Wedged/booting session is electable as PM and can be handed the queue flush (register fakes liveness)

Split from MSG-285 as the ROUTING half. (a)/(b) there are the hub over-asserting on the RESPONSE; this is the hub over-asserting on the ROUTE, and unlike them it can lose messages currently sitting in the queue. Verified in source by coder-llmmsgsrv-cc: stmtRegister upserts last_seen = excluded.last_seen, so POST /register stamps liveness fresh. Every liveness predicate reads last_seen and nothing else - stmtRosterIsActive (:1962), pmOnline (:1968), pickPmCandidate (:3171-3176). So for STALE_TTL_S=600 after a bootstrap register, a session that registered but is wedged before claude can read (dev-channels picker, workspace-trust prompt, slow boot) is ELECTABLE AS PM and reads as online. It can win an election, become recipients=[pm], and be handed the pm_pending_queue flush - moving messages OUT of the queue into the inbox of something that cannot read them. The queue drain becomes the loss. Not hypothetical: observed on coder-llmmsgsrv-cc 2026-08-12 00:35:03-00:47, wedged on the dev-channels picker with a fresh roster row throughout. The honest field already exists and has zero readers: last_poll_at is written only at :6188 on the poll path, read only by the roster listing and the caller_kind classifier. Comment at :1904 records it was deliberately kept OFF the register path so the register test could not be faked - the inverse case, LIVENESS being faked by a register, was not considered. Fix direction: routing predicates must consult evidence-of-READING, not evidence-of-ANNOUNCEMENT, at minimum for (1) PM electability and (2) the queue flush target. OUT OF SCOPE deliberately: last_seen=0 also counting as active. Correct for poll-created rows (:6164 inserts 0 on purpose); folding it in would break implicit re-register. Priority 0 because pm-llmmsgsrv-cc now holds a standing wake grant (Elazar 2026-08-12), so deliberate wakes make the wedge window MORE frequent. mem:agent-wake-grant-coder-llmmsgsrv.