feat: replay inactive terminal outcomes

.github/workflows/ci.yml

@@ -45,6 +45,7 @@ jobs:
         run: |
           set -eu
           bash tests/fm-worker-isolation.test.sh
+          bash tests/fm-inactive-outcome.test.sh
           bash tests/fm-watch-session.test.sh
           bash tests/fm-slot-occupant-proof.test.sh
           FM_TEARDOWN_TEST_FOCUS=s1 bash tests/fm-teardown.test.sh

AGENTS.md

@@ -81,11 +81,13 @@ data/                personal fleet records; LOCAL, gitignored as a whole
   <id>/brief.md      per-task crewmate brief, or per-secondmate charter brief when kind=secondmate
   <id>/report.md     scout task deliverable, written by the crewmate; survives teardown
 projects/            cloned repos; gitignored; READ-ONLY for you
-state/               volatile runtime signals; gitignored
+state/               gitignored operational state: volatile runtime signals plus durable local inactive-outcome receipts
   <id>.status        appended by crewmates: "<state>: <note>" wake-event lines, not current-state truth
   <id>.turn-ended    touched by turn-end hooks
-  <id>.meta          written by fm-spawn: window=, worktree=, project=, harness=, kind=, mode=, yolo=; kind=secondmate also records home= and projects= (fm-pr-check appends pr= and verified pr_head= when available)
+  <id>.meta          written by fm-spawn: window=, worktree=, project=, harness=, kind=, mode=, yolo=, and spawn_incarnation=; no-mistakes ship tasks also carry the run-binding handoff/state and, after binding, run_id=; kind=secondmate also records home= and projects= (fm-pr-check appends pr= and verified pr_head= when available)
   <id>.check.sh      optional slow poll you write per task (e.g. merged-PR check)
+  terminal-outcomes/ fingerprinted local inactive terminal-outcome receipts; the locked wake drain is the only path that presents and acknowledges them
+  .inactive-outcome-* bounded scan, claim, cursor, and retry state; never touch
   x-watch.check.sh   generated X-mode relay poll shim; present only when opted in (section 14)
   x-inbox/           generated X-mode pending mention payloads; fmx-respond drains it (section 14)
   x-outbox/          generated X-mode dry-run reply previews; inspect it when FMX_DRY_RUN is set (section 14)
@@ -393,7 +395,7 @@ If one pair fails, the rest still run and the batch exits non-zero.
 The script resolves the harness (`fm-harness.sh crew`), owns the verified launch templates, resolves the project's delivery mode (`fm-project-mode.sh`) for ship/scout tasks, and records `harness=`, `kind=`, `mode=`, and `yolo=` in the task's meta; a non-flag third argument containing whitespace is treated as a raw launch command (only for verifying new adapters).
 For `kind=secondmate`, the same script launches in the registered or explicit firstmate home instead of running `treehouse get` for a project, records `home=` and `projects=`, and uses the charter brief as the launch prompt.
 
-For ship and scout tasks, the script creates the window (in your current tmux session, or a dedicated `firstmate` session when you are outside tmux), runs `treehouse get`, waits for the worktree subshell, asserts the resolved worktree is a genuine isolated worktree distinct from the primary checkout (aborting the spawn otherwise, to prevent the worktree tangle of section 8), installs the turn-end hook, records `state/<id>.meta`, and launches the agent with the brief.
+For ship and scout tasks, the script creates the window (in your current tmux session, or a dedicated `firstmate` session when you are outside tmux), runs `treehouse get`, waits for the worktree subshell, asserts the resolved worktree is a genuine isolated worktree distinct from the primary checkout (aborting the spawn otherwise, to prevent the worktree tangle of section 8), installs the turn-end hook, records `state/<id>.meta`, and launches the agent with the brief. No-mistakes ship spawns install a task-local command bridge in the child PATH; when the child invokes `no-mistakes axi run`, the bridge captures the actual returned run ID and publishes its binding under the existing task lock before the command can continue. Ship spawns never fabricate or infer a run ID, and refuse to launch if this handoff cannot be installed.
 For `kind=secondmate`, the script creates the same kind of window but starts directly in the persistent home.
 Before launching a secondmate, the script fast-forwards its home worktree to firstmate's own current default-branch commit, so a freshly spawned or recovery-respawned secondmate always starts on firstmate's current version.
 This is a purely local fast-forward of tracked files - never a fetch from origin, and never touching the gitignored operational dirs - so the secondmate's backlog, projects, and any prior in-flight work are untouched; a dirty, diverged, or in-flight home is left as-is and launches unchanged.

