feat(kernel): complete P02b-3 durable subscriber delivery

.claude/skills/add-integration-event/SKILL.md

@@ -34,8 +34,11 @@ production censuses and catalogue enforcement; the
 owns final verification and review status.
 Accepted [ADR-0046](../../../docs/decisions/0046-durable-event-delivery-and-recovery.md)
 owns dispatcher recovery, subscription readiness and the shared inbox contract.
-P02b-2 implements producer dispatch; P02b-3 still owns durable acceptance,
-independent execution, canonical inbox/ledger DDL and real subscriptions.
+P02b-2 implements producer dispatch; P02b-3 Steps 1–4 implement durable
+acceptance, shared inbox/ledger storage, independent execution and scheduling.
+Step 5 supplies the real default subscriptions and semantic Seeder handoff; the
+[delivery record](../../../docs/roadmap/phase-02b-events-auth.md#p02b-3-step-5--useful-defaults-and-semantic-seed-handoff-2026-10-13)
+owns validation/review status.
 
 ## When to use
 
@@ -193,7 +196,7 @@ fails the build.
 
 ### Step 4: Consumer — transport-owned inbox boundary
 
-**Accepted target, pending P02b-3 implementation.** The transport owns the shared
+**P02b-3 owner implemented.** The transport owns the shared
 `inbox_messages` guard; business handlers do not inject or call `IInboxGuard`.
 Deduplication is `(tenant_id, subscription_id, event_id)`, with a stable versioned
 subscription ID independent of handler type names. The separate delivery ledger
@@ -221,9 +224,9 @@ outbox intent; database rollback alone cannot undo them.
 
 The first real flow has two independent Customization subscriptions:
 `customization.initialize-content-type-default.v1` installs `card@1` content type;
-`customization.initialize-taxonomy-default.v1` installs `plain@1` taxonomy. Both
-remain Pending until P02b-3 supplies durable acceptance, create-only preservation,
-per-effect MUST audit and the semantic key/version Seeder handoff. Neither may
+`customization.initialize-taxonomy-default.v1` installs `plain@1` taxonomy.
+P02b-3 activates both together with create-only preservation, classified nested
+initialization commands and the semantic key/version Seeder handoff. Neither may
 suppress its sibling or overwrite authored, retired or deleted definitions.
 
