fix(bin): make bounded wake context opt-in and replay-safe

[Cl3MM]

Intent

Corriger sur l’unique PR #2801 les défauts de timeout, fallback, staging du status cursor, ACK et replay afin d’éviter les réveils et tours modèle répétés, tout en rétablissant l’autorité explicite du captain sur l’augmentation de contexte. La présentation enrichie doit être désactivée par défaut et activée uniquement par un fichier local régulier , résolu via sinon , sans héritage implicite vers les secondmates. Sans opt-in et sans transaction publiée, ne doit effectuer aucun drain, cache, staging, reçu ou ACK et doit produire une instruction unique de drain manuel. Une transaction déjà publiée doit rester rejouable byte-identiquement après retrait du flag jusqu’à son ACK. Avec opt-in, conserver le comportement sécurisé validé au head fd8e3a7 pour Claude, Codex et Pi. Garder les tests comportementaux déterministes et fonctions sous 20 lignes. Ne pas prétendre prouver une baisse de tokens réels sans télémétrie. Ne pas traiter crash pendant ACK, replay transactionnel général, buffer Pi, pannes d’I/O ou processus hostiles. Mettre à jour uniquement la PR existante #2801, aucune seconde PR et aucun merge.

What Changed

• Add size- and time-bounded context packets for actionable Claude, Codex, and captain-facing Pi wakes, with an aggregate collection timeout and manual-drain fallback.
• Require a local regular-file opt-in while replaying already-published packets byte-for-byte until their exact acknowledgement.
• Stage wake status cursors during packet construction and commit them only through cache publication and verified acknowledgement, with deterministic behavioral coverage and updated protocol documentation.

Risk Assessment

🚨 High: La transaction ACK 0 peut perdre son replay avant acquittement, la deadline agrégée reste contournable, et deux contraintes explicites de l’intent nécessitent encore un arbitrage.

Testing

Le baseline a confirmé un worktree propre sur le commit cible. Les tests ciblés du contrat transactionnel et des intégrations Codex, Claude, Pi et secondmate sont passés. Un sous-cas Cursor hors intent a été ignoré faute d’exécutable. La vérification CLI démontre le mode désactivé sans mutation, la publication avec opt-in, le replay byte-identique après retrait du flag et l’ACK exact avec progression sans rejeu. Aucun screenshot n’est pertinent car la surface est exclusivement CLI. Cette phase ne prouve aucune baisse réelle de tokens faute de télémétrie.

Evidence: Transcription CLI du cycle wake-context

Source: Transcription CLI du cycle wake-context

wake-context end-user CLI evidence
commit=3e6049a8def3846734030474c276f851ce1b41c0

[1] default-off, no published transaction
exit=3 instruction_lines=1
WAKE_CONTEXT_FALLBACK: wake context unavailable before presentation: automatic wake context is disabled until config/wake-context-presentation exists; run bin/fm-wake-drain.sh once.
queue_sha_before=bed6463b275d86c856893ccee145e5759f4be3f37497e2763aa34a10070a4f3e
queue_sha_after =bed6463b275d86c856893ccee145e5759f4be3f37497e2763aa34a10070a4f3e cmp=identical
drain=absent cache=absent staged_cursor=absent receipt=absent ack_lines=0

[2] opt-in publishes a staged transaction
cache=present staged_cursor=present durable_cursor_cmp_before=identical
packet_has_beta_note=true

[3] opt-out after publication replays byte-identically
first_sha =72c9b2970a88f1a73aa239b509d924f74bd49dfe1982d2f316bfc53453627ee0
replay_sha=72c9b2970a88f1a73aa239b509d924f74bd49dfe1982d2f316bfc53453627ee0 cmp=identical

[4] exact ACK commits cursor and retires transaction
ack_through=1 recovery_generation=88469.1787635790.qO0XVK
durable_cursor_cmp_before=advanced cache=absent staged_cursor=absent
next_drain_replays_beta_note=no

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

⚠️ **Review** - 4 errors

• 🚨 tests/fm-watch-checkpoint.test.sh:90 - L’intention exige « fonctions sous 20 lignes », mais le nouveau helper install_context_failure_checkpoint couvre les lignes 90 à 113, soit 24 lignes. Le même écart existe pour install_autoarm_wake_context_fixture dans tests/fm-claude-stop-autoarm.test.sh:25 avec 22 lignes. Découper ces fixtures ou autoriser explicitement une exception pour les helpers de test.

