fix: keep secondmate operational inputs silent

[withally]

Intent

Fix the defect where Pi secondmates answer away-supervisor digests, doorbells, fire-and-forget steers, and routine from-firstmate steers in captain voice. The generated secondmate charter and crewmate or scout brief scaffolds must state once under the status protocol that FIRSTMATE_OP digests, doorbells, steers, and marked from-firstmate requests are handled silently: never emit assistant or chat text, including acknowledgements, summaries, or idle notices; after any required status-file append, or no action, end with an empty assistant response; the address captain is reserved for the main firstmate. bin/fm-operational-input.sh must carry the same bounded one-sentence instruction on worker-bound operational inputs so already-launched mates receive it, while main-bound inputs remain unchanged and body parsing remains byte-compatible. Do not edit AGENTS.md. Extend the existing fm-brief and fm-operational-input tests through generated and executable interfaces; prove ship, scout, and secondmate scaffolds each contain exactly one copy and worker carriers contain exactly one copy without adding a second copy to crewmate briefs. Keep one fix per PR and touched tests green under bin/fm-test-run.sh. Preserve the two-review-round maximum. The named isolated Pi/Herdr live acceptance must use ~/Projects/firstmate/bin/fm-herdr-lab.sh only, never the default session or fleet panes, and prove a real marked secondmate appends the required status line while producing zero assistant text; this passed with session fm-lab-fm-mate-op-diges-23823-31152, pane w1:p2, token LIVE_OP_SILENCE_1788395551, exact status line, one carrier copy, final assistant content [], and helper teardown restored the unchanged running default session. Firstmate authority accepts the residual fire-and-forget-pre-carrier-resend-duplicates finding as-is for this PR: exposure is bounded to records persisted before this change lands and retried after it, the delivery-ID-specific dedupe remedy is filed as follow-up fm-send-fire-and-forget-precarrier-dedupe-f2, and the review step must be approved rather than skipped so the reviewed head is durably attested. Test and document steps must complete.

What Changed

• Added recipient-aware silence carriers for worker-bound operational inputs, inbox doorbells, and marked secondmate requests, while preserving main-bound encoding and body parsing.
• Persisted exact pending-reply request and recovery bodies so correlation-preserving retries reuse the original payload and recovery attempt.
• Updated ship, scout, and secondmate scaffolds, delivery documentation, and executable/remote/Pi-Herdr regression coverage for the single-copy silent-response contract.

Risk Assessment

⚠️ Medium: The change spans operational-input framing, durable resend state, generated briefs, and executable acceptance paths, so it carries cross-cutting compatibility risk despite no substantiated merge blocker.

Testing

Ran the focused behavioral suites and the required isolated Pi/Herdr end-to-end witness through bin/fm-test-run.sh. The live test proved durable marker/carrier/silence delivery, exact status-file append, handled acknowledgement, zero assistant text, preserved direct captain input, and successful isolated teardown. No full suite, linter, formatter, or static-analysis command was run per the assigned test-phase contract.

Evidence: Isolated Pi/Herdr end-to-end witness

Source: Isolated Pi/Herdr end-to-end witness

Real marked secondmate request: exact status append, assistant-content=[], zero assistant text, one carrier/rule copy, and direct captain input remained unmarked.

Test command:
FM_SEND_MARKER_HERDR_E2E=1 HERDR_LAB_HELPER=bin/fm-herdr-lab.sh bin/fm-test-run.sh tests/fm-send-secondmate-marker-herdr-e2e.test.sh

FM_TEST_BEGIN 2026-09-03T03:40:04Z tests/fm-send-secondmate-marker-herdr-e2e.test.sh family=live-harness-optin expected_gate_skip=optin-env

