feat(moderation): let staff enforce room decisions and track delivery

[rabble]

Staff need to recover moderation actions without losing their identity or undoing a newer decision. The existing ItemAction UI now obtains server-issued receipts for bans, unbans and removals. It persists the original nonce before transport, binds retries to the original account and input fingerprint, retains uncertain requests across reloads, and prevents a late response from clearing newer work. Legacy requests remain lookup-only. The narrow client authorization preserves broader UI ownership in issue24.

Current review: needs work. A fresh whole-candidate pass at 53d6fc0 found a server operator-recovery gap for an MRT message removal that is recorded but has neither acceptance nor a definitive refusal. If delivery cannot proceed, that individual recorded job can remain pending without a server stop/attention/close path. Skip lets other MRT jobs progress; this is not a claim that the whole queue blocks or that enforcement succeeded. The approving maintainer and server recovery implementer must settle an identity-preserving durable record or audited primary-decision-derived stop design, including schema/rollback and API security scope, before implementation. This is separate from the broader issue24 UI work. The earlier accepted-removal completion and retired-unsent close findings remain fixed and resolved.

Durable source ordering preserves latest staff decision and Guild scope across retries. Retired, proved-unsent requests can receive an explicit authorized audited close; unknown or in-flight delivery cannot. Accepted MRT removals now append exact-execution acceptance evidence before queue completion, so cleanup loss cannot cause repeated moderator handling. Replay validates the original payload and decision, without another POST or dependence on deleted transient evidence. Permanent refusals retain durable needs-attention state without reporting successful enforcement.

Backend APIs provide operation status, retirement, attention, held evidence, audited access, closure and fresh reversal from retained ban facts. Holds consume the Bridge201 response; GraphQL preserves conflict details. Migration-before-writer cutover is required. Retain ordering, receipt, disposition and removal-acceptance records on rollback; never resume unfenced writers. The new additive acceptance journal rejects malformed required fields and blocks owner UPDATE/DELETE/TRUNCATE.

Current reviewed source: 53d6fc056f7fbc01dc758f9ebe173e38dc90ed6a, preserving the author client/lifecycle work through e629c17 and the status repair at a23d660. The earlier added-range review was followed by a fresh whole-current review against d91664a, with production paths, provisioning/docs, structural dependency changes and bounded test/helper coverage completed. Generated/mechanical exclusions remain disclosed. Its new operator-recovery finding is open and unwaived, so neither prior scoped readiness, account approval nor green CI establishes readiness of the current candidate.

Current bounded client repair:

Successful receipt acquisition can return a receipt that was durably retired elsewhere. The client now releases only the matching receipt when the server certifies retired, unrecorded, acceptance-known-absent state with no accepted decision and explicitly permits replacement. This is retirement, not enforcement success. Raw begin errors, local attempt counts, NOT_RECORDED responses, unknown/refused outcomes and stopped receipts without replacement permission do not release it.

Automation-stopped receipts can remain pinned even after retired-unsent closure because the server withholds replacement. That fail-closed availability tradeoff and broader status/retirement/attention/reversal interaction remain with issue24. A new tab is a separate operation, not cancellation or an implicit retry.

Current-source validation and limits:

• A fresh required revalidation on unchanged 53d6fc0 passed 108 focused server tests in 19 suites, all 53 real PostgreSQL tests in five suites, all 41 focused UI tests in six files, server/client lint and build, clean GraphQL generation, 30 artifact contracts and two setup tests. This is not a full local server/client or multi-store suite. The new operator-gap finding is source-traced, not an executed new failing-runtime reproduction; these checks do not cover that recovery path.
• Exact-head hosted CI passed 87 server suites/537 tests and 42 snapshots (eight unchanged existing skips), all five real PostgreSQL suites/53 tests, six frontend suites/41 tests, generated types, setup and migration checks. Actual job logs and commands were inspected.
• The exact client tree passed lint/typecheck and production build. The retired-receipt regression fails against its preceding implementation and passes fixed. Server build/full lint and 30 artifact tests also pass; dependencies are unchanged.
• All four exact-source 53d6fc0 images were freshly built and verified. Compiled server and worker with SQL extracted from the matching migrator pass acceptance/replay/queue completion, immutable conflicts, append-only guards, retired-close and late-claim checks. The served client index and all 375 JavaScript assets match their source proof. Older archives remain historical rather than relabeled.
• Actual paired HTTP/HMAC acceptance passed with Bridge f402fe28c9e02a7eb551fa7e579bb741e452ff6c and Coop server e629c17724be6d5fd63a263a6cfb1af8c684673b: holds/audited evidence/release, expired-source reversal, retired-unsent audited closure, accepted-response loss followed by lookup with zero resend, revisions1/2/3, durable MRT removal completion/replay without extra POSTs and durable attention after definitive refusal. The current server tree is byte-identical, so this server-wire evidence is retained rather than presented as a newly executed browser test.

