fix: preserve command effect certainty across retries

Separate per-attempt physical state from the logical execution history. The
executor now keeps one monotonic certainty accumulator joined through
joinMutationEffectCertainty, records MAYBE_APPLIED at dispatch, and reads the
accumulator from every retry-loop fence, final-invariant, cancellation and
timeout return.

A retry-time scope fence landing between the loop-entry check and the
pre-dispatch invariant can no longer downgrade an already dispatched command to
NOT_STARTED.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/architecture/decisions/VD-23-api-transport-selection-and-rest-execution.md

@@ -262,6 +262,22 @@ auth-required operation은 session state가 `authenticated`가 아니면 fetch
 `integration-failed`, `unauthenticated`와 credential attach rejection을 anonymous
 request로 downgrade하지 않는다.
 
+#### 5-0. Logical effect certainty는 단조 증가한다
+
+`PhysicalAttemptState`는 현재 attempt만 설명한다. logical execution 전체에는
+별도의 monotonic accumulator를 두고 `joinMutationEffectCertainty`로 join한다.
+join 순서는 보수적이다.
+
+```text
+NOT_STARTED < NOT_APPLIED < MAYBE_APPLIED < APPLIED_CONFIRMED
+```
+
+`fetch()` dispatch 시점에 command는 즉시 `MAYBE_APPLIED`를 기록한다. 이후 retry
+loop entry, pre-dispatch final invariant, scope fence, cancellation, timeout
+return은 모두 accumulator를 읽는다. 아직 보내지 않은 새 retry가 있다는 이유로
+전체 logical operation을 `NOT_STARTED`로 되돌리지 않는다. query operation은
+`NOT_APPLICABLE`로 남고 이 lattice를 쓰지 않는다.
+
 #### 5-1. Installed auth profile registry (V3 집행)
 
 `installRestAuthProfileRegistry()`가 composition 시점에 profile을 한 번 설치하고