fix(persistence): roll back failed state replacements

[seonghobae]

Problem

A failed keyed replacement leaves its DELETE in an open SQLite transaction. A later unrelated save commits that deletion and loses the previous record.

Change

Use the existing SQLite transaction context under the existing writer lock. No schema, dependency, routing default, or numerical formula change.

Evidence

RED: injected SQLite insertion failure reproduces loss of the previous committed record (1 failed).
GREEN at d7bba88: tests/test_persistence.py, 19 passed in 16.38s. Focused unit evidence only; no customer KPI, full-suite, release, or deployment claim.

Stacked on #1107 to preserve its research delta. Runbook contains the reproduction and measurement-boundary rationale. Required reviews and checks remain pending; no bypass requested.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: e283cd4f-6380-49be-bf5a-d001782e361b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Validation receipt for head 877d511: persistence, workflow object authorization, and governance-runtime tests passed together (28 passed in 12.50s). The SQLite rollback test verifies immediate transaction closure and preservation after reopening. This is focused local evidence, not full-suite or security approval.

Ready-for-review did not activate stack verification: authoritative commit statuses say CodeRabbit review is disabled for this base branch and Devin review was skipped for expired trial/no credits. The Actions API returned zero runs for this head. CLEAN merge state therefore is not an approval. Existing stack-CI repair PR #1060 remains the owner of trigger repair; no duplicate workflow or protection bypass was added.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-09T03:32:29.487692Z	4316be8	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[seonghobae]

CI lineage correction: #1060 is the fork predecessor, not the active trusted-branch repair. #1066 (head 59a8f4e) already inherits its stacked-PR trigger and regression-contract delta. Use #1066 for protected delivery, retain #1060 until verified complete inheritance reaches protected main, and do not duplicate either workflow patch in this persistence PR. This corrects the incomplete owner reference in the previous receipt.

[seonghobae]

Additional exact-head diagnostic at 877d511 passed: enabled SQLite foreign keys and added a DEFERRABLE INITIALLY DEFERRED reference to the existing state row. Replacing the referenced row reaches a real commit-time IntegrityError. The transaction context rolled back, the previous record remained, and an unrelated subsequent save succeeded. This complements the committed insertion-failure/reopen regression; it is a separate diagnostic, not yet a committed test. The full suite remains running on the unchanged worktree, so its result is not yet claimed.

[seonghobae]

Validation update: full local suite at 877d511 exited 0: 3396 passed, 2 skipped in 883.03s. Skip reasons were not emitted by this quiet run and skips are not counted as passes. Test-only follow-up 716e012 now commits the real SQLite deferred-constraint commit-failure case previously reported as a standalone diagnostic. Persistence + workflow authorization + governance: 29 passed in 4.89s at that test commit. Runtime code is unchanged. Updated runbook and gap baseline preserve these exact-head distinctions; full suite has not been rerun at the new test head. Independent review, hosted security validation, protected merge and release remain unverified; skipped-review success statuses do not satisfy those gates.