[reka18]

What this change does

The next step ordinal survives a checkpoint that compacts the whole tail. The checkpoint envelope now records the step that follows it, and recovery uses the last tail Record, then the envelope, then the old Trace count. Stacked on #230.

A checkpoint written before this change keeps the old fallback, which can still reuse a step. durable has no release tags, despite the [0.1.0] changelog heading, so this should only reach unreleased checkpoints.

Why

Recovery derived the next step from the Trace count, which doesn't match the ordinals past a tick barrier. The next Fire reused a recorded step. This also removes the hard failure #229 gave recovery from a compacted checkpoint.

Relates to: #214

Evidence

On GOTOOLCHAIN=go1.27.3, in durable:

Command	Result
go test ./...	Pass, including TestRecover_StepAfterTickCheckpoint_IsPersisted
go test -race -skip TestRunner_FireDuringTimerLoop_LosesNoAcknowledgedSteps ./...	0 race warnings
Pinned golangci-lint	0 issues

Checklist

• Commits are signed off (git commit -s) per the DCO
• Conventional commit messages (type: subject)
• mage check passes locally (lint + race tests + govulncheck): not run as a whole, and it cannot pass until the rest of the chain lands
• Tests added/updated for the change
• Public API changes documented (godoc) and, if applicable, noted for the changelog

[reka18]

ACR round 1: correctness

Reviewed the step-numbering commit. 0 blockers, so correctness is confirmed.

Checked clean: 1,550 randomized Fire/Tick/Recover runs on MemStore and FileStore across checkpoint intervals, with exact step continuity. Service and single-Trace actor recovery, append-then-failed-checkpoint recovery, FileStore reopen, StateAt across compaction, and envelope byte determinism.

Non-blockers, folded in:

• The comments and changelog said the Trace count undercounts. It can also overcount, on a multi-Trace actor delivery. Reworded.
• The changelog overstated ErrStepConflict: a reused step with an identical record is still dropped as a retry. Reworded.

Not fixed here:

• A checkpoint written before this change can still lose a step through the old fallback. durable has no release tags, so this is limited to unreleased checkpoints.
• checkpointDue can be skipped forever when tick barriers keep stepping over the interval (every 8, barriers on even steps: 50 ticks, no checkpoint). This predates the change and isn't in durable: defects found in the platform-redesign review #214.
• After a failed Checkpoint, the same Handle's next step could conflict. Fixed by the lock PR, which is stacked on this one.

[reka18]

Update since review. #213 is closed. This PR now carries the tests it turns green, and it's stacked on #231 in stack #239. The code under review didn't change, and durable passes with -race and lint at this head.