agent: Implemented the explicit persisted webhook state machine.

README.md

@@ -15,9 +15,10 @@ private OpenCode server on the same Docker network as Gitea.
 | PR | `/agent iterate [message]` | Resume an agent implementation and its reviewer once. |
 | PR | `/agent fix [message]` | Start a fresh one-shot fix session and push one commit. |
 
-The requester must have Gitea `write`, `admin`, or `owner` permission on the repository. Each
-accepted command gets one Gitea comment, which is updated as the job moves from queued to started
-and then to its final result or failure. Remaining review findings are included in the final update.
+The requester must have Gitea `write`, `admin`, or `owner` permission on the repository. Commands
+are durably sequenced when their webhook arrives, then authorized and executed in that receive
+order. Each command gets one Gitea comment, which is reconciled asynchronously through queued,
+running, and terminal states. Deleted comments are rediscovered by their hidden marker or recreated.
 
 ## Deploy
 
@@ -127,11 +128,17 @@ The `opencode_home` volume contains provider authentication, OpenCode's database
 sessions. Tea's Gitea token configuration is regenerated in an ephemeral tmpfs and is not copied to
 `opencode_home`. Back up both persistent volumes together.
 
+SQLite stores the current job state, an idempotent event inbox, and durable listener tasks. State
+transitions and workflow creation/linking commit atomically; timestamps are storage metadata rather
+than reducer state. Control effects retry with bounded backoff. A delayed authorization blocks later
+workflow execution but not later control work.
+
 The OpenCode migration tags existing workflows as Codex-owned and preserves their session IDs for
 rollback, but OpenCode refuses to resume them. Follow-up commands against those workflows ask for a
-new plan or implementation. Queued jobs survive restart. An in-progress job is aborted in OpenCode
-and marked failed instead of being replayed because a partial model turn may already have changed
-files. Git pushes are never forced.
+new plan or implementation. Queued jobs survive restart. A restart before `JobStarted` returns the
+task to the queue; after `JobStarted`, the job is failed, its sessions are aborted, and execution is
+never replayed because a partial model turn may already have changed files. Git pushes are never
+forced.
 
 ## Development