john/firstmate
Watch
1
0
Fork
You've already forked firstmate
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

merge: catch up with upstream kunchenguid/firstmate (41 commits, 24 conflicts resolved) #2

Merged
john merged 42 commits from fm/fm-upstream-merge into main 2026-08-07 18:23:12 +00:00
Conversation 0 Commits 42 Files changed 160 +26508 -1216
john commented 2026-08-07 18:23:00 +00:00
Owner
Copy link

Catches this fork up with its parent, kunchenguid/firstmate, by merging upstream/main into main.

  • local main = 8576b4f, upstream/main = 70aeba8, merge-base 4ee4a0a
  • 79 commits ahead, 41 behind; a fast-forward is not available, so this is a real merge commit
  • 24 conflicting files, 49 hunks, resolved here
  • pushed to this Forgejo only; upstream is read-only and was never written to

What came from upstream

41 commits. The ones that matter for a single-home setup:

commit what it fixes
d0461e4 false "watcher down" alarms in Claude sessions - a defect this home is actively suffering
cf95112 hardens tmux agent liveness across harnesses (see the R3 section below)
7ef26c4 aborts parked runs and reaps leaked processes before teardown
4b6b89d moves network checks off the blocking session-start path
345de4e preserves fleet state in truncated session-start digests
3b6ee03 runs session start deterministically from hooks
bb352e7, bf01a42 surfaces fleet-wide open decisions on every wake drain, bounded by incremental cursors
4a9979a, ef2c3a2 reports stale AXI tools during bootstrap and enforces the AXI-family floors
8387039, 3089a57 Herdr presentation spaces, now default-on above a 0.8.0 floor
71f0b3f gates Pi Calm built-in overrides by activation state

Plus features: remote secondmate homes, per-task trace-context propagation, the Muse Code crewmate adapter, fm-send --resolve-key, and the X-mode-to-Relay documentation rename. New libraries land intact (fm-startup-network.sh, fm-line-cap-lib.sh, fm-sessionstart-run.sh, fm-timeout-lib.sh, fm-nm-run-lib.sh, fm-trace-context-lib.sh, fm-secondmate-parent-lib.sh).

What was ours, and survives

All seven core OMP files land verbatim - upstream never touched them:
bin/fm-backend.sh, bin/fm-supervise-daemon.sh, bin/fm-tmux-lib.sh, bin/fm-omp-primary-marker-lib.sh, bin/fm-primary-watch-core.ts, bin/fm-primary-watch-version-lib.sh, bin/backends/orca.sh.

Also preserved: the locale-independent composer glyph strip (a73484c), the committed-but-never-pushed teardown refusal (97359ee, still at step 1 of teardown, ahead of upstream's new reaping at step 2), the watcher signal-signature work (d136e7a/a2f23e6), the watcher ownership-across-rebinds fix (8a1054b), and the skills import (a5ec819).

The five conflicts that needed judgement

Roughly 18 of the 24 were additive collisions - we added omp to a list, upstream added muse to the same list - and are unioned. Both names are kept everywhere. These five were not mechanical.

R1 bin/fm-composer-lib.sh - two different bugs on the same lines

We had refactored the leading-glyph strip into per-glyph arms because ${content#??} counts characters, so under a non-UTF-8 locale a multibyte glyph like ❯ (3 bytes) is miscounted and the strip corrupts the row. Upstream did not fix that; it added Muse's ⟩ to the same locale-fragile form.

Taking either side alone loses something real. Resolved by adding ⟩ to the per-glyph arms:

'⟩ '*) content=${content#'⟩ '} ;;
...
'⟩'*)  content=${content#'⟩'} ;;

Upstream's two bare-glyph '❯'|'›'|'⟩') cases and its luminance comments merged cleanly and are kept, as is our fm_composer_terminal_width.

R3 bin/backends/tmux.sh - the dangerous one

Upstream rewrote agent liveness around a new fm_backend_tmux_classify_process_name that recognises no interpreter names. An OMP worker's process name is bun (or omp), so taking upstream wholesale classifies a live OMP worker as ambiguous. A false negative here is the one verdict that can launch a duplicate agent onto a live worktree, and OMP support is this fork's reason for existing.

Simply adding bun|omp to the classifier is not sufficient either: a bare bun shell is ordinary, and that would report a live agent in an empty pane.

The resolution keeps upstream's new two-source probe (classify_process_name, foreground_comms, foreground_argv0s - they genuinely harden liveness for the other harnesses and add Muse) and restores the expected_bun/expected_omp parameters upstream dropped, dispatching bun/omp to our existing fm_backend_tmux_bun_agent_state from both name sources:

case "$name" in
  bun|omp)
    omp_state=$(fm_backend_tmux_bun_agent_state "$target" "$name" "$expected_bun" "$expected_omp")
    if [ "$omp_state" = alive ]; then printf 'alive'; return 0; fi
    fg_other=1
    continue
    ;;
esac

That helper proves a real OMP launch from the task-bound Bun/OMP identity - argv shape plus the verified executable - not from the name. An unproven bun never settles a verdict on its own; it leaves the pane ambiguous, which is the conservative direction, because only dead authorizes recovery.

The audit that preceded this work explicitly did not implement R3 and flagged it UNVERIFIED, so it is implemented and tested here.

Test evidence. tests/fm-tmux-agent-liveness.test.sh (upstream's new real-process, real-tmux suite) gains three OMP cases:

  • a verified bun <omp-entrypoint> launch, driven through fm_backend_agent_state with a real task meta file, classifies alive
  • a bare bun shell with the same recorded identity stays ambiguous
  • a pane whose recorded Bun is not the live interpreter stays ambiguous, never alive

plus a guard that bun and omp are not accepted as agent names on their own, so the positive case cannot pass for the wrong reason.

The regression is genuinely covered: with the dispatch removed, the first case reports ambiguous instead of alive and the suite fails. With it restored, all 14 assertions pass.

Those committed cases use a stand-in interpreter so they run anywhere. They were additionally confirmed against the real Bun runtime (bun 1.3.14, the same binary the installed omp 17.2.6 runs under), in a throwaway tmux lab driving fm_backend_agent_state through a real task meta file:

real `bun <entrypoint>` matching the recorded omp_bun/omp_bin   -> verdict=alive
real bare `bun -e ...` with the SAME recorded identity          -> verdict=ambiguous

Both panes report pane_current_command=bun, so the name alone is identical between them; only the argv shape and the /proc/<pid>/exe identity separate the live worker from the bare shell, which is exactly the distinction this resolution restores.

R4 bin/fm-spawn.sh - ordering in the secondmate launch path

Our OMP secondmate session prep (primary-extension marker plus session-lock PID validation) now runs before upstream's FM_SKIP_SECONDMATE_INHERIT-guarded inheritance block, so a corrupt OMP home fails before foreign config is pushed into it. Our older unguarded inheritance lines are superseded by upstream's guarded form, which adds FM_CONFIG_INHERIT_LIVE=1.

The LAUNCH string carries both sides: our FM_OMP_SESSION_POINTER and upstream's FM_TRACE_CONTEXT plus FM_SUPERVISION_MODEL. For an OMP secondmate the supervision model resolves to persistent, which is correct - OMP runs a persistent watcher.

R5 bin/fm-teardown.sh - a line-continuation trap

Both sides added artifact paths to the same two rm -f lists (ours .omp-ext.ts/.omp-ready/.omp-started, upstream's .muse-session/.muse-session-current/.open-decisions-cursor). A careless union drops a trailing backslash and bash then tries to execute the next path. Resolved as one rm -f per block with all artifacts and correct continuations.

Our unpushed-work refusal is untouched and still runs at step 1, ahead of upstream's new run-abort and process-reaping at step 2, so an undelivered worktree is still refused before anything is reaped.

R6 .agents/skills/harness-adapters/SKILL.md - delete versus modify

Upstream deleted the per-harness session-start bullet list from the skill and relocated that content. We had extended that list with an omp bullet. The deletion is kept - the relocation is intentional and preserves a single owner - and the OMP fact is migrated into the relocated owner, docs/sessionstart-nudge.md, as a row in its harness-transport table.

The fixture bump that had no conflict marker

Upstream raised FM_TASKS_AXI_MIN from 0.1.1 to 0.2.4 in bin/fm-tasks-axi-lib.sh, which merged cleanly. That silently put the fake tasks-axi in tests/fm-teardown.test.sh below the floor, so the scout completion gate refused a teardown the test expects to succeed - an exit 0 assertion getting 1, with no conflict to draw attention to it. Fixed with the one-line fixture bump to 0.2.4. Real teardowns were never affected; the installed tasks-axi is already 0.2.4.

Test results

bin/fm-lint.sh clean (ShellCheck 0.11.0, pinned). bin/fm-test-run.sh --check-coverage ok (139 suites).

Full run - bin/fm-test-run.sh --all:

FM_TEST_SUMMARY total=139 failed=8 skipped_gate=21 duration_ms=2186932

2,334 individual assertions passed. Every one of the 8 failing suites is accounted for below: none is caused by this merge, and each claim is backed by a run rather than an assumption - each failing suite was additionally re-run on its own against clean main or pure upstream/main, which is stronger evidence than any single sweep.

Suites specifically re-run because the audit could not verify them:

suite result
fm-tmux-agent-liveness (incl. new OMP cases) pass, 14/14
fm-watcher-lock pass, 30/30 (see the load-flake note below)
fm-omp-primary, fm-omp-harness, fm-omp-secondmate pass
fm-teardown (all 7 unpushed-refusal tests + scout) pass
fm-composer-lib, fm-composer-ghost pass
fm-guard-stale-banner (upstream d0461e4) pass
fm-backend, fm-send-strict, fm-crew-state, fm-secondmate-liveness pass

Remaining failures, all proven not merge-induced

fm-session-start.test.sh and fm-bootstrap.test.sh - "MISSING: node" (environmental).
Both assert that bootstrap reports MISSING: node after the fixture removes node from a fake PATH prefix. This machine has /usr/bin/node, which is still on the tests' BASE_PATH (/usr/bin:/bin:/usr/sbin:/sbin), so the tool is found and no diagnostic appears. Proof: with a node-free base path both suites pass completely.

FM_TEST_BASE_PATH=<dir without node> bash tests/fm-bootstrap.test.sh      -> EXIT=0, 0 failures
FM_TEST_BASE_PATH=<dir without node> bash tests/fm-session-start.test.sh  -> EXIT=0, 0 failures

fm-session-start additionally fails identically on clean main (8576b4f) before this merge, and fm-bootstrap's assertion is new from upstream and fails identically on pure upstream/main.

fm-backend-herdr-presentation-e2e.test.sh - "multi-home teardown changed active workspace/tab" (inherited).
Fails identically on pure upstream/main, with the same values (w3/w3:t1 to wY/wY:t1). The merged file is byte-identical to upstream's. This machine runs its sessions inside a real Herdr, and upstream's 3089a57 turned presentation spaces default-on, so the focus-drift assertion is exercised against ambient Herdr state.

fm-calm-pi-extension.test.sh - "/export did not complete while calm mode was on" (pre-existing).
A live Pi TUI case driving a real /export through tmux. Fails identically on clean main (8576b4f) before this merge, with the same message.

fm-documentation-audiences.test.sh - "repository documentation audience check failed" (pre-existing).
bin/fm-doc-audience-check.sh reports seven unclassified skills, all from the local skills import in a5ec819: before-building, handoff, next-decision, pi-custom-model, to-spec, to-tickets, wayfinder. Identical output and exit code on clean main. Classifying those imported skills is separate work, out of scope for a merge.

fm-on.test.sh and fm-remote-doctor.test.sh - the remote-secondmate preflight (inherited).
Both are upstream-only suites from the remote-secondmate feature (7809ab9, 733a504), absent from clean main, and byte-identical here to upstream's copies. Both fail identically on pure upstream/main:

tests/fm-on.test.sh            -> "the remote doctor did not name the missing tools
                                   (missing: 'required tools do not resolve on the remote
                                   runtime PATH: herdr tasks-axi treehouse harness')"
tests/fm-remote-doctor.test.sh -> "--fix did not create the first needed harness wrapper"

fm-on's failure is the same environmental class as the node cases above: it asserts that herdr, tasks-axi, treehouse, and harness do not resolve on PATH, and this machine has all four installed. This home has no remote secondmates, so the feature these suites cover is unused here.

fm-watcher-lock.test.sh - "arm did not exit with HUP status (got 124)" (load flake, not a defect).
124 is the test's own wait_for_exit timeout sentinel, not a process exit code: the armed watcher did not shut down within the ~8s the case allows, on a machine that was running the full 139-suite sweep concurrently with several standalone baseline runs.

The case is provably untouched by this merge. test_arm_hup_cleans_child_and_temp_output is byte-identical in local main, upstream/main, and the merged tree, and bin/fm-watch-arm.sh and bin/fm-watch.sh are unchanged by the merge. My conflict resolution in this file touched only test_watch_restart_attaches_to_healthy_peer, a different case.

