fix(cv): sync operation terminal state

docs/work-programmes/decisions.md

@@ -779,3 +779,13 @@
 - **Consequences:** a rare account deletion globally clears the shared summary cache because entries are not owner-keyed. An unavailable sidecar delays completion but does not restore deleted live rows/files. Production still needs protected volume custody, provider semantics, retention decisions and a disposable restore rehearsal.
 - **User approval required:** Production activation and operational mutation only. Repository implementation remains inert behind `ACCOUNT_DELETION_ENABLED=false`.
 - **Reversible:** Keep deletion disabled, drain any in-flight request, then revert the endpoint/client and Compose volume mapping. Never remove a deployed tombstone ledger while older restorable backups exist.
+
+## DEC-079 — Synchronize durable CV terminal state centrally
+
+- **Date:** 2026-08-15
+- **Decision:** When the shared operation store cancels, terminally fails, recovers an expired deadline, or retries a `cv.process` operation, update its explicitly referenced owner-scoped `CvExtractionRun` in the same transaction boundary.
+- **Reason/evidence:** cancellation before worker claim was authoritative in `UserOperation` but left the domain history row queued indefinitely. Focused 17/17 tests cover cancel-before-claim, retry, deadline recovery and existing lease behavior; backend 660/660 passes.
+- **Alternatives considered:** reconcile only in the controller; wait for a later worker; add a generic observer framework. These miss recovery paths, preserve stale history, or overbuild a two-task operation system.
+- **Consequences:** generic operations remain independent; the one existing persisted subject projection is synchronized through a narrow task/subject check with an explicit owner predicate.
+- **User approval required:** No; local consistency fix with no schema, dependency or production change.
+- **Reversible:** Revert the store helper/tests. No stored format changed.