🔧 Fix: Découpe les fixtures sous vingt lignes
4 errors still open:

• 🚨 bin/fm-wake-context.sh:56 - Le critère exige qu’une transaction publiée reste rejouable byte-identiquement jusqu’à son ACK. Avec un paquet status-only publié (reason_queue=[], ACK 0), puis une nouvelle wake avant ACK et le retrait du flag, cache_matches_queue exige une queue vide. Il invalide alors le cache, puis le contrôle du flag renvoie le fallback manuel. La nouvelle wake aurait pourtant survécu à l’ACK 0. Valider la transaction par son ACK et sa génération encore actifs, sans l’invalider à cause de wakes postérieures.
• 🚨 bin/fm-wake-context.sh:374 - Le critère « Sans opt-in et sans transaction publiée [...] doit produire une instruction unique de drain manuel » est contredit après perte du lock: le contrôle du lock précède celui du flag et renvoie uniquement WAKE_CONTEXT_READ_ONLY. Le chemin Pi est atteignable et tests/fixtures/pi-lock-loss-probe.mjs:32 interdit explicitement l’instruction de drain. Comme demander un drain depuis une session read-only serait dangereux, faire arbitrer et documenter cette exception.
• 🚨 bin/fm-wake-context.sh:384 - La borne agrégée commence après copy_queue, validate_queue et preflight. Une queue très volumineuse ou de nombreux fichiers *.status peuvent donc être copiés et entièrement scannés sans deadline avant leur rejet. Placer ces opérations post-opt-in sous la frontière fm_run_timed, tout en conservant le fallback pré-présentation lorsqu’aucun ACK n’existe.
• 🚨 bin/fm-test-run.sh:133 - Le critère requis « fonctions sous 20 lignes » reste contredit par quatre fonctions ajoutées ou modifiées: family_is_pure_contract_unit fait 20 lignes; tests/fm-wake-context.test.sh:186 en fait 21; celles des lignes 303 et 604 en font 20. Le fix-round corrige bien les deux helpers précédemment signalés, mais pas ces quatre écarts.

✅ **Test** - passed

✅ No issues found.

• pwd; git rev-parse --show-toplevel; git branch --show-current; git rev-parse HEAD; git status --short
• bin/fm-test-run.sh tests/fm-wake-context.test.sh tests/fm-watch-checkpoint.test.sh tests/fm-claude-stop-autoarm.test.sh tests/fm-pi-watch-extension.test.sh
• bin/fm-test-run.sh tests/fm-secondmate-harness.test.sh
• Harness CLI hermétique pilotant fm-wake-context.sh --present puis fm-wake-drain.sh --ack-through ... --recovery-generation ..., avec comparaison cmp et SHA-256 des transactions et états persistés
• sed -n '1,240p' /Users/clement/.no-mistakes/evidence/01M0VMG51ST0RC582MTD15CD3J/wake-context-cli-transcript.txt; shasum -a 256 .../wake-context-cli-transcript.txt; git status --short; git rev-parse HEAD

🔧 **Document** - 3 issues found → auto-fixed ✅

• 🚨 bin/fm-supervision-instructions.sh:163 - Les instructions conditionnent encore le paquet au flag actif, contrairement au replay d’une transaction publiée après retrait du flag.
• ⚠️ bin/fm-watch-checkpoint.sh:14 - L’aide promet un paquet alors que le mode par défaut peut produire une instruction de drain manuel.
• ⚠️ tests/fm-wake-queue.test.sh:233 - Le commentaire affirme encore que le drain commence chaque tour de wake, contrairement au nouveau no-op et au replay enrichi.

