[Mjones13]

A committed registry keys member-init transaction could be reported as failed and have its key file deleted; an interruption before commit could leave an orphan file that blocked retry. Reconcile the exact key row outside a reported transaction failure, retain uncertain files with outcome_unknown, and remove only this attempt's unchanged file after proved row absence.

Add an explicit --resume that reuses valid 32-byte orphan keys or accepts an exact active row and file without changing bytes. Malformed files remain untouched, conflicts refuse, and a row without its file reports key_file_missing without regenerating that ID. Home key initialization is unchanged. The peer-setup integration fixture now provisions its member key through NativeMemberKeyAdmin and the real secret store before exercising peer setup and member startup.

Closes #937.

Validation:

• The two focused files passed all 47 tests with one worker and file parallelism disabled: native/runtime/cli.test.ts and native/conformance/peerSetupIntegration.test.ts. After converting the fault cases to the required table-driven test syntax, the CLI file passed all 17 tests again.
• The committed-then-error regression fails against the original source and passes against the repair; it also verifies actual WorkstreamsKeyProvider resolution.
• pnpm --filter t3 typecheck passed with the verified official Effect compiler.
• node scripts/jones/check-boundary.ts --strict passed with zero violations.
• Targeted lint and formatting passed for all three changed files.

This is source-only work; no installed runtime update or live-state repair. Scope is the CLI service and its two focused test files. There are no schema, rotation, wire, or persisted-history changes.

Implemented by the scoped implementation child in Jones Code using gpt-6.1-sol (high reasoning), Codex harness.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}