Orrey can lose the only record of something it published

Four findings from the phase-1 review that share one shape and were left out of the fix PRs (#70–#72) on purpose: each needs a decision, not a patch. None of them can bite in phase 1, where sessions are seeded by hand and never deleted — but all four get reachable the moment the console and the lifecycle exist.

**The remote object outlives Orrey's memory of it.**

1. **Create-then-store has a crash window.** `projectDiscordEvent` POSTs the scheduled event, then writes the id to D1. If the write fails, the queue retries, `discord_event_id` is still null, and it creates a *second* event — the first one orphaned, with nobody holding its id. Google is immune because its id is derived from the session id; Discord has no equivalent. Options: put the session id in the event's `description` and look before creating, or write an intent row before the call.

2. **`postAttendancePost` has the same window** — `postMessage` succeeds, the id write fails, the job re-runs, and a second post goes up with live buttons. That is exactly what the "post once" guard exists to prevent, and under send-only the duplicate cannot be tidied away.

3. **A `*.delete` whose session row is already gone acks and does nothing.** Delete is precisely the case where the row is disappearing, so this is the common path, not the rare one. Either the delete message carries the ids, or the retraction happens before the row goes.

4. **`ON DELETE cascade` destroys the ids.** Deleting a session takes `calendar_links` (and `sessions.discord_event_id`) with it — the only record that a Google event and a Discord event exist out there. After that no reconcile can find them.

The through-line: **Orrey's database is the source of truth, so anything Orrey published must remain findable from it.** Today a published object's id can be lost while the object stays up.

Worth settling before phase 2's lifecycle (#22) gives people a way to delete and conclude things, and before phase 7's reconcile (#48) has to explain events it cannot account for.