feat(store): preview one exact prompt source without authority

[dnlrsls]

🔗 Linked Issue

Closes #1458

Child 1 of the explicit reauthorization work for open tracker #1464. Base: feat/prompt-inbox-foundation-tracker at 1d70f3b3, not main.

🏷️ PR Type

• type:bug — Bug fix
• type:feature — New feature
• type:question — Question requiring tracked work
• type:docs — Documentation only
• type:refactor — Code refactoring
• type:chore — Maintenance
• type:breaking-change — Breaking change

📝 Summary

• Add a read-only store preview for one exact prompt sync ID, returning the observed live/tombstone session, inbox and prompt-project tuple.
• Reject missing, ambiguous, duplicate, idless or incomplete observations without inferring session ownership, local creation or cloud authority.

📂 Changes

File	Change
internal/store/store.go	PreviewPromptSource reads live and tombstone rows together with a two-row ambiguity bound.
internal/store/prompt_local_origin_test.go	Local, unmarked/imported-style, tombstone, idless, near-match, duplicate, conflict, blank and DB-error regressions.

134 authored additions. Documentation N/A: this internal read has no CLI or remote behavior until subsequent children.

🧪 Test Plan

• Focused: go test ./internal/store -run 'TestPreviewPromptSource' -count=1 — PASS (independent verifier).
• Affected package: go test ./internal/store -count=1 — PASS (independent verifier).
• Additional: go vet ./internal/store, gofmt listing and git diff --check — PASS; only LF→CRLF advisory warnings. Native review review-1dc16dbe3c394613 approved and acknowledged; one nonblocking test-readability suggestion.
• GitHub unit/E2E/plugin/lint/Windows/policy checks — pending at creation.

🤖 Automated Checks

CI results pending. Required checks must pass before normal merge.

✅ Contributor Checklist

• Approved issue feat(store): preserve admitted prompt identity through sync and deletion #1458 linked.
• Exactly one type:feature label.
• Focused/package/additional checks recorded; CI pending.
• Docs N/A for inert internal read; user-facing docs belong with the CLI child.
• Conventional commit without co-author trailer.
• Changed paths comply with transient-artifact policy.

💬 Notes for Reviewers

This does not reauthorize any source. A future CLI will require an explicitly asserted owner project and human confirmation; the server must authenticate the actor, check current grants for both owner and prompt projects, and record a distinct per-source attestation. A returned prompt Project is data, not proof of session ownership. Do not queue #1464 or enable remote deletes until the remaining reauthorization children, cloud delete gate and integrated validation are complete.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 94ebeec9-577d-41c1-86da-ac9691369b21

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}