feat(afk): make recurring composer deferrals record their own cause

[sbracewell64]

Intent

Implement R2 from the completed away-mode escalation wedge diagnosis (data/away-injection-wedge-diagnosis/report.md): give the away-mode delivery guard's max-defer escape somewhere to escape to.

Background. Away mode buffers captain-relevant escalations and injects them into firstmate's own pane. The max-defer escape at bin/fm-supervise-daemon.sh retried the identical guarded delivery path and could only alarm. A 9.5-hour wedge (three consecutive occurrences) proved that a systematic composer misclassification defers forever with zero diagnostic value: the buffered escalation recorded no record of WHICH verdict recurred or WHAT the offending composer row contained, so the follow-up investigation had to start from scratch. The diagnosed root cause was Claude Code rendering its empty composer as the prompt glyph plus U+00A0, which bash's [[:space:]] trims cannot see.

Goal of THIS change. Make that class of wedge self-diagnosing. After N consecutive identical non-empty composer verdicts, record a distinguishable diagnostic: the verdict, the offending row's sanitized bounded bytes, and the reader that produced it, so the next investigation starts at the answer.

Deliberate decisions made and approved by the supervising firstmate in a mandatory design review before implementation (design at data/composer-defer-diagnostic-fallback/design.md). A reviewer reading only the diff would not know these were chosen on purpose:

1. NO fallback delivery route is implemented, deliberately. R2 offered either the diagnostic or a composer-independent delivery route. Six candidate routes were evaluated and every one violates the hard safety property that we never type into a pane that might hold real input: typing on a "provably chrome" verdict needs a general proof that does not exist; herdr agent prompt drives the same PTY so it either merges with or destroys the captain's draft; baseline identity is sound but can never arm in the wedge it would fix (proof needs a confirmed submit or an affirmative empty verdict, and the incident had zero of both across 9.5 hours); cross-pane identity against a crewmate pane rests on an assumption AGENTS.md hard rule 4 contradicts and ends in typing on a probabilistic argument; a fresh pane hosts a second firstmate that the per-home session lock refuses. R2 itself names the diagnostic alone as the accepted minimum in that case, and firstmate approved shipping exactly that. Do NOT flag the absence of a delivery route as incomplete work.

2. The diagnostic does NOT gate on the backend independently reporting idle, even though R2's wording mentions it. That needs no new gate: inject_msg already returns early on pane_is_busy, which consults the backend's native busy state before the harness busy footer, so every deferral reaching the composer guard is already proven not-busy by both signals. The native state is recorded as evidence instead, because only herdr exposes a real native busy state (tmux returns unknown) and gating on an affirmative idle would make the diagnostic never fire on the tmux reference backend, which the diagnosed defect affected identically.

3. The new test fixture deliberately does NOT use the U+00A0 that caused the diagnosed wedge. The root-cause fix (R1) is being shipped in parallel and normalizes Unicode blanks in the shared classifier, so once it lands an NBSP row reads empty and an NBSP fixture would silently stop reproducing the identical-verdict condition. Stable non-blank content models what R2 actually targets: the NEXT systematic misclassification, not the one R1 fixes. This change adds NO blank normalization of its own and must not duplicate R1's.

4. Row bytes are recorded as hex rather than raw, and every field is bounded to 120 bytes with an explicit truncation marker. Both are safety choices, not style: a composer row can contain the terminal's own escape sequences and a diagnostic record is read with cat, so hex can never replay an escape into the reader's terminal; and the row can hold the captain's own unsent draft, so it must be bounded. For the same reason the wedge alert summary carries only the verdict, reader, and streak and never the row bytes, because that string is passed to an OS notifier or a configured command: directive.

