clio-relay 1.4.12

Production endpoint activation recovery

clio-relay 1.4.12 fixes false bootstrap failures when an endpoint service spends longer than the old observer window migrating durable queue indexes before startup.

• Adds a bounded systemd activation observer with exact unit state, invocation, result, and queued-job evidence.
• Serializes state/job preflight and enqueue across relay processes, enqueues at most one start/restart, and pins the exact systemd job identity through restart-to-start phase transitions.
• Fails closed on ambiguous, incompatible, unreadable, terminal load, and future state evidence without cancelling or duplicating the systemd job.
• Emits truthful machine-readable endpoint_service.activation progress and terminal records; job_id=none is reported only after a successful zero-match inventory.
• Gives ExecStartPre queue migration a five-minute systemd bound, observes for five minutes thirty seconds, and gives SSH/bootstrap enough outer transport time to report the terminal result.
• Preserves existing relay and scheduler cleanup defaults: jobs are not cancelled unless explicitly requested.
• Hardens one Windows health-redaction test deadline against loaded-runner scheduling without changing product deadlines.

Runtime dependency pins remain JARVIS-CD 1.4.4 and clio-kit 2.5.22. Validation for the changed surface: 63 focused tests, Ruff, Pyright, ShellCheck, generated-helper Bash syntax, full-bootstrap Bash syntax, and exact release identity.

Artifacts were built once from merged commit dc6d366058ce8d1dcdeb8fdd06dad827a0752d88 with local tag v1.4.12; SHA256SUMS covers the attached wheel and source distribution.