bin/backends/herdr.sh

@@ -358,6 +358,7 @@ fm_backend_herdr_server_ensure() {  # <session>
   local session=$1 running out i
   running=$(fm_backend_herdr_cli "$session" status --json 2>/dev/null | jq -r '.server.running // false' 2>/dev/null)
   [ "$running" = "true" ] && return 0
+  [ "${FM_BACKEND_HERDR_NO_SERVER_START:-0}" = 1 ] && return 1
   ( fm_backend_herdr_cli "$session" server >/dev/null 2>&1 & ) || return 1
   for i in $(seq 1 20); do
     running=$(fm_backend_herdr_cli "$session" status --json 2>/dev/null | jq -r '.server.running // false' 2>/dev/null)

bin/fm-crew-state.sh

@@ -59,6 +59,14 @@ STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
 . "$SCRIPT_DIR/fm-backend.sh"
 # shellcheck source=bin/fm-numeric-lib.sh
 . "$SCRIPT_DIR/fm-numeric-lib.sh"
+# shellcheck source=bin/fm-wake-lib.sh
+FM_SESSION_LOCK_BOOTSTRAP=1
+FM_WAKE_LIB_NO_INIT=1
+. "$SCRIPT_DIR/fm-wake-lib.sh"
+# shellcheck source=bin/fm-run-step-lib.sh
+FM_RUN_STEP_READ_ONLY=1
+. "$SCRIPT_DIR/fm-run-step-lib.sh"
+trap 'fm_run_step_binding_release_held >/dev/null 2>&1 || true' EXIT
 
