fix: make worker handoff rotation durable

internal/store/store_test.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 
@@ -51,6 +52,80 @@ func TestLeaseCarriesReleasedHandoffRef(t *testing.T) {
 	}
 }
 
+func TestRenewLeaseRequiresCurrentOwnerAndVersion(t *testing.T) {
+	s, err := Open(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := s.Append(domain.Event{ID: "create", Type: "TaskCreated", TaskID: "t", Version: 1, Payload: []byte(`{"source":"s","external_id":"renew","project":"p"}`), Surface: string(authz.System)}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := s.Lease("t", "worker-a", time.Minute); err != nil {
+		t.Fatal(err)
+	}
+	before, _ := s.Task("t")
+	if _, err := s.RenewLease("t", "worker-b", before.Version, time.Hour); !errors.Is(err, domain.ErrConflict) {
+		t.Fatalf("other worker renewal = %v, want conflict", err)
+	}
+	if _, err := s.RenewLease("t", "worker-a", before.Version-1, time.Hour); !errors.Is(err, domain.ErrConflict) {
+		t.Fatalf("stale renewal = %v, want conflict", err)
+	}
+	e, err := s.RenewLease("t", "worker-a", before.Version, time.Hour)
+	if err != nil {
+		t.Fatal(err)
+	}
+	after, _ := s.Task("t")
+	if e.Type != "TaskLeaseRenewed" || after.Version != before.Version+1 || after.Lease == nil || !after.Lease.Until.After(before.Lease.Until) {
+		t.Fatalf("renewal was not projected: before=%+v after=%+v event=%+v", before, after, e)
+	}
+	if _, err := s.RenewLease("t", "worker-a", before.Version, time.Hour); !errors.Is(err, domain.ErrConflict) {
+		t.Fatalf("replayed renewal = %v, want conflict", err)
+	}
+}
+
+func TestBlockedTaskProjectsStructuredDiagnosisAndLegacyFallback(t *testing.T) {
+	s, err := Open(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := s.Append(domain.Event{ID: "create", Type: "TaskCreated", TaskID: "t", Version: 1, Payload: []byte(`{"source":"s","external_id":"blocked","project":"p"}`), Surface: string(authz.System)}); err != nil {
+		t.Fatal(err)
+	}
+	payload := []byte(`{"blocker":"worker is offline","block_reason":"worker_offline","pane_id":"p1","harness_id":"w1","pane_state":"unreachable"}`)
+	if err := s.Append(domain.Event{ID: "blocked", Type: "TaskBlocked", TaskID: "t", Version: 2, Payload: payload, Surface: string(authz.System)}); err != nil {
+		t.Fatal(err)
+	}
+	task, _ := s.Task("t")
+	if task.BlockReason != domain.BlockReasonWorkerOffline || task.LastPaneID != "p1" || task.PaneState != "unreachable" {
+		t.Fatalf("blocked diagnosis was not projected: %+v", task)
+	}
+	if got := domain.InferBlockReason("handoff validation failed"); got != domain.BlockReasonHandoffValidation {
+		t.Fatalf("legacy fallback=%q", got)
+	}
+}
+
+func TestTerminalSessionEvidenceSurvivesSessionCleanup(t *testing.T) {
+	s, err := Open(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := s.Append(domain.Event{ID: "create", Type: "TaskCreated", TaskID: "t", Version: 1, Payload: []byte(`{"source":"s","external_id":"evidence","project":"p"}`), Surface: string(authz.System)}); err != nil {
+		t.Fatal(err)
+	}
+	ref, err := s.PutArtifact([]byte("report"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	payload := []byte(`{"report_ref":"` + ref + `","receipt":{"source":"worker"},"session_evidence":{"pane_id":"w:p1","harness_id":"worker-1","pane_state":"open","source":"worker","captured_at":"2026-07-29T12:00:00Z","checked_at":"2026-07-29T12:00:01Z"}}`)
+	if err := s.Append(domain.Event{ID: "complete", Type: "TaskCompleted", TaskID: "t", Version: 2, Payload: payload, Surface: string(authz.System)}); err != nil {
+		t.Fatal(err)
+	}
+	task, _ := s.Task("t")
+	if task.LastSession.PaneID != "w:p1" || task.LastSession.Source != "worker" || task.LastSession.CapturedAt.IsZero() || task.LastHarness != "worker-1" {
+		t.Fatalf("terminal session evidence was lost: %+v", task)
+	}
+}
+
 func TestAppendReplayAndDeduplicate(t *testing.T) {
 	dir := t.TempDir()
 	s, err := Open(dir)
@@ -314,3 +389,41 @@ func TestExpectedVersionIsCheckedForEveryWriter(t *testing.T) {
 		t.Fatalf("expected CAS conflict, got %v", err)
 	}
 }
+
+func TestReleaseTransactionSurvivesReLeaseUntilMatchingPickup(t *testing.T) {
+	s, err := Open(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := s.Append(created("create")); err != nil {
+		t.Fatal(err)
+	}
+	leased, err := s.Lease("task-1", "predecessor", time.Minute)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ref, err := s.PutArtifact([]byte("handoff"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	anchor := strings.Repeat("a", 40)
+	p, _ := json.Marshal(map[string]any{"handoff_ref": ref, "anchor_sha": anchor, "transaction_id": "tx-1", "expected_version": leased.Version})
+	if err := s.Append(domain.Event{ID: "release", Type: "TaskReleased", TaskID: "task-1", Version: leased.Version + 1, Payload: p, Surface: string(authz.System)}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := s.Lease("task-1", "successor", time.Minute); err != nil {
+		t.Fatal(err)
+	}
+	task, _ := s.Task("task-1")
+	if task.ReleaseTransaction != "tx-1" || task.ReleaseAnchor != anchor || task.HandoffRef != ref {
+		t.Fatalf("re-lease lost transaction: %+v", task)
+	}
+	p, _ = json.Marshal(map[string]any{"transaction_id": "tx-1", "handoff_ref": ref, "anchor_sha": anchor, "harness_id": "successor", "lease_version": task.Version, "expected_version": task.Version})
+	if err := s.Append(domain.Event{ID: "pickup", Type: "TaskPickupValidated", TaskID: "task-1", Version: task.Version + 1, Payload: p, Surface: string(authz.System)}); err != nil {
+		t.Fatal(err)
+	}
+	task, _ = s.Task("task-1")
+	if task.PickupTransaction != "tx-1" || task.PickupLeaseVersion != 4 {
+		t.Fatalf("pickup not bound to transaction/epoch: %+v", task)
+	}
+}