Bug: reconcile unconfirmed postSellOffer without unsafe duplicate repost

[Community-AI-tools]

Observed production failure

A native seller for gpt-5.6-luna submitted postSellOffer after exact preflight passed. The subsequent authoritative book/event reads timed out. The client ended with:

fresh_sell_submit=unresolved, match_current=false, raw_exact_tc_sell_count=0, offerPosted=false, events_matched=false, placement_value_returned=false.

The seller correctly failed closed, but the lifecycle had no durable terminal classification. A blind retry is unsafe: the original write could still become visible later and create a duplicate SELL.

Expected behavior

1. Persist a deterministic submission marker before the write.
2. On post-write read timeout, report a distinct publication_unconfirmed outcome, not a generic failed publication.
3. Reconcile using the exact token contract, deal offer latch, exact raw order-book rows, and events from the marker onward.
4. Permit a fresh postSellOffer only after reconciliation proves no resting/matched/returned placement exists for that exact deal. Otherwise adopt the discovered outcome.
5. Make the reconciliation bounded, retryable and observable; a transport timeout must never silently become either available or an automatic duplicate post.

Regression coverage

• accepted write + temporarily unavailable book/event reads + later visible placement;
• accepted write + no placement (safe retry only after exact negative proof);
• accepted write + immediate match;
• duplicate active SELL;
• all read paths unavailable: stays fail-closed and emits publication_unconfirmed.

Scope

CLI/core seller outcome reconciliation only. No wallet, funding, Note, cancellation, or automatic repost behavior is authorized by this issue.

[Community-AI-tools]

Production follow-up (2026-09-10): owner-scoped chain orders list completed successfully with a 90s read budget and showed no current resting SELL. Historical Luna orders were all expired=yes, escrow=returned.

A single controlled seller start then reproduced the failure: exact preflight passed, but outcome reconciliation ended with fresh_sell_submit=unresolved; the daemon reported authoritative_read=timeout/no terminal fact. This proves the issue is not an active duplicate. The current lifecycle was runtime-masked for Luna to stop repeated unknown submissions while retaining monitoring for the other lots.