Give the pipeline stage ledger a reader

Nothing outside internal/coordinator could read pipeline_stage_records -- no
RPC, no session-event kind -- so the per-stage verdicts, timings and skip counts
the whole Pipeline Refinement milestone produces were invisible to any
interface. The evidence existed and had no reader.

PipelineStageService.ListPipelineStages returns one task attempt's recorded
flow. An RPC rather than a durable session event, decided on the shape of the
data: the rows are immutable and fully written before any interface could
announce them, they are addressed by task and attempt rather than delivered in
one session's live order, and the session snapshot is correctness-bearing base
state rather than a stage-by-stage audit trail. Live progress is a real but
different concern the existing tool and plan events already serve.

Migration 000036 adds elapsed_measured. StartedAt and FinishedAt alone cannot
distinguish an untracked start from a genuinely instant stage -- both store
identical equal timestamps -- and inferring it from that equality is exactly
the overstatement this ledger exists to avoid. The bit is decided at write time,
the only point that knows why the timestamps match, and the handler leaves
elapsed unset rather than an explicit zero when unmeasured, so a client reading
only that field cannot quietly treat "not measured" as "instant".

Named elapsed rather than duration, matching TaskView.elapsed, and documented at
the proto as wall clock from the previous stage's record rather than the check's
own processing time.

Bounded at LIMIT 128 as defence in depth -- the schema already caps an attempt
at 64 rows -- with a test proving the bound does not clip a real 38-stage flow.

Proven to discriminate twice: sabotaging the storage write to infer
measured-ness from timestamp inequality failed the re-read assertion, and
sabotaging the handler to always set elapsed failed the wire test.

Unblocks PIPE-006a and PIPE-044.

Committed with --no-verify at the user's explicit request.

TODO: PIPE-006b

Change-Log: CL-20260802-064
Dev-Log: DL-20260802-074
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: claude

CHANGELOG

@@ -42,6 +42,43 @@ Dev-Log:
 
 Entries
 -------
+Change-ID: CL-20260802-064
+Commit: pending
+Date: 2026-08-02
+Type: Feature -- the pipeline stage ledger becomes readable
+Request-or-TODO: PIPE-006b
+Outcome: PipelineStageService.ListPipelineStages exposes one task attempt's
+  recorded flow -- stage number, name, verdict, and elapsed timing with an
+  explicit measured signal. Nothing outside internal/coordinator could read
+  pipeline_stage_records before this, so the evidence the whole Pipeline
+  Refinement milestone produces had no reader at all.
+  An RPC rather than a durable session event: the rows are immutable and fully
+  written before any interface could announce them, they are addressed by task
+  and attempt rather than delivered in one session's live order, and the session
+  snapshot is correctness-bearing base state rather than a stage-by-stage audit
+  trail. An event would have bought live per-stage animation at the cost of
+  threading a payload through every write site and multiplying session-event
+  volume by up to 38 per attempt for data already durable in SQL.
+  Migration 000036 adds elapsed_measured, because StartedAt and FinishedAt alone
+  cannot distinguish an untracked start from a genuinely instant stage -- both
+  store identical equal timestamps. The bit is decided once at write time, in
+  the only place that knows why the two are equal, and the handler leaves
+  elapsed unset rather than an explicit zero when unmeasured
+Affected-behavior: A new authenticated, bounded read surface. No existing
+  behavior changes
+Compatibility-or-migration: Forward migration 000036 adds one column;
+  migration-check accepts it and generate-check accepts the regenerated protobuf
+Verification: Proven to discriminate twice. Sabotaging the storage write to
+  infer measured-ness from timestamp inequality made the re-read assertion fail;
+  sabotaging the handler to always set elapsed made the wire test fail. Both
+  reverted and re-verified. A further test proves the LIMIT 128 read bound does
+  not clip a real 38-stage flow, and TestAUDIT008 confirms the new service is
+  registered and refuses an unauthenticated call
+Known-limitations: attempt=0 resolves to attempt 1, matching
+  NextPipelineAttempt's convention. There is no "latest attempt" concept
+  anywhere in the product and this surface does not invent one
+Dev-Log: DL-20260802-074
+
 Change-ID: CL-20260802-063
 Commit: pending
 Date: 2026-08-02

DEVLOG

@@ -25,6 +25,45 @@ Next-safe-step:
 
 Entries
 -------
+Dev-Log: DL-20260802-074
+Date: 2026-08-02
+Status: Read path landed; PIPE-006a and PIPE-044 unblocked
+Change-ID: CL-20260802-064
+Commit: pending
+Request-or-TODO: PIPE-006b
+Goal: Give the pipeline stage ledger a reader
+Assumptions: Evidence nobody can read is not evidence
+Decisions: Chose an RPC over a session event on the shape of the data rather
+  than on convenience -- immutable rows, already durable, addressed by task and
+  attempt, read retrospectively by a reviewer rather than watched live. Live
+  progress is a real but different concern that the existing tool and plan
+  events already serve.
+  Added an explicit elapsed_measured bit instead of inferring it. Inference from
+  timestamp equality is exactly wrong here: a stage that genuinely took zero
+  microseconds and a stage whose start was never tracked are indistinguishable
+  that way, and the ledger's whole purpose is to not overstate what it knows.
+  Decided the bit at write time, since that is the only point that knows why the
+  timestamps match.
+  Left elapsed unset rather than zero on the wire when unmeasured, so a client
+  reading only that field cannot quietly treat "not measured" as "instant".
+  Named the field elapsed rather than duration, matching TaskView.elapsed, and
+  documented at the proto that it is wall clock from the previous stage's record
+  rather than the check's own processing time
+Files-or-schemas: api/proto and its regenerated output,
+  internal/storage/pipeline_stage_repository.go and a new test,
+  migrations/000036_pipeline_stage_elapsed_measured.sql,
+  internal/transport/pipeline_stage_service.go and test,
+  internal/coordinator/pipeline_stage_reader.go and test, application.go
+Validation: build, gofmt, generate-check, migration-check, the storage package
+  in full, the transport package, a SQLite end-to-end gRPC test, TestAUDIT008,
+  and lint -- all clean
+Failures-or-discarded-approaches: The session-event design, above. Also rejected
+  inferring measured-ness in the transport layer, which would have put the
+  judgement furthest from the knowledge
+Known-limitations: No latest-attempt resolution, deliberately
+Next-safe-step: PIPE-006a can render this, once PIPE-042 supplies the skip ratio
+  PIPE-044 needs
+
 Dev-Log: DL-20260802-073
 Date: 2026-08-02
 Status: Closing at the decision site