Re-run twice on an idle machine, the suite is green both times: EXIT=0, 30/30 assertions, 0 failures.

One opt-in suite that could not run, on either side

tests/fm-omp-worker-tmux-live-e2e.test.sh (opt-in, FM_OMP_TMUX_LIVE_E2E=1) refuses before it starts: ship spawns require --mode <no-mistakes|direct-PR|local-only>. The file is byte-identical to clean main and passes no --mode, so ab89395 carried the per-task delivery contract into the other OMP spawn cases but missed this one. It fails the same way on clean main, so it is pre-existing and unrelated to this merge; fixing it is out of scope here and worth its own change.

Patched locally in a throwaway clone just to see past that gate, it then stops at OMP initial instruction was not acknowledged by a turn_start event, which needs live model credentials this environment does not have. That is why R3 was validated with the real-Bun lab described above rather than through this suite.

Scope

Merge resolution only. The two live defects upstream does not fix - the away-mode injection wedge and the missing Forgejo support in the PR merge poll - are tracked separately and deliberately untouched here. The stale dnth remote is left alone.

Independent verification by firstmate

The full suite was re-run against this branch with FM_HOME correctly scoped to the tree under test: 2290 passing, 9 failing. Every failure was chased to ground rather than waved off, and none is merge-induced:

suite verdict
fm-turnend-guard concurrency flake — 0 failures run alone, on both trees
fm-watcher-lock concurrency flake — 0 failures run alone, on both trees
fm-bootstrap expects node absent; this machine has /usr/bin/node
fm-session-start same MISSING-tool cause
fm-on new upstream test; fails identically on pure upstream/main
fm-remote-doctor new upstream test; fails identically on pure upstream/main
fm-backend-herdr-presentation-e2e fails identically on pure upstream/main — sessions run inside a real herdr
fm-calm-pi-extension fails identically on clean main — pre-existing
fm-documentation-audiences fails identically on clean main — pre-existing

Two notes on method, because both nearly produced a wrong answer:

  • fm-on and fm-remote-doctor do not exist on main, so a naive main-versus-branch comparison reported "0 failures on main" and looked like a regression. The meaningful counterfactual was pure upstream/main, where they fail the same way.
  • An earlier run of fm-arm-pretool-check case A13 failed only because FM_HOME was left pointing at the primary checkout while testing a worktree. Repeating it three times made a harness error look deterministic. It passes with FM_HOME scoped correctly or unset.
Catches this fork up with its parent, `kunchenguid/firstmate`, by merging `upstream/main` into `main`. - local `main` = `8576b4f`, `upstream/main` = `70aeba8`, merge-base `4ee4a0a` - 79 commits ahead, 41 behind; a fast-forward is not available, so this is a real merge commit - 24 conflicting files, 49 hunks, resolved here - pushed to this Forgejo only; `upstream` is read-only and was never written to ## What came from upstream 41 commits. The ones that matter for a single-home setup: | commit | what it fixes | |---|---| | `d0461e4` | false "watcher down" alarms in Claude sessions - a defect this home is actively suffering | | `cf95112` | hardens tmux agent liveness across harnesses (see the R3 section below) | | `7ef26c4` | aborts parked runs and reaps leaked processes before teardown | | `4b6b89d` | moves network checks off the blocking session-start path | | `345de4e` | preserves fleet state in truncated session-start digests | | `3b6ee03` | runs session start deterministically from hooks | | `bb352e7`, `bf01a42` | surfaces fleet-wide open decisions on every wake drain, bounded by incremental cursors | | `4a9979a`, `ef2c3a2` | reports stale AXI tools during bootstrap and enforces the AXI-family floors | | `8387039`, `3089a57` | Herdr presentation spaces, now default-on above a 0.8.0 floor | | `71f0b3f` | gates Pi Calm built-in overrides by activation state | Plus features: remote secondmate homes, per-task trace-context propagation, the Muse Code crewmate adapter, `fm-send --resolve-key`, and the X-mode-to-Relay documentation rename. New libraries land intact (`fm-startup-network.sh`, `fm-line-cap-lib.sh`, `fm-sessionstart-run.sh`, `fm-timeout-lib.sh`, `fm-nm-run-lib.sh`, `fm-trace-context-lib.sh`, `fm-secondmate-parent-lib.sh`). ## What was ours, and survives All seven core OMP files land **verbatim** - upstream never touched them: `bin/fm-backend.sh`, `bin/fm-supervise-daemon.sh`, `bin/fm-tmux-lib.sh`, `bin/fm-omp-primary-marker-lib.sh`, `bin/fm-primary-watch-core.ts`, `bin/fm-primary-watch-version-lib.sh`, `bin/backends/orca.sh`. Also preserved: the locale-independent composer glyph strip (`a73484c`), the committed-but-never-pushed teardown refusal (`97359ee`, still at step 1 of teardown, ahead of upstream's new reaping at step 2), the watcher signal-signature work (`d136e7a`/`a2f23e6`), the watcher ownership-across-rebinds fix (`8a1054b`), and the skills import (`a5ec819`). ## The five conflicts that needed judgement Roughly 18 of the 24 were additive collisions - we added `omp` to a list, upstream added `muse` to the same list - and are unioned. Both names are kept everywhere. These five were not mechanical. ### R1 `bin/fm-composer-lib.sh` - two different bugs on the same lines We had refactored the leading-glyph strip into per-glyph arms because `${content#??}` counts **characters**, so under a non-UTF-8 locale a multibyte glyph like `❯` (3 bytes) is miscounted and the strip corrupts the row. Upstream did not fix that; it added Muse's `⟩` to the same locale-fragile form. Taking either side alone loses something real. Resolved by adding `⟩` to the per-glyph arms: ```sh '⟩ '*) content=${content#'⟩ '} ;; ... '⟩'*) content=${content#'⟩'} ;; ``` Upstream's two bare-glyph `'❯'|'›'|'⟩')` cases and its luminance comments merged cleanly and are kept, as is our `fm_composer_terminal_width`. ### R3 `bin/backends/tmux.sh` - the dangerous one Upstream rewrote agent liveness around a new `fm_backend_tmux_classify_process_name` that recognises no interpreter names. An OMP worker's process name is `bun` (or `omp`), so taking upstream wholesale classifies a **live OMP worker** as `ambiguous`. A false negative here is the one verdict that can launch a **duplicate agent onto a live worktree**, and OMP support is this fork's reason for existing. Simply adding `bun|omp` to the classifier is **not** sufficient either: a bare `bun` shell is ordinary, and that would report a live agent in an empty pane. The resolution keeps upstream's new two-source probe (`classify_process_name`, `foreground_comms`, `foreground_argv0s` - they genuinely harden liveness for the other harnesses and add Muse) and restores the `expected_bun`/`expected_omp` parameters upstream dropped, dispatching `bun`/`omp` to our existing `fm_backend_tmux_bun_agent_state` from **both** name sources: ```sh case "$name" in bun|omp) omp_state=$(fm_backend_tmux_bun_agent_state "$target" "$name" "$expected_bun" "$expected_omp") if [ "$omp_state" = alive ]; then printf 'alive'; return 0; fi fg_other=1 continue ;; esac ``` That helper proves a real OMP launch from the task-bound Bun/OMP identity - argv shape plus the verified executable - not from the name. An unproven `bun` never settles a verdict on its own; it leaves the pane `ambiguous`, which is the conservative direction, because only `dead` authorizes recovery. The audit that preceded this work explicitly did **not** implement R3 and flagged it UNVERIFIED, so it is implemented and tested here. **Test evidence.** `tests/fm-tmux-agent-liveness.test.sh` (upstream's new real-process, real-tmux suite) gains three OMP cases: - a verified `bun <omp-entrypoint>` launch, driven through `fm_backend_agent_state` with a real task meta file, classifies `alive` - a bare `bun` shell with the same recorded identity stays `ambiguous` - a pane whose recorded Bun is not the live interpreter stays `ambiguous`, never `alive` plus a guard that `bun` and `omp` are *not* accepted as agent names on their own, so the positive case cannot pass for the wrong reason. The regression is genuinely covered: with the dispatch removed, the first case reports `ambiguous` instead of `alive` and the suite fails. With it restored, all 14 assertions pass. Those committed cases use a stand-in interpreter so they run anywhere. They were additionally confirmed against the **real Bun runtime** (`bun 1.3.14`, the same binary the installed `omp 17.2.6` runs under), in a throwaway tmux lab driving `fm_backend_agent_state` through a real task meta file: ``` real `bun <entrypoint>` matching the recorded omp_bun/omp_bin -> verdict=alive real bare `bun -e ...` with the SAME recorded identity -> verdict=ambiguous ``` Both panes report `pane_current_command=bun`, so the name alone is identical between them; only the argv shape and the `/proc/<pid>/exe` identity separate the live worker from the bare shell, which is exactly the distinction this resolution restores. ### R4 `bin/fm-spawn.sh` - ordering in the secondmate launch path Our OMP secondmate session prep (primary-extension marker plus session-lock PID validation) now runs **before** upstream's `FM_SKIP_SECONDMATE_INHERIT`-guarded inheritance block, so a corrupt OMP home fails before foreign config is pushed into it. Our older unguarded inheritance lines are superseded by upstream's guarded form, which adds `FM_CONFIG_INHERIT_LIVE=1`. The `LAUNCH` string carries both sides: our `FM_OMP_SESSION_POINTER` and upstream's `FM_TRACE_CONTEXT` plus `FM_SUPERVISION_MODEL`. For an OMP secondmate the supervision model resolves to `persistent`, which is correct - OMP runs a persistent watcher. ### R5 `bin/fm-teardown.sh` - a line-continuation trap Both sides added artifact paths to the same two `rm -f` lists (ours `.omp-ext.ts`/`.omp-ready`/`.omp-started`, upstream's `.muse-session`/`.muse-session-current`/`.open-decisions-cursor`). A careless union drops a trailing backslash and bash then tries to **execute** the next path. Resolved as one `rm -f` per block with all artifacts and correct continuations. Our unpushed-work refusal is untouched and still runs at step 1, ahead of upstream's new run-abort and process-reaping at step 2, so an undelivered worktree is still refused before anything is reaped. ### R6 `.agents/skills/harness-adapters/SKILL.md` - delete versus modify Upstream deleted the per-harness session-start bullet list from the skill and relocated that content. We had extended that list with an `omp` bullet. The deletion is kept - the relocation is intentional and preserves a single owner - and the OMP fact is migrated into the relocated owner, `docs/sessionstart-nudge.md`, as a row in its harness-transport table. ## The fixture bump that had no conflict marker Upstream raised `FM_TASKS_AXI_MIN` from `0.1.1` to `0.2.4` in `bin/fm-tasks-axi-lib.sh`, which merged **cleanly**. That silently put the fake `tasks-axi` in `tests/fm-teardown.test.sh` below the floor, so the scout completion gate refused a teardown the test expects to succeed - an `exit 0` assertion getting `1`, with no conflict to draw attention to it. Fixed with the one-line fixture bump to `0.2.4`. Real teardowns were never affected; the installed `tasks-axi` is already `0.2.4`. ## Test results `bin/fm-lint.sh` clean (ShellCheck 0.11.0, pinned). `bin/fm-test-run.sh --check-coverage` ok (139 suites). Full run - `bin/fm-test-run.sh --all`: ``` FM_TEST_SUMMARY total=139 failed=8 skipped_gate=21 duration_ms=2186932 ``` 2,334 individual assertions passed. Every one of the 8 failing suites is accounted for below: none is caused by this merge, and each claim is backed by a run rather than an assumption - each failing suite was additionally re-run on its own against clean `main` or pure `upstream/main`, which is stronger evidence than any single sweep. Suites specifically re-run because the audit could not verify them: | suite | result | |---|---| | `fm-tmux-agent-liveness` (incl. new OMP cases) | pass, 14/14 | | `fm-watcher-lock` | pass, 30/30 (see the load-flake note below) | | `fm-omp-primary`, `fm-omp-harness`, `fm-omp-secondmate` | pass | | `fm-teardown` (all 7 unpushed-refusal tests + scout) | pass | | `fm-composer-lib`, `fm-composer-ghost` | pass | | `fm-guard-stale-banner` (upstream `d0461e4`) | pass | | `fm-backend`, `fm-send-strict`, `fm-crew-state`, `fm-secondmate-liveness` | pass | ### Remaining failures, all proven not merge-induced **`fm-session-start.test.sh` and `fm-bootstrap.test.sh` - "MISSING: node" (environmental).** Both assert that bootstrap reports `MISSING: node` after the fixture removes `node` from a fake PATH prefix. This machine has `/usr/bin/node`, which is still on the tests' `BASE_PATH` (`/usr/bin:/bin:/usr/sbin:/sbin`), so the tool is found and no diagnostic appears. Proof: with a node-free base path both suites pass completely. ``` FM_TEST_BASE_PATH=<dir without node> bash tests/fm-bootstrap.test.sh -> EXIT=0, 0 failures FM_TEST_BASE_PATH=<dir without node> bash tests/fm-session-start.test.sh -> EXIT=0, 0 failures ``` `fm-session-start` additionally fails identically on clean `main` (`8576b4f`) before this merge, and `fm-bootstrap`'s assertion is new from upstream and fails identically on pure `upstream/main`. **`fm-backend-herdr-presentation-e2e.test.sh` - "multi-home teardown changed active workspace/tab" (inherited).** Fails identically on pure `upstream/main`, with the same values (`w3/w3:t1` to `wY/wY:t1`). The merged file is byte-identical to upstream's. This machine runs its sessions inside a real Herdr, and upstream's `3089a57` turned presentation spaces default-on, so the focus-drift assertion is exercised against ambient Herdr state. **`fm-calm-pi-extension.test.sh` - "/export did not complete while calm mode was on" (pre-existing).** A live Pi TUI case driving a real `/export` through tmux. Fails identically on clean `main` (`8576b4f`) before this merge, with the same message. **`fm-documentation-audiences.test.sh` - "repository documentation audience check failed" (pre-existing).** `bin/fm-doc-audience-check.sh` reports seven unclassified skills, all from the local skills import in `a5ec819`: `before-building`, `handoff`, `next-decision`, `pi-custom-model`, `to-spec`, `to-tickets`, `wayfinder`. Identical output and exit code on clean `main`. Classifying those imported skills is separate work, out of scope for a merge. **`fm-on.test.sh` and `fm-remote-doctor.test.sh` - the remote-secondmate preflight (inherited).** Both are upstream-only suites from the remote-secondmate feature (`7809ab9`, `733a504`), absent from clean `main`, and byte-identical here to upstream's copies. Both fail identically on pure `upstream/main`: ``` tests/fm-on.test.sh -> "the remote doctor did not name the missing tools (missing: 'required tools do not resolve on the remote runtime PATH: herdr tasks-axi treehouse harness')" tests/fm-remote-doctor.test.sh -> "--fix did not create the first needed harness wrapper" ``` `fm-on`'s failure is the same environmental class as the `node` cases above: it asserts that `herdr`, `tasks-axi`, `treehouse`, and `harness` do **not** resolve on PATH, and this machine has all four installed. This home has no remote secondmates, so the feature these suites cover is unused here. **`fm-watcher-lock.test.sh` - "arm did not exit with HUP status (got 124)" (load flake, not a defect).** `124` is the test's own `wait_for_exit` timeout sentinel, not a process exit code: the armed watcher did not shut down within the ~8s the case allows, on a machine that was running the full 139-suite sweep concurrently with several standalone baseline runs. The case is provably untouched by this merge. `test_arm_hup_cleans_child_and_temp_output` is **byte-identical** in local `main`, `upstream/main`, and the merged tree, and `bin/fm-watch-arm.sh` and `bin/fm-watch.sh` are **unchanged by the merge**. My conflict resolution in this file touched only `test_watch_restart_attaches_to_healthy_peer`, a different case. Re-run twice on an idle machine, the suite is green both times: `EXIT=0`, 30/30 assertions, 0 failures. ### One opt-in suite that could not run, on either side `tests/fm-omp-worker-tmux-live-e2e.test.sh` (opt-in, `FM_OMP_TMUX_LIVE_E2E=1`) refuses before it starts: `ship spawns require --mode <no-mistakes|direct-PR|local-only>`. The file is **byte-identical to clean `main`** and passes no `--mode`, so `ab89395` carried the per-task delivery contract into the other OMP spawn cases but missed this one. It fails the same way on clean `main`, so it is pre-existing and unrelated to this merge; fixing it is out of scope here and worth its own change. Patched locally in a throwaway clone just to see past that gate, it then stops at `OMP initial instruction was not acknowledged by a turn_start event`, which needs live model credentials this environment does not have. That is why R3 was validated with the real-Bun lab described above rather than through this suite. ## Scope Merge resolution only. The two live defects upstream does **not** fix - the away-mode injection wedge and the missing Forgejo support in the PR merge poll - are tracked separately and deliberately untouched here. The stale `dnth` remote is left alone. --- ## Independent verification by firstmate The full suite was re-run against this branch with `FM_HOME` correctly scoped to the tree under test: **2290 passing, 9 failing**. Every failure was chased to ground rather than waved off, and **none is merge-induced**: | suite | verdict | |---|---| | `fm-turnend-guard` | concurrency flake — **0 failures** run alone, on both trees | | `fm-watcher-lock` | concurrency flake — **0 failures** run alone, on both trees | | `fm-bootstrap` | expects `node` absent; this machine has `/usr/bin/node` | | `fm-session-start` | same `MISSING`-tool cause | | `fm-on` | new upstream test; fails identically on **pure `upstream/main`** | | `fm-remote-doctor` | new upstream test; fails identically on **pure `upstream/main`** | | `fm-backend-herdr-presentation-e2e` | fails identically on **pure `upstream/main`** — sessions run inside a real herdr | | `fm-calm-pi-extension` | fails identically on clean `main` — pre-existing | | `fm-documentation-audiences` | fails identically on clean `main` — pre-existing | Two notes on method, because both nearly produced a wrong answer: - `fm-on` and `fm-remote-doctor` **do not exist on `main`**, so a naive main-versus-branch comparison reported "0 failures on main" and looked like a regression. The meaningful counterfactual was pure `upstream/main`, where they fail the same way. - An earlier run of `fm-arm-pretool-check` case A13 failed only because `FM_HOME` was left pointing at the primary checkout while testing a worktree. Repeating it three times made a harness error look deterministic. It passes with `FM_HOME` scoped correctly or unset.
john added 42 commits 2026-08-07 18:23:00 +00:00 
* Add generic remote secondmate transport