Final source CI and local image validation are complete. Hosted image publication jobs were skipped. Whole-client/hands-on ItemAction, live destination acceptance and release publication remain separate from these source and compiled-module checks.

These fix the manual client blocker, the retired-unsent close omission and accepted-removal completion omission. The older OCI daemon-handle binding defect is also fixed; all four preserved real archives verify and final artifact contracts pass. The original reviewer verified and resolved both backend threads. Separate whole-candidate review, lineage and human-reading gates remain; no approval is inferred from source tests.

Current-head automated review completed successfully on 53d6fc0 at 03:46UTC; roborev reports no findings at or above high severity, and source CI is verified green. This is not an all-checks-green or merge-approval claim. Final independent/mapped review, required human diff-read, selected launch policy values, native destination capacity, final merged-source publication/pins and live Discord/relay/client acceptance remain release gates. Source-client provenance and synthetic calibration do not establish owner UI acceptance. No new application images have been published or production operations performed.

Matching Bridge PR1 and production PR2263. Existing private/multi-community bridge compatibility is preserved separately from the public pilot.

Contributor records retained from the existing PR (not reconstructed or replaced):

Agent-Model: openai/gpt-6.1-sol
Agent-Effort: unknown
Agent-Harness: OpenCode/unknown
Agent-Context: shared
Initiated-By: @dcadenas

Agent-Model: openai/gpt-6
Agent-Effort: unknown
Agent-Harness: codex/unknown
Agent-Context: forked
Initiated-By: @rabble

Current backend contributor (runtime identity not exposed; coordinator launch configuration is not asserted as the served model):

Agent-Model: unknown
Agent-Effort: unknown
Agent-Harness: codex/unknown
Agent-Context: shared
Initiated-By: @rabble

Current release-tooling contributor (separate retained run; precise served identity not exposed here):

Agent-Model: unknown
Agent-Effort: unknown
Agent-Harness: codex/unknown
Agent-Context: shared
Initiated-By: @rabble

Earlier retained contributor model identities remain incomplete. Known identities alone do not establish independence from every prior contributor, and required human diff-read has not been recorded. Final review and reviewer closeout are reported separately; tests do not clear another reviewer’s change request.

Protected-path/dependency approval evidence is attributed in earlier author reports, but a directly cited approval covering the production base-image change and client jsdom/transitive test dependencies has not been established in this recheck. This is an evidence gap, not a claim that approval never occurred. Please supply the applicable maintainer receipt alongside the remaining contributor/model and human-read evidence. The new server-recovery design is not assumed to be covered by the earlier plan approval.

[rabble]

Independent review closeout for the implementation: the fresh reviewer requested changes on five Important findings across the bridge/Coop integration. The fix pass added regression coverage for delivery retries, stable staff intent and explicit scope confirmation; those regressions pass. This records the earlier review and fixes, not an approval of the current head.

At fb030bb, every GitHub Actions job passes. The server run reports 77 passing suites, 470 passing tests, eight skipped tests and 42 passing snapshots. All seven room UI tests pass in CI. Four matching source images build locally and server/client runtime smoke checks pass. Automated roborev is still running.

Registry publication is blocked because GCP authentication requires renewal. No live image pins, workloads or pilot settings have changed. Live staff/Discord/client acceptance remains a rollout gate. Review requests are open for the current head.

[divine-roborev]

roborev: Partial Review (1af6e0a)

Partial review: 1/2 reviewers completed. Unavailable: security. Findings below cover completed reviewers only.

Verdict: Completed reviewers reported no findings at the configured severity.

---

Reviewers: 2 total (1 done, 1 failed) | Synthesis: opencode | Total: 8m31s

[rabble]

@mbradley @NotThatKindOfDrLiz The JSON-persistence retry finding is fixed in 98d73d0. The regression first reproduced two failures when stored decisions were round-tripped through JSON. Equality now uses the persisted JSON representation: identical retries resume, while changed actions, reasons, parameters and related targets remain rejected.

Validation on this head: 38 focused tests; full CI 77 suites, 472 tests passed / eight skipped, 42 snapshots; seven UI tests; typechecking, lint, builds, GraphQL and migration checks pass. All four matching images are rebuilt, published and verified against the exact tested local image indexes. No live rollout was performed.

Please review the fix with the current head; your review requests remain open. Automated re-review is deferred by the service until 00:13 UTC, so that review is still pending.

[dcadenas]

@rabble I pushed four commits through 3e795c8e to preserve room decisions across delivery retries and reject invalid submissions before recording them.
Please re-review the updated branch; approval is pending final-head CI, not rollout work.

