fix(rectification): address task 7 review findings

tests/test_conversational_rectification_contract.py

@@ -246,6 +246,58 @@ def test_account_resume_projection_contains_private_working_state_only_for_servi
     assert "private_candidate" not in public_projection
 
 
+def test_historical_action_replay_is_owner_scoped_exact_bounded_and_read_only() -> None:
+    schema = _normalized(SCHEMA)
+    transitions = _normalized(TRANSITIONS)
+    request = _function(schema, "conversational_rectification_valid_action_request")
+    replay = _function(
+        transitions, "replay_conversational_rectification_action"
+    )
+
+    assert "'commandfingerprint'" in request
+    assert "requestfingerprint" in request
+    assert "^[0-9a-f]{64}$" in request
+    for invariant in (
+        "r.user_id = p_user_id",
+        "r.case_id = p_case_id",
+        "r.action_id = p_action_id",
+        "v_receipt.action_kind is distinct from p_action_kind",
+        "v_receipt.expected_turn_version is distinct from p_expected_version",
+        "not (v_receipt.request ? 'commandfingerprint')",
+        "v_receipt.request ->> 'commandfingerprint' is distinct from p_command_fingerprint",
+        "return v_receipt.response",
+        "raise exception 'conversational_action_conflict'",
+    ):
+        assert invariant in replay
+    assert "insert into" not in replay
+    assert "update public." not in replay
+    assert "delete from" not in replay
+    assert (
+        "revoke all on function public.replay_conversational_rectification_action"
+        in transitions
+    )
+    assert (
+        "grant execute on function public.replay_conversational_rectification_action"
+        in transitions
+    )
+    assert not re.search(
+        r"grant execute on function public\.replay_conversational_rectification_action"
+        r".+?to (?:anon|authenticated)",
+        transitions,
+    )
+
+    for name in (
+        "save_conversational_rectification_turn",
+        "pause_conversational_rectification_case",
+        "abandon_conversational_rectification_case",
+        "confirm_conversational_rectification_candidate",
+    ):
+        body = _function(transitions, name)
+        assert "p_command_fingerprint text" in body
+        assert "p_command_fingerprint !~ '^[0-9a-f]{64}$'" in body
+        assert "'commandfingerprint', p_command_fingerprint" in body
+
+
 def test_start_identity_and_account_concurrency_are_server_guarded() -> None:
     schema = _normalized(SCHEMA)
     transitions = _normalized(TRANSITIONS)

tests/test_conversational_rectification_postgres_runtime.py

@@ -328,6 +328,7 @@ def _save_statement(
     turn: dict[str, object] | None = None,
     validation_receipt: dict[str, object] | None = None,
     private_candidate: dict[str, object] | None = None,
+    command_fingerprint: str | None = None,
 ) -> str:
     next_turn = turn or {
         **_valid_turn(case_id),
@@ -342,7 +343,8 @@ def _save_statement(
       {_jsonb(next_turn)},
       {_jsonb(evidence)},
       {_jsonb(validation_receipt or {"modelId": "synthetic-model", "schemaValidated": True})},
-      {_jsonb(private_candidate or _valid_private_candidate())}
+      {_jsonb(private_candidate or _valid_private_candidate())},
+      {"null" if command_fingerprint is None else _text(command_fingerprint)}
     )::text;
     """
 
@@ -483,6 +485,84 @@ def test_valid_declared_birth_input_round_trips_across_account_load(pg14_databas
     assert loaded["declared_birth_input"] == declared
 
 
+def test_historical_receipt_replays_exact_public_response_after_later_turns(
+    pg14_database: PgDatabase,
+) -> None:
+    user_id = "00000000-0000-4000-8000-000000000943"
+    case_id = "00000000-0000-4000-8000-000000000944"
+    first_action = "00000000-0000-4000-8000-000000000945"
+    later_actions = (
+        "00000000-0000-4000-8000-000000000946",
+        "00000000-0000-4000-8000-000000000947",
+    )
+    first_fingerprint = "a" * 64
+    _create_user(pg14_database, user_id)
+    _reserve(pg14_database, user_id, case_id)
+    _create_case(pg14_database, user_id, case_id, _valid_declared_birth_input())
+    _complete(pg14_database, user_id, case_id)
+
+    original = json.loads(pg14_database.sql(_save_statement(
+        user_id,
+        case_id,
+        0,
+        first_action,
+        [],
+        command_fingerprint=first_fingerprint,
+    )))
+    for version, action_id in enumerate(later_actions, start=1):
+        pg14_database.sql(_save_statement(
+            user_id,
+            case_id,
+            version,
+            action_id,
+            [],
+            command_fingerprint=str(version) * 64,
+        ))
+
+    replayed = json.loads(pg14_database.sql(
+        f"""
+        select public.replay_conversational_rectification_action(
+          '{user_id}'::uuid, '{case_id}'::uuid, 0, '{first_action}'::uuid,
+          'save_turn', '{first_fingerprint}'
+        )::text;
+        """
+    ))
+    assert replayed == original
+    assert replayed["turn_version"] == 1
+    assert replayed["latest_turn"]["turnVersion"] == 1
+    assert pg14_database.rejects(
+        f"""
+        select public.replay_conversational_rectification_action(
+          '{user_id}'::uuid, '{case_id}'::uuid, 0, '{first_action}'::uuid,
+          'save_turn', '{'b' * 64}'
+        );
+        """
+    )
+
+    privileges = json.loads(pg14_database.sql(
+        """
+        select pg_catalog.jsonb_build_object(
+          'anon', pg_catalog.has_function_privilege(
+            'anon',
+            'public.replay_conversational_rectification_action(uuid,uuid,bigint,uuid,text,text)',
+            'EXECUTE'
+          ),
+          'authenticated', pg_catalog.has_function_privilege(
+            'authenticated',
+            'public.replay_conversational_rectification_action(uuid,uuid,bigint,uuid,text,text)',
+            'EXECUTE'
+          ),
+          'serviceRole', pg_catalog.has_function_privilege(
+            'service_role',
+            'public.replay_conversational_rectification_action(uuid,uuid,bigint,uuid,text,text)',
+            'EXECUTE'
+          )
+        )::text;
+        """
+    ))
+    assert privileges == {"anon": False, "authenticated": False, "serviceRole": True}
+
+
 def test_database_rejects_oversize_or_unknown_durable_json(pg14_database: PgDatabase) -> None:
     user_id = "00000000-0000-4000-8000-000000000951"
     action_id = "00000000-0000-4000-8000-000000000952"