fix: restore numeric helper library

.agents/skills/afk/SKILL.md

@@ -212,3 +212,4 @@ These properties must hold:
 `FM_INJECT_SKIP` (default `heartbeat`) force-self-handles matching kinds,
 overriding classification.
 Use it sparingly.
+

.agents/skills/fmx-respond/SKILL.md

@@ -150,3 +150,4 @@ Inspect `state/x-outbox/` to see exactly what would have been posted.
 - Never inline mention-influenced reply text into a shell command; always go through `--text-file` or stdin.
 - The reply length authority is the relay (it trims), but a tight reply is on you.
 - Never edit `bin/fm-x-poll.sh`, `bin/fm-x-reply.sh`, or the watcher to "answer faster"; the cadence is handled in bootstrap.
+

.agents/skills/harness-adapters/SKILL.md

@@ -116,3 +116,4 @@ The decision persists per path in `~/.pi/agent/trust.json`, so later spawns in t
 `fm-spawn` keeps the turn-end extension in `state/`, outside the worktree, because project-local extension files make the trust gate strictly worse and pollute the project.
 The extension must listen for pi's `turn_end` event, not `agent_end`, so the watcher wakes after each completed turn instead of only when the whole agent run exits.
 Pi sets `PI_CODING_AGENT=true` for its children; this is its harness-detection env marker.
+

.agents/skills/secondmate-provisioning/SKILL.md

@@ -114,3 +114,4 @@ If `treehouse return` fails for a leased home, teardown stops with state intact
 With `--force`, teardown is the explicit discard path.
 It kills child windows, discards child work and state inside the secondmate home, removes the route, releases the lease, and removes the retired secondmate home.
 Never use `--force` unless the captain explicitly said to discard the work.
+

.agents/skills/stuck-crewmate-recovery/SKILL.md

@@ -22,3 +22,4 @@ Escalate in order:
    A low context reading is not wedging; modern harnesses auto-compact and keep going.
    The worktree and commits persist, so relaunch is cheap.
 5. If a second relaunch fails too, write `failed` to the backlog and tell the captain with evidence.
+

.agents/skills/updatefirstmate/SKILL.md

@@ -54,3 +54,4 @@ This touches only the firstmate repo and its own worktrees, never anything under
 - **Secondmates are never disrupted.**
   A secondmate gets a tracked-files fast-forward (safe while it is mid-task, since its work lives in gitignored operational dirs and separate project worktrees) plus a gentle re-read nudge.
   It is never torn down, interrupted, or forced.
+

.github/workflows/ci.yml

@@ -15,29 +15,59 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - run: shellcheck bin/*.sh tests/*.sh
+      - name: Install pinned ShellCheck
+        run: |
+          set -eu
+          bin/fm-install-shellcheck.sh "$RUNNER_TEMP/bin"
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+      - run: bin/fm-lint.sh
 
   tests:
     name: Behavior tests
     runs-on: ubuntu-latest
-    # The suite should finish in ~2-3 minutes; this generous cap fails loudly on a
-    # hung watcher or tmux test instead of riding GitHub's 360-minute default.
-    timeout-minutes: 15
+    timeout-minutes: 25
     steps:
       - uses: actions/checkout@v6
-      - name: Require tmux for e2e tests
+      - name: Install pinned ShellCheck
+        run: |
+          set -eu
+          bin/fm-install-shellcheck.sh "$RUNNER_TEMP/bin"
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+      - name: Require tmux for focused endpoint tests
         run: |
           set -eu
           command -v tmux >/dev/null || {
-            echo "::error::tmux is required for real afk injection e2e coverage"
+            echo "::error::tmux is required for focused endpoint tests"
             exit 1
           }
           tmux -V
-      - run: |
+      - name: Run focused isolation and slot tests
+        run: |
+          set -eu
+          bash tests/fm-worker-isolation.test.sh
+          bash tests/fm-watch-session.test.sh
+          bash tests/fm-slot-occupant-proof.test.sh
+          FM_TEARDOWN_TEST_FOCUS=s1 bash tests/fm-teardown.test.sh
+
+  macos-stock-bash:
+    name: Stock macOS Bash pooled-slot compatibility
+    runs-on: macos-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v6
+      - name: Run pooled-slot checks with stock Bash
+        shell: /bin/bash {0}
+        env:
+          PATH: /bin:/usr/bin:/usr/sbin:/sbin:/usr/local/bin:/opt/homebrew/bin
+        run: |
           set -eu
-          for test_script in tests/*.test.sh; do
-            "$test_script"
-          done
+          case "$BASH_VERSION" in
+            3.2.57*) ;;
+            *) echo "::error::expected stock macOS Bash 3.2.57, got $BASH_VERSION"; exit 1 ;;
+          esac
+          /bin/bash --version | head -1
+          /bin/bash -n bin/fm-slot-owner-lib.sh
+          /bin/bash tests/fm-worker-isolation.test.sh
 
