[puretensor]

pt undo can delete work that has been claimed, promoted or advanced to its next recurrence. Its journal filter omits those events and reaches back to the task's creation. A separate history defect causes the second undo after two completions to reopen the same task again, fail, and leave the earlier completion untouched.

The fix considers only each task's newest event within the existing 50-event window, checks its current state, and performs selection and reversal in one immediate SQLite transaction. This prevents an intervening writer from invalidating the selected history. Existing delete/reopen logic is reused through connection-taking helpers. Later edits and prior reversals protect the task; bare-create undo still works.

Original-code reproduction at a95a43b: cargo test -p ptask-core undo_ --locked produced two failures: create/claim/undo deleted the task, and repeated undo returned task is not done/dismissed. Both tests now pass, alongside promotion/recurrence protection, manual reopen, priority edits after completion, existing priority-edit protection and bare-create undo. Severity: high for unintended deletion of active work; medium for blocked undo history.

Validation on Rust 1.98.1, all exit 0:

cargo test --workspace --locked
cargo clippy --workspace --all-targets --locked -- -D warnings
cargo build --workspace --locked
cargo test -p ptask-distill --features native-ml --locked
cargo clippy -p ptask-distill --all-targets --features native-ml --locked -- -D warnings
cargo fmt --all -- --check
cargo deny check advisories licenses sources
bash scripts/ci-version-check.sh
bash scripts/generated-artifacts.sh --check
bash scripts/ci-production-build-check.sh
actionlint
python3 -m unittest discover -s scripts/tests -v
PYTHONPATH=dashboard python3 -m unittest discover -s dashboard/tests -v
node --test dashboard/tests/face_unlock.test.mjs dashboard/tests/face_unlock_markup.test.mjs dashboard/tests/domains_markup.test.mjs
git diff --check
git diff origin/main -- . ':!Cargo.lock' | gitleaks stdin --redact --no-banner --log-level warn

Builds used a dedicated audit target directory and CPU fence; database tests used disposable stores.

Compatibility: a task with any newer event is skipped instead of reversing an older mutation underneath it; the search remains bounded to 50 task events. No schema change or dependency update. Workspace, internal requirements, lockfile and manpage bump together to v3.30.5. Independent branch from main at a95a43b; no dependency on other audit PRs. Version stamps will need reconciliation when several independent audit PRs land. No production testing or deployment. Remote CI runs separately on this PR; local results above are executed checks.

Additional validation limits

Native-feature tests include existing model-dependent cases that can return early when assets are unavailable; model-loaded coverage is not claimed. Local builds were debug workspace builds, not release or cross-target builds. Dependency-policy checks passed with pre-existing yanked chacha20 0.10.0 and unused BSD-2-Clause allowance warnings. The upstream-backed chacha20 correction is isolated in PR #102, not folded into this defect branch.