Deliver proposal webhook durability and card recovery fixes

[Chris0Jeky]

This delivery combines five completed recovery slices on the delivered typed-relations base. Reviewed proposal events now persist webhook deliveries before commit, changed archived imports fail during planning, deactivation removes card assignments atomically, estimate reads have bounded lifetimes, and demo sessions omit the server-only Estimates entry.

The source commits and PRs are preserved: #3071, #3068, #3078, #3075 and #3080. All runtime/test merges were automatic; both concurrent progress-document records were retained. A comparison of 94 changed code/test blobs found no difference from their reviewed source owners. Independent source reviews and one bounded integration review are clean.

Validation:

• Combined frontend: 6,907 passed, three existing skips across 445 files; lint, typecheck and production build pass.
• Deactivation source qualification: all six backend projects pass, with 9,746 passed, 34 existing skips and no failures. All eight new Application cases and four real SQLite API cases pass, including rollback after SQL save, authorization and committed-state visibility before notification.
• Prior source proof includes the complete webhook backend checkpoint (9,802 passed, 34 skips), archived-import backend checkpoint (9,747 passed, 34 skips), causal webhook rollback/visibility controls, and real API/SQLite Chromium relation and estimate journeys. These are source checkpoints, not claims about the final integrated backend run.
• Actual Chromium demo journey on a separate empty-API-base production build confirms four demo cards, no Estimates control and no estimate-rollup request. The screenshot was inspected inline; file export was refused by the browser MCP. Both temporary preview servers and browser tabs are stopped.
• Documentation links, operations governance and whitespace checks pass. The branch includes main160818440214a18c60392576452e28e9e283bc76; all runtime/test files remain identical to reviewed f9228e8.

The final combined local backend qualification completed successfully: 9,839 passed, 34 existing skips and zero failures across all six projects. The command was dotnet test backend/Taskdeck.sln -c Release -m:1 with TRX logging at code-equivalent 00c4609; the final head has no backend or frontend changes relative to that checkpoint. Counts were checked against individual TRX outcomes. This PR is ready for review. Exact-head/base ci-required.yml must qualify the final delivery before merge.

Scope limits: permission PR #3072 remains parked and excluded. Direct deactivation still has its existing post-commit notification window; the proposal webhook change is not a global outbox conversion. No actual process-kill, external webhook HTTP, physical-device, screen-reader, cross-browser or new concurrent-writer acceptance is claimed. Existing follow-up issues and all 41 human actions in OUTSTANDING_TASKS.md remain open as applicable. No release or deployment is included.

Closes #3024
Closes #2935
Closes #3000
Closes #3063
Closes #3056

[Chris0Jeky]

Independent integration review: CLEAN at runtime/test tree f9228e8. The Terra reviewer checked the combined demo entry, direct deactivation notifications versus deferred proposal webhooks, and archived import planning against the relation store. It found no merge-specific HIGH/CRITICAL defect. The existing per-slice independent reviews remain the source reviews; this was a bounded integration pass, not a repeated broad audit.

The coordinator verified all six source ancestors and all 94 changed code/test blobs against their reviewed source owners. The later main160818440 merge and documentation commits leave those runtime/test files unchanged at final head6bc8ea4976b5a83671d03d4f78b0dd9ccb71b1a2. Full frontend qualification is green; final backend/hosted gates remain separate requirements. The parked permission PR3072 is excluded.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-12T22:08:48.428803Z	6bc8ea4	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Chris0Jeky]

Delivered in merge commit 96f4b7c after ci-required.yml run34720964639 passed at exact head6bc8ea4976b5a83671d03d4f78b0dd9ccb71b1a2 and base160818440214a18c60392576452e28e9e283bc76. Independent source/integration reviews are clean; the completed Codex review has no findings. The only nonsuccess check entry was a cancelled advisory Smart CI plan, not a failed required test.

Final local qualification: 9,839 backend passed / 34 existing skips across six projects, and 6,907 frontend passed / three existing skips across445 files, plus lint/typecheck/build. The delivery preserves all five source PRs, which GitHub now marks merged. Issues2935/3000/3024/3056/3063 are closed and all eleven project items are Done with verified priorities. The first post-merge review-thread check is clear.

Durable native evidence is preserved in C:/td0912-evidence, with the final local receipt in product-recovery-local-qualification.md. Five delivered worktrees were removed with clean source, ancestry and ignored-output checks; the demo source cleanup hit a Windows filesystem permission error after Git deregistered that worktree, so its remaining directory is preserved. No force removal was attempted. The two earlier automatic-policy-denied cleanup trees are also preserved. Source branches and committed history remain available.

The parked permission PR3072 and existing human actions remain separate. No release, deployment, physical-device or historical-old-binary acceptance is claimed. Archive reselection proceeds independently in PR3082.

[Chris0Jeky]

Post-merge fresh-context review found one transaction-boundary residual and recorded it as #3117.

The durable webhook preparation introduced here appears sound: matching deliveries are staged inside the operation transaction, preparation failure rolls back, and deferred channel publication is isolated after commit. The remaining defect is later in the committed tail: assignment notification and linked-capture synchronization still inherit the caller cancellation token and can throw into the outer rollback/mark-Failed catch after CommitTransactionAsync has already made the proposal effects durable.

#3117 contains the concrete paths, failure semantics, and regression acceptance. I found no reason to revert the webhook staging itself.