fix: report OPFS completion honestly and bound public cache staging

A durable write whose journal transaction could not be completed returned
plain success with `SUCCEEDED` telemetry. The payload was committed but
the transaction stayed `COMMITTED`, so the reconcile backlog and its quota
pressure grew while every caller was told the write had settled. That is
now a `RECONCILE` failure with the effect certainty preserved, and an
unfinished delete is observed `DEGRADED` rather than clean.

The worker seam lost causes in both directions. A bootstrap failure
answered every request with kind `CAPABILITIES`, so the gateway read a
kind mismatch and replaced the real `BLOCKED` or `QUOTA_EXCEEDED` with a
generic `UNSUPPORTED`; the envelope's correlation is now captured once at
the listener. On the client, the pending row and its timer were released
before the reply was decoded, so a trap that threw inside the decoder left
the public promise pending with nothing left to time it out, and a
throwing `requestId` getter produced a timeout instead of a prompt
protocol failure.

Public cache staging handed its signal to each `Request` and called that
ownership. A fetch that ignored it held the mutation lock forever, and a
digest that finished after the abort still wrote both the asset and the
activation marker — publishing a release nobody was waiting for. One
terminal owner now covers the whole staging body and every await
re-checks it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/unit/opfs-byte-store.test.ts

@@ -352,6 +352,123 @@ describe("OPFS byte-store coordinator", () => {
     expect(JSON.stringify(observations)).not.toContain("object_12345678");
   });
 
+  /**
+   * NS-04. Awaiting `journal.complete` without checking it reported a settled
+   * transaction that nobody settled: the caller saw plain success and success
+   * telemetry while the durable row stayed `COMMITTED`, so the reconcile
+   * backlog grew invisibly.
+   */
+  it("does not report a settled write when the journal cannot complete it", async () => {
+    const journal = createJournal();
+    journal.complete = async () =>
+      browserDataFailure("UNAVAILABLE", "INDEXEDDB_WRITE", {
+        retryable: true,
+        recovery: "RECONCILE",
+      });
+    const observations: { operation: string; outcome: string }[] = [];
+    const adapter = createOpfsByteStoreAdapter({
+      journal,
+      worker: createWorker(),
+      scope,
+      storagePolicy,
+      policy: {
+        ...resolveOpfsRuntimePolicy(),
+        chunkSizeBytes: 64 * 1024,
+        maxObjectBytes: 64 * 1024,
+        maxChunkCount: 1,
+      },
+      createTransactionId: () => "transaction_12345678",
+      now: () => 100,
+      observer: (event) =>
+        observations.push(event as { operation: string; outcome: string }),
+    });
+
+    const result = await adapter.objects.put({
+      objectId: "object_12345678",
+      expectedGeneration: null,
+      mediaType: "application/octet-stream",
+      source: sourceFrom(new Uint8Array([1, 2, 3])),
+    });
+
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      // The payload is durable, so recovery is reconciliation, not a rewrite.
+      expect(result.error.recovery).toBe("RECONCILE");
+      expect(result.error.operation).toBe("OBJECT_WRITE");
+    }
+    expect(
+      observations.some(
+        (event) =>
+          event.operation === "OBJECT_WRITE" && event.outcome === "SUCCEEDED",
+      ),
+    ).toBe(false);
+    // The committed row stays the reconciler's authority.
+    expect(journal.transactions.get("transaction_12345678")?.phase).toBe(
+      "COMMITTED",
+    );
+    expect(journal.objects.get("object_12345678")).toBeDefined();
+  });
+
+  it("records maintenance debt when a committed delete cannot be completed", async () => {
+    const journal = createJournal();
+    const observations: { operation: string; outcome: string }[] = [];
+    const policy = {
+      ...resolveOpfsRuntimePolicy(),
+      chunkSizeBytes: 64 * 1024,
+      maxObjectBytes: 64 * 1024,
+      maxChunkCount: 1,
+    };
+    const writer = createOpfsByteStoreAdapter({
+      journal,
+      worker: createWorker(),
+      scope,
+      storagePolicy,
+      policy,
+      createTransactionId: () => "transaction_12345678",
+      now: () => 100,
+    });
+    await writer.objects.put({
+      objectId: "object_12345678",
+      expectedGeneration: null,
+      mediaType: "application/octet-stream",
+      source: sourceFrom(new Uint8Array([1, 2, 3])),
+    });
+
+    // The journal can commit the deletion but cannot settle the transaction.
+    const remover = createOpfsByteStoreAdapter({
+      journal: {
+        ...journal,
+        complete: async () =>
+          browserDataFailure("UNAVAILABLE", "INDEXEDDB_WRITE", {
+            retryable: true,
+            recovery: "RECONCILE",
+          }),
+      },
+      worker: createWorker(),
+      scope,
+      storagePolicy,
+      policy,
+      createTransactionId: () => "transaction_87654321",
+      now: () => 200,
+      observer: (event) =>
+        observations.push(event as { operation: string; outcome: string }),
+    });
+
+    // Logical deletion is already committed, so the caller must not be asked to
+    // repeat a non-idempotent delete — but it is not a settled success either.
+    const result = await remover.objects.remove({
+      objectId: "object_12345678",
+      expectedGeneration: 1,
+    });
+
+    expect(result.ok).toBe(true);
+    const deleteOutcomes = observations
+      .filter((event) => event.operation === "OBJECT_DELETE")
+      .map((event) => event.outcome);
+    expect(deleteOutcomes.at(-1)).toBe("DEGRADED");
+    expect(deleteOutcomes).not.toContain("SUCCEEDED");
+  });
+
   it("deep-snapshots scope and policy at composition against caller mutation", async () => {
     const journal = createJournal();
     const mutableScope = { ...scope };