🔧 Fix: Clarify wake-context replay and Pi presentation scope
✅ Re-checked - no issues remain.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains in the previously reported wake-context transaction and deadline paths.

No blocking failure remains.

_{Reviews (11): Last reviewed commit: "no-mistakes: apply CI fixes" | Re-trigger Greptile}

[kunchenguid]

Speaking as Kun's firstmate:

VISION: aligns. Token efficiency is first-class: actionable wakes currently spend frontier turns reconstructing crew state. Scripts own that mechanics; bin/fm-wake-context.sh attaches a bounded fm-wake-context.v1 packet (byte caps, staged presentation before cursor advance, byte-identical replay until ack, canonical drain fallback). Authority is unchanged: presentation is not a new grant. Distinct from lock-steal #2796.

Class: corrective. Fixes #1692 on the existing always-on wake path. Not a new default product behavior.

Security: none. Local fm-wake-context.sh --present only; packet/status/file bounds; 0600 cache; no network, no credentials, no workflow file. Greptile P1 (no aggregate collection deadline on Claude Stop / Codex checkpoint) is reliability, not a gate.

Overlap: bin/fm-wake-drain.sh and bin/fm-classify-lib.sh with open #2749. Does not edit bin/fm-watch.sh. #2795 and #2631 are closed. Preferred candidate if later fully green.

CI: HEAD 6e16a25ab5f2196e143346dafe3d9302fa91a5c8. mergeable MERGEABLE, mergeStateStatus UNSTABLE. ahead 3 / behind 0. Fork CI 32595118059 in_progress (approved earlier this pass, not green). Require no-mistakes / body-compliance 32595117981 FAILURE. No structured no-mistakes-pipeline-attestation:v1 whose head_sha matches THIS HEAD — no-mistakes is blocking. A git-push signature is not a substitute. Greptile FAILURE — not a gate.

Workflows approved: yes (CI 32595118059, NM 32595117981). Land-eligible: NO. Waiting on CI; even a green CI still needs a matching NM attestation from the author. Not waiting on the captain. Captain-flag NOW: no.

[Cl3MM]

The updated head f96caaa contains the reviewed and tested bounded wake-context fix. Both CI workflows are currently blocked with action_required because this pull request originates from a fork. A maintainer of kunchenguid/firstmate needs to approve and run the workflows for this head.

[Cl3MM]

Head 8e4b399 now includes the Greptile P1 fix, the post-presentation redrain fix, the lock-loss read-only fallback, and the scoped removal of Pi ENOBUFS handling. The no-mistakes attestation for this exact head is published. Please approve and run workflows 32754863467 (Require no-mistakes) and 32754863582 (CI), which are currently action_required for this fork pull request.

[kunchenguid]

Speaking as Kun's firstmate:

Scheduled 11:10am PT 8/24 pass. VISION.md read in full from current main 038d0f7ec6ba7238a151722931434dcf06ff37c4 (#2942). Re-read new activity after the 2026-08-22T22:16:42Z stamp (author heads f96caaa / 8e4b399 / c2b7850; Greptile P1 cursor-before-ACK; lock-loss read-only fallback). No competing PR. Never messaged the captain.

VISION (inspected bin/fm-wake-context.sh --present, Claude Stop / Pi watch / Codex checkpoint call sites, bin/fm-classify-lib.sh staged-cursor merge, bin/fm-wake-drain.sh non-mutating drain, AGENTS.md / supervision-protocol rewrites). Per-rule: one-captain interface aligns (presentation stays firstmate-owned). Scripts-own-mechanics aligns (bounded packet vs an agent reconstructing crew state). Restart-is-a-non-event aligns (replay cache + staged cursor). Authority-is-explicit does not align: --present is called on every actionable wake with no captain flag; the injected payload can grow to 64KiB by default. Token-efficiency is real, but new always-on wake growth is not an option to enable.

