Use a shared abstract int64 cursor for authoritative sync progress

[RCmerci]

Normally ordered authoritative pull transactions such as 9 → 10 were rejected because the versioned cursor token used string ordering. Authoritative progress also crossed protocol, reducer and storage boundaries as unrelated machine integers and strings.

Introduce one abstract, non-negative int64 cursor in db_types and expose the same type through overlay. Migrate authoritative progress through protocol, reducer, worker, snapshot/checkpoint, outbox and receipt consumers. JSON codecs enforce the server's safe-integer range; SQLite preserves the complete int64 value; legacy persisted cursor token bytes remain compatible. Checked submission arithmetic defensively rejects abnormal overflowing intervals before persistence, including rejection suffix resubmission. The max-int64 fixture exercises the complete type domain and defensive validation; it is outside the real server's wire range and is not counted as a normal business bug.

Validation:

• Public reducer regressions reproduce and then fix 9 → 10, 99 → 100 and 999 → 1000 admission; duplicates and reverse order remain rejected.
• Cursor, JSON range, SQLite int64 round-trip and defensive overflow rejection tests verified RED before implementation and GREEN afterward.
• dune build @all app/native_embed.exe.o and the full forced regression suite passed locally: 681 Alcotest cases plus native/source checks. The external build cache includes a compatibility layout for the existing compiler-boundary test's root locator.
• Follow-up review confirmed an HTTP snapshot bootstrap regression: a valid 526,168-byte response was being decoded with the WebSocket limit. A public Core.step regression verified RED before the fix and GREEN afterward. HTTP request and decoder now share the existing 64 MiB budget; WebSocket limits remain unchanged.
• Removed duplicate overlay decimal-boundary tuples so the numeric bug regression stays at the public pure-reducer boundary; negative/full-int64 type-contract coverage remains.
• Independent review passed for head 7a8db24d2f1978220174a261a939db5c91f9017e; Journal CI run 37948625893 succeeded on this exact head, including the all-target/native-embed build and full regression suite.
• The only Dune edits are the two explicitly approved overlay spec module lists. No shared pins, personal graph/account, phone or Simulator were changed.
• This decision document passes validation. Repository-wide decision validation still reports three pre-existing unrelated missing-section errors.

Live account/UI acceptance and the separate reconnect finding are outside this change. See docs/agent-guide/implemented/architecture/2026-10-09-server-cursor-int64.md.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T14:41:39.171624Z	50a33eb	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 50a33ebfad

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".