Changes I pushed

• 33c1a10: Keep related room actions queued until durable acceptance and forward their reason.
• 752ad65: Validate reasons before recording and preserve ordinary queue recovery when original actions have been deleted.
• 80483a8: Preserve retries for ignored room reports without treating them as enforcement.
• 3e795c8: Check current staff, queue, action and Discord-scope permissions before recording, while retaining publication-time checks.

Checks

• Server lint, build and typechecking pass; 49 focused tests pass in nine suites.
• Client lint/build and seven room UI tests passed on unchanged client sources.
• GraphQL regeneration is clean; provisioning guards and two setup tests passed on unchanged provisioning sources.
• Full local database-backed testing remains unverified: the local Scylla stack could not start, and the no-dependencies full-suite attempt failed against unmigrated databases.
• The last four added cases pass normally; their attempted preceding-source comparison did not execute, so it supplies no before-fix failure evidence.
• Independent review covered 3e795c8e with no remaining findings. Final-head CI has not been verified green, so this handback is not approval.

Follow-ups

The description now distinguishes the earlier 98d73d0a CI and published images from the current source.
Those images and existing companion pins do not contain these four commits; matching-image rebuild/pinning and live cross-service acceptance remain rollout prerequisites.
No images were published and no rollout was performed here.

@mbradley @NotThatKindOfDrLiz your review requests remain pending; no duplicate request was added.

[dcadenas]

@rabble I pushed two commits through 38d26a93 on top of 58a05764, retaining your reason UI and GraphQL fixture changes.
Please re-review the updated branch; approval is pending final-head CI.

Changes I pushed

• c96a10a: Preserve related-action Discord scope through submission, recorded intent, retries and delivery.
• 38d26a9: Reject unavailable related configuration before recording, and retain required durable delivery if configuration disappears during publication.

Checks

• Server lint/build/typechecking and 59 focused tests in ten suites pass.
• Client lint/typechecking/build and 12 room UI tests in four files passed on the retained client sources.
• Clean GraphQL regeneration passes. Unchanged provisioning checks retain two setup tests and the guard-suite passes.
• Configuration-loss tests use a mocked callback with shared guards; the real publication wiring was inspected statically. No before-fix runtime failure is claimed for the new cases.
• Full local database-backed orchestration remains unverified; the prior no-dependencies full-suite attempt failed against unmigrated databases.
• Independent review covered the complete extension from 3e795c8e through 38d26a93 with no remaining findings. Final-head CI has not cleared, so this is not approval.

Follow-ups

The description now separates current local checks from the historical 58a05764 CI and reported candidate images.
Those images do not include these two commits. Matching-image rebuild/pinning and live cross-service acceptance remain rollout prerequisites; neither was performed here.

@mbradley @NotThatKindOfDrLiz your review requests remain pending; no duplicate request was added.

[rabble]

Review-feedback closeout for 38d26a93e998d6b57d094d2b9f6044df18f56843. This is the PR author's non-approving handback; human approval remains required.

Fixed and verified:

• Related room actions retain their reason and parameters through submission, immutable persistence, retries and publication, including the explicit Discord-server scope choice.
• Recorded decisions retain their original actor and intent. Ordinary queue retries and ignored reports preserve their intended recovery paths.
• Current staff, queue, action and scope authorization is checked before recording, with publication-time checks retained.
• Missing related configuration is rejected before recording. Required durable delivery survives later configuration loss, keeping the job available until delivery is accepted.
• Primary and related room actions require a valid reason in the UI even when the organization's general reason setting is off. Test fixtures reuse generated fragments, so regeneration remains clean.

The migration checklist needs no schema correction: all three receipt columns are already NOT NULL, with organization foreign-key and composite primary-key constraints. No inline review threads were returned.

Final-head verification: all GitHub checks pass; the server run has 79 passing suites, 493 passing / eight skipped tests and 42 passing snapshots; the 12 room UI tests pass. Automated re-review reports no findings at or above high severity. The reviewer also reports 59 focused server tests. Configuration-loss tests exercise shared guards with a mocked callback; actual publication wiring was inspected statically. Full local database orchestration remains unverified, and the broader local client run retains the unchanged snapshot/mock/ESLint failures documented in the description.

I inspected the new parameter and durable-publication paths and found no further actionable code findings. All four matching source images are rebuilt, published and registry-verified; their current digests are in the description. No production image pins or workloads were upgraded. Live cross-service acceptance remains a deployment prerequisite.

@dcadenas please re-review the current head and the reason-form fixes retained above. @mbradley @NotThatKindOfDrLiz your existing review requests remain pending. The merge decision remains with the human reviewers; this comment is not an approval.

[mbradley]

@rabble, I know I've been sitting on this one. As part of my review I'm going to do a local build and put some hands-on time into the Coop experience myself. That may inform, or push back on, the approaches I've taken so far in extending Coop. I want to make it a priority once I've landed the series of things I have in flight, which are wrapping up now.

