Mutation cursor external taint - #245

Establish the worktree-local filesystem boundary needed to detect interrupted mutation-cursor runtime sections before the coordinator wires it into the full boundary. `ExternalTaintMarker` uses an empty `<git-dir>/sce/mutation-cursor-tainted` file whose existence is the state, with synced creation, idempotent clearing, and worktree-scoped paths. Add the runtime context and record plan `mutation-cursor-external-taint` task T01 as complete; coordinator integration remains follow-up work.

Co-authored-by: SCE <[email protected]>

Prevent failures during Agent Trace DB acquisition and the protected mutation-trace boundary from losing the worktree-local durability signal. Reshape `coordinate()` to accept a DB provider, arm the marker after acquiring the worktree lock and before checkout identity or DB access, clear it only after success, and report marker and DB-provider failures explicitly.

Add end-to-end coverage for success, failure, and fail-closed marker arming, and document the fence ordering and concrete marker refinement.

Plan: mutation-cursor-external-taint (T02)

Co-authored-by: SCE <[email protected]>

Update the sync test fixture to return terminal stream counts and assert that only messages trigger one ingestion batch request. This verifies terminal statuses do not resend batches.

Co-authored-by: SCE <[email protected]>

Map an inherited external-taint marker onto `database_failure` for each freshly loaded projection so recovery rebaselines against the already captured tree, retries losing recovery CAS operations without recapturing, and clears the pending overlay once recovery lands. Add focused pipeline coverage for first-use recovery and boundary retries, and document the recovery lifecycle and completed task.

Plan: mutation-cursor-external-taint (T03)

Co-authored-by: SCE <[email protected]>

Exercise external-taint marker fencing and conservative recovery through coordinate() so DB-open, snapshot, stale-marker, linked-worktree, and clear-failure paths cannot emit untrusted mutation evidence. Record the completed integration coverage for T04.

Plan: mutation-cursor-external-taint (T04)

Co-authored-by: SCE <[email protected]>

…ests

Keep the external-taint marker armed after a durable boundary when cleanup fails, while returning the committed CoordinateOutcome so mutation events remain available. Add recovery-transition coverage and document the pre-commit and post-commit failure semantics. Make the malformed batch response test deterministic by seeding only the messages stream and asserting the exact reconciliation request order.

Co-authored-by: SCE <[email protected]>

Identify the triggering Advance by its scope and event key, then verify that
recovery does not mark that boundary event as processed after a failed
invocation. Record the tightened AC8 validation in the
mutation-cursor-external-taint plan.

Co-authored-by: SCE <[email protected]>