fix(lifecycle): address six retention and cleanup review regressions #1038

PR #1036 review found six lifecycle regressions at baseline 2db214fb0b2b9ae46dba9afdb7d72c5fabed7486. Fix and validate them together on the existing PR.

Evidence: Source = current PR code; Test = isolated SQLite/Go overlay reproduction; Live = not exercised against production.

• R1: Migrated sessions renew after accepted input. Migration and Session Manager share the revision encoding; renewal preserves historic revisions and longer deadlines, refreshes persisted lifecycle fields, and uses a persisted-revision CAS. Real migration and hot/cold manager regression tests pass.
• R2: Timeout no longer mutates forwarder-owned aggregation. Real forwarding/callback tests verify one terminal response and pass race checks. The original isolated overlay reproduced the concurrent accesses; repeated baseline runs of the real integration test did not reliably reproduce the race.
• R3: Unregistered Worker cleanup returns ErrSessionCleanupUnsupported. SQLite/PostgreSQL atomically record an unsupported purge item and a blocked aggregate status; stale leases and repeated deletes cannot overwrite or recreate the task. Registered cleanup and retry tests pass.
• R4: Paired migration 045 persists immutable retention windows and policy revisions when effect/input records are created. GC uses the stored window plus the settlement timestamp. Configuration changes affect new records; legacy NULL windows remain protected. SQLite cohort tests and the real PostgreSQL regression cover both acceptance paths, the 90-day BIGINT window, duplicate stability and GC boundaries.
• R5: First durable queue acceptance records lifecycle activity before ACK; duplicates do not renew activity. A lifecycle failure cancels the row and returns INPUT_LIFECYCLE_UPDATE_FAILED without volatile fallback. Additional same-ID retry regressions verify that lifecycle failures are not ACKed as queued and cancelled queued records report their actual terminal status, including the cached Handler path.
• R6: Bounded migration candidates and readiness now use the same maximum deadline rule. Batch-size-one regressions verify convergence after raising legacy retention, without shortening existing deadlines.

The six review fixes are delivered by commit 15986c5591dd4610de36c0bfca5cf3301daed392, followed by the PostgreSQL queue budget placeholder fix in 8cfa8a763c59bbfa9a92183650d58146b1a77cf3, dispatch/settlement/depth fixes plus regression coverage in 8a622f448ec15d70a54b0f507eb8bad2af37e6c4, effect/operator settlement type fixes in 6295259228b05ab0e66bec2e9a19ac27a62c597b, lifecycle failure-safety coverage in ae03a6c04dcaeab63de39b38c5b7b9ce653ffe9d, and serialized/bounded Repairer shutdown in 5f59804cceae18e9fc1c5da84ea78cfeb78e2c20, on PR #1036. Detailed evidence is recorded in docs/issues/2026-10-data-lifecycle/PR-review-fixes.md.

The first real PostgreSQL CI run exposed a previously untested queue budget mirror update that sent a SQLite ? placeholder directly to PostgreSQL. The finding was registered before the fix in this comment. The incremental fix uses the existing dialect rebinding; the regression test was retained unchanged.

The second real PostgreSQL run advanced through acceptance, then exposed the same omission during claim. A broader source check found the shared settlement deletion and session-depth query too. These were registered before fixing in this comment. All three use the existing dialect helper; the PostgreSQL test now also verifies claim depth changes, cancel/clear/expiry terminal states and retention snapshot stability.

The third real PostgreSQL run completed queue operations and input-retention assertions, then exposed a text/BIGINT inference error in the effect completion settlement CASE. The same pattern existed in operator actions. Both timestamp arms now have explicit BIGINT casts; the finding was registered before the fix. Coverage was extended to unknown delivery, operator terminal decisions and requeue clearing the settlement clock.

The fourth run passed ordinary tests and the real PostgreSQL regression, but session coverage was 69.8%, below the existing 70% gate. The gap was registered before adding deterministic failure-safety tests. They verify failed/refused retirement releases cached/cold deletion fences, renewal persistence errors cannot report success or change deadlines, deleted sessions cannot be revived, and legacy inputs do not acquire v2 deadlines. Local full session tests with race/shuffle/coverage passed at 72.6%. This incremental commit changes tests and the ledger only; thresholds are unchanged.

The fifth run passed PostgreSQL and the unchanged coverage gate (Linux session 70.6%), but caught a real Repairer shutdown race: background processing and shutdown draining operated on the same mutable intent. The finding was registered before a channel-controlled regression reproduced both overlapping store calls and race reports. Shutdown now has one teardown owner, waits for the loop before draining, and does not drain after a cancelled/timed-out wait. The drain has a bounded context. Active-loop, drain-only, timeout and cancellation scenarios passed 10 consecutive race/shuffle rounds.

Verification on October 9, 2026:

• Local full make quality passed: lint reported zero issues and the full Go test suite passed with -race -count=1 -shuffle=on.
• make build and make docs-lint passed. Commit/push hooks ran without bypass; all six pre-push quality gates passed.
• The PostgreSQL regression compiled locally but was skipped because HOTPLEX_TEST_PG_DSN was absent; the PR CI supplies a disposable PostgreSQL 18 database.
• Production runtime and data were not modified.

Final CI verification on October 9, 2026:

• Current PR HEAD: 5f59804cceae18e9fc1c5da84ea78cfeb78e2c20.
• CI run 37874490089 completed successfully for this exact HEAD. Every job passed, including the race/coverage test suite, real PostgreSQL regression, Coverage Check and Validation Gate.
• Both PR Checks runs for this HEAD passed branch naming and issue linkage.
• Local worktree is clean. The fixes are pushed to PR feat(lifecycle): separate runtime and history retention #1036; merge and production rollout remain outside this task.