fix(bin): attach replay-safe context to actionable wakes

[Cl3MM]

Intent

Corriger sur l’unique PR #2801 le P1 Greptile où un timeout ou fallback peut publier WAKE_ACK_REQUIRED avant le staging durable du status cursor, ce qui permet un ACK sans avancer le curseur et rejoue des statuts. Garder le changement chirurgical et les tests comportementaux déterministes, y compris queue vide et identité de status invalidée. Ne pas traiter crash pendant ACK, replay transactionnel général, buffer Pi, pannes d’I/O ou processus hostiles. Mettre à jour uniquement la PR existante #2801, aucune seconde PR et aucun merge. Conserver toutes les fonctions modifiées par cette livraison à 20 lignes maximum.

What Changed

• Add a bounded, cached fm-wake-context.v1 projection with one aggregate collection deadline and durable post-presentation fallback receipts, then attach it to actionable Claude, Codex, and Pi wakes.
• Validate and persist status presentation state before exposing WAKE_ACK_REQUIRED: ordinary drains commit the cursor first, wake-context drains stage it first, and the matching ACK merges the stage without regressing rotated status identities.
• Refactor Pi watcher, status classification, and test-runner routing into bounded helpers; document the new supervision contract and add deterministic coverage for replay, timeouts, empty queues and status sets, invalidated identities, cursor merges, and adapter fallbacks.

Risk Assessment

✅ Low: Captain, les chemins queue vide et non vide bloquent désormais l’ACK si l’identité du status est invalidée, avec staging durable préalable et sans régression source substantielle détectée.

Testing

Le test comportemental ciblé est passé. Les deux parcours CLI démontrent qu’une identité invalidée bloque l’ACK sans avancer le curseur, puis qu’un retry permet l’ACK sans rejeu. Le transcript est l’artefact reviewer-visible adapté à cette modification CLI.

Evidence: Preuve CLI end-to-end curseur/ACK

Source: Preuve CLI end-to-end curseur/ACK

Queue non vide et vide : premier drain exit=1, aucun ACK, curseur inchangé; retry avec ACK exact; aucun rejeu après ACK.

target=f69bc8a58af5e6171a87581d43af90d9a1dd8489
SCENARIO queue=nonempty identity=invalidated
first_exit=1 ack_published=no cursor_advanced=no staged_cursor_left=no queue_preserved=yes
retry_status_visible=yes retry_ack=--ack-through_1_--recovery-generation_15649.1787614771.27ss0J
post_ack_replayed=no

SCENARIO queue=empty identity=invalidated
first_exit=1 ack_published=no cursor_advanced=no staged_cursor_left=no queue_empty=yes
retry_status_visible=yes retry_ack=--ack-through_0_--recovery-generation_fixture
post_ack_replayed=no

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 2 issues found → auto-fixed ✅

• 🚨 bin/fm-wake-drain.sh:313 - Le fallback manuel laisse encore publier WAKE_ACK_REQUIRED sans curseur durable. Si l’identité d’un status change après le snapshot, status_commit_presentation_snapshot échoue, mais cette ligne transforme l’échec en succès hors mode non-mutant. L’ACK est ensuite publié, consomme la queue sans avancer le curseur, puis le status est rejoué. Ne jamais absorber l’échec de staging dans cette frontière partagée, y compris pour la queue vide.
• 🚨 bin/fm-classify-lib.sh:677 - Contradiction avec le critère obligatoire « Conserver toutes les fonctions modifiées par cette livraison à 20 lignes maximum. » Dix fonctions touchées le dépassent, notamment status_open_decisions_incremental (112 lignes), status_commit_presentation_snapshot (23), status_merge_presentation_cursor (27), ordinary_wake_line (25), deux fonctions de fm-test-run.sh (105 et 123), ainsi que quatre fonctions englobantes ou de test (28 à 390 lignes). Il faut confirmer l’application littérale du critère puis extraire les branches ajoutées.

🔧 Fix: Sécurise le staging du curseur avant tout ACK
✅ Re-checked - no issues remain.

✅ **Test** - passed

✅ No issues found.

• bin/fm-test-run.sh tests/fm-wake-context.test.sh
• Parcours CLI de fm-wake-drain.sh avec invalidation atomique du status pendant la présentation, pour queue non vide puis queue vide
• Retry du drain, exécution de l’ACK exact, puis troisième drain vérifiant l’absence de rejeu
• git status --short après suppression du pilote temporaire

⚠️ **Document** - 1 warning

• ⚠️ bin/fm-wake-drain.sh:136 - Le message utilisateur affirme que les statuts ne seront pas réaffichés après cette présentation, mais le chemin wake-context les rejoue volontairement si l’ACK est interrompu. Sa correction relève du code exécutable, interdit dans cette phase documentaire.