Target:
01c36f245c9a137003015b097002e04c906bda2d

Reviewer-visible end-user witness:
evidence: exact-id durable-body-hex=5b666d2d66726f6d2d66697273746d6174655de281a3636f72723d65666334646161616438396163366361204c4956455f4f505f53494c454e43455f32393633333a20726561642074686973206d61726b656420696e626f7820726571756573742c2072756e2065786163746c79207468697320636f6d6d616e643a207072696e7466202725735c6e272027646f6e653a204c4956455f4f505f53494c454e43455f323936333327203e3e20272f7661722f666f6c646572732f336e2f33776663706c726e33636c663434686a6a6b66677138743030303030676e2f542f2f666d2d73656e642d6d61726b65722d68657264722d6532652e7a41476f4c632f7365636f6e646d6174652d686f6d652f73746174652f6d61726b65722d70692d736d2e73746174757327202d207468656e206d6f7665207468652072657175657374207265636f726420746f2068616e646c65642f2ee281a420e281a348616e646c652046495253544d4154455f4f5020646967657374732c20646f6f7262656c6c732c207374656572732c20616e64206d61726b65642066726f6d2d66697273746d6174652072657175657374732073696c656e746c793a206e6576657220656d697420617373697374616e74206f72206368617420746578742c20696e636c7564696e672061636b6e6f776c656467656d656e74732c2073756d6d61726965732c206f722069646c65206e6f74696365733b20616674657220746865207265717569726564207374617475732d66696c6520617070656e642c206f72206e6f20616374696f6e2c20656e64207769746820616e20656d70747920617373697374616e7420726573706f6e73653b20226361707461696e2220697320726573657276656420666f7220746865206d61696e2066697273746d6174652e; status=done: LIVE_OP_SILENCE_29633 assistant-content=[]
ok - real Pi/Herdr: exact-id inbox request is marked, acted, acked, and silent
evidence: direct-input received-hex=464d5f4d41524b45525f48455244525f444952454354206361707461696e20696e707574
ok - real Pi/Herdr: direct captain terminal input stays unmarked
FM_TEST_END 2026-09-03T03:42:13Z tests/fm-send-secondmate-marker-herdr-e2e.test.sh exit=0 duration_ms=128528 gate_skip=false
FM_TEST_SUMMARY total=1 failed=0 skipped_gate=0 duration_ms=128649

Assertions exercised by the real test:
- durable secondmate record retained exactly one from-firstmate marker, worker carrier, and silence rule;
- guarded Herdr doorbell carried exactly one silence rule;
- Pi appended exactly one requested status line and moved the record to handled/;
- Pi emitted zero assistant text and final assistant content []; and
- direct captain terminal input remained byte-identical and unmarked.

The test teardown completed successfully for its isolated fm-lab session.

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 1 issue found → auto-fixed ✅

• 🚨 tests/fm-send-secondmate-marker-herdr-e2e.test.sh:170 - The changed assertion still watches the wrong delivery plane. This test launches a local kind=secondmate, then fm-send.sh "$ID" "$REQUEST" resolves it as a task selector; ordinary text is written to the task inbox and only fm_task_inbox_ring's doorbell is typed. The capture extension aborts every before_agent_start before Pi can read that record, so wait_for_prompt "$REQUEST" at line 168 cannot observe the request and the line-170 assertion cannot prove the worker carrier or the required status-only, zero-assistant behavior. Read the durable record for carrier bytes and use a non-aborting worker/status-file witness for the live silence acceptance; changing that acceptance-test boundary needs authorization.

🔧 Fix: Fixed secondmate E2E inbox silence witness
✅ Re-checked - no issues remain.

✅ **Test** - passed

✅ No issues found.

• bin/fm-test-run.sh tests/fm-brief.test.sh tests/fm-operational-input.test.sh tests/fm-pending-reply.test.sh tests/fm-send-remote-delivery.test.sh tests/fm-send-secondmate-marker.test.sh tests/fm-task-inbox.test.sh
• FM_SEND_MARKER_HERDR_E2E=1 HERDR_LAB_HELPER=bin/fm-herdr-lab.sh bin/fm-test-run.sh tests/fm-send-secondmate-marker-herdr-e2e.test.sh

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.