hermes: pin the legacy publication terminal outcome

services/hermes/scripts/bootstrap_soteria_publication_retry.py

@@ -111,6 +111,7 @@ def _native_guard() -> supervisor_state.Lineage:
         # record is exactly blocked/blocked; accept only that historical
         # terminal form in addition to the current terminal spellings.
         or latest[1] not in {"blocked", "done", "failed"}
+        or (latest[1] == "blocked" and latest[2] != "blocked")
         or not isinstance(parents, (list, tuple, set)) or ROOT not in {str(value) for value in parents}
     ):
         raise ValueError("bootstrap native task is no longer the exact blocked run")

testing/tests/test_hermes_legacy_scm_roots.py

@@ -129,6 +129,13 @@ def test_publication_bootstrap_accepts_only_the_verified_historical_blocked_run(
     with pytest.raises(ValueError, match="exact blocked run"):
         bootstrap._native_guard()
 
+    kanban.connect = lambda **_kwargs: type("BadOutcomeConnection", (), {
+        "execute": lambda _self, _sql, _args: SimpleNamespace(fetchone=lambda: (8, "blocked", "failed")),
+        "close": lambda _self: None,
+    })()
+    with pytest.raises(ValueError, match="exact blocked run"):
+        bootstrap._native_guard()
+
 
 def test_publication_retry_is_bound_once_and_never_falls_back_to_a_model(tmp_path, monkeypatch):
     """A mediator receipt can power one fresh ordinal-pinned publication only."""