Merge upstream round 4 through kunchenguid/firstmate@0866a770

[HelloWorldSungin]

Round 4 of the TRACK sync plan. One upstream merge of the contiguous first-parent range from measured merge base 9e3df47b to endpoint kunchenguid/firstmate@0866a770234502364c268a768cb7c66cc321c629, seven changes, on fork base 0f364f17dada691c2bde5d2a7e244e21fbba64e0.

No cherry-pick, no rebase, no squash, no force. The merge commit's parents are exactly 0f364f17 and 0866a770. Upstream had advanced past the plan's ceiling at intake and that did not widen this round; re-planning the tail is a separate decision.

Applicability of the seven changes

#	Upstream change	Verdict
21	kunchenguid/firstmate#3247 feat(bin): add trusted process-event extension bindings (1fbc7bb1)	Taken, with one adapted fixture. The extension package, binding, handshake, and evidence boundary are new files with no fork counterpart. .agents/skills/process-event-sources/SKILL.md and docs/captain-hold-lifecycle.md merged as unions with this fork's Lavish artifact-missing verdict kept beside upstream's new generic classify routing and read command. Upstream's remote extension fixture mirrors a fixed list of bin/ files onto a fake remote root; this fork's bin/fm-remote-job-lib.sh sources bin/fm-timeout-lib.sh, which that list did not carry, so the remote entrypoint refused before it could publish a binding. The owner was added to the list. This change also carries an inherited red described under "Attributed failures" below.
22	kunchenguid/firstmate#3269 fix(bin): deliver safety rules to promoted workers (c7fdef92)	Conflicted with fork work, resolved by extending upstream's owner. See "C2" below.
23	kunchenguid/firstmate#3321 fix(bin): present Lavish feedback as structured output (debe4bfa)	Taken, textual resolution only. bin/fm-procevent-lavish.sh gains upstream's read command beside this fork's canonical_artifact_path and gone-path retire. Both sides edited the header and usage(); the header is the union and the fork's growth-proof usage() (which prints every leading comment line) is kept over upstream's hardcoded sed -n '2,107p' line range, because upstream's range no longer covers the merged header.
24	kunchenguid/firstmate#3322 fix: keep task records and backlog transitions atomic (1260adce)	Taken as a contract change, with two ordering adaptations. See "Change 24" below.
25	kunchenguid/firstmate#3342 fix(bin): contain promote and Relay metadata publishing (d71f4b9c)	Taken cleanly. No fork hunk in the contained region.
26	kunchenguid/firstmate#2877 fix(bin): absorb turn-end wakes during bounded pane churn (a56a78ac)	Taken cleanly in code, prose merged as a union. As the round plan predicted, the churn absorber does not overlap this fork's trap-hygiene or wedge-hold watcher changes; bin/fm-watch.sh had no code conflict. The two conflicts were both header prose, resolved as unions so config/turnend-churn-absorb is described beside this fork's first-sighting, keyed-open-decision, and declared-wait absorb rules. docs/architecture.md, docs/configuration.md, and AGENTS.md carry the same union.
27	kunchenguid/firstmate#3369 fix(bin): safely unregister custom checks (0866a770)	Taken cleanly. bin/fm-check-unregister.sh is new; AGENTS.md section 7 and docs/scripts.md gained its contract row beside this fork's existing fm-check-register.sh sentence.

C2 - who owns the definition of done (change 22)

Upstream moved the definition of done into a new bin/fm-dod-lib.sh rendered by both bin/fm-brief.sh and bin/fm-promote.sh, so a promoted scout receives the same delivery contract a briefed worker does. That library hardcodes fm/<task-id>, knows no design kind, and hands a no-mistakes worker off with done: {summary}.

This fork renders four things it cannot: the --continue-branch task branch (HelloWorldSungin/firstmate#149), the ADR design kind (HelloWorldSungin/firstmate#126), the configured declared-wait verb, and the canonical blocked: implemented and committed, ready to validate handoff that bin/fm-trigger-validation.sh's canonical_handoff resolves. That string exists nowhere upstream.

