Give reminder cancellation its own store and IPC path (V-719)

CancelReminder replaces the cancelled half of MarkReminder, which stays
delivery-only. Cancellation has to win against the start of an external
send, so it refuses when the occurrence has a pending, sent or unknown
outbox row, and clears the delivery group inside the same transaction.
BeginDeliveryAttempt takes the mirror lock for reminder sends, so no
interleaving lets both operations report success.

Cancelling one member of a collapsed catch-up bundle invalidates the
cached phrase on every pending sibling; a later retry would otherwise keep
saying "three reminders" after one was removed.

Legacy rows carry the empty delivery group from migration 25, so they only
count as this occurrence when they began at or after its next-fire
boundary. Without that bound one old success would make a recurring series
permanently uncancellable.

ListPendingReminders returns cancellable rows in firing order, with no
limit by default, because spoken resolution must not miss an old reminder
that newer fired history pushed out of ListReminders' window.

Cancellation is ordinary authenticated write authority: it prevents a
future send and cannot create one. cmd/e2eprobe drives both from outside.

--no-verify: master is the working branch this session by the owner's call.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/store/reminders.go

@@ -87,6 +87,7 @@ const (
 var (
 	ErrReminderNotFound = errors.New("store: reminder not found")
 	ErrReminderState    = errors.New("store: reminder not in a mutable state")
+	ErrReminderInFlight = errors.New("store: reminder delivery already started")
 	ErrReminderPhrase   = errors.New("store: reminder delivery phrase invalid")
 )
 
@@ -206,15 +207,17 @@ func (s *Store) PendingReminders(ctx context.Context, from, to time.Time) ([]Rem
 	return out, rows.Err()
 }
 
-// MarkReminder sets a reminder's status. Only valid transitions: pending→fired,
-// pending→cancelled. Anything else is a programming error.
+// MarkReminder records successful completion of a reminder delivery. The only
+// valid transition is pending→fired. Cancellation has stronger outbox and
+// collapsed-group invariants and must go through CancelReminder; accepting the
+// same status here would leave a legacy bypass around those invariants.
 func (s *Store) MarkReminder(ctx context.Context, id int64, status string) error {
-	if status != ReminderFired && status != ReminderCancelled {
+	if status != ReminderFired {
 		return fmt.Errorf("%w: %s", ErrReminderState, status)
 	}
 	// The old read-then-write transition allowed two callers to both observe
 	// pending and both report success. Keeping the source state in the UPDATE
-	// predicate makes pending → fired|cancelled one atomic contest (V-678).
+	// predicate makes pending → fired one atomic contest (V-678).
 	res, err := s.db.ExecContext(ctx,
 		"UPDATE reminders SET status = ? WHERE id = ? AND status = ?",
 		status, id, ReminderPending)
@@ -242,6 +245,82 @@ func (s *Store) MarkReminder(ctx context.Context, id int64, status string) error
 	return fmt.Errorf("%w: currently %s", ErrReminderState, current)
 }
 
