Davy7/20/2026, 1:05:48 PM

Implement PR#4: versioned remote repository manifest, transactional
publish protocol, and CAS-based conflict handling.

New modules:
- errors.rs: typed RemoteError enum with RemoteErrorKind for
  machine-readable error codes persisted to remote_operations.
- manifest.rs: RepositoryManifest read/write/validate with
  generation-based database path layout (.openkara/databases/N.sqlite).
- executor.rs: 13-step transactional publish protocol with
  candidate DB copy, integrity check, upload, manifest CAS,
  re-verification, and GC scheduling. Includes conflict resolution
  functions (keep-local, use-remote, cancel) and disjoint-song
  auto-rebase for settings-compatible conflicts.

Provider trait extension (provider.rs):
- capabilities(): report conditional_replace, resumable_upload,
  range_download, revision_metadata, server_side_move.
- stat(): return RemoteObjectMetadata (size + revision).
- conditional_replace(): CAS-protected upload via ConditionalSource.

Provider implementations:
- Dropbox: rev-based CAS using mode:update with rev precondition.
  HTTP 409 maps to RemoteConflict.
- WebDAV: ETag-based CAS using If-Match for updates and
  If-None-Match:* for conditional-create. HTTP 412 maps to
  RemoteConflict.
- Google Drive: fail-closed (capabilities.conditional_replace=false)
  because the API v3 lacks If-Match/ETag conditional updates.

Control DB schema (002_manifest_columns.sql):
- Add repository_id and writer_id columns to remote_repository_state.
- Migration is idempotent: Rust runner checks column existence before
  ALTER TABLE ADD COLUMN (SQLite does not support IF NOT EXISTS for
  ADD COLUMN).

Publish refactor (publish.rs, mirror.rs):
- Replace legacy upload_remote_database with executor-driven
  commit_via_executor / commit_mirror_via_executor.
- Defect #2 fix: upload-complete event emitted ONLY after manifest
  CAS succeeds and is re-verified. Asset-upload failures never emit
  upload-complete.

Recovery (recovery.rs):
- Add retry_pending_operations to drive pending/retry_wait operations
  through the executor after startup recovery.

Tests: 8 executor tests covering first-generation publish, generation
advancement, CAS conflict detection, fail-closed for providers without
CAS, terminal operation idempotency, manifest verification, GC
scheduling, and repository/writer ID persistence.

Parent999b49c