 ### Step 5: Subscription registration
@@ -239,17 +242,21 @@ builder.AddLearnStackCrossCuttingFoundation(
     typeof(LearnStack.Modules.Customization.Application.AssemblyMarker).Assembly);
 ```
 
-Today `InProcessEventBus` resolves the concrete
-`IIntegrationEventHandler<T>` directly from DI in that subscription's async
-scope. MediatR is not involved. There is no shipped
+The independent `DeliveryExecutor` resolves the concrete
+`IIntegrationEventHandler<T>` from its owned async scope after validation, inbox
+claim and classification. A coordinating handler may send one classified nested
+command through MediatR. Check that command's `Result`; a refusal must fail the
+consumer with a bounded exception rather than silently complete its inbox. The
+two default coordinators are explicitly Off; their commands own the MUST intents.
+There is no shipped
 `AddDaprSubscription<T>` helper; do not invent one. P02b-2's construction-free
 manifest implements stable subscription IDs, compatible
 type aliases and required Pending/Active readiness. Pending holds the producer row
 before acquisition or payload validation. Only explicit intentional absence may
 acknowledge a known type without publication. P02b-3 makes Active publication mean
 durable acceptance of all matching deliveries, independently of business handling.
-Do not invent a registration API before its implementation ships. Phase 11 must
-preserve these contracts when it adds Dapr.
+Use the shipped `OutboxSubscriptionManifest` and handler-registry registration
+in the API composition root. Phase 11 must preserve these contracts when it adds Dapr.
 
 ### Step 6: Tests
 
@@ -273,8 +280,8 @@ byte boundaries, SQL NULL metadata and terminal reuse. For delivered flows:
 - `dotnet build` and `dotnet test` pass.
 - `LearnStack.Tests.Architecture` is green — `Integration_Event_TopicNames_FollowConvention`
   and `Integration_Events_Inherit_From_IntegrationEventBase` run today.
-  `Integration_Event_Handlers_Use_InboxGuard` remains Registered for P02b-3's
-  transport-owned consumer delivery. Check
+  `Integration_Event_Handlers_Use_InboxGuard` is Implemented with P02b-3's
+  nonempty all-layer production census and real transport-owned delivery proofs. Check
   [the catalogue](../../../docs/standards/21-architecture-tests-catalogue.md) for their
   status rather than assuming a net is under you.
 - P02b-2 proves producer recovery and terminal audit independently of Pending
@@ -288,8 +295,9 @@ byte boundaries, SQL NULL metadata and terminal reuse. For delivered flows:
   that owns the aggregate. The moment another module needs to react, it must be an
   integration event.
 - **Moving the inbox guard into a handler.** The transport must claim before
-  construction. The rule remains Registered until P02b-3; its name alone proves
-  no enforcement. Redelivery must preserve independent sibling effects.
+  construction. P02b-3 enforces typed invocation boundaries and actual transaction
+  atomicity; extend both controls for a new subscription. Redelivery must preserve
+  independent sibling effects.
 - **Writing the outbox row in a separate transaction.** Use `IOutbox.EnqueueAsync`
   through the enrolled ambient `IUnitOfWork`; never `new TransactionScope`.
 - **Supplying a second topic at enqueue or subscription time.** The concrete

.claude/skills/add-integration-test/SKILL.md

@@ -70,7 +70,7 @@ architecture test) plus any other invariant the change touches. See
 > what almost every test wants: **every** migration chain applied — through
 > `MigrationChains.ApplyAllAsync`, never a list a fixture keeps itself — and every
 > table seeded for two tenants, with a second organization under tenant A. There
-> are five chains and 21 data tables (26 including migration histories). Discover
+> are five chains and 23 data tables (28 including migration histories). Discover
 > current chains and history names through
 > [MigrationChains](../../../backend/tests/LearnStack.Tests.Integration/Database/MigrationChains.cs);
 > do not copy that inventory into a fixture. Share the schema with
@@ -241,8 +241,10 @@ those shipped examples for Education rather than inventing an authenticated rout
 > `IOutbox`; follow `OutboxProducerTests` and `TenantCreatedProducerTests` for
 > shipped producer fixtures. P02b-2 Step 3 implements the API-host dispatcher;
 > both independent review rounds are complete, and `OutboxProcessorTests` owns its
-> runtime proofs. Real subscriptions remain Pending; consumer/inbox assertions
-> belong to P02b-3. `audit_log` shipped in Packet 9: for a real audit assertion,
+> runtime proofs. P02b-3 Steps 1–5 implement shared inbox, per-subscription
+> execution and both Active production defaults. Follow `DeliveryExecutionTests`
+> for ownership/atomicity and `CustomizationDefaultDeliveryTests` for the actual
+> API-worker/Seeder flow. `audit_log` shipped in Packet 9: for a real audit assertion,
 > follow `AuditWorkflowTests`, which drives commands through
 > the seeder's composition root on `SchemaFixture` as `learnstack_app` and reads the
 > persisted columns. The durable `IIdempotencyStore` ships on the trigger
@@ -272,8 +274,9 @@ public async Task CreateEnrollment_publishes_EnrollmentCreated_via_outbox()
 }
 ```
 
