docs: design bounded webhook ingress scheduling

[iperev]

Stacked PR 13 — base: #67 (feat/workflow-graph-parity). Do not merge yet. Review only the top commit.

Context

ROADMAP "Webhook Concurrency And Asynchronous Processing" item 7 requires a frozen design, alternatives, falsifiers and plan before any CI-014 code. Validation at 62d7765 corrected the scoping premise "no inbox exists": the compact ci_history_delivery_inbox is already atomic with acknowledgement and drained in-process; the T10 loss cause is the process-global single-flight webhook gate. Review corrections: recent/repair recheck claims order repositories by oldest due row and are not repository-fair; cheap webhook header checks change error precedence for multi-defect requests; the sub-10-second acknowledgement bound needed a webhook-specific deadline.

What changed

• docs/features/webhook-ingress-scheduling.md: as-is analysis with coordinates; post-ack consumer inventory; alternatives with costs and falsifiers; REQ-CI-RUNTIME-008 verifier-pool successor (Erlang-B sizing, 503 same wire); per-route-class pre-authentication budgets (F-06) with an explicit multi-defect error-precedence table; fairness (archive and recheck process-cursor rotation, backfill/discovery due-time cycle, A1/A2/B1 counterexample); webhook response deadline (8 s via RequestAdmissionPolicy.timeout_seconds) with ambiguous-commit and cooperative-cleanup limits; connection shares; declared budgets; crash-cut algebra; refused-delivery recovery owner; revision triggers; non-claims.
• docs/features/webhook-ingress-scheduling-plan.md: owner modules, ordered work (verifier pool, pre-auth stage, webhook deadline, recheck rotation, logout envelope, connection shares, metrics, requirements, documents), migration outline (none needed), causal witnesses with mutants killed (P1-P6, H1-H3, L1-L3, D1-D2, F1, M1, R1-R2), live-only CI-069 evidence.
• INDEX, CI-014 ROADMAP row (still open), documentation-graph limit 356->358, Proofkit bindings to REQ-CI-RUNTIME-008, regenerated self-CI artifacts.

Provisional owner decisions (2026-10-11): (1) the existing per-consumer compact PostgreSQL inbox in the same process, no raw-payload inbox; (2) declared conservative budgets labelled unmeasured; (3) bounded verifier pool, no queue, plus a separate pre-authentication limiter; (4) a separate budget per public route class with cheap pre-verification, including the admitted multi-defect webhook error-precedence change, edge filter as a CI-059/CI-062 dependency; (5) seed preparation stays best-effort.

Expected result

An independently reviewable frozen design that gates the CI-014 source PR. No runtime, schema, wire or requirement behavior changes in this PR.

Non-claims: no source delivered; no capacity, fairness under restart or across replicas, replica-wide abuse control, provider-observed response time, cleanup-duration bound, provider behavior or deployment readiness is claimed; budgets (including the 8-second deadline) are declared, not measured; native and live witnesses are unexecuted; CI-014 is not closed.

Independent review: gpt-6-astra (xhigh); findings addressed or rejected with reasons in the single commit. Provisional owner decisions (2026-10-11) are labelled in the changed documents.