fix(session): allow explicit deletion after task settlement failure

[Jacob953]

When a runtime saves a terminal or waiting task boundary but its SettleTask acknowledgement never commits, the Session rejects further work and lifecycle operations, including deletion. This PR allows a caller to delete that Session through the existing durable Actor deletion workflow.

Related issue: #3010, case B: unsettled task boundary blocks Delete. This implements the issue's explicit-deletion alternative. It partially addresses #3010; automatic publication and recovery of the original Session remain open.

Ready for maintainer review of the deletion semantics and retained lifecycle guards.

Implementation

• Share one runtime admission query across deletion, dispatch, task writes and checkpoint creation. Only explicit DELETE may proceed despite unpublished task events. Live dispatch reservations, claimed quiescence work and checkpoint creation still block deletion. The existing workflow records deletion intent before backend cleanup and retains it for retry if cleanup fails.
• Serialize deletion admission and task settlement under the same Session row lock. If deletion starts first, late settlement of an unpublished boundary returns ErrConflict (Aborted over gRPC), including after deletion preparation fails. It cannot publish task state/history or enqueue push notifications. A previously published acknowledgement remains idempotent until final deletion.
• Keep idle expiration blocked by unpublished events. The explicit-deletion exception therefore does not allow TTL cleanup to discard an unconfirmed boundary.
• Document the behavior and remaining lifecycle guards in architecture documentation and source comments. The change is confined to Session lifecycle admission and settlement; it adds no API or schema.

Deletion discards the pending result and removes the Session's runtime through the existing deletion workflow. It does not resume the conversation. Orphaned active tasks and abandoned quiescence claims require separate recovery work.

Validation

Coverage	Result and method
Database and Session workflow	PostgreSQL-backed tests cover all four terminal states, INPUT_REQUIRED and AUTH_REQUIRED, both initial creation and later updates, deletion/settlement ordering, idempotence, callback suppression and workflow retries after partial failure. Passed under the race detector.
Go ADK settlement failure	The production Go ADK executor runs through A2A and TaskStore gRPC with PostgreSQL. Four injected settlement failures exhaust retries and leave a private completed task/public working task. Deletion admission succeeds and late settlement is rejected. The model is an in-process fixture. Passed.
Live Actor deletion	The committed TestSessionUnpublishedBoundaryDeletion stages completed and input-required boundaries through TaskStore while a real Actor is blocked at a mock model request. It checks Actor removal, rejected stale writes, a lost successful public deletion reply and no compute recreation. Go ADK cases passed on Kind 1.37.0, Substrate 0.5.0-alpha2 and gVisor on arm64.
Existing suites	Full database, migration, Session service and gRPC race suites passed without test exclusions. Inline SQL preparation and make -C go lint passed.

The TTL regression test also now takes its precise cutoffs from PostgreSQL, matching the event clock. This removes a host/container clock-skew failure in the test without changing production TTL timing. It passed 100 consecutive race runs.

Relevant commands, from go/ with Docker and the repository's envtest assets configured:

go test -race -count=1 ./core/internal/database ./core/pkg/migrations
go test -race -count=1 ./core/internal/service/session ./core/internal/grpcserver
go test -race -count=100 ./core/internal/database -run '^TestSessionExpirationRechecksActivity$'

With the clean-install E2E fixtures configured as described in go/core/test/e2e/README.md:

go test -race -count=1 -timeout 15m ./core/test/e2e -run '^TestSessionUnpublishedBoundaryDeletion$/^kagent$'

An additional local infrastructure probe verified that deletion intent survives backend unavailability and controller replacement, and a fresh request completes deletion after recovery. That probe is not a committed regression test. Lost Substrate deletion responses are covered by workflow fault tests; the live E2E test injects loss of the public API reply after success.

Pending review and validation

• Maintainer agreement on allowing explicit deletion to supersede an unpublished boundary, with the remaining guards retained.
• Upstream CI requires maintainer approval. The shared E2E test includes Codex, Claude and BYO cases, but only Go ADK was run live locally. The BYO fixture uses Go ADK through the BYO compiler. The live Kind results predate the shared-query refactor; the current head still needs the CI harness-matrix run.

AI assistance: OpenAI Codex assisted with implementation, testing and this PR description.