feat(processing): persist safe atomic operation history

docs/pre-phase10-ux/D_HISTORY_CHECKPOINT.md

@@ -0,0 +1,19 @@
+# D history foundation checkpoint
+
+28 October2026. Cumulative branch `feature/admin-processing-monitor`, based on C0bd290e; architecture checkpoint5f26108 was pushed with remote equality verified. This report accompanies the event/persistence checkpoint. **This is not acceptance of the admin API/UI, which remains in progress.**
+
+Implemented migration-owned typed operation history, strict safe stage/status/failure projection at insertion, event owner filtering and operation-cascade erasure. Queue creation, successful claims, actual stage changes, completion, retry/failure, cancellation and lease/deadline recovery append events within their state transition transaction. Periodic same-stage/empty heartbeats do not manufacture history. New relational event writes use parameterized insertion without flushing unrelated tracked objects. Existing terminal notification transactions remain intact.
+
+Document stage reporting retains the original owner, lease, cancellation and expiry checks and now uses the same store. Retention uses the existing hourly owner, excludes no current document cleanup and removes up to5,000 events older than30 days per sweep. Account export adds only owner-scoped event metadata; operation cascade and explicit owner erasure remove history. No event contains raw CVs/prompts/results, free-form exceptions, lease tokens, paths or model/provider strings. Existing operation records retain their prior contract; future admin projections must independently redact their legacy free-text fields.
+
+Qualification, independent lanes under `.artifacts/pre-phase10-ux/`:
+
+- `d-events-red/d-events-red.trx`: missing-history regression failed as expected before implementation.
+- `d-retry-red/d-retry-red.trx`: confirmed an existing tracked-stale-operation retry failure. Retry now reads durable state and conditionally resets the observed terminal state/completion timestamp, atomically deleting its notification and adding one retry event.
+- `d-backend-01/d-backend.trx`: **1,413 passed, zero failed/skipped** full backend. Subsequent additional history cases are checked in the focused lane, not added to this total.
+- `d-events-04/d-events-04.trx`: **53 passed, zero failed/skipped**, including claim/stage/completion/retry insertion-failure rollback, stage deduplication/redaction/owner isolation, no unrelated tracked-user flush, inactive lease rejection, recovery ordering/attempts, retention/cascade, existing account rights, startup ownership, CV workers and avatar/document retention.
+- `d-mariadb-02/{mariadb.trx,run.json}`: **88 passed, zero failed/skipped** against real MariaDB12.2.2. New tests prove one winning claim/event, concurrent same-stage deduplication, owner isolation, and event-insertion failure rolling back completion and notifications. Migration/startup, account/import/revision tests also pass. All generated resources cleaned; no existing/production database selected.
+
+Retained findings: the first MariaDB run had87 passes/one outdated latest-migration assertion. The test now names the pre-RD21 migration explicitly, retaining every original content/version preservation assertion and actually exercising revision backfill. A shared in-memory SQLite connection allowed a worker test to observe an uncommitted success before stopping the worker; its fixture now uses independent connections to an isolated temporary WAL database, preserving the requirement that success survives the worker stop. `d-events-01` retains that failure; later focused/full runs pass.
+
+The additive migration and snapshot were updated together; no production schema or runtime was changed. Event-history acceptance is limited to the checks above. Admin-only APIs, exact string cursors, owner-verified associations, safe browser presentation, polling/recovery, correlation headers and integrated acceptance remain the next work. No retrospective history is invented for old operation rows.

docs/pre-phase10-ux/PLAN.md

@@ -31,7 +31,7 @@ No main merge, production service/database/storage/model/cache/deployment operat
 - [x] B-01: versioned designs, actual samples, matching letters, secure optional photographs, queue repair and local runtime. Backend1394/frontend1014/MariaDB84/interactive browser6/real Docling2; revised CV36+letter18 per platform and original Linux24+4. Conditional development acceptance and retained large-name oracle failures: B_ACCEPTANCE.md. Source3f4db8c committed/pushed with remote equality verified; qualified source images activated only locally on28 October.
 - [x] C-00: branch from accepted B; pinned2.3.0/MIT, installed modern API/React19 pointer proof, measured+23,636 aggregate gzip bytes; schema2 and legacy RED/GREEN migration tests. Combined with C-01 source checkpoint.
 - [x] C-01: actual widgets drag/resize, compact catalogue and keyboard controls, bounded non-overlapping geometry, no automatic writes, stale-client/CAS protection. Backend1405/full frontend1019 plus final focused33/MariaDB86/browser12; C_ACCEPTANCE.md records conditional development acceptance and independent evidence. Commit/push/remote equality form the publication step of this checkpoint.
-- [ ] D-00: branch from accepted C; define exact safe diagnostic/event schema and admin identity/association policies; tests first.
+- [x] D-00: cumulative branch from C0bd290e, safe history/API/identity contract pushed5f26108. Missing history and stale tracked retry reproduced RED. Event foundation: backend1413/final focused53/MariaDB88 with atomic rollback/redaction/retention/account rights; D_HISTORY_CHECKPOINT.md. Admin API/UI remains in D-01.
 - [ ] D-01: atomic structured events/correlation/retention and account rights, safe admin list/stats/detail/events, polling filters/reconnect/pause, EN/Bokmål and responsive UI; security/provider/browser validation; commit/push/verify.
 - [ ] UX-INT-00: branch `test/pre-phase10-ux-acceptance` from accepted D. Fresh full backend/frontend/ordinary and added browsers/real MariaDB/RD21/Python/Docling/import/contracts/security/type/lint/build/Windows/Linux PDF/preservation; exact source/discovery/native exits, retain failures and fix regressions.
 - [ ] UX-INT-01: independent feature/overall/Phase10/production verdicts, all57/33 preservation carry-forward, accepted branch commit register, human/operator debt and cleanup-only handoff. Commit/push/remote equality/own-work clean; preserve unrelated primary checkout work; stop.