Resolution: upstream's library is adopted as the owner and extended, rather than the fork keeping an inline copy. It now exposes fm_dod_fragments, fm_dod_fragments_continue_branch, fm_dod_render, and upstream's fm_dod_block. bin/fm-brief.sh sets the fragments its task shape needs and renders; bin/fm-promote.sh still calls fm_dod_block, which is that same rendering for a default ship task. The declared-wait verb is resolved from bin/fm-classify-lib.sh's own constant rather than restated. Upstream's stronger --yes/-y prohibition is taken in full, in both the ship and ADR renderings and in CONTRIBUTING.md.

Extending the library rather than keeping the fork's inline rendering was chosen because it is the only option that gives a promoted scout the fork's handoff too. Under the alternative, a promoted no-mistakes worker would still have reported done: and never reached this fork's validation trigger.

Behavioural proof, not file presence. A new regression, test_generated_brief_handoff_is_the_line_the_trigger_closes in tests/fm-trigger-validation.test.sh, generates a real ship brief, takes the handoff status line out of it with no restatement, appends that line, runs bin/fm-trigger-validation.sh, and asserts the open-decision fold is empty afterwards. It was proved to fail on drift: rewording the handoff in bin/fm-dod-lib.sh to "ready for validation" turns it red with the trigger did not close the handoff the generated brief tells a worker to append: blocked: implemented and committed, ready for validation. That is the exact silent break this collision risked, and nothing else in the suite caught it. Upstream's own byte-identity check between the promote and brief paths stays green, so the two renderings still cannot drift.

The generated brief's only other change against fork main is upstream's --yes wording; the golden fixture and the exact design-DOD expectation were refreshed to match, and every other byte of all six brief variants is unchanged.

Change 24 - atomic backlog transitions

Upstream makes bin/fm-spawn.sh and bin/fm-teardown.sh run the tasks-axi start/done transitions themselves through bin/fm-backlog-transition-lib.sh, records a pending close in state/<id>.backlog-close before destructive cleanup, and replaces teardown's rm -f of the task record with a close.

Taken, with the ordering this fork requires:

• The completion manifest still precedes the close. publish_outcome_manifest, the GBrain capture it wraps, and the model-watermark append all still run before the close that removes the record, and $STATE/$ID.meta was removed from the later receipt rm -f lists on both the main and remote-secondmate paths so the validated transition owns it.
• A preserving refusal now withdraws the close it recorded. The pending-close record exists so a crash mid-cleanup can still be finished, which upstream's own test_interrupted_destructive_cleanup_leaves_a_recoverable_close pins by SIGTERM-ing teardown during the worktree return. This fork's cleanup also carries refusals upstream has no equivalent of that deliberately keep a task: an unpublishable completion manifest, a model-routing verdict that gained a turn, and a Herdr close that could not be confirmed gone. Left as-is, the next session start would replay the pending close and remove the very record those refusals exist to preserve. withdraw_pending_backlog_close is called at exactly those refusal sites, and deliberately not from the exit trap, which a signal would also reach. A new colocated regression, test_a_preserving_refusal_withdraws_the_close_it_recorded in tests/fm-backlog-atomicity.test.sh, drives a real teardown whose manifest cannot be published and then runs a real bootstrap, asserting the item stays In flight and the record survives the restart. Both halves now pin each other.
• A watermark-capture failure keeps its published record. Upstream removes a published record when the dispatch fails after publication. This fork's claude dispatch captures a model-evidence watermark after that record is published and after the endpoint and worktree already exist, and refuses when the capture fails; unwinding there would strand a live pane and local copy with nothing naming them. bin/fm-spawn.sh clears its rollback intent on exactly those two refusals. The backlog item stays Queued, which upstream's own worker-record reconciliation converges to In flight at the next locked session start, so the state this leaves is one upstream already knows how to correct. Every other post-publication failure keeps upstream's rollback unchanged, and test_claude_watermark_failure_preserves_recoverable_metadata pins the retained record.