 ID=${1:-}
 [ -n "$ID" ] || { echo "usage: fm-crew-state.sh <id>" >&2; exit 2; }
@@ -368,6 +376,62 @@ nm_run_ids_for_branch() {  # <branch> <list-output>
 # CREW_BRANCH is empty at detached HEAD (a just-spawned crew, or a scout's
 # scratch worktree); with no branch there is no run to attribute to this crew.
 CREW_BRANCH=$(git -C "$WT" symbolic-ref --quiet --short HEAD 2>/dev/null || true)
+META_INCARNATION=$(awk -F= '$1 == "spawn_incarnation" { print substr($0, index($0, "=") + 1); n++ } END { exit(n == 1 ? 0 : 1) }' "$META" 2>/dev/null || true)
+META_SPAWN_STATE=absent
+META_SPAWN_STATE_COUNT=0
+META_BINDING_STATE=absent
+META_BINDING_STATE_COUNT=0
+while IFS= read -r META_BINDING_LINE; do
+  case "$META_BINDING_LINE" in
+    spawn_state=*)
+      META_SPAWN_STATE_COUNT=$((META_SPAWN_STATE_COUNT + 1))
+      META_SPAWN_STATE=${META_BINDING_LINE#*=}
+      ;;
+    run_binding_state=*)
+      META_BINDING_STATE_COUNT=$((META_BINDING_STATE_COUNT + 1))
+      META_BINDING_STATE=${META_BINDING_LINE#*=}
+      ;;
+  esac
+done < "$META"
+if [ "$META_SPAWN_STATE_COUNT" -ne 0 ]; then
+  [ "$META_SPAWN_STATE_COUNT" = 1 ] || META_SPAWN_STATE=invalid
+  case "$META_SPAWN_STATE" in
+    starting|aborted) ;;
+    *) META_SPAWN_STATE=invalid ;;
+  esac
+fi
+if [ "$META_BINDING_STATE_COUNT" -ne 0 ]; then
+  [ "$META_BINDING_STATE_COUNT" = 1 ] || META_BINDING_STATE=invalid
+  case "$META_BINDING_STATE" in
+    pending|staged|bound) ;;
+    *) META_BINDING_STATE=invalid ;;
+  esac
+fi
+BOUND_RUN_ID=
+BOUND_RUN_STATUS=75
+BOUND_RUN_REQUIRED=0
+BOUND_RUN_EVIDENCE=$(fm_run_step_binding_path "$ID") || exit 1
+if [ -e "$BOUND_RUN_EVIDENCE" ] || [ -L "$BOUND_RUN_EVIDENCE" ]; then
+  BOUND_RUN_REQUIRED=1
+fi
+case "$META_BINDING_STATE" in
+  pending|bound|staged|invalid) BOUND_RUN_REQUIRED=1 ;;
+esac
+case "$META_SPAWN_STATE" in
+  starting|aborted|invalid) BOUND_RUN_REQUIRED=1 ;;
+esac
+if [ "$KIND" = ship ] && [ -n "$CREW_BRANCH" ] && [ -n "$META_INCARNATION" ]; then
+  if fm_run_step_binding_read_held "$ID" "$META_INCARNATION"; then
+    BOUND_RUN_ID=$FM_RUN_STEP_HELD_VALUE
+    BOUND_RUN_STATUS=0
+  else
+    BOUND_RUN_STATUS=$?
+  fi
+  [ "$BOUND_RUN_STATUS" = 1 ] && {
+    printf '%s\n' 'state: unknown · source: run-step · incarnation binding could not be read' >&2
+    exit 1
+  }
+fi
 
 # A branch match is not enough when branch names are reused. Accept a run only
 # when its recorded head is the local worktree HEAD, or a descendant of that
@@ -387,30 +451,49 @@ HAVE_RUN=0
 # Scouts and secondmates never drive a no-mistakes validation of their own
 # worktree, so skip the lookup for them and read state from pane/log directly.
 if [ "$KIND" = ship ] && [ -n "$CREW_BRANCH" ] && command -v no-mistakes >/dev/null 2>&1; then
-  RUN_OUT=$(nm_run axi status)
-  if [ -n "$RUN_OUT" ]; then
-    run_branch=$(strip_quotes "$(nm_field branch)")
-    if [ -n "$run_branch" ] && [ "$run_branch" = "$CREW_BRANCH" ] && nm_run_head_matches_worktree; then
-      HAVE_RUN=1
+  if [ "$BOUND_RUN_STATUS" = 0 ] || [ "$BOUND_RUN_REQUIRED" = 1 ]; then
+    BOUND_RUN_REQUIRED=1
+    if [ "$BOUND_RUN_STATUS" = 0 ]; then
+      RUN_OUT=$(nm_run axi status --run "$BOUND_RUN_ID")
+      run_id=$(strip_quotes "$(nm_field id)")
+      run_branch=$(strip_quotes "$(nm_field branch)")
+      if [ "$run_id" = "$BOUND_RUN_ID" ] && [ "$run_branch" = "$CREW_BRANCH" ] \
+        && nm_run_head_matches_worktree; then
+        HAVE_RUN=1
+      else
+        RUN_OUT=
+      fi
     else
-      # The active-or-most-recent run is for another branch, or its branch name
-      # matches but its code identity does not. Inspect bounded recent runs for
-      # this branch until one is compatible with the worktree.
-      list_out=$(nm_run axi)
-      candidate_ids=$(nm_run_ids_for_branch "$CREW_BRANCH" "$list_out")
-      while IFS= read -r rid; do
-        [ -n "$rid" ] || continue
-        RUN_OUT=$(nm_run axi status --run "$rid")
-        run_branch=$(strip_quotes "$(nm_field branch)")
-        if [ "$run_branch" = "$CREW_BRANCH" ] && nm_run_head_matches_worktree; then
-          HAVE_RUN=1
-          break
-        fi
-      done <<< "$candidate_ids"
+      RUN_OUT=
+    fi
+  else
+    RUN_OUT=$(nm_run axi status)
+    if [ -n "$RUN_OUT" ]; then
+      run_branch=$(strip_quotes "$(nm_field branch)")
+      if [ -n "$run_branch" ] && [ "$run_branch" = "$CREW_BRANCH" ] && nm_run_head_matches_worktree; then
+        HAVE_RUN=1
+      else
+        # The active-or-most-recent run is for another branch, or its branch name
+        # matches but its code identity does not. Inspect bounded recent runs for
+        # this branch until one is compatible with the worktree.
+        list_out=$(nm_run axi)
+        candidate_ids=$(nm_run_ids_for_branch "$CREW_BRANCH" "$list_out")
+        while IFS= read -r rid; do
+          [ -n "$rid" ] || continue
+          RUN_OUT=$(nm_run axi status --run "$rid")
+          run_branch=$(strip_quotes "$(nm_field branch)")
+          if [ "$run_branch" = "$CREW_BRANCH" ] && nm_run_head_matches_worktree; then
+            HAVE_RUN=1
+            break
+          fi
+        done <<< "$candidate_ids"
+      fi
     fi
   fi
 fi
 
