fix(free): reconcile ambiguous apply commits and refresh Undo authorization (#297)

[MrDarkRoot]

Fixes #297.

Authorization

Founder GO on #297 (after dependencies). Verified merged before branching: #296 CAS (PR #300, merge 2be5576) and #295 allowlist (PR #301, merge 73e1bed). Base: 73e1bed002f594ba5b45580fc954200f8d8b90dd. Scope is #297 only.

Objective A — live-worker reconciliation

Job_Worker::attempt_item() re-reads the journal on the independent observer connection before the NEEDS_REVIEW fallback. Adopts only bound APPLIED rows under the worker's own claim token (APPLYING->APPLIED, reason DURABLE_RECONCILED, journal applied_at). Missing/unreadable/non-APPLIED/bad-binding/lost-token all fail closed to review. No mutator re-call, no setters/save(), no NEEDS_REVIEW->APPLIED transition, no inference from AMBIGUOUS_COMMIT.

Objective B — Undo authorization refresh

Woo_Undo_Mutator::authorize() reloads wp_roles()->for_site() + clean_user_cache(executor) after the existing row locks, before evaluation. Same two calls and order as Apply; principal unchanged; no broad flush.

Tests (5 files, +180/-0)

• jobs harness: mutator_fault=throw support; post-commit throw adopts APPLIEDx2 with journal applied_at and 1 save each; same fixture feeds conditional Undo (sibling newer price conflicts, zero overwrite); pre-commit throw stays PENDING then retries once; material-tamper stays NEEDS_REVIEW with zero mutation.
• undo harness: user-level revoke staged below a warm object cache (in-process stale + cross-process Redis probe in persistent mode); expects PERMISSION_DENIED, zero restores.

Validation

• php -l clean; allowlist PASS; no-replan PASS; i18n-catalog PASS; free/unit 2607 PASS; outcome-copy PASS; pr-fast.sh PR_FAST PASS.
• BLOCKED locally (no Docker): jobs/undo/durable/admin container suites -> must go green in CI before merge. Not claimed as passing.

Maintainer: inspect diff + CI before merge. Do not merge until jobs/undo/admin/journal workflows pass.

[MrDarkRoot]

Maintainer technical review of HEAD 216641d:

I inspected the full PR patch and found no blocking correctness issue in the diff.

Findings:

• Durable reconciliation only adopts a journal row when state is APPLIED, the plan/product binding matches, applied_at passes strict format + calendar + clock validation, and record_item succeeds under the current claim token. Otherwise the path remains fail-closed to NEEDS_REVIEW; it does not replay the Woo mutation.
• Undo authorization refreshes site role definitions and the current executor's user cache before capability checks. The new warm-cache revoke test exercises the stale-user-cache failure mode.
• The new timestamp validator correctly rejects impossible dates/times that passed the previous shape-only regex. The unit matrix includes leap-day, month-end, invalid month/day/hour/minute/second, null/missing, zero-date, and malformed strings.
• Integration coverage addresses post-commit ambiguous outcomes, pre-commit rollback/retry, binding mismatch, conditional Undo conflicts, and missing/zero-date timestamp evidence.
• CI run 38888114929 reports success for this exact HEAD.

Technical recommendation: GO / merge-ready from code + CI review. No code changes requested. Note: this is a COMMENT review, not an APPROVE review, because GitHub rejects approval of the PR by its author; a different authorized maintainer must provide the formal approval if repository rules require it.