[reka18]

What this change does

A step whose context ended partway is no longer journaled. Stacked on #233.

• RunService: a settle the kernel refused returns true and ErrHandleFailed, wrapping the error, and journals nothing. After Recover the service stays in flight, so it runs a second time when the host calls RunService. Please check that this is the behavior you want.
• Tick: a due timer the kernel refused returns ErrHandleFailed and journals nothing. Recover re-arms the timer. durable: defects found in the platform-redesign review #214 doesn't list this one, but it's the same defect.
• DeliverToActor: a context that ended during the delivery returns ErrHandleFailed and journals nothing. The actor restarts from its initial state after Recover. Before this, a canceled delivery could make every later Recover fail. durable: defects found in the platform-redesign review #214 doesn't list this one either.
• The "exactly once" docs for services and actors now say a recorded result never re-runs, and an unrecorded one does.
• Recover and StateAt now fail on a canceled context, checked before each replayed Record, because a replayed settle or tick could stop silently and return state short of the journal.

Known and left open: a Fire canceled through a middleware's own derived context bypasses these guards, which only watch the caller's context.

Why

The kernel refused the step live, but the result was journaled, so recovery committed something the live instance never applied. For an actor, it left a journal Recover couldn't replay.

Relates to: #214

Evidence

On GOTOOLCHAIN=go1.27.3, in durable:

Command	Result
go test ./...	Pass, including TestService_ResultFromCanceledTurn_NotCommittedOnRecover and TestService_CanceledTurn_RecoverRerunsTheService

Checklist

• Commits are signed off (git commit -s) per the DCO
• Conventional commit messages (type: subject)
• mage check passes locally (lint + race tests + govulncheck): not run as a whole
• Tests added/updated for the change
• Public API changes documented (godoc) and, if applicable, noted for the changelog

[reka18]

Review results. One reviewer per dimension, each reading the others' findings. All seven dimensions have zero blockers on the latest round.

Fixed along the way: Tick and DeliverToActor got the same partway guard as RunService, and Recover and StateAt check the context before each Record. The canceled-turn test moved here from #213 and now asserts the live state.