* Add routed remote secondmate replies

* Add remote outbox backlog handoff

* Integrate remote secondmate lifecycle

* no-mistakes(review): Fix remote snapshot and handoff races

* no-mistakes(review): Serialize remote home provisioning transactions

* no-mistakes(review): Harden remote lifecycle transaction boundaries

* no-mistakes(review): Serialize remote lifecycle mutations and fail closed

* no-mistakes(review): Close remote lifecycle and file race windows

* no-mistakes(review): Serialize remote reply retirement and inheritance

* no-mistakes(review): Harden remote transfer integrity and recovery

* no-mistakes(review): Serialize remote respawn with registry retirement

* no-mistakes(document): Document remote bootstrap convergence accurately

* no-mistakes(document): Clarify skipped remote secondmate mutations

* no-mistakes(lint): Resolve remote script ShellCheck warnings

* no-mistakes: apply CI fixes
* feat(spawn): propagate a native W3C traceparent to spawned agents

Add a default-off capability that resolves one W3C traceparent for a task,
injects it into the agent's pane shell as the TRACEPARENT environment
variable immediately before launch, and records the identical value as
traceparent= in state/<id>.meta, so an external observer that explicitly
reads that env value or meta field can correlate a worker, a Secondmate, and
their nested children into one trace with no collector, storage, UI, or
vendor coupling.

TRACEPARENT as an environment variable is a firstmate convention carrying a
W3C-formatted value: W3C Trace Context standardizes the header, not an env
var, and OpenTelemetry SDKs do not read it automatically, so a downstream
must consume it deliberately; this feature parents no SDK span by itself.

Identity is per task, not per spawn: the carrier is minted with random ids on
the first spawn, adopted as a child (fresh span, same trace) for a nested
spawn whose parent already holds one, and reused verbatim from the meta on
relaunch, so a task keeps one stable logical identity across restarts. A
malformed or all-zero inherited value is treated as absent and roots a fresh
trace. A new root is sampled (01) - a sampling decision a downstream
parent-based sampler honors, not a guarantee that any collector stores a
span, and firstmate emits no spans; a child preserves the inherited flag.

Trust boundary: a firstmate-minted root is random and reads no prompt, path,
task prose, credential, or arbitrary environment key. An inherited
TRACEPARENT is opaque caller-controlled data - up to 24 bytes of id passed
through after syntax validation - so whoever set it controls those bytes, a
bounded fixed-width channel rather than a general content or secret channel.
The feature adds no OTEL_* variable, no tracestate, and no arbitrary
environment injection; it runs no configurable or arbitrary command, only the
fixed local od and tr (resolved from PATH) to read a few bytes of entropy - a
small local pipeline with no network or watchdog and no hard latency
guarantee. Any entropy or validation failure that returns omits the carrier
without aborting the spawn. A default-off spawn leaves the generated meta and
launch environment unchanged.

Enablement is default-off (config/trace-context, or FM_TRACE_CONTEXT where a
non-empty value overrides and unset or empty defers to the file) and is
propagated into secondmate homes, taking effect at each agent's next launch:
a Secondmate launched or relaunched after enablement carries the primary
trace into its nested workers, while an already-running Secondmate roots new
traces for its own workers until relaunched. Injection reuses the existing
GOTMPDIR channel, so all spawn backends and harnesses and the ship, scout,
and secondmate paths are covered.

Covered by a pure-library suite and a spawn-path integration test (fake tmux
plus a real worktree, hermetic against ambient FM_TRACE_CONTEXT) proving the
recorded and injected carriers are identical and sent before launch, that
default-off writes and injects neither, that a relaunch reuses the recorded
carrier, and that an explicit FM_TRACE_CONTEXT overrides the file both ways;
plus a source-owner inheritance test proving trace-context propagates and
absence-mirrors through propagate_inheritable_config.

Documentation follows the repository documentation-audiences contract:
docs/trace-context.md is maintainer-architecture rationale, the configuration
schema lives in docs/configuration.md, and the repeatable test evidence is
separated into docs/verification/trace-context.md (maintainer-verification),
registered in docs/documentation-audiences.json.

* fix(spawn): propagate the effective trace-context decision to secondmates

FM_TRACE_CONTEXT overrode trace context only in the process that read it. A
newly launched secondmate decided enablement from the inherited
config/trace-context file alone, so the override did not cross the
primary-to-secondmate boundary: FM_TRACE_CONTEXT=off with the file present left
the secondmate's nested workers traced (a broken kill switch), and
FM_TRACE_CONTEXT=on with the file absent left them untraced despite the
inherited carrier.

Deliver the primary's effective decision to a newly launched secondmate as a
normalized on/off FM_TRACE_CONTEXT in the launch prefix, so a FM_TRACE_CONTEXT
override governs the nested primary -> secondmate -> worker chain both ways, not
just the copied file. The value is bounded to the literal on/off and does not
broaden environment injection; the already-running secondmate boundary is
unchanged.

Add a genuine two-level spawn regression that drives fm-spawn twice with the
exact environment the primary injects into the secondmate and proves both
divergent directions end to end. Correct the documentation that implied
secondmate coverage on every backend, since orca and cmux reject secondmate
spawns, and refresh the verification evidence for the new assertion count.

* no-mistakes(review): Clarify Secondmate trace-context launch snapshots

* no-mistakes(document): Correct trace-context documentation ownership and relaunch semantics

* fix(spawn): resolve the trace-context decision once for carrier and snapshot

The effective trace-context decision was read twice per spawn: once inside
fm_trace_context_resolve for the recorded carrier, and again for the secondmate
FM_TRACE_CONTEXT launch snapshot. A config-file change between the two reads
could pair a carrier with the opposite enable state - an injected carrier with
an off snapshot, or no carrier with an on snapshot.

Freeze the effective on/off decision once, drive the carrier resolution under
that frozen FM_TRACE_CONTEXT so it cannot independently re-read the file, and
reuse the same frozen decision for the secondmate launch snapshot. Add a
spawn-path regression that drives the file-decided path and proves the recorded
carrier and the delivered snapshot always agree, and refresh the verification
evidence for the new assertion count.

* no-mistakes(review): Preserve legacy Secondmate trace boundary

* no-mistakes(document): Correct trace-context verification comparison base

* no-mistakes(review): Captain, prevent failed trace delivery metadata claims

* no-mistakes(review): Captain, align trace-context tests and verification evidence

* no-mistakes(document): Correct trace-context verification evidence

* no-mistakes(lint): Suppress intentional ShellCheck literal-dollar warnings

* no-mistakes(review): Captain: freeze trace context at session start

* no-mistakes(test): Captain: stabilize scheduler test and document Kimi trace coverage

* no-mistakes(document): Document trace-context safety boundaries

* fix(trace): fail off on stale session snapshots

Publish each home session decision atomically through a same-directory temporary file and bind it to the current session lock. A replacement failure can no longer leave an earlier on decision active in a later session; missing, stale, malformed, or unpublishable state defaults safely to off.

