Scope

Closes #188. Observability epic #173; prerequisite for O5 #178.

Repository-document callbacks from obsolete registration/source authority must not mutate a replacement source after rebind. This fixes the shared maintenance owner, not just observer attribution.

Design

• Fence completion and late-failure callbacks before any source, scheduling, timestamp or registry mutation.
• Qualify registration id/generation, cache UUID, repository id, physical-cache fingerprint, selected source id/generation, source path and profile.
• A rejected callback returns the current public entry and performs zero registry writes. It manufactures neither transition events nor diagnostic loss.
• Only an active repository-document job matching the source intent may mark that source indexing. Current-generation completion/failure behavior and independently retained inspection remain intact.
• Existing source-id redirects after restart are preserved.

Design and verification details are issue comments; original issue input remains unchanged.

Verification

Exact commit: e6cb3c16911f157c5c1d27eca2b95d743e57d0df.
Base: f38d6c7ba52b058a4d2e243e50e4ca4f732a6829.

Passed:

• go test ./... -count=1
• go test -race -p 1 ./internal/servicectl -count=1
• Targeted source/callback/inspection race tests, count=3
• go vet ./...
• ./scripts/check-product-docs.sh
• git diff --check

Actual queued-job/rebind completion and paused-reconcile/rebind late-failure controls assert all retained state, public list projection and zero stale writes, including restart. The finalized regressions fail on unchanged base production code only for obsolete callbacks; current controls pass. A mismatch matrix and active-job-intent controls extend boundary coverage.

Independent exact-SHA review and remote CI evidence are recorded separately before merge.

Risk, recovery and UX

The principal risk is rejecting legitimate current callbacks. Positive current-generation and normal inspection/recovery controls preserve those paths. No schema migration, provider endpoint, remote write, installed-service change or destructive repair is introduced.

CLI, MCP and Admin continue using the existing shared source-state projection; no new user-visible resource, lifecycle action or remediation path is added. Full cross-surface observability acceptance remains tracked by #178, not claimed by this prerequisite. Rollback is a normal code revert; existing cache/registry formats remain unchanged.