refactor: one durable pending-action store — the MCP park migrates up, the bespoke mechanism retires (#511)

guardrailsvc.PendingActionStore is the generic pending-action model
brought up to the MCP write park's own guarantees (restart survival,
retention-window sweep, at-most-once apply-on-approve, an opaque
Payload for restart-safe re-dispatch). RequestGuardedAction now parks
through it; mcpsvc's gated-write lifecycle (gateWrite/ResolveMCPWrite/
CancelMCPWrite/PendingMCPWrites/ResolvedMCPWrites/check_write_status)
migrates onto the same store, and MCPWriteRecord plus its bespoke
settings-key persistence are deleted. A settings file carrying the old
mcp-pending-writes key upgrades automatically (MigrateLegacyPendingWrites,
wired in main.go ahead of GuardrailService's own construction) so a
user's parked write survives the upgrade.

Every existing MCP-write/guardrail Go test and e2e spec passes
unmodified against the new seam.

🤖 Generated with Claude Code


Claude-Session: https://claude.ai/code/session_012im1JxQQV2ahnXzZDdVmZq

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: alicoding

internal/services/guardrailsvc/guardrailservice.go

@@ -58,21 +58,34 @@ type GuardrailService struct {
 	store settings.Store
 	rules []guardrail.Rule
 	comp  *compositionsvc.CompositionService
-	// guardedActionsMu guards guardedActions (guardrailservice_request.go)
-	// -- a separate lock from mu (rule CRUD): the two protect unrelated
-	// state, and a long-parked guarded action must never block a rule
-	// save/list.
-	guardedActionsMu sync.Mutex
-	guardedActions   map[string]*guardedActionRecord
+	// pending is the durable generic pending-action store
+	// (guardrailservice_pendingstore.go, docs/adr/0047 §5.4's follow-up)
+	// -- its own internal lock, separate from mu (rule CRUD): the two
+	// protect unrelated state, and a long-parked guarded action must
+	// never block a rule save/list.
+	pending *PendingActionStore
 }
 
 func NewGuardrailService(store settings.Store, comp *compositionsvc.CompositionService) *GuardrailService {
-	g := &GuardrailService{store: store, comp: comp}
+	g := &GuardrailService{store: store, comp: comp, pending: NewPendingActionStore(store)}
 	g.restore()
 	g.reconcileBuiltInRules()
 	return g
 }
 
+// PendingActionStore exposes the shared durable pending-action store
+// for a caller that wants to park through the SAME persisted store this
+// service's own RequestGuardedAction uses (mcpsvc's SetGuardrailService
+// wiring, replacing its own constructor-time default -- see
+// millmcpservice.go's pendingActionStore field doc comment for why a
+// default exists at all). Go-internal wiring only, never a frontend
+// RPC.
+//
+//wails:ignore
+func (g *GuardrailService) PendingActionStore() *PendingActionStore {
+	return g.pending
+}
+
 func (g *GuardrailService) restore() {
 	if raw, ok := g.store.Get(guardrailRulesKey).(string); ok && raw != "" {
 		var rules []guardrail.Rule