Persist proposal webhook deliveries before commit

[Chris0Jeky]

A host failure after a proposal committed but before notification completed could permanently lose its webhook delivery. Already-buffered proposal events now stage filtered Pending delivery rows before the final proposal save, so board effects, audit/status receipts, subscription trigger timestamps and delivery rows commit or roll back together. After commit, realtime publication remains best-effort and the existing webhook worker can recover the committed queue rows.

The change reuses the current outbound delivery queue and retry worker. It adds no schema or migration. Immediate notification producers and the separate assignment collector retain their current behavior; the scope is the executor's already-deferred lifecycle, card-update, detached-child and relation events. Explicit review, approval and Apply remain required.

Validation:

• Focused source checks: 39 Application and 10 Composite API tests reported passing; the complete backend gate below qualifies the integrated source.
• Five real SQLite API cases pass: separate-scope queue visibility at the first post-commit callback, archive/restore, controlled callback-loss recovery, final-save rollback of effects/receipts/queue/trigger marker, and already-applied deduplication.
• A negative control omitting pre-commit preparation fails both lifecycle cases. Restoring the exact reviewed executor bytes makes all five pass; evidence includes red/green TRX files and matching SHA-256 receipts.
• One independent source review is clean.
• Full backend: 9,802 passed, 34 existing skips, zero failures across all six projects at0a65b536b00282d543bdcedfb05e0a4dce936054. The later inherited chat correction changes only nine tool/registration/test files, which pass 91 Application cases and one API registry case on the parent. Webhook implementation and durability tests are unchanged. The combined final head still requires hosted qualification.
• Documentation links (701 Markdown files), GitHub operations governance and diff checks pass; exact-head hosted qualification is required before merge.

Delivery remains at-least-once under the existing worker contract. Controlled callback loss is not an actual process-kill test; external HTTP delivery, physical-device/screen-reader acceptance and release/hosting decisions were not exercised. OUTSTANDING_TASKS.md remains unchanged.

This PR is stacked on #3066 through7c66104b3900a7d9bb44153b299f714e86d34cdd, including its corrected chat ID/revision contracts and delivered archive draft settlement from main9a8c14c6b. The latest base merge changes frontend/docs only; backend files are unchanged from the previous combined webhook/chat head. The parent passes61 focused archive/relation tests on this base. Merge that parent first, retain its branch until this child is retargeted, and requalify the new base. The source and SQLite proof commits are preserved. The finished proof worktree was removed only after remote/ancestry verification; its red/green TRX files, logs and restoration receipt remain at C:/td0912-evidence/webhook-durability-control.

Closes #3024

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-12T20:57:30.885317Z	25db91a	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.