feat: support completion decision corrections

[seonghobae]

Summary

• accept an optional supersedes_decision_id on completion decisions
• validate the predecessor belongs to the same tenant, learner, and registration
• persist a new immutable decision and emit completion_decision.corrected
• extend the exact-head PostgreSQL/API smoke path and operational documentation
• add explicit PRD, TRD, UML, and ADR-0003 traceability for the correction contract

Evidence

• cargo +1.97.1 fmt --all -- --check
• cargo +1.97.1 test --workspace --all-targets --locked
• cargo +1.97.1 clippy --workspace --all-targets --locked -- -D warnings
• RUSTDOCFLAGS='-D warnings' cargo +1.97.1 doc --workspace --no-deps --locked
• actionlint, git diff --check, and the required-doc contract
• real PostgreSQL 18.4 API run with a NOSUPERUSER role: two linked decisions, invalid predecessor 400, three exported audit events, and direct cross-tenant RLS reads returning zero

The PR is intentionally unmerged until an independent current-head review and all live protected checks succeed.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 07205d44-f557-4556-9441-d10a33e69dfb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head semantic review (COMMENT only; no approval): completion corrections validate the predecessor inside the same tenant/learner/registration transaction, insert a new immutable decision, expose the relation in the response, and emit a distinct audit action. The exact-head smoke path covers the valid correction, invalid predecessor rejection, decision count, correlation, audit export, and append-only guard. Local pinned Rust checks, actionlint, and real PostgreSQL/API evidence are recorded in the PR. No blocking defect identified in this review; independent approval and live protected Checks remain required.

[seonghobae]

Re-reviewed exact current head after the smoke-test follow-up: the CI path now asserts a non-member predecessor is rejected with HTTP 400 before exercising the valid correction. The implementation and local real-PostgreSQL evidence remain consistent; no blocking defect identified. This is a COMMENT-only review, not an approval. Independent approval and terminal protected Checks remain required.

[seonghobae]

@opencode-agent Please perform the bounded current-head review for this PR. Review only; do not update branches, approve, merge, or bypass protection. Bind the review to the live PR head and report any actionable findings with verification.

[seonghobae]

@opencode-agent Re-review the exact current head d7201db after the PRD/TRD/UML/ADR documentation and required-doc contract update. Review only; do not update branches, approve, merge, or bypass protection.

[seonghobae]

@opencode-agent Re-review the exact current head 4622b97 after the documentation head pin. Review only; do not update branches, approve, merge, or bypass protection.

[seonghobae]

@opencode-agent Re-review the exact current head 4468e60 after aligning docs/product-technical-gap-baseline.md with PR1 and PR17. Review only; do not update branches, approve, merge, or bypass protection.

[seonghobae]

@opencode-agent Review the exact current head 80379bc after the live-head baseline wording update. Review only; do not update branches, approve, merge, or bypass protection.