feat: merge upstream supervision and runtime capabilities

[levelupself]

Intent

Deliver the deliberate two-parent merge of upstream/main into levelupself/firstmate main through no-mistakes, without rebasing, resetting, dropping any of the three fork commits, or chasing the one later upstream commit. The fork lacked 139 upstream commits; the rebase detector's 97-commit count is a different subset of local-main commits never pushed to origin. Both counts are accepted. The pipeline must update open PR 6 against levelupself/firstmate main and write its own no-mistakes signature; no manual PR-body edit is permitted. Public prose must not directly address a reader. The test summary must state only: Upstream main was merged into the fork through a two-parent merge. Eighteen file conflicts were resolved by retaining current upstream structure and reapplying fork-specific process identity, task-usage tracking, Cygwin safety, and watcher synchronization behavior. Final PR-artifact verification belongs to the PR phase; absence during the test phase is expected and not fixable. Any recorded deferral fix label must be exactly: replacement-PR verification deferred to the PR phase. The PR body must retain these eighteen conflict-resolution lines exactly:

1. AGENTS.md - Both: upstream current operating-contract rewrite won the surrounding structure, while spawned_at and the task-usage data, cache, and command pointers were reapplied.
2. README.md - Upstream: its current documentation index won because the fork side added no unique content in the conflicted block.
3. bin/fm-fleet-snapshot.sh - Both: upstream current-state, endpoint, and secondmate-summary shape won, with fork usage collection and safe temp cleanup integrated into it.
4. bin/fm-guard.sh - Upstream: its current read-only and watcher-warning contract won because it supersedes the fork's duplicated advisory wording.
5. bin/fm-harness.sh - Both: upstream harness detection and basename hardening won, while process reads stay routed through the fork's portable fm_process_comm helper.
6. bin/fm-lock.sh - Both: upstream serialized and verified lock publication won, with the fork's Cygwin unknown-identity exit-2 safety reapplied.
7. bin/fm-session-start.sh - Both: upstream's current digest and mutation inventory won, while fork lock-inspection failures still force an accurately described read-only session.
8. bin/fm-teardown.sh - Both: upstream Herdr preflight and authenticated cleanup won, with the fork's usage snapshot-before-release and usage-cache cleanup retained.
9. bin/fm-wake-lib.sh - Upstream: its independently implemented /proc and MSYS watcher PID identity won because it is stronger than routing watcher identity through fm_process_identity.
10. docs/architecture.md - Both: upstream's current fleet-state architecture won, with per-task codeburn usage restored to the snapshot contract.
11. docs/scripts.md - Both: upstream's current script inventory won, with the fork's fm-task-usage entry retained in the current table.
12. tests/fm-backend-orca.test.sh - Upstream: its current spawn-failure fixture won because the fork's exact old mkdir-error assertion no longer describes the rewritten path.
13. tests/fm-backend.test.sh - Both: upstream's expanded compatibility fixture won, with fm-process-lib added as the fork-required unchanged sibling.
14. tests/fm-pi-watch-extension.test.sh - Both: upstream's current extension coverage won, with the fork's Cygwin fixed-column process-name fallback regression retained.
15. tests/fm-session-start.test.sh - Both: upstream lock-publication and concurrency coverage won, with the fork's Cygwin acquisition, live-holder, and native-parent-gap cases retained.
16. tests/fm-spawn-dispatch-profile.test.sh - Both: upstream's current dispatch fixture won, with the fork-required process and usage-hook dependencies preserved.
17. tests/fm-teardown.test.sh - Both: upstream's Herdr teardown safety suite won, with the fork's usage-cache retirement regression retained.
18. tests/fm-watcher-lock.test.sh - Upstream plus one fork race fix: upstream's /proc and MSYS identity suite replaced the fork's watcher-level Cygwin identity test, while the fork's ready-file synchronization remains in the healthy-peer test.

