Merge upstream template up to a7e01bc (43 commits)

[samchu8]

Merge upstream template up to a7e01bc (43 commits)

Brings the fork up to date with kunchenguid/firstmate as far as is safe, stopping deliberately short of the commit that breaks brief generation on this machine.

origin/main is 2 ahead of upstream as well as behind, so this is structurally a merge, not a fast-forward. The fast-forward-only rule governs the home ← origin leg and is untouched by this.

Two corrections to the assessment this implements

The scout report (data/firstmate-upstream-gap/report.md) was written earlier and two of its load-bearing facts did not survive re-verification:

Report claim	Measured
a7e01bc is ec09871^, so it is 44 of 71 commits	ec09871^ is 6b0d21d. a7e01bc sits 7 commits earlier and brings 43, leaving 28 behind.
Stopping at a7e01bc "should therefore merge clean"	False. 2 of the 3 conflicts remain. Only bin/fm-brief.sh — the one that mattered most — auto-merged.

The conflicts do not all trace to ec09871. CONTRIBUTING.md conflicts via six test-infrastructure commits (b843c66, f02eef1, 622d467, f6c281a, 673b6ad, bd43c73); tests/fm-brief.test.sh conflicts via a7e01bc itself plus ea3ac2e, 3729081, bc1a21b.

The report's core recommendation still held: a7e01bc parses, ec09871 does not, and the absorb fix is included.

Verification — all four mandatory gates passed

Gate	Result
/bin/bash -n bin/fm-brief.sh under stock Bash 3.2.57	pass — and 0 parse failures across all 88 bin/*.sh + bin/backends/*.sh
Real brief generated end-to-end	pass — ship, scout, secondmate charter, and filled-pre-flight variants; 92 lines, all sections, no leaked placeholders beyond the intended {TASK}
tests/fm-brief.test.sh	pass 20/20, including both sides' newly added tests
Full suite (bin/fm-test-run.sh --all)	95 scripts, 1583 passing, 3 failing — all pre-existing, see below
bin/fm-lint.sh (ShellCheck 0.11.0 pinned)	clean

Confirmed the breakage boundary directly rather than trusting it:

origin/main      PARSE OK
a7e01bc          PARSE OK      <- merged to here
ec09871          PARSE FAIL: line 314: unexpected EOF while looking for matching `)'
upstream/main    PARSE FAIL: line 314: unexpected EOF while looking for matching `)'

The 3 suite failures are not from this merge

Each was reproduced against a pristine a7e01bc tree extracted with git archive:

Test	Pre-merge (origin/main)	Pristine a7e01bc	Cause
fm-gate-refuse.test.sh	already failing	failing	This machine's system Ruby 2.6 cannot require "yaml" at all — psych is broken. Environmental.
fm-nm-test-contract.test.sh	test did not exist	failing	Same broken Ruby. New test arriving from upstream.
fm-backend-orca.test.sh	passing	failing	Upstream defect imported by the merge — fm-spawn --backend orca no longer fails when metadata cannot be written. Not a resolution artifact; reproduces on untouched upstream code. Deferred as out of scope.

Resolved hunks — every one, explicitly

All three resolved by merging intent. Our round-discipline content survives in full.

1. CONTRIBUTING.md — one hunk, 5 lines vs 4.
Kept our fork's sentence bin/fm-brief.sh adds firstmate's version-independent gate-response policy only to no-mistakes ship briefs. and our That wrapper also routes ask-user findings... sentence. Took upstream's fuller lead sentence and both of its .no-mistakes.yaml sentences, because upstream's are now the factually correct ones: the merged .no-mistakes.yaml (which we never edited, so it took upstream's version wholesale) drops commands.test and pins only commands.lint. Our old prose describing a pinned portable-behavior command had become stale against the file it describes.

Behavior change worth noting: local no-mistakes Test is now intent-targeted rather than a full tests/*.test.sh walk. CI owns broad regression. The full suite in this PR was run manually.

2. tests/fm-brief.test.sh, DOD-wording hunk — 4 lines vs 9. Kept ours.
Traced the line across all three refs first. Base 6de9278 and upstream a7e01bc are identical here; only our cf13c9b changed it. So bin/fm-brief.sh auto-merged to our wording correctly, and upstream's three assertions (no-mistakes itself provides for the mechanics, `no-mistakes axi run --help`, `help`) would have asserted against text the generator no longer emits. Upstream's actual intent — that the DOD point at no-mistakes' own installed guidance with literal backticks and no apostrophe artifact — is preserved by our assertion plus the assert_no_grep "no-mistakes' own guidance" guard that both sides already share.

3. tests/fm-brief.test.sh, new-tests hunk — 96 lines vs 19. Kept both sides.
Not a semantic conflict at all: both sides appended different new test functions at the same file position. Ours (pre-flight section ×3, blast-radius framing ×1) and upstream's (test_scout_and_secondmate_scaffold) all survive. The runner list at the bottom of the file had already auto-merged to include all of them.

AGENTS.md auto-merged with all four of our fork lines intact (verified individually): the gate-response policy, the blast-radius line, the pre-flight harvest, and the pre-flight recording instruction.

