Roadmap item 3: add inactive reconciliation planner

[yihanzhu]

What changed

This adds the final pure planning unit for Roadmap item 3. The jq filter reads a canonical scanner observation, a canonical delivery ledger, exact caller references, and a concurrency limit. It returns a stable inactive plan.

The plan keeps one composite delivery key across pending and failed redelivery, suppresses acknowledged delivery, advances only bounded retry attempts, preserves stranded attempt numbers, copies operator recovery messages as data, and defers excess work in a stable order.

Inactive boundary

This filter only plans. It does not dispatch, schedule, execute recovery, write state, use a credential or network, activate a profile, publish, or touch a target. It adds no launcher, driver, process boundary, or live selection.

Exact proof

Head: 419c5c1
Base: 1f99263

• Focused reconciliation plan test: 21/21 passed.
• Portable core schema test: 47/47 rules, 141/141 direct cases, 13/13 route probes, 8/8 registry cases, 39/39 guard cases, 8/8 numeric cases, 8/8 review findings, and 44/44 legacy assertions; zero failures.
• Bash syntax passed.
• ShellCheck 0.11.0 passed over every shell script at style severity.
• Pinned jq 1.6 static compile, canonical repeat output, single schema import, and raw generation-ID absence checks passed.
• Required-file structure and append-only manifest checks passed.
• Exact six-path diff, no rename, forbidden-path absence, and diff whitespace checks passed.

No local full suite or pre-PR advisory review was run, as required.

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: 419c5c1
Reviewed-base: 1f99263
reviewer: review_reconciliation_217 @ high

CLEAN — zero unresolved Important findings.

Bugs

• Exact shapes, refs, sorting, uniqueness, bounds, timestamps, and retry relations fail closed.
• Stable composite delivery keys support first delivery, pending and failed same-key redelivery, acknowledged suppression, bounded retry increment, and same-attempt stranded recovery.
• Redeliveries receive deterministic priority. Active slots, failed redelivery allocation, and full or partial backpressure are correct.
• Deferred entries, suppressions, deliveries, and operator messages are explicit and canonically ordered.
• Malformed, stale, duplicate, unsorted, and oversized inputs return the closed input error.

Security

• The planner is one pure jq module with no launcher, driver, process, dispatcher, scheduler, state writer, recovery executor, credential, target, candidate, activation, publish, or external effect.
• Output is explicitly inactive, planning-only, and authority-free.
• Input remains validated data and never forms commands, paths, environment values, or capabilities.
• No raw selected generation ID is embedded. The schema guard adds only the exact planner import path, with no glob, prefix, fallback, or broader allowance.

Compliance

• Exact six-path diff, clean local and remote heads, base, and ancestry match.
• Restore manifest is append-only; no forbidden or constitution path changed.
• Construction mode, Roadmap, north star, and ruleset identities match.
• This remains one bounded Roadmap item 3 planning concern; delivery and persistence remain deferred.
• Required CI run 33634938034, check 100263326198, completed successfully from app 15368.
• Focused planner proof passed 21/21; portable-core schema groups, including 39/39 activation guards, passed with zero failures.

[yihanzhu]

Construction publish receipt

• reviewed head/base: 419c5c1 / 1f99263
• required CI: app 15368, check 100263326198, success
• independent review: comment 5510716502, zero unresolved Important
• squash merge/main: c276b42
• reviewed/merged tree: af1c2ece7a776018b8a930e1a2bbaa61b8d76b74
• canonical receipt SHA-256: be18f6b54682b3612999dc9da95d6b8a20dbb0ec0bea517b5cca2f606fdf0c30
• local main: clean and fast-forwarded
• Roadmap item 3: implementation-complete