What Changed

• Upstream main was merged into the fork through a two-parent merge. Eighteen file conflicts were resolved by retaining current upstream structure and reapplying fork-specific process identity, task-usage tracking, Cygwin safety, and watcher synchronization behavior.
• Integrated upstream supervision, runtime-adapter, process-event, public-followup, Calm-mode, CI-sharding, and lifecycle improvements while preserving the fork’s three existing commits.
• Recorded the conflict resolutions:
  1. AGENTS.md - Both: upstream current operating-contract rewrite won the surrounding structure, while spawned_at and the task-usage data, cache, and command pointers were reapplied.
  2. README.md - Upstream: its current documentation index won because the fork side added no unique content in the conflicted block.
  3. bin/fm-fleet-snapshot.sh - Both: upstream current-state, endpoint, and secondmate-summary shape won, with fork usage collection and safe temp cleanup integrated into it.
  4. bin/fm-guard.sh - Upstream: its current read-only and watcher-warning contract won because it supersedes the fork's duplicated advisory wording.
  5. bin/fm-harness.sh - Both: upstream harness detection and basename hardening won, while process reads stay routed through the fork's portable fm_process_comm helper.
  6. bin/fm-lock.sh - Both: upstream serialized and verified lock publication won, with the fork's Cygwin unknown-identity exit-2 safety reapplied.
  7. bin/fm-session-start.sh - Both: upstream's current digest and mutation inventory won, while fork lock-inspection failures still force an accurately described read-only session.
  8. bin/fm-teardown.sh - Both: upstream Herdr preflight and authenticated cleanup won, with the fork's usage snapshot-before-release and usage-cache cleanup retained.
  9. bin/fm-wake-lib.sh - Upstream: its independently implemented /proc and MSYS watcher PID identity won because it is stronger than routing watcher identity through fm_process_identity.
  10. docs/architecture.md - Both: upstream's current fleet-state architecture won, with per-task codeburn usage restored to the snapshot contract.
  11. docs/scripts.md - Both: upstream's current script inventory won, with the fork's fm-task-usage entry retained in the current table.
  12. tests/fm-backend-orca.test.sh - Upstream: its current spawn-failure fixture won because the fork's exact old mkdir-error assertion no longer describes the rewritten path.
  13. tests/fm-backend.test.sh - Both: upstream's expanded compatibility fixture won, with fm-process-lib added as the fork-required unchanged sibling.
  14. tests/fm-pi-watch-extension.test.sh - Both: upstream's current extension coverage won, with the fork's Cygwin fixed-column process-name fallback regression retained.
  15. tests/fm-session-start.test.sh - Both: upstream lock-publication and concurrency coverage won, with the fork's Cygwin acquisition, live-holder, and native-parent-gap cases retained.
  16. tests/fm-spawn-dispatch-profile.test.sh - Both: upstream's current dispatch fixture won, with the fork-required process and usage-hook dependencies preserved.
  17. tests/fm-teardown.test.sh - Both: upstream's Herdr teardown safety suite won, with the fork's usage-cache retirement regression retained.
  18. tests/fm-watcher-lock.test.sh - Upstream plus one fork race fix: upstream's /proc and MSYS identity suite replaced the fork's watcher-level Cygwin identity test, while the fork's ready-file synchronization remains in the healthy-peer test.

Risk Assessment

✅ Low: Captain, the deliberate two-parent merge preserves all three fork commits, incorporates the stated 139 upstream commits, and the reviewed conflict integrations show no substantiated source defect or intent contradiction.

Testing

Upstream main was merged into the fork through a two-parent merge. Eighteen file conflicts were resolved by retaining current upstream structure and reapplying fork-specific process identity, task-usage tracking, Cygwin safety, and watcher synchronization behavior.

Evidence: Fork-sync end-to-end transcript

END-USER MERGE TOPOLOGY
merge=63c32b32e93558caaaec11c2c170cfe4a6cbe2ee
parents=babef94800d23bc7f738ce08bb36ae8ad9236442 33a428773059aa9bbe55865ce73ae51e4334bccc
subject=Merge upstream/main into fork main

