fix: bind no-mistakes run by plan metadata, not intent-log body

[dnth]

Outcome

fm-receipt-check.sh --bind-run/--complete refused every no-mistakes run because the binder proved a run belonged to the current plan by grepping the run's intent log for an inline Firstmate-Validation-Generation: <gen> record. Real AXI never echoes the agent-supplied --intent body back through axi logs --step intent - it reports only "using intent supplied by the agent" - so no run could bind and terminal --complete refused even for CI-green, correctly-validated runs (observed this session on fork PR #88's receipt completion and the port-3369-check-unregister task).

The fix binds from what AXI reports authoritatively instead: the run id and head from axi status --run, the created-after-plan boundary, and the generation recorded in the task's own plan metadata (validation_generation). The exact run/generation/head identity checks are unchanged, so a wrong head, a mismatched generation, or a superseded plan (which mints a new generation and clears validation_run_*) still fails closed.

Files changed

• bin/fm-receipt-check.sh - bind-run no longer reads axi logs --step intent; the generation is anchored to plan metadata cross-checked against the run-authoritative id/head. Added a rationale comment at the check.
• bin/fm-nm-run-lib.sh - removed the now-unused fm_nm_intent_has_generation helper (its only caller was the bind path).
• tests/fm-receipt-check.test.sh - new regression test reproduces the real agent-supplied intent-log shape and asserts bind+complete succeed while a mismatched generation and a wrong head still fail closed; the intent-echo-specific assertions were retargeted to the retained id/head/generation checks.

Verification

• bash tests/fm-receipt-check.test.sh - all pass, including the new agent-supplied intent-log regression.
• bash tests/fm-omp-harness.test.sh - 12/12 pass; no OMP adapter/spawn/arm files were modified (harness-agnostic change).
• bash bin/fm-lint.sh - exit 0 (ShellCheck 0.11.0 pinned).

Risks / follow-ups

• The generation is Firstmate's own plan-side nonce; since AXI exposes no per-run generation, it is anchored to plan metadata rather than proven from the run body. Anti-superseded protection is retained through the created-after-plan boundary at bind and the generation/head re-checks at completion (a replan clears the bound run). The Firstmate-Validation-Generation: line in the brief's --intent is now provenance only, no longer machine-verified; fm-brief.sh is left unchanged.

https://claude.ai/code/session_016U99CBNwSkGnuHNoqLJZQj