+[ "$HAVE_RUN" = 1 ] || [ "$BOUND_RUN_REQUIRED" = 0 ] || emit unknown run-step "bound run unavailable"
+
 # --- run-step authoritative path -------------------------------------------
 
 if [ "$HAVE_RUN" = 1 ]; then
@@ -530,6 +613,38 @@ if [ "$HAVE_RUN" = 1 ]; then
     RUN_DETAIL="$RUN_DETAIL${SEP}convergence-round=$convergence_round${SEP}convergence-fingerprint=unavailable"
   fi
 
+  run_id=$(strip_quotes "$(nm_field id)")
+  run_step_id_count=$(grep -c '^run_step_id=' "$META" 2>/dev/null || true)
+  run_step_id=
+  if [ "$run_step_id_count" = 1 ]; then
+    run_step_id=$(grep '^run_step_id=' "$META" 2>/dev/null | cut -d= -f2- || true)
+  fi
+  incarnation=$(awk -F= '$1 == "spawn_incarnation" { print substr($0, index($0, "=") + 1); n++ } END { exit(n == 1 ? 0 : 1) }' "$META" 2>/dev/null || true)
+  case "$RUN_STATE" in
+    done|failed)
+      case "$run_step_id_count" in
+        0) run_step_id_matches_meta=1 ;;
+        1) [ "$run_step_id" = "$run_id" ] && run_step_id_matches_meta=1 || run_step_id_matches_meta=0 ;;
+        *) run_step_id_matches_meta=0 ;;
+      esac
+      if [ "$run_step_id_matches_meta" != 1 ] || [ -z "$run_id" ] || [ -z "$incarnation" ]; then
+        printf '%s\n' 'state: unknown · source: run-step · incarnation binding unavailable' >&2
+        exit 75
+      fi
+      fm_run_step_binding_validate "$ID" "$run_id" "$incarnation" || {
+        status=$?
+        printf '%s\n' 'state: unknown · source: run-step · incarnation binding unavailable' >&2
+        [ "$status" = 75 ] && exit 75
+        exit 1
+      }
+      ;;
+  esac
+  case "$RUN_STATE" in
+    working|parked|paused|done|failed)
+      [ -n "$run_id" ] && RUN_DETAIL="$RUN_DETAIL${SEP}run-id=$run_id"
+      ;;
+  esac
+
   emit "$RUN_STATE" run-step "$RUN_DETAIL"
 fi