5. The diagnostic sink lives in bin/fm-composer-lib.sh and is opt-in via FM_COMPOSER_DIAG_FILE, inert otherwise. Each reader calls it once where it already holds both the raw styled row and the ghost-stripped content. This is to honor the repo's one-owner rule: re-deriving composer row location in the daemon would duplicate exactly the logic that has drifted across adapters twice before. The daemon arms the sink only once already deep in a streak, so the recorded row comes from the same read as the recorded verdict rather than a second read.

6. Scope also includes two additions firstmate explicitly approved beyond R2's literal wording: a bounded sanitized pane tail when the reader found no candidate composer row at all (the dead-shell / unreadable class, which has no offending row but wedges just as permanently), and surfacing the record as away-return catch-up evidence so the captain's next investigation does not have to rediscover it.

7. Only tmux and herdr can be supervisor panes (the daemon refuses others loudly at startup), so those two readers are the complete affected set. The orca, cmux, and zellij composer surfaces were inspected and deliberately left unchanged; the sink is inert without the env var so their behavior is unchanged bit for bit.

Verification already performed locally: bin/fm-lint.sh clean, bin/fm-doc-audience-check.sh clean, and 52 suites run. Sixteen new tests added across tests/fm-daemon.test.sh, tests/fm-composer-lib.test.sh, and tests/fm-afk-return.test.sh, all green. Four suites fail, and each was individually reproduced as identical at the base commit a2d5f26, so none is caused by this change: fm-calm-pi-extension, fm-pi-watch-extension, and fm-turnend-guard share one node ESM environment fault in the Pi tooling, and fm-watcher-lock is a watcher-singleton timing test perturbed by sibling firstmate lanes' live watchers on this host. tests/fm-backend-tmux-smoke.test.sh was excluded because it needs a real tmux server and hangs at the base commit too, and the real-herdr-gated family was excluded because this task's brief was scaffolded without the Herdr lab guard and must not drive Herdr lifecycle.

What Changed

• The away-mode daemon (bin/fm-supervise-daemon.sh) now tracks consecutive identical non-empty composer verdicts across deferred escalation deliveries in a durable streak file that survives daemon restarts. After FM_COMPOSER_DEFER_DIAG_COUNT identical verdicts (default 20, 0 disables), it writes a diagnostic record — verdict, reader, streak, native busy state, and the offending row's sanitized bytes — to state/.subsuper-composer-defer-diag, the daemon log, and the wedge-alarm marker. The wedge alert summary carries only the verdict, reader, and streak, never row bytes; when the reader found no candidate row at all (dead-shell/unreadable pane), a bounded sanitized pane tail is recorded instead. Deliberately no fallback delivery route is added — the diagnostic alone is the approved scope.
• bin/fm-composer-lib.sh gains an opt-in diagnostic sink (fm_composer_diag_record, armed via FM_COMPOSER_DIAG_FILE, inert otherwise) that the tmux and herdr composer readers call at the point they already hold both the raw styled row and the ghost-stripped content. Row bytes are rendered as hex and every field is bounded to 120 bytes with an explicit truncation marker, so a record read with cat can never replay terminal escapes and never leaks an unbounded captain draft.
• Away-mode entry/return now manage the new artifacts: fm-afk-return.sh surfaces the diagnostic as catch-up evidence and clears it, and a fresh away entry clears stale diagnostics too, with the launcher's transactional backup/rollback extended to cover them. Docs (docs/wedge-alarm.md, docs/configuration.md, docs/architecture.md, the afk skill) describe the new behavior, and 16 new tests cover the threshold trigger, streak reset/restart survival, sanitization bounds, wedge-marker/alarm content, and return-side surfacing. The no-mistakes review pass also fixed a stderr leak from the streak-file read that would have printed on every healthy delivery.

Risk Assessment

✅ Low: The round-1 fix commit resolves both prior findings precisely as instructed — a readability guard replacing the broken redirection-order suppression with identical fallback semantics plus a behavioral stderr regression test, and a comment-only correction of the diag sink contract — leaving the branch intent-conformant with no remaining issues.

