fix(bin): sync upstream startup and lifecycle safeguards

[dnth]

Intent

Sync this firstmate fork with its upstream template by merging upstream/main into fm/upstream-sync-v1, resolving all conflicts, and shipping the result as a no-mistakes PR against origin (dnth/firstmate). This is a real 2-parent merge (fork was ~78 ahead / 5 behind), NOT a fast-forward. The 5 incoming upstream commits, all of which must land: 6f0f87f prevent remote polls from blocking session startup (kunchenguid#1754); bf01a42 bound open decision scans with incremental cursors (kunchenguid#1737); ef2c3a2 enforce latest AXI-family tool floors (kunchenguid#1733); 30b18b9 persist secondmate parent bindings for cleanup (kunchenguid#1727); 71f0b3f gate Calm built-in overrides by activation state (kunchenguid#1724). Every conflict was resolved by COMBINING both intents (keep the fork's own omp/herdr/secondmate/Pi-Calm work AND incorporate upstream's fix), never by dropping one side. Four files conflicted: (1) AGENTS.md - kept both new state-file inventory lines (fork's .omp-primary-extension-loaded marker and upstream's ..open-decisions-cursor). (2) bin/fm-teardown.sh - unioned the state-file cleanup rm list, keeping the fork's omp-ext.ts/omp-ready/omp-started removals and adding upstream's ..open-decisions-cursor removal. (3) tests/fm-watcher-lock.test.sh - kept the fork's subshell function form and EXIT-trap cleanup for the healthy-peer test and added upstream's peer_ready readiness handshake, declaring peer_ready in the locals so the auto-merged body resolves. (4) tests/fm-calm-pi-extension.test.sh, two hunks: in the renderer test kept upstream's output-file redirect (the post-heredoc consumer auto-merged to out=cat output_file) with the fork's .pi/extensions/ WATCH_EXT path where the fixture actually copies the file; in the /calm E2E redraw loop took upstream's corrected detection (scrollback capture -S -600 and waiting for the collapsed-thinking row to hide rather than for CALM_E2E_OUTPUT to vanish, because the merged activation-gated fm-calm.ts keeps pre-activation built-in tool rows visible per its documented bound) and preserved the fork's config/calm=on persistence gate. Deliberate scope constraint: the diff is limited to the merge plus conflict resolution plus any test/lint fixes the merge itself requires; no project code was changed outside the sync. Note: one local teardown test (content-landed) fails only because this host runs git 2.34.1 while the fork's content_in_default uses git merge-tree --write-tree (needs git >= 2.38); that check is byte-identical on both sides of the merge, so it is a pre-existing environment limitation unrelated to this sync, and CI runs modern git.

What Changed

• Preempt remote reply polls when interactive work arrives and use cursor-backed open-decision scans, keeping startup and wake drains bounded without losing unresolved decisions.
• Enforce current AXI-family tool floors during bootstrap and persist local or remote secondmate parent bindings so cleanup uses durable ownership data.
• Gate Pi Calm built-in overrides on activation, skip contested tool names on first enablement, and preserve the fork’s existing OMP, Herdr, secondmate, and Calm persistence behavior across the upstream merge.

Risk Assessment

✅ Low: Captain, the five upstream fixes land through the required two-parent merge, and the four conflict resolutions preserve both upstream and fork behavior without source-verifiable defects.

Testing

The merge structure, all five incoming fixes, and every conflict-resolution surface were exercised through six targeted suites, a focused teardown selector, manual CLI verification, and rendered Pi terminal evidence; all passed. Git 2.34.1 was confirmed, so the documented unrelated full-teardown merge-tree case was intentionally excluded, and one transient post-pass fixture directory was removed.

• Evidence: Calm active—operational rows hidden (local file: /tmp/no-mistakes-evidence/01KZAK2H4GF2SRRFKMZ3HY1FAX/calm-active-hidden.png)
• Evidence: Calm persisted across restart (local file: /tmp/no-mistakes-evidence/01KZAK2H4GF2SRRFKMZ3HY1FAX/calm-restarted.png)
• Evidence: Calm off—ordinary tool rows restored (local file: /tmp/no-mistakes-evidence/01KZAK2H4GF2SRRFKMZ3HY1FAX/calm-restored-off.png)

Evidence: Incremental open-decisions CLI transcript

$ bin/fm-wake-drain.sh  # initial session drain
OPEN DECISIONS (still open, folded from the durable status logs - not just the latest line):
task-demo [key=api-shape] needs-decision: pick REST or RPC

$ bin/fm-wake-drain.sh  # later empty-queue drain
OPEN DECISIONS (still open, folded from the durable status logs - not just the latest line):
task-demo [key=api-shape] needs-decision: pick REST or RPC

$ bin/fm-wake-drain.sh  # after captain decision is resolved
(no open decisions)