TARGET DESCENDS FROM MERGE
yes

FORK-SPECIFIC BEHAVIOR CHECKS
== tests/fm-fleet-snapshot-view.test.sh ==
ok - empty fleet snapshot and view use explicit absence markers
ok - fixture snapshot covers task rows, backlog rows, pointers, and stable ordering
ok - main_inventory discloses orphan/unstructured and clears when inventory is consistent
ok - backlog normalization preserves strict roles and resolves every blocker compatibly
ok - snapshot event hints follow reconciled current state
ok - durable fold keeps an open decision past a later unrelated event
ok - a live secondmate endpoint preserves unrelated open decisions
ok - durable captain-held transfer closes the duplicate live status decision
ok - durable fold clears a decision only on a keyed resolution
ok - a completed scout's stale decision surfaces as a report pointer, not pending
ok - a scout still parked at a decision stays pending (terminal clear does not over-fire)
ok - snapshot includes durable scout reports after teardown
ok - snapshot parses tasks-axi rows and respects operational overrides
ok - fleet view renders the snapshot without secondmate peek guidance
ok - fleet view renders secondmate agent liveness
== tests/fm-backend.test.sh ==
ok - fm_backend_name: FM_BACKEND env > config/backend > default tmux
ok - fm_backend_detect: no markers -> undetected, HERDR_ENV=1 -> herdr, $TMUX -> tmux, CMUX_WORKSPACE_ID -> cmux, nested combinations resolve innermost-first
ok - fm_backend_detect: falls back to __CFBundleIdentifier=com.cmuxterm.app when CMUX_WORKSPACE_ID is absent (signal bundle-id; foreign bundle ids rejected)
ok - fm_backend_detect: the cmux fallback signals are macOS-only (inert on a non-Darwin uname)
ok - fm_backend_detect: an inherited cmux bundle id never outranks $TMUX or HERDR_ENV (tmux/herdr-inside-cmux false positive absorbed)
ok - fm_backend_detect: ancestry fallback matches the lsappinfo-resolved (bundle-id) cmux app pid in the parent chain
ok - fm_backend_detect: ancestry fallback matches a bundle-shaped cmux comm path at any install location when lsappinfo cannot resolve a pid
ok - fm_backend_detect: ancestry fallback stops undetected at launchd (a reparented tmux server never reaches cmux)
ok - fm_backend_name: a fallback-detected cmux prints a NOTICE naming the fallback signal; the primary-marker notice is unchanged
ok - fm_backend_name: auto-detect selects herdr or cmux (loud notice) or tmux (silent, including nested tmux-in-herdr/tmux-in-cmux)
ok - fm_backend_name: an explicit FM_BACKEND or config/backend setting always wins over runtime auto-detection, including an ambient cmux marker
ok - fm_backend_validate: implemented adapters accepted, unknown and blocked codex-app backends refused loudly
ok - zsh: shell-portable backend matching skipped (zsh not found)
ok - bash: fm_backend_source recognizes known backends and rejects unknown ones
ok - fm_backend_validate_spawn: all implemented lifecycle backends are spawn-supported
ok - fm_meta_get / fm_backend_of_meta: read key=value, default backend to tmux
ok - fm_backend_resolve_selector: session:window literal, exact task id first, legacy fm-<id> label fallback, ad hoc bare name via tmux list-windows
ok - fm_backend_of_selector: exact task ids, legacy fm-<id> labels, and matching explicit targets inherit metadata backend
ok - fm-send.sh: explicit tmux targets are verified, while --key/plain/slash send command shape stays old-compatible
ok - fm-peek.sh: capture-pane invocation and output are byte-identical old vs new
ok - fm-spawn.sh: a project reached through a symlinked prefix (e.g. macOS /tmp -> /private/tmp) does not trip the isolation guard's false refusal
ok - fm-teardown.sh: treehouse return remains compatible while tmux cleanup uses exact selectors
ok - fm-spawn.sh --backend bogus is refused loudly
ok - fm-spawn.sh --backend codex-app is refused
ok - fm-spawn.sh honors FM_BACKEND and refuses an unimplemented value loudly
ok - fm-spawn.sh: an explicit --backend tmux resolves silently and writes no backend= (missing means tmux)
ok - fm-spawn.sh: explicit --backend tmux wins over an ambient HERDR_ENV=1 auto-detect marker
ok - fm-spawn.sh: auto-detect resolves nested tmux-in-herdr to tmux and stays silent end to end
== tests/fm-pi-watch-extension.test.sh ==
ok - Pi primary watcher extension is tracked, self-hashing, and self-locating
ok - Pi secondmate launch wiring includes both tracked primary extensions
ok - Pi extension reports external healthy watcher output
ok - Pi custom tool exposes repair-only metadata and returns automatic-continuation guidance
ok - Pi redundant tool call returns ownership guidance and spawns no second child
ok - Pi scheduled retry remains extension-owned after another tool call
ok - Pi actionable close starts one successor before wake delivery settles
ok - Pi hung successor falls back to one typed actionable wake
ok - Pi unretired successor falls back without an overlapping retry
ok - Pi late unretired closes resume classified supervision
ok - Pi clean empty close triggers a bounded continuity retry
ok - Pi established clean closes stop at the configured retry limit
ok - Pi close handler verifies session-lock ownership before successor launch
ok - Pi watcher arm distinguishes all session lock ownership states
ok - Pi session transitions use a generation owner across /new /resume /fork, stale callbacks, and quit
ok - Pi process-exit cleanup listener remains singular across session replacement
ok - Pi process-exit cleanup stops the attached arm child
ok - OpenCode plugins have an explicit ESM boundary even under a typeless parent package
ok - OpenCode watcher plugin uses the effective FM_HOME state
ok - OpenCode watcher plugin sources the effective config
ok - OpenCode watcher plugin requires session lock ownership
ok - OpenCode watcher coordinator respects primary scope
ok - OpenCode watcher plugin starts one successor before wake prompt delivery settles
ok - OpenCode pre-ready actionable close preserves its successor
ok - OpenCode hung successor falls back to one typed actionable wake
ok - OpenCode unretired successor falls back without an overlapping retry
ok - OpenCode late unretired closes resume classified supervision
ok - OpenCode clean empty close triggers a bounded continuity retry
ok - OpenCode established clean closes stop at the configured retry limit
ok - OpenCode close handler verifies session-lock ownership before successor launch
ok - OpenCode watcher plugin coordinates with the turn-end guard
ok - OpenCode healthy arm output does not suppress the turn-end guard
== tests/fm-session-start.test.sh ==
ok - context digest distinguishes ABSENT, empty-but-present, and populated files
ok - a lock refusal prints a loud read-only banner, skips every mutating step, and still completes the digest
ok - Cygwin ps acquires the fleet lock and recognizes its live holder
ok - a Cygwin native-parent gap degrades safely without claiming another session is live
ok - session start stays read-only when lock ownership cannot be published
ok - concurrent session-lock acquisition admits exactly one live harness
ok - digest sections are ordered diagnostics-first, bulk-context-last
ok - session start: configured and auto-detected Herdr homes never require tmux
ok - session start: an absent recorded tmux window relaunches its Pi secondmate exactly once
ok - session start: an existing ambiguous Pi process prevents duplicate recovery
ok - session start: transient tmux unreadability never licenses a relaunch
ok - session start: the proven bare-shell recovery path remains intact
ok - session start: a confirmed Herdr husk is closed and relaunched
ok - status tail is bounded to the configured line count, with the full log path always printed
ok - orphan status logs are printed once with bounded tails
ok - tmux endpoint liveness is reported per task: alive for a live window, dead for a gone one
ok - herdr endpoint liveness is reported per task: alive for a live pane, dead for a gone one
ok - fm-s