Add regressions for read-only replacement and failed publication, update spawn and session-start fixtures for the lock-bound format, and refresh the architecture and verification records.

* no-mistakes(review): Fix trace spawn failure independence and duplicate safety

* no-mistakes(document): Refresh trace-context documentation and verification

* no-mistakes(review): Clear partial backend input after failed trace submission

* no-mistakes(review): Stop unsafe trace delivery before launch append

* no-mistakes(document): Document unsafe trace delivery handling

* fix(trace): bound each trace to one routed task, never the routing agent

A persistent Secondmate holds its launch-time TRACEPARENT in the process
environment for its whole life, and routed requests never replace it, so
resolving new-task carriers from the ambient environment chained every
routed task into one ever-growing trace per Secondmate with distinct
parent ids. Resolve now reuses the task's recorded carrier or mints a
fresh sampled root, never reading ambient TRACEPARENT, so each routed
task is its own trace boundary while relaunch, recovery, and
scout-to-ship promotion keep one stable per-task identity.

The spawn regression models the reviewed scenario exactly: two unrelated
tasks spawned sequentially through one persistent Secondmate environment
record and inject distinct trace ids, adopt nothing from the Secondmate's
carrier, and a relaunch of the first task reuses its original carrier
verbatim.

* docs(trace): define the per-task trace boundary

The design contract is one task per trace: a persistent Secondmate is
routing infrastructure with its own agent identity, never a shared trace
root for the unrelated tasks routed through it. Root/recovery semantics
replace the removed child-inheritance path, the sampling and safety
sections drop inherited-carrier language because ambient TRACEPARENT is
never read, and the verification page records the refreshed suite
inventories including the two-task Secondmate boundary regression.

* test(trace): adopt the explicit per-task delivery contract in spawn fixtures

Rebasing onto current main brings the explicit per-task delivery contract:
ship spawns now require --mode and --yolo instead of resolving them from the
project registry. The trace spawn fixtures pass the same explicit contract
canonical spawn tests use, preserving the per-task trace boundary coverage
unchanged, and the verification page records the refreshed comparison base.
* fix(bin): classify tmux agent liveness independent of process titles

`fm_backend_tmux_agent_state` attributed a pane solely from
`#{pane_current_command}`, which is a process TITLE a harness can rewrite,
not a structural fact. Claude Code 2.1.220 reports its version string there,
so a live Claude endpoint classified `ambiguous`: the session-start secondmate
liveness sweep could no longer see it, and any consumer that gates on a
positive classification refuses outright.

Read a second, independent name source: the kernel `comm` of every process in
the pane tty's foreground process group. Either source naming a verified
harness yields `alive`, because a false `dead` is the one verdict that can
start a duplicate agent on a live worktree. Scoping to the foreground process
group rather than the pane's descendants keeps a harness-named background
process from faking an agent, and covers multi-process launchers (the Pi
Launcher path) without a special case.

Verified on 2026-08-03 against all seven adapters running for real on tmux
3.6a / macOS 26.5.2 arm64: claude 2.1.220, codex-cli 0.146.0, opencode
1.18.11, pi 0.82.0, pi-signed 0.82.0, grok 0.2.118, kimi 0.31.1 all classify
`alive`, each attributed by a source independent of its title.

Two tests, because they fail for different reasons:
- tests/fm-tmux-agent-liveness.test.sh pins the logic with real processes and
  no harness, so it runs everywhere CI runs tmux. It drives the two name
  sources apart on purpose and asserts the divergence, so no case can go
  quietly vacuous.
- tests/fm-harness-liveness-drift-live-e2e.test.sh relaunches every installed
  harness and fails naming the harness and version when one stops being
  attributed by a title-independent source.

AGENTS.md section 4 carries the resulting standing rule, and
firstmate-coding-guidelines owns how to satisfy it.

* no-mistakes: apply CI fixes

* docs: move the harness-dependent-check policy out of AGENTS.md

The standing rule was stated in AGENTS.md section 4 with the mechanics in
firstmate-coding-guidelines, which split one contract across two owners and
charged every session for a rule that only fires when firstmate's own
harness-dependent code is being changed.

firstmate-coding-guidelines is now the single owner of both the rule and how
to satisfy it: real-harness proof required, that proof authorized to spend
tokens, structural signals preferred over vendor-rendered surfaces, and a
guard that fails loudly naming the harness and version where a surface signal
is unavoidable. No inline stub is left behind, because AGENTS.md already
carries the load trigger for that skill in sections 7 and 13, so it is read
before any change to firstmate's shared tracked material.

Also records the cross-platform lesson the pipeline caught in the portable
regression, and corrects that file's header: the divergence assertion lives
on the version-string case, which diverges on both supported platforms,
rather than on every case.

* no-mistakes(review): Harden tmux liveness identity and drift validation

* no-mistakes(document): Clarify cross-platform tmux liveness documentation
* feat(bin): trace remote secondmate routes and unify the inherit allowlist

Per-task W3C trace context (#995) resolved and injected its carrier only at
the local spawn path. A remote secondmate is routed through
spawn_remote_secondmate, which returns long before that site and wrote its own
metadata block, so a remote secondmate stayed silently untraced even with the
capability enabled.

The parent home still owns that task's identity, because it holds the metadata
an observer reads. It now resolves the carrier against the task's own meta
under its own frozen decision - reused verbatim on relaunch, freshly rooted
otherwise, never adopting the parent process's ambient TRACEPARENT - and hands
it to the configured host through a new fm-spawn --traceparent argument,
accepted only for a secondmate launch and only as a strict W3C value. The
remote host exports it at the same unconditional pre-launch site and reports
back the carrier its endpoint actually holds, which the parent records, so an
already-alive endpoint reports the identity its agent really received rather
than one the parent merely intended. Disabled remains byte-identical and off.

The remote inherit path also carried its own hardcoded copy of the inheritable
config set, already drifted from FM_INHERITABLE_CONFIG by trace-context. Both
remote ends now derive from that one declaration, so a future item cannot be
sent by one side and refused by the other, and session-scoped enablement items
are skipped on live convergence exactly as the local path skips them.

Also fixes a latent stderr leak: an absent session lock printed a raw redirect
failure, which the new remote resolve site made visible.

Adds tests/fm-remote-secondmate-trace-context.test.sh, driving the real
parent -> fm-on -> remote entrypoint -> control -> remote fm-spawn chain over
the deterministic SSH boundary and reading the carrier back from the remote
pane's own log.

* no-mistakes(document): Clarify remote trace and allowlist contracts
* feat(bin): widen the remote runtime PATH and add a remote doctor preflight

The fixed remote entrypoint hard-coded a four-directory PATH, so a remote
account whose tools live under nix or a per-user profile could not run basic
Firstmate work without a login shell. The entrypoint now composes its child
PATH from the code root's bin, the account's ~/.local/bin, the common
package-manager directories that actually exist on the host, and the portable
system tail, deduplicated and in a fixed order, still under env -i with the
same variable allowlist and no shell command string.

fm-remote-doctor.sh reports that exact PATH by inheriting it from its own
entrypoint launch rather than recomposing it, so the ordering keeps one owner.
It is read-only, reports where each required and optional tool resolved, and
exits non-zero naming every required tool that did not. Remote seeding runs it
as a preflight before anything is created on the host and restores the registry
when it fails.

* no-mistakes(review): Harden remote git authorization and missing-tool diagnostics

* no-mistakes(document): Document remote PATH doctor and safe shims

* no-mistakes(lint): Fix ShellCheck findings in remote path tests

* no-mistakes(lint): Suppress exported fixture's false-positive ShellCheck warning
* feat(bin): gate remote second mates on herdr readiness

A remote second mate now always runs on the Herdr backend, whose server
belongs to the host's GUI login session and therefore outlives the SSH
connections that supervise it. fm-spawn's remote route forces that backend
and the host-local control script refuses any other, so the requirement
cannot be dropped from either side.

fm-remote-doctor.sh becomes the single owner of what "ready" means. It keeps
its PATH and tool reporting from #1623 and adds the Herdr, Aqua LaunchAgent,
GUI-session, server-reachability, and entrypoint-symlink checks, tagging each
gap fixable: or human: with the exact operator step. --fix closes only the
automatable gaps - writing and loading the Aqua-scoped dev.firstmate.herdr
launch agent, starting the server where no launch agent applies, and
recreating the entrypoint symlink - then re-derives every check from the host,
so a human gap is never presented as fixed. It never creates a login session,
writes an auto-login password, or touches FileVault.

Remote seed, remote spawn, and the startup liveness relaunch all run the same
check, repair, re-check sequence through one shared library and fail closed
with the doctor's own gap text. Recovery inherits the gate because it respawns
through the same route.

Tests drive the real doctor against a controlled account fixture with a
private HOME, a state-backed launchctl, and a fake herdr, and prove the
dangerous actions are never attempted. The remote lifecycle suites gain a
stateful Herdr CLI fixture and answer the readiness gate at the SSH boundary,
so they never inspect or repair the runner's own account.

* no-mistakes(review): Validate launch-agent contract and confirm Herdr startup

* no-mistakes(review): Validate loaded launch-agent contract before readiness

* no-mistakes(review): Refuse legacy remote backends without altering routes

* no-mistakes(review): Clarify conditional remote readiness repair sequence

* no-mistakes(review): Repair remote readiness before liveness probing

* no-mistakes(review): Preserve unknown seeds and reject legacy liveness

* no-mistakes(document): docs: clarify remote Herdr backend ownership
* Pin remote secondmates to fm-remote

* no-mistakes(review): Fail closed on legacy remote Herdr endpoints

* no-mistakes(review): Isolate fm-remote launch agent from interactive default

* no-mistakes(document): Document shared remote Herdr retirement safety
* feat: run remote commands through Aqua job worker

* no-mistakes(review): Enforce remote job deadlines and safe worker shutdown

* no-mistakes(review): Refresh stale workers and harden dependency-free supervision

* no-mistakes(review): Harden worker ownership recovery and shutdown quarantine

* no-mistakes(review): Fix doctor bootstrap, harness repair, and output draining

* no-mistakes(review): Probe doctor tools through authenticated worker bootstrap

* no-mistakes(review): Refresh stale workers before doctor tool probes

* no-mistakes(review): Recover stopped quarantines and extend job deadlines

* no-mistakes(review): Separate queue and execution timeout windows

* no-mistakes(review): Supervise Linux worker crashes and bind root identity

* no-mistakes(review): Resolve authorized Nix profile bin links

* no-mistakes(review): Clarify Nix path resolution documentation

* no-mistakes(review): Harden PATH safety and nvm selection

* no-mistakes(review): Honor nvm system defaults and refresh doctor digest

* no-mistakes(review): Keep workers ready during active jobs

* no-mistakes(review): Bound pre-execution validation by job timeout

* no-mistakes(document): Clarify remote worker documentation

* no-mistakes(lint): Fix remote worker ShellCheck diagnostics

* no-mistakes: apply CI fixes

* no-mistakes: apply CI fixes

* no-mistakes: apply CI fixes
* fix(remote): arm SSH dead-peer detection in fm-on.sh

A vanished remote host mid-poll (a reboot, a dropped link) left ssh
blocked indefinitely on a half-open TCP connection, because fm-on.sh's
ssh invocation had no ServerAliveInterval/ServerAliveCountMax. This
wedged the remote-reply ferry: fm-procevent.sh's runner blocked inside
the ssh child and never reached its own no-result -> claim-release ->
reconcile re-arm self-healing path, which otherwise already handles a
nonzero exit with empty output correctly. Recovery required a manual
retire and re-arm.

Arm ServerAliveInterval=15 and ServerAliveCountMax=3 by default
(bounded ~45s detection window), both overridable via
FM_SSH_ALIVE_INTERVAL and FM_SSH_ALIVE_COUNT_MAX. This is a transport-
level fix in fm-on.sh, so it covers every remote command routed
through it, not just the reply ferry. The remote sshd answers
keepalive probes independently of whatever the remote command is
doing, so a legitimately long-but-alive command (a 55s poll, a clone,
the doctor) is never falsely killed - only a truly vanished peer trips
it, turning that case into a bounded, detectable ssh failure (exit
255) instead of an indefinite hang.

Extends tests/fm-on.test.sh with a behavioral regression asserting a
bounded, positive ServerAliveInterval/ServerAliveCountMax on the real
ssh argv captured through the FM_SSH_BIN process seam, plus coverage
that both are env-overridable.

* no-mistakes(document): Document SSH dead-peer detection ownership
* feat(bootstrap): gate stale axi CLIs at the floors firstmate actually uses

Add gh-axi 0.1.29 floor so bare --squash PR merges stop failing quietly on
older builds. Raise tasks-axi to FM_TASKS_AXI_MIN=0.2.2 (multi-id mv) while
keeping feature probes. Keep quota-axi at 0.1.16 after verifying schema 3
and per-model availability already ship there; runway remains optional.

