fix: keep guarded adoption target ID immutable

[andrei-hasna]

Summary

• reject primary-key changes before a guarded legacy-adoption transition
• preserve prior migration bytes by appending the database trigger guard
• add a PGlite raw-SQL regression using a valid live adoption claim

Verification

• bun test tests/guarded-writer.test.ts — 26 pass, 0 fail
• bun run build
• bun run verify:generated — 6 generated bundles byte-identical
• bun run contracts:conformance
• contracts no-cloud-scan .
• bun run release:pack:check
• staged and exact-commit gitleaks scans — no leaks found

Task: KNO-00022

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — remediation cycle 1

Fixed reviewer: /root/knowledge_adoption_reviewer

Focused scope only: the named primary-key mutation defect, its fix, and direct regressions.

Exact candidates:

• OSS PR 81 head 82878b51e64724371ca2c7054f40847c665fefa3, tree/landing tree e0e4b789467b33598bd46d9dc396170f7856ab30, base/current main 24284bd3ce4d39be100dc13a0e79d826fab18b61.
• Hosted PR 10 head 977f9d5f2f9f5e63687f3f018c99c5e10272b0d3, tree/landing tree 9b7db65a8173ce769615b06a9f4f22dcbb2e265f, base/current main ee7717c7399b1bbc3a7390c1329cd083b38388d4.

Independent live-claim PGlite controls:

• {"control":"oss_adoption_primary_key_mutation","outcome":"rejected","error_matches":true,"old_rows":[{"id":"k_review_oss_old_id","content":"review stable body","version":1,"authority_classification":null,"authority_id":null,"tenant_id":null,"scope":null,"parent_id":null,"guarded_adoption_receipt_id":null}],"new_rows":[]}
• {"control":"iapp_adoption_primary_key_mutation","outcome":"rejected","error_matches":true,"old_rows":[{"id":"k_review_iapp_old_id","content":"review stable body","version":1,"authority_classification":null,"authority_id":null,"tenant_id":null,"scope":null,"parent_id":null,"guarded_adoption_receipt_id":null}],"new_rows":[]}

Affected verification:

• OSS: 26 pass, 0 fail, 245 expect() calls; all seven required CI jobs COMPLETED/SUCCESS.
• Hosted: 8 pass, 13 environment-gated skips, 0 fail, 140 expect() calls; typecheck exit 0; all seven required CI jobs COMPLETED/SUCCESS.
• Both current merge trees equal their reviewed heads.
• Hosted first 105 migration entries remain byte-identical: 229e104c1770f94de89d816a592552f0e0d159a948d83e0c5344f184c6115533.
• Both worktrees are clean; commits use the canonical author and single Agent: reges-project-coordinator trailer.

The trigger now rejects an ID change before the adoption-authority transition. No P0/P1 defect or direct regression remains in this focused scope. GO.

[andrei-hasna]

[REVIEW] GO — #81 @ 82878b5 — lens: correctness+isolation+wiring, reviewer codewith-sol-reviewer (1 of 1)

P0: None.

P1: None.

P2: None.

P3: None.

Evidence: src/db/pg-migrations.ts adds a narrowly scoped BEFORE UPDATE OF id trigger that rejects a changed primary key whenever the guarded-adoption transaction setting is non-empty. This closes the reachable bypass in the existing authority trigger, which otherwise treats id as part of an adoption-authorized binding transition. Invalid or absent claims do not weaken the guard, and ordinary non-adoption updates retain their prior behavior because the new predicate is false. The same migration is wired into dist/index.js, dist/storage.js, and bin/knowledge.js. The added PostgreSQL regression proves the original row and legacy binding remain unchanged and the replacement ID is absent. Exact-head hosted Linux/macOS/Windows Bun/Node checks reported success.

Could NOT verify: I did not execute the PostgreSQL regression locally because the exact head object was not present in the available checkout, and I did not apply the migration to a production database. Review used the supplied diff, exact-head GitHub source readback, and hosted check results.