flow: remote-failover — try peers in order, fall through to local + 6 tests

(remote-failover addrs fn local) tries fn on each peer in order, moves to the next
on any raised error, and runs the local node if every peer fails. Threads input,
composes in sequences.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/flow-on-sx.md

@@ -16,7 +16,7 @@ federation extension via fed-sx for remote-node execution.
 
 ## Status (rolling)
 
-`bash lib/flow/conformance.sh` → **81/81** (Phases 1-3 done; Phase 4 in progress: remote-node done)
+`bash lib/flow/conformance.sh` → **87/87** (Phases 1-3 done; Phase 4 in progress: remote-node + failover done)
 
 ## Ground rules
 
@@ -120,7 +120,9 @@ lib/flow/spec.sx           lib/flow/runtime.sx          lib/flow/store.sx
   the fed-sx boundary, MOCKED via a peer registry (`flow-peer-register!`); raises
   `flow-remote-unreachable` / `flow-remote-no-fn`. Composes with sequence, suspend,
   retry. `tests/distributed.sx`, 7 cases.
-- [ ] failure semantics — retry on different peer, fall through to local
+- [x] failure semantics — `(remote-failover addrs fn local)` tries each peer in
+  order, moves to the next on any raised error, and runs the `local` node if every
+  peer fails. 6 tests.
 - [ ] persistence across instances — flow state replicates via fed-sx
 - [ ] handoff — flow started here can resume on a peer if the local instance is down
 - [ ] `lib/flow/tests/distributed.sx` — federated flow scenarios (mock fed-sx in tests)