fix(bin): prevent routed secondmate work from stranding

[kunchenguid]

Intent

Fix routed-work STRANDING in firstmate shared supervision and hand-off core, referencing GitHub issue #2791. Address both coupled defects: (1) distinguish agent liveness from wake-loop and queue-consumption liveness for registered local second mates, so when the oldest unacknowledged foreign durable wake-queue row exceeds a bounded age, outer supervision emits exactly one durable, idempotent parent notification identifying the mate and row, remains quiet for empty or healthy queues, and detects age read-only without consuming or rewriting the foreign row; (2) make a routed backlog hand-off reliably wake the receiving home through its supported delivery path, or fail loudly and observably if it cannot, so routed work cannot silently strand until a manual nudge. Preserve the diagnosis boundary around wake-queue consumption and hand-off wake, excluding process-event application or re-arm behavior unless genuinely reproduced. Add behavioral regression tests under tests/ for both reproductions: stalled foreign queue notification exactly once and idempotently with byte-for-byte row preservation plus quiet empty/healthy cases, and routed hand-off waking the receiver or surfacing failure. Exercise executable interfaces and review affected supported harness/runtime surfaces. Deliver one no-mistakes PR, reference #2791, do not merge, and note that homes pick up the fix after merge plus self-update coordinated with the main firstmate.

What Changed

• Detect aged local-secondmate wake-queue rows read-only and emit one durable, deduplicated parent notification while keeping empty and healthy queues quiet.
• Durably track and reconcile local and remote backlog-handoff wakes, preserving delivered work and surfacing missing, failed, or unresolved receiver delivery instead of silently succeeding.
• Add lifecycle-safe wake-state teardown, regression coverage, and documentation for the corrected handoff and supervision behavior in A live second mate can silently stop consuming its durable wake queue #2791.

Risk Assessment

✅ Low: The durable wake, stall supervision, handoff recovery, and teardown staging paths preserve the required invariants with no remaining source-verifiable defect found.

Testing

Targeted local and remote handoff, wake-queue stall supervision, crash recovery, retry, concurrency, teardown, and pending-reply reconciliation checks passed; end-user transcripts demonstrate one durable stall notification with byte-identical foreign rows and a routed item persisted and woken exactly once through the supported tmux endpoint.

Evidence: Stalled foreign queue supervision transcript

Source: Stalled foreign queue supervision transcript

--- parent-visible stall notification ---
check: secondmate wake-loop stalled: mate=mate row=7 age=10s
--- foreign row before/after SHA-256 (must match) ---
4f97967a93682bbc22356d82bd187651c339d978906539c26915490bf64cbb22  /var/folders/0k/bf8mwt2n5qddzk24r20gfk0c0000gn/T//fm-wake-tests.ZN4rFT/secondmate-foreign-stall/foreign-before
4f97967a93682bbc22356d82bd187651c339d978906539c26915490bf64cbb22  /var/folders/0k/bf8mwt2n5qddzk24r20gfk0c0000gn/T//fm-wake-tests.ZN4rFT/secondmate-foreign-stall/foreign-after
--- empty queue checkpoint output (must contain no stall) ---
check: rearm-resurface
--- healthy queue checkpoint output (must contain no stall) ---
check: rearm-resurface
ok - foreign secondmate queue stalls notify once, remain byte-stable, and stay quiet when empty or healthy

Evidence: Routed handoff and receiver wake transcript

Source: Routed handoff and receiver wake transcript

--- handoff CLI response ---
handed off 1 item(s) to design: wake-item
  into /private/var/folders/0k/bf8mwt2n5qddzk24r20gfk0c0000gn/T/fm-backlog-handoff.rhlKJ7/live-wake-sub/data/backlog.md
●━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
●  WATCHER DOWN - SUPERVISION IS OFF
●  1 task(s) in flight, but no watcher has a fresh beacon (last beat: never, grace 300s).
●  Trust the emitted supervision protocol for this harness; do not use shell & for watcher repair.
●  This is a supervision warning only; the requested message WILL still be sent.
●  repair a missing or failed watcher cycle with the Pi tool fm_watch_arm_pi, or restart Pi with -e /Users/kunchen/.no-mistakes/worktrees/016d88035d58/01M0Q2GKJAPCVZS6Q7RQADKM5M/.pi/extensions/fm-primary-turnend-guard.ts -e /Users/kunchen/.no-mistakes/worktrees/016d88035d58/01M0Q2GKJAPCVZS6Q7RQADKM5M/.pi/extensions/fm-primary-pi-watch.ts if the extensions are not loaded.
●━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
--- receiving home durable backlog ---
## Queued
- [ ] wake-item - routed to a live receiver (repo: alpha)

## Done
## In flight
--- supported tmux endpoint received wake ---
send-keys -t firstmate:fm-design -l [fm-from-firstmate]⁣corr=6efd57a321fb63f4 New routed work is in your backlog. Run bin/fm-session-start.sh now, then act on the routed task.
wake submissions after idempotent rerun: 1
ok - a routed handoff wakes once and a successful rerun stays idempotent

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 1 issue found → auto-fixed ✅

• ⚠️ bin/fm-teardown.sh:2653 - The home is irreversibly removed before wake retirement. If handoff_wake_retire then fails, teardown preserves the registry route and metadata while its home no longer exists; the advertised retry fails earlier at home validation and can never finish cleanup. Make home removal and wake retirement recoverable as one teardown transition, such as staging wake state for rollback before removing the home.

🔧 Fix: Make local wake retirement recoverable
✅ Re-checked - no issues remain.

✅ **Test** - passed

✅ No issues found.

• Inspected the target diff against base commit 801c0838fdb19823b6d215f6ad15522ee7c3c007.
• bash tests/fm-wake-queue.test.sh
• bash tests/fm-backlog-handoff.test.sh
• bash tests/fm-remote-backlog-handoff.test.sh
• bash tests/fm-pending-reply.test.sh
• Executed evidence-only focused harnesses exercising fm-watch-checkpoint.sh, fm-wake-drain.sh, and fm-backlog-handoff.sh through their executable interfaces.
• git status --short confirmed testing left the worktree clean.

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge because the previously reported handoff and teardown failures no longer remain at the current head.

No blocking failure remains.

_{Reviews (7): Last reviewed commit: "no-mistakes(document): Clarify handoff r..." | Re-trigger Greptile}