P2 pre-merge fixes: io_captured column, reconcile copy, harden security test

Fix 1: Add io_captured TINYINT(1) NOT NULL DEFAULT 0 to prv_call_meta
CREATE (baked into initial schema — table is new in v0.3.0, no separate
migration needed). PRV_Capture_Writer::write_io() sets io_captured=1 via
set_io_captured() on success; error rows and legacy rows keep 0.
Drawer state now driven by io_captured instead of config_version heuristic:
  0         → Legacy/not-captured
  1 + io    → Normal
  1 + no io → Pruned
ARCHITECTURE.md schema section updated.

Fix 2: Soften reconciliation copy in PRV_Costs_Renderer (~line 75):
'matches the Dashboard MTD total' → 'approximately reconciles to the
Dashboard MTD total' — error calls write prv_call_meta (cost 0) but not
prv_ai_visibility, so exact equality is not guaranteed.

Fix 3: Harden security test (test-capture-writer Test 4): inject sentinel
sk-or-TEST-LEAK-CANARY as PRV_OPENROUTER_API_KEY constant; queue a mocked
401 wp_remote_post response; drive PRV_Probe_Runner → PRV_Probe_Run_Executor
→ probe_one() 401 error path end-to-end; assert the sentinel, Bearer, and
Authorization appear in NO stored row (prv_call_meta or prv_call_io).
Original direct-writer security test retained as Test 3.

includes/core/class-prv-capture-writer.php

@@ -15,7 +15,7 @@ declare(strict_types=1);
  *   - NEVER receives $headers, $parsed_args, Authorization, or api keys.
  *   - Allowlist: prompt_text, response_text, model, peptide_slug, intent_label,
  *     tokens_in, tokens_out, cost_usd, latency_ms, cited, http_status,
- *     config_version, visibility_row, run_id, captured_at.
+ *     config_version, visibility_row, run_id, captured_at, io_captured.
  *
  * Capture is BEST-EFFORT: capture_io() is wrapped in a swallowing try/catch
  * by the caller (PRV_Probe_Runner). A write failure must never reach the probe
@@ -38,6 +38,7 @@ class PRV_Capture_Writer {
 	 *
 	 * Called inside the probe loop BEFORE capture_io() so the metadata row
 	 * exists even when the I/O write fails. Returns the inserted row ID.
+	 * io_captured is always 0 here; call set_io_captured() after write_io() succeeds.
 	 *
 	 * Side effects: Database write to prv_call_meta.
 	 *
@@ -72,8 +73,9 @@ class PRV_Capture_Writer {
 				'http_status'    => (int) ( $meta['http_status'] ?? 200 ),
 				'captured_at'    => $now,
 				'config_version' => isset( $meta['config_version'] ) ? (int) $meta['config_version'] : null,
+				'io_captured'    => 0,
 			),
-			array( '%d', '%s', '%s', '%s', '%s', '%d', '%d', '%s', '%d', '%d', '%d', '%s', '%d' )
+			array( '%d', '%s', '%s', '%s', '%s', '%d', '%d', '%s', '%d', '%d', '%d', '%s', '%d', '%d' )
 		);
 
 		return (int) $wpdb->insert_id;
@@ -85,7 +87,11 @@ class PRV_Capture_Writer {
 	 * Security: only prompt_text and response_text are stored — never
 	 * headers, Authorization, or any raw HTTP request object.
 	 *
-	 * Side effects: Database write to prv_call_io.
+	 * On success, sets io_captured = 1 on the matching prv_call_meta row.
+	 * The meta update is a best-effort follow-up; a failure here is not
+	 * propagated (caller already swallows this entire method).
+	 *
+	 * Side effects: Database writes to prv_call_io and prv_call_meta.
 	 *
 	 * @param int    $call_id       FK to prv_call_meta.id.
 	 * @param string $prompt_text   Rendered plain-text prompt (messages joined).
@@ -111,7 +117,12 @@ class PRV_Capture_Writer {
 			array( '%d', '%s', '%s', '%s' )
 		);
 
-		return false !== $result;
+		if ( false !== $result ) {
+			$this->set_io_captured( $call_id );
+			return true;
+		}
+
+		return false;
 	}
 
 	/**
@@ -143,4 +154,31 @@ class PRV_Capture_Writer {
 
 		return false !== $result;
 	}
+
+	/**
+	 * Mark io_captured = 1 on the prv_call_meta row after a successful I/O write.
+	 *
+	 * Best-effort: called internally from write_io(); failure is non-fatal.
+	 * Legacy/pre-feature rows retain io_captured = 0 (the column default).
+	 *
+	 * Side effects: Database write to prv_call_meta.
+	 *
+	 * @param int $call_id PK of the prv_call_meta row.
+	 *
+	 * @return void
+	 */
+	private function set_io_captured( int $call_id ): void {
+		global $wpdb;
+
+		$table = PRV_Call_Meta_Table::get_table_name();
+
+		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
+		$wpdb->update(
+			$table,
+			array( 'io_captured' => 1 ),
+			array( 'id' => $call_id ),
+			array( '%d' ),
+			array( '%d' )
+		);
+	}
 }