feat(edgesync): add StateExported to the spoke ledger (#569)

[xe-nvdk]

PR 9a of 4 for the air-gap bundle (item 9 of #569). The ledger state comes first because the format and endpoints depend on it. Next: 9b format/MAC/export, 9c import/dedup, 9d ack.

Why this is a separate PR

The original plan was one PR that left exported files in pending. An adversarial review of the plan caught that this does not converge, and I reproduced it:

without StateExported:  9 files, batch 3, 3 rounds -> 3 files, each exported 3x
with it:                9 files, batch 3, 3 rounds -> 9 files, exactly once each

Pending orders partition_time DESC (ledger.go:392), so a capped export re-takes the newest N every time and the oldest files never leave the box. A submarine on a 90-day cycle would ship the same recent data forever while its backlog silently starved. That is a treadmill, not eventual consistency.

Transitions

pending  -> exported   MarkExported, bundle ID required
exported -> synced     MarkSynced, widened for the ack path (9d)
exported -> pending    RevertExported, scoped to one bundle

MarkExported accepts only pending: an in_flight row belongs to a running network transfer, and exporting it concurrently would put one file on two paths with no way to reconcile which acknowledgment arrived.

MarkSynced previously accepted only pending/in_flight, so an ack for an exported file would have been rejected — an air-gap spoke could never reach synced, PruneSynced would never prune, and the ledger would grow forever on the box least able to receive a site visit. Defined now even though the ack ships in 9d.

Operator surface

• Stats counts exported separately, but PendingBytes still includes exported bytes — a file on a drive in transit has not arrived, and excluding it would make the backlog appear to shrink at exactly the moment nothing was delivered.
• Unfinished includes exported entries, so they stay visible in the troubleshooting view.
• exported_at / exported_bundle_id are readable on LedgerEntry and on the ledger endpoint. RevertExported filters on the bundle ID in SQL, but an operator whose drive did not arrive needs to read it to know what to revert. (Raised in review — previously only reachable by opening the SQLite file.)

Schema

Two nullable columns, added with tolerated duplicate-column errors since SQLite has no ADD COLUMN IF NOT EXISTS. 26.09.1 is unreleased (no tag), so only development databases are affected.

Test plan

• 7 new tests; the starvation test verified to fail pre-change (3 of 9 files, each 3×), and the bundle-ID test likewise
• Both mutants confirmed to compile before trusting the failure — a false negative I have hit before
• Migration verified on a real pre-9a spoke database: 20 rows and their states preserved, restart idempotent, no duplicate-column error
• Live binary: exported counted separately from pending, ledger endpoint lists the exported file first rather than hiding it
• go test -race, go vet, gofmt clean

🤖 Generated with Claude Code