Test the parts that had only been driven by hand

53 new assertions across four areas, and writing them found three defects.

Accepting rolled the claim back if the relay failed — but the document already
held the decision by then, so the record would say open while the plan showed
a decision, and the next accept would append a second node with the same id.
Committing is no longer optional once the mutation lands; a relay nobody
received is recoverable, a record disagreeing with the document is not.

The queue's spent-turn check lived inside run(), where no test could reach it.
Extracted as pending(), which is also where the rule belongs: only something
that queued behind a turn can be spent.

ThreadStore.refresh dropped dismissed threads in two branches, and the test
only covered one — removing the check from the other left it green. One filter
now, and the mutation fails as it should.

Coverage: the service two-phase ordering and relationship bookkeeping against a
real Service.open room; Chat.instruct's queue, ceiling and AGENT=off gate;
eleven socket-level tests that exercise main.ts routing and the plan:open
fan-out, neither of which the handler tests reach; and the store's reducers,
including the dedupe that stops a note appearing twice for its author.

Each new test was checked by breaking the code it covers.