$ test -f state/.task-demo.open-decisions-cursor
cursor persisted

Evidence: Merge ancestry and combined conflict-resolution inventory

merge=8c9b6c83c763db51d15260d931f2cb879f9cfa94
parents=d332d316075f56eed076fc4513658ade34b5df5e 6f0f87f4ce62a31cf36bf6afb5c56aa818c6fe6b
subject=Merge upstream/main into fm/upstream-sync-v1
included 71f0b3f
included 30b18b9
included ef2c3a2
included bf01a42
included 6f0f87f

Conflict-resolution inventory:
  .omp-primary-extension-loaded  this home's OMP primary adapter identity marker; published by the adapter, validated by fm-session-start.sh, never hand-edited (docs/configuration.md "Harness support")
  .<id>.open-decisions-cursor  per-task byte cursor and folded open-decision set bounding the OPEN DECISIONS scan's cost to new status-log appends; written only by fm-classify-lib.sh's status_open_decisions_incremental, removed by teardown, safe to delete (forces one full re-fold)
  .afk               durable away-mode flag; present = sub-supervisor may inject escalations (set by /afk, cleared on user return)
rm -f "$STATE/$ID.status" "$STATE/$ID.turn-ended" "$STATE/$ID.meta" \
  "$STATE/$ID.pi-ext.ts" "$STATE/$ID.omp-ext.ts" "$STATE/$ID.omp-ready" \
  "$STATE/$ID.omp-started" \
  "$STATE/$ID.grok-turnend-token" "$STATE/$ID.kimi-turnend-token" \
  "$STATE/.$ID.open-decisions-cursor"
if [ "$KIND" != scout ] && [ "$KIND" != secondmate ] && [ "$MODE" != local-only ]; then
test_watch_restart_attaches_to_healthy_peer() (
  local dir state fakebin out peer_ready peer='' identity armpid='' status i lock_pid
  dir=$(make_case restart-healthy-peer)
  state="$dir/state"
  fakebin="$dir/fakebin"
  out="$dir/restart.out"
  peer_ready="$dir/peer.ready"
  # shellcheck disable=SC2329  # invoked indirectly by the EXIT trap below
  cleanup_restart_healthy_peer() {
    lock_pid=$(cat "$state/.watch.lock/pid" 2>/dev/null || true)
    if [ -n "$lock_pid" ] \
       && FM_HOME="$dir" FM_STATE_OVERRIDE="$state" bash -c \
         '. "$1"; fm_watcher_lock_matches_pid "$2" "$3" "$4" "$5"' \
         _ "$LIB" "$state" "$WATCH" "$lock_pid" "$dir"; then
      kill "$lock_pid" 2>/dev/null || true
    fi
    [ -z "$armpid" ] || kill "$armpid" 2>/dev/null || true
    [ -z "$peer" ] || kill -KILL "$peer" 2>/dev/null || true
    [ -z "$armpid" ] || wait "$armpid" 2>/dev/null || true
    [ -z "$peer" ] || wait "$peer" 2>/dev/null || true
  }
  trap cleanup_restart_healthy_peer EXIT
  mark_pr_check_migration_complete "$state"
  node -e 'const fs = require("node:fs"); process.on("SIGTERM", () => {}); fs.writeFileSync(process.argv[1], "ready\n"); setTimeout(() => {}, 300000)' "$peer_ready" &
  peer=$!
  i=0
  while [ "$i" -lt 50 ] && [ ! -s "$peer_ready" ]; do
    sleep 0.1

- Evidence: Targeted test evidence directory (local file: /tmp/no-mistakes-evidence/01KZAK2H4GF2SRRFKMZ3HY1FAX)

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• git show -s --format='%H%nparents:%P%nsubject:%s' HEAD and git merge-base --is-ancestor <incoming> HEAD for all five required commits
• bash tests/fm-wake-drain-open-decisions-cursor.test.sh
• bash tests/fm-remote-job.test.sh
• bash tests/fm-remote-secondmate-parent-binding.test.sh
• bash tests/fm-bootstrap.test.sh
• bash tests/fm-calm-pi-extension.test.sh
• bash tests/fm-watcher-lock.test.sh
• Focused test_no_mistakes_origin_remote_allows extraction from tests/fm-teardown.test.sh
• Manual repeated bin/fm-wake-drain.sh session demonstrating a buried decision persists across empty drains, clears after resolution, and persists its cursor
• Rendered and inspected Pi terminal captures for Calm active, restart persistence, and Calm-off restoration
• Checked git status --short, evidence inventory, and removal of transient test fixtures

✅ **Document** - passed

✅ No issues found.

⚠️ **Lint** - 1 warning

• ⚠️ linter found issues (exit code 127)

✅ **Push** - passed

✅ No issues found.