External-source idempotency conflicts storm for ~40 s after a scoped observation reset

[ScriptedAlchemy]

Observed

Surfaced while root-causing observation_reset_recovery_test on #707 (tip 15ee56ae5). After the scoped observation-authority reset and daemon reopen, the daemon log shows one

observation repository provenance collision (authority_write_failed)

followed by

registered external-source commit failed error=external source idempotency key conflicts with a prior command (external_source_commit_failed, retryable)

every ~1.5 s for ~40 s before the retained temporal authority converges. With the test's 24-rollout fixture the first describe after reopen takes 30–42 s; a 240-rollout trial took ~6 min. The retry storm dominates recovery time.

Suspected cause

reset.rs clears the authority/projection tables, anchors and cursors (same class as 73072ebe5 / c4c025fd5) but the external-source receipt journal survives the scoped reset, so the replaced-identity transcript conflicts with prior idempotency keys on re-admission and is retried on a fixed cadence until the journal window passes.

Expected

Re-admission after a scoped reset should either scope the idempotency journal to the reset (clear it with the authority it describes) or recognise the replaced identity as a supersession rather than a conflict. Fix the cost, not the retry cadence or the test fixture (AGENTS.md: limits are symptoms).

Repro

cargo nextest run -p tracedecay-cli --test core_cli_suite -E 'test(observation_authority_reset_recovers_the_retained_temporal_authority)' with daemon logs captured; the test passes but its ~60 s runtime is this storm.

Related: converging-state mapping converging_projection_unavailable (e4760ea22) is no longer exercised through the CLI since 40c78417d rides out after-delay refusals; a deterministic session-runtime-level test is the right home for it.

[ScriptedAlchemy]

Fixed on #707 by 5bb8de9 (merged at 3473b1f): the scoped observation reset now retires the host-observation receipt journal with the stream it attested, so re-admission is a one-pass rebuild. Recovery journey 60 s → 13 s; store-level test proves zero leftover receipts and no idempotency conflict. Closing when #707 CI is green on the tip.

[ScriptedAlchemy]

Fixed by 673914348, integrated into #707 through #1162 (9c3a3001c). The original daemon retry storm is covered directly: RED cc-12524 failed on a real provenance collision; GREEN cc-12570 passed the unchanged 24-rollout CLI reset/reopen journey in 20.77 seconds total, with the original 120-second bound. That duration includes baseline and ordinary reopen, not just reset.

The passing test checks both actual daemon stderr logs after shutdown and rejects any provenance collision, idempotency-key conflict, authority_write_failed, or external_source_commit_failed. It also verifies preserved LCM content, recovered searchable sessions, nonzero generation, complete/current doctor status, successful explicit import, and rebuilt scheduling cursors. Writer regressions cc-12576 passed 18 tests and retain genuine conflict refusals. This closes the reset retry-storm defect; #843 remains open for the separate real-profile admission/LCM latency work.