F1a: persist the runner lifecycle in the Store

[mchwang]

Lane F, step F1, slice F1a: the Store. The F1 contract (#49) is merged; this PR now targets main. Related: #22, #51.

What this does

Adds the durable half of the F1 runner lifecycle contract (docs/implementation/runner-lifecycle.md). There is no coordinator, HTTP or shutdown wiring yet; those are later slices.

• Schema v6 and backfill. New tables tasks, attempts, user_actions and feedback_events. Every v5 plan gets one task row with the documented defaults. A merged plan becomes merged and gets its task-closed event. A null budget means "not started", never expired.
• Guarded attempt transitions. Admission (including retry) checks the task status, the state version, the requeue claim, a pending cancel, an active attempt and the captured context in one transaction. recordFirstReason is the same-state "Stopping" transition, and markRunning is refused once a stop reason is recorded.
• The Store chooses the terminal state. settleAttempt takes D's result and the in-memory first reason, and applies the precedence in runner/lifecycle.ts (classifySettlement), so the precedence lives in one place:
  1. the saved or in-memory first reason (a D stop that came before shutdown wins);
  2. then a changed context, which gives stale;
  3. then D's own stop reason;
  4. then the exit status and validation.
• Two counters. Every plan-revision, snapshot or assignment change increases both the context generation and the state version in the same transaction (#savePlan, #snapshot, setAssignment). Lifecycle changes increase only the state version.
• Task closure.
  • cancelTask closes at once, or, with an active attempt, stops it first and closes when it settles. A pending cancel beats the time limit.
  • Cancel is refused while a merge is being submitted or queued.
  • finishMergeAttempt(merged) now closes the task and writes task-closed in the same transaction.
• User actions. userAction gives exact replay for a UUID-v4 action ID: the same request returns the saved response without re-applying it. A different request with the same ID is refused. Guard refusals are recorded and replayed; storage errors are not.
• Feedback events. recordFeedback works only inside a user action, and supersedes by source. feedbackEvents is lane J's read path and is available once the task closes.
• Nested transactions. #transaction now joins an outer transaction, so a user action can wrap existing Store methods atomically.

Contract change found while implementing

The running → failed guard in the contract said "no first reason". That contradicted the round-19 rule that a D stop before shutdown ends failed. I fixed the row on #49 (e44d04a).

Validation (head 4c83e78, rebased onto main after #49 merged)

• npm run typecheck: passes.
• CI's unit set (npm test minus the Docker suites): 470 passed, 0 failed. 26 of those tests are new, in test/runner-lifecycle-store.test.ts. The 26th test, from contract round 35, checks that a result never completes into a task that isn't running, and fails without the guard.
• Mutation check: six guards were broken one at a time, and each was caught by at least one test:
  • markRunning ignoring the first reason;
  • admission skipping the context check;
  • a pending cancel not winning;
  • refusals not recorded;
  • shutdown ignoring D's reason;
  • no context bump on a snapshot change.
• npm run test:browser: 47 passed in a full run.
• Flaky browser tests already on main: three review.spec.ts tests are timing-sensitive ("preserves edits made while a question submission is in flight" ×2, and "drains an in-flight question request…"). Run alone three times each, they failed 2 of 12 with this change and 3 of 12 without it. So this PR doesn't cause them; I'm flagging them separately.
• The Docker suites (agent-*) weren't run locally; this PR doesn't touch agents/.

Not in this slice

F1b (coordinator), F1c (shutdown wiring and /api/runner), F1d (startup recovery and the OS lock), F1e (planning endpoints and wiring feedback into review actions). The F1 implementation must not merge as a whole until #51's pre-F1 D items land.

🤖 Generated with Claude Code