[Aschenbath]

Why

A person reviewing a temporal conflict needs to correct a successor's start or choose when its predecessor ended. The conflict card previously lacked the start correction, and graph changes, conflict settlement and the person's audit event could commit separately.

This PR is the human-path slice of issue #695, following ADR 0043. It adds the ordinary human decision path first. #695 still includes model proposals, automatic conflict decisions and their undo/measurement work, and the other review queues. This PR leaves issue #695 open. The governor continues to handle duplicates.

Refs #695, #725.

What changes

• Let an editor close the old fact at a chosen date, retime the new fact's start, keep both, or reject the new fact from the ordinary conflict card. Input, displayed dates and history retain the stated precision, with English and Chinese strings.
• Commit the graph mutation, timeline reconciliation, conflict settlement and actor's audit event in one transaction. Lock timelines before fact/conflict rows and recheck the live pair; stale or concurrent answers cannot record a second decision, and failed audit writes roll back the mutation.
• Retiming rewrites only the start and preserves evidence, qualifiers, materialization links, explicit ends and period marks. Reconciliation can redraw an engine-derived end. Rejecting a successor settles related open conflicts before invalidation withdraws them.
• Migration 0117_a_person_can_retime_a_conflict.sql adds retimed_new to the resolution vocabulary; the CLI schema count is 105. The existing ADR records this human-first split.

The API, temporal writer, audit transaction, card and database regression belong together: exposing the new decision without its atomic settlement would leave a partially implemented human path. Model proposals remain a separate slice.

How it was checked

Validated code is committed as 3b5fafae5e193def266e9571b7138b3f54a3281f. The six existing ignored tests retain their normal workspace behavior.

• RUST_TEST_THREADS=1 target/test-env.sh cargo test --workspace: passed — 1646 passed, 0 failed, 6 ignored; exit 0. The wrapper sets UTOPIA_DATABASE_URL, UTOPIA_TEST_REQUIRE_DB=1 and UTOPIA_TEST_REQUIRE_PDFTOTEXT=1, so database/PDF coverage is required. Full output: target/resume-human-conflict-workspace-final.log.
• The new HTTP/database regression covers required/invalid dates and precision, editor/viewer/base boundaries, audit-failure rollback, provenance preservation, explicit and derived ends, rejection settlement and concurrent answers.
• cargo fmt --all --check and cargo clippy --workspace --all-targets -- -D warnings passed again after fixing the audit fault-injection fixture. Previously completed web validation (target/resume-human-web-final.log, target/resume-human-web.log): production build and all 307 web tests (44 files).
• The existing embedding concurrency regression now uses a 400 ms mock response delay instead of 150 ms so fixed database write overhead does not dominate the timing bound; its in-flight ceiling, actual overlap and three-quarter-of-serial assertions remain intact.
• A full-run citation regression exposed concurrent automatic/manual Tantivy reloads: an older asynchronous reload could hide a just-indexed document. The chunk index now uses manual reloads, which every mutation already performs under the writer lock; the existing citation regression checks publication and stored sources.
• Local validation ran on Linux x86_64 with two CPUs and PostgreSQL 16/pgvector through proot, using a UTF-8 database with all 105 migrations applied. The workspace run uses one test thread; concurrency inside the regression tests still runs. No real-model conflict benchmark was run; this slice does not call a conflict model.

Before review

• Every contribution commit is signed off (git commit -s)
• cargo fmt --all --check, cargo clippy --workspace --all-targets -- -D warnings and cargo test --workspace pass
• For changes under web/: pnpm build and pnpm test pass
• SQL under crates/utopia-store/ was tested with UTOPIA_DATABASE_URL set
• The migration number is free on dev, and CURRENT_SCHEMA_VERSION equals the 105 migration files
• UI strings are in both English and Chinese
• The data-model/API change follows ADR 0043, whose human-path record landed before this code

[WaylandYang]

Thank you. This is the conflict cut of 0043 that #695 puts first, and the care shows: the structural gates before any automatic write, the decision and its undo committed together, and leaving 0107 free for #1097.

At 3,100 lines it is more than we can review as one change, and one part needs evidence first. Please split it along the seam it already has:

1. The human path. Migration 0108, the writer shared by the conflict card and the Agent queue, and date editing at its stated precision. No model.
2. The agent proposes. Batches, per-item parsing and proposals in the Agent queue, with a person accepting or overriding. No automatic writes.
3. Automatic application and undo. With a run on the lease bench against a real model, reporting how often an applied action was right. Governance is on by default, so merging this turns it on for every base; we enabled it for duplicates only after measuring.

In each part, tests cover the behaviour that part introduces (the measure on #1126). For work of this size, please say so on the issue first, so we can agree the cuts before you write them. That applies to #1133 too, which I have not read yet.

Thanks again.

[WaylandYang]

Thank you again for this work. Checking in on the split suggested on 10-09 (the human path first, then the agent's proposals): are you still planning to take it that way? Migration 0108 is long taken on dev now, so the first part will need the next free number when you rebase. If you'd rather hand it over, just say so; no pressure either way.