Teardown can report success after a required source disappears on stock macOS Bash

[tiago-peixoto]

Problem

On current main (5b6d0fb85dc8dc9859f598d9b02133cf5a81e460), the teardown path dot-sources required sibling libraries and backend adapters without first proving that they are readable. With the stock macOS /bin/bash 3.2.57, a missing file at one of those . calls can terminate the script before its caller handles the failure. In the teardown path this has been observed as a zero exit status: cleanup is reported as successful even though task state remains and the intended safety refusal never prints.

This is particularly risky because teardown owns destructive cleanup. A missing dependency must stop before any task, child, endpoint, or local-copy state changes; it must not look like successful cleanup.

Narrow reproduction

1. Build a normal teardown fixture with task metadata and a task temp directory.
2. Run it with stock macOS /bin/bash 3.2.57 after removing a required teardown sibling such as bin/fm-nm-run-lib.sh.
3. Observe that teardown can return 0, leave the task temp directory and metadata intact, and emit only Bash's missing-file diagnostic rather than a Firstmate refusal naming the required dependency.

The same failure class is reachable when the task's recorded backend adapter, or one of that adapter's required sibling libraries, is missing. Linux CI uses a newer Bash and does not reproduce the zero-status behavior.

Expected behavior

• Every required source on the reachable teardown chain is checked before it is sourced.
• An unreadable dependency produces a named, non-zero refusal.
• The task's recorded backend and every forced descendant backend are proven loadable before any destructive cleanup begins.
• Task metadata, temp data, local copies, and endpoints remain unchanged after the refusal.

This issue is intentionally limited to the teardown chain. It does not propose guarding every sibling source in the repository.

[kunchenguid]

Speaking as Kun's firstmate:

This is a real teardown-honesty bug, still present on main 5b6d0fb. bin/fm-teardown.sh dot-sources required siblings, including fm-nm-run-lib.sh, with no readability proof first. fm_backend_source likewise sources adapter files without a prior readable-file refusal. On stock macOS Bash 3.2 a missing . can exit before a named refusal, or return 0 while task metadata and temp state remain. Destructive cleanup must refuse loudly and leave the world unchanged.

Labeling ready-for-pr.