duplicate_holder_pids names only one of a wrapper's two-or-more verified children, and --retire can report clean over a live one #86

duplicate_holder_pids (lanes-edit.sh, issue #39's own discovery function)
names at most ONE verified child per bg-pty-host parent. When a wrapper has
two or more direct children whose argv all independently verify the same
transcript (--fork-session --resume …/<uuid>.jsonl), the scan loop breaks
on the first verified match:

case "$dhp_c_resume" in */"$dhp_id_lc.jsonl") dhp_verified="$dhp_c"; break ;; esac

and the per-parent output record (<parent><US><child><US><id>) has exactly
one child slot, so the second verified child is silently excluded from the
report lane-end --retire acts on. --retire then terminates the parent and
the one named child, reports success (RETIRED lane <lane>'s duplicate holder of transcript <uuid>), and the second child — now orphaned — keeps running
and keeps holding the transcript: the exact double-holder shape issue #39
exists to end, just with one extra live process surviving a reported-clean
retirement.

Raised by Copilot's review of PR #61 at commit 11bf0f0 (2026-09-15T16:00Z),
lanes-edit.sh:4919. Not fixed there: the honest fix is not a one-line gate
like this PR's other three rounds-13 findings — duplicate_holder_pids'
output format (one child per parent record) has no room for a second
verified child, so naming ALL of them means changing that format and every
reader of it (lane-end --retire's own parsing, whatever else consumes
duplicate-holder's listing). The narrower alternative Copilot itself
offered — fail closed on this shape instead of picking one — doesn't fully
close the gap either: a parent whose child slot is left empty because two
verified matches were found looks IDENTICAL to a parent with no matching
child at all, so lane-end --retire would still report success while the
second live child survives, just without ever naming it. A real fix wants
either the output format widened to a child LIST, or an explicit
ambiguous-children signal lane-end --retire can refuse on by name — a
design decision, not a rushed edit at the tail of an already-large PR.

Scope for whoever picks this up: duplicate_holder_pids in lanes-edit.sh
(discovery), and lane-end's --retire dispatch (consumption) — both would
need to agree on however multiple verified children are represented. A
regression case wants a bg-pty-host wrapper with two children, both faked to
independently verify the same transcript, proving neither survives a
reported-clean --retire (or that the retirement explicitly refuses rather
than reporting clean over a live one).