sqlite: run_schedules' failed-renewal arm classifies as Database, never LeadershipLost (review 004 item 9) — a lost lease (Ok(false)) keeps the respawn arm unchanged; a failed renewal (closed store / storage failure) propagates its opaque classification, so respawning misdirects at a dead store no more; dated (2026-10-11) ADR-017 §2 class-1 annotation of the loss-vs-failure arm set in ADR-009 §1, core-contract §Errors, queues.md, engine-sqlite.md, core+sqlite doc comments; two tests pin both arms; pg twin recorded for follow-up; task -> completed

alkstore/src/store.rs

@@ -127,7 +127,13 @@ pub trait Store: Send + Sync {
     /// boundaries; sleep until the next boundary or `stop`}. A
     /// cancelled [`StopToken`] ends the sleep and returns the clean
     /// `Ok(())`; leadership loss returns `Err(LeadershipLost)` — the
-    /// caller's recipe is to respawn (ADR-009 §1).
+    /// caller's recipe is to respawn (ADR-009 §1). A *failed* renewal
+    /// is not a loss and never returns `LeadershipLost`: a closed
+    /// store (respawning a leader against a dead store is misdirected
+    /// — the engine-wide closed-store posture) and storage failure
+    /// both surface the opaque `Err(Database)` fallback with the
+    /// engine detail preserved via the source chain (annotated
+    /// 2026-10-11 — review 004 item 9; ADR-017 §2 class 1).
     fn run_schedules<'a>(&'a self, stop: StopToken) -> BoxedFuture<'a, Result<()>>;
 
     /// Closure-scoped transaction — a wrapper over [`Store::begin_tx`]