Testing

Ran the three touched suites (fm-composer-lib, fm-daemon, fm-afk-return — all green, covering the 16 new tests) and a manual end-to-end demo through the real daemon inject path: five identical pending deferrals build the durable streak, the diagnostic records at the threshold with verdict/reader/bounded hex row bytes and native busy state as evidence, nothing is typed into the pane holding the draft, the wedge marker and daemon log carry the record, the notifier summary carries only verdict/reader/streak (no row bytes), and away-return surfaces the record as catch-up evidence then clears it; diff checks confirmed no delivery route and no blank normalization were added.

Evidence: End-to-end wedge lifecycle transcript (deferrals → diagnostic → wedge alarm → return catch-up → clear)

=== 5 daemon inject attempts (FM_COMPOSER_DEFER_DIAG_COUNT=5) === attempt 1: deferred; streak file: [1 pending]; diagnostic: absent ... attempt 5: deferred; streak file: [5 pending]; diagnostic: RECORDED === state/.subsuper-composer-defer-diag === composer-defer-diag 2026-07-29T23:47:21-0400 target=firstmate:0 backend=tmux verdict=pending streak=5/5 native_busy=unknown rows_evaluated=1 reader=fm_tmux_composer_row_state raw_len=46 raw_hex=e2 94 82 20 3e 20 64 72 61 66 74 ... content_text=> draft: reply to the board before 6pm === nothing typed into the pane holding the draft === sent.log bytes: 0 --- summary handed to the OS notifier (no row bytes) --- osascript away-mode escalations WEDGED 600s undelivered (composer verdict=pending reader=fm_tmux_composer_row_state streak=5/5) - see .../.subsuper-inject-wedged === fm-afk-return.sh begin === catch-up composer-defer: composer-defer-diag 2026-07-29T23:47:21-0400 ... === after resolved blocker -> check === .subsuper-composer-defer-diag: cleared .subsuper-composer-defer-streak: cleared .subsuper-composer-defer-read: cleared

=== supervisor pane (never changes: the captain left a draft in the composer) ===
╭────────────────────────────────────────╮
│ > draft: reply to the board before 6pm │
╰────────────────────────────────────────╯

=== 5 daemon inject attempts (FM_COMPOSER_DEFER_DIAG_COUNT=5) ===
attempt 1: deferred; streak file: [1 pending]; diagnostic: absent
attempt 2: deferred; streak file: [2 pending]; diagnostic: absent
attempt 3: deferred; streak file: [3 pending]; diagnostic: absent
attempt 4: deferred; streak file: [4 pending]; diagnostic: absent
attempt 5: deferred; streak file: [5 pending]; diagnostic: RECORDED

=== state/.subsuper-composer-defer-diag (the record the next investigation starts from) ===
composer-defer-diag 2026-07-29T23:47:21-0400
  target=firstmate:0 backend=tmux verdict=pending streak=5/5 native_busy=unknown
  rows_evaluated=1 reader=fm_tmux_composer_row_state raw_len=46 raw_hex=e2 94 82 20 3e 20 64 72 61 66 74 3a 20 72 65 70 6c 79 20 74 6f 20 74 68 65 20 62 6f 61 72 64 20 62 65 66 6f 72 65 20 36 70 6d 20 e2 94 82 raw_text=... > draft: reply to the board before 6pm ... content_len=38 content_hex=3e 20 64 72 61 66 74 3a 20 72 65 70 6c 79 20 74 6f 20 74 68 65 20 62 6f 61 72 64 20 62 65 66 6f 72 65 20 36 70 6d content_text=> draft: reply to the board before 6pm

