Let an expired lease still commit the anchor it pushed

A release pushes the anchor first and commits second. When the lease
expired in between, the commit could never land: the worker sent the
epoch from w.leases, which the expiry replay had already deleted, and
the coordinator refused a /handoff without a live owned lease. Run 10
lost a finished task this way, its work sitting in the worktree until
retry_limit.

The epoch now belongs to the release transaction, so it survives the
lease. TaskReleased retains the ending epoch as Task.LastLeaseEpoch,
and lateHandoffAccepted lets exactly that owner commit while the task
is queued, unleased, and carrying no handoff of its own. A successor
that has already re-leased the task holds the lease, so the late
handoff loses. Store.Append's version fence settles the race, which is
why the late path skips the version check the worker cannot satisfy.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CVbaKucEYBjMqVeUgJUsc1

internal/store/store.go

@@ -387,6 +387,9 @@ func (s *Store) apply(e domain.Event) error {
 	case "TaskLaunchAcknowledged":
 		t.LifecyclePhase = "started"
 	case "TaskReleased":
+		if t.Lease != nil {
+			t.LastLeaseEpoch = t.Lease.Epoch
+		}
 		t.State = domain.StateQueued
 		t.LifecyclePhase = "reclaimed"
 		t.Lease = nil

internal/store/store_test.go

@@ -663,3 +663,33 @@ func TestQuotaSinceReportsEmptyWindowAsKnownZero(t *testing.T) {
 }
 
 const fiveHours = 5 * time.Hour
+
+// TestExpiryRetainsLeaseEpoch covers the late-handoff fence: a worker that
+// pushed its release anchor and then lost the lease can only commit if the
+// projection still knows which epoch just ended.
+func TestExpiryRetainsLeaseEpoch(t *testing.T) {
+	s, err := Open(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := s.Append(created("e1")); err != nil {
+		t.Fatal(err)
+	}
+	id := s.Tasks()[0].ID
+	if _, err := s.Lease(id, "h1", time.Millisecond); err != nil {
+		t.Fatal(err)
+	}
+	leased, _ := s.Task(id)
+	epoch := leased.Lease.Epoch
+	time.Sleep(2 * time.Millisecond)
+	if _, err := s.ExpireLease(id, time.Now()); err != nil {
+		t.Fatal(err)
+	}
+	after, _ := s.Task(id)
+	if after.Lease != nil {
+		t.Fatal("expired task still holds a lease")
+	}
+	if after.LastLeaseEpoch != epoch || epoch == "" {
+		t.Fatalf("last lease epoch %q, want %q", after.LastLeaseEpoch, epoch)
+	}
+}