[rabble]

Review follow-through at 38d26a9 (targeted source, review-history and live-check audit).

All current-head checks pass, and the prior implementation closeout already records the fixed related-action, reason, scope and durable-delivery findings. The receipt schema has NOT NULL columns and its organization/key constraints; no correction is needed for the automated checklist. No new actionable review finding was identified in this scoped follow-through. @mbradley has explicitly planned a hands-on review, and the existing individual requests are preserved without duplicates. Matching deployment and live cross-service acceptance remain separate gates. This is an author-account triage, not an independent approval.

[dcadenas]

@rabble the fresh review of 5772e7a..78f06e4 found no new technical finding in the CI-selection change.
The former hosted-test coverage gap is resolved: all six focused client files now ran in CI, including the overlapping-response and transport-retry regressions.
This was a review of the added commit in context, not a new whole-application approval.

Checks

• Run 39118011918 executed 27 client tests in six files, 527 backend tests with eight unchanged skips, and 16 PostgreSQL tests in two suites.
• All 12 returned check runs passed, including lint/build, GraphQL no-drift, migration ordering and setup gates. CLA passed.
• Automated roborev reports Review unavailable for 78f06e4: no reviewer produced usable output. The description's current pending-status sentence was corrected to that result; the older 5772e7a report is not evidence for this head.
• No local tests were rerun for this one-line selection change. Application sources are unchanged from 5772e7a; full-client, full local multi-store, cross-service, hands-on and release-image claims are not made.

Remaining gates

The existing question for @rabble or the approving maintainer remains: which terminal/remediation behavior under the selected durable-recovery contract is required for PR approval versus release, and is the lookup-404 exact-original replay amendment accepted or rejected?
The recorded product direction is not implementation completion or reviewer closeout.
Broader #24 status/remediation work remains with its current owner.

Contributor declarations, qualifying distinct-lineage review against every retained contributor and a human diff-read attestation for the moderation/outward-operation changes remain unestablished before merge.
The new contributor declaration does not establish the missing identities of other retained runs.
No approval, merge, push or operational change was performed in this pass.

Publishing contributor:

Agent-Model: openai/gpt-6.1-sol
Agent-Effort: unknown
Agent-Harness: OpenCode/unknown
Agent-Context: shared
Initiated-By: @dcadenas

Attributed fresh technical review receipt (self-reported, not execution certification):

Agent-Model: anthropic/claude-opus-5-5
Agent-Effort: unknown
Agent-Harness: Claude Code/unknown
Agent-Context: fresh
Initiated-By: unknown

[rabble]

Reviewed current head 78f06e44dff47e8648e521c30440a6947afbd6e2 and completed the narrow CI follow-up. Author-account report, not self-approval.

Fixed: hosted frontend CI now runs the two omitted component-overlap and transport-retry regression files. The exact command passes 27 tests across six files, including an independent fresh-context rerun. The underlying operation-bound cleanup and loading correction is present; no additional scoped source defect was found.

Validation: current-head standard CI passed: 86 backend suites (527 passed, eight unchanged skips), both PostgreSQL suites (16 passed), frontend checks and 27 focused UI tests, GraphQL no-drift, migration order and setup gates. Client lint/build passed locally with existing warnings. Automated review result: ERROR — Review unavailable: neither automated reviewer produced usable output (service report). This is an external review-service failure, not a failed test; complete automated validation remains unavailable. Keep the PR open for review-service recovery and the owner gates below.

Escalated / unchanged: the durable-recovery and needs-attention contract disposition, explicit lookup-404 amendment acceptance, assigned consumer work in #24 and hands-on acceptance remain open. Matching reviewed images and coordinated rollout remain separate; nothing was published or deployed. No review item was silently waived or declined.

@dcadenas has now re-reviewed the exact follow-up and confirmed the hosted-test gap is fixed, with no new technical finding. That scoped review is not whole-application approval. @mbradley remains requested for the assigned consumer workflow. The standing approval from NotThatKindOfDrLiz is preserved without a duplicate request. The author retains the merge decision after owner/reviewer gates and model/human-read requirements are met.

Agent-Model: openai/gpt-6
Agent-Effort: unknown
Agent-Harness: codex/unknown
Agent-Context: shared
Initiated-By: @rabble

[rabble]

Maintainer decision recorded from the active session: Rabble approved the concrete implementation plan, additive schemas, compatible rollback and image-build workflow scope on 19 October, and selected task-by-task implementers/reviewers. The lookup-404 exact-original-identity replay amendment is explicitly accepted. The broader durable recovery/lifecycle and bounded-pilot implementation is required for the coordinated release candidate; actual retention values, measured supported envelope, paired client acceptance and live operations remain release gates. Design approval alone does not clear reviewer verdicts or certify implementation. Work is proceeding on isolated local branches; no deployment is performed by this decision.