... [4365 bytes truncated] ...


●  WATCHER DOWN - SUPERVISION IS OFF
●  1 task(s) in flight, but no watcher has a fresh beacon (last beat: 0s ago, grace 300s).
●  Trust the emitted supervision protocol for this harness; do not use shell & for watcher repair.
●  This is a supervision warning only; the guarded operation WILL still run.
●  repair missing watcher supervision according to the session-start block for this harness; do not use shell &.
●━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
ok - teardown honors config/backlog-backend=manual even when tasks-axi is compatible
ok - local-only worktree with truly unpushed work is refused (safety preserved)
ok - local-only worktree with work merged into local main is torn down (no regression)
ok - no-mistakes worktree with HEAD on origin is torn down (no regression)
ok - no-mistakes worktree with genuinely unlanded work is refused (safety preserved)
ok - local-only worktree with unpushed work is torn down under --force (escape hatch)
ok - teardown completes when an exact busy-state sidecar is already absent
ok - herdr teardown removes pane-owned escalation dedupe state
ok - teardown removes the task's volatile state/usage-cache entry
ok - herdr flat teardown refuses before returning the isolated copy under lock contention and the retry completes cleanly
ok - herdr flat teardown never erases records when pane presence is unparseable
ok - herdr flat teardown preflight refuses before every destructive change
ok - forced secondmate teardown preflights every Herdr child before cleanup mutation
ok - forced secondmate teardown retains Herdr child identity until exact pane disappearance
ok - forced teardown retains a nested secondmate home and its grandchild's Herdr identity when the grandchild close is unconfirmed
ok - herdr projection teardown retires its journal only after confirming the exact recorded pane is gone
ok - herdr projection teardown retains every record when post-close presence is unknown
ok - squash-merged + deleted-branch worktree (PR merged) is torn down (the fix)
ok - squash-merged PR accepts a local HEAD that is an ancestor of the final PR head
ok - teardown discovers a merged PR by branch name and tears down when no pr= was ever recorded
ok - squash-merged PR accepts replayed unpushed local patches contained in the PR head
ok - merged PR does not allow teardown after a later local commit
●━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
●  WATCHER DOWN - SUPERVISION IS OFF
●  1 task(s) in flight, but no watcher has a fresh beacon (last beat: 0s ago, grace 300s).
●  Trust the emitted supervision protocol for this harness; do not use shell & for watcher repair.
●  This is a supervision warning only; the guarded operation WILL still run.
●  repair missing watcher supervision according to the session-start block for this harness; do not use shell &.
●━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
WARNING: watcher still down (same stale episode; last beat: 0s ago, grace 300s) - full banner already printed this episode.
ok - fm-pr-check does not refresh PR head after HEAD moves
●━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
●  WATCHER DOWN - SUPERVISION IS OFF
●  1 task(s) in flight, but no watcher has a fresh beacon (last beat: 1s ago, grace 300s).
●  Trust the emitted supervision protocol for this harness; do not use shell & for watcher repair.
●  This is a supervision warning only; the guarded operation WILL still run.
●  repair missing watcher supervision according to the session-start block for this harness; do not use shell &.
●━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
ok - fm-pr-check records the remote PR head when the local worktree lags
ok - worktree whose content already landed in the default branch is torn down (content fallback)
ok - content fallback refreshes origin default before comparing trees
ok - dirty worktree is refused even when its committed work has landed (dirty always wins)
ok - gh lookup error with content not in default refuses (fail-safe)
ok - provably-stale worktree index.lock (old, no live holder) is cleared and teardown succeeds
ok - live-held worktree index.lock is never removed and teardown refuses
ok - lsof errors leave worktree index.lock in place and refuse teardown
ok - stale lock cleanup rechecks and refuses dirty worktree before return
ok - normal repo index.lock is resolved from the worktree and cleared when stale
ok - lock mtime read failures leave worktree index.lock in place and refuse teardown
ok - transient index.lock cleared after first failed return is retried successfully without force-remove
ok - persistent index.lock exhausts retries and refuses without force-removing the lock
ok - empty retry wait overrides use the default without aborting teardown
ok - fractional legacy retry wait remains supported without arithmetic
== tests/fm-watcher-lock.test.sh ==
ok - simultaneous watcher starts leave exactly one live process
ok - fm_pid_identity real ps fallback is locale-invariant
ok - fm_pid_identity is locale-invariant across LC_ALL/LC_TIME
ok - /proc process identity ignores simulated btime changes
ok - /proc process identity detects pid reuse
ok - MSYS /proc process identity regression skipped on non-Windows host
ok - killed watcher stale lock is reclaimed
ok - live watcher lock with stale heartbeat is actionable
ok - guard banner leads when down with pending wakes (repair-after-drain) and stays silent when live and fresh
ok - concurrent fm_lock_try_acquire yields exactly one winner
ok - dead-pid stale lock is reclaimed by a single acquirer
ok - concurrent stale-lock steal yields exactly one winner
ok - live steal mutex is not reclaimed
ok - live-held lock is not stolen
ok - empty mid-acquire lock keeps a minimum grace
ok - late original claimant cannot claim a recreated lock
ok - paused mid-acquire claimant backs off to active stealer
ok - watch restart refuses to signal a reused pid
ok - watch restart attaches to a verified healthy peer and later surfaces a successor gap
ok - watcher self-evicts when the lock pid no longer names it
ok - arm turns clean self-eviction without a successor into a typed failure
ok - arm attaches to a live fresh watcher and fails loudly when that cycle has no successor
ok - attached arm signals record a classified lifecycle entry
ok - arm starts+confirms a fresh watcher on a clean lock and self-heals a dead-pid lock (never healthy off a dead pid)
ok - arm cleans child watcher and temp output on HUP
ok - arm propagates an immediate watcher wake before confirmation
ok - arm attaches to a peer watcher after child stands down and surfaces a missing successor
watcher: lock held by live pid 2383389 but heartbeat is stale for 839039406s (>300s); inspect or stop that watcher before re-arming.
ok - arm reports FAILED and exits non-zero when no fresh watcher can be confirmed
ok - cycle-exit ledger links a verified successor and remains size-capped
ok - SIGSTOP distinguishes live PID from stale beacon and termination records the exit class

