fix(store): apply repairable cloud-upgrade mutations even when a blocker is queued

[Alan-TheGentleman]

Summary

Closes #446 — engram cloud upgrade repair --apply was all-or-nothing: if any non-repairable blocker existed among repairable findings, it returned Applied: false and repaired nothing. The message also named Findings[0] (lowest seq, usually a repairable entry) instead of the actual blocker.

Change

RepairCloudUpgrade (internal/store/store.go): when both repairable findings and a blocker are present with apply: true, apply the repairable subset first, then return Class: Blocked with Applied: true, the count repaired, and the actual blocker's seq + entity_key in the message.

Test plan

TDD red→green. New sub-test seeds a low-seq repairable mutation + a high-seq blocker, calls RepairCloudUpgrade(apply: true), and asserts Applied: true, Class == Blocked, and the message names the blocker's seq (not the repairable entry). go test ./internal/store/... and -race clean.

Notes

Passed adversarial review: partial apply runs in its own withTx (atomic), is idempotent (re-running skips repaired entries), and the only non-test caller makes no control-flow decision on Applied.

[Copilot]

Pull request overview

Fixes issue #446 where engram cloud upgrade repair --apply aborted the entire repair pass when any non-repairable blocker existed among findings, and produced a misleading manual-action message pointing at Findings[0] (lowest seq) rather than the actual blocker.

Changes:

• In RepairCloudUpgrade, apply the repairable subset when apply=true regardless of whether a blocker is present, then return Class=Blocked with Applied=true.
• Select the message finding by scanning for the first non-repairable entry (instead of Findings[0]) and include entity_key in the formatted message; differentiate messages for apply=true mixed vs apply=false mixed vs blocker-only cases.
• Add a regression sub-test seeding a low-seq repairable observation mutation and a high-seq blocked relation mutation, asserting Applied=true, Class=Blocked, and that the message names the blocker's seq and entity_key.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
internal/store/store.go	Restructures RepairCloudUpgrade to apply repairable subset before reporting blockers, picks the real blocker for the message, and adds entity_key to manual-action text.
internal/store/store_test.go	New sub-test under TestUpgradeRepairDryRunAndApply covering the mixed repairable+blocked scenario described in #446.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.