Preserve private ledger continuity across Firstmate home migrations

[pranaypratyush]

Problem

A Firstmate home migration can transfer project Git custody without a checksum-bound inventory of the private operational ledgers that explain worker failures and recovery decisions. The receiving home can therefore have an incomplete or discontinuous incident history while the migration still appears complete.

Observed behavior

The maintained state-breakage ledger records a handoff that intentionally transferred project Git custody but excluded Firstmate-local operational repairs and runtime recovery material. The receiving home retained a stoppage ledger beginning after the handoff, but continuity with any older ledger was not proven.

Expected invariant

A home migration either transfers every selected private operational ledger with an inventory of relative path, byte length, and checksum, or records an explicit absent source. The receiver verifies the inventory and content before the source is retired. Missing, changed, or ambiguous entries stop completion rather than silently presenting a partial history.

Evidence and causal boundary

• The maintained incident record documents the missing continuity, the deliberate handoff boundary, and the required checksum-bound regression target at data/firstmate-state-breakages.md:10-18.
• The consolidated diagnosis classifies this as an evidence-retention limitation that did not cause the runtime incidents at data/firstmate-broken-state-diagnosis.md:89-109.
• Existing task/backlog handoff code uses hashes for a remote task outbox, but that is a different transfer contract from an entire Firstmate-home migration.

The causal boundary is the Firstmate-home migration manifest and receiver verification contract. Whether an older source ledger actually existed is unknown; the defect is that the migration did not prove the answer.

Impact

Root-cause investigations lose historical evidence, duplicate incidents may be recorded, and operators cannot distinguish a genuinely new failure from a missing pre-migration record. This weakens recovery confidence without exposing any private data publicly.

Relationship to existing work

Open issue #74 covers stale supervision advisory delivery and is unrelated. Closed issues #1–#7 and #39 cover OMP support and executable/lifecycle capabilities, not private-home migration continuity. Merged PRs #24–#34 cover remote secondmate and RunPod transfers; their task-outbox guarantees do not cover the complete private ledger set. The current Firstmate backlog has no migration-continuity repair, and no PR covers it.

Acceptance criteria

1. The home migration manifest enumerates the configured private ledgers and their relative path, byte length, and SHA-256, preserving explicit absent-file semantics.
2. Receiver verification checks every manifest entry before source retirement and reports the exact missing, changed, or unexpected entry without copying private contents into public artifacts.
3. The migration remains resumable and idempotent after interruption, with the source preserved until verification succeeds.
4. Deterministic tests cover a missing ledger, changed bytes, an explicitly absent ledger, and a successful byte-identical transfer.
5. Existing project Git, task-outbox, and secondmate handoff safeguards remain unchanged.

Deterministic regression scenario

Create synthetic source and receiver homes with a known ledger manifest. Run a migration with one missing ledger and assert completion refuses while the source remains intact. Run again with one modified byte and assert checksum mismatch is reported. Mark a genuinely absent optional ledger explicitly and assert verification succeeds only for that declared absence. Finally transfer all entries unchanged and assert the receiver records verified continuity before source retirement.