Source refresh at 78f06e44dff47e8648e521c30440a6947afbd6e2 confirms the owner-delivered identity-bound completion cleanup/loading guard and overlapping-response regressions. The previously reported narrow late-success P2 is fixed in source; preserve and reverify it, rather than implementing it again. Durable retirement/status/refusal disposition remains separate work. Issue #24 UI ownership is unchanged.

[rabble]

Blocking technical review at f2e1076: the existing ItemAction client still generates source-order-v1 operation IDs, while the new backend safely treats unregistered legacy executions as lookup-only. New manual ban, unban and message-removal submissions therefore enter quarantine/lookup and never POST a decision. The client then displays unknown acceptance even though this new execution was never sent. MRT queue decisions are unaffected.

Evidence: client/src/components/roomOperation.ts:14 and ItemAction.tsx:217-249; server/rule_engine/ActionPublisher.ts:210-214 and 663-672; server/routes/concord/manualRoomDelivery.ts:38-42; memberIntentClaim.ts:30-51; legacyMemberIntents.ts:29-37. The fresh reviewer verified these citations against the reviewed commit and compared the preceding published source to establish the regression. This conclusion comes from source tracing, not an executed end-to-end ItemAction test.

Merge/deployment is blocked until the client obtains and retains server-issued receipts. The approved C4 ownership boundary leaves this integration with mbradley; a narrow client-wiring scope extension is pending in the active maintainer session. Unknown legacy operations must not be assigned new executions as a compatibility shortcut. Broader recovery/attention UI remains with its existing owner.

A second, lower-severity artifact issue is being corrected: an OCI index in a saved archive does not alone determine which verified digest Docker uses as its local image handle. The new regression reproduces rejection of an otherwise valid indexed archive with a config-digest daemon handle. The original review's Docker-classic-platform premise was not independently established; no actual registry/publication failure is claimed. Descriptor, source, config and layer verification must remain intact.

The delegated review covered the full PR diff and inspected core receipt, delivery, disposition, lifecycle, migration, client action and publication paths. It ran the citation checker (21 citations and four snippets), but no tests/services/DB mutations. It did not read every generated/test file or JobDecisioning line by line. Local source/database/paired-HTTP tests are separate author-side evidence. Hosted checks are still running; this is a blocker report, not a completed-fix handback or approval. The reviewing account is also the PR author, so this is a COMMENT review.

Reviewer identity:

Agent-Model: anthropic/claude-opus-5-5
Agent-Effort: unknown
Agent-Harness: claude-code/unknown
Agent-Context: fresh
Initiated-By: @rabble

The reviewer inherited no authoring transcript. Its lineage is distinct from the recorded OpenAI contributors; missing earlier/current served-model records and required human diff-read are not silently established by this review. Coordinator publishes this delegated conclusion.

[rabble]

@mbradley — the backend receipt/recovery contract for #24 is available at f2e1076. This is an integration handoff with an explicit merge/deployment blocker, not a readiness claim: current ItemAction creates v1 IDs, which the new backend treats as lookup-only, so fresh manual actions do not send. The final review records that path. Narrow client-wiring ownership is being resolved in the maintainer session; broader recovery UI remains assigned to you.

The checked-in contract and generated GraphQL types are ready:

• Persist a UUID clientNonce before beginRoomOperation(input: {clientNonce, actionId, itemId, itemTypeId, note, parameters}); retain its returned operationId/executionId and pass operationId to bulkExecuteActions. Recover a lost begin response with the same nonce and exact claim. Do not mint another operation or upgrade an ambiguous old browser ID into a new send.
• roomOperationStatus remains available after evidence expiry. Use phase, recorded, acceptanceUnknown, acceptedDecisionId, sourceOrder, refusalCode, disposition, successorExecutionId and allowedNextActions. ROOM_OPERATION_CONFLICT GraphQL extensions retain the current reason-free operation status.
• retireRoomOperation applies only before registration/attempt. Unknown delivery cannot be recalled. roomNeedsAttention reads durable primary state independently of Redis; ADMIN stopRoomAutomation preserves uncertainty, and closeRoomExecution is separate from enforcement success.
• reverseRoomDecision uses a fresh clientNonce and retained prior decision, with server-owned target and a new source revision. Preserve discordRestriction/auditAvailable; community success does not imply a Guild restriction was removed. ADMIN-only lifecycle/held-evidence routes remain separately authorized and audited.

The two concrete interaction paths to retain are: late completion of A must not erase a newer pending B identity (the existing captured-operation cleanup/loading regressions still pass); and a definitive expired-source refusal must show durable attention and permitted recovery choices rather than an endless generic Retry. Also cover fresh receipt acquisition for ban/unban/removal before calling the existing bulk action mutation.