* no-mistakes(document): Clarify AXI compatibility documentation ownership
* fix(guard): stop false watcher-down alarm mid-turn under Claude auto-arm

bin/fm-guard.sh derived its watcher-health verdict from fm_watcher_healthy,
which requires a live watcher process holding the home lock. Under the Claude
Stop-hook auto-arm supervision model the watcher is armed at each turn end and
exits on its wake, so it runs only between turns. Every guarded command run
mid-turn therefore found no live watcher and printed the "WATCHER DOWN -
SUPERVISION IS OFF" banner even though supervision was healthy. Because the
episode key was derived from the beacon mtime (which the between-turns watcher
advances every poll), the full banner re-printed on essentially every command,
and the message always blamed a "fresh beacon" that was in fact fresh.

Make the pull guard's health check model-aware via a new
fm_watcher_supervision_verdict in bin/fm-wake-lib.sh:

- Under the auto-arm model a beacon fresh within FM_GUARD_GRACE is healthy even
  with no live watcher process; only a beacon stale beyond grace (or absent) is
  a genuine lapse and alarms.
- Under every persistent-watcher harness (codex foreground checkpoint,
  opencode/pi/grok background arm, tmux, unknown) a live identity-matched
  watcher with a fresh beacon is still required, unchanged.

The banner now names the true failing condition, a missing live watcher process
versus a genuinely stale beacon, instead of always blaming the beacon, and the
once-per-episode dedup keys on that condition rather than the beacon mtime so a
genuine lapse announces once and does not re-print each turn.

The turn-end guard keeps the strict fm_watcher_healthy check because it fires at
the turn boundary, where the auto-arm brings a fresh watcher up and it
cooperates with that arm. fm_watcher_healthy itself is unchanged, so the arm
layer's start/attach/replace decisions are unaffected.

Tests in tests/fm-guard-stale-banner.test.sh cover the auto-arm healthy
fresh-beacon-without-a-watcher case, the auto-arm stale-beacon alarm and its
stable episode, the true-reason banner wording, and the reason-keyed episode
surviving a beacon mtime change; existing persistent-model cases are pinned to
that model.

* no-mistakes(review): Pin secondmate supervision model to launched harness

* no-mistakes(document): Align watcher documentation with model-aware supervision health
* fix(tests): stop fixture-tempdir helper from self-deleting under command substitution

fm_test_tmproot is almost always called as `TMP_ROOT=$(fm_test_tmproot prefix)`,
which forks a subshell to capture its stdout. The old implementation set its
EXIT cleanup trap inside that call, so the trap fired - and deleted the fixture
root - the instant the subshell exited, before the real caller's own EXIT trap
was ever installed. Every test using the documented call pattern leaked its
fixture root on every run; two suites had already independently discovered and
worked around this with ad-hoc mktemp calls.

Registration now goes through a $$-keyed registry file instead of in-process
state, since $$ resolves to the invoking shell's PID even inside the
subshell. The real cleanup trap is armed once at source time (always the real
caller, never a subshell) for EXIT, INT, and TERM. A best-effort orphan sweep
on next source reaps marked fixture roots old enough to be from a killed prior
run.

Simplifies the two existing ad-hoc workarounds (fm-procevent.test.sh,
wake-helpers.sh) back onto the shared helper now that it works correctly.

* no-mistakes(review): Preserve live fixtures during orphan reaping

* no-mistakes(review): Harden fixture ownership against PID reuse

* no-mistakes(review): Secure cleanup registry against path precreation

* no-mistakes(review): Make fixture registration transactional

* no-mistakes(document): Documentation already matches fixture cleanup behavior

* no-mistakes: apply CI fixes

* no-mistakes: apply CI fixes
* feat(herdr): default presentation spaces on with an explicit opt-out

Herdr's disposable one-task presentation workspace was opt-in through the
presence of local config/herdr-presentation-spaces. It is now on by default,
and a home opts out by writing "off" into that same file.

Values are read with the whole-file whitespace-stripped convention the other
scalar config items already use, plus case folding. An absent file, an empty
file, and "on" all resolve on; only "off" opts out; an unrecognized value warns
and keeps the default rather than failing a spawn over a purely visual setting.
The empty file is exactly the historical opt-in form, so every home that had
already enabled the projection stays enabled with no migration step, and no
previously enabled home can be turned off by the flip.

Because absence now means on at both ends, secondmate inheritance needs no
item-specific convergence: mirroring an absent primary file converges a
secondmate to the same default-on rather than turning its projection off, and
only an explicit primary opt-out propagates the opt-out.

The gate itself moves into fm_backend_herdr_presentation_enabled in the Herdr
adapter so the semantics have one owner that regressions can exercise directly.

* no-mistakes(document): Document Herdr default-on presentation safety

---------

Co-authored-by: kunchenguid <kun-1@kunchenguid.com>
* fix: surface consolidated open decisions on every wake-drain

A needs-decision or blocked event buried under later, unrelated status
appends was only ever shown via the last-line wake annotation, so a
still-open captain decision could go silently missed even though
status_open_decisions (fm-classify-lib.sh) already folds the whole
status stream correctly and fleet-snapshot/bearings already reuse it.

Wire that same fold into bin/fm-wake-drain.sh: a new fleet-wide
scan_open_decisions wrapper scans every state/<id>.status, and
fm-wake-drain.sh prints a separate, bounded OPEN DECISIONS section on
every drain (including the empty-queue fast path), so session-start
and every wake-handling turn surface it for free without duplicating
the open/resolved fold itself. Heartbeat wakes drain through the same
script, so this covers that surface too.

Also tighten status_open_decisions' file guard to skip an unreadable
status file instead of leaking a bash redirection error, now that a
fleet-wide directory scan can reach files a single targeted read
would not.

* no-mistakes(review): Prevent status symlinks leaking open decisions

* fix: drop unbounded perl subprocess from status symlink guard

The review step's own symlink-safety auto-fix (O_NOFOLLOW read via a
perl subprocess) forked one perl process per status file scanned by
the new fleet-wide open-decisions scan, with no cap - inflating
fm-wake-drain.sh's total external-read cost from 8 (the existing
annotation read_cap) to 18 in the enrichment-caps regression test.

The plain [ -L "$f" ] check already rejects any status file that is
itself a symlink before any read happens, which is exactly what the
new regression test exercises and is the same defense level the
sibling scan_captain_relevant_statuses/last_status_line already rely
on elsewhere in this file (no O_NOFOLLOW). Drop the subprocess-based
nofollow read and keep the cheap builtin guard.

* no-mistakes(document): Document actionable fleet-wide open decision drains
* fix(bin): abort orphaned no-mistakes runs and reap leaked processes at teardown

Teardown could remove a task's worker while its no-mistakes pipeline run was
still parked at a gate, leaving an orphaned run holding a fleet slot
indefinitely (observed 2026-08-03: runs parked 7h39m and parked at a
post-CI approval gate). It could also leave backgrounded/disowned
descendant processes rooted under the worktree or tasktmp surviving
reparented to init (observed: two `go test` binaries pinning CPU for
hours with no live task meta to attribute them to).

Add two coupled pre-teardown steps, both scoped to this task's exact
branch/head or worktree/tasktmp so they can never touch another task's
run or processes:
- conclude_task_no_mistakes_run aborts a run parked at a gate via
  `no-mistakes axi abort`, cd'd into the exact worktree so the daemon
  resolves the run itself rather than teardown naming a --run id.
- reap_task_worktree_processes sweeps for processes whose cwd is under
  the worktree or tasktmp (via `lsof -a -d cwd`) and TERM/KILLs them.

Both run before any worktree return, branch delete, or backend kill,
and are idempotent on a retried teardown. The branch+head attribution
logic is factored out of bin/fm-crew-state.sh into the new shared
bin/fm-nm-run-lib.sh so both scripts use the same ownership contract.

* no-mistakes(review): Fail closed on incomplete teardown cleanup

* no-mistakes(review): Bind teardown cleanup to verified run and process identities

* no-mistakes(review): Require confirmed aborts and convergent identity-safe process reaping

* no-mistakes(review): Handle process exits during teardown identity checks

* no-mistakes(review): Restore teardown library in hermetic gotmp fixtures

* no-mistakes(document): Document teardown run attribution and timeout

* no-mistakes(lint): Rename shell variable conflicting with done keyword

* no-mistakes: apply CI fixes
The script installs as a symlink under ~/.local/bin. Taking dirname of
the symlink itself (instead of its real target) pointed SCRIPT_DIR at
~/.local/bin, breaking sourcing of the sibling fm-remote-job-lib.sh.
Resolve the real path first, preferring python3's os.path.realpath,
then realpath, falling back to the raw BASH_SOURCE on hosts with
neither.
* fix(pi): stop Calm claiming a built-in tool name another extension owns

fm-calm.ts claimed bash/read/edit/write/grep/find/ls unconditionally at
extension load, regardless of whether Calm was on. Pi resolves two
extensions registering the same built-in name by first-registered-wins
with no merge and no unregister call, and Calm's project-local
.pi/extensions/ position beats any global or CLI-configured extension,
so a user who never even enabled Calm could have their own bash/read/etc
override silently replaced.

Captain-approved plan implemented:

- Registration is now gated on config/calm already being "on" at load
  time. A Calm-off session or reload registers nothing, so a non-Calm
  user never contests a name. This stays synchronous during the
  factory's own load, not deferred to session_start: /reload (and
  ctx.newSession/fork/switchSession) render the restored transcript from
  a pre-session_start snapshot of the tool registry, so a deferred claim
  would miss that render - confirmed by tests/fm-calm-pi-extension
  .test.sh's hidden-block-geometry E2E when trialed.
- The first time Calm turns on in a session that started off
  (activateBuiltInsIfNeeded, from the /calm command handler), Calm calls
  pi.getAllTools() - safe only once every extension has finished loading,
  unlike the load-time path above - to see whether a different extension
  already owns a name, and skips claiming only that one, leaving it and
  its owning extension fully intact and callable.
- A contested name found this way prints a prominent ctx.ui.notify()
  warning naming the tool, plus a console diagnostic.
- reportBuiltInLosses() remains the backstop for the one case neither of
  the above can reach: a session that starts or reloads with Calm already
  on, where the registry snapshot is taken before Calm gets any chance to
  check ownership. A symlink-safe realpath comparison avoids misreporting
  Calm's own registration as foreign when its path crosses a symlink
  (macOS /tmp, /var).

Confirmed, bounded trade-off: the very first time a session that started
Calm-off turns Calm on, tool-call rows already on screen from before that
toggle do not retroactively collapse, because Pi never lets an extension
re-point an already-rendered row at a definition registered later. Every
session after that first toggle starts with the preference already on and
takes the synchronous load-time path, so the guarantee is intact from
then on. docs/calm.md and the file's own header document this in full.

tests/fm-calm-pi-extension.test.sh gains test_builtin_gate_load_time
(config/calm off registers nothing, on registers all 7 synchronously at
load) and test_calm_activation_collision_and_regression_bound (first
activation claims every uncontested built-in, leaves a foreign bash tool
fully intact and callable, warns and logs the contested name, and locks
in the documented pre-activation bound against real ToolExecutionComponent
rendering). test_rendering_and_session_lifecycle and the live interactive
E2E are updated for the new gate-at-load and first-activation-bound
contract.

* no-mistakes(document): Document Calm tool collision boundaries

* no-mistakes: apply CI fixes
* fix(bin): give secondmate homes a durable parent binding record

Finished-worker cleanup on a remote second mate refused forever with
"cannot resolve the primary home ... durable parent binding". The
remote launch hands the child the remote code checkout as its parent
home (fm-spawn.sh's sole writer of FM_PUBLIC_FOLLOWUP_PRIMARY_HOME
receives FM_HOME=$FM_ROOT from fm-remote-secondmate-control.sh's
host-local launch), and that path can never carry the parent's real
records, so the guard refused unconditionally once relay looked active
anywhere on that host.

fm-home-seed.sh and fm-remote-home-provision.sh now write a durable
.fm-secondmate-parent record next to the .fm-secondmate-home identity
marker, naming the home's route to its parent as local (with the real
parent path) or remote (with the parent's SSH alias for diagnostics
only). fm-teardown.sh's cleanup gate reads it: a remote parent is out
of scope for the delegated-promise check (the whole promised-public-
reply subsystem is same-filesystem by construction, so a remote parent
can never hold one), while a token committed directly to the child's
own .env file - never the process environment - still refuses, so an
unrelated export in the remote host's login shell can no longer mask
in. For a local secondmate, the durable parent_home now also backs up
the launch-time env var, closing a silent fail-open where a restart
that dropped the launch prefix made the guard treat a genuinely active
parent relay as off.