=== nothing was ever typed into the pane holding the draft ===
sent.log bytes: 0

=== max-defer escape fires (housekeeping, FM_MAX_DEFER_SECS=60, digest 600s old) ===
--- wedge marker state/.subsuper-inject-wedged ---
fm away-mode inject WEDGED: 600s undelivered as of 2026-07-29T23:47:21-0400
The supervisor pane could not accept an escalation. Buffered items:
needs-decision: crewmate blocked on API key rotation
Recurring composer verdict diagnostic:
composer-defer-diag 2026-07-29T23:47:21-0400
  target=firstmate:0 backend=tmux verdict=pending streak=5/5 native_busy=unknown
  rows_evaluated=1 reader=fm_tmux_composer_row_state raw_len=46 raw_hex=e2 94 82 20 3e 20 64 72 61 66 74 3a 20 72 65 70 6c 79 20 74 6f 20 74 68 65 20 62 6f 61 72 64 20 62 65 66 6f 72 65 20 36 70 6d 20 e2 94 82 raw_text=... > draft: reply to the board before 6pm ... content_len=38 content_hex=3e 20 64 72 61 66 74 3a 20 72 65 70 6c 79 20 74 6f 20 74 68 65 20 62 6f 61 72 64 20 62 65 66 6f 72 65 20 36 70 6d content_text=> draft: reply to the board before 6pm
--- summary handed to the OS notifier (no row bytes, ever) ---
osascript	away-mode escalations WEDGED 600s undelivered (composer verdict=pending reader=fm_tmux_composer_row_state streak=5/5) - see /tmp/fm-defer-demo.lkQked/state/.subsuper-inject-wedged

--- daemon log trail (grep composer-defer) ---
    [2026-07-29T23:47:21-0400] composer-defer-diag 2026-07-29T23:47:21-0400
    [2026-07-29T23:47:21-0400] ERROR: away-mode escalation undelivered 600s (composer verdict=pending reader=fm_tmux_composer_row_state streak=5/5); inject could not confirm a submit (supervisor pane busy or wedged). Buffer + wake-queue preserved; alarm marker written.

=== captain returns: bin/fm-afk-return.sh begin surfaces the cause as catch-up evidence ===
fm-afk-return: catch-up must finish before the captain request
catch-up wedge: fm away-mode inject WEDGED: 600s undelivered as of 2026-07-29T23:47:21-0400
catch-up composer-defer: composer-defer-diag 2026-07-29T23:47:21-0400
catch-up composer-defer:   target=firstmate:0 backend=tmux verdict=pending streak=5/5 native_busy=unknown
catch-up composer-defer:   rows_evaluated=1 reader=fm_tmux_composer_row_state raw_len=46 raw_hex=e2 94 82 20 3e 20 64 72 61 66 74 3a 20 72 65 70 6c 79 20 74 6f 20 74 68 65 20 62 6f 61 72 64 20 62 65 66 6f 72 65 20 36 70 6d 20 e2 94 82 raw_text=... > draft: reply to the board before 6pm ... content_len=38 content_hex=3e 20 64 72 61 66 74 3a 20 72 65 70 6c 79 20 74 6f 20 74 68 65 20 62 6f 61 72 64 20 62 65 66 6f 72 65 20 36 70 6d content_text=> draft: reply to the board before 6pm
catch-up escalation: needs-decision: crewmate blocked on API key rotation
firstmate-actionable blocker: repair-task [key=api-key] firstmate can refresh the synthetic token
fm-afk-return: handle each blocker now, or close it with resolved [key=...] and append a durable reclassification reason, then run bin/fm-afk-return.sh check

=== blocker resolved -> return check clears the diagnostic with the delivery artifacts ===
.subsuper-composer-defer-diag: cleared
.subsuper-composer-defer-streak: cleared
.subsuper-composer-defer-read: cleared

Evidence: Demo script (reproducible manual verification)

