fix: recover stale pending read-state publication after relay age rejection #447

Failure

src/features/relay/read-state.ts:434,519 keeps retrying journal.pending before newer read intent. If an undelivered signed event remains pending past the relay age window, the relay rejects the old event as too old. Subsequent flushes retry the same ID indefinitely, never re-sign from the journal, and newer reads cannot sync. The pending event survives restart and health remains in error.

Reproduction and scope

.scratch/cid-rr6-age.test.ts (local review fixture) reproduced an age-rejection response via mocked native transport: four publication attempts over three new reads/flushes, zero new signatures, unchanged pending ID after restart. Actual relay policy for kind 30078 was not exercised. The behavior predates PR #444 and also affects the broker read-state owner; packaged read-state makes it reachable in native builds. See #444 .

Recovery contract

On an aged pending event, perform strong readback by exact event ID before replacing it. If delivery is confirmed, reconcile normally. If the event is confirmed absent, clear pending and re-sign retained journal state so newer reads can sync. Ambiguous delivery must not be blindly discarded or re-dated. Preserve idempotent exact-event retry and restart behavior; add a regression covering rejection, confirmed absence, recovery, and uncertain readback.