fix(ah): bound custody maintenance and preserve recovery

[MadMaxMangos]

Summary

Harden auction custody maintenance and integrate the conservation recovery checkpoint with current master.

• Reconcile custody against an indexed database snapshot, distinguishing player seller/bid custody, legacy listings, and bot materialization markers.
• Gate automatic custody maintenance, cap diagnostic/repair detail output, and drain orphan materializations in checked batches of at most 100 rows. Retry remaining backlog on the shorter maintenance cadence.
• Preserve item and gold reservations when finalization or reconnect recovery cannot complete. Refund the actual rejected-sell deposit and displaced player bids, validate complete worker journal results, and distinguish absent rows from database errors.
• Accept validated bot markers during terminal item preflight and use auction-scoped bid reads instead of scanning the entire reserved ledger.
• Protect held sale escrow from orphan cleanup, and preserve a buyer's relisted cached item when retiring its old bot marker.
• Restore and extend the existing in-process regression tests, including rollback, retry, bot delivery, and bounded backlog recovery.

Verification

• Windows VS 2026 x64 RelWithDebInfo build and install passed; executable, PDB, and runtime dependency hashes matched.
• All 17 targeted mangosd suites passed: commit, custody, ahowner, ahusabilityref, ahbrowsehelper, ahbrowsepending, ahmutpending, ahforwardreserve, ahrelease, ahmutresult, ahresolve, ahrepair, ahcustodyroute, ahreconcile, ahreconcileabort, ahmaterialize, ahbotterminal.
• Worker self-tests passed, including configured-database journal tests and IPC loopback.
• The integrated conservation checkpoint at 0c00c487 passed a live two-character check: list, bid, normal mangosd restart, buyout, cancellation, item delivery, and bidder refund. The final orphan-cleanup guards were verified by the targeted regressions below, not a repeat in-game smoke.
• Final dry-run repair reported confirmed=0 pending=0 sweep-owned=0 repaired=0 skipped=0 failed=0; no live auctions or reserved custody rows remained.
• The held-sale and relisted-item regressions failed with the expected escrow-loss assertions before the final guards, then passed afterward; all 17 targeted suites were rerun successfully.
• A local synthetic MariaDB check with 65,000 live auctions and 20,000 old markers kept candidate selection below 90 ms, used idx_auction for the reservation lookup, excluded held sales, and retained the 101-candidate limit (100 rows plus backlog detection). This is local test evidence, not a production latency guarantee.
• The maintenance hotfix series was previously exercised on two public test realms with approximately 65,000 live auctions each. That field evidence applies to the maintenance series; the integrated conservation changes were validated separately by the local tests above.
• Claude Opus 5 at max effort completed a full production/test diff review and a focused re-review of the reproduced fixes: APPROVE, no blocking or important findings remaining.

Scope and Compatibility

• Server repository only. No new database migration or submodule pointer changes.
• AH service, custody, and write-authority configuration defaults remain off.
• Durable coordinator-journal reconstruction and DB-backed escrow loading remain separate follow-up stages.
• Known, pre-existing edge case: collecting mail gold near the character gold cap can clip the amount credited. The AH payout was correct before collection; this unchanged shared-mail behavior was explicitly accepted as non-blocking and is not fixed here.

Review Follow-Up (060be973)

• Recover a valid COMMITTED cancel from the worker's unchanged PREPARED envelope; retain strict identity checks and hold ambiguous APPLIED/aborted records.
• Require positively established auction absence before repair may mutate custody.
• Distinguish failed orphan-candidate queries from drained batches so database failures retain the one-minute retry cadence.
• Initialize all copied finding fields, restore the full standard header on both new reconciler files, and replace the undeclared POSIX exit call with standard C++ std::_Exit.
• All three recovery regressions reproduced before the fixes and passed afterward. All 17 targeted suites passed again; targeted Cppcheck reproduced the original uninitialized-member finding and is clear after the fix.
• Final Windows build/install and deployed revision verified; live configuration unchanged. Claude Opus 5 max approved with follow-up; the remaining Linux/Docker CI verification is pending on this commit.

Latest Review Fixes (5f984f2b)

• Destructive mangosd -t modes now require --allow-destructive-tests, checked before database startup. Use only a disposable database configuration; incompatible service/daemon combinations are rejected.
• Initialize custody presence once at boot, bypass per-auction SQL on a known-empty realm, and latch routing on when reservations are queued. Existing custody continues to settle after runtime disable; unknown DB state fails closed.
• Both service and in-process generated bids use the existing custody co-commit transaction when needed. Player refunds, ledger settlement, auction changes and buyout effects commit together; rollback restores the live bid. No owner-zero gold reservation is created.
• All 18 targeted suites passed, including no-SQL routing, disabled-config/restart retention, bot outbid followed by expiry, and failed bot-buyout rollback plus retry. Worker configured-DB self-tests and final Windows build/install passed.
• Claude Opus 5 max approved with follow-up. Its schema question is confirmed: the required character structure 22/5 is introduced by Rel22_05_001_Add_Custody_Ledger_Table.sql; absence of that table is not a supported legacy schema.
• GitHub CI and Codex review are being followed on this exact head. No database migration, submodule update, or live config change is included.

Terminal Deposit Follow-Up (8b1d55dc)

• Require matching RESERVED seller deposit custody before terminal player WON, EXPIRED_NOBID and terminal REPAIR_RETURN settlement. Missing or mismatched deposits hold all value and the resolution marker for retry.
• Preserve deposit-less bot materializations, refund-only repair, and cancellation unlock behavior.
• Six missing/mismatched-deposit cases failed before the fix and pass afterward, including restored-deposit retry and duplicate suppression. All 18 focused mangosd suites passed again on a disposable database.
• Claude Opus 5 max approved the focused delta with no blocking or important findings. Final Windows build/install, exact deployed revision and executable/PDB hashes were verified; live configs remain unchanged.
• GitHub Codex completed its review of 8b1d55dc at 17:43 UTC on 2026-09-08 with no new findings and a clean approval reaction. GCC, Clang and style/static checks passed; Windows, Docker and AppVeyor were still pending or running at this checkpoint. No new migration or submodule change.

---

This change is 

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-08T17:43:05.571519Z	8b1d55d	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 154 complexity · 2 duplication

Metric	Results
Complexity	154
Duplication	2

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 62b5b589cb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[AppVeyorBot]

✅ Build Mangos ZERO Server 22.04.481-jlrxumaq completed (commit 49a19de3d1 by @MadMaxMangos)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 060be97386

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[AppVeyorBot]

✅ Build Mangos ZERO Server 22.04.481-pykuegqk completed (commit 34b8354c09 by @MadMaxMangos)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5f984f2b7c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[AppVeyorBot]

✅ Build Mangos ZERO Server 22.04.481-ithlicfq completed (commit 660f701cd9 by @MadMaxMangos)

[AppVeyorBot]

✅ Build Mangos ZERO Server 22.04.481-hieguxos completed (commit 09e2ead0fc by @MadMaxMangos)