Davy7/21/2026, 9:39:13 AM

Close the remaining P0 gaps on #175 coalescing:

- Merge only Pending/RetryWait (never cancel Prepared mid-mutation)
- Coalesce in one control-DB transaction (union songs, cancel secondaries,
  rebind generation/active_operation_id, invalidate stale candidates)
- Hold the same commit lock across local mutation + outbox + projection
- Invalidate candidate identity/transfer sessions when the change set grows
- Startup recovery shares merge_pending_ops_for_publish and reuploads from
  op.library_id working copy (not the active library)
- Fail-closed candidate outbox COUNT verification
- Strict residual terminal-outbox match (outbox ⊆ non-empty payload only)

Parent39af617