fix: close final promotion contract gaps

docs/operations/coderabbit-pr-40-disposition.md

@@ -1,13 +1,18 @@
 # CodeRabbit disposition for promotion PR 40
 
 Promotion PR [#40](https://github.com/DatabreezeService/databreeze-platform/pull/40)
-received exactly one automatic full CodeRabbit review. No manual rerun or second
-review was requested.
+received one automatic full CodeRabbit review. After the focused fix PR merged
+into `dev`, the CodeRabbit integration automatically ran one incremental review
+on the new promotion head; no additional review was manually requested or
+invoked, and no further run will be requested.
 
 - Review ID: `4845720374`
 - Run ID: `2397e2ad-4258-4b05-9516-0a8b6fb4f39c`
 - Submitted: `2026-08-03T15:20:07Z`
 - Reviewed range: `8a4c0af52ed872715103710e3c89ca832f999bd4..f1573921446e9f86313e0f58b926777aed9e1402`
+- Automatic incremental review ID: `4846097863`
+- Automatic incremental run ID: `ce0a1c0d-b669-4551-bbd1-b9cad29de291`
+- Incremental range: `f1573921446e9f86313e0f58b926777aed9e1402..c80994cf4e2cf97be5a9137160417b8feb2b4eb7`
 
 ## Valid findings fixed
 
@@ -24,6 +29,9 @@ fixed in focused commits on `fix/coderabbit-pr-40-reconciliation`:
 | Hierarchy reads and membership outcomes returned denial/not-found/conflict envelopes as HTTP 200. | Accepted. `0689d70` maps hierarchy `NOT_FOUND` to 404 and membership result codes to 400/403/404/409/410/503, with generated OpenAPI and regression tests. |
 | Windows Android test command mixed PowerShell and cmd.exe syntax. | Accepted. `de3ff3d` documents valid commands for both shells. |
 | Maintainability and boundary nitpicks (shared DTO constants, cross-field scope validation, identity state coverage, adapter equality/filtering, rollback assertions, and mapped bootstrap assertions). | Accepted. These are covered by `c459a10`, `06588ea`, `0689d70`, and the preceding `37f2289` test changes. |
+| The documented membership error body did not match the emitted rejection envelope. | Accepted. `73b6199` documents `MembershipRejectedResponseDto` with `accepted: false` and the bounded error-code enum for every mapped error status. |
+| `handoffTaskIds` accepted malformed non-array values and could throw while checking the ledger. | Accepted. `8414b83` normalizes and diagnoses malformed shapes, with object/string regression coverage. |
+| The uniqueness migration test omitted `project_id` normalization. | Accepted. `d79c74b` asserts the project `COALESCE` expression alongside the workspace assertion. |
 
 ## Rejected findings
 
@@ -34,7 +42,7 @@ correctness, contract, security, or test-coverage improvement in this slice.
 
 The focused fixes must pass the affected API/domain tests, OpenAPI drift check,
 `corepack pnpm repo:check`, `corepack pnpm repo:build`, and the hosted checks on
-the follow-up `dev` PR. This document records the single-review disposition; it
-does not authorize a second CodeRabbit run. PR #40 remains unmergeable until the
-fix PR is merged to `dev`, its promotion checks are green, and all valid findings
-are resolved.
+the follow-up `dev` PR. This document records both the one full review and the
+integration-triggered incremental result; it does not authorize another
+CodeRabbit run. PR #40 remains unmergeable until its current checks are green
+and all valid findings from both completed results are resolved.