feat(ha-convergence-recovery): commit-gated scheduler egress — submit_lsn tagging + watermark gate (task 1.2)

src/controller/job.c

@@ -89,9 +89,12 @@ int load_jobs(void* c)
 
 /* Reconstruct a job from a WAL_JOB_SUBMIT Cap'n Proto payload.
  * Uses the jobid embedded in the serialized xce_job_t (not the caller's arg).
+ * entry_lsn is the WAL entry LSN of this submit record (ha-convergence-recovery
+ * 3.3): the restored job is tagged with it so its commit status is decidable at
+ * scheduler-export time.  0 = unknown (pre-feature / direct create) = exportable.
  * Returns -EEXIST if the job is already present (idempotent replay guard). */
 int restore_job(cluster_t* c, uint64_t jobid_unused,
-                const void* capnp_payload, size_t len)
+                const void* capnp_payload, size_t len, uint64_t entry_lsn)
 {
     (void)jobid_unused;
 
@@ -121,6 +124,12 @@ int restore_job(cluster_t* c, uint64_t jobid_unused,
     job_t* job = create_job(c, &j);
     if (!job)
         return -errno;
+    /* ha-convergence-recovery (3.3): tag the restored job with its submit
+     * entry's LSN so the egress watermark predicate can decide its commit
+     * status (job_submit_committed).  On a promoted primary, replayed entries
+     * sit at or below the promotion truncation point, so restored jobs are
+     * exportable by construction. */
+    job->submit_lsn = entry_lsn;
     return 0;
 }