feat(identity): reject rebound recover after unlink+relink

[cursor]

Why

PR #202 lets a returning account unlink and later relink. Recover still returned whatever history reconstructed after subject lookup. Under READ COMMITTED, FOR SHARE on the unterminated link row does not block a later link-end insert, so a concurrent unlink+relink can hand back a participant now bound to another issuer-scoped subject, or an unlinked record, to the original proof.

TDD

RED accept_recovered_participant_for_authenticated_account was missing, so rebound-subject, unlinked, tenant-mismatch, and issuer-mismatch loads could not be rejected. GREEN keeps the record only when current tenant, issuer, and subject still match the still-valid Keyverse proof.

Scope

• Successor of feat(identity): persist authorized unlink after inspect #202. Prefer this head over feat(identity): persist authorized unlink after inspect #202, feat(identity): persist dual-proof write after inspect #192, feat(identity): persist dual-proof write and recover on reconcile #183, test(identity): free ended subject after inspect and reconcile #178, fix(identity): reject rebound recover after unlink+relink #176, test(identity): rebind ended subject after restore reconcile #173, feat(identity): inspect projection drift after restore #169, feat(identity): persist dual-proof write and recover commands #160, feat(identity): rebuild current projections after restore #158, fix(identity): restore current projection on exact replay #147, fix(identity): recover participant from unterminated history #133, fix(identity): persist unlink+relink in lifecycle order #124, and feat(identity): persist append-only account-link history #114.
• Compose the fix(identity): reject rebound recover after unlink+relink #176 recover current-binding check onto the inspect/unlink stack.
• Keep HTTP and live Keyverse verification out of this slice.

Out of scope

• HTTP account-link transport / OpenAPI
• Live Keyverse token verification
• Store-wide auto-reconcile on unlink

Operator next action

After recover loads a participant, keep it only when reconstructed tenant/issuer/subject still match the current Keyverse proof. Prefer this head over #202 and #176. Do not merge #202, #192, #183, or #176 as substitutes. Do not merge this PR until exact-head checks and independent last-push approval are satisfied. Never self-approve.

  

[cursor]

Verdict: persist contract is SOUND on 7860bc7

Independent review of this exact head found no remaining fail-closed grant hole on identity-link persist.

• Recover keeps a loaded participant only when reconstructed tenant, issuer, and subject still match the still-valid Keyverse proof. A READ COMMITTED unlink+relink that would otherwise hand back a rebound participant is dropped.
• Unlink reloads stored history before authorize_account_unlink. A stale in-memory first-link or an ended subject's proof cannot end a rebound current binding (NoCurrentBinding).
• participant_ref is a lookup key, not a standing capability, on this persist head.

Prefer this head over #206, #202, #192, #183, #178, and #176. Do not merge those as substitutes.

Do not merge this PR until exact-head checks and an independent last-push approval are satisfied. Never self-approve. Do not fold HTTP into this slice.

Hosted account-link HTTP is the next buyer-facing gap. That adapter must call recover_participant_for_authenticated_account, re-check current binding on every later command, and must not treat a previously recovered participant_ref as a capability grant. #215 is persist/recover HTTP on the older #183/#206 write path; rebase or replace it onto this head rather than merging it as a substitute.

  

_{Sent by Cursor Automation: Fix Issues}

[seonghobae]

Closing as superseded, not merged. Fresh ancestry proof shows #230 head 86352add is an exact descendant of this head 7860bc71 (ahead_by=1, behind_by=0). #230 preserves this current-binding recover/unlink persistence contract and adds the persist-backed recover/unlink HTTP + OpenAPI surface, so keeping #210 open would duplicate the same identity landing lineage.