feat: failure attribution, companion preflight, superseded (0.0.50)

[okisdev]

summary

• codex runs that die in an apply_patch retry loop or lose their exec child no longer masquerade as wall clock timeouts: a seven day read of 175 engine jobs found 34 foreground kills (41% of every gpt-5.6-sol write run), and their event streams split into 19 genuine overruns, 12 patch retry loops and 3 UnknownProcessId deaths, so only 19 were ever a sizing problem. patch_thrash and exec_lost now terminate early off live child stderr (neither string reaches the structured event stream) and join the repeated class in the breaker
• a deliberate kill stops losing its reason: a collaboration policy violation exits through cleanupRequired leaving a non terminal record, and reconciliation hardcoded failureKind: "died" over the recorded policy, destroying the attribution exactly where the resumable patch needed it. reconciliation now preserves a resumable set kind and falls back to died only when none was recorded
• three mechanical companion defects that each lost real work in the same window: a non git working directory (3 refusals in 2 days) now auto passes --skip-git-repo-check for read only consults and fails fast for writes, while the recorded request keeps the user's declared intent so the inference never rides a resumed thread; a single flight bounce no longer destroys the staged brief, since the raw transport was consumed at dispatch entry while the guard threw later; and the sol foreground write warning (58 records, 34 of them successful) moves from post mortem to preflight with the measured 41%
• timeout, policy and patch_thrash with a live thread are all resumable now, after two policy kills lost 413s and 443s of completed work with zero output
• /fusion:stats stops reporting a structurally false unverified rate: all 34 salvaged attempts sat at unverified forever because the wrapper binds only to the resume job, so one package read as two engine records. they are now derived as superseded in their own bucket, never recordable and never written to disk

test plan

already verified

• npm test -> 1102 tests, 1101 pass, 0 fail, 1 skipped (the skip is a pre-existing platform gated t.skip)
• each package reverified in a full environment after collection, since peer sandboxes skip the process dependent suites and node --test exits 0 on a skip

reviewer should verify

• a codex write package that cannot land a patch terminates with failure: patch_thrash well before 570s instead of burning the full deadline
• codex task (consult, no --write) in a directory with no ancestor .git runs, while the same call with --write fails fast naming --skip-git-repo-check
• /fusion:stats renders a superseded line and the acceptance buckets still sum to the terminal record count

notes

• these land in the repo only; the installed plugin cache still serves 0.0.49, so the early termination saving does not apply to live runs until the cache refreshes
• the diagnosis that produced this wave recurred one layer up during the wave itself: a peer package reported 76 pass, 0 fail while 64 process dependent tests, including every test it had just written, were skipped. the brief's done criterion accepted the exit code, so an implementation brief now has to demand # fail 0 and # skipped 0