DIVERGENCE COUNTS AT MERGE PARENTS
upstream-only commits: 139
fork-only commits: 3

FORK PARENT TIP AND THREE FORK COMMITS
babef94 feat(task-usage): add per-task codeburn usage tracking across the crewmate lifecycle (#2)
1237d41 fix: handle Cygwin process identity safely (#1)
538c148 Configure armada/ as project store and wire FM_PROJECTS_OVERRIDE

Evidence: Combined merge-resolution files

.claude/settings.json
.gitignore
.pi/extensions/fm-primary-pi-watch.ts
AGENTS.md
README.md
bin/fm-backend.sh
bin/fm-claude-stop-autoarm.sh
bin/fm-fleet-snapshot.sh
bin/fm-fleet-view.sh
bin/fm-harness.sh
bin/fm-lock.sh
bin/fm-session-lock-lib.sh
bin/fm-session-start.sh
bin/fm-spawn.sh
bin/fm-supervision-instructions.sh
bin/fm-teardown.sh
bin/fm-wake-lib.sh
docs/architecture.md
docs/configuration.md
docs/documentation-audiences.json
docs/scripts.md
tests/fm-afk-launch.test.sh
tests/fm-backend-herdr-presentation-e2e.test.sh
tests/fm-backend.test.sh
tests/fm-claude-stop-autoarm.test.sh
tests/fm-fleet-snapshot-view.test.sh
tests/fm-gotmp.test.sh
tests/fm-pi-watch-extension.test.sh
tests/fm-session-lock-ancestry.test.sh
tests/fm-session-start.test.sh
tests/fm-spawn-dispatch-profile.test.sh
tests/fm-teardown.test.sh
tests/fm-turnend-guard.test.sh
tests/fm-watcher-lock.test.sh

