fix(cli): expose publication debt and recovery context

[TusanHomichi]

system generation pending omitted the selected database and the recorded publication failure reason. Its dense one-line records also hid the summary and retry count. The command now passes the existing core query results to ui/generation_pending.rs, which renders exact identities, typed phase/status, recorded paths, summary, retry count, and last error through shared fields and guarded status tags.

The existing pending_recoverable query, order, schema, retry owner, and mutation boundaries stay unchanged. One recovery note retains the queried database, including when an individual record stores another path. Ordinary paths use the existing shell quoting; control-containing paths receive same-path instructions without an executable placeholder. The original empty-result line remains intact for the supported-host publication fixture. The old interpolated-status allowlist entry is removed, and the existing transaction recovery capture follows the new frame.

Three real CLI regressions use the registered core database connection and model APIs. They cover the exact retained failure cause and retry count, pending/running/failed records, exclusion of complete/abandoned/nonrecoverable records, order, empty output, quoted and control-containing fields, TTY/pipe/NO_COLOR, and unchanged complete database snapshots. Printed ordinary-path recovery commands are exercised with --help, so parser and shell-quoting proof does not apply publication. Terminal metadata in the exclusion fixture is queried only, never published, activated, or recovered.

Verification at 9ee84eb5:

• cargo test -p conary --features test-hooks --test cli_generation_pending: three passed. All three fail against the previous executable and pass with this change.
• Generation command unit tests: 13 passed; UI unit tests: 71 passed; diagnostic/progress/vocabulary/daily UX/list/snapshot/repository/publication-debt captures: 47 passed.
• cargo test -p conary --features test-hooks --no-fail-fast: 1,525 passed, five ignored, and exactly the 16 documented namespace failures in test(conary): make the full library suite hermetic on restricted hosts #788. All 16 exact binaries passed under sudo -n unshare --mount --propagation private <binary> --exact <test> --nocapture. The ordinary sweep is not reported as green.
• Workspace clippy with warnings denied, formatting, documentation truth and regression tests, routing tests/validation, and line caps all passed.

Primary issue: Refs #644; supports #132. Rebased onto merged #1045 without changing the tested tree 509ff5e86a48e3ee8ad9bd2580e4459224544acf; current head is 4d5a1f4073ab6a713c7edb47f6d0984f09d3507f. Remaining generation/recovery refusal and broader machine-output acceptance stay open.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-14T18:15:33.655092Z	4d5a1f4	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.