fix(ship): bind recovered pull requests before review

[coreplane-switchboard]

Ship now records one complete publication authority before any newly opened pull request reaches review. That keeps later findings work on the original unit, branch, and owner instead of failing at the publication fence.

Why: A recovered PR could advance with only its number persisted, so an ordinary request-changes verdict later failed at #2341. This is the bounded new-PR repair after #2342; retained-unit recovery remains separate under #2265.

Where to look

1. Publication binding gate validates the live repository, branch, base, full head SHA, and PR before creating authority. ⚠ A false positive could authorize the wrong publication target.
2. Recovered-open path re-reads remote facts and durably binds the PR before returning it to review.
3. Full-row compare-and-replace makes the PR and publication binding visible atomically or rejects stale state.
4. Production-shaped recovery proof opens a salvaged PR and asserts its exact durable owner and head before review.
5. Fail-closed matrix proves refused or unknown ownership and stale storage leave no partial PR-only row.
6. Durable-store CAS proof verifies a complete binding wins once and a stale PR-only write is rejected.

Feedback wanted: Check that ownership acquisition, full-row CAS, and conditional release form one fail-closed transition across every ordinary PR-discovery path.

Risk: A mistake can block review or authorize later coding against stale PR facts. This is about 550 changed lines; storage and coordinator changes stayed together because splitting them would leave the atomic contract temporarily unproved. Roll back this commit to restore the prior guard behavior.

Verified: 563 dispatcher tests and scoped format, type, hygiene, and spec checks passed; exact-head review is approved. all current-head CI passed, including the recovered memory-worker job.

Decisions (3)

• Bind before review. Returning an optimistic open result was rejected because later review findings require durable authority that already names the exact PR and head.
• Replace the complete row. Separate PR and publication writes were rejected because crashes or stale writers could expose a partial row.
• Keep retained-unit recovery out. This repair prevents new incomplete bindings; reconstructing ended original units and moved-head review authority remains a separate Router treats ship checkpoint continuation as plane command #2265 contract.

Validation (6 criteria)

Criterion	Proof
Recovered PR facts are bound before review starts	src/channels/adminCoordinator.test.ts::a completed child's production read-record view carries its observed final head, so same-head salvage opens the pull request and enters review
Request-changes starts findings work under the original unit binding	Same production-shaped test above, including the review verdict and findings spawn
Mismatched repo, PR, ref, base, head, or incomplete SHA fails closed	src/channels/adminCoordinator.test.ts::ordinary open pull-request binding refuses every incomplete or mismatched remote fact without starting review
Rival/unknown ownership, stale CAS, and unavailable storage leave no PR-only row	src/channels/adminCoordinator.test.ts::a refused ownership claim, an unknown fence, a stale row and an unavailable store all release only this attempt's owner and store no PR-only row
Exact replay is idempotent	src/channels/adminCoordinator.test.ts::the exact publication binding replays idempotently without releasing the retained owner
Durable storage rejects a stale partial replacement	deploy/cloudflare-memory/runLedger.test.ts::the full-row CAS atomically binds an ordinary open pull request and rejects a stale PR-only write

For agents

This PR covers only ordinary newly discovered PRs. Do not infer support for CLI#113, Switchboard#2338, nominal#3589, nominal#3680, generic Ship reissue, moved-head review, or any replacement instance/unit/ref.

[coreplane-switchboard]

LGTM: The durable publication binding is now established atomically and fail-closed before review or findings work begins.

Note

Approved · head cd141bb · no findings

Full review

No findings. The atomic publication-binding transition and whole-path regression coverage satisfy the contract.

[github-actions]

Auto-approved: coreplane-switchboard[bot] reviewed this PR and posted an LGTM verdict (see its review). This repository opted in through its REVIEW_BOT_LOGIN and REVIEW_BOT_ID variables.