Hosted source CI at this head passed the actual 537 server tests/42 snapshots, five real PostgreSQL suites/44 tests, frontend and generated types, setup/migration/title and artifact contracts. Automated roborev is still pending. Paired real HMAC/HTTP + Bridge API-role/Coop owner-role database acceptance passed server-issued receipt, loss recovery, retirement, ordering, reversal and attention paths; it did not exercise current ItemAction. No source images were published or production operations performed. Merge/deployment stays blocked on client compatibility and remaining release acceptance.

[rabble]

The maintainer has explicitly authorized the narrow client receipt wiring fix in the active session: ItemAction will obtain and retain the server-issued receipt/nonce before bulk submission, including exact recovery after a lost begin response. This addresses the fresh-action blocker in the final review. @mbradley retains the broader recovery/attention/reversal UI and hands-on work in #24. The narrow fix and regressions are in progress; this records scope and ownership, not merge/deployment readiness.

[dcadenas]

@rabble I pushed the independently reviewed bounded status repair a23d660 on top of b105738, preserving all seven author commits after 78f06e4.
Please re-review the updated head; the candidate as a whole still needs work and is not approved.

Changes I pushed

• Registered but unattempted receipts now offer the existing send recovery action. Stopped, retired, accepted, superseded and refused states do not gain a new send path.
• Reversal recovery documentation now names the dedicated reversal operation with the same nonce and exact input, rather than the bulk action operation.

Checks and scope

• Server lint/build and 44 real PostgreSQL tests in five suites passed; clean post-commit GraphQL generation passed. The new status assertion fails against the preceding production module and passes fixed.
• Thirty artifact contract tests passed on unchanged artifact sources. The older daemon-handle binding defect is fixed; cross-store publication robustness remains unproven and fail-closed.
• Fresh technical review covered 78f06e4..a23d660. It found the bounded repair publishable, not the entire candidate ready.
• Final-head hosted checks are not yet verified complete. The earlier 537 backend, 44 PostgreSQL and 27 UI hosted passes are ancestor evidence. Image build/publication jobs were skipped, not successful publication receipts.
• No whole-client, full local multi-store, current paired client/HMAC acceptance, registry publication or production change is claimed.

Still open

The fresh manual client remains incompatible with the server-issued receipt flow at this head, as recorded in the existing blocker review.
The narrow client-wiring authorization is now recorded, but the implementation is not in this head; broader #24 ownership is unchanged.

@rabble and the lifecycle/queue owners still need to settle stopped-unsent attention closure and durable completion versus intentional redisplay for accepted MRT removals. The two inline notes state the exact remaining choices; neither was waived to publish this repair.
The lookup-404 replay amendment is explicitly accepted, not an unanswered choice.
Typed SHA publication confirmation is not independent authorization; live enforcement and actual release acceptance remain unestablished.

Contributor-lineage declarations and an actual human diff-read for moderation/outward-operation changes remain incomplete before merge. The technical reviewer retained context across three rounds; the final round was not a fresh review.
@mbradley your existing request and broader #24 assignment remain unchanged; @NotThatKindOfDrLiz this head differs from your historical approval, and no duplicate request was sent.

Publishing contributor:

Agent-Model: openai/gpt-6.1-sol
Agent-Effort: unknown
Agent-Harness: OpenCode/unknown
Agent-Context: shared
Initiated-By: @dcadenas

Attributed reviewer self-report (not served-model certification; initial fresh incarnation, retained context in rounds 2 and 3):

Agent-Model: claude-opus-5-5
Agent-Effort: unknown
Agent-Harness: Claude Code/unknown
Agent-Context: shared
Initiated-By: unknown

[rabble]

Author-side remediation disposition at e629c17.

The manual-client blocker in #23 (review) is fixed under the recorded narrow authorization. ItemAction now obtains and persists a server-issued receipt before all three manual room actions. Lost responses/reloads retain the original nonce and immutable claims, legacy attempts remain lookup-only, and late completion cannot erase a newer request. The OCI daemon/config handle defect is also fixed with cryptographic descriptor binding; 30 artifact regressions and the actual final image archives pass. No additional actionable findings were found in this scoped follow-through; this is author validation, not independent approval.

The two newer lifecycle/completion findings are fixed and have detailed dispositions on their original threads. Final-head hosted source CI is green: 87 server suites/537 tests, five real PostgreSQL suites/53 tests, frontend/generated/setup/migration checks and 42 snapshots. Eight existing skips remain unchanged. Full client/server lint and builds passed. All four source images passed archive verification and compiled server/worker/PostgreSQL/client HTTP checks. Paired final-source HTTP/HMAC acceptance with Bridge f402fe28c9e02a7eb551fa7e579bb741e452ff6c passed, including exact lost-response recovery, audited retired-unsent closure and durable accepted-removal replay with zero extra POSTs.

