fix(036): timedelta import + emit_terminal status mapping + C5 decision memory

agent/src/ss_tools/agent/_run_tracker.py

@@ -166,10 +166,12 @@ class RunTracker:
         error_code: str | None = None,
         error_detail: str | None = None,
     ) -> None:
-        """Mark the run as COMPLETED, FAILED, or CANCELLED."""
+        """Mark the run as completed, failed, or cancelled.
+        Maps run-level status to lowercase event status for Pydantic validation."""
+        status_map = {"COMPLETED": "completed", "FAILED": "failed", "CANCELLED": "skipped"}
         await self.append_event(
             event_type="terminal",
-            status=status,
+            status=status_map.get(status, "completed"),
             payload={"error_code": error_code, "error_detail": error_detail},
         )
 

backend/src/services/agent_runs/service.py

@@ -6,7 +6,9 @@
 # @RELATION DEPENDS_ON -> [Schemas.AgentRun]
 # @RELATION DEPENDS_ON -> [Services.AgentRuns.Repository]
 # @INVARIANT Terminal runs are immutable; sequence monotonicity enforced; dual-auth for internal writes.
-from datetime import UTC, datetime
+# @RATIONALE Durable backend-of-record design chosen because Gradio is a restartable client — run state must survive worker restarts for long-running scenario generation. Dual-auth pattern (user JWT for browser reads, service JWT for agent writes) keeps the ownership boundary explicit without exposing service credentials to the browser.
+# @REJECTED Storing authoritative run state only in Gradio or frontend memory — rejected because both are ephemeral. Admin override of terminal runs — rejected because immutable audit trail is required for compliance. Soft-delete instead of hard immutability — rejected because it creates ambiguity in recovery snapshots.
+from datetime import UTC, datetime, timedelta
 import hashlib
 import json
 from typing import Any