feat: replay inactive terminal outcomes

[JTInventory]

Intent

JT-native inactive terminal outcome replay from upstream kunchenguid#2167: durable incarnation-and-snapshot receipts and one drain-owned wake for direct done/failed crews, bounded home-local scans, strict secondmate parent correlation, focused JT tests; reporting only, never teardown, PR mutation, CAPTAIN/default, chat scrape, or forge/network calls.

What Changed

• Added bounded, home-local reconciliation for quiet direct ship/scout children, using authoritative terminal state plus incarnation/run-step evidence to create atomic fm-jt-terminal-outcome.v1 receipts.
• Routed each receipt through the wake queue and locked drain for one presentation and acknowledgement cycle, with strict secondmate parent-route and corr= validation.
• Added supporting spawn, watcher/session-start, crew-state, pending-reply, pane-idle, and safe-I/O changes, plus documentation and focused CI coverage.

Risk Assessment

✅ Low: Captain, the prior process-group cleanup issue is corrected before reaping, and the full changed source review found no additional material source-verifiable risk or intent contradiction.

Testing

The preconfigured baseline had passed, was rerun successfully, and the complete targeted inactive-outcome suite passed end to end with CLI evidence for durable replay, bounded scans, strict secondmate correlation, and fail-closed behavior. No UI surface was involved, so screenshot evidence was not applicable.

• Evidence: Full inactive-outcome suite (local file: /tmp/no-mistakes-evidence/01M079M91TXRXJJGD87TPA96JJ3/inactive-outcome-full-final-13.log)

Evidence: Required baseline batch

ok - an incomplete durable return refuses with an exact, documented recovery
ok - an unresolved-lease record is retirable and reports its still-held lease
ok - a failed return stays retryable and only retires the task branch once the return is proven
ok - teardown retries a transient index lock without weakening landed-work checks
ok - endpoint recovery consumes the immutable tmux window id
ok - endpoint recovery retains metadata when tmux presence is unreadable
ok - pending endpoint recovery retires only after confirming no task window exists
ok - pending endpoint recovery preserves an unproven matching window
exit_status=0

Evidence: Done/failed replay evidence

●━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
●  WATCHER DOWN - SUPERVISION IS OFF
●  2 task(s) in flight, but no watcher has a fresh beacon (last beat: never, grace 300s).
●  Trust the emitted supervision protocol for this harness; do not use shell & for watcher repair.
●  This is a supervision warning only; the guarded operation WILL still run.
●  repair missing watcher supervision with a foreground checkpoint: bin/fm-watch-checkpoint.sh --seconds 180.
●━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
ok - done and failed inactive outcomes are replayed once and acknowledged on drain
exit_status=0

Evidence: Bounded receipt maintenance

ok - pending-receipt maintenance rotates bounded receipt batches
exit_status=0

- Outcome: 🔧 1 issue found → auto-fixed (2) ✅ across 3 runs (2h57m38s)

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 1 issue found → auto-fixed ✅

• ⚠️ bin/fm-run-step-bridge.sh:351 - Normal completion reaps $child before run_axi_stop_group signals the process group by that PID. If the PID is reused, cleanup can TERM/KILL an unrelated process group. Stop and verify the group before reaping the leader, or validate its identity before signaling.

🔧 Fix: Hardened bridge cleanup against PID reuse
✅ Re-checked - no issues remain.

🔧 **Test** - 1 issue found → auto-fixed (2) ✅

• 🚨 tests failed with exit code 1
• bash tests/fm-worker-isolation.test.sh && bash tests/fm-watch-session.test.sh && bash tests/fm-slot-occupant-proof.test.sh && FM_TEARDOWN_TEST_FOCUS=s1 bash tests/fm-teardown.test.sh

🔧 Fix: Preserved worker declaration before run-binding PATH injection
1 error still open:

• 🚨 tests failed with exit code 1
• bash tests/fm-worker-isolation.test.sh && bash tests/fm-watch-session.test.sh && bash tests/fm-slot-occupant-proof.test.sh && FM_TEARDOWN_TEST_FOCUS=s1 bash tests/fm-teardown.test.sh

🔧 Fix: Fixed optional worktree parsing; focused teardown tests pass
✅ Re-checked - no issues remain.

• bash tests/fm-worker-isolation.test.sh && bash tests/fm-watch-session.test.sh && bash tests/fm-slot-occupant-proof.test.sh && FM_TEARDOWN_TEST_FOCUS=s1 bash tests/fm-teardown.test.sh
• bash tests/fm-inactive-outcome.test.sh
• bash tests/fm-worker-isolation.test.sh && bash tests/fm-watch-session.test.sh && bash tests/fm-slot-occupant-proof.test.sh && FM_TEARDOWN_TEST_FOCUS=s1 bash tests/fm-teardown.test.sh
• FM_INACTIVE_TEST_ONLY=test_done_and_failed_are_replayed_once bash tests/fm-inactive-outcome.test.sh
• FM_INACTIVE_TEST_ONLY=test_pending_receipt_republish_is_bounded bash tests/fm-inactive-outcome.test.sh
• FM_INACTIVE_TEST_ONLY=test_postpublication_uncertainty_is_not_replayed bash tests/fm-inactive-outcome.test.sh

✅ **Document** - passed

✅ No issues found.

🔧 **Lint** - 1 issue found → auto-fixed (2) ✅

• ⚠️ linter found issues (exit code 1)

🔧 Fix: Captain: fix inactive reconciliation ShellCheck warnings
1 warning still open:

• ⚠️ linter found issues (exit code 1)

🔧 Fix: Fix ShellCheck warnings across scripts and fixtures
✅ Re-checked - no issues remain.

✅ **Push** - passed

✅ No issues found.