@dcadenas re-review is requested for the addressed findings; @mbradley your existing request and broader issue24 ownership remain. Standing approvals and others' threads/verdicts were preserved. The review service defers this head until 03:01UTC; independent/mapped reviewer closeout and actual human diff-read remain unestablished. Matching merged-source publication/pins, approved launch values, native capacity and live destination/client acceptance remain release gates. No merge, application-image publication or production operation was performed.

[dcadenas]

@rabble I pushed 53d6fc0 on top of e629c17, preserving the author client and lifecycle follow-ups.
The fresh review covered a23d660..53d6fc0; no known blocking finding remains in that added range, but this is not whole-PR or merge approval.

Changes and closeout

• The existing manual client now obtains server-issued receipts for ban, unban and removal. The former v1 lookup-only submission blocker is fixed in source, not waived.
• My bounded fix releases only a matching receipt with the complete server-certified retired/replacement state. Errors, local zero-attempt counts and uncertain history do not authorize replacement.
• The two original lifecycle/completion findings are verified fixed by the author changes: audited close for stopped, retired and proved-unsent work; durable exact-execution MRT-removal acceptance before queue completion. Unknown/in-flight work still cannot close. Dispositions were posted and both original threads were resolved.

Checks and limits

• The exact client tree passed 41 tests in six files, lint/typecheck and build. Its new retired-receipt regression fails against the preceding client module and passes fixed; the final replay preserved that client tree byte-for-byte.
• The unchanged server tree has actual parent-head hosted coverage: 537 passes/eight skips and 53 PostgreSQL tests in five suites. Final-head GraphQL generation is clean. Parent artifact contracts passed 30 tests; image build/publication jobs were skipped.
• Final-head hosted CI and automated review are not yet verified complete. Parent results are not a final-head completion receipt.
• No whole-client, full local multi-store, real ItemAction paired HTTP/HMAC, live destination acceptance or release-image publication is claimed.

Accepted tradeoff and remaining gates

Stopped receipts can stay pinned after retired-unsent closure when the server withholds replacement. The client deliberately follows that affordance; broader replacement/status/retirement/attention/reversal UI and hands-on acceptance remain with #24. A new tab is a separate decision, not cancellation or an implicit retry.
The lookup-404 amendment is already accepted. Contributor declarations, qualifying lineage review against every retained contributor and actual human moderation/outward-operation diff-reading remain unestablished before merge.
@mbradley your existing request and broader #24 ownership remain; @NotThatKindOfDrLiz the head has changed since your historical approval, with no repeat request sent.

Publishing contributor:

Agent-Model: openai/gpt-6.1-sol
Agent-Effort: unknown
Agent-Harness: OpenCode/unknown
Agent-Context: shared
Initiated-By: unknown

Attributed technical reviewer self-report, not execution certification (fresh initial incarnation; retained context for later rounds):

Agent-Model: anthropic/claude-opus-5-5
Agent-Effort: unknown
Agent-Harness: Claude Code/unknown
Agent-Context: shared
Initiated-By: unknown

[rabble]

Current-head integration receipt at 53d6fc0.

Preserved the maintainer's matching retired-receipt cleanup by fast-forwarding without source edits. Its complete server-certified replacement condition and exact-identity cleanup remain intact. Current-head hosted CI is verified green: 87 server suites/537 tests, five PostgreSQL suites/53 tests, six client suites/41 tests, 42 snapshots, generated/setup/migration checks and artifact contracts. Eight existing server skips remain unchanged. Actual hosted logs were inspected: https://github.com/divinevideo/coop/actions/runs/39189861825.

All four current-source images were freshly rebuilt and verified. Compiled server/worker modules with SQL extracted from the matching migrator passed the durable acceptance, replay, queue, conflict, append-only and retired-closure checks. The served current client index and all 375 JavaScript assets match its source proof. The server is byte-identical to e629c17, so the final paired Bridge HTTP/HMAC/PostgreSQL proof remains applicable to the server; this is not a newly executed browser test.

The original reviewer resolved both backend threads. Existing individual review requests and broader issue24 ownership are preserved; no duplicate request was sent. Automated review, qualifying whole-candidate lineage review and actual human diff-read remain unestablished. Matching merged-source publication/pins, launch policy values, native capacity and live client/destination acceptance remain release gates. Worktree is clean and task runtime resources are stopped. No merge, application-image publication or production operation was performed.

[NotThatKindOfDrLiz]

Re-approving 53d6fc0 after re-reviewing the manual-client receipt wiring, identity-preserving retry/cleanup behavior, audited closure for stopped retired requests proved unsent, and durable MRT removal completion. No blocking finding remained in the changes re-reviewed. Exact-head hosted logs confirm 537 server tests, 53 PostgreSQL tests, and 41 focused client tests passed; automated review is green.

