feat(desktop): B1 transactional agent store

[wpfleger96]

Replaces the autocommit+sequential-rename agent store with a substrate that makes transactional claims true end-to-end.

What changed

Commit protocol (store_journal/txn.rs)

mutate_store is the only write entry point. It owns the full lock sequence:

1. In-process mutex → OS advisory lock (flock / named mutex) → fresh fail-closed decode
2. BEGIN SQLite transaction — all journal mutations plus file serialization run inside
3. Stage both JSON files with fsync (serialization failure rolls back)
4. Insert file_commit_phases intent row inside the transaction (commit-unique stage paths)
5. COMMIT
6. Rename managed-agents.<commit_id>.stage → record first_renamed → rename teams.<commit_id>.stage → record committed
7. Release advisory lock

A closure returning Err rolls back the SQLite transaction — no journal row is written, no file is staged.

Stage paths are commit-unique (managed-agents.<uuid>.stage) so two concurrent mutate_store calls or a recovery-vs-mutation race cannot overwrite each other's temp files.

Boot recovery

run_file_commit_recovery runs synchronously under the anchored advisory lock during app setup, before any commands are admitted. This ensures the JSON store is in a consistent state before the first write arrives.

run_boot_recovery_at (called from spawn_boot_recovery) performs two phases: file-commit recovery (under advisory lock) then publication recovery (outbox re-drive into the active scoped retention DB).

Recovery uses the active scoped retention DB (anchor/retention/<sha256(relay,owner)>.db) resolved via active_retention_scope — the same database the flush loop drains. The prior flat anchor/retention.db path did not exist in production and silently nullified publication re-drive.

File recovery is fail-closed on ambiguous missing stages (intent phase, agents-absent teams-present) rather than treating absence as proof of success.

Publication authority (prepare_publication)

Single function that establishes durable evidence in a recoverable ordered protocol across two SQLite connections (journal then retention). IdentityCollision → Err. Wired for all production publication paths: agent retain/tombstone/archive, team retain/tombstone, persona pending/tombstone.

Tombstone and archive helpers (tombstone_managed_agent_pending, archive_managed_agent_pending, tombstone_team_pending, tombstone_persona_pending) return Result<(), String> — callers log errors rather than swallowing them.

Keyring chokepoint restored

persist_agent_keys_pub is called on a save-local record clone before mutate_agent_store for all creates and imports (agents.rs, personas/snapshot/import.rs). The nsec is stripped after keyring write+verify; the closure only receives a cleared record. Inline fallback preserved when keyring unavailable. Team snapshot already had this pattern.

Fail-closed event-sync / reconcile

migrate_personas_to_events and reconcile_agents_to_events resolve the advisory lock and file paths from store_anchor_dir(). Lock-acquire failure returns early.

Retention DB migration under advisory lock

active_retention_scope migrates the old per-process DB to the anchored path using the SQLite backup API under the advisory lock. Fail-closed.

Windows abandoned-mutex handling

WaitForSingleObject accepts WAIT_OBJECT_0 and WAIT_ABANDONED; rejects WAIT_FAILED with GetLastError context.

Generation intents at identity mutations

cas_generation wired for agent create/update/delete, team create/update/delete, agent settings, and team snapshot import. CasOutcome::Tombstoned and Conflict matched — create rejects tombstoned keys.

Boundary

All changes are within desktop/src-tauri/**. No mobile, frontend, or relay files.

Gates

• just desktop-tauri-clippy — zero errors, zero warnings (-D warnings)
• just desktop-tauri-test — 2207 passed, 0 failed
• just desktop-check — no ratchet violations
• cargo test --workspace (test target) — 0 warnings

Deferred to B1.1

Three items explicitly out of scope per Will's ruling (2026-08-04), tracked as B1.1 follow-up — not separate issues:

Keyring compensation protocol (CRIT 4 residual). The restore-on-crash protocol for overwritten agent keys (persist_agent_keys_journaled / pin_compensation) is not wired in production. Delete is generation-fenced via tombstone_key; what's missing is the two-phase lock-release/reacquire mechanism that would restore an old key value if the app crashed mid-overwrite. Deferred because: (a) it's substantial new surface, (b) if agent nsecs move to relay aggregates under Wes's relay-only migration plan, the local keyring-compensation protocol may shrink or disappear.

Lifecycle-only CAS (IMP residual). Start/stop/restore/runtime/shutdown mutations do not call cas_generation. These paths do not write new identity records and are already serialized by the advisory lock. Accepted as a documented design position: CAS guards identity-key ownership; the lock prevents lost updates on lifecycle writes.

Bulk boot migrations + outbox-join flusher (CRIT 2 residual). Boot event-sync/reconcile bulk writers (event_sync.rs, reconcile.rs, team_snapshot.rs snapshot-import path) still write retention directly without outbox evidence. The background flush loop still drains the retention table rather than validating a 1:1 join against outbox rows. Both require design work and belong in a dedicated B1.1 pass.