feat(server): publish approved Instagram Reels without duplicate retries

[awtprod]

Command Center needs a one-time Instagram Reel action that can survive restarts without publishing twice. This adds an immutable approved account/asset/caption/UTC binding, durable fenced claims and receipts, and GET-only reconciliation when a create or publish outcome is uncertain.

The existing private Instagram provider owns the token. Server-side enablement, persisted approval/session validity, current connection revision, exact local bytes/duration and the actual publication window are checked before effects. The media adapter consumes a private owner-installed verification receipt and signed GET URL, validates asset identity and expiry, and verifies bounded remote bytes/range responses before creating a container. The signed URL never enters the wire contract or durable receipts. Nothing in this PR schedules or publishes a real post.

Dependency order: #126 (migrations 072–077), #127 (lease fencing), then this PR. This PR is stacked on pinned #127 head c56297b64c20872f8ee3a8a88765878a0545b4b8; migration 078 retains its prerequisite guard. Do not merge or deploy the stack before its own required reviews and the human release gate. No changes from the stale provider branch are included.

The first exact-head Prism review found stale recovery rows could starve newer due actions. The executor now prioritizes active actions within the same bounded batch. Four real-SQLite regressions pass, and removing that priority makes all four fail. The next review identified the same starvation risk within GET-only recovery. Recovery now rotates by the existing durable claim generation; six frozen-clock/restart regressions pass and fail when only that ordering is removed. A third validated case showed 25 IN_PROGRESS containers could starve a newer approval. The same durable rotation now applies within both active and recovery groups; a frozen-clock restart regression fails only when active rotation is removed, with all 92 prior tests still passing. The account guard, read budget, fencing and no-retry rule remain intact.

Local validation: 196 tests in seven focused files (including updated dependency observation and inbox adjustment tests) on head dc6822f54ac552e398c56193d66726281ce8b26c, all three affected typechecks, scoped lint/format and the actual server bundle build pass. Negative controls for duplicate identity, account-bound recovery, host identity, remote hash and URL expiry fail substantively when their guards are removed; all guards are restored. The deployed database baseline 069 is also covered by two additional real-migrator cases. CI initially exposed missing FFmpeg in the ephemeral server-test runner; the workflow now installs that test dependency without changing permissions, runners, existing test commands or gates. The current combined tree includes PR127 main-integration head c56297b and PR126419dd75d. Git tree comparison proves application code/tests are identical to the previously CI-green, Prism-clean head1c816404e2; only the operations dependency pin changed. Final exact-head CI passes on dc6822f, and its published Prism review reports no concrete defects with complete19-filecoverage. Formal promotion and the human release gate remain. All three historical finding threads are resolved with verified fix evidence. Focused tests cover fake Instagram, durable SQLite, real clock boundaries, restart recovery, uncertainty, duplicate prevention, authority and media-provider negatives; formal dependency promotion and the human release gate still control deployment.

The requested April Reel remains NOT SCHEDULED. Production installation and restart require the parent's existing authorized owner route. Caption approval and a durable action receipt remain separate from this code review.

Implemented and reviewed with Codex gpt-6.1-sol through the Codex harness and Ringer.

[awtprod]

gpt-6.1-sol responding on behalf of Andrew: @coderabbitai review

Please review exact head 25c8800fe0fc586087c64b73a7089c92fa6cf832 against the pinned PR127 base. This is the requested draft review; no merge or production effects are authorized by this comment. Focus on immutable approval binding, atomic duplicate prevention, uncertain-outcome/restart reconciliation, private receipt-backed media validation, and migration 078 ordering.

[awtprod]

gpt-6.1-sol responding on behalf of Andrew: @codex review

Please review exact head 25c8800fe0fc586087c64b73a7089c92fa6cf832 against the pinned PR127 base. This is the requested draft review; no merge or production effects are authorized by this comment. Focus on immutable approval binding, atomic duplicate prevention, uncertain-outcome/restart reconciliation, private receipt-backed media validation, and migration 078 ordering.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.9 KiB	13.9 KiB	−3 B (−0.0%)	15.6 KiB	✅
Codex	Thread snapshot wire	7.4 KiB	7.5 KiB	+4 B (+0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.5 KiB	−7 B (−0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.7 KiB	55.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	8	8	0 (0.0%)	21	✅
Claude	Total thread wire	13.9 KiB	13.9 KiB	−1 B (−0.0%)	15.6 KiB	✅
Claude	Thread snapshot wire	7.5 KiB	7.5 KiB	−4 B (−0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.5 KiB	+3 B (+0.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.6 KiB	56.6 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	8	8	0 (0.0%)	21	✅

Baseline: b58646a · PR result: c781dd3 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.1 KiB
• Claude decoded thread snapshot: 113.9 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[awtprod]

gpt-6.1-sol responding on behalf of Andrew: @codex review

Please review exact head dbc7b9fdf8a116551dc31840d507f388d9d07f26 against the pinned PR127 base. This is the requested draft review; no merge or production effects are authorized by this comment. Focus on immutable approval binding, atomic duplicate prevention, uncertain-outcome/restart reconciliation, private receipt-backed media validation, and migration 078 ordering.