Two other adaptations this change forced:

• tests/fm-teardown.test.sh's two tasks-axi done prompt cases are superseded by upstream's two backlog-close cases and were dropped with the functions upstream deleted; upstream's seed_backlog_in_flight and backlog_row_state helpers are carried, and the fixture record now writes spawn_gen= beside this fork's branch=.
• tests/fm-endpoint-binding-migrate.test.sh's fixture home gained a data/ directory, because cleanup now resolves the home's backlog directory before it can reach the binding refusal that test is about.

Where the trees disagreed with the round plan

The plan (data/fm-upstream-issue-reconcile/report.md, dated 2026-09-02) lists 40 paths changed on both sides for this round. The measured set is 41: tests/fm-secondmate-reconcile.test.sh is also in it, and it conflicted. Both sides had written the same four-hour cooldown boundary assertion in different shapes; upstream's, which pins the reconcile's clock through a fake date, replaced this fork's minute-wide bracket, because pinning the clock is the stronger form of the same assertion rather than a workaround for host load.

Everything else in the plan's sections 3.3, 3.4, and 4 for this round matched what the trees actually contained, including its prediction that change 26 would not overlap the fork's watcher changes.

Test and lint evidence

All three runs used the same command shape on this host: every portable CI lane (portable-parallel-1, portable-parallel-2, and every portable-serial-<k>of<n> shard) run concurrently, plus bin/fm-lint.sh. Parent baselines were measured in isolated temporary clones so this branch and its merge structure were never touched.

	scripts run	failing	lint
Fork parent 0f364f17	179	1	pass
Upstream parent 0866a770	161	14	pass
Merge result	182	8	pass

bin/fm-doc-audience-check.sh (126 surfaces, 717 local links) and bin/fm-pointer-check.sh (32 checked, 0 broken) both pass on the merge result.

Attributed failures

Every one of the merge result's eight failures reproduces on the upstream parent with the identical assertion text, and none of them fails on the fork parent:

Script	fork 0f364f17	upstream 0866a770	merge	Failing assertion
fm-procevent.test.sh	pass	fail	fail	reconcile never claimed the registered source
fm-procevent-when.test.sh	pass	fail	fail	the winning concurrent arm did not produce an outcome
fm-remote-reply.test.sh	pass	fail	fail	process-event runner never claimed the remote reply source
fm-watch-triage.test.sh	pass	fail	fail	the fixture captured no process-event result
fm-remote-secondmate-lifecycle-e2e.test.sh	pass	fail	fail	remote reply source did not capture the correlated answer
fm-captain-hold-lifecycle.test.sh	pass	fail	fail	dies silently at bin/fm-procevent.sh start fixture-src
fm-bearings-board.test.sh	pass	fail	fail	the order-proof board build failed
fm-extension-binding.test.sh	pass	fail	fail	local bind returned no binding retirement identity, an isolated extension conformance section failed

The first six share one root cause and it was bisected: running tests/fm-procevent.test.sh in an isolated clone of the upstream line passes at 9e3df47b (this round's merge base) and fails at 1fbc7bb1 (change 21). The minimal reproduction is two commands in a scratch home:

bin/fm-procevent.sh register lavish demo-src -- cat /etc/hostname   # registered: demo-src (lavish)
bin/fm-procevent.sh start demo-src                                  # error: cannot claim source: demo-src

The claim runs inside the re-executed _start child, so the failure is inside upstream's new claim path rather than anything this fork touched, and it does not depend on FM_PROCEVENT_CLAIM_ROOT (an isolated claim root fails the same way). fm-extension-binding's two remaining reds are error[mode-unsafe]: ... mode is unsafe: 775, which is this host's umask 002 rather than a code fault.

