fix: prevent duplicate away-mode completion escalations

[sparkus]

Intent

Stop the away-mode catch-all scan re-escalating completions already handled through the normal signal path (or already surfaced to firstmate).

Defect (observed 2026-08-02): while afk was active, the daemon's catch-all fleet scan re-escalated the same done: lines already handled — three separate completions each waking firstmate a second time. Root cause: catch-all only consulted .subsuper-seen-status-* (written by the daemon escalate path). Always-on firstmate handling only sets .hb-surfaced-, so when afk started, historical done: lines firstmate already saw were re-escalated. The per-wake signal escalate path already marked .subsuper-seen-status- correctly; the gap was the always-on / hb-surfaced path.

Fix (narrow, 2 files): In bin/fm-supervise-daemon.sh, status_line_already_seen checks both .subsuper-seen-status-* and .hb-surfaced-*; catch-all uses it. Does NOT promote hb into subsuper-seen (watcher marks hb before the daemon signal path; promoting would make classify_signal self-handle without delivering). Tests in tests/fm-daemon.test.sh: signal-then-scan no re-fire (existing), scan-first still escalates (existing), new test that hb-only historical done is not re-escalated by catch-all while signal path still escalates.

Acceptance: completion escalated via signal path not re-escalated by catch-all; completion scan first sees still escalated; existing away-mode classification tests stay green. Scope fence: only the named scripts and their tests (~2 files); no backend adapters, AGENTS.md, docs/, skills/, CI, install scripts.

What Changed

• Make the away-mode catch-all scan deduplicate status lines against both daemon escalation markers and always-on firstmate surfacing markers, while preserving normal signal delivery.
• Add regression coverage for historical completions marked only as surfaced, alongside the existing signal-first and scan-first cases.
• Clarify the shared scanner comments to reflect the catch-all’s dedup ownership.

Risk Assessment

✅ Low: Captain, the two-file change is narrowly scoped and preserves the signal-first, scan-first, and hb-surfaced deduplication invariants without suppressing the daemon signal path.

Testing

Exact-commit and scope preflight passed; focused daemon and watcher-to-supervisor lifecycle tests passed without skips, and the evidence transcript demonstrated signal-first deduplication, scan-first escalation, and hb-only catch-all suppression with signal delivery preserved. Two evidence-harness setup attempts were corrected before the successful transcript.

Evidence: AFK duplicate-escalation acceptance transcript

All scenarios report PASS: signal→scan remained one escalation; scan-first escalated once; hb-only history was skipped by catch-all while the signal path still escalated.

AFK duplicate-escalation acceptance transcript
target_commit=c53403870bdba244e9acbb9fbb788c6462e49b4b

SCENARIO signal_then_scan
  after_signal_buffered=1
  after_catchall_buffered=1
  result=PASS

SCENARIO scan_first
  after_scan_buffered=1
  payload=task.status: done: scan-first completion (catch-all scan)
  after_later_signal_buffered=1
  result=PASS

SCENARIO hb_only_historical
  hb_marker=present:done: historical completion already surfaced to firstmate
  after_catchall_buffered=0
  subsuper_marker_after_catchall=absent
  after_signal_buffered=1
  subsuper_marker_after_signal=present:done: historical completion already surfaced to firstmate
  result=PASS

OVERALL=PASS

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• Exact-commit, merge-base, clean-worktree, and two-file scope preflight using git status, git rev-parse, git merge-base, and git diff
• bin/fm-test-run.sh tests/fm-daemon.test.sh tests/fm-wake-daemon-lifecycle-e2e.test.sh
• Production-function acceptance scenarios exercising handle_wake and housekeeping, recorded in afk-dedup-behavior.txt

🔧 **Document** - 1 issue found → auto-fixed ✅

• ⚠️ bin/fm-classify-lib.sh:403 - The shared scanner comment says daemon dedup uses only .subsuper-seen-status-*, but the catch-all now also uses .hb-surfaced-*. Fixing this third script would violate the two-file scope fence.

🔧 Fix: Correct catch-all dedup owner comment
✅ Re-checked - no issues remain.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.