seller recovery: exact vacant proof cannot clear unresolved terminal consumed marker

[Community-AI-tools]

Problem

A mainnet seller can end in seller_cancel_terminal with unresolved_terminal after authoritative re-reads time out during a fresh SELL lifecycle. Later owner-scoped exact book reads can return a readable vacant book (no resting SELL) and the controller can confirm no buyer-active contract, but a subsequent seller start is refused as publication_unconfirmed because the local consumed marker is retained indefinitely.

This is not a buyer-inactivity timeout and must not be resolved by cancelling/releasing a buyer deal.

Required canonical recovery

Provide a narrow, explicit CLI recovery path that is admissible only after all of the following fresh facts are proven:

1. exact owner-scoped book read is readable and has no live resting SELL for the candidate token contract;
2. exact contract/deal state proves no buyer-owned active or disputed contract;
3. the prior terminal attempt is tied to the same local seller handle and market identity;
4. recovery does not modify Notes, wallet state, provider credentials, unrelated orders, or another buyer's contract.

The recovery may clear/retire only the local consumed marker needed to return the seller to a clean pre-publication state. A new offer must still be a separate normal provision/start path and must obtain fresh exact-book proof.

Tests

• interrupted fresh SELL followed by exact vacant proof can recover;
• timeout/ambiguous read cannot recover;
• live resting SELL, buyer-active, disputed, wrong token contract, wrong owner, or stale handle cannot recover;
• repeated invocation is idempotent and does not create an order;
• recovery never uses buyer inactivity as a condition.

Related but independent: #154 (GLM B7 verification).