- upsert refuses due_dates before today (never generate in the past)
and refuses regeneration of any instance carrying a completion event
(immutability); the ON CONFLICT refresh only ever touches open
instances
- delete_future_uncompleted clamps the cutoff to today so backdating
cannot rewrite past open instances
- occurred_at enforces ONE strict UTC shape (YYYY-MM-DDTHH:MM:SS+00:00)
at append; occurred-at range scope uses exact half-open bounds
- was_on_time: bool | None with type(was_on_time) is bool validation -
0.5 silently coercing to False is rejected
- append-only guards hardened: package-wide mutation regex covers
UPDATE OR IGNORE/qualified names/quotes, DAO INSERT exempted
narrowly; behavioral call-interception test proves only INSERT/SELECT
ever reach the DB for completion_events; compensating self-scan for
the instances test file's rules-table exemption
Joshua King