Complete autonomous recovery controls

internal/domain/domain.go

@@ -151,6 +151,14 @@ type Task struct {
 	LastHarness string          `json:"last_harness_id,omitempty"`
 	PaneState   string          `json:"pane_state,omitempty"` // open, closed, unreachable, unknown
 	LastSession SessionEvidence `json:"last_session,omitempty"`
+	// Recovery state is part of the durable projection, never process-local
+	// router memory. This makes retry and operator diagnostics survive a
+	// coordinator restart.
+	Attempt        int       `json:"attempt,omitempty"`
+	NextRetryAt    time.Time `json:"next_retry_at,omitempty"`
+	FailureClass   string    `json:"failure_class,omitempty"`
+	LifecyclePhase string    `json:"lifecycle_phase,omitempty"`
+	LastError      string    `json:"last_error,omitempty"`
 }
 
 type Event struct {
@@ -190,7 +198,7 @@ func ValidateEvent(e Event) error {
 	if e.SchemaVersion >= 2 && strings.TrimSpace(e.Surface) == "" {
 		return fmt.Errorf("%w: surface required", ErrInvalid)
 	}
-	allowed := map[string]bool{"TaskCreated": true, "TaskLeased": true, "TaskLeaseRenewed": true, "TaskReleased": true, "TaskPickupValidated": true, "TaskCompleted": true, "TaskFailed": true, "TaskBlocked": true, "TaskNeedsAttention": true, "ApprovalRequested": true, "ApprovalGranted": true, "ApprovalDenied": true, "TaskAmended": true, "TaskCorrected": true, "QuotaReported": true, "StandupAdvisory": true}
+	allowed := map[string]bool{"TaskCreated": true, "TaskLeased": true, "TaskLeaseRenewed": true, "TaskReleased": true, "TaskLaunchAcknowledged": true, "TaskPickupValidated": true, "TaskCompleted": true, "TaskFailed": true, "TaskBlocked": true, "TaskNeedsAttention": true, "ApprovalRequested": true, "ApprovalGranted": true, "ApprovalDenied": true, "TaskAmended": true, "TaskCorrected": true, "QuotaReported": true, "StandupAdvisory": true}
 	if !allowed[e.Type] {
 		return fmt.Errorf("%w: unknown type %q", ErrInvalid, e.Type)
 	}
@@ -206,7 +214,7 @@ func ValidateEvent(e Event) error {
 	}
 	if e.SchemaVersion >= 3 {
 		switch e.Type {
-		case "TaskLeased", "TaskLeaseRenewed", "TaskPickupValidated":
+		case "TaskLeased", "TaskLeaseRenewed", "TaskLaunchAcknowledged", "TaskPickupValidated":
 			if v, ok := p["lease_epoch"].(string); !ok || strings.TrimSpace(v) == "" {
 				return fmt.Errorf("%w: lease_epoch required", ErrInvalid)
 			}
@@ -313,6 +321,10 @@ func ValidatePayload(typ string, p map[string]any) error {
 		if err := requiredString("reason"); err != nil {
 			return err
 		}
+	case "TaskLaunchAcknowledged":
+		if err := requiredString("harness_id"); err != nil {
+			return err
+		}
 	case "TaskBlocked", "TaskNeedsAttention":
 		if err := requiredString("blocker"); err != nil {
 			return err

internal/domain/fuzz_test.go

@@ -10,7 +10,7 @@ import (
 // of these on adversarial input is a defect regardless of whether real
 // producers happen to send well-formed payloads.
 var eventTypesUnderTest = []string{
-	"TaskCreated", "TaskLeased", "TaskReleased", "TaskCompleted", "TaskFailed",
+	"TaskCreated", "TaskLeased", "TaskReleased", "TaskLaunchAcknowledged", "TaskCompleted", "TaskFailed",
 	"TaskBlocked", "TaskNeedsAttention", "ApprovalRequested", "ApprovalGranted", "ApprovalDenied",
 	"TaskAmended", "QuotaReported", "StandupAdvisory",
 }