#!/usr/bin/env bash
# Manual end-to-end demo of the recurring-deferral diagnostic
# (branch fm/composer-defer-diagnostic-fallback).
#
# Scenario: away mode is active, an escalation is buffered, and the supervisor
# pane's composer permanently holds a captain draft ("pending" on every poll) -
# the systematic-misclassification shape that wedged delivery for 9.5 hours.
# We drive the daemon's real inject path five times (threshold 5), then the
# max-defer housekeeping escape, then the away-return catch-up.
set -u
ROOT=${1:?repo root}
WORK=$(mktemp -d /tmp/fm-defer-demo.XXXXXX)
trap 'rm -rf "$WORK"' EXIT
state="$WORK/state"; fakebin="$WORK/fakebin"
mkdir -p "$state" "$fakebin"

DRAFT='draft: reply to the board before 6pm'

# Fake tmux: the pane's composer box forever holds the captain's draft.
cat > "$fakebin/tmux" <<'SH'
#!/usr/bin/env bash
set -u
case "${1:-}" in
  display-message)
    for a in "$@"; do case "$a" in *cursor_y*) printf '1\n'; exit 0 ;; esac; done
    for a in "$@"; do [ "$a" = "-p" ] && { printf 'fakepane\n'; break; }; done
    exit 0 ;;
  capture-pane) cat "$FM_FAKE_COMPOSER" 2>/dev/null; exit 0 ;;
  list-windows) exit 0 ;;
  send-keys)
    shift; lit=0
    while [ "$#" -gt 0 ]; do
      case "$1" in
        -l) lit=1 ;;
        Enter) printf '[ENTER]\n' >> "$FM_FAKE_SENT" ;;
        -t) shift ;;
        *) [ "$lit" = 1 ] && printf '%s\n' "$1" >> "$FM_FAKE_SENT" ;;
      esac; shift
    done
    exit 0 ;;
esac
exit 1
SH
chmod +x "$fakebin/tmux"
width=$(( ${#DRAFT} + 4 )); border=; i=0
while [ "$i" -lt "$width" ]; do border="${border}─"; i=$((i+1)); done
printf '╭%s╮\n│ > %s │\n╰%s╯\n' "$border" "$DRAFT" "$border" > "$WORK/composer"
: > "$WORK/sent.log"

# Notifier seam recorder: what an OS notifier would have been handed.
cat > "$WORK/alarm-rec" <<'SH'
#!/usr/bin/env bash
printf '%s\t%s\n' "${1:-}" "${2:-}" >> "${DEMO_ALARM_LOG:?}"
SH
chmod +x "$WORK/alarm-rec"
export DEMO_ALARM_LOG="$WORK/alarm.log"
export FM_WEDGE_ALARM_EXEC="$WORK/alarm-rec"
export FM_WEDGE_ALARM_CHANNEL=osascript

export PATH="$fakebin:$PATH"
export FM_FAKE_COMPOSER="$WORK/composer" FM_FAKE_SENT="$WORK/sent.log"
export FM_INJECT_CONFIRM_SLEEP=0.05
export FM_COMPOSER_DEFER_DIAG_COUNT=5
export LOG="$WORK/daemon.log"

# shellcheck disable=SC1091
. "$ROOT/bin/fm-supervise-daemon.sh"

escalate_add "$state" "needs-decision: crewmate blocked on API key rotation"
afk_enter "$state"

