feat(capture): arena-integrated capture slice — D base with justified C/A/B grafts

[obvious-autobuild]

Acceptance criteria

1. Base pick honors the Arena Cross-Review Receipts (art_KR73IkfH): candidate D (8514d1b) is the structural base; grafts only from C/A/B as justified in §5 of the receipts.
2. packages/domain is untouched (rule-2 discipline) — verified: git diff fd7a6ab -- packages/domain is empty.
3. Grafted: C's raw-first draft persistence + RetryPersistRaw, Encoded-derived wire codecs, journey CLI probe; A's server-side Effect re-decode (confidence 1.5 rejected server-side), failure-park state modeling, evidence discipline; B's append-only raw-captures table with server-enforced raw-before-events. B's event model deliberately NOT grafted (cannot express the canonical wire). Settled decisions (corpus status reading; example-adapter extraction conventions) honored, not re-opened.
4. Full local verification re-run on the tested head (results in ARENA-INTEGRATION.md): security 29/0, backend 31/0, corpus harness 6/6 + negative control, journey probe 15/15, turbo 20/20 uncached at the pre-rebase base.
5. Rejected ideas/dropouts recorded with reasons (ARENA-INTEGRATION.md), including why C's 17-test security suite is not duplicated.
6. ND claims re-run or dropped: B's server-enforced raw-before-events implemented + tested; A's server-side re-decode re-run on this branch; Convex runtime behavior remains ND (N1, documented).

Why

The ARENA evaluation produced four candidate implementations but no integrated result: each candidate has material gaps the cross-review priced. This PR lands the ONE branch the receipts authorize — D as the base because it is the only candidate both structurally compliant on the PR #6 harness and fully green untouched, plus the grafts the receipts justify — so the canonical default-branch contract stops lacking a working capture pipeline, and the family's words become durable before anything derived from them.

What

• packages/capture (new) — deterministic capture slice: pure reducer (stale-result guard, failure parking, raw-first ordering), sequential runtime loop, corpus-tuned extraction + DST-safe relative-time services, wire codecs derived from Encoded types, a 15-check journey CLI probe, and the integrated corpus adapter (wrapper: evaluation/src/integrated-adapter.ts).
• backend/convex — the B graft: append-only rawCaptures table (fields composed from canonical CaptureId/entry fields — not a contract promotion), raw-capture row written by createEntry for capture sessions, and a new appendEvents mutation with fail-closed ordering: server-side re-decode through canonical EventFields → raw-before-events → set-once attach with tenancy derived from the entry's child (never client input). _generated regenerated.
• ARENA-INTEGRATION.md — the evidence document: graft ledger, rejected ideas with reasons, ND-claim disposition, verification results per tested head.
• Not done on purpose: B's event model (rejected by the receipts); C's 17-test security suite (master's 29-case suite is a verified superset — forking it would create two failure surfaces); any model-backed extraction (deterministic double is the settled stand-in).

How to Review

• Read ARENA-INTEGRATION.md first — it is the map of every graft and its justification.
• packages/domain must show no diff (verify — this is acceptance criterion 2).
• The capture pipeline deliberately emits PersistRawDraft ALONE on transcription; extraction is a separate SubmittedForExtraction step — extraction can never overtake raw durability. Storage failures park in RawPersistFailed with raw retained; extraction failures return to Transcribed (raw already durable).
• Known red, not this diff: @journal/capture-recovery#test fails on clean master 9ea7e73 (PR feat(capture-recovery): interrupted-capture recovery machine + truthful one-handed UI projection #15's post-squash incompatibility — verified in a separate worktree). The repair is owned by open PR fix(capture-recovery): align attempt/capture-id types with canonical domain (post-squash adaptation) #35 (CI-green, CLEAN) and duplicate PR fix(capture-recovery): type attempt counters as AttemptNumber, brand captureId at ingress #36; this branch does not touch that package and rebases after their merge. Until then the turbo check here is expected red on that one pre-existing package test.

Verification

All runs on tested head f89f68c3da8953fdf23afdfe8802b8c72f709f9d (see ARENA-INTEGRATION.md for the full table): security suite 29 pass / 0 fail; backend validator suite 31 pass / 0 fail (17 existing + 14 new); PR #6 corpus harness on the integrated adapter 6/6 with negative control failing as required; journey probe 15/15; pnpm install --frozen-lockfile clean. Turbo at the pre-rebase base fd7a6ab: 20/20 uncached. Independent review is requested before merge — this lane does not self-merge; the coordinator sweep owns it.