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

⚠️ **Rebase** - 1 warning

• ⚠️ .agents/skills/afk/SKILL.md - branch carries 97 commit(s) that exist on your local main branch but were never pushed to origin/main; rebasing would bundle this unrelated work (254 file(s)) into the PR:
• 9ea1a1a fix(pi): rearm watcher across session transitions (fix(pi): rearm watcher across session transitions kunchenguid/firstmate#1166)
• b29621b feat(bin): add verified pi-signed runtime adapter (feat(bin): add verified pi-signed runtime adapter kunchenguid/firstmate#1145)
• a5fe1bc fix(tmux): classify bordered composers across all rows (fix(tmux): classify bordered composers across all rows kunchenguid/firstmate#1066)
• 4d6992a feat(bin): add guarded Kimi turn-end wake (feat(bin): add guarded Kimi turn-end wake kunchenguid/firstmate#1059)
• 39b450b fix: harden Kimi submission and spinner matching (fix: harden Kimi submission and spinner matching kunchenguid/firstmate#1058)
• c64ad1c feat: add verified Kimi crewmate adapter (feat: add verified Kimi crewmate adapter kunchenguid/firstmate#1047)
• aca3ad1 fix(tmux): scope busy detection and recognize current Claude turns (fix(tmux): scope busy detection and recognize current Claude turns kunchenguid/firstmate#1049)
• 34213e6 docs(agents): drop superseded interim quota-window rule (docs: remove superseded interim quota-window rule kunchenguid/firstmate#1039)
• 3f71cdd fix(bin): remove vestigial dispatch selector (fix(bin): remove vestigial dispatch selector kunchenguid/firstmate#1026)
• 5c89d36 fix: make quota-aware profile selection agent-owned (fix: make quota-aware profile selection agent-owned kunchenguid/firstmate#1018)
• b05eb24 fix: recover Claude supervision without watcher-status gate (fix: recover Claude supervision without watcher-status gate kunchenguid/firstmate#1001)
• 2b7cd66 fix(herdr): clean stale projections at session start (fix(herdr): clean stale projections at session start kunchenguid/firstmate#996)
• 418ab78 fix: preserve Claude watcher continuity across Stop hooks (fix: preserve Claude watcher continuity across Stop hooks kunchenguid/firstmate#997)
• 861b1f8 docs: separate current guidance from verification evidence (docs: separate current guidance from verification evidence kunchenguid/firstmate#994)
• 10ee779 Require shipshape routine acknowledgement (fix: require event-scoped shipshape acknowledgements kunchenguid/firstmate#969)
• cb3aa7b Teach Ahoy to surface open decisions (feat: surface unanswered decisions in Ahoy recaps kunchenguid/firstmate#968)
• 3eca8ff fix(herdr): reclaim resumed task projections after restart (fix(herdr): reclaim resumed task projections after restart kunchenguid/firstmate#967)
• f017572 fix: relaunch missing second mates at session start (fix: relaunch missing second mates at session start kunchenguid/firstmate#950)
• 1c4d210 fix(pi): hide operational user rows in Calm mode (fix(pi): hide operational user rows in Calm mode kunchenguid/firstmate#948)
• 587f591 docs: prefer direct operational paths (docs: prefer direct paths for operational work kunchenguid/firstmate#946)
• ec09871 fix: enforce contract boundaries for ask-user findings (fix: enforce contract boundaries for ask-user findings kunchenguid/firstmate#945)
• 6b0d21d fix(pi): remove Calm hidden-block gaps (fix(pi): remove Calm hidden-block gaps kunchenguid/firstmate#942)
• d89a1b6 perf(bin): shrink the ShellCheck source graph (perf(bin): shrink the ShellCheck source graph kunchenguid/firstmate#939)
• 65ad47b fix(pi): prevent duplicate assistant replies in Calm (fix(pi): prevent duplicate assistant replies in Calm kunchenguid/firstmate#936)
• 792174d fix: refine scout intake and parallel dispatch (fix: refine scout intake and parallel dispatch kunchenguid/firstmate#934)
• b24e72c fix(watch): retire merged PR polls after durable notification (fix(watch): retire merged PR polls after durable notification kunchenguid/firstmate#932)
• ca4be1c fix(pi): make calm mode persistent and gapless (fix(pi): make calm mode persistent and gapless kunchenguid/firstmate#927)
• a7e01bc fix: avoid generic secondmate start acknowledgements (fix: avoid generic secondmate start acknowledgements kunchenguid/firstmate#926)
• 68ed7ed fix: canonically classify operational inputs across harnesses (fix: canonically classify operational inputs across harnesses kunchenguid/firstmate#909)
• 6bcb381 fix: exclude operational injections from ahoy boundaries (fix: exclude operational injections from ahoy boundaries kunchenguid/firstmate#899)
• bd43c73 fix: execute every PR body compliance event (fix: execute every PR body compliance event kunchenguid/firstmate#898)
• 6db3b09 fix(pi): clean up Calm transcript rendering (fix(pi): clean up Calm transcript rendering kunchenguid/firstmate#895)
• 82a7943 fix(pi): prevent redundant watcher re-arms (fix(pi): prevent redundant watcher re-arms kunchenguid/firstmate#885)
• 4497181 feat(pi): add session-local calm mode (feat(pi): add session-local calm mode kunchenguid/firstmate#884)
