task core: record tick's poison marker; keep the bracket broken on cancellation-delivery traps

[lannbot]

task core: record tick's poison marker; keep the bracket broken on cancellation-delivery traps

Two conformance fixes from the definitions.py parity review (five parallel independent review tracks against the pinned reference; both findings re-verified in source before dispatch).

1. Store.tick's poison path bypassed the poison marker

The catch block called the raw onInstancePoisoned hook instead of notifyInstancePoisoned, so an instance poisoned by a trap under tick — a background/sibling thread, outside any export's entered set (boundary.ts's poison only marks entered-set members) — was never recorded in poisonedInstances. Every marker consumer misfired for exactly that instance:

• Thread.resumeWith's quiet-retire of late settled tails missed it — pre-scheduler: settled tails defer while their instance is not host-enterable #161 that resurrects the backstop assert;
• on current main, scheduler: settled tails defer while their instance is not host-enterable #161's dispatchableTail saw "non-enterable, non-poisoned" and deferred the instance's settled tails forever — a silent leak invisible to hasServiceableSettled. This is the observed pre-fix failure mode of the new regression test (verified against a stash);
• withPoisonCause lost the Go components trap (and poison their instance) when the Go runtime reads the clock inside cabi_realloc #145 diagnostic suffix on later entry refusals.

Reference anchor: definitions.py Store.tick (~:597) — the trap skipping leave_to is the poisoning this marker records. Fix is one line: route through the seam like every other bracket-break site (thread.ts, boundary.ts, fact_calls.ts, handles.ts).

2. Task.requestCancellation un-poisoned on a trapping delivery

Cancellation delivery was wrapped in try/finally { leaveTo(caller) }. The reference (Task.request_cancellation, definitions.py:519-532) has no handler around resume(Cancelled.TRUE): a trap skips leave_to — the Component Model's instance poisoning, the same discipline Store.tick preserves with its "deliberately NOT a finally" catch. The finally restored mayEnter on a half-unwound callee, leaving it enterable where the reference permanently locks it.

Reachable: subtask.cancel delivering TASK_CANCELLED to a cancellable block point whose resumed path traps (e.g. task.cancel with live borrows — the num_borrows trap in the same file). Now mirrors tick's catch exactly: capability signals (NeedsJspi/PendingCapability) release the bracket (the runtime is incomplete, not the component faulted); traps keep it broken, release the synthetic root (poisoning stays per-instance, plan v3 amendment 4 — a no-op for a guest caller, whose entering set is the leaf alone), and notify the poison seam. state stays cancel-delivered, matching the reference's pre-delivery assignment.

Tests

Three regression pins in task_test.ts, pre-fix failure modes confirmed against a stash:

• tick's trap path records the marker; a late settled tail of the poisoned instance drains quietly (pre-fix: expected true, got false on the marker, and the tail deferred forever);
• a trapping cancellation delivery leaves the callee locked (mayEnterFrom(caller) === false), poisoned, and in cancel-delivered (pre-fix: enterable);
• a capability signal during delivery still releases the gate and does not poison (guards the new catch against over-poisoning).

Gates

just gates — full pass. Conformance 1416 commands: 1257 passed, 0 failed, no expectation changes; sched-seeds clean. No published-surface change; lockstep version untouched per AGENTS.md.