refactor(exec,api): share mutation transactions and recovery

[DecisionNerd]

Cypher statements and analyst property write-back now use one mutation transaction for the private catalog, rewrite staging, receipts, counters, commit, and recovery. The facade retains generation publication, while both entry points share authority-aware rollback and adjacency invalidation. Explicit multi-statement transactions use the same abort adapter after unpublished writes.

Recovery follows the actual selected generation after publication errors. Failed restoration retains its backup after owner drop and denies further use of the affected owner; retained streams check a recovery epoch before and after each pull. Absent targets preserve their empty snapshot contract, and substituted rollback-root links are rejected before touching outside files. Existing caller-specific catalog observation and counter semantics are preserved. ADR 0028 records the boundary; no durable or public result format changes.

Validation:

• Real Degree/Components versus Cypher receipt, counter, value, and reopen parity; eight rewrite/publication fault cases; semantic post-publication reconciliation; ephemeral and standalone rollback; retained-stream recovery checks.
• Full AST, executor, API (703 unit tests), structured-stage and storage suites passed. After snapshot integration, executor units, read/write transactions, lowering goldens, composition and recovery checks passed again, including 21 write-statement tests.
• API BDD 118/118 and openCypher TCK 3,897/3,897 passed with zero regressions. Advisory timing warnings remain; no performance claim.
• Workspace Clippy, formatting, and make pre-push-fast passed. Exact-head CI remains required.

Closes #1010

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 14936f26-8eb7-4f44-aa40-2343d1caa1d9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}