Allow bounded preserved artifact backfill apply

[nicho1ab]

Pull Request Evidence

Governing issue and intended outcome

• Governing issue: Make preserved-artifact backfills safely repeatable #475. Issue Make preserved-artifact backfills safely repeatable #475 remains open after merge until deployed production acceptance passes.
• Intended outcome: permit the exact preserved-artifact normalization required by Make preserved-artifact backfills safely repeatable #475 through the existing bounded checkpointed backfill interface, and remove provenance-only differences between equivalent preserved-document operations.

Implementation scope

• Major files or components changed: hosted backfill request validation, PowerShell wrapper validation, focused backfill and CLI regressions, and hosted-backfill operator documentation.
• Important behavior intentionally unchanged or out of scope: schemas, migrations, connectors, live retrieval, facility-reference precedence, reviewer-created state, reviewer UI, authentication, deployment configuration, statewide execution, and Issue Fix preserved-artifact backfill failures for 27 facilities #476.
• Reviewer UI regression contracts: RT-RC-004 and RT-RC-006 remain protected invariants. Stable facility/source identity, source-document relationships, reviewer-created-state separation, fixture relationships, and audit relationships remain unchanged; no reviewer-facing presentation or interaction changes.

Root cause

The deployed #475 correction correctly deduplicated final stable source-record projections, but the mutation boundary still prohibited explicit preserved-artifacts apply even when max-facilities and a durable checkpoint were supplied. Equivalent preserved-document operations also embedded different operation labels in source_artifact_identity, causing provenance-only cross-operation differences. No seeded-import comparison defect remained.

Acceptance-criteria evidence

Acceptance criterion	Evidence and result
Bounded preserved-artifacts apply	PASS - preserved-artifacts apply is permitted only through the existing explicit apply, max-facilities, and durable-checkpoint safeguards.
Dry-run and repeat idempotence	PASS - focused regression proves initial legitimate update, bounded apply, zero-update immediate repeat, and zero-write second apply.
Equivalent preserved-document provenance	PASS - canonical-observation replay after preserved-artifact normalization produces no provenance-only update.
Protected state	PASS - stable conflicts, identities, hashes, original import scope, reviewer-created state, and audit state remain preserved.
Existing boundaries	PASS - operation all remains dry-run-only and facility-reference behavior is not weakened.

Validation and failure classification

Validation	Result	Failure classification, if applicable
New/final regression	PASS - 1 passed	none
Backfill, CLI, and seeded-import affected collection	PASS - 22 passed	none
Ruff	PASS	none
mypy	PASS	none
PowerShell parser validation	PASS	none
Documentation validation	PASS using the documented primary-repository shared Python runtime	none
git diff --check	PASS	none
Portable-path completion-report preflight	PASS	none
Initial PATH-Python documentation attempt	Did not complete because jsonschema was unavailable; documented shared runtime passed	environmental runtime-selection failure only

• Pre-existing failures relied upon for passage: None.
• Tests intentionally not run: the complete local suite was not repeated because this is a focused correction and required PR CI supplies repository-wide validation.

UI and accessibility evidence (when applicable)

Not applicable - no UI or accessibility behavior changed.

Reviewer-facing redesign artifact classification (when applicable)

Not applicable - no reviewer-facing redesign occurred.

Documentation, assumptions, and remaining risks

• Documentation impact: hosted-backfill documentation now accurately describes preserved-artifacts as an explicitly bounded/checkpointed writable operation while all remains diagnostic/dry-run only.
• Assumptions and limitations: production data has not yet been mutated by this correction. The previously recovered 29-facility affected set remains the governing deployed acceptance subset.
• Remaining risks or follow-up: after merge, human-operated QNAP deployment must run the 29-facility dry-run/apply/repeat lifecycle and the full 312-facility repeat dry run before Make preserved-artifact backfills safely repeatable #475 may close. Issue Fix preserved-artifact backfill failures for 27 facilities #476 remains separate.

Governed-boundary review

Governed boundary	Status	Specific explanation or evidence
Schemas and migrations	No change	No schema or migration changed.
Ingestion and source-connector contracts	Authorized change	Governed preserved-artifact backfill mutation authorization and provenance identity are corrected; no connector retrieval behavior changed.
Security and privacy	No change	No credentials, private data, authentication, authorization, or secret handling changed.
Production data and correction behavior	Authorized change	The correction permits explicitly bounded checkpointed preserved-artifact normalization; no production mutation occurred during implementation.
Deployment and infrastructure	No change	No Compose, QNAP, Cloudflare, host, deployment, or infrastructure files changed.
Repository governance	No change	No repository governance mechanism or workflow policy changed.
Required GitHub workflows and checks	No change	validate, docs-check, fixtures, and security remain required and unchanged.
Tests or checks weakened to obtain passage	Authorized change	Focused backfill and CLI tests strengthen the mutation and idempotence contract; no required protection was weakened.

Required GitHub checks

• validate
• docs-check
• fixtures
• security