fix(supervision): suppress advisories superseded before delivery

[pranaypratyush]

Problem

A supervision advisory can remain deliverable after newer durable state has resolved or superseded it. This surfaces obsolete decisions, stopped-worker reports, and recovery recommendations after the task has already moved on.

Routine long-cadence confirmations can also reach the captain when they contain no current action.

Root cause

Current state is converted into opaque prose and then handed to a delayed delivery channel without carrying a freshness identity or reconciling durable state at the final preventable-delivery boundary.

Two independent producers have this defect:

1. The attended OMP supervision branch records fm_branch_report output and mergeIntoMain queues a precomputed fm-branch-merge message to the primary conversation.
2. Away-mode supervision stores precomputed prose in .subsuper-escalations, then later flushes that text without reclassifying the task, keyed decision, or worker state.

The branch outcome schema carries ordering and ownership data, but no task-state revision, keyed-decision identity, source wake-row sequence, or advisory freshness generation. Its cursor advances before the OMP message is accepted, and the current API path supplies no delivery receipt, cancellation, or replacement identity. The away buffer independently persists only text.

The keyed open-decision fold, wake-row ownership, branch process generation, watcher recovery generation, and outcome sequence are operating within their existing contracts. None is an advisory freshness token.

Expected behavior

Before an advisory crosses its final preventable-delivery boundary, reconcile it against current durable state using typed source identity rather than precomputed prose alone.

• A newer keyed resolution suppresses an older pending-decision advisory.
• A newer working or terminal outcome suppresses an obsolete stopped-worker advisory when its condition no longer holds.
• Both the attended OMP branch and away-mode deferred buffer use the same semantic freshness contract.
• Delivery failure remains replayable only while the advisory is still current.
• Routine long-cadence pause or stale confirmations remain silent when they require no captain action; this narrow presentation policy is separate from freshness suppression.
• The existing buried-decision and exact-key folding semantics remain authoritative.

Required identity and delivery boundaries

Define and carry an exact identity tuple appropriate to the advisory: task id, advisory kind, optional keyed-decision key, source wake-row sequence or status-log revision, and a source generation distinct from branch-process and watcher-recovery generations. Define how the revision is produced and compared; wall-clock time is not sufficient.

For OMP, reconciliation must happen at the last point where the message can still be prevented from entering the primary queue, or in a receipt-bound turn-start resolver that re-reads current state before exposing it. A post-sendMessage cleanup cannot retract accepted prose without an explicit SDK retract or replace primitive.

The replay contract must distinguish accepted, failed, and indeterminate delivery with an idempotent token or equivalent receipt. Merely moving cursor advancement after sendMessage can duplicate captain turns when acceptance succeeds but acknowledgement is lost.

Regression scenarios

Keyed decision supersession

1. Produce an advisory for needs-decision [key=example] at source generation A.
2. Before delivery, record resolved [key=example] and resumed work at generation B.
3. Attempt delivery of the generation-A advisory.
4. Assert that no captain-facing notice is emitted.

Worker-state supersession

1. Produce a stopped-worker advisory.
2. Record a newer authoritative working or terminal state before delivery.
3. Assert that the stopped advisory is suppressed when its condition no longer holds.

Away-buffer supersession

1. Buffer an away-mode decision advisory.
2. Resolve the keyed decision before flush.
3. Assert that flush reclassifies and omits the obsolete prose.

Valid replay

1. Produce a current advisory.
2. Fail delivery before confirmed acceptance.
3. Assert durable replay.
4. Resolve or supersede the advisory before retry.
5. Assert that the retry is suppressed rather than delivered.

Acceptance criteria

• Typed advisories carry exact task, kind, optional decision key, source revision, and freshness-generation identity.
• The OMP branch and away-mode buffer both perform delivery-time current-state reconciliation.
• Newer resolution or superseding state atomically makes the older advisory ineligible.
• Delivery acknowledgment and replay distinguish accepted, failed, and indeterminate outcomes without duplicate captain turns.
• Routine long-cadence no-action confirmations are silent without making all routine reports silent.
• Existing keyed-decision folding and current-projection retry behavior remain intact.
• Deterministic tests cover both producer paths, decision resolution, worker resumption, narrow routine silence, failed delivery, indeterminate delivery, and valid replay.