• 5549834 fix: preserve trustworthy Bearings data in partial snapshots (fix: preserve trustworthy Bearings data in partial snapshots kunchenguid/firstmate#875)
• 593e3a2 Add built-in ahoy recap skill (feat: add session-only ahoy recaps kunchenguid/firstmate#873)
• 5140413 feat(bin): make dispatch profiles quota aware (feat(bin): make dispatch profiles quota aware kunchenguid/firstmate#867)
• f5bdea3 fix: install tasks-axi in portable CI shards (ci: install tasks-axi in portable test shards kunchenguid/firstmate#866)
• 50cc24a fix: block primary-session delegation outside the fleet (fix: block primary-session delegation outside the fleet kunchenguid/firstmate#854)
• 673b6ad feat: shard portable tests and add bounded local parallelism (feat: shard portable tests and add bounded local parallelism kunchenguid/firstmate#841)
• f6c281a feat: require pinned real-Herdr CI coverage (feat: require pinned real-Herdr CI coverage kunchenguid/firstmate#838)
• 14c0d5f feat: guard against missed secondmate reports (feat: guard against missed secondmate reports kunchenguid/firstmate#834)
• 622d467 feat: add bounded concurrent test isolation proof (feat: add bounded concurrent test isolation proof kunchenguid/firstmate#832)
• f61e65c fix: surface main inventory gaps in Bearings (fix: surface main inventory gaps in Bearings kunchenguid/firstmate#830)
• f02eef1 feat: add canonical timed test runner (feat: add canonical timed test runner kunchenguid/firstmate#825)
• b843c66 fix: keep local no-mistakes tests intent-targeted (fix: keep local no-mistakes tests intent-targeted kunchenguid/firstmate#823)
• c58cb0f fix(herdr): group projected children beneath owning parents (fix(herdr): group projected children beneath owning parents kunchenguid/firstmate#821)
• 59ece45 feat(watch): follow GitLab merge requests to merge (feat(watch): follow GitLab merge requests to merge kunchenguid/firstmate#797)
• b4316be fix(bin): send literal config reread nudges after pushes (fix(bin): send literal config reread nudges after pushes kunchenguid/firstmate#809)
• f9a89c3 feat(herdr): order presentation spaces while preserving focus (feat(herdr): order presentation spaces while preserving focus kunchenguid/firstmate#790)
• 916c8e2 fix(bin): allow safe teardown during watcher recovery (fix(bin): allow safe teardown during watcher recovery kunchenguid/firstmate#750)
• ea3ac2e fix: prevent AFK idle stalls and stale run attribution (fix: prevent AFK idle stalls and stale run attribution kunchenguid/firstmate#758)
• a26b37c fix(bin): make watcher process identity immune to Linux wall-clock changes (fix(bin): make watcher process identity immune to Linux wall-clock changes kunchenguid/firstmate#752)
• 3f9e70e fix(spawn): require two stable reads before accepting worktree path (fix(spawn): require two stable reads before accepting worktree path kunchenguid/firstmate#765)
• c49f823 fix(send): treat opencode busy-queued composer state as submitted (fix(send): treat opencode busy-queued composer state as submitted kunchenguid/firstmate#775)
• 628292d feat(herdr): add optional presentation spaces (feat(herdr): add optional presentation spaces kunchenguid/firstmate#784)
• 4ab61fa feat(wake): enrich drained signals with bounded status context (feat(wake): enrich drained signals with bounded status context kunchenguid/firstmate#747)
• c12bdea fix(x-mode): dedupe pending mention wakes (fix(x-mode): dedupe pending mention wakes kunchenguid/firstmate#745)
• 68c6110 fix(supervision): distinguish ordinary wakes from recovery (fix(supervision): distinguish ordinary wakes from recovery kunchenguid/firstmate#744)
• ab8cea6 fix(watcher): bound stale wakes for parked crew (fix(watcher): bound stale wakes for parked crew kunchenguid/firstmate#743)
• 15b0fb9 docs(harness): correct Grok exit guidance (docs(harness): correct Grok exit guidance kunchenguid/firstmate#742)
• 7a9b4dd docs: resolve five contract contradictions across AGENTS.md, README, and skills (docs: resolve five contract contradictions across AGENTS.md, README, and skills kunchenguid/firstmate#736)
• b2bf95f fix: fetch current PR head for review diffs (fix: fetch current PR head for review diffs kunchenguid/firstmate#722)
• 3729081 fix(bin): keep watcher supervision continuous across child cycles (fix(bin): keep watcher supervision continuous across child cycles kunchenguid/firstmate#693)
• bc1a21b fix(bin): repair fm-brief.sh parse error and harden set -u array expansion (fix(bin): repair fm-brief.sh parse error and harden set -u array expansion kunchenguid/firstmate#205)
• 6bdeb3a docs: call built-in defaults the firstmate repo, not template (docs: relabel built-in defaults as the firstmate repo kunchenguid/firstmate#688)
• 3ebb219 feat: add native session-start nudges (feat: add native session-start nudges kunchenguid/firstmate#687)
• d939c49 fix(bin): parse handoff homes after registry parentheticals (fix(bin): parse handoff homes after registry parentheticals kunchenguid/firstmate#686)
• 1182883 fix: accept secondmate house vocabulary (fix: accept secondmate house vocabulary kunchenguid/firstmate#685)