[awtprod]

gpt-6.1-sol responding on behalf of Andrew: @coderabbitai review

Please review exact head dbc7b9fdf8a116551dc31840d507f388d9d07f26 against the pinned PR127 base. This is the requested draft review; no merge or production effects are authorized by this comment. Focus on immutable approval binding, atomic duplicate prevention, uncertain-outcome/restart reconciliation, private receipt-backed media validation, and migration 078 ordering.

[awtprod]

gpt-6.1-sol responding on behalf of Andrew: @coderabbitai review

Please review exact head 9b3fd34ed73f199ca29f62e979311e6d69f5ab0e after the latest dependency integration. PR128 is now ready for review.

[awtprod]

gpt-6.1-sol responding on behalf of Andrew: @codex review

Please review exact head 9b3fd34ed73f199ca29f62e979311e6d69f5ab0e after the latest dependency integration. PR128 is now ready for review.

[github-actions]

Prism Review

Semantic validation confirmed 1 concrete finding(s).

Complete diff-line coverage: 3209/3209 changed lines across 19/19 files and 33 complete hunks. Security/tenant pass: 1374/1374 eligible lines. Security-boundary recall pass: 378/378 eligible lines. 12 discovery and 1 semantic-validation model requests.

[awtprod]

gpt-6.1-sol responding on behalf of Andrew: Confirmed against source and fixed in 25d4d2476d76788f5d8465bd7b7ff9277aa84976. Active approved/processing states are prioritized before guarded recovery within the unchanged 25-row budget. Four regressions cover 25 stale uncertain/published rows and a newer approved/processing action; removing only the priority fails all four. Account revision checks, receipt state and read budgets remain intact. Fresh CI and Prism gates are required.

[awtprod]

gpt-6.1-sol responding on behalf of Andrew: @coderabbitai review @codex review

Final combined head 6fa635455a1124155c172d473ecd7f92f03e0be9 now includes current PR12625e0f1793f and PR12771e1e2bb0e. The verified Prism starvation correction is retained; migration078 prerequisites, no-retry guards and private provider authority remain intact. Fresh exact-head CI and Prism reviews are required before release.

[github-actions]

Prism Review

Semantic validation confirmed 1 concrete finding(s).

Complete diff-line coverage: 3266/3266 changed lines across 19/19 files and 33 complete hunks. Security/tenant pass: 1374/1374 eligible lines. Security-boundary recall pass: 378/378 eligible lines. 12 discovery and 1 semantic-validation model requests.

[awtprod]

gpt-6.1-sol responding on behalf of Andrew: Confirmed recovery starvation and corrected in f0690b54592479dce6e1f74e6b28562c82a40370. Recovery uses existing durable lease_generation ordering after active priority, preserving LIMIT25 and account/read-budget/fencing guards. Six real-SQLite frozen-clock restart regressions pass; removing only recovery ordering fails all six while active priority tests pass. This combined tree includes current PR126419dd75d and PR127558d6c8c. Fresh exact-head CI and Prism review are required.

[github-actions]

Prism Review

Semantic validation confirmed 1 concrete finding(s).

Complete diff-line coverage: 3354/3354 changed lines across 19/19 files and 33 complete hunks. Security/tenant pass: 1374/1374 eligible lines. Security-boundary recall pass: 378/378 eligible lines. 12 discovery and 1 semantic-validation model requests.

[awtprod]

gpt-6.1-sol responding on behalf of Andrew: Verified the active IN_PROGRESS batch finding and corrected in 1c816404e286f72475441914bd3a73db5052eebf. Existing lease_generation now rotates rows within both active and recovery groups, retaining active priority, all filters and LIMIT25. The new real-SQLite frozen-clock restart regression reaches the 26th approved action before cutoff while25oldercontainers remain IN_PROGRESS. Removing only active rotation makes exactly that regression fail;92prior tests pass. Full combined local suite196passes; fresh exact-head CI and Prism are required.

[github-actions]

Prism Review

No concrete defects were found by the completed review passes.

Complete diff-line coverage: 3412/3412 changed lines across 19/19 files and 33 complete hunks. Security/tenant pass: 1374/1374 eligible lines. Security-boundary recall pass: 378/378 eligible lines. 12 discovery and 0 semantic-validation model requests.

[github-actions]

Prism Review

No concrete defects were found by the completed review passes.

Complete diff-line coverage: 3412/3412 changed lines across 19/19 files and 33 complete hunks. Security/tenant pass: 1374/1374 eligible lines. Security-boundary recall pass: 378/378 eligible lines. 12 discovery and 0 semantic-validation model requests.

[github-actions]

Prism Review

No concrete defects were found by the completed review passes.

Complete diff-line coverage: 3412/3412 changed lines across 19/19 files and 33 complete hunks. Security/tenant pass: 1374/1374 eligible lines. Security-boundary recall pass: 378/378 eligible lines. 12 discovery and 0 semantic-validation model requests.