0.1.0: restore Grain State during action recovery

[suraciii]

Goal

Keep Confirmed State and the Application Receipt consistent when the Single Silo recovers a Pending Action.

Problem

ReportAction saves a Pending Action before it writes Grain State. Recovery must not create the Application Receipt or remove the Pending Action while Confirmed State is stale.

Contract

• ReportAction and recovery use the same State confirmation rule.
• The requested State contains the reported properties and Online set to true.
• A required State write uses a new ReportedAt value from the injected Clock.
• Recovery completes the Pending Action only after the State step succeeds.
• A failed or unknown State write keeps the Pending Action.
• An unknown write is safe to repeat. Recovery does not write State again when the requested State is already confirmed.
• Recovery applies Pending Actions in save order.
• A repeat of a completed ActionID does not roll State back.
• A Pending Action or Application Receipt for another DeviceKey is rejected.
• The process proof checks Confirmed State, the Application Receipt, and Pending Action removal.

Acceptance

• Recovery restores both Confirmed State and the Application Receipt.
• A State failure does not create the Application Receipt.
• An unknown State result is safe after process restart.
• A completed ActionID is idempotent and does not change newer State.
• Multiple Pending Actions produce State in save order.
• make ci and make external pass.

References

• examples/shadow/domain
• design/conformance-example.md
• design/persistence.md
• docs/release-0.1.0.md

[suraciii]

The reviewed local batch is complete in commit 32ce5c7.

Implemented:

• Recovery confirms requested Grain State before it completes the Pending Action.
• ReportAction and recovery share one State confirmation rule.
• State failures and unknown results keep the Pending Action.
• Recovery keeps Pending Action save order.
• A completed ActionID repeat does not roll State back.
• Pending Actions and Application Receipts validate DeviceKey.
• The external process proof now checks Confirmed State after restart.

Review:

• The first independent review found two high priority defects.
• A completed ReportAction repeat could restore old State. The code now checks the Application Receipt before the State step.
• The first SQLite order design required a schema change. The final design uses SQLite rowid and keeps the existing schema.
• The second independent review passed.

Mutation proof:

• Completing the action before State caused the State failure test to fail.
• Reversing Pending Action order caused the save-order test to fail.
• Repeating the State write after an unknown result caused the restart test to fail.
• Each mutation was removed after the expected failure.

Exact commit verification:

• go test -race ./examples/shadow/... -count=1: pass.
• go clean -testcache && make ci: pass. It ran 4 release command tests, 609 default tests, 19 simulation tests, 19 generator tests, 45 transport network tests, 48 example network tests, 2 resource tests, and 3 fuzz targets.
• go clean -testcache && make external: pass. It ran 4 release command tests, 1 Quick Start process test, and 19 external module and restart tests.
• git diff --check HEAD^ HEAD: pass.
• The worktree is clean.

Remote master is still 584f008. This issue stays open until the batch is integrated.

[suraciii]

Completed in the integrated candidate #116. Recovery confirms the requested Grain State before committing the Application Receipt, keeps failed or unknown actions pending, repeats unknown results safely, preserves save order and idempotency, and rejects cross-Device data. Exact master 0c41f9f644905183d7d4fd8f7efed24e4396bf0d passed the separate-process local make external, local make ci, and hosted run https://github.com/suraciii/gor/actions/runs/31504300130.