Audit duplicate Codex app post and tighten social gates

[yvette-carlisle]

Summary

• Mark the 2026-06-06 Codex app 26.602 @decodexspace post record as a duplicate of the earlier live media-attached post.
• Correct daily cap accounting from 0 -> 1 to 1 -> 2 and record the earlier duplicate URL.
• Tighten Publisher docs/skills so X search No results is never accepted as duplicate-clear evidence by itself; live @decodexspace profile/timeline readback is now a hard pre-compose gate.
• Add Radar validation for duplicate terminal social_post idempotency keys while still allowing failed attempts to be retried.
• Add social_publish_reservation/v1 as a PR-visible pre-compose lease and validate conflicts between active reservations and terminal social_post records in either file traversal order.

Live duplicate evidence

• Earlier live post: https://x.com/decodexspace/status/2063109099135574379
• Later duplicate post recorded here: https://x.com/decodexspace/status/2063198209271554481

Reservation fix

• Publisher must create and push an active reservation before opening X compose.
• Local-only or unpushed reservations do not authorize publication.
• Other runs must inspect active reservations in checked records and open publication PRs before composing.
• Publisher must repeat live @decodexspace profile/timeline readback immediately before clicking Post.
• Terminal publication/block records and active reservations with the same idempotency key now fail decodex radar validate.

Validation

• cargo make fmt
• cargo make lint-fix
• python3 -m py_compile scripts/github/contracts.py
• jq . scripts/github/social_post.schema.json >/dev/null && jq . scripts/github/social_publish_reservation.schema.json >/dev/null
• git diff --check
• cargo run -p decodex --bin decodex -- radar validate artifacts/github/social-candidates artifacts/social/x
• cargo make test (969 passed, 1 skipped)
• python3 /Users/x/.codex/plugins/cache/hack-ink/playbook/0.3.0/scripts/semantic_drift_audit.py; agent verdict: pass

Notes

• No X deletion was performed. Deleting a live post should be an explicit operator action.
• No codex/codex-automation labels were available in this repository label list.