fix: reconcile interrupted shutdown delivery without replay ↗

The helper marks only history without a proven terminal result as eligible for restore.

func HasUnprovenOutcome(submission Submission) bool {
  if submission.State == SubmissionInterruptedUnknown {
    return true
  }
  if submission.TerminalEventRetained || submission.TerminalSequence != 0 {
    return false
  }
  switch submission.State {
  case SubmissionFailed, SubmissionCompleted, SubmissionCancelled:
    return true
  default:
    return false
  }
}

The descriptor hides retired uncertain history so repeat adoption uses the same rule.

func submissionNeedsRecovery(submission Submission) bool {
  if submission.Retired && (submission.State == SubmissionInterruptedUnknown || HasUnprovenOutcome(submission)) {
    return false
  }
  switch submission.State {
  case SubmissionPrepared, SubmissionAccepted, SubmissionDispatching, SubmissionInterruptedUnknown:
    return true
  case SubmissionCompleted:
    return !submission.TerminalEventRetained
  default:
    return false
  }
}

The selector retires a prompt only when journal and SQL agree on identity and uncertainty.

case journal.SubmissionInterruptedUnknown, journal.SubmissionCompleted, journal.SubmissionFailed, journal.SubmissionCancelled:
  if !journal.HasUnprovenOutcome(submission) {
    continue
  }
  sqlSubmission, found := backend[submission.ID]
  if !found || sqlSubmission.State != models.DeliverySubmissionInterruptedUnknown {
    if submission.State == journal.SubmissionFailed || submission.State == journal.SubmissionCancelled {
      continue
    }
    return nil, fmt.Errorf("%w: native resume requires uncertain SQL history", ErrDurableAdoptionBlocked)
  }

The path finishes retirement for an idle native successor from the stored prompt binding.

func (m *Manager) ReconcileLoadedNativeDelivery(ctx context.Context, sessionID string) (*models.NativeResumeDeliveryEvidence, error) {
  execution, exists := m.GetExecutionBySessionID(sessionID)
  if !exists || execution == nil {
    return nil, ErrDurableAdoptionEvidenceUnavailable
  }
  if !execution.promptMu.TryLock() {
    return nil, ErrDeliveryRecoveryBlocked
  }
  defer execution.promptMu.Unlock()
  if execution.Status != v1.AgentStatusReady || execution.dispatchedPromptPending.Load() {
    return nil, ErrDeliveryRecoveryBlocked
  }

The entry rechecks retained evidence and stream projection before it resumes a legacy session.

func (s *Service) resumeLegacyNativeRestart(ctx context.Context, session *models.TaskSession) (bool, error) {
  if session == nil || session.State != models.TaskSessionStateWaitingForInput || !silentRestoreSessionRouteEligible(session) {
    return false, nil
  }
  source, err := s.legacyNativeRestartSource(ctx, session)
  if err != nil || source == nil {
    return false, err
  }