Sources: recover ingestion for unchanged repositories through the idempotent reconcile operation #1250

Problem and observed outcome

After restoring the configured execution worker in a consuming workspace, unchanged connected repositories cannot be recovered through the current Sources kit. Normal Sync calls conditional ReconcileSource and returns No changes without handing off another snapshot. The source can look up to date although earlier downstream ingestion never executed and no readable repository content exists.

Evidence

On 24 October 2026 a fresh reconciliation of an unchanged public test repository succeeded as conditional, without a snapshot handoff or new execution. Worker readiness and the active installed handler were independently verified. Existing content, stores and receipts were retained. The test viewer already had read access; this failure is separate from content grants.

Owner paths: datasources-panel.tsx handleSync → useReconcileSource → datasource_reconcile_operation.go enqueueReconcileOccurrence (conditional). ReconcileSourceRequest has organization/source/effect but no recovery mode. Legacy SyncSource can force a snapshot, but is deliberately forbidden for ordinary kit Sync by #1097. Reconnect changes or reaffirms delegation and is not a recovery-only substitute.

Required owner design and implementation sequence

1. Reconcile current owner work, especially fix(accounts,frontend): the follow-ups from the reviews of #1115 and #1116, and a module identity minted for one tenant #1122 (provenance, identity, attempt binding, sweep), before editing. Its inspected scope does not supply recovery for unchanged GitHub content.
2. Independently review an explicit recovery mode on the existing idempotent ReconcileSource operation. Reuse the forced snapshot engine and receipt/effect machinery. Define authorization, digest/effect identity, retry identity and rejection; preserve the conditional default for schedules. Avoid a second operation state machine.
3. Regenerate public contracts and clients through supported tooling. Test same-effect retry, mode conflict, denied access, unchanged snapshots and preserved delegation, including compatibility with earlier receipts.
4. Expose a clear owner Sources action with status distinguishing snapshot dispatch from downstream processing/readiness. Consumers use the kit without copying sync logic or invoking legacy RPCs.
5. Qualify the composed journey: fresh snapshot → execution attempt → stored version → processing → authorized list/read → grounded answer → exact citation. Test denial and retain historical unknown-effect receipts; do not rewrite queues or cursors.

Worker readiness does not close this issue. The supported recovery journey must be implemented and exercised. No grant expansion, reconnect, raw replay or legacy fallback was used as a substitute.