sqlite: run_schedules' failed-renewal arm classifies as Database, never LeadershipLost (review 004 item 9) — a lost lease (Ok(false)) keeps the respawn arm unchanged; a failed renewal (closed store / storage failure) propagates its opaque classification, so respawning misdirects at a dead store no more; dated (2026-10-11) ADR-017 §2 class-1 annotation of the loss-vs-failure arm set in ADR-009 §1, core-contract §Errors, queues.md, engine-sqlite.md, core+sqlite doc comments; two tests pin both arms; pg twin recorded for follow-up; task -> completed

docs/architecture/core-contract.md

@@ -605,7 +605,15 @@ and `LeadershipLost` (`run_schedules` return on leadership loss) —
 both from [ADR-009](decisions/009-scheduler-collapse.md) §6 — are
 part of contract v1's initial text (pre-release additions per
 [ADR-017](decisions/017-contract-versioning.md) class 1; the
-"post-v1 additions" framing an earlier draft used is retired). Pinning rule: a variant exists only when
+"post-v1 additions" framing an earlier draft used is retired).
+`LeadershipLost` is the *loss* arm only — the lease expired and was
+re-acquired elsewhere; a *failed* renewal is not a loss and never
+returns `LeadershipLost`: a closed store (respawning a leader
+against a dead store is misdirected — the engine-wide closed-store
+posture) and storage failure both surface the opaque `Database`
+fallback with the engine detail preserved via the source chain
+(annotated 2026-10-11 — review 004 item 9; ADR-009 §1's dated
+classification note). Pinning rule: a variant exists only when
 callers can act differently on it. Queue claim "no work" and job/lock
 boolean results are values, not errors; dead-letter is observable
 state (`get_job`), not an error.