fix: preserve supervision continuity and run attribution

[eyevanovich]

Intent

Port the approved upstream supervision-continuity and AFK/current-run-attribution end state onto the current Firstmate fork. Add bounded one-owner successor cycles for Pi and OpenCode, Claude Stop-owned auto-arm with shared session-lock identity and bounded block cooperation, structured AFK terminal classification with independent wedge aging, and exact code/head-bound no-mistakes run attribution. Preserve PR #13/#14 security, authority, observer, delegation, signing, GitLab, and canonical FIRSTMATE_OP behavior; keep Codex and Grok continuity unchanged; include genuine secondmate primaries while excluding child task copies and observer/daemon/diagnostic/unrelated windows. Use the pre-calm Pi implementation and do not introduce unavailable calm dependencies or the rejected upstream command-gate change. Update ownership docs and add hermetic plus current-version live verification, reporting Claude authentication as a blocker rather than claiming success.

What Changed

• Add bounded, single-owner watcher successor cycles for Pi and OpenCode, plus Claude Stop-owned auto-arm coordinated through verified session-lock identity and bounded turn-end recovery.
• Make AFK terminal classification and wedge aging independent, and bind no-mistakes run attribution to both branch and commit ancestry.
• Extend primary-session scoping, lifecycle diagnostics, documentation, and hermetic/live coverage while preserving Codex and Grok continuity.

Risk Assessment

✅ Low: The follow-up binds auto-arm ownership to process identity and scopes successor-cycle behavior to Pi, OpenCode, and Claude while preserving Grok’s default one-cycle semantics, with no remaining material source issue identified.

Testing

Completed 1 recorded test check.

• Outcome: ⚠️ 1 error across 2 runs (1h2m47s)

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 2 issues found → auto-fixed ✅

• 🚨 bin/fm-turnend-guard.sh:180 - The Claude guard treats any live process with the PID recorded in .claude-autoarm.lock as proof that recovery is underway. If an auto-arm process dies without releasing the lock and its PID is reused, fm_lock_try_acquire also refuses the stale lock, while this guard indefinitely allows stops with no watcher. Bind generic lock ownership to process identity, as watcher locks already do, and verify that identity at this shared lock boundary.
• 🚨 bin/fm-watch-arm.sh:261 - The required criterion says to “keep Codex and Grok continuity unchanged,” but the shared arm wrapper used by Grok now follows successor watchers and converts an attached cycle ending without a successor from a clean completion into a nonzero failure. This changes Grok’s documented re-arm/notification behavior; scope the new successor semantics to Pi/OpenCode (and Claude where intended), or obtain explicit approval to change Grok continuity.

🔧 Fix: Bind auto-arm identity and preserve Grok continuity
✅ Re-checked - no issues remain.

⚠️ **Test** - 1 error

• 🚨 tests failed with exit code 1
• command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; exit "$rc"

🔧 Fix: Bound recursive lock stealing and stabilize identity mocks
1 error still open:

• 🚨 tests failed with exit code 1
• command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; exit "$rc"

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.