• 46e4201 fix(pi): distinguish stale locks when arming watcher (fix(pi): distinguish stale locks when arming watcher kunchenguid/firstmate#681)
• 6de9278 Revert "feat: gate local agent secret injection (feat: gate local agent secret injection kunchenguid/firstmate#658)" (revert: remove blanket agent-secret injection kunchenguid/firstmate#668)
• 5bf59ba docs: adopt under way for active work (fix: align active-work wording with under way kunchenguid/firstmate#666)
• 85643ee test: isolate Herdr autodetect smoke sessions (test: isolate Herdr autodetect smoke sessions kunchenguid/firstmate#662)
• c27135c feat: gate local agent secret injection (feat: gate local agent secret injection kunchenguid/firstmate#658)
• e6f240c feat(secondmate): inherit shared captain preferences (feat(secondmate): inherit shared captain preferences kunchenguid/firstmate#656)
• 024b96b fix(bin): strip quoted blocked_by values during decision hold resolve (fix(bin): strip quoted blocked_by values during decision hold resolve kunchenguid/firstmate#654)
• 508a6b7 docs(secondmate-provisioning): clarify concise registry ownership (docs(secondmate-provisioning): clarify concise registry ownership kunchenguid/firstmate#649)
• 1346ff7 fix(bin): make bootstrap output and nudges deterministic (fix(bin): make bootstrap output and nudges deterministic kunchenguid/firstmate#646)
• a5d3652 fix: clarify captain-facing translation contract (fix: clarify captain-facing translation contract kunchenguid/firstmate#644)
• c115561 fix(bin): balance bearings landed baseline (fix(bin): balance bearings landed baseline kunchenguid/firstmate#640)
• 2406354 fix: dedupe stale watcher guard banners (fix: dedupe stale watcher guard banners kunchenguid/firstmate#637)
• 815f7af fix(bin): compact session-start backlog digest (fix(bin): compact session-start backlog digest kunchenguid/firstmate#636)
• 064aa67 fix(bin): harden PR check artifacts (fix(bin): harden PR check artifacts kunchenguid/firstmate#556)
• cd218f2 feat: add durable captain decision holds (feat: add durable captain decision holds kunchenguid/firstmate#593)
• 71db4be fix: compress Firstmate contract and enforce delivery rigor ownership (fix: compress Firstmate contract and enforce delivery rigor ownership kunchenguid/firstmate#626)
• fcb9e8a feat: establish instruction ownership foundation (feat: establish instruction ownership foundation kunchenguid/firstmate#619)
• e063ca5 chore: no-mistakes(document): Clarify yolo response ownership (chore: no-mistakes(document): Clarify yolo response ownership kunchenguid/firstmate#595)
• f8c5941 feat: support Pi max reasoning profiles (feat: support Pi max reasoning profiles kunchenguid/firstmate#537)
• 1811b89 fix(afk): make Pi escalation and return catch-up reliable (fix(afk): make Pi escalation and return catch-up reliable kunchenguid/firstmate#587)
• eb9ee2f fix: restore fleet snapshots on stock macOS Bash (fix: restore fleet snapshots on stock macOS Bash kunchenguid/firstmate#578)
• 8934c17 fix: derive bearings from authoritative secondmate state (fix: derive bearings from authoritative secondmate state kunchenguid/firstmate#555)
• 8c0d9eb fix: align Grok effort handling with 0.2.99 (fix: align Grok effort handling with 0.2.99 kunchenguid/firstmate#527)
• 85b7a29 fix: preserve secondmate routing markers in terminal sends (fix: preserve secondmate routing markers in terminal sends kunchenguid/firstmate#533)
• b708731 fix: preserve follow-up platform context after inbox cleanup (fix: preserve follow-up platform context after inbox cleanup kunchenguid/firstmate#520)
• 547acd7 fix: make bootstrap diagnostics backend-aware (fix: make bootstrap diagnostics backend-aware kunchenguid/firstmate#519)
• 2364817 fix: guard secondmate primary sessions from blind turn ends (fix: guard secondmate primary sessions from blind turn ends kunchenguid/firstmate#505)
• 6556882 fix: prevent no-mistakes gate agents from driving the fleet (fix: prevent no-mistakes gate agents from driving the fleet kunchenguid/firstmate#518)

Push main to origin, or rebase your branch onto origin/main, before gating.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; exit "$rc"
• Baseline previously passed: command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; exit "$rc"
• Merge topology and ancestry: git log --graph --decorate --oneline --parents -12 336adf705e7bdff9988ee25171bad0d770475cd5 and git merge-base --is-ancestor 63c32b32e93558caaaec11c2c170cfe4a6cbe2ee 336adf705e7bdff9988ee25171bad0d770475cd5
• Divergence and retained fork commits: git rev-list --count <fork>..<upstream>, reverse count, and git log --oneline -3 babef94800d23bc7f738ce08bb36ae8ad9236442
• Focused behavior checks: bash tests/fm-fleet-snapshot-view.test.sh, bash tests/fm-backend.test.sh, bash tests/fm-pi-watch-extension.test.sh, bash tests/fm-session-start.test.sh, bash tests/fm-spawn-dispatch-profile.test.sh, bash tests/fm-teardown.test.sh, and bash tests/fm-watcher-lock.test.sh
• Merge-resolution artifact: git show --cc --name-only --format='' 63c32b32e93558caaaec11c2c170cfe4a6cbe2ee

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.