test(evolver): validate same-image campaign takeover and stale writes

[mirror29]

Changes

Paused-worker observations alone do not prove rejection of a stale checkpoint write. Add a maintained offline validator that pins a cached Evolver business image to its resolved image ID, creates a fresh migrated local audit database, and checks the actual completion function with matching operands: an active-token write succeeds and is rolled back, then the old token is rejected after natural expiry and a different live claim.

Record the observation-table lock anchors, unknown reserves, process-resume invariance and owned-resource cleanup. Keep failure stages in receipts and full tracebacks only in private logs. Bound cleanup independently per process; add boundary, timeout, already-exited and intentionally reused dev-fixture contract tests. Document the command and evidence limits.

Validation

• Final same-image two-container probe passed with positive/negative write controls, two offline provider calls, retained unknown reserve, both containers exit 0 and removed.
• Nine targeted tests, Ruff and formatting passed; consistency 19 passed / 0 failed / 12 existing warnings.
• Exact head 8b2f474 CI 38539151052 passed.
• Independent code/document/receipt reviews found no remaining confirmed P1/P2. The first automated review's five MEDIUM findings were addressed or explicitly scoped with tests; the latest automated review could not complete because its provider balance was insufficient. It is not counted as a passed review.

Peripheral services are fixtures; the direct storage call is not an old SDK callback, normal-owner production authorization, full peripheral-stack recovery or complete fault-matrix acceptance. No production model calls or service restarts were added. The validator does not require a production deployment.

[cloudflare-workers-and-pages]

Deploying inalpha-web with    Cloudflare Pages

Latest commit:	8b2f474
Status:	✅  Deploy successful!
Preview URL:	https://c1e984a4.inalpha-web.pages.dev
Branch Preview URL:	https://codex-e2-campaign-takeover-v.inalpha-web.pages.dev

View logs

[github-actions]

Reviewed PR head: 8b2f4746dfae

🤖 DeepSeek V4 Pro PR Review

⚠️ Review could not be completed: DeepSeek API returned HTTP 402: {"error":{"message":"Insufficient Balance (request_id: 50721553-d7e1-4cd5-8835-77cc82f6549d)","type":"unknown_error","param":null,"code":"invalid_request_error"}}

[mirror29]

Addressed the actionable gaps in 1fae2a1 and refreshed the actual probe evidence in 66d214e.

1. Portless local URLs now use 5432; a regression covers that path. The normal entry point already normalizes local URLs via local_database_urls, but the helper is now independently correct.
2. The actual image first executes complete() successfully with the same reservation/scope under its original live token, inside a transaction that is rolled back. After natural expiry and a different live claim, the old token's same write is rejected. Ledger and non-null response counts are checked unchanged after the control. This strengthens stale-authority attribution without claiming an old SDK callback was received.
3. The receipt now records observation-lock acquire/release anchors and explicitly states that the isolated response-table lock holds recovery while the replacement claim is observed. It is released before unknown-response termination and old-process resume/invariance checks. App-side blocking was not separately sampled; no natural recovery latency claim is made.
4. Execution failures now include a safe stage identifier and type in the receipt. Full traceback goes only to a private 0600 log inside the invocation's 0700 directory, not the public receipt, because exception text may contain connection or credential details.
5. Seed paths now derive from file, not caller CWD. The dev-only tool intentionally reuses the existing baseline fixture, consistent with the requested reuse of tested state setup rather than duplicating it. README declares the checkout/dev fixture dependency and a new CI contract check detects a rename/removal. It is not advertised as an installed production seed API.

Final updated same-image probe passed; nine boundary/cleanup/fixture-contract tests, Ruff and formatting passed. The original failed attempts and earlier successful narrower probes remain documented.