fix(streams): durable producer settles two inaccurate rejection reasons — close-drain reports producer-failed, single-attempt refusal reports retry-exhausted

[rickylabs]

Summary

DurableStreamProducer's reconnect supervisor (#1326) settles every write explicitly and meters
every drop path — there is no silent loss. But two settled reason strings misdescribe the state
that produced them.

1. Close-drain window. close() flips #accepted = false before the stopping transition
   (packages/plugin-streams-core/src/application/durable-stream-producer-supervisor.ts:205-226), so
   a write arriving during the drain is rejected as producer-failed while the producer is in
   fact healthy and closing (create-durable-stream.ts:131,251-261).
2. Single-attempt refusal. A non-retryable append failure settles
   delivery-unknown: retry-exhausted even on attempt 1 (supervisor.ts:412-423). No retries
   were exhausted; the server positively refused.

Why it matters

Neither is a correctness defect and neither can produce a false delivered — both were verified safe
by the separate-session IMPL-EVAL of PR #1402. The cost is diagnostic: a caller or operator reading
producer-failed during an orderly shutdown will look for a failure that did not happen, and
retry-exhausted on a first-attempt refusal hides that the server rejected the write outright.

Accurate reasons are most of the value of settling writes explicitly rather than dropping them.

Acceptance criteria

• A write rejected during the close-drain window settles with a reason naming the closing state,
  distinct from producer-failed
• A non-retryable append failure on attempt 1 settles with a reason naming the refusal, distinct
  from retry-exhausted
• Retry-exhaustion keeps its own reason for the case where retries genuinely were exhausted
• Tests assert each reason for its own state, so a future refactor that collapses them fails
• No change to which writes are accepted, rejected or delivered — reasons only

Provenance

IMPL-EVAL of PR #1402 (#1326), 2026-08-09, findings MINOR-1 and MINOR-2, both explicitly
non-blocking. Verdict record:
.llm/runs/release-0.0.5--orchestration/slices/w3-a-1326/evaluate.md.

Refs #1326.

[rickylabs]

[PHASE: PLAN]

Picked up by the 0.0.6 runtime / public-surface orchestration lane (control PR #1525, run dir .llm/runs/release-0.0.6-features--orchestration/).

Two-PR dependency plan

Order	Issue	Shape	PLAN-EVAL	IMPL-EVAL
1	#1405	small, specified, deterministic; reasons-only	N/A — complete contract	small lane, with exact negative tests
2	#1398	substantive public/runtime behaviour	required, separate session	complex lane, with live runtime + OTEL evidence

Order rationale. #1398 must prove a live subscription observes a published execution record within a bounded time. When that proof fails, the settled write reason is the first diagnostic anyone reads — and two of those reasons currently misdescribe the state that produced them (#1405). Landing #1405 first makes #1398's failure diagnostics trustworthy while its runtime evidence is being gathered.

The dependency is diagnostic, not structural: #1398 imports nothing #1405 adds, so #1398 can proceed with recorded drift if #1405 stalls.

Each issue gets its own leaf branch and its own draft PR against main. #1525 carries orchestration evidence only and never becomes an implementation umbrella — it carries no closing keyword for either issue.

Predecessor state re-baselined

#1395 (versioned SSE/OTEL envelope) merged 2026-08-09T01:25:15Z and #1402 (durable producer reconnect supervisor) merged 2026-08-09T05:11:32Z. Both are ancestors of this lane's baseline origin/main@01aa12b67, so #1398 is planned against the landed envelope and landed supervisor — and is not satisfied by either.