refuse.
• Recover still resolves from unterminated history while inspect reports drift. That is the intended returning-login path, not a missing inspect gate.
• Realistic PostgreSQL coverage includes restart recover, expired/unused proofs, subject-already-bound, and restore_drift_refuses_dual_proof_write_until_operator_reconciles.
• HTTP and live Keyverse verification stay out of this slice.

Merge gates that are still open

• Draft.
• Required checks were still queued at review time; queued is not acceptance.
• Independent last-push approval is still required. Do not self-approve.

Buyer gap this head does not close

A returning account can recover after restart, but cannot disconnect. The authorized unlink successor on cursor/bc-08d3bd7b-4151-4d01-992f-2afd21638d37-6992 adds that command. Prefer that successor once it is opened; keep #192 unmerged as a predecessor.

  

_{Sent by Cursor Automation: Fix Issues}

[seonghobae]

Closing as superseded by PR #202. #202 explicitly carries this inspect → dual-proof persist/recover path and adds the missing buyer lifecycle operation: an authorized unlink that appends the link end, clears returning-account recovery, and permits later relink without rewriting historical participant identity. Its current scope says to prefer #202 over #192 and not merge #192 separately. Continue exact-head review on #202 or its later successor.