fix(bayn): preserve preopen cycles across authority rollover

[gregkonush]

Summary

• Keep an untouched execution cycle active when a source rollout temporarily restricts authority before its submission window.
• Allow the restricted generation to settle against that same-plan pre-open cycle instead of requiring destructive terminalization.
• Add a guarded, idempotent migration that repairs the one already-blocked cycle only when PAPER authority is clear, reconciliation is exact, the account is flat, and no unresolved mutation or unsafe broker order exists.
• Serialize both runtime recovery and migration repair with the shared execution writer fence, and sample current time only after acquiring that fence.
• Refresh both Linux dependency-closure hashes from the authoritative builders.

Related Issues

None

Testing

• Red test commit 3fabb3e995: expected no terminal reason before submission open, received BLOCKED_AUTHORITY.
• Red test commit 25dfd4c04f: migration completed while another transaction held the execution writer fence.
• Red test commit 026e80cb97: runtime settlement reused the timestamp sampled before waiting for the fence.
• Red test commit af51736dab: migration revived a cycle after the fence wait crossed submission_open_at.
• bun run --filter @proompteng/bayn test: 926 passed, 40 skipped, 0 failed.
• bun run --filter @proompteng/bayn test:postgres with ephemeral local PostgreSQL 17: 25 passed, 0 failed.
• bun run --filter @proompteng/bayn tsc
• bun run --filter @proompteng/bayn lint
• bun run --filter @proompteng/bayn lint:oxlint
• bun run --filter @proompteng/bayn lint:oxlint:type
• bun run --filter @proompteng/bayn build
• nix eval --raw .#packages.x86_64-linux.bayn-image.drvPath
• nix eval --raw .#packages.aarch64-linux.bayn-image.drvPath
• Hosted Bayn, PostgreSQL, strict Effect/tsgo, shared compatibility, amd64 image, arm64 image, dependency invariant, and release gates pass on exact head d721ac7067.
• Read-only live preflight matched exactly one repairable cycle and confirmed clear PAPER authority, exact fresh reconciliation, flat latest positions, no cycle decision or intents, no unresolved mutations, and no unsafe latest broker orders.

Breaking Changes

None. Migration 0057 is a one-time fail-closed repair, serialized by the execution writer fence, time-checked after lock acquisition, and idempotent.

Checklist

• Testing section documents the exact validation performed.
• Screenshots section removed because this is backend state recovery.
• Breaking Changes section is filled in.
• Documentation, release notes, and follow-ups are updated or tracked. No documentation change is needed for this defect correction.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-03T02:13:47.266260Z	d721ac7	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1503cee84d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9ba933703e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d721ac7067

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Check unresolved mutations through the repair time

When an account has a mutation whose first event occurred after the selected reconciliation—for example, a committed SUBMIT_STARTED followed by a crash before an order row is recorded—passing reconciliation.reconciled_at here causes paper_account_has_unresolved_mutation to ignore that event because it filters on event.occurred_at <= mutation_observed_at. The latest-order check cannot catch an unknown submit with no order row, so this migration can reactivate the cycle despite an unresolved trading outcome; evaluate mutation state through repair_observed_at while the writer fence is held.

AGENTS.md reference: services/bayn/AGENTS.md:L72-L73

Useful? React with 👍 / 👎.