fix(annealing): repair promotion source assignment + autonomous approval

[aaronsb]

Summary

Goal: get annealing proposals to behave as advertised, in their most basic golden-path mode. An investigation of the annealing agent surfaced three issues — two are real defects (fixed here), one is correct behaviour as-is.

Issue 1 — promotions created empty ontologies 🔴 fixed

get_first_order_source_ids() ran a Cypher query that combined a bound variable with an aggregate in a single WITH:

WITH neighbor_sources + collect(DISTINCT s2.source_id) as all_sources

Legal in Neo4j; rejected by Apache AGE — "neighbor_sources" must be either part of an explicitly listed key or used inside an aggregate function. The try/except swallowed it, the function returned [], and every execute_promotion() reassigned zero sources — creating Ontology nodes with no concepts.

Runtime logs confirmed it fired for all four recent promotions:

ERROR get_first_order_source_ids ... Failed ... "neighbor_sources" must be ...

And the graph proved the effect: all 7 Source nodes still SCOPED_BY primordial, the 4 promoted ontologies empty.

Fix: split into two fixed-length queries (the anchor's own sources + its neighbors' sources), unioned in Python. Verified against the live graph — a known anchor now returns 4 primordial-scoped sources where the old query threw.

Issue 2 — autonomous mode still had a raceable "pending" window 🟠 fixed

Auto-approval ran as a post-cycle batch ~30s after proposals were written (each proposal needs an LLM evaluation). During that window proposals sat pending in the UI and a human could approve one first — observed in the logs: one proposal executed triggered_by=admin, the rest triggered_by=annealing_worker, plus a Proposal N not pending — skipping auto-approve warning.

Fix: in autonomous mode the manager now stores proposals already approved (reviewed_by=annealing_worker) — there is no pending window to race. The worker's post-cycle step is dispatch-only (_dispatch_approved_proposals), guarded on status='approved' so a re-run can't double-dispatch. The proposal still passes through the same approved → proposal_execution job lifecycle the manual review endpoint uses. hitl mode is unchanged — proposals are born pending for human review.

Issue 3 — failed demotions ("Ontology no longer exists") 🟡 no change, by design

When a proposal targets an ontology that was already removed (by a sibling proposal or manual edits), execute_demotion() fails gracefully with a clear error and status=failed. That is correct — a real reviewer would not approve a proposal against a missing target, and with autonomous approval working there is no drift to reconcile. No state-reconciliation layer added.

Changes

• api/app/lib/age_client/ontology_edges.py — AGE-safe two-query rewrite of get_first_order_source_ids
• api/app/services/annealing_manager.py — automation_level param; _store_proposal born-approved in autonomous mode
• api/app/workers/annealing_worker.py — pass automation_level to the manager; _auto_approve_and_dispatch → dispatch-only _dispatch_approved_proposals
• tests/unit/services/test_annealing_manager.py — born-approved / born-pending tests

Verification

• 465 unit tests pass (incl. 2 new).
• Issue 1's fixed query run directly against the live AGE graph — returns sources where the old form errored.
• Backend-only — the web admin tab reflects worker/DB state, no UI change needed.

End-to-end (trigger a real annealing cycle and watch a promotion populate an ontology) is worth doing post-merge — it mutates the graph, so left for an explicit run.