fix(workflow): reload the store and reap once when a window takes over - #2707

Verdict: PASS at 04ec140
Written-by: Reviewer
Attestation: 04ec140 role=Reviewer

Ran at this tip:

$ cd plugins/workflow && node --import ./test/resolve.mjs --test test/takeover.test.js
# tests 2  # pass 2  # fail 0
$ node --import ./test/resolve.mjs --test "test/*.test.js"
# tests 491  # pass 491  # fail 0
$ cp /data/dsh/bot/workspace/p2707/base/plugins/workflow/src/service.js src/service.js && node --import ./test/resolve.mjs --test test/takeover.test.js
# tests 2  # pass 0  # fail 2  (F1 and F2 red without the change)
$ diff -u /data/dsh/bot/workspace/p2707/base/plugins/workflow/src/service.js src/service.js
# only the takeover/reap hunks above; no maxConcurrent, assign, setConcurrency, stop or reset semantics moved

Review points, against the tip tree extracted from the tarball (harness packages linked from a local 0.2.1-rc.2 install; a first run without them failed only on ERR_MODULE_NOT_FOUND @deepseek-ai/dsh-llm, not on code):

• F1 (takeover = state change). writer = !readOnly() at construction; writable() sends the first call that finds the host writable through takeover() → adoptStore() (re-read + migrate + purge + seq) → re-check readOnly() → only then writer = true. Read order is lock → re-read → write, one time only; a writer that later loses the lock is refused exactly as before (reapRuns and write() both re-check). write() refuses before its first byte when !writer, so an endpoint that skipped the guard cannot land a stale copy.
• F2 (reap once). The load-time body is extracted verbatim into reapRuns(); takeover() starts it once and reap()/dispose() hand that same promise back instead of releasing twice. lane.queue is untouched: F2 asserts the queued card starts, the dead run is archived failed/host-ended, its Bots are released exactly once, and activeCount/queueDepth return to 1/1. A second call is a no-op (run no longer running, no ephemeral map), and a failed release keeps its id for the next retry.
• Rest of the +171/−86 is the extraction, the writable() guard on each write endpoint, and the state()/dispose() refresh — no change to maxConcurrent, assign/queue rules, setConcurrency, stop or reset return values or codes.
• Red first confirmed: base blob of service.js (71855d9d) with the new test file makes both F1 and F2 fail; the tip passes.
• Tests are real: takeover.test.js spawns real child processes, uses the real core/src/host/home-lock.js and a real kill -9; neither the lock nor the store is mocked.
• Scope: 4 files (service.js, takeover.test.js, docs/subsystems/workflow.md, changelog.d/2704-workflow-takeover.fixed.md); no core/, no inflight.json is truncated before it is written, so a crash drops every turn it was meant to resume #2705/A timeline trace that started behind another writer never retries the lock, and flush() reports success while dropping spans #2706 files.
• Checks at tip: tests-ok, plugins (workflow|social|tree|timeline), package, merge-gate, reviewed tip and risk tier green; only enqueue-guard red (no PASS yet) plus a cancelled judge run from a duplicate workflow trigger.