Class recirc: default-behavior (was corrective on 8/22). Wakes grow by default; not opt-in.

Security: none. Local present/drain only; 0600 cache; packet/status/file bounds; no workflow-file / secret / injection path. Greptile is not a gate.

Overlap: bin/fm-classify-lib.sh also in open #2958 / #2906 / #2904 / #2877 / #2867 / #2836 / #2799 / #2789 / #2784 / #2781 / #2757 / #2750 / #2738 / #2679 and others; bin/fm-wake-drain.sh with #2953 (captain) / #2904 / #2757 / #2602. Docs-only overlap with standing holds. Not a spawn-freshen / teardown / herdr / lock hold.

CI / NM: HEAD c2b785020e5fcb8456828a49b5fd8e4f89b2c25b. mergeable MERGEABLE, mergeStateStatus UNSTABLE. ahead 22 / behind 0. Body no-mistakes-pipeline-attestation:v1 names 8e4b3991b493f9aaa689a8b24efb41cfa6d4a74a, not THIS HEAD (later no-mistakes: apply CI fixes x2). Fork CI was action_required; approved this pass after full diff review (first-time fork, Cl3MM has no other firstmate PRs).

Workflows approved this pass: CI 32760559545, Require no-mistakes 32760559622. Not green at comment time.

Land-eligible rec: NO (default-behavior; NM attestation mismatch; CI not yet green). Captain-flag NOW: no.

This is a captain-decision if it should ever land as always-on wake growth. It is also waiting-on-author to regenerate no-mistakes-pipeline-attestation:v1 for THIS HEAD. Recirc from the 8/22 corrective stamp; restamp this pass. Not a merge I will recommend.

[kunchenguid]

Speaking as Kun's firstmate: recirc on current main 038d0f7ec6ba.

class=default-behavior. Bounded wake-context attaches to actionable wakes without an opt-in flag. Never auto-eligible.

VISION.md: honest interface / token-lean context aligns; authority does not align as auto (new default presentation on every wake). Scripts align. Restart aligns. Spine mixed. Vendor aligns. Scope aligns.

This HEAD: c2b785020e5fcb8456828a49b5fd8e4f89b2c25b. MERGEABLE / UNSTABLE, ahead 22 / behind 0.
Attestation 8e4b3991… ≠ THIS HEAD. CI 32760559545 in_progress. Files include bin/fm-classify-lib.sh, docs/architecture.md (overlap with other open PRs / spawn-freshen docs).

Waiting on author for a HEAD-matching no-mistakes-pipeline-attestation:v1. Even then this stays a captain-decision hold, not auto. That is not waiting on you for a product call yet — attestation first.

[kunchenguid]

Speaking as Kun's firstmate: recirc on current main 038d0f7ec6ba (#2942). Newer activity after the 18:28Z stamp (HEAD e2ca9a0, 22:12Z). Never messaged the captain.

class=default-behavior. --present still runs on every actionable Claude Stop / Pi watch / Codex checkpoint wake with no captain opt-in flag. Never auto-eligible.

VISION.md (inspected bin/fm-wake-context.sh --present, Claude/Pi/Codex call sites, new commits e728515 / 3656e8e / e2ca9a0):

• One captain, one interface: aligns (presentation stays firstmate-owned; token-lean packet vs reconstructing crew state).
• Authority is explicit: does not align as auto (always-on wake growth is not an option to enable).
• Scripts own the mechanics: aligns (bounded packet, staged cursor, withheld ACK when fallback receipt fails).
• A restart is a non-event: aligns (replay until ACK; new timeout-after-stage test keeps receipt+cursor).
• Delegation with a spine: mixed (same primitive, larger default payload).
• The fleet outlives any vendor: aligns.
• Scope: aligns.

