Settle a release transaction deterministically in every case

F60, and the general rule F58 and F59 were reaching for one case at a
time: a transaction must settle or be abandoned deterministically, and
must never spin on an answer that cannot change.

Terminal now means failed or completed. Both drop the transaction and
free the session; nothing will ever lease either task again.

Blocked keeps the transaction, because a reopen returns the task to the
queue and that exact owner can still commit. TaskBlocked therefore
retains the ending epoch the way TaskReleased already did, or the
late-handoff path would have nothing to fence against after the reopen.

A refusal parks the commit instead of retrying every five seconds. It
is the coordinator's answer about who owns the task, so it stays true
until an event about that task arrives, and any such event un-parks it.
A reopen arrives as TaskCorrected, so the rule cannot be a list of
event types. Backoff runs 30s to a 5 minute cap.

A transport failure is not an answer and keeps retrying at once. That
distinction is the whole reason the park keys on a 4xx StatusError
rather than on any error at all.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CVbaKucEYBjMqVeUgJUsc1

internal/store/store.go

@@ -424,6 +424,13 @@ func (s *Store) apply(e domain.Event) error {
 		t.Lease = nil
 	case "TaskBlocked", "TaskNeedsAttention":
 		if e.Type == "TaskBlocked" {
+			if t.Lease != nil {
+				// Same reason as TaskReleased: a worker may hold a pushed
+				// anchor whose commit was refused. A reopen returns the task
+				// to the queue, and the late-handoff path can only accept it
+				// if the epoch that ended is still on record.
+				t.LastLeaseEpoch = t.Lease.Epoch
+			}
 			t.State = domain.StateBlocked
 			t.Lease = nil
 		} else {

internal/store/store_test.go

@@ -693,3 +693,33 @@ func TestExpiryRetainsLeaseEpoch(t *testing.T) {
 		t.Fatalf("last lease epoch %q, want %q", after.LastLeaseEpoch, epoch)
 	}
 }
+
+// A worker can hold a pushed anchor whose commit was refused when an operator
+// blocks the task. A reopen returns it to the queue, and the late-handoff path
+// can only accept that exact owner if the epoch that ended is still recorded.
+func TestBlockRetainsLeaseEpochForALaterReopen(t *testing.T) {
+	s, err := Open(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := s.Append(created("e1")); err != nil {
+		t.Fatal(err)
+	}
+	id := s.Tasks()[0].ID
+	if _, err := s.Lease(id, "h1", time.Minute); err != nil {
+		t.Fatal(err)
+	}
+	leased, _ := s.Task(id)
+	epoch := leased.Lease.Epoch
+	p, _ := json.Marshal(map[string]any{"blocker": "parked by the operator", "harness_id": "h1", "lease_epoch": epoch})
+	if err := s.Append(domain.Event{ID: domain.NewID(), Type: "TaskBlocked", TaskID: id, Version: leased.Version + 1, Payload: p, Surface: string(authz.System)}); err != nil {
+		t.Fatal(err)
+	}
+	after, _ := s.Task(id)
+	if after.State != domain.StateBlocked || after.Lease != nil {
+		t.Fatalf("expected a blocked unleased task, got %s lease=%v", after.State, after.Lease)
+	}
+	if after.LastLeaseEpoch != epoch || epoch == "" {
+		t.Fatalf("last lease epoch %q, want %q", after.LastLeaseEpoch, epoch)
+	}
+}