Regression coverage drives the real remote route (SSH boundary + Herdr
fixture) and real fm-home-seed.sh seeding rather than hand-crafted
markers.

* no-mistakes(review): Captain: fail closed on unsafe durable parent records

* no-mistakes(review): Captain: enforce durable parent binding commit protocol

* no-mistakes(review): Captain: publish local parent binding before identity

* no-mistakes(review): Captain: refuse conflicting local parent bindings

* no-mistakes(review): Captain: reject non-regular secondmate seed leaves

* no-mistakes(review): Captain: enforce unique durable parent bindings

* no-mistakes(review): Captain: reject route-incompatible durable parent fields

* no-mistakes(document): Document durable secondmate parent bindings

* no-mistakes(lint): Fix secondmate parent parser ShellCheck warnings

* no-mistakes: apply CI fixes
* feat(bin): gate lavish-axi at its session_ended floor in bootstrap

bin/fm-procevent-lavish.sh decides that a human "Send & End" review is
terminal by reading session_ended from the poll response's leading session
block. That field first shipped in lavish-axi 0.1.35, so an older installed
build silently leaves every ended review source armed forever and captures
an empty ended result on each later cycle. The same release is what makes a
plain reopen refuse a session the human deliberately ended.

Add LAVISH_AXI_MIN=0.1.35 to the existing axi-family floor structure in
bin/fm-bootstrap.sh, reusing tool_version_at_least and the same MISSING
diagnostic gh-axi already emits, so an incompatible build is reported as an
upgrade request before any review surface is armed. Later lavish-axi
releases only add artifact-authoring surface the adapter never reads, so
the floor is the feature-introduction point rather than latest.

Fixtures that stubbed lavish-axi as a bare exit-0 tool would now be read as
unparseable builds, so tests/lib.sh gains fm_fake_version_tool and every
bootstrap-running suite uses it for lavish-axi.

* no-mistakes(review): Clarify lavish-axi version floor rationale

* no-mistakes: apply CI fixes

* feat(bin): set axi-family floors to current latest under the bump policy

The axi-family bootstrap floors are the CURRENT LATEST published version of
each tool, captain-bumped periodically to move the whole fleet onto the
newest axi tools. They are not the minimum feature-introduced version. The
earlier lavish-axi work set a feature-minimum floor, which is the opposite
of this policy, so replace it along with the older feature-minimum rationale
carried by tasks-axi and quota-axi.

State the policy explicitly in bin/fm-bootstrap.sh's header, which owns it,
and in each per-tool floor owner, so no future change argues a floor back
down to the earliest release that happens to satisfy some behavior. Remove
the lavish-axi session_ended and upstream-PR citation, the tasks-axi
multi-ID-mv minimum argument, and the quota-axi credential-source argument
as floor rationale; the tasks-axi feature probes remain as a separate
defense-in-depth concern.

Floors: lavish-axi 0.1.45 (was 0.1.35), tasks-axi 0.2.4 (was 0.2.2),
quota-axi 0.1.17 (was 0.1.16), gh-axi 0.1.29 unchanged and already latest.
Each was verified against the tool's current published version.

The mechanism is unchanged: the same shared version helper and the same
MISSING diagnostic path. The below-fires and at-or-above-silent regression
rows move to the new floors, keeping each boundary genuine by pinning the
patch immediately below each floor rather than a version that was only
below the old one. Fleet fixtures move to the new floors so a bootstrap-
running suite is not reported as an out-of-date build.

Three operator-facing backlog handoff and receipt errors named "0.2.2+"
while the enforced floor moved, so they now point at the floor's owner
instead of duplicating a version number that drifts.

* no-mistakes(review): Centralize AXI floor policy beside constants

* no-mistakes(review): Clarify bootstrap boundary test comment

* no-mistakes(document): Centralize AXI floor policy rationale
* fix(bin): bound OPEN DECISIONS scan cost with a per-status-file cursor

The fleet-wide OPEN DECISIONS scan added in #1711 re-reads and refolds
every task's entire lifetime status log on every drain, so its cost
grows unbounded with total log size. Add status_open_decisions_incremental
and scan_open_decisions_incremental to fm-classify-lib.sh: they persist a
per-status-file byte cursor plus the folded open-decision set, and fold
only newly appended bytes on each call, reusing status_open_decisions'
exact fold-line rule (extracted into _fm_decision_fold_line) so the two
strategies can never disagree on what is open. A missing or invalidated
cursor (new task, truncated/rewritten/shrunk log) falls back to a full
re-fold. bin/fm-wake-drain.sh now calls the incremental wrapper instead
of the whole-file scan.

* fix(bin): add O(1) rotation detection and read-failure guarding to the cursor fold

Add the two pieces the incremental open-decisions cursor was missing,
scoped to this repo's actual status-file usage (create-once, append-only,
never replaced or rewritten in place):

- An O(1) device+inode identity check (one stat call) alongside the
  existing size-shrink check, so a status file replaced/rotated/recreated
  at the same path is detected and falls back to a full re-fold, even
  when the replacement is the same size. A same-inode, same-size,
  in-place byte edit is a deliberately accepted gap: no code path in
  this repo ever does that to a status file.
- Checked reads: a stat/wc/tail failure is a genuine I/O error, not
  "the file is empty" - it now reports the already-trusted persisted
  open set unchanged instead of risking a silent invalidation.

Both stay O(1) plus new bytes per call, matching the cursor's bounded-
cost design; no content hashing or pending-fragment machinery.

* no-mistakes(review): Preserve cursor state across failed incremental reads

* no-mistakes(review): Refold status when cursor cache reads fail

* no-mistakes(document): Document cursor-backed open-decision scanning

* no-mistakes: apply CI fixes
* fix(bin): preempt remote reply long-polls for queued short jobs

Session start on a home with live remote second mates could stall silently
for many minutes: the single serial remote job worker ran each armed
fm-remote-delta-read.sh reply poll to its full 55s window while bootstrap's
short sync, inherit, state, and route commands sat queued behind it, and
non-FIFO queue pickup let re-armed polls keep winning the lane. Measured
end to end, a trivial short job took 31s behind one 30s poll window.

The worker now preempts a running preemptible job (the read-only, cursor-
anchored delta read is the only member of that class) as soon as a
non-preemptible job is queued, publishing exit 75 with emptied output -
byte-identical to the poll's own elapsed-window-with-no-data result - so
the parent runner takes its existing no-result path and the watcher re-arms
from the same cursor with nothing lost. The delta read translates SIGTERM
into that same exit after removing its staging directory. Sibling polls
never preempt each other, so two armed monitors cannot churn. The same
measured scenario now completes in 1s.

* no-mistakes(document): Clarify remote poll preemption documentation
Discord mentions already ride the same pairing-token opt-in, relay poll,
and platform-aware reply path as X mentions, but the docs still read as
X-only, so a stranger could not self-serve the Discord path.

Add the numbered turn-on steps to the X mode configuration reference,
pointing at the myfirstmate dashboard for account creation, bot install,
and token issuance rather than duplicating operator setup here, and drop
the X-only framing from the README bullet, the documentation index, and
the architecture overview.
* feat(bin): run session start deterministically on hook-capable harnesses

Session start relied on a native nudge that only asked the agent to run
bin/fm-session-start.sh, and an agent can defer that. Observed 2026-08-01:
an /ahoy-first session followed the recap path and did not take the helm
until a later request forced it.

Claude, Codex, and Pi now RUN the digest in their session-open hook through
the new bin/fm-sessionstart-run.sh, so the full ordered digest is in model
context before the first turn. That wrapper is the single owner of what a
session-open source means: startup and Pi's "new" take the helm, clear and
compact re-emit, resume/reload/fork delegate to the nudge, and an unreadable
source takes the helm because doing that redundantly is idempotent while
skipping it is the bug. Grok and OpenCode keep the nudge as the floor, since
neither can carry hook stdout into a model turn.

Because the hook now blocks session initialization, fm-session-start.sh
bounds itself first. Its steps are not all individually bounded - bootstrap's
gh auth probe, tool version probes, the backlog listing and per-task endpoint
reads are unbounded - so the whole digest runs as one bounded child (default
120s). Whatever it emitted before the bound survives, and the parent adds a
loud STARTUP TRUNCATED banner naming the stage that stalled and every stage
that never ran, still exiting 0.

--reemit skips only the sweeps startup already reconciled. It still re-verifies
lock ownership and still drains queued wakes, which arrived after startup and
are the turn's work. fm-bootstrap.sh gains FM_BOOTSTRAP_LOCKED so a re-emit
keeps repair ownership instead of deferring to a lock holder that is itself.

Also adds bin/fm-timeout-lib.sh as the single owner of bounded execution,
replacing three near-identical copies, and gives the ahoy skill a helm check
so a nudge-tier harness cannot recap before taking the helm.

Verified live on 2026-08-05 against Claude 2.1.222, Codex 0.146.0, and Pi
0.82.0; docs/verification/supervision.md records the per-harness source
vocabulary, the two named gaps, and the refresh command.

* no-mistakes(review): Harden session-start completion, timeout, and Pi delivery

* no-mistakes(review): Harden completion ownership and portable timeout escalation

* no-mistakes(review): Normalize watchdog KILL exits without masking command status

* no-mistakes(review): Guarantee startup bounds and align harness delivery tiers

* no-mistakes(test): Fix Pi session-start live verification fixture

* no-mistakes(document): Align session-start documentation with deterministic hooks

* no-mistakes(lint): Silence intentional child-shell expansion lint warning

* no-mistakes: apply CI fixes

* no-mistakes: apply CI fixes
* docs: rename the user-facing product name to Relay

The public-mention integration gated by the `.env` pairing token is now
called Relay across user-facing prose, covering X and Discord alike
instead of implying a single network.

Renames the product-name strings only: README, docs, the captain-facing
skill descriptions, and the AGENTS.md operating prose, including the
`X mode (.env)` and `Optional X mode` headings and every link anchor
that pointed at them. AGENTS.md section 14 carries a one-line bridge
note so the older name and the unchanged identifier spellings stay
discoverable.

Internal identifiers are untouched: `FMX_*`, `config/x-mode.env`,
`state/x-*`, `bin/fm-x-*`, the `fmx-respond` skill path,
`__FM_X_MODE_ENV__`, and `x-mode-error`. Platform references to X and
Discord as networks stay as they are, and the bootstrap-diagnostics
entry still quotes bootstrap's emitted `FMX: X mode on/off` line
verbatim because `bin/` output is out of scope for this pass.

* no-mistakes(review): Complete Relay prose rename in maintained docs

* no-mistakes: apply CI fixes
* feat(harness): add a verified muse crewmate adapter

Muse Code joins the fleet as a crewmate/scout adapter, verified live against
Muse Code 0.1.0-R708.1 in an isolated lab.

Detection matches the anchored prefix muse-bin*, because the installed launcher
execs a version-suffixed binary whose name changes on every auto-update and
whose install path carries no muse component to fall back on. The same identity
is taught to the tmux liveness classifier, without which a healthy muse pane
would have read as a dead endpoint.

Busy state folds muse's own durable session event log, bound per task by a
sessions-root/worktree sidecar. It is a pull source with no writer, so nothing
is armed and no record is ever seeded. The fold is anchored on the full run
lifecycle prefix so muse's nested cleanup "terminal" payloads cannot settle an
in-flight run, and it is depth-bounded so muse's native sub-agent logs cannot be
mistaken for the parent's. The idle half stays gated: an open run proves busy,
but a settled log reads unknown until a credentialed multi-step run proves one
turn stays inside one run.

Two findings corrected the scout report. The exec-only
--no-foreign-personal-context flag is rejected by the interactive TUI, so the
privacy control that actually reaches a pane worker is
MUSE_EXPERIMENTAL_FOREIGN_PERSONAL_CONTEXT_KILL, verified to drop the operator's
foreign personal rules while keeping the project's own AGENTS.md. And an
unauthenticated muse pane never exits, it waits on a device-code prompt, so
credentials are a spawn preflight rather than a screen check.

muse is refused for secondmates: it has no primary supervision protocol and its
hook dialect rejects the reawakening handlers that protocol needs.

Per the captain's decision, auto-update is not pinned, and the credentialed
multi-step smoke is deferred with an explicit checklist in
docs/verification/muse.md.

* no-mistakes(review): Accept Muse dispatch profiles and shared efforts

* no-mistakes(review): Bind Muse busy state to current session

* no-mistakes(review): Compare Muse workspace bindings literally

* no-mistakes(review): Harden Muse worker credentials and live signal verification

* no-mistakes(review): Cache Muse session bindings and clarify worker credentials

* no-mistakes(review): Clear Muse marker inheritance and normalize interrupt aliases

* no-mistakes(review): Verify Muse glyph effective foreground color

* no-mistakes(review): Harden Muse XDG paths, session cache, and glyph parsing

* no-mistakes(document): Document Muse adapter boundaries
* fix(herdr): floor default-on presentation spaces at Herdr 0.8.0

Default-on presentation projection turns every crewmate teardown into a
workspace-emptying removal. The focus-safe removal plan avoids Herdr's
focus-stealing explicit close only while the doomed pane's shell can be proved
lone, childless, and idle; a persistent child of that shell (gitstatusd, a
zsh-async worker, direnv) fails that proof permanently and forces the plain
close, which on every release before Herdr 0.8.0 moves the captain's active
workspace for ~140ms on each teardown.

