fix(project-registration): stabilize guarded replays

[andrei-hasna]

Summary

• stores the accepted guarded-update result digest in the immutable receipt inside the existing transaction
• replays forward and rollback results from the accepted receipt instead of recomputing reference-derived digests from live state
• adds local-authority and HTTP regressions proving byte-stable accepted payloads after supported reference mutations

Lineage

• Todos task: 2078fa59-6d9e-40fd-b0d9-efdb211892a1
• PR fix(project-registration): expose guarded update authority #73 was merged externally before fixed reviewer Hilbert returned GO; that merge is process evidence only and is not reused as an accepted review gate
• Candidate head: 2700c61ad43bad6e1b01d9a766caa671d3fc3630
• Candidate base: a7ca9932355532744866d8a9c41856f6d2430e56
• Candidate tree: 41aebc9edcffef99127fbf7189de7611ed739d56
• Fixed reviewer: Hilbert, focused only on the named replay defect and direct regressions

Verification

• focused authority/HTTP regression: 17 pass, 0 fail, 110 expectations
• authority/HTTP/server routes: 19 pass, 0 fail, 116 expectations
• adjacent guarded-update/schema: 6 pass, 0 fail, 178 expectations
• full suite: 2527 pass, 0 fail, 6600 expectations across 183 files
• bun run typecheck
• bun run contracts:conformance
• bun run contracts no-cloud-scan .
• bun run build
• bun run scan-artifact: 549 members scanned, 0 excluded, 0 unreadable
• staged security review: no issues
• pre-push secret scan: 1 commit scanned, exit 0

Package version remains 0.14.81. Tag, publish, install, and production mutation remain stopped pending Hilbert's focused GO.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #74 @ 2700c61 — lens: correctness+security+gates, reviewer Trebius (1 of 1)

Reviewed the full diff from freshly fetched base a7ca993 through the exact head, plus surrounding receipt creation/storage, guarded update and rollback transactions, public record digest construction, HTTP routing/client serialization, result types, reference-count behavior, and all changed tests.

Commands and exact results:

• git log --oneline origin/main..HEAD — exit 0; one commit: 2700c61 fix(project-registration): stabilize guarded replays.
• git diff origin/main...HEAD --stat — exit 0; 4 files changed, 103 insertions, 11 deletions.
• bun install — exit 0; setup completed, 231 packages installed. This is setup, not the repository test gate.
• bun run typecheck — exit 0; tsc --noEmit emitted no pass/fail count.
• bun run test — exit 0; 2527 pass, 0 fail, 6600 expect() calls; 2527 tests across 183 files.

Blocking P0/P1 findings: none.

The receipt-bound digest makes accepted forward and rollback replays stable when supported project references change without changing the guarded project row. Revision, target identity, immutable receipt, compare-and-swap, rollback receipt matching, response bounds, and private-path non-disclosure remain enforced on reachable local and HTTP paths.

Non-blocking follow-ups: none.