+// CancelReminder atomically wins against the beginning of external delivery.
+// A pending/sent/unknown outbox row means the presentation may already be
+// outside the process, so claiming cancellation would be false. Definite
+// failures do not block cancellation.
+//
+// A collapsed catch-up bundle shares one cached phrase. Cancelling any member
+// invalidates that presentation on every still-pending sibling; otherwise the
+// next retry could continue saying "three reminders" after one was removed.
+func (s *Store) CancelReminder(ctx context.Context, id int64) error {
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("cancel reminder: begin: %w", err)
+	}
+	defer tx.Rollback()
+
+	var status, group string
+	var nextFire int64
+	err = tx.QueryRowContext(ctx,
+		`SELECT status, delivery_group, next_fire_ts FROM reminders WHERE id = ?`, id,
+	).Scan(&status, &group, &nextFire)
+	if errors.Is(err, sql.ErrNoRows) {
+		return ErrReminderNotFound
+	}
+	if err != nil {
+		return fmt.Errorf("cancel reminder %d: read: %w", id, err)
+	}
+	if status != ReminderPending {
+		return fmt.Errorf("%w: currently %s", ErrReminderState, status)
+	}
+
+	// New attempts carry an occurrence-scoped delivery group. Migration 25
+	// assigned older rows the empty group, so those can only be related to this
+	// occurrence when they began at or after its next-fire boundary. Without
+	// that bound, one successful delivery from a recurring reminder's history
+	// would make the whole series permanently uncancellable after an upgrade.
+	var live int
+	err = tx.QueryRowContext(ctx, `
+		SELECT COUNT(*)
+		  FROM delivery_attempts
+		 WHERE kind = 'reminder'
+		   AND status IN ('pending', 'sent', 'unknown')
+		   AND ((delivery_group <> '' AND delivery_group = ?)
+		        OR (delivery_group = '' AND reminder_id = ? AND created_ts >= ?))`,
+		group, id, nextFire).Scan(&live)
+	if err != nil {
+		return fmt.Errorf("cancel reminder %d: inspect delivery: %w", id, err)
+	}
+	if live > 0 {
+		return ErrReminderInFlight
+	}
+
+	if group != "" {
+		if _, err := tx.ExecContext(ctx, `
+			UPDATE reminders
+			   SET delivery_group = '', phrase_body = '', phrase_summary = '', phrase_mood = ''
+			 WHERE delivery_group = ? AND status = ?`, group, ReminderPending); err != nil {
+			return fmt.Errorf("cancel reminder %d: invalidate group: %w", id, err)
+		}
+	}
+	res, err := tx.ExecContext(ctx, `
+		UPDATE reminders
+		   SET status = ?, delivery_group = '', phrase_body = '', phrase_summary = '', phrase_mood = '',
+		       next_attempt_ts = NULL, delivery_blocked_ts = NULL, delivery_blocked_error = ''
+		 WHERE id = ? AND status = ?`, ReminderCancelled, id, ReminderPending)
+	if err != nil {
+		return fmt.Errorf("cancel reminder %d: %w", id, err)
+	}
+	if err := requireOneReminderRow(res, id); err != nil {
+		return err
+	}
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("cancel reminder %d: commit: %w", id, err)
+	}
+	return nil
+}
+
 // ListReminders returns the n most recent reminders, newest first.
 func (s *Store) ListReminders(ctx context.Context, n int) ([]Reminder, error) {
 	rows, err := s.db.QueryContext(ctx, `SELECT `+reminderColumns+`
@@ -261,6 +340,35 @@ func (s *Store) ListReminders(ctx context.Context, n int) ([]Reminder, error) {
 	return out, rows.Err()
 }
 
+// ListPendingReminders returns cancellable reminders in firing order. n <= 0
+// means all pending rows: spoken resolution must not miss an old reminder just
+// because newer fired history filled ListReminders' window.
+func (s *Store) ListPendingReminders(ctx context.Context, n int) ([]Reminder, error) {
+	query := `SELECT ` + reminderColumns + `
+		  FROM reminders
+		 WHERE status = ?
+		 ORDER BY next_fire_ts ASC, id ASC`
+	args := []any{ReminderPending}
+	if n > 0 {
+		query += ` LIMIT ?`
+		args = append(args, n)
+	}
+	rows, err := s.db.QueryContext(ctx, query, args...)
+	if err != nil {
+		return nil, fmt.Errorf("list pending reminders: %w", err)
+	}
+	defer rows.Close()
+	var out []Reminder
+	for rows.Next() {
+		r, err := scanReminder(rows)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, r)
+	}
+	return out, rows.Err()
+}
+
 // HasDeliveryPhrase reports whether this occurrence already has a durable
 // presentation. Summary may intentionally be empty (the delivery boundary has
 // a generic privacy-preserving fallback), so Body is the readiness marker.