Gate the unconfigured default behind a Herdr 0.8.0 floor. At or above it,
project as before; below it, fall back to the flat per-home layout with one
warning per home per detected release naming the version and the upgrade. An
explicit "on" - including the historical empty opt-in file - is still honored
below the floor, so a deliberate opt-in is never silently downgraded.

The floor reads two independent signals from the client's own status, either of
which can establish a supported release: the protocol number and the release
core of the version string. Measured against the real release binaries, no build
lacking both upstream focus fixes reaches protocol 19 and every pre-fix build
tops out at 17, so protocol 19 is a safe structural expression of the floor. A
release that reports neither signal readably is treated as unsupported rather
than guessed at.

Also:
- Correct the adapter comment claiming the mitigation "stays safe without any
  version gate". That holds for the pane-death route only; the plain-close
  fallback is reachable precisely on the releases where it is unsafe.
- Stop discarding the projected-close helper's stderr at teardown, so a refused
  or failed focus restore is visible instead of silent. The close stays
  non-fatal; the presence gate still decides record removal.
- Add Part C to the focus-flash regression: a doomed pane whose shell holds a
  persistent child, in the geometry where the closing workspace's right
  neighbour is not the anchor. That is the fallback branch the suite could not
  structurally reach. On 0.7.5 it observes a bounded four-sample wrong-focus
  window restored exactly; on 0.8.0 it observes none. It also cross-checks its
  own measurement against the floor classifier, so a drifted protocol mapping
  fails loudly.
- Make the projection suite's unconfigured-home case release-aware, so the whole
  real-Herdr lane passes on both the CI-pinned 0.7.4 and 0.8.0.
- Add an opt-in live guard that re-measures the release-to-protocol mapping
  against the pinned upstream binaries.

The immediate no-code mitigation for a home that cannot upgrade remains writing
"off" into config/herdr-presentation-spaces.

* no-mistakes(review): Pin Herdr live-guard digests across supported platforms

* no-mistakes(review): Document authorized Herdr cleanup containment

* no-mistakes(review): Harden Herdr warning marker publication

* no-mistakes(review): Honor running Herdr server presentation floor

* no-mistakes(review): Recheck Herdr floor after server ensure

* no-mistakes(review): Refresh 0.7.5 and 0.8.0 focus transcripts

* no-mistakes(review): Route Herdr floor probe through lab session

* no-mistakes(document): Align Herdr floor documentation and comments

* no-mistakes(lint): Document Herdr presentation out-parameter consumer
* fix(muse): trust the settled session log as idle

The credentialed multi-step smoke on Muse Code 0.1.0-R708.1 answered the one
question the idle half was held back for: one real 75-second tool-loop turn with
23 tool batches stays inside exactly one run started/terminal pair, and an
Escape mid tool loop closes that run as cancelled rather than leaving the turn to
continue in another run. A settled log is therefore a finished turn, not a pause
between the runs of one turn.

Remove fm_busy_muse_idle_verified and FM_BUSY_MUSE_IDLE_VERIFIED_VERSIONS
outright rather than pinning them to a version: the session log's own metadata
carries only semver 0.1.0 and a build sha, so a version allowlist could not
actually match the running build and would be false precision. A settled log now
classifies idle, an open run still classifies busy, and only a resolution
failure - no binding, no matching log, an unreadable or run-free log - stays
unknown.

Record the evidence in docs/verification/muse.md, including the run-scoped grep
the counts must use, and keep the post-upgrade re-check guidance.

* no-mistakes(review): Document Muse idle trust and remove stale gate reference

* no-mistakes(document): Clarify Muse idle verification ownership
* feat(session-start): order the startup digest for truncation safety and bound its bulk

The digest is delivered through a harness that truncates an oversized payload
from the tail, and it really has been truncated: a 70KB digest arrived as lines
1-435 of 578, cutting off eight lines before the live-task inventory. That
session took the helm without ever seeing which tasks were live or where their
endpoints were.

Three changes, one file's worth of composition:

- FLEET STATE is emitted before CONTEXT, so a truncated tail drops curated
  memory - stable session to session, already governed by a captain-set budget,
  recoverable with one targeted read - instead of live fleet identity. The
  LOCK/BOOTSTRAP/WAKE-QUEUE safety preamble keeps its order. The read-once
  contract moves out of the closing reminder into its own section ahead of both,
  and now names the condition that voids it: a stage the truncation banner
  reports as never emitted.

- Status-tail lines are capped per line, reusing the cut the wake digest's OPEN
  DECISIONS section already applies. An observed tail line ran 865 characters
  and nothing bounded it. The cut and its marker now live in one place,
  bin/fm-line-cap-lib.sh, so the two digests cannot drift apart; each task's
  full status log path is still printed beside its tail.

- The backlog listing is composed as a recovery input: done rows are never
  listed, every in-flight, held, and blocked row is shown in full with its hold
  and blocked-by metadata, and only the dispatchable-now listing is bounded -
  with an exact remainder count and the command that shows the rest.
  FM_SESSION_START_QUEUED_LIMIT (default 20) replaces
  FM_SESSION_START_BACKLOG_LIMIT, which bounded the whole listing
  indiscriminately and so could drop a held or blocked row.

Tests exercise the real digest output: section ordering with the preamble
pinned, the per-line cap and its marker, and the backlog composition including
the remainder counters on both the tasks-axi and manual paths.

* no-mistakes(document): Clarify digest source recovery comments
A captain decision opened by a keyed needs-decision:/blocked: status line
orphaned as permanently open whenever the answer kicked off work: the
worker's next event is working [key=<workstream>] in a different key
namespace, so no resolved [key=<decision>] ever landed and the OPEN
DECISIONS fold kept listing the answered decision forever.

Remove the writer-dependency at its source: the answering firstmate
already holds the decision key when it sends the answer, so fm-send's new
--resolve-key flag (repeatable) appends the closing resolved line to this
home's own state/<id>.status after the submit is confirmed. The close is
a local ledger append for crewmates, local secondmates, and remote
secondmates alike - a remote mate's escalations reach this ledger through
the parent-replies ingest, so only the answer message crosses the
transport.

Safety: each named key must currently be open per the authoritative
status_open_decisions fold or fm-send refuses before sending; a failed or
unconfirmed send never closes a key; an append failure after a delivered
answer exits nonzero with the manual close command so the decision
re-surfaces instead of silently vanishing; a send without the flag closes
nothing, and working:/done: still never clear a captain decision.

Complementary fixes: the wake-drain OPEN DECISIONS section prints the
answer-with-close command hint at the moment of use; brief scaffolds
separate resolved's two duties (keyed-phase end vs decision closure) and
state that a done:/working: line never closes a decision even when the
answer started that work, keeping worker self-close for blockers that
clear without a firstmate reply; AGENTS.md and docs/architecture.md carry
the one-line pointers to the fm-send contract.
* feat(secondmate): seed a remote home from a supplied project origin

Remote seeding required a local projects/<name> clone purely to read
`git remote get-url origin` into the provisioning manifest, so setting up
a remote second mate forced disposable clones and no-mistakes inits in the
primary home for projects that home has no reason to hold.

Firstmate now resolves the origin itself and names it as <project>=<origin-url>.
The seed validates and transports what it is given, and the receiving host
re-validates it rather than trusting the sender; bin/fm-project-origin-lib.sh
is the single owner of which URLs are accepted, refusing executable remote-helper
transports, option-shaped values, and unusable spellings at both ends. A bare
<project> still reads an already-present clone's origin, so nothing that works
today has to change. Registry consistency is unchanged: an unregistered or
local-only project is still refused.

A remote seed therefore creates nothing in the primary home beyond the route,
the charter, and its launch record.

The lifecycle test now seeds a registered project the primary has never cloned
and asserts the primary project tree is byte-identical afterwards, alongside
refusals for a missing origin, an unsafe origin, a local-only project, and an
unregistered project.

* no-mistakes(review): Clarify project origin documentation ownership

* no-mistakes(document): Document supplied-origin remote seeding contract

* feat(secondmate): accept project origins from any host or forge

Firstmate is a shared template, so a project origin must be able to name any
host: GitHub Enterprise on a private domain, GitLab hosted or self-hosted,
Bitbucket, Gitea, Codeberg, sr.ht, a bare IP, an SSH config alias, or a plain
server nobody else has heard of. The validator already decided on structure
rather than on a forge allowlist, and this makes that guarantee explicit and
closes the two gaps that a host-agnostic rule exposed:

- a bracketed IPv6 literal in the scp-like form is now accepted, so a host
  reachable only by address is not excluded
- a "/../" traversal inside a local or file: origin is now refused, because
  that names a path on the cloning host's own filesystem

The library is the single owner of the accepted forms, and its header says
plainly that there is no host, domain, or forge allowlist and there must never
be one. The skill keeps its distinct agent-operating lines (the agent resolves
and supplies the origin; a remote seed creates nothing in the primary home
beyond the route, the charter, and its launch record) and points at the library
for URL acceptance and at the operator doc for the rest.

The lifecycle test now drives Bitbucket, a self-hosted enterprise domain, a
self-hosted GitLab over ssh with a port, and a bare scp-like custom host through
the real seed, manifest, transport, and remote provisioning path in one seed,
asserting each URL reaches git unchanged and each clone carries its own origin's
content. The unit matrix leads with non-GitHub hosts for the same reason.

* no-mistakes(review): Validate project origin authorities safely

* no-mistakes: apply CI fixes

* no-mistakes: apply CI fixes
* fix(tests): copy the whole bin/ tree into the old-vs-new conformance shim

main went red on tests/fm-backend.test.sh's "fm-send --key: old vs new
exit code" assertion, which reads as an fm-send fail-closed regression from

build_old_bin enumerated by hand the sibling scripts it copied into the
synthetic pre-refactor tree. #1842 made bin/fm-send.sh source
bin/fm-line-cap-lib.sh (added by #1798) and the list never learned about it,
so the pinned old fm-send.sh aborted at `. "$SCRIPT_DIR/fm-line-cap-lib.sh"`
under set -eu and exited 1 before parsing a single argument, while the
current one delivered the key and exited 0. The parity check compared a
crashed process against a working one and reported a behavior divergence
that never happened - the more so because BASE_REF collapses to HEAD on
main, where both sides run byte-identical source and a genuine divergence is
impossible. fm-send's --key exit path is unchanged and its fail-closed
contract is intact.

Copy the tree whole instead of enumerating it. An enumerated list has to be
extended by hand every time an entrypoint gains a dependency and is the only
thing that knows; it has been patched a dozen times for exactly that. A
whole-tree copy has nothing to forget. Extracting a refactored entrypoint the
baseline does not have now fails loudly instead of writing an empty file.

Only old-vs-new parity covered that exit contract, and parity is near-vacuous
on main. Pin it directly: tests/fm-send-strict.test.sh drives delivery both
ways from one stub and asserts an undelivered key exits nonzero naming the
key, so swallowing that error fails the suite.

* no-mistakes(review): Materialize historical fixture dependencies from baseline

* no-mistakes(document): Clarify fm-send key regression scope
* fix(bin): mirror the whole remote secondmate status stream

A remote secondmate's reply channel required corr=<16hex> on every line and
failed the entire delta when one line lacked it, so the cursor could never
advance past that line and the channel wedged permanently.

The charter tells a secondmate to report its own progress phases and to raise
new decisions with no correlation token, because correlation only answers a
marked parent request. Those lines were therefore unrepresentable on the remote
channel, while a local secondmate writes them straight into the parent's status
file.

Treat the channel as what it is: a mirror of the mate's status stream. A remote
mate now presents the same status and decision model as a local one, so a newly
raised needs-decision reaches the parent's open-decision fold identically, and
correlation goes back to being a per-line property that settles a pending
request rather than a gate on the stream.

Only what crossing a machine boundary genuinely adds stays behind: cursor
continuity, confined document fetch and rewrite, at-most-once append, and
control-byte normalization that rewrites bytes without ever dropping a line.
Line framing and size bounding already belong to fm-remote-delta-read.sh. A
document the remote reader refuses is named in one escalation instead of
stalling the stream, while an unavailable transport still leaves the delta for
the existing retry.

* refactor(bin): give the remote reply stream one append owner

Every line entering the parent status stream - a mirrored line, the continuity
escalation, and the undelivered-document escalation - now goes through one
at-most-once append, so the idempotence a replayed generation depends on is
stated once instead of copied at three call sites.