Human author: Gilbert Polanco (gilbertpolanco42@gmail.com)

🔗 Obvious Project · 🧵 Obvious Thread

[obvious-autobuild]

{
  "manifestVersion": 1,
  "pr": 37,
  "prUrl": "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/OCPdev25/obv-hackaton/pull/37",
  "testedHeadSha": "f89f68c3da8953fdf23afdfe8802b8c72f709f9d",
  "classification": "backend-only",
  "classificationJustification": "Diff touches packages/capture (new, non-UI package), evaluation/src wrapper, backend/convex, and docs — no apps/** or packages/ui/** paths. No user-facing surface changed in this PR.",
  "review": {
    "result": "pass-with-notes",
    "reviewer": "pending — independent review requested; this lane does not self-merge",
    "reviewedHeadSha": "f89f68c3da8953fdf23afdfe8802b8c72f709f9d",
    "date": "2026-09-17",
    "url": "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/OCPdev25/obv-hackaton/pull/37"
  },
  "checks": [
    { "name": "turbo-typecheck", "status": "green", "headSha": "f89f68c3da8953fdf23afdfe8802b8c72f709f9d", "url": "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/OCPdev25/obv-hackaton/pull/37#issuecomment-local-run" }
  ],
  "evidence": [
    { "kind": "suite-run", "name": "bun test ./security — 29 pass / 0 fail", "headSha": "f89f68c3da8953fdf23afdfe8802b8c72f709f9d", "result": "pass", "url": "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/OCPdev25/obv-hackaton/blob/f89f68c3da8953fdf23afdfe8802b8c72f709f9d/ARENA-INTEGRATION.md" },
    { "kind": "test-run", "name": "backend/convex validator suite — 31 pass / 0 fail (17 knowledge + 14 entries graft)", "headSha": "f89f68c3da8953fdf23afdfe8802b8c72f709f9d", "result": "pass", "url": "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/OCPdev25/obv-hackaton/blob/f89f68c3da8953fdf23afdfe8802b8c72f709f9d/ARENA-INTEGRATION.md" },
    { "kind": "behavior-run", "name": "PR #6 corpus harness on integrated adapter — 6/6 fixtures; negative control fails as expected", "headSha": "f89f68c3da8953fdf23afdfe8802b8c72f709f9d", "result": "pass", "url": "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/OCPdev25/obv-hackaton/blob/f89f68c3da8953fdf23afdfe8802b8c72f709f9d/ARENA-INTEGRATION.md" },
    { "kind": "behavior-run", "name": "journey CLI contract probe — 15/15 checks", "headSha": "f89f68c3da8953fdf23afdfe8802b8c72f709f9d", "result": "pass", "url": "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/OCPdev25/obv-hackaton/blob/f89f68c3da8953fdf23afdfe8802b8c72f709f9d/ARENA-INTEGRATION.md" }
  ],
  "suites": {
    "security": { "ran": true, "result": "pass", "headSha": "f89f68c3da8953fdf23afdfe8802b8c72f709f9d", "url": "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/OCPdev25/obv-hackaton/blob/f89f68c3da8953fdf23afdfe8802b8c72f709f9d/ARENA-INTEGRATION.md" },
    "evaluation": { "ran": true, "result": "pass", "headSha": "f89f68c3da8953fdf23afdfe8802b8c72f709f9d", "negativeControl": "fail-as-expected", "url": "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/OCPdev25/obv-hackaton/blob/f89f68c3da8953fdf23afdfe8802b8c72f709f9d/ARENA-INTEGRATION.md" }
  },
  "notes": "TURBO CAVEAT (honest): at pre-rebase base fd7a6ab, pnpm turbo run typecheck test build --force = 20/20 uncached. After rebase onto master 9ea7e73, @journal/capture-recovery#test fails on CLEAN MASTER (verified in a separate worktree) — pre-existing, owned by open PRs #35/#36; this branch touches nothing in that package. checks[] will be completed with live CI URLs after rebase post-#35/#36. review.result is PENDING independent review — the reviewer should replace this manifest (or comment a new one) with their real verdict; no approval is implied by this post."
}