-The future P02b-3 consumer-side assertion below is illustrative; the shipped
-worker has no `_fx.RunOutboxProcessorOnceAsync()` fixture API:
+The consumer-side assertion below remains illustrative; the shipped P02b-3
+fixtures above exercise actual workers and have no
+`_fx.RunOutboxProcessorOnceAsync()` fixture API:
 
 ```csharp
 await _fx.RunOutboxProcessorOnceAsync();

.claude/skills/code-review/SKILL.md

@@ -295,11 +295,14 @@ Author intent: <one-paragraph restatement>
   causation/causal actor; transaction announcement supplies tenant/organization.
   No caller header/snapshot establishes authority. Common non-MediatR audit
   entry refuses unregistered direct mutation and reconciles only at the outer
-  frame; producer receipts are distinct. P02b-3 delivery/inbox remains open.
+  frame; producer receipts are distinct. P02b-3 Steps 1–6 deliver durable
+  acceptance, transport-owned inbox/business completion and useful defaults;
+  check the packet record for current enforcement and review evidence.
 - **Real flow and evidence.** Completed provisioning emits
-  `TenantCreatedIntegrationEventV1`; P02b-1 claims pending rows only. P02b-3 owns
+  `TenantCreatedIntegrationEventV1`; P02b-1 claims pending rows only. P02b-3 delivers
   separate create-only `card@1`/`plain@1` subscriptions and Seeder identity
-  handoff after G1; no settings invalidation or Audit mirror is the sample.
+  handoff under Accepted G1; both subscriptions are Active. No settings
+  invalidation or Audit mirror is the sample.
   Read current producer/consumer statuses in the catalogue; require production
   censuses and planted offenders rather than zero-subject passes.
 - **No direct write to `audit_log` / `outbox_messages` /

.claude/skills/seed-tenant/SKILL.md

@@ -16,7 +16,11 @@ description: >
 The [P02d-2 accepted package](../../../docs/roadmap/phase-02d-walking-skeleton.md#p02d-2-decision-package-2026-10-02)
 records the decisions. Step 4 delivers the complete inventory and contextual
 verification; both implementation review rounds and final verification passed.
-P02d-2 is merged, and P02d-4 supplies public API reads. Server ingress/transport
+P02d-2 is merged, and P02d-4 supplies public API reads. The accepted
+[P02b-3 package](../../../docs/roadmap/phase-02b-events-auth.md#p02b-3-decision-package-2026-10-13)
+adds shared create-only defaults and the semantic built-in handoff; its
+[Step 5 record](../../../docs/roadmap/phase-02b-events-auth.md#p02b-3-step-5--useful-defaults-and-semantic-seed-handoff-2026-10-13)
+owns current validation/review status. Server ingress/transport
 belongs to P02d-5; P02d-6 pages and P02d-7's shared foreground/CI demo are delivered.
 Step 3 supplies the narrow browser/Lighthouse proof; its
 [delivery record](../../../docs/roadmap/phase-02d-walking-skeleton.md#p02d-7-step-3--browser-and-audit-proof-2026-10-11)
@@ -74,7 +78,9 @@ that file. There is no `make seed-tenant`, `infra/seed/`, or seed-reset command.
 
 ### 2. Read the declaration
 
-The existing fixed tenant, organization, host and built-in IDs are preserved.
+Fixed tenant, organization, host and authored curriculum IDs are preserved.
+P02b-3 discovers built-ins by semantic key/version and verifies their complete
+Active shape while retaining the stored ID; new built-ins mint owner UUIDv7 IDs.
 English's host remains tenant-wide; Yoga's host maps to Studio One. The exact
 [accepted inventory](../../../docs/roadmap/phase-02d-walking-skeleton.md#seed-inventory-and-ownership)
 and `SeedData` own the choices; this skill does not keep a second literal list.
@@ -94,7 +100,9 @@ URLs or logo are seeded. Restricted publication grants no anonymous lesson acces
    and host mapping. The tenant starts Trial. Provisioning alone writes the
    sanctioned Tenant/Organization pair ([ADR-0042](../../../docs/decisions/0042-tenant-provisioning-cross-aggregate-transaction.md)).
 2. Enabled locales, with the declared default first.
-3. Built-in and tenant-specific definitions, each registered then published.
+3. The two built-ins through separate shared initialization commands; each new
+   root is Active at one save, generation bump and MUST audit. Tenant-authored
+   definitions retain separate exact-ID registration and publication.
 4. Complete branding, in tenant-wide scope.
 5. Draft Course/Lesson creation and each translation, followed by each selected