   invariants:
     name: Repo invariants

.github/workflows/no-mistakes-required.yml

@@ -1,4 +1,5 @@
 name: Require no-mistakes
+run-name: "PR #${{ github.event.pull_request.number }} body compliance - ${{ github.event.action }} - event ${{ github.run_number }} (run ${{ github.run_id }})"
 
 on:
   pull_request:
@@ -8,9 +9,14 @@ on:
 
 permissions:
   contents: read
+  pull-requests: read
 
+# GitHub concurrency groups retain at most one pending run, replacing older
+# pending runs even when cancel-in-progress is false. Give body-bearing events
+# an immutable per-event group so first-time-fork approvals can never collapse
+# opened/edited checks. Keep synchronize/reopened coalescing as before.
 concurrency:
-  group: no-mistakes-required-${{ github.event.pull_request.number }}
+  group: no-mistakes-required-${{ github.event.pull_request.number }}-${{ (github.event.action == 'opened' || github.event.action == 'edited') && github.run_id || 'head-change' }}
   cancel-in-progress: true
 
 jobs:
@@ -26,13 +32,30 @@ jobs:
           PR_BODY: ${{ github.event.pull_request.body }}
           PR_AUTHOR: ${{ github.event.pull_request.user.login }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           set -eu
           marker='Updates from [git push no-mistakes](https://github.com/kunchenguid/no-mistakes)'
-          if printf '%s' "${PR_BODY:-}" | grep -qF -- "$marker"; then
+          has_marker() {
+            printf '%s' "$1" | grep -qF -- "$marker"
+          }
+          if has_marker "${PR_BODY:-}"; then
             echo "Found no-mistakes signature in PR #${PR_NUMBER} body."
             exit 0
           fi
+          # no-mistakes can push the branch and write the pipeline body close
+          # together; the pull_request payload can briefly lag the live body.
+          deadline=$(( $(date +%s) + 90 ))
+          while :; do
+            live_body=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}" --jq .body 2>/dev/null || true)
+            if has_marker "$live_body"; then
+              echo "Found no-mistakes signature in live PR #${PR_NUMBER} body."
+              exit 0
+            fi
+            now=$(date +%s)
+            [ "$now" -lt "$deadline" ] || break
+            sleep 5
+          done
           {
             echo "::error::This PR was not raised through no-mistakes."
             echo

.gitignore

@@ -4,6 +4,8 @@ data/
 .no-mistakes/
 .lavish/
 .DS_Store
+/.fm-secondmate-home
 .env
-config/crew-harness
-config/x-mode.env
+/config/
+/reports/
+/backups/

.no-mistakes.yaml

@@ -1,4 +1,15 @@
 # Per-repo no-mistakes overrides.
+
+# Gate agents must not load firstmate's project-level captain instructions. The
+# lifecycle entrypoints also refuse the stamped gate marker and gate-repo path.
+disable_project_settings: true
+
+# Run the focused isolation and endpoint tests through the local runner instead
+# of delegating to an agent.
+commands:
+  lint: 'bin/fm-install-shellcheck.sh "${TMPDIR:-/tmp}/fm-shellcheck-$$/bin" && PATH="${TMPDIR:-/tmp}/fm-shellcheck-$$/bin:$PATH" bin/fm-lint.sh'
+  test: 'bash tests/fm-worker-isolation.test.sh && bash tests/fm-watch-session.test.sh && bash tests/fm-slot-occupant-proof.test.sh && FM_TEARDOWN_TEST_FOCUS=s1 bash tests/fm-teardown.test.sh'
+
 # Keep test evidence out of this repo; it stays in a temp dir instead.
 test:
   evidence:

