[Archive] Publish lifecycle notifications after proposal commit

[Chris0Jeky]

Confirmed MEDIUM from #2932 comment 3982295764. CardService.SetArchivedAsync publishes its board notification after SaveChanges but before AutomationExecutorService commits its outer transaction. A later operation can fail and roll back the archive/restore after the notification has gone out.

Independent source triage: the frontend useBoardRealtime consumer ignores operation semantics and performs a debounced database refetch; it does not apply a phantom archive locally. Webhook delivery rows share the transaction and roll back. This extends the pre-existing create/update/move notification pattern. No persisted corruption was demonstrated.

Residual: notify only after a lifecycle proposal transaction commits, preserving standalone API notification. Prove failed later operations produce no lifecycle notification, successful proposals notify after commit, and direct lifecycle writes still notify. Keep any transaction bridge bounded and coordinate if shared infrastructure is needed; do not broaden into a general notification redesign.

Tracked under the bounded review rule; no active claim. #2932 (comment)

[Chris0Jeky]

[Claude lane claim v2]

• Lane: alpha-product-trust
• Issue: [Archive] Publish lifecycle notifications after proposal commit #2934 — publish archive/restore lifecycle notifications only after the proposal transaction commits
• Base SHA: 4c479a7ff311912ffb96da027f6e525521bb70df (origin/main)
• Branch: issue-2934/post-commit-lifecycle-notifications (detached worktree, outside the main checkout)

Owned paths (new files, exclusive):

• backend/src/Taskdeck.Application/Services/DeferredBoardRealtimeNotifier.cs
• backend/tests/Taskdeck.Application.Tests/Services/ProposalLifecycleNotificationTests.cs

Shared-path leases (small, localized edits — please coordinate before touching these hunks):

• backend/src/Taskdeck.Application/Services/CardService.cs — SetArchivedAsync only: one new optional trailing parameter (a notification sink) and the two NotifyBoardMutationAsync call sites inside that method. The recordLifecycleAudit parameter added in Align card lifecycle proposal side effects and audit receipts #3001 stays exactly as-is.
• backend/src/Taskdeck.Application/Services/CardService.Hierarchy.cs — NotifyDetachedChildrenAsync only (it must route through the same sink).
• backend/src/Taskdeck.Application/Services/Pipeline/OperationHandlerRegistry.cs — constructor plus SetCardArchivedAsync only.
• backend/src/Taskdeck.Application/Services/AutomationExecutorService.cs — constructor plus the flush/discard points around the outer transaction.

Explicitly NOT touching: backend/src/Taskdeck.Application/Services/Pipeline/ProposalOperationContractValidator.cs (claimed for #2926), and no frontend files — useBoardRealtime is read-only reference for me.

Parallel-safe work: anything outside Taskdeck.Application/Services/{CardService*,AutomationExecutorService,Pipeline/OperationHandlerRegistry}.cs. Backend test projects other than Taskdeck.Application.Tests are untouched by me except possibly a single added assertion; I will note it here if that changes.

Status: claimed, implementing now. Release marker with head SHA and result will follow on this issue.

[Chris0Jeky]

[Claude lane release v2]

• Lane: alpha-product-trust
• Result: implemented and shipped to review — PR Publish archive/restore lifecycle notifications only after the proposal commits (#2934) #3016, head b652faed71c09f07c39174a98c73f92ffe3133c5, ready for review, Closes #2934 verified via closingIssuesReferences. Not merged — merge disposition belongs to the coordinator.
• Base at claim: 4c479a7ff311912ffb96da027f6e525521bb70df. main has advanced since; the PR diff against the merge base is exactly 8 files.