* no-mistakes(review): Keep local document transfer failures retryable

* no-mistakes(review): Isolate reply headers and normalize payload bytes

* no-mistakes(review): Correct remote reply mirror contract wording

* no-mistakes(review): Update remote reply script catalog description

* no-mistakes(document): Document remote status-stream mirroring
fm_secondmate_parent_record_parse read the .fm-secondmate-parent record
with bash's read, which drops NUL bytes - and different bash generations
disagree on the result: 3.2 truncates the value at the NUL while 5.x
splices the surrounding bytes together. A NUL-bearing parent_home could
therefore resolve to a home the record's bytes never name contiguously,
and which home fm-teardown.sh's promised-public-reply resolution read
(registration, registry, relay state) - or whether that protection
engaged at all - depended on which interpreter ran the cleanup.
Reproduced end to end: the same NUL-bearing record cleaned up under bash
5.x by resolving the spliced-together registered parent, while bash 3.2
refused it as unresolved, and a literal truncated path refused under
both.

Reject any NUL byte in the record before field parsing, putting corrupt
records in the same fail-closed bucket as duplicate fields, malformed
local bindings, unsupported routes, and symlinked records. The
regression test drives the real bin/fm-teardown.sh over the proven
clean-cleanup fixture with a NUL spliced mid-path into the recorded
parent_home, so before the fix it reproduced the wrong-home cleanup and
now it must refuse with the explicit binding refusal.
* docs(secondmate-provisioning): require record intake for an inherited domain

A new mate seeded for an existing or inherited domain previously pulled in
charter, inherited config, captain-shared preferences, project clones, and
queued backlog rows with zero instruction about the domain's shipped history,
so it assumed a greenfield domain. A live backlog keeps only the configured
recent Done entries, so an inherited queue structurally over-represents plans
and under-represents deliveries, and already-delivered work resurfaced as open.

Add a record-intake step to the creation/seed path: classify greenfield versus
existing or inherited, and for the latter reconcile every inherited plan
against origin/main plus the live deployment, take only genuinely open work
and still-live durable knowledge, never carry a plan row for shipped work, and
record what could not be reconciled. Greenfield domains are untouched.

The skill owns the procedure; the backlog handoff section carries a one-line
reinforcement at the point where plan rows actually move.

* no-mistakes(document): Clarify secondmate record-intake scope
* perf(session-start): run every network check off the blocking path

The session-start digest runs on a session-open hook that blocks session
initialization, and every external-network call it made was individually
unbounded: `gh auth status`, secondmate liveness, secondmate convergence,
pending remote handoff delivery, and the fleet-sync fetch. One unreachable
remote secondmate could consume the whole FM_SESSION_START_TIMEOUT and
truncate the digest, so a slow network could cost the work queue itself.
Measured against a host hanging 25s per SSH connection, that startup took
1m18s.

The digest is now composed from local reads alone. bin/fm-startup-network.sh
runs the same checks concurrently in a bounded detached worker and the digest
harvests whatever finished, without ever waiting. Same fixture: 0.84s.

Nothing is dropped. fm-bootstrap.sh stays the single owner of every sweep and
still runs all of them, through a new FM_BOOTSTRAP_NETWORK phase split whose
`skip` and `only` halves are a partition of the unsplit run. Deferral is safe
because the sweeps are idempotent detectors, the result is durable and always
surfaces (inline, or as a `check: startup-network` wake), and the worker
re-verifies that the fleet lock still names the session that asked before it
mutates anything. While the worker is still running the digest names exactly
what is unconfirmed rather than implying it passed.

A relaunch performed by the deferred pass is now always reported, because the
digest that printed the superseded endpoint record is already out.

Also collapses the duplicate tasks-axi compatibility probe: the verdict is
computed once and handed to the bootstrap child for one process hop, then
consumed so it never reaches a spawned agent's environment. 10 tasks-axi
invocations per startup become 7.

Verified on Claude Code 2.1.222 that a worker detached by the session-open
hook survives the hook returning, the one vendor behavior this design needs
and no portable test can see.

Re-landed on current main, superseding PR #1845, which was cut from a
pre-#1842 base. The digest's section numbering in AGENTS.md section 3 now
states the emission order directly - supervision block and its read-once
contract, fleet state, network checks, then context - which keeps #1826's
fleet-state-before-context ordering. The old-bin test shim keeps main's
git-archive baseline from #1851, which already subsumes this branch's reason
for widening that shim.

* docs(verification): re-measure the deferred startup stage on the current base

Re-runs the unreachable-remote latency fixture against default-branch tip
8398d31 rather than the now-historical 345de4e, and records the sweep-result
comparison the deferral's safety argument rests on: the deferred worker's
published report is byte-identical to the three sweep lines the blocking
baseline printed, with the unreachable route preserved in both.

* no-mistakes(review): Fail deferred startup when report publication fails

* no-mistakes(document): Document deferred startup network behavior accurately
* fix(procevent): apply a captured adapter result in code, not by instruction

A remote secondmate's reply was captured and announced, but never applied.
Nothing dispatched the reply adapter's `handle` on a `procevent remote-reply`
wake, and the handling instruction named only the generic acknowledgement, so
the wake was retired while everything it carried was dropped: the reply never
reached the secondmate's local status mirror, the request it answered kept
escalating as a missed report, and the relay - whose registration each capture
retires, and which only that same handling re-arms - was left dead until the
next session start armed it again.

Applying such a result carries no judgement, so it belongs in code. After
publishing, the runner now calls
`bin/fm-procevent-<adapter>.sh autohandle <source-id> <sequence> <result-file>`
and lets the adapter apply and acknowledge its own result, through the same kind
of seam that already owns the terminal verdict. It runs strictly after terminal
retirement, because a handling adapter re-arms its own next source and retiring
afterwards would drop that fresh registration. An adapter with no such command,
or one whose pass does not complete, leaves the result unacknowledged and
therefore still announced, so a handler receives it exactly as before.

Resolving the request was not enough on its own either. An escalation opens a
durable keyed decision in the parent status log, and nothing ever closed it, so
a request the remote had answered kept surfacing in every later open-decisions
fold. The pending-reply library now owns both ends of that decision: it opens
one under a per-request key rather than the shared default key, and closes it
once the record resolves, appending the closing line only while that exact
decision is still open in the fold so it can neither double-close nor clear an
unrelated decision that has since taken the same key.

The handling instruction still routes a wake to its adapter, now as the
idempotent confirmation of what the runner already did rather than as the
guarantee.

Verified end to end in a throwaway isolated home driving the real armed source,
blocking delta reader, runner, and wake queue, with the handler doing only the
generic acknowledgement and no part of the ingest stubbed: before, seven failed
observations reproducing the incident; after, none. Each half is independently
load-bearing - without the runner change the reply never reaches the mirror,
without the escalation close the settled request still surfaces as an open
decision.

* no-mistakes(review): Prevent legacy reply closure from masking decisions

* no-mistakes(review): Serialize pending reply resolution and escalation closure

* no-mistakes(review): Serialize pending reply escalation with resolution

* no-mistakes(review): Clarify guarded legacy escalation closure behavior

* no-mistakes(review): Guard legacy closure and reserve pending reply keys

* no-mistakes(review): Match pending reply escalations by construction

* no-mistakes(document): Document automatic remote reply resolution

* no-mistakes(lint): Fix unused concurrent escalation loop variable

* no-mistakes(lint): Fix unused concurrent resolution loop binding

* no-mistakes(review): Version fold cache and gate autohandle on publication

* no-mistakes(document): Clarify remote reply relay documentation
Bring the public installer-facing stow skill up to the internal skill's
current curation behavior while keeping it fully standalone:

- Replace the total-capture thesis with the compact-operating-map framing.
- Add read-the-destination-before-writing with the inspect-then-update
  triad (supersedes what, one-sentence rewrite, delete stale now).
- Add the concrete prune list together with its unique-fact guard, as an
  accuracy discipline with no size-budget machinery.
- Curate every memory file the pass has open, not only the routed one.
- Add the standing-decisions sweep category.
- Add the stronger-owner pointer-over-copy test before filing.
- Add tool-agnostic task-note discipline (inspect, classify, considered
  replacement body, never blind-append) and blocked-on recording.
- Give .stow-notes.md a closed set of three exits.
- Forbid storing, creating, or editing a skill as a stow destination.
- Report per-file action verbs in the completion receipt.
- Consolidate the repeated local-vs-external and .gitignore prose and fix
  the second-person voice slip, so the file does not grow (11334 -> 11276
  bytes).
merge: catch up with upstream kunchenguid/firstmate
Some checks failed
CI / Behavior portable parallel 2 (pull_request) Has been cancelled
Details
CI / Behavior portable serial 1 (pull_request) Has been cancelled
Details
CI / Behavior portable serial 2 (pull_request) Has been cancelled
Details
CI / Behavior portable serial 3 (pull_request) Has been cancelled
Details
CI / Behavior portable serial 4 (pull_request) Has been cancelled
Details
CI / Behavior tests (Herdr) (pull_request) Has been cancelled
Details
CI / Behavior timing aggregate (pull_request) Has been cancelled
Details
CI / Stock macOS Bash snapshot compatibility (pull_request) Has been cancelled
Details
CI / Repo invariants (pull_request) Has been cancelled
Details
Require no-mistakes / PR must be raised via no-mistakes (pull_request) Has been cancelled
Details
CI / Lint shell scripts (pull_request) Has been cancelled
Details
CI / Test coverage guard (pull_request) Has been cancelled
Details
CI / Behavior portable parallel 1 (pull_request) Has been cancelled
Details
07538957db
 
Merge upstream/main (70aeba8) into main (8576b4f). Merge-base 4ee4a0a;
79 local commits ahead, 41 upstream commits behind. A fast-forward is not
available, so this is a real merge commit resolving 24 conflicting files.

Roughly 18 conflicts were additive list or prose collisions where this fork
added `omp` and upstream added `muse` to the same list, resolved by union.
Five needed a semantic resolution:

bin/fm-composer-lib.sh - local made the leading-glyph strip
locale-independent (per-glyph `${content#'X'}` arms) because `${content#??}`
counts characters and corrupts a row under a non-UTF-8 locale. Upstream did
not fix that; it only added Muse's `⟩` to the same fragile form. Resolved by
adding `⟩` to the per-glyph arms, keeping both fixes.

bin/backends/tmux.sh - upstream rewrote agent liveness around a new
fm_backend_tmux_classify_process_name that does not recognise `bun` or `omp`,
so a live OMP worker would classify `ambiguous` and could license a duplicate
agent onto a live worktree. Resolved by keeping upstream's new two-source
helpers and restoring the `expected_bun`/`expected_omp` parameters plus a
`bun|omp` dispatch to fm_backend_tmux_bun_agent_state from BOTH name sources.
A bare `bun` shell is common, so the name alone never returns alive: the
task-bound Bun/OMP identity check does, and an unproven `bun` leaves the pane
ambiguous rather than dead.

bin/fm-spawn.sh - local OMP secondmate session prep now runs before upstream's
FM_SKIP_SECONDMATE_INHERIT-guarded inheritance block, so a corrupt OMP home
fails before foreign config is pushed into it. Local's unguarded inheritance
lines are superseded. LAUNCH carries local's FM_OMP_SESSION_POINTER together
with upstream's FM_TRACE_CONTEXT and FM_SUPERVISION_MODEL.

bin/fm-teardown.sh - the two additive `rm -f` artifact lists are unioned into
one command per block with correct line continuations; a naive union drops a
backslash and makes bash execute a path.

.agents/skills/harness-adapters/SKILL.md - upstream relocated the per-harness
session-start bullets out of the skill. The deletion is kept and the fork's
`omp` fact migrated into the relocated owner, docs/sessionstart-nudge.md.

Also bumps the fake tasks-axi in tests/fm-teardown.test.sh from 0.1.1 to
0.2.4. Upstream raised FM_TASKS_AXI_MIN in a cleanly merging file, which put
the fixture below the floor and made the scout completion gate refuse a
teardown the test expects to succeed. Real teardowns were never affected.

tests/fm-tmux-agent-liveness.test.sh gains OMP coverage: a verified
`bun <omp-entrypoint>` launch classifies alive, a bare bun shell stays
ambiguous, and a pane whose recorded Bun is not the live interpreter stays
ambiguous. Reverting the dispatch turns the first case ambiguous, so the
regression is genuinely covered.

Every local behaviour survives: OMP harness support (all seven core OMP files
land verbatim), the locale-independent glyph strip, the committed-but-never-
pushed teardown refusal, and the watcher signal-signature work. Upstream's
d0461e4 false-watcher-down fix lands and its test passes.
john merged commit 1c8dee0b6f into main 2026-08-07 18:23:12 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
john/firstmate!2
No description provided.