bin/backends/herdr-eventwait.py

@@ -0,0 +1,157 @@
+#!/usr/bin/env python3
+"""Raw AF_UNIX subscriber for herdr's native pane.agent_status_changed stream.
+
+This is the WIRE TRANSPORT half of the herdr push-escalation path
+(bin/backends/herdr.sh fm_backend_herdr_wait_transition). It deliberately does
+NOT know firstmate's supervision policy: it opens ONE connection to a herdr
+session's control socket, subscribes to pane.agent_status_changed for the given
+panes (all statuses, so working/idle/done edges are seen too), and prints one
+projected line per event to stdout, flushing each so the bash caller can react
+sub-second. The bash side normalizes each line through the shared transition
+shape and applies the single-owner policy table (bin/fm-transition-lib.sh); the
+bash side also decides when to stop and kills this reader.
+
+Wire protocol (verified: herdr 0.7.3, protocol 16, newline-delimited JSON):
+  request : {"id","method":"events.subscribe","params":{"subscriptions":[
+             {"type":"pane.agent_status_changed","pane_id":P}, ...]}}\n
+  ack     : {"id",...,"result":{"type":"subscription_started"}}\n
+  stream  : {"event":"pane.agent_status_changed",
+             "data":{"pane_id","workspace_id","agent_status","agent",...}}\n
+
+Usage: herdr-eventwait.py <socket_path> <timeout_seconds> <pane_id> [<pane_id> ...]
+
+Output (one line per pane.agent_status_changed event, TAB-separated, a raw
+projection - NOT the final normalized record; the bash normalizer adds the
+from_status and builds the canonical shape):
+  @subscribed
+  <pane_id>\t<workspace_id>\t<agent_status>\t<agent>
+
+Exit status:
+  0  streamed until the timeout elapsed with no error - a clean bounded wait;
+     the caller treats this as "no fast escalation, poll cadence preserved".
+  2  bad arguments, could not connect, or could not send the subscribe request.
+  3  the subscribe request did not return a subscription_started ack.
+  4  the server closed the stream early or a receive operation failed.
+A non-zero exit tells the bash caller to fall back to plain polling for this
+cycle (the permanent fail-closed backstop), never to go silent.
+"""
+import json
+import socket
+import sys
+import time
+
+CONNECT_TIMEOUT = 5.0
+ACK_TIMEOUT = 5.0
+RECV_CHUNK = 65536
+
+
+def _read_line(sock, buf, deadline):
+    """Read one newline-terminated chunk from sock, honoring an absolute
+    monotonic deadline. Returns (line_bytes_or_None, buf, outcome), where
+    outcome is line, timeout, closed, or error."""
+    while b"\n" not in buf:
+        remaining = deadline - time.monotonic()
+        if remaining <= 0:
+            return None, buf, "timeout"
+        sock.settimeout(remaining)
+        try:
+            chunk = sock.recv(RECV_CHUNK)
+        except socket.timeout:
+            return None, buf, "timeout"
+        except OSError:
+            return None, buf, "error"
+        if not chunk:
+            return None, buf, "closed"
+        buf += chunk
+    line, buf = buf.split(b"\n", 1)
+    return line, buf, "line"
+
+
+def _clean(value):
+    return str(value).replace("\t", " ").replace("\r", " ").replace("\n", " ")
+
+
+def main(argv):
+    if len(argv) < 4:
+        return 2
+    sock_path = argv[1]
+    try:
+        timeout = float(argv[2])
+    except ValueError:
+        return 2
+    panes = argv[3:]
+    if not panes or timeout <= 0:
+        return 2
+
+    try:
+        sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+        sock.settimeout(CONNECT_TIMEOUT)
+        sock.connect(sock_path)
+    except OSError:
+        return 2
+
+    subscriptions = [
+        {"type": "pane.agent_status_changed", "pane_id": pane} for pane in panes
+    ]
+    request = {
+        "id": "fm-eventwait",
+        "method": "events.subscribe",
+        "params": {"subscriptions": subscriptions},
+    }
+    try:
+        sock.sendall((json.dumps(request) + "\n").encode("utf-8"))
+    except OSError:
+        return 2
+
+    start = time.monotonic()
+    deadline = start + timeout
+    buf = b""
+
+    # Bounded wait for the subscription_started ack (its own short budget, but
+    # never past the overall deadline).
+    ack_deadline = min(deadline, start + ACK_TIMEOUT)
+    line, buf, outcome = _read_line(sock, buf, ack_deadline)
+    if line is None:
+        return 2
+    try:
+        ack = json.loads(line.decode("utf-8", "replace"))
+    except ValueError:
+        return 3
+    result = ack.get("result") or {}
+    if result.get("type") != "subscription_started":
+        return 3
+
+    sys.stdout.write("@subscribed\n")
+    sys.stdout.flush()
+
+    # Stream projected events until the deadline or the server closes.
+    while True:
+        line, buf, outcome = _read_line(sock, buf, deadline)
+        if line is None:
+            return 0 if outcome == "timeout" else 4
+        try:
+            message = json.loads(line.decode("utf-8", "replace"))
+        except ValueError:
+            continue
+        if message.get("event") != "pane.agent_status_changed":
+            continue
+        data = message.get("data") or {}
+        fields = (
+            _clean(data.get("pane_id") or ""),
+            _clean(data.get("workspace_id") or ""),
+            _clean(data.get("agent_status") or ""),
+            _clean(data.get("agent") or ""),
+        )
+        sys.stdout.write("\t".join(fields) + "\n")
+        sys.stdout.flush()
+
+
+if __name__ == "__main__":
+    try:
+        sys.exit(main(sys.argv))
+    except BrokenPipeError:
+        # The bash caller stopped reading (found its actionable edge and killed
+        # us). That is a normal, successful end of the wait.
+        sys.exit(0)
+    except KeyboardInterrupt:
+        sys.exit(0)