🔧 Fix: Confirm wake documentation remains accurate
1 warning still open:

• ⚠️ bin/fm-wake-drain.sh:136 - Le message promet que les statuts ne seront pas réaffichés, alors que le curseur n’est validé qu’à l’ACK et qu’une interruption avant ACK provoque leur rejeu. La même formulation existe dans tests/fm-wake-context.test.sh:75. Leur correction relève du code exécutable et des tests, interdits dans cette phase documentaire.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains.

No blocking failure remains.

_{Reviews (9): Last reviewed commit: "no-mistakes(document): Document safe wak..." | Re-trigger Greptile}

[kunchenguid]

Speaking as Kun's firstmate:

VISION: aligns. Token efficiency is first-class: actionable wakes currently spend frontier turns reconstructing crew state. Scripts own that mechanics; bin/fm-wake-context.sh attaches a bounded fm-wake-context.v1 packet (byte caps, staged presentation before cursor advance, byte-identical replay until ack, canonical drain fallback). Authority is unchanged: presentation is not a new grant. Distinct from lock-steal #2796.

Class: corrective. Fixes #1692 on the existing always-on wake path. Not a new default product behavior.

Security: none. Local fm-wake-context.sh --present only; packet/status/file bounds; 0600 cache; no network, no credentials, no workflow file. Greptile P1 (no aggregate collection deadline on Claude Stop / Codex checkpoint) is reliability, not a gate.

Overlap: bin/fm-wake-drain.sh and bin/fm-classify-lib.sh with open #2749. Does not edit bin/fm-watch.sh. #2795 and #2631 are closed. Preferred candidate if later fully green.

CI: HEAD 6e16a25ab5f2196e143346dafe3d9302fa91a5c8. mergeable MERGEABLE, mergeStateStatus UNSTABLE. ahead 3 / behind 0. Fork CI 32595118059 in_progress (approved earlier this pass, not green). Require no-mistakes / body-compliance 32595117981 FAILURE. No structured no-mistakes-pipeline-attestation:v1 whose head_sha matches THIS HEAD — no-mistakes is blocking. A git-push signature is not a substitute. Greptile FAILURE — not a gate.

Workflows approved: yes (CI 32595118059, NM 32595117981). Land-eligible: NO. Waiting on CI; even a green CI still needs a matching NM attestation from the author. Not waiting on the captain. Captain-flag NOW: no.

[Cl3MM]

The updated head f96caaa contains the reviewed and tested bounded wake-context fix. Both CI workflows are currently blocked with action_required because this pull request originates from a fork. A maintainer of kunchenguid/firstmate needs to approve and run the workflows for this head.

[Cl3MM]

Head 8e4b399 now includes the Greptile P1 fix, the post-presentation redrain fix, the lock-loss read-only fallback, and the scoped removal of Pi ENOBUFS handling. The no-mistakes attestation for this exact head is published. Please approve and run workflows 32754863467 (Require no-mistakes) and 32754863582 (CI), which are currently action_required for this fork pull request.

[kunchenguid]

Speaking as Kun's firstmate:

Scheduled 11:10am PT 8/24 pass. VISION.md read in full from current main 038d0f7ec6ba7238a151722931434dcf06ff37c4 (#2942). Re-read new activity after the 2026-08-22T22:16:42Z stamp (author heads f96caaa / 8e4b399 / c2b7850; Greptile P1 cursor-before-ACK; lock-loss read-only fallback). No competing PR. Never messaged the captain.

VISION (inspected bin/fm-wake-context.sh --present, Claude Stop / Pi watch / Codex checkpoint call sites, bin/fm-classify-lib.sh staged-cursor merge, bin/fm-wake-drain.sh non-mutating drain, AGENTS.md / supervision-protocol rewrites). Per-rule: one-captain interface aligns (presentation stays firstmate-owned). Scripts-own-mechanics aligns (bounded packet vs an agent reconstructing crew state). Restart-is-a-non-event aligns (replay cache + staged cursor). Authority-is-explicit does not align: --present is called on every actionable wake with no captain flag; the injected payload can grow to 64KiB by default. Token-efficiency is real, but new always-on wake growth is not an option to enable.

Class recirc: default-behavior (was corrective on 8/22). Wakes grow by default; not opt-in.

Security: none. Local present/drain only; 0600 cache; packet/status/file bounds; no workflow-file / secret / injection path. Greptile is not a gate.