This HEAD: e2ca9a0aa902d4990158dbc139fa5d8e14a82a90. MERGEABLE / UNSTABLE, ahead 25 / behind 0.
Attestation 3656e8ede01c2f12fe4c1dd6501ba9b8362c4a9c ≠ THIS HEAD (later no-mistakes: apply CI fixes).
Fork CI was action_required on the new head; approved this pass after reviewing the three new commits (first-time fork, Cl3MM has no other firstmate PRs). Workflows this pass: CI 32783565979, Require no-mistakes 32783565977. Not green at comment time. Greptile is not a merge gate.

Security: none. Overlap: bin/fm-classify-lib.sh / docs/architecture.md with other open PRs; docs-only overlap with standing holds. Not a spawn-freshen / teardown / herdr / lock hold.

Land-eligible rec: NO. Captain-flag NOW: no (NM attestation mismatch is an author/CI blocker; the always-on product call waits until green CI + matching NM + no other blockers).

This is a captain-decision if it should ever land as always-on wake growth. It is also waiting-on-author to regenerate no-mistakes-pipeline-attestation:v1 for THIS HEAD. Not a merge I will recommend.

[kunchenguid]

Speaking as Kun's firstmate: recirc on current main 85d6c7226c93 (#2953). Newer activity after the 2026-08-24T22:20:00Z stamp (HEAD now 26eb22e; title now opt-in). Never messaged the captain. Do not rebase.

class=opt-in (was default-behavior last pass). wake_context_enabled requires a regular non-symlink config/wake-context-presentation; absent=off. --present is still invoked from Claude Stop / Pi watch / Codex checkpoint, but without the flag and with no published packet it returns the single manual-drain fallback and does not drain, cache, stage, receipt, or ACK. Replay of an already-published packet remains until exact ACK. Not inherited to secondmates. Tests pin default-off. Not default-behavior. Not auto this pass.

VISION.md (inspected bin/fm-wake-context.sh wake_context_enabled / prepare_presentation, Claude Stop bin/fm-claude-stop-autoarm.sh, Codex bin/fm-watch-checkpoint.sh, Pi .pi/extensions/fm-primary-pi-watch.ts, docs/configuration.md wake-context flag, tests/fm-wake-context.test.sh test_missing_opt_in_falls_back_without_mutation, classify-lib cursor merge):

• One captain, one interface: aligns (presentation stays firstmate-owned; default path keeps the ordinary drain).
• Authority is explicit: aligns as opt-in (new capability is a home-local flag, never inferred; secondmate inheritance refused).
• Scripts own the mechanics: aligns (bounded packet, staged cursor, withheld ACK).
• A restart is a non-event: aligns (byte-identical replay until ACK).
• Delegation with a spine: aligns (same wake primitive; larger payload only after grant).
• The fleet outlives any vendor: aligns.
• Scope: aligns.

This HEAD: 26eb22e6f62aa397abe5755e3de9af8441c500c1 (matches the fetch-time SHA; re-verified). CONFLICTING / DIRTY vs main (#2953 actor-split touched bin/fm-wake-drain.sh). ahead 32 / behind 1.
Attestation matches THIS HEAD.
CI: no Actions runs on THIS HEAD (only Greptile FAILURE). Prior heads did have Behavior/Lint/CI actually run (CI 32783565979 success on e2ca9a0) — Cl3MM is not first-time this pass; no workflow approval this pass. Greptile is not a merge gate. Author body does not use a GitHub closing link; do not claim this closes #1692.

Security: none. Local present/drain; 0600 cache; packet/status/file bounds; flag must be a regular file.

Overlap: bin/fm-classify-lib.sh with open #3001 / #2866 / #2836 / #2881 and others; bin/fm-wake-drain.sh conflicts with landed #2953. Docs-only overlap with standing holds. Not a spawn-freshen / lock / herdr hold.

Land-eligible rec: NO (conflict; no CI on THIS HEAD; not safe to squash). Captain-flag NOW: no.

This is waiting-on-author (conflict with current main; no CI on this HEAD). Not a captain-decision after the opt-in recirc. Not a merge I will recommend.

[greptile-apps]

Want your agent to iterate on Greptile's feedback? Try greploops.