echo '=== supervisor pane (never changes: the captain left a draft in the composer) ==='
cat "$WORK/composer"
echo
echo "=== 5 daemon inject attempts (FM_COMPOSER_DEFER_DIAG_COUNT=5) ==="
for i in 1 2 3 4 5; do
  inject_msg "away digest: needs-decision: crewmate blocked on API key rotation" "$state" >/dev/null 2>&1
  streak=$(cat "$state/.subsuper-composer-defer-streak" 2>/dev/null | tr '\t' ' ')
  diag_state=absent; [ -s "$state/.subsuper-composer-defer-diag" ] && diag_state=RECORDED
  printf 'attempt %s: deferred; streak file: [%s]; diagnostic: %s\n' "$i" "$streak" "$diag_state"
done
echo
echo '=== state/.subsuper-composer-defer-diag (the record the next investigation starts from) ==='
cat "$state/.subsuper-composer-defer-diag"
echo
echo '=== nothing was ever typed into the pane holding the draft ==='
printf 'sent.log bytes: %s\n' "$(wc -c < "$WORK/sent.log" | tr -d ' ')"
echo
echo '=== max-defer escape fires (housekeeping, FM_MAX_DEFER_SECS=60, digest 600s old) ==='
echo $(( $(date +%s) - 600 )) > "$state/.subsuper-escalations.since"
FM_ESCALATE_BATCH_SECS=99999 FM_MAX_DEFER_SECS=60 housekeeping "$state" >/dev/null 2>&1
echo '--- wedge marker state/.subsuper-inject-wedged ---'
cat "$state/.subsuper-inject-wedged"
echo '--- summary handed to the OS notifier (no row bytes, ever) ---'
cat "$WORK/alarm.log"
echo
echo '--- daemon log trail (grep composer-defer) ---'
grep -E 'composer-defer|ERROR' "$WORK/daemon.log" | sed 's/^/    /'
echo
echo '=== captain returns: bin/fm-afk-return.sh begin surfaces the cause as catch-up evidence ==='
ret="$WORK/return"; mkdir -p "$ret/bin" "$ret/home/state" "$ret/home/data" "$ret/home/config"
cp "$ROOT/bin/fm-afk-return.sh" "$ROOT/bin/fm-wake-lib.sh" "$ROOT/bin/fm-classify-lib.sh" "$ret/bin/"
cat > "$ret/bin/fm-afk-launch.sh" <<'SH'
#!/usr/bin/env bash
[ "${1:-}" = stop ] || exit 2
rm -f "$FM_HOME/state/.afk" "$FM_HOME/state/.afk-daemon-terminal"
SH
cat > "$ret/bin/fm-wake-drain.sh" <<'SH'
#!/usr/bin/env bash
exit 0
SH
chmod +x "$ret/bin/"*.sh
# Carry the REAL artifacts the daemon just produced into the return's state.
cp "$state/.subsuper-escalations" "$state/.subsuper-inject-wedged" \
   "$state/.subsuper-composer-defer-diag" "$state/.subsuper-composer-defer-streak" \
   "$ret/home/state/" 2>/dev/null
date +%s > "$ret/home/state/.afk"
cat > "$ret/home/state/repair-task.meta" <<EOF
window=synthetic:fm-repair-task
backend=tmux
kind=ship
EOF
printf 'blocked [key=api-key]: firstmate can refresh the synthetic token\n' > "$ret/home/state/repair-task.status"
out=$(FM_HOME="$ret/home" FM_STATE_OVERRIDE="$ret/home/state" "$ret/bin/fm-afk-return.sh" begin 2>&1) || true
printf '%s\n' "$out"
echo
echo '=== blocker resolved -> return check clears the diagnostic with the delivery artifacts ==='
printf 'resolved [key=api-key]: refreshed the synthetic token\n' >> "$ret/home/state/repair-task.status"
FM_HOME="$ret/home" FM_STATE_OVERRIDE="$ret/home/state" "$ret/bin/fm-afk-return.sh" check >/dev/null 2>&1 || true
for f in .subsuper-composer-defer-diag .subsuper-composer-defer-streak .subsuper-composer-defer-read; do
  if [ -e "$ret/home/state/$f" ]; then printf '%s: STILL PRESENT\n' "$f"; else printf '%s: cleared\n' "$f"; fi
done

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 2 issues found → auto-fixed ✅

