[Trecek]

Fleet roots could report success without a reason verified against the active recipe, or continue and resume after losing context. This change makes the final fleet verdict authoritative and treats context loss as a terminal failure for the failed dispatch identity.

• Derive success declarations from the composed active recipe, keep them private, and validate current and historical success claims against them. Derive envelope success from final dispatch status.
• Block Claude orchestrator automatic compaction synchronously before history replacement, preserving the existing Codex veto. Recognize native Codex context-window errors and retain Claude compaction-attempt evidence. Emit the dedicated logical context-exhaustion failure even when payloads or sidecars claim success, while retaining parse and tracker diagnostics.
• Detect legacy Claude compacted transcripts, refuse both primary and fallback resume sessions before spawning, and persist the selected refused identity. Use the launch callback's authoritative session ID consistently for transcript lookup, provenance, state, and envelope.

The strict envelope checker and scripts/e2e/ are unchanged. Update the supporting prompts, docs, protocol fakes, field ledgers, generated hook artifacts, and focused regressions with the behavior.

Validation: every part independently passed the configured task test-local-gate. The final gate reported 51,665 passed, 618 skipped, 29 xfailed. Final pre-commit run --all-files passed, and the worktree is clean.

Native probes verified the Claude Code 2.1.285 threshold veto and context-limit path, plus the production decoder against an actual Claude Code 2.1.291 compacted control transcript. Codex maximum-window coverage uses its v2 protocol schema fixtures; no live maximum-window incident was captured.

Outstanding live verification: a genuine interactive Claude Code 2.1.291 idle probe ran for 3,800 seconds without emitting an idle PreCompact event. The idle-triggered veto remains unverified; source/settings/model/quota/cache diagnostics did not identify a concrete failed precondition. No idle pass is claimed. All probe processes were stopped and joined.

Closes #5272.