This approval preserves the previous release qualifications: broader #24 UI and hands-on acceptance, coordinated publication/cutover, live destination acceptance, and recorded human-review requirements remain outstanding. This was source/regression and hosted-log re-review, not a new whole-PR audit or locally rerun test suite, and does not certify deployment readiness.

[dcadenas]

@rabble the fresh whole-current review of d91664a..53d6fc0 found a server operator-recovery gap. The candidate remains needs-work despite successful checks and the scoped account re-approval.
The new inline finding is distinct from the two earlier lifecycle/completion findings, which remain fixed and resolved.

Open server recovery finding

A recorded MRT message removal that has not been accepted or definitively refused has no server stop/attention/close path when delivery cannot proceed. One recorded job can remain pending; Skip permits other queue progress and does not cancel that intent. This is source-traced, not a new failing-runtime reproduction or a live incident claim.
@rabble and the server recovery implementer need to settle an identity-preserving pre-attempt record or audited stop derived from the primary MRT decision, including schema/rollback and API security scope, then implement, validate and re-review it. Earlier plan approval does not establish scope for this new design; broader issue24 UI ownership does not own this server gap.

Fresh checks and review scope

• On unchanged source: 108 server tests in 19 suites, 53 PostgreSQL tests in five suites, 41 UI tests in six files, server/client lint and build, clean GraphQL generation, 30 artifact contracts and two setup tests passed.
• Exact-head hosted source CI, CLA and roborev remain successful. Image build/publication jobs were skipped. No whole-client, full local multi-store, new paired ItemAction/browser/HTTP or live destination acceptance is claimed.
• The review completed production-path coverage plus provisioning/docs, structural lockfile changes and bounded test/helper review. Generated/mechanical exclusions were recorded; this is not a claim to have read every generated hash or rerun every hosted test locally.
• The historical image-model documentation drift was retained as a nonblocking limitation; no agent instructions, workflow or other-repository files were edited.

Evidence still needed

Protected-path and dependency approvals are reported in earlier author records, not established by a direct approval citation here. Please provide the applicable receipt for the production base-image and client test-dependency changes; this is not a finding that approval never happened.
All-contributor model/context mapping, qualifying distinct-lineage review and actual human moderation/outward-operation diff-reading remain unestablished. The current account approval explicitly covered selected changes, not a new whole-PR audit or human-read attestation, and does not waive this finding.
No source change, push, approval, change-request verdict, merge or operational effect occurred in this recheck.

Publishing contributor:

Agent-Model: openai/gpt-6.1-sol
Agent-Effort: unknown
Agent-Harness: OpenCode/unknown
Agent-Context: shared
Initiated-By: unknown

Attributed reviewer self-report, not inferred from launch configuration (fresh initial incarnation for this whole-review cycle; retained coverage/disposition context):

Agent-Model: unknown
Agent-Effort: unknown
Agent-Harness: Claude Code/unknown
Agent-Context: shared
Initiated-By: unknown

[dcadenas]

A recorded MRT message removal is not known to this operator gate before acceptance or a definitive refusal: it has no manual receipt, membership intent, quarantine row or accepted-removal entry. The public stop operation cannot derive its audited source from the primary MRT decision. If delivery cannot proceed, one immutable recorded job can therefore stay recovery-pending without a server stop/attention/close path. Skip allows other jobs to progress; it does not settle this intent.

This is separate from the already-fixed accepted-removal completion case. It is a source-traced recovery gap, not a new failing-runtime or live-incident claim.

The approving maintainer/server recovery implementer needs an approved identity-preserving pre-attempt journal design or an audited stop derived from the primary MRT decision, with organization/execution binding, rollback and API security scope, followed by implementation, validation and fresh review. Current green checks and earlier plan approval do not settle that design. This server finding is not deferred to the issue24 consumer UI.

[github-actions]

Checklist:

• Are as many columns marked NOT NULL as possible? If some columns can sometimes be null, but not when another column is filled in, have you considered normalizing the schema further (see https://www.guru99.com/database-normalization.html)? If that's not viable/desirable, are there adequate SQL CHECK constraints to capture the relationships between column values (e.g., which can be null together), and are these also captured using unions in the associated kysely types? (db/src/scripts/api-server-pg/2026.10.14T00.00.00.add_concord_receipts.sql, db/src/scripts/api-server-pg/2026.10.18T00.00.00.add_member_intent_order.sql, db/src/scripts/api-server-pg/2026.10.19T00.14.35.add_room_operation_lifecycle.sql, db/src/scripts/api-server-pg/2026.10.19T01.38.51.add_room_execution_acceptances.sql)