Settled by this PR's own CI: all eight were host-specific. Every behaviour lane is green on head ece09b03d220fd0e00eed9c025bf82c34e48d79b - both portable parallel shards, all eight portable serial shards, the required real-Herdr lane, and the stock macOS Bash compatibility lane - so none of these eight failures reproduce in a clean environment. They are this development host's umask 002, its live process-event claim root, and its installed herdr, not defects this round carries. The bisection to change 21 still stands as a local-environment sensitivity worth knowing about; it is not a reason to hold this round.

Nothing was widened, skipped, or quieted to make a red pass. The merge result has fewer failures than the upstream parent because six of upstream's fourteen (fm-bootstrap, fm-watcher-lock, fm-on, fm-remote-doctor, fm-session-start, fm-test-run) are shapes this fork already diverges on and they pass here.

The fork parent's single failure, fm-backend-herdr.test.sh (container_ensure should echo ..., got empty), passes on the merge result. It is a flake in that suite against a real herdr on this host, not something this round repaired.

Divergence survival

Every active entry in docs/fork-divergence.md names the test that pins it, and all of those pinning tests are inside the portable lanes this sweep ran. Their verdicts on the merge result:

Ledger entry	Pinning test	Verdict
Agy crew adapter	fm-agy-adapter.test.sh	pass
Pinned ShellCheck download retry budget	fm-lint.test.sh	pass
LLM quota sidecar	fm-quota-sidecar.test.sh	pass
Scout completion gate reopened by a firstmate steer	fm-send-strict.test.sh	pass
Pre-move crash fixture	fm-backlog-handoff.test.sh	pass
Watcher restart hand-over; watcher stop-signal disposition	fm-watcher-lock.test.sh	pass
Run-progress wedge hold; watcher live declared-wait routing and cadence	fm-watch-triage.test.sh, fm-daemon.test.sh	fm-daemon pass; fm-watch-triage red only on the inherited process-event claim assertion above, with every wedge-hold, pause-streak, and live-declaration case passing
Herdr pre-Enter footer read	fm-backend-herdr.test.sh	pass
Remote job worker descendant reaping; bounded remote job stdin capture	fm-remote-job-orphan-reap.test.sh, fm-remote-job.test.sh	pass
Default per-script bound on every test sweep	fm-test-run.test.sh, fm-on.test.sh	pass
No-mistakes run attribution	fm-crew-state.test.sh	pass
Fleet snapshot per-task timeout and abandoned child work	fm-home-summary-refresh.test.sh	pass
Pi away-mode supervision standby	fm-pi-watch-extension.test.sh	pass
Fork-local compliance-gate event scope; live PR body refresh	fm-no-mistakes-required-gate.test.sh	pass
Merge-proof contract	fm-pr-merge.test.sh	pass
Upstream-read-only posture in shared tracked docs	fm-agents-hard-rules.test.sh	pass
GBrain per-home knowledge memory	fm-bootstrap.test.sh, fm-brief.test.sh, fm-gbrain-capture.test.sh, fm-recall.test.sh	pass
Fleet dashboard and agent-event instrumentation	fm-dashboard-events.test.sh, fm-dashboard-gbrain.test.sh	pass

Beyond those, the fork's ready-to-validate handoff is now proved end to end against the trigger by the new regression described under C2, rather than by observing that the string still exists in a file.

Ledger changes

docs/fork-divergence.md gains three entries, all created by this round:

• Definition-of-done owner carries this fork's ready-to-validate handoff - upstream's library adopted as the owner and extended.
• A preserving refusal withdraws the pending backlog close - and why a crash deliberately does not.
• A watermark-capture failure keeps the published task record - and why every other post-publication failure keeps upstream's rollback.

No entry was retired and no entry's intent changed.

