[PaleHazy]

Outcome

Adds the public-worker half of the hosted artifact terminal lifecycle contract on top of #29.

• replaces time-only retry exhaustion with a durable, idempotent artifact-deliveries/abandon notification;
• binds notification replay to the exact operation (when known), reservation, artifact, destination, provider, size, and digest;
• preserves local audio, raw locator metadata, and hosted backpressure while private provider cleanup is pending;
• permits local deletion only after an exact provider_absent response;
• handles a lost prepare response with the nullable operation tuple without disclosing the private resolved operation;
• replaces delivered/abandoned raw terminal outbox, artifact, receipt, locator, and customer identifiers with domain-separated hash-only audit evidence;
• adds bounded migration/cleanup for legacy terminal rows; and
• activates real PostgreSQL integration tests in GitHub Actions instead of silently skipping them.

Verification

• PostgreSQL 17: cargo test --all-features --locked — 64 passed, 0 failed
• cargo fmt --all -- --check
• cargo clippy --all-features --all-targets --locked -- -D warnings
• cargo audit with the repository's documented accepted-risk policy
• personal-data pattern check
• git diff --check
• docker compose --env-file .env.docker.example config --quiet
• helm lint and immutable-digest helm template
• independent exact-digest review: clean (783ba2fe7be1a895169de4b26c6953945674cb15df753e7858720d9f2001d0a7)

Dependencies and rollout

• Base/dependency: Fix hosted customer-storage security boundaries #29 (fix/hosted-storage-security)
• Cross-repo dependency: the private call-scribe-hosted customer-storage adapter PR implementing the same exact abandonment contract
• No live provider credentials, OAuth apps, deployment, or production activation are included.