The headline fix — and exactly what it covers

ab8cea6 "fix(watcher): bound stale wakes for parked crew (kunchenguid#743)" is included. As the report said, crew_absorb_class is byte-identical between us and upstream; the fix is in the caller, pause_state_class in bin/fm-watch.sh.

Against our two live cases, it is a partial fix. Evaluated the merged predicate against the real status lines:

Live case	Status verb	Covered?
Work parked awaiting a captain decision (spec31d-impl)	needs-decision	No.
Validation run parked (crew-absorb-cancelled-run)	paused	Only once the agent is confirmed gone.

status_is_paused_or_captain_held admits exactly two verbs — paused and captain-held. A needs-decision: line is rejected at the gate and early-returns straight into crew_absorb_class, which returns none; the new dead-agent upgrade sits downstream of that early return and never executes. So our most expensive case — a worker parked on a captain decision — is untouched by this fix.

For the paused: case the fix engages, but only via [ "$class" = none ] && [ "$agent_alive" = dead ] && class=paused. Note the merge also adds an earlier short-circuit: for a non-secondmate window whose agent reads alive-or-unknown, pause_state_class now returns none where our current code returned paused unconditionally in the fresh-recheck branch. For a live idle pane this is slightly more surfacing than today, not less. The gain is confined to the dead-agent tail.

Net: upstream handles the dead-agent tail; it does not declare the wait at the source. crew-absorb-cancelled-run (currently held) is not made redundant — the captain's choice between the two implementations still stands, and this merge does not pre-empt it.

The other 42 commits, by area

skills/ — the public installer surface — is completely unchanged (0 commits), as the report found.

Of the four surfaces a running firstmate loads:

Surface	Commits	Delta
bin/	35	50 files, +7966 −640
.agents/skills/	16	8 files, +158 −44
AGENTS.md	14	+20 −14
skills/	0	—

Non-loaded: tests/ 55 files (+12122), docs/ 25 files (+1802), .github/ 2 files (+264).

Supervision and watcher robustness (the largest and most relevant cluster) — bounded stale wakes for parked crew; ordinary-vs-recovery wake distinction; enriched drained signals with bounded status context; AFK idle stalls and stale run attribution; continuous supervision across child cycles; safe teardown during watcher recovery; watcher process identity immune to Linux wall-clock changes.

Harness breadth — pi session-local Calm mode and its follow-ups (transcript rendering, duplicate replies, stale lock handling, redundant re-arms); Grok exit guidance; opencode busy-queued composer state; canonical operational-input classification across harnesses.

Delivery and forge — GitLab merge requests followed to merge; current PR head fetched for review diffs; every PR body compliance event executed.

Test infrastructure (most of the +12122) — canonical timed runner (bin/fm-test-run.sh), portable shards with bounded local parallelism, concurrent isolation proof, pinned real-Herdr CI coverage.

Herdr — optional presentation spaces, ordering while preserving focus, projected children grouped under owning parents.

Other — quota-aware dispatch profiles; built-in ahoy recap skill (new); Bearings partial-snapshot and main-inventory fixes; secondmate report guards and vocabulary; X-mode pending-mention dedupe.

14 new bin/ scripts and 1 new skill (ahoy) arrive. Note quota-axi becomes a bootstrap tool — already installed here, so no new dependency blocker.

Two things landing that deserve the captain's eye before merge

1. Primary-session delegation fence (50cc24a, kunchenguid#854). The report described this as a permissions.deny list removing 18 tools from the tracked .claude/settings.json. That is not what lands. The tracked settings gain hooks only (+24 lines, no permissions block); the script's own header states the deny list "must not be tracked". Enforcement is a runtime PreToolUse hook, bin/fm-subagent-pretool-check.sh, which denies delegation-shaped tool names by substring — the shipped stem list is agent subagent task workflow cron schedul worktree delegate spawn dispatch handoff remote sendmessage monitor — while exempting observe/stop tools so runaway work can always be inspected or ended.

It is scoped to a genuine primary home (crew worktrees unaffected) and has an FM_ALLOW_SUBAGENT=1 escape hatch. Why it still matters: this home's /pr-review, /implement, /spec-discuss, /merge-train, and /followups fan out sub-agents, and data/captain.md puts the pr-review↔implement loop at the centre of the delivery model. Whether that loop can still run from the primary session is the captain's call, not something this merge should decide silently.

Also arriving on the same surface: a SessionStart nudge hook and a fm-continuity-pretool-check.sh on the Bash matcher.

2. Upstream issue kunchenguid#1188 — watchers and daemons stranded unhealthy after crossing the fm_pid_identity format change (a26b37c). That commit is inside this range. Worth confirming the supervision chain comes back healthy after the home picks this up.

What this does not do

Stops 28 commits behind upstream. Closing the rest requires upstream's Bash 3.2 fix for bin/fm-brief.sh to land first — four competing PRs are open on issue kunchenguid#1179 (kunchenguid#1200, kunchenguid#1199, kunchenguid#1198, and others), none merged. No commits were cherry-picked; this is one contiguous merge, so no third divergence lineage is created.