Parked branches

docs/fork-divergence.md lists five deliberately unlanded branches: fm/fm-afk-injection-wedge, fm/fm-crew-state-blind-during-fix-round, fm/fm-parked-decision-stale-noise, fm/fm-subagent-model-routing-guard, and fm/fm-vault-drift-check. None entered this round. This branch descends only from 0f364f17 and 0866a770, which the merge commit's two parents show.

Contract decisions (firstmate, not the captain)

Both AGENTS.md contract questions raised by changes 22 and 24 were put to firstmate and decided by firstmate. The captain was not consulted on either.

1. Who moves the backlog item - adopt upstream. Sections 7 and 10 agree, with "ship, design, or scout" restored where upstream says "ship or scout", because upstream has no design kind while this fork's gate does cover it. Firstmate's reasoning: change 24 was taken as code, so the spawn genuinely does move the item now, and keeping the old section 7 sentence would leave the always-loaded contract describing behaviour the code no longer has - a false statement there is worse than either option. Beyond that, "update the backlog on every dispatch" was a documented promise rather than a mechanism, and upstream converts it into something that refuses; an enforced mechanism is not reverted back to an instruction someone has to remember.

Secondmate exemption, verified rather than assumed. A persistent secondmate is deliberately never a backlog work item in this fork, so firstmate required proof that upstream's refuse-without-an-item path does not catch one before this lands.

• Code path: fm_backlog_transition_applies returns a skip on kind = secondmate as its first check, before any data resolution. In bin/fm-spawn.sh the entire refuse-without-a-row block sits inside that gate's then branch, and the else branch refuses only on the unresolvable-data status a secondmate can never reach. bin/fm-teardown.sh resolves the same gate from the record's own kind.
• Dispatch, behavioural: upstream's own test_a_persistent_secondmate_is_never_a_backlog_item spawns a secondmate into a home with no backlog row for it and asserts the spawn succeeds and publishes its record. It passes on the merge result.
• Retirement, behavioural: this is the half the round actually moved, since cleanup now routes the record removal through the validated transition, and nothing pinned it. A new colocated regression, test_retiring_a_persistent_secondmate_needs_no_backlog_item, retires a real kind=secondmate record in a home that has a real backlog with no row for it, and asserts the retirement succeeds, records no pending close, and adds no backlog row.
• That regression was proved non-vacuous: deleting the kind exemption from fm_backlog_transition_applies makes the same retirement exit non-zero with its backlog item could not be closed atomically (Task "..." not found in this backlog), after the record is already gone, leaving a pending close a session start would keep retrying for an agent that was never a work item.

No fork adaptation to the exemption itself was needed; it was already correct on both paths, and only the retirement half lacked coverage.

2. Restating the definition of done - no change. Section 7 is left exactly as it was. The sentence about the canonical ready-to-validate blocked: entry is still true of the merged code, and firstmate's reasoning is that section 7 owns the contract, bin/fm-dod-lib.sh now owns the rendering, and the new regression owns the enforcement: three owners, one fact. Naming the library in an always-loaded file at its size ceiling would create a second owner for a mechanism detail and buy nothing executable, which is the documented-promise defect wearing the other face.

Expected red check

This round ships direct-PR, deliberately. The no-mistakes pipeline rebases onto origin/main, which would replay and linearize a merge-only branch and destroy exactly the structure this PR exists to create. The fork's compliance workflow still requires a no-mistakes signature, so PR must be raised via no-mistakes is red by design. Every other required check must pass.

Head

Pushed head: ece09b03d220fd0e00eed9c025bf82c34e48d79b
Merge commit: 601db8e7817d43c624c881e01897096b0a66feac, parents 0f364f17dada691c2bde5d2a7e244e21fbba64e0 and 0866a770234502364c268a768cb7c66cc321c629

Mergeability checked against main at that head: mergeable: true. mergeable_state is unstable, which is the by-design red compliance check below rather than a conflict.

CI verdict on that head: 16 of 17 checks pass, and the single failure is PR must be raised via no-mistakes, which this direct-PR round carries deliberately for the reason stated below.