• ⚠️ bin/fm-supervise-daemon.sh:1131 - In _composer_defer_streak_read, the redirection order read -r count verdict < "$(_composer_defer_streak_file "$1")" 2>/dev/null does not suppress the error when the streak file is missing: bash processes redirections left to right, so the failed input redirect prints "No such file or directory" to the original stderr before 2>/dev/null takes effect (verified empirically). The arming check in inject_msg (line 1302) calls this on every inject attempt with the default threshold of 20, and the streak file is absent on a healthy fleet, so every normal escalation delivery emits an unsuppressed error line to the daemon's stderr (its foreground pane). Fix by reordering to 2>/dev/null < "$file" or guarding with [ -r "$file" ] before the read.
• ℹ️ bin/fm-composer-lib.sh:271 - The sink contract comment in fm_composer_diag_record says the daemon reports the LAST record because "the readers return on the first row that classifies non-empty." That holds for pending (fm_tmux_composer_state returns immediately on a pending row) but not for the geometry-ambiguous unknown case: there every box row classifies empty, the verdict comes from the ambiguity flag, and tail -1 in composer_defer_diag_write reports an innocuous last box row as the offending one. The record still carries rows_evaluated and real pane bytes, so it remains diagnostic; noting the nuance in case a future investigation reads the reported row as authoritative for verdict=unknown streaks.

🔧 Fix: silence missing-streak-file stderr leak; correct diag sink comment
✅ Re-checked - no issues remain.

✅ **Test** - passed

✅ No issues found.

• bash tests/fm-composer-lib.test.sh — 14 ok (5 new diag-sink tests: inert without env var, hex byte capture, no replayable escapes, 120-byte bounding with truncation marker, one line per row)
• bash tests/fm-daemon.test.sh — 111 ok, exit 0 (12 new tests: threshold trigger, stderr silence, refresh cadence, streak reset/restart-survival, disable via 0, no leaked temp reads, pane-tail for unreadable composer, wedge marker carries diagnostic, alarm summary excludes row bytes)
• bash tests/fm-afk-return.test.sh — 7 ok, exit 0 (new: return surfaces and clears the composer-defer diagnostic)
• Manual end-to-end demo (defer-diag-demo.sh): sourced the real daemon in library mode against a fake tmux pane whose composer forever holds a captain draft; drove 5 real inject_msg deferrals to the threshold, ran housekeeping past max-defer, then ran the real bin/fm-afk-return.sh begin/check against the daemon-produced artifacts
• Constraint checks against the diff: no fallback delivery route added, no blank/NBSP normalization added, diag sink opt-in via FM_COMPOSER_DIAG_FILE, daemon fixture uses non-blank content (not U+00A0)

⚠️ **Document** - 1 info

• ℹ️ bin/fm-afk-launch.sh:369 - fm_afk_clear_stale_artifacts in bin/fm-afk-launch.sh clears only .subsuper-escalations, .subsuper-escalations.since, and .subsuper-inject-wedged on a fresh away entry; the new .subsuper-composer-defer-diag/-streak/-read artifacts are cleared only by bin/fm-afk-return.sh, so a prior session's diagnostic or streak count can survive into a fresh away session if the return script never ran (crash or manual .afk removal). Effect is diagnostic-only, but a code follow-up may be warranted; documentation now attributes clearing to the return script, which matches current behavior.

🔧 Fix: clear composer-defer diagnostics on fresh away entry too
1 info still open:

• ℹ️ bin/fm-afk-launch.sh:362 - Judgment call, already applied: the instruction literally asked only to extend fm_afk_clear_stale_artifacts (which lives in bin/fm-afk-start.sh, sourced by the launcher, not in bin/fm-afk-launch.sh as the instruction stated), but the launcher's transactional entry backs up and restores every artifact that clear removes, so the backup loops and fm_afk_launch_restore_backup were also extended with the three composer-defer artifacts. Without that, a failed away entry would restore the delivery artifacts yet permanently destroy the prior session's diagnostic evidence, breaking the launcher's existing rollback invariant. Signature, call sites, and away-entry ordering are unchanged, and the rollback regression test now covers the new artifacts.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.