fix(queue): upgrade legacy retry members atomically

[Joncallim]

Source Issue

Issue: #179

Summary

• Selects due retry members and their exact score snapshots through a bounded Redis-time Lua scan.
• Preserves current occurrence envelopes and atomically upgrades valid legacy task, approval, and answers retries into the closed versioned occurrence envelope.
• Gives every exact retry member and score snapshot an opaque, domain-separated, length-prefixed SHA-256 disposition identity.
• Uses bounded per-queue HASH/ZSET receipts so concurrent canonical, legacy, and poison promotion has one applied transition and exact replay success without scanning the ready list.
• Atomically discards invalid retry members without copying raw or decoded arbitrary fields to any queue sink, then continues to later valid work.

Receipt authority

• Source-absent replay reads both the exact fingerprint's HASH disposition and ZSET timestamp.
• Replay succeeds only when both sides exist, the disposition is exactly discarded or promoted:<canonical UUID>, and the finite Redis timestamp is not future-dated and is strictly within the 15-minute receipt window.
• Canonical occurrence replay is winner-bound: the receipt winner must equal the occurrence ID in the scanned candidate. A mismatch fails with the fixed fatal category receipt_integrity_failure; it is never treated as a compatibility conflict or successful replay.
• A winner mismatch is mutation-free. The coherent HASH and ZSET receipt pair is preserved, and no ready-queue destination is created.
• Matching canonical replay and legitimate legacy first-winner replay remain accepted.
• Hash-only, index-only, expired, future-dated, non-finite, malformed, unknown, or invalid-UUID receipts fail closed. Exact inconsistent target pairs may be removed with bounded HDEL/ZREM without touching neighboring receipts.
• An expired target is rejected directly even when 100 older expired receipts consume the global bounded pruning budget.
• A source-present snapshot plus any receipt-side state is an impossible ownership state and fails closed without overwriting the source or receipt.
• Existing exact source and score atomicity, Redis server-time receipt creation, bounded pruning and capacity, opaque storage, poison handling, and no-LPOS/LRANGE replay inference remain intact.

Validation

• Integrated focused queue, attempt, and output-contract tests: 25/25 passed.
• Disposable Redis queue proof: 3/3 passed with:
  • QUEUE_OCCURRENCE_REDIS_MULTIPLICITY_OK
  • QUEUE_OCCURRENCE_REDIS_RECOVERY_OK
  • QUEUE_OCCURRENCE_REDIS_SHUTDOWN_OK
• Exact nine-file scope:
  • docs/operator-guide.md
  • web/__tests__/core-diagnostic-output-closure.test.ts
  • web/__tests__/queue-occurrence-recovery.redis.test.ts
  • web/__tests__/task-attempts.test.ts
  • web/app/dashboard/tasks/[id]/page.tsx
  • web/db/schema.ts
  • web/worker/queue.ts
  • web/worker/runtime.ts
  • web/worker/task-attempts.ts
• A confirmed retry transition closes the failed attempt with the exact Redis-authored deadline. If one bounded identical replay is still inconclusive, the attempt closes as indeterminate, retains only the safe business error, records completion, leaves the next retry unknown, emits a warning, and shows “Retry status unknown”.
• The mixed-version deployment contract still requires old v2 workers to be stopped and drained before the new workers start. This change does not prove a production mixed-binary rollout.
• ESLint, npx tsc --noEmit, production build, migration and cutover checks, and the pull-request whitespace gate passed.

Hosted exact-head evidence

All required checks passed on integrated head d3cc2c24938bef5820890176a8aa4bc733a1c122:

• Web CI run 30392054423, job 90385814688: 114/114 unit-test files and 1,699/1,699 unit tests passed with zero skips. The real Redis queue proof passed 3/3 with all three markers above.
• Mandatory PostgreSQL S4 proof: 14/14 passed with zero skips and all three protected scrub markers.
• Mandatory Redis scrub proof: 3/3 passed with zero skips and all three scrub markers.
• Mandatory Redis ACL proof: 3/3 passed with zero skips and all three ACL markers.
• S3 concurrency: 16/16 passed. Disabled ingress: 1/1 passed. End-to-end: 17 passed with 59 expected skips. Production build completed all 39 static pages.
• PR Contract run 30392054192, job 90385814110: passed with Source Issue [FEATURE] S4 — Specialist prompt and bounded context packet assembly with run evidence #179 found.
• GitGuardian check 90385804177: passed.

This is exact-head evidence for this pull request. It does not claim that all Issue #179 criteria are complete, nor that a production rollout or mixed-binary deployment has occurred.

Stack boundary

This draft targets codex/pr198-producer-5a2-core-diagnostics at parent head f589d99852441705b93e169ed3798064a6995891. R3B, R3C, and R3D remain out of scope until this child is reviewed and progressively merged.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dbdd43c348

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 279801f5cf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c74d427529

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".