sqlite: run_schedules' failed-renewal arm classifies as Database, never LeadershipLost (review 004 item 9) — a lost lease (Ok(false)) keeps the respawn arm unchanged; a failed renewal (closed store / storage failure) propagates its opaque classification, so respawning misdirects at a dead store no more; dated (2026-10-11) ADR-017 §2 class-1 annotation of the loss-vs-failure arm set in ADR-009 §1, core-contract §Errors, queues.md, engine-sqlite.md, core+sqlite doc comments; two tests pin both arms; pg twin recorded for follow-up; task -> completed

docs/architecture/queues.md

@@ -207,8 +207,13 @@ Collapsed into queues: no `Scheduler` handle, no schedule objects.
   the ADR; extension path: a consumer-inventory row first).
 - `run_schedules` is opt-in: schedules never fire without a runner
   (the no-ambient-timers posture). The runner: leadership lock →
-  {renew (on loss, return before ticking — `Err(LeadershipLost)`,
-  distinct from clean `Ok(())` stop) → fire due boundaries → sleep}.
+  {renew (an actual lease loss — the refused renewal — returns before
+  ticking with `Err(LeadershipLost)`, distinct from clean `Ok(())`
+  stop; a *failed* renewal is not a loss — closed store and storage
+  failure surface the opaque `Err(Database)` classification, a dead
+  store must not misdirect the respawn recipe, annotated 2026-10-11
+  — [ADR-009](decisions/009-scheduler-collapse.md) §1, review 004
+  item 9) → fire due boundaries → sleep}.
   The `stop` parameter is a core-crate cloneable `StopToken`
   ([ADR-019](decisions/019-mechanism-handle-surfaces.md) §4).
   Leadership lock: reserved name `__alkstore_scheduler`