fix(dod): stop telling no-mistakes workers to halt before validating

[nordbotten]

The bug

The generated no-mistakes definition of done tells a worker to stop before validating:

The task is complete only when committed on your branch.
When you believe it is complete, append done: {summary} to the status file and stop.
Firstmate will then instruct you to run /no-mistakes to validate and ship a PR.

That handshake does not happen. Firstmate does not send a separate instruction to begin validation,
so a worker that finishes implementing commits, appends done:, and stops — having run no validation
at all. Firstmate then has to notice that the status line carries a commit where a PR URL belongs and
send the worker back by hand.

Four crewmates did exactly this in one night, on four unrelated tasks. None was careless; all four
obeyed the contract as written.

The change

In bin/fm-dod-lib.sh, the no-mistakes definition-of-done block:

1. The pre-pipeline paragraph now says committing is a milestone, not completion: append a
   working: line, then start the validation run yourself on the same branch in the same session.
   The sentence promising that firstmate will instruct the worker to run /no-mistakes is removed,
   because that handshake does not exist.
2. Three lines added after the closing sentence: done: is reserved for the CI-green PR-URL line;
   finishing implementation, tests and commit is working:, not done:; a done: line naming a
   commit instead of a PR URL is a contract violation.
3. A stale assertion in tests/fm-brief.test.sh that expected the old wording is updated.

Untouched: the --intent rules, the gate-driving rules, the ask-user rules, and the direct-PR and
local-only definitions of done.

Both passages now agree. A reservation at the end of the block is worthless while the front of the
block still tells the worker to stop and wait.

Validation

Ran through the project's own no-mistakes pipeline: review, test, document and lint all passed. The
push step failed only because the authoring account has no write access to this repository, which is
why this arrives as a fork PR.

[kunchenguid]

Speaking as Kun's firstmate:

First look on main a27646c4eae5d807027c3ebcb783234e0d212958 (2026-09-12). Tip f2fd8ddc7e4954531806b4f1b81fe7a87d962950. Whole thread read (empty). Full diff reviewed: bin/fm-dod-lib.sh no-mistakes DoD open + reservation lines; tests/fm-brief.test.sh one-line assertion swap. No .github/workflows/*. nordbotten not blocked. Not automation.

Defect still on main. bin/fm-dod-lib.sh still opens with mid-task done: {summary} + "Firstmate will then instruct you to run /no-mistakes". Same surface as open #99 / #1033 / #3141 / #1840.

Owning help target: #4149 (karotkriss). That tip b769813b5a6fe81a35e7643cf3cd12aef4486a3f is attestation MATCH, MERGEABLE/CLEAN, tip Require-no-mistakes pass, and adds tests/fm-dod-lib.test.sh pinning one terminal done: plus untouched direct-PR/local-only arms. Older copy #3135 (o2themar) is the same defect but attestation-stale / waiting-author since 2026-08-27. Help lands on #4149 — do not open a competing PR; do not invest in making this tip mergeable.

This tip

• Attestation MISSING (no no-mistakes-pipeline-attestation:v1).
• Fork CI was action_required; approved runs 34675768193 (CI) and 34675768211 (Require no-mistakes) after diff review — safe wording-only change. Not a merge path for this PR.

VISION.md (each rule)

• One captain, one interface: aligns — removes a firstmate wake that only says "now run /no-mistakes" with no review.
• Authority is explicit: aligns — no-mistakes mode is already the captain's contract; no new autonomy grant.
• Scripts own the mechanics: aligns — brief text + one assertion.
• A restart is a non-event: aligns — uses existing nonterminal working:.
• Delegation with a spine: aligns — validation is no longer a guessed extra hop.
• The fleet outlives any vendor: aligns.
• Scope: aligns — command-layer DoD wording, not workshop.

Contract-class: restore (corrects broken mid-task done: / halt-before-validation inside an already-chosen ship contract).

Outcome: existing-pr → #4149. Merge-eligible: NO. Firstmate flag: no. Security: none.

[nordbotten]

Closing this. Upstream triage already routed the fix to #4149 and said not to open a competing PR or invest in making this tip mergeable, so this copy has no merge path. No objection to that call - #4149 pins the behaviour with a test, which this did not.