Released paths (all leases dropped):

• backend/src/Taskdeck.Application/Services/DeferredBoardRealtimeNotifier.cs (new)
• backend/src/Taskdeck.Application/Services/AutomationExecutorService.cs
• backend/src/Taskdeck.Application/Services/CardService.cs
• backend/src/Taskdeck.Application/Services/CardService.Hierarchy.cs
• backend/src/Taskdeck.Application/Services/Pipeline/OperationHandlerRegistry.cs
• backend/tests/Taskdeck.Application.Tests/Services/ProposalLifecycleNotificationTests.cs (new)
• backend/tests/Taskdeck.Application.Tests/Services/DeferredBoardRealtimeNotifierTests.cs (new)
• autodoc/interfaces/proposal-operation-vocabulary.md (one sentence)

ProposalOperationContractValidator.cs was never touched, as promised to the concurrent #2926 worker.

What landed: lifecycle archive/restore applied through a proposal now stages its card.archived / card.restored event (and the card.updated events for children the archive detaches) in a buffer the executor owns, flushed as the first statement after CommitTransactionAsync and discarded in a finally that drains every non-commit exit. Direct API archive/restore passes no sink and notifies immediately, unchanged. Create/update/move on the proposal lane share the same underlying pattern and were deliberately left alone — not the one-line reuse the issue scoped in.

Review: one fresh-context adversarial pass plus the Codex connector. No CRITICAL/HIGH. Two MEDIUM findings — both in lines this PR introduced, both fixed in b652faed7: post-commit delivery was tied to the caller's cancellation token (a cancelled request could permanently lose the events for an already-durable archive), and the 6-argument constructor staged events into a NoOp buffer instead of falling back to immediate publication. Codex independently reported the first; its thread is answered and resolved. Two LOW findings closed with tests, one declined as non-blocking and recorded on the PR.

Follow-up worth a separate issue (not filed by me): create / update / move on the proposal lane publish before the outer transaction commits, exactly as archive did. The bridge is now in place; each needs its own sink parameter, call site and tests.

[Chris0Jeky]

[Claude lane release v2] — supersedes the release above (round-2 fixes landed after it)

• Lane: alpha-product-trust
• Result: PR Publish archive/restore lifecycle notifications only after the proposal commits (#2934) #3016, head 449037027432d3fc27e9109a9d9839cee548b6c1, ready for review, Closes #2934 verified. Not merged.
• Required gate green on that head: dotnet test backend/Taskdeck.sln -c Release -m:1, exit 0 — Domain 1676 · Application 4376 · Api 3174 (4 skipped) · Cli 243 · Architecture 28 (1 skipped) · Integration 7 (29 Docker-gated skips), 0 failed anywhere.
• Branch also merges origin/main (b93d2768f), clean, no conflicts. Diff against the merge base is 8 files.

Two review rounds, closed. Round 1 (fresh-context adversarial + Codex, same finding independently): post-commit delivery was tied to the caller's cancellation token, and the 6-argument constructor staged events into a NoOp buffer instead of falling back. Round 2 (coordinator): the buffer is now created per execution rather than living on the Scoped service and is threaded through OperationHandlerRegistry.ExecuteOperationAsync per call; the load-bearing flush catch gained a test proving a dead notification channel cannot roll back a committed transaction and flip an Applied proposal to Failed (verified non-vacuous by rethrowing); the flush log binds the exception and names the proposal.

Webhook durability is documented, not fixed. A lifecycle event's outbound webhook delivery rows are now written by the post-commit flush, outside any transaction, so a host crash in that window loses them with no retry. One clause on the autodoc sentence; #3024 — "Outbox for post-commit webhook deliveries" tracks the fix and states that reverting the ordering is not it.

Remaining LOWs, declined and recorded on the PR: at-most-once flush on a bare throwing channel (deliberate; unreachable with the production wiring); create / update / move / delete on the proposal lane still notify pre-commit — the identical defect with a wider blast radius, out of scope per this issue's own wording. No issue filed for that yet; the bridge is in place for whoever picks it up.

Released paths — all leases dropped; ProposalOperationContractValidator.cs was never touched, as promised to the concurrent #2926 worker.

Worktree: C:/wt/td-2934, clean and fully pushed, ready for removal by the coordinator.