Harden conversation replies and prioritize newest candidates

docs/database.md

@@ -21,7 +21,7 @@ The special legacy-unassigned account exists only to preserve rows created befor
 
 - `processed_posts`: account/post key, source metadata, analysis, generated opener, send marker, and terminal error/rejection reason.
 - `sent_messages`: account-owned opener/reply attribution, strategy/experiment/model metadata, Matrix room, response/image flags, and source type.
-- `successful_messages`: examples derived from positive outcomes for prompt context.
+- `successful_messages`: mature positive examples for prompt context; terminal negative reclassification removes the linked example.
 - `conversation_outcomes`: normalized outcome for a sent message (`engaged`, `declined`, `boundary`, `upsell`, or `unknown`).
 - `activity_log`: operator-facing events with optional recipient/post context.
 - `reddit_users`: global mapping between Reddit fullname/username and Matrix identity.
@@ -32,7 +32,7 @@ The special legacy-unassigned account exists only to preserve rows created befor
 - `candidate_queue`: global candidate snapshot, source/priority, state, prepared payload, worker lease, retry timing, selected account, and rejection/error details.
 - `delivery_outbox`: account-scoped prepared delivery and idempotency status retained for legacy/recovery paths.
 - `conversation_states`: account/conversation policy and derived state JSON.
-- `conversation_automation_claims`: account/conversation/inbound-event claim with intended reply and pending/sent state.
+- `conversation_automation_claims`: account/conversation/inbound-event claim with intended reply and `pending`, `sent`, or terminal `superseded` state plus audit timestamps.
 - `runtime_state`: small process controls such as whether bot work is running.
 
 ### Configuration and telemetry
@@ -71,10 +71,12 @@ Any new candidate state needs:
 
 ## Conversation reply claims
 
-The unique identity is account + conversation + inbound message key. The claim persists the intended reply before the remote send. A pending claim is not blindly retried: Matrix history is checked first. This closes the process-crash window between remote acceptance and local completion.
+The unique identity is account + conversation + inbound message key. The claim persists the intended reply before the remote send. A pending claim is not blindly retried: Matrix history is checked first. After rate-limit waiting, Matrix is refreshed again; a newer event, boundary, received image, seller signal, operator-owned state, or repeated media request changes the claim to `superseded` and records `superseded_at`. This closes both the process-crash window between remote acceptance and local completion and the stale-send window while a reply is queued.
 
 Changes to this flow must prove at-most-once observable replies across retry and restart tests.
 
+Outcome rows are re-evaluated from the complete attributed recipient transcript. Negative outcomes take precedence over reciprocal activity. `successful_messages` rows are created only after the conversation becomes terminal/human-owned and are deleted by `sent_message_id` when later evidence changes the outcome.
+
 ## Configuration persistence
 
 On an empty database, `config.yaml` is parsed, environment-owned values are injected, the result is validated, and the application-owned subset is saved to `app_config`. Later starts load SQLite first. Dashboard changes update that record.