    publication. Course and Lesson publication remain independent.
@@ -116,7 +124,11 @@ IDs; contract-local IDs cross the module boundary as Guid under ADR-0023.
 - Missing acts write through the ordinary command.
 - Completed acts skip before invoking a writer, so the second completed run changes
   no root, timestamp, version, generation or audit row.
-- Creation accepts only the declared Draft intermediate or intended final state
+- Built-ins require exact Active version/shape but allow matching warm/generated
+  IDs. Any Draft, deprecated, deleted or successor history is preserved; a failed
+  demo postcondition refuses without overwrite. Initialization and registration
+  share the transaction-owned semantic concept lock.
+- Authored creation accepts only the declared Draft intermediate or intended final state
   with matching immutable data. Definition creation accepts Draft/Active, with a
   separate publication act verifying Active.
 - Existing translations are checked before draft-only insertion. JSON object
@@ -134,7 +146,8 @@ IDs; contract-local IDs cross the module boundary as Guid under ADR-0023.
 The process entry point exits 2 for missing connection configuration, 1 for a
 refused credential or run failure, and 0 for a completed run. Completed acts remain
 durable; a later explicit run resumes the remaining acts. If a different revision
-becomes Active between registration's pre-read and post-read, the newly committed
+becomes Active between authored registration's pre-read and post-read, the newly
+committed
 Draft, generation increment and audit remain durable; the run refuses and requires
 explicit operator reconciliation. It does not retire either revision or undo an
 already committed act.

.claude/skills/standards-check/SKILL.md

@@ -377,7 +377,8 @@ domain the diff doesn't touch.
   endpoint carries its ADR and lands in both repositories.
 - [ ] Producer INSERT uses its announced transaction. ADR-0046 dispatcher
   transitions use fresh tokens and atomic terminal audit; transport-owned shared
-  inbox acquisition precedes handler construction (P02b-3 pending).
+  inbox acquisition precedes handler construction (P02b-3 Steps 2–3 delivered;
+  Step 5 activates both real defaults).
 - [ ] Manifest readiness preserves required Pending rows. Active publication
   means durable acceptance; subscriber retry/terminal/replay state is independent
   of the producer budget. Check catalogue status before claiming enforcement.

.claude/skills/wire-dapr-pubsub/SKILL.md

@@ -24,8 +24,9 @@ that contract. The wiring contract is in
 this skill is the **mechanical** check-list. Accepted
 [ADR-0046](../../../docs/decisions/0046-durable-event-delivery-and-recovery.md)
 adds construction-free stable subscription identities, Pending/Active readiness
-and durable acceptance. Those consumer components remain P02b-3 work; Phase 11
-must preserve their contracts rather than reintroduce handler-owned deduplication.
+and durable acceptance, implemented by P02b-3 with independent execution/retries
+and both real default subscribers. Phase 11 must preserve these contracts rather
+than reintroduce handler-owned deduplication.
 
 ## When to use
 
@@ -266,12 +267,12 @@ obligations to the adapter or infer delivery from a registered metric name.
 - Current architecture tests
   `Integration_Event_TopicNames_FollowConvention` and
   `Modules_Do_Not_Inject_IEventBus_Directly` pass.
-- When doing Phase 02b consumer work, add/keep its registered inheritance and
+- When doing Phase 02b consumer work, extend its implemented inheritance and
   inbox-guard rules. When doing Phase 11 adapter work, add/keep the Dapr binding
   and direct-provider boundary rules owned by that phase.
-- The current baseline has no durable inbox. P02b-3 must prove acceptance plus
-  atomic inbox/business completion, concurrent duplicates, independent sibling
-  retries, sticky timeout and uncertain-COMMIT recovery on the real delivery path.
+- P02b-3 implements durable acceptance and the shared inbox. Extend the real
+  delivery proofs for atomic inbox/business completion, concurrent duplicates,
+  independent sibling retries, sticky timeout and uncertain-COMMIT recovery.
 - When Phase 11's adapter exists, its Dapr/Testcontainers binding test and
   transport metrics pass as additional validation.