Let scout cleanup finish after a captain decision is answered and archived

[EvanAgee]

What this fixes

The completion check that guards scout cleanup (bin/fm-decision-hold.sh, its verify and complete paths) used to fail once a captain decision had been answered, marked done, and then aged out of the backlog by Done-history retention. Because the hold was gone, verify treated a genuinely answered decision as unverifiable and refused, so the investigation could never be cleaned up.

The change makes verify tolerate that archived-but-answered case without ever waving through a decision the captain did not answer.

The rule the gate now enforces

An absent hold passes only when all of these hold:

• The captain answered it through a real close path (resolve, answer, decline, or repair), recorded durably in the origin's metadata as answered_keys. This record lives beside decision_keys, not in the trimmed backlog body, so it survives retention.
• The decision was durably held before (its key is in decision_keys, which complete writes only after verifying the hold existed). A never-registered key still fails.
• The backlog file is present, non-empty, and structurally a backlog. A missing, empty, or unstructured backlog fails loudly instead of being read as a trimmed hold.
• The key is not currently open (a decision re-asked in a later round is not treated as answered by an earlier round's record).

The status-log answer route was removed. A worker writes its own status lines (bin/fm-brief.sh tells a crewmate or scout to append its own resolved [key=...] line when a blocker clears without a firstmate reply), so a resolved [key=X]: answered: ... line is forgeable by the very agent whose source deletion this gate guards. The only positive proof is now the metadata record that only a real close path writes.

Supporting fixes in the same branch: the intactness check resolves the backlog path the way tasks-axi does; the durable answer is recorded before the irreversible close so a metadata-write failure never reports an already-closed hold as not closed; and the record step no longer resurrects a torn-down origin's metadata.

Validation

All four decision-hold suites pass by hand on this head (932e8ab3):

• fm-classify-decision-key — 29 ok
• fm-wake-drain-open-decisions — ok
• fm-wake-drain-open-decisions-cursor — ok
• fm-decision-hold-lifecycle — 32 ok, including the archived-answered case, the never-registered refusal, the broken-backlog refusals, the forged-marker refusal, the re-asked-key refusal, and the real fm-send chat-answer flow driven end to end into the metadata record and through archival

bin/fm-lint.sh is clean.

Why the automated pipeline was skipped

This branch cleared the pipeline's review, test, and document steps across earlier rounds. It was not merged through the pipeline because the review-fix agent hit three consecutive 30-minute infrastructure timeouts (the agent went silent and was killed each time). That is an infrastructure failure, not a verdict on the code. After the third timeout the captain authorized shipping on the passing steps via a direct push and PR, the same fallback used for firstmate PR #75.

Known-open item, deferred by decision

One answer-proof hole is not closed on this head and is called out plainly so it is not mistaken for fixed:

A worker can defeat the re-open guard with its own self-close. Chain: the captain answers round one (records answered_keys); the worker re-asks the decision (needs-decision for the same key); the worker then writes its own bare resolved [key=X]: ... line, which closes the key in the open-decision fold; the re-open guard checks "is the key open now," sees "no," finds the stale round-one record, and passes an unanswered round two.

The fix was approved (clear the key from answered_keys when complete re-inventories a re-opened key, plus a RED-then-green regression test that reproduces the bypass through the real scripts). It is not in this PR because it was the exact fix round that hit the third pipeline timeout, so it never committed. The existing re-open test covers only the case where round two is left open, which the current guard already catches; it does not cover the self-close bypass. This should be the first follow-up on this code.

Also tracked as follow-ups

• Re-open self-close bypass (above) — approved fix, not yet applied.
• The backlog-path config parser diverges from tasks-axi on two odd inputs (duplicate path keys, a # inside a quoted path). Approved fix, not yet applied.
• A backlog wiped down to only its section headings still reads as intact — tracked in Decision-hold gate: a headings-only wiped backlog still reads as a trimmed hold #87.

Authority

Merge stays firstmate-gated. This PR was opened by direct push under explicit captain authorization after the three pipeline timeouts; it is not a claim that the automated gate passed.