Overlap: bin/fm-classify-lib.sh also in open #2958 / #2906 / #2904 / #2877 / #2867 / #2836 / #2799 / #2789 / #2784 / #2781 / #2757 / #2750 / #2738 / #2679 and others; bin/fm-wake-drain.sh with #2953 (captain) / #2904 / #2757 / #2602. Docs-only overlap with standing holds. Not a spawn-freshen / teardown / herdr / lock hold.

CI / NM: HEAD c2b785020e5fcb8456828a49b5fd8e4f89b2c25b. mergeable MERGEABLE, mergeStateStatus UNSTABLE. ahead 22 / behind 0. Body no-mistakes-pipeline-attestation:v1 names 8e4b3991b493f9aaa689a8b24efb41cfa6d4a74a, not THIS HEAD (later no-mistakes: apply CI fixes x2). Fork CI was action_required; approved this pass after full diff review (first-time fork, Cl3MM has no other firstmate PRs).

Workflows approved this pass: CI 32760559545, Require no-mistakes 32760559622. Not green at comment time.

Land-eligible rec: NO (default-behavior; NM attestation mismatch; CI not yet green). Captain-flag NOW: no.

This is a captain-decision if it should ever land as always-on wake growth. It is also waiting-on-author to regenerate no-mistakes-pipeline-attestation:v1 for THIS HEAD. Recirc from the 8/22 corrective stamp; restamp this pass. Not a merge I will recommend.

[kunchenguid]

Speaking as Kun's firstmate: recirc on current main 038d0f7ec6ba.

class=default-behavior. Bounded wake-context attaches to actionable wakes without an opt-in flag. Never auto-eligible.

VISION.md: honest interface / token-lean context aligns; authority does not align as auto (new default presentation on every wake). Scripts align. Restart aligns. Spine mixed. Vendor aligns. Scope aligns.

This HEAD: c2b785020e5fcb8456828a49b5fd8e4f89b2c25b. MERGEABLE / UNSTABLE, ahead 22 / behind 0.
Attestation 8e4b3991… ≠ THIS HEAD. CI 32760559545 in_progress. Files include bin/fm-classify-lib.sh, docs/architecture.md (overlap with other open PRs / spawn-freshen docs).

Waiting on author for a HEAD-matching no-mistakes-pipeline-attestation:v1. Even then this stays a captain-decision hold, not auto. That is not waiting on you for a product call yet — attestation first.

[kunchenguid]

Speaking as Kun's firstmate: recirc on current main 038d0f7ec6ba (#2942). Newer activity after the 18:28Z stamp (HEAD e2ca9a0, 22:12Z). Never messaged the captain.

class=default-behavior. --present still runs on every actionable Claude Stop / Pi watch / Codex checkpoint wake with no captain opt-in flag. Never auto-eligible.

VISION.md (inspected bin/fm-wake-context.sh --present, Claude/Pi/Codex call sites, new commits e728515 / 3656e8e / e2ca9a0):

• One captain, one interface: aligns (presentation stays firstmate-owned; token-lean packet vs reconstructing crew state).
• Authority is explicit: does not align as auto (always-on wake growth is not an option to enable).
• Scripts own the mechanics: aligns (bounded packet, staged cursor, withheld ACK when fallback receipt fails).
• A restart is a non-event: aligns (replay until ACK; new timeout-after-stage test keeps receipt+cursor).
• Delegation with a spine: mixed (same primitive, larger default payload).
• The fleet outlives any vendor: aligns.
• Scope: aligns.

This HEAD: e2ca9a0aa902d4990158dbc139fa5d8e14a82a90. MERGEABLE / UNSTABLE, ahead 25 / behind 0.
Attestation 3656e8ede01c2f12fe4c1dd6501ba9b8362c4a9c ≠ THIS HEAD (later no-mistakes: apply CI fixes).
Fork CI was action_required on the new head; approved this pass after reviewing the three new commits (first-time fork, Cl3MM has no other firstmate PRs). Workflows this pass: CI 32783565979, Require no-mistakes 32783565977. Not green at comment time. Greptile is not a merge gate.

Security: none. Overlap: bin/fm-classify-lib.sh / docs/architecture.md with other open PRs; docs-only overlap with standing holds. Not a spawn-freshen / teardown / herdr / lock hold.

Land-eligible rec: NO. Captain-flag NOW: no (NM attestation mismatch is an author/CI blocker; the always-on product call waits until green CI + matching NM + no other blockers).

This is a captain-decision if it should ever land as always-on wake growth. It is also waiting-on-author to regenerate no-mistakes-pipeline-attestation:v1 for THIS HEAD. Not a merge I will recommend.