[FLO-3.3] Persist versioned plans, runs, checkpoints, and recovery decisions

[szmyty]

Complete: PR #63 merged on 2026-09-26 at 711fbe3c19c0e080ab6c67b74d7945cd29675a74; all five default-branch CI jobs passed. #31 is now active through #64 → #65 → #66.

Parent: #3
Suite roadmap: #11
Depends on: #29 and #30
Unblocks: #31 and the provider-adapter checkpoints

Outcome

Persist Flow's plans, runs, checkpoints, artifacts, authority decisions, validation results, and recovery choices as versioned durable state. A process restart must never silently lose or reinterpret execution intent.

Acceptance criteria

• Define versioned schemas for plans, runs, checkpoints, artifacts, authority/approval decisions, validation evidence, and recovery state.
• Persist state atomically inside an explicit workspace with stable run and artifact identities.
• Bind every checkpoint to plan digest, input digests, provider identity/version, configuration, and capability contract.
• Support deterministic reopen, status inspection, resume eligibility, and typed refusal when evidence is stale or incompatible.
• Detect corruption, partial writes, unsupported schema versions, and identity mismatches without guessing.
• Document schema migration and rollback policy before the first breaking change.
• Avoid persisting secrets or unnecessary source content; document retention and cleanup behavior.
• Add restart, cancellation, crash, corruption, and concurrent-open tests.
• Keep the existing in-memory path available to unit tests while making the supported execution path durable.
• CI, schemas, docs, and cross-platform tests are green.

Non-goals

• Real provider integrations.
• A distributed scheduler or remote state service.
• The final user-facing CLI.
• Automatic mutation or recovery without explicit authority.

Verification and handoff

• All five hosted jobs passed at the review head: Rust 1.85.0, stable Rust, repository validators, macOS, and Windows. Both Linux jobs retain normalized evidence for all 81 acceptance scenarios, each run twice in fresh workspaces.
• Eight closed durable schemas cover immutable plans, state, checkpoints, artifacts, authority, validation, recovery decisions, and snapshot envelopes. Runtime tests cover restart, interrupted commits, abrupt process exit, concurrent opens, corruption, cancellation, stale evidence, explicit retry/abandon, and privacy.
• Durable-state guide records filesystem guarantees, budgets, retention, migration, and rollback. ADR-0011 remains proposed for maintainer review.
• General graph scheduling, downstream invalidation, provider-native recovery, real adapters, and the public CLI remain outside this checkpoint. [FLO-13.4] Prove interruption, retry, resume, and authority state transitions #31 owns the next lifecycle proof through [FLO-13.4a] Revalidate dependency graphs before durable resume and execution #64 (fresh graph safety), [FLO-13.4b] Add deterministic durable lifecycle traces and recovery scenarios #65 (durable lifecycle corpus), and [FLO-13.4c] Prove authority, duplicate-effect prevention, and recovery residuals #66 (authority/effect and residual proofs). The merge and main-CI dependency is satisfied.