storage: serialize validation in write transactions

[TusanHomichi]

Concurrent writes in the older services could validate a deferred SQLite snapshot and fail on promotion with an internal error. All application-owned multi-statement write transactions now reserve the writer through storage::write_tx before transactional validation. Competing overlapping-session requests return one 201 and one 409 with interval_overlap.

• Retrofit programs/imports, enrollments/lifecycle, assignments, training sessions/membership, users, and setup. Await rollback on typed refusals. Preserve read-only deferred snapshots.
• Recheck username uniqueness inside the reserved transaction after hashing. Serialize setup-code issuance with initialization so no setup code survives completed setup.
• Extract program vocabulary/validation into programs/content.rs and persistence into programs/persistence.rs; retain policy and transaction orchestration in programs.rs with compatible exports. The move/new-owner/impact/proof plan was recorded in this draft PR before broad edits. This completes refactor(rust): separate program and draft workspace ownership #58's programs slice; its draft-workspace slice remains open.
• ADR 0019 amends ADR 0003 and documents reservation, refusal cleanup, ownership, and limits. The five-second busy timeout still bounds lock waits; prolonged contention can still fail operationally. Existing authorization-gate placement and refusal vocabulary remain unchanged. No schema, migration checksum, HTTP payload, or portable-format change.

Validated at b1e8d45484108cf8faa730b4c8e211899d3903b5:

• npm ci, npm run check, and npm run build in web.
• cargo fmt --check and cargo clippy --workspace --all-targets -- -D warnings.
• cargo test --workspace: 155 passed, including all 21 new concurrency tests and existing program/API, enrollment/lifecycle, authentication, draft/review, finalization, and export suites.
• cargo build -p consolebook-server, npx playwright install chromium, and npm run e2e -- --workers=2 --trace retain-on-failure: 8 passed.

Heavy local suites ran sequentially, with CARGO_BUILD_JOBS=2 and RUST_TEST_THREADS=2 on the full Rust run. The concurrency tests cover each retrofitted write path, legitimate pairs of successes, the HTTP conflict response, cancellation versus draft coverage, and zero-wait probes after refusals. A negative control temporarily restored session creation's deferred transaction: the overlap regression failed in 0.06s because the writers returned before the held reservation was released; the immediate implementation was restored before final validation. Extracted content/validation and persistence bodies were also compared with main and match apart from formatting and sibling visibility.

The existing low-severity npm advisory chain remains tracked in #54. Live preview was not deployed.

Closes #27. Refs #58.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T18:13:13.980371Z	b1e8d45	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.