feat(bin): add fork-sync, firstmate-update, and AXI-suite checks

[Freudator86]

Intent

Reconcile the repository's diverged histories into one branch that preserves both origin/main and all 12 already-completed commits from origin/fm/recover-unlanded-commits-jul19. The reconciliation must remain a genuine two-parent merge with the exact merge subject 'Merge unlanded local commits predating a later origin advance'; do not rebase, squash, force-push, or manually replace either parent history. Resolve overlapping shared instructions, scripts, skills, docs, and tests conservatively on merit, keeping additive functionality from both sides and preserving the newer safety and ownership contracts. Validate the complete merged tree, push the feature branch, and open a PR that Firstmate can later land with merge rather than squash.

What Changed

• Reconciled diverged histories with a genuine two-parent merge (Merge unlanded local commits predating a later origin advance) landing 12 previously-unlanded fork commits onto origin/main, then restored merge-dropped AXI-suite/Bridge/docs/scripts.md/test-guard content and fixed an inverted Bridge-vessel config precedence description in AGENTS.md.
• Added new drift/self-update detection scripts wired into bootstrap: bin/fm-axi-suite.sh (AXI-suite self-update and safety seatbelts), bin/fm-firstmate-update-check.sh (upstream firstmate update detection), and bin/fm-fork-sync-check.sh (curated fork sync detection), documented in docs/architecture.md, docs/configuration.md, and docs/scripts.md.
• Extended bin/fm-watch.sh to wake on Bridge inbox traffic, scoped per home and deduplicated via a surfaced-signature marker, reading state from fetched origin/main; added matching coverage in tests/fm-axi-suite.test.sh, tests/fm-firstmate-update-check.test.sh, tests/fm-fork-sync-check.test.sh, tests/fm-watch-bridge-inbox.test.sh, and tests/lib.sh.

Risk Assessment

✅ Low: The single-line fix in e59d3a0 correctly corrects the previously-flagged Bridge vessel precedence description to match the actual code (bin/fm-watch.sh) and the cross-referenced docs/configuration.md, with no new issues introduced and a clean, marker-free working tree.

Testing

The configured baseline test command already passed; on top of that I verified via git plumbing that the merge is a genuine two-parent merge with the exact required subject and the exact 12 recovered commits from origin/fm/recover-unlanded-commits-jul19 layered onto origin/main, found zero leftover conflict markers, and ran targeted tests for every file the merge listed as conflicted (all pass, including a test that directly exercises the Bridge-vessel precedence bug the final commit fixed, cross-checked against the real code). The one intent requirement not yet satisfied at this commit is that the branch has not been pushed to origin and no PR has been opened.

• Outcome: ⚠️ 1 warning across 1 run (25m44s)

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

⚠️ **Rebase** - 1 warning

• ⚠️ .agents/skills/afk/SKILL.md - branch carries 12 commit(s) that exist on your local main branch but were never pushed to origin/main; rebasing would bundle this unrelated work (148 file(s)) into the PR:
• 8a5fd11 fix(watch): deduplicate Bridge inbox wakes with a surfaced-signature marker (feat(session-start): arm direct Telegram receiver #7)
• 9053fc4 fix(watch): scope Bridge inbox vessel per home (fix(wake): harden test cleanup and wake-queue locking against tmp leaks and filesystem failures #6)
• bff1762 Merge pull request feat(bootstrap): detect primary checkout drift from its own origin #5 from Freudator86/fm/fork-sync-maintenance
• 6aedfec no-mistakes(document): Docs synced: added fork-sync-check mentions to architecture.md and configuration.md systemd/env sections
• 40b1f11 no-mistakes(test): fix(afk): install signal traps before lock acquire to avoid race
• a3794c7 no-mistakes(review): fix: drop unused local-checkout fetch, de-personalize docs cron path
• c8496fb feat: add curated fork sync detection
• 0fc5f85 Merge branch 'main' of https://github.com/kunchenguid/firstmate into fm/fork-sync-maintenance
• 8f3190b fix(watch): read Bridge inbox state from fetched origin/main instead of stale local tree (feat(bin): add fork-sync, firstmate-update, and AXI-suite checks #4)
• df159d2 feat(bootstrap): add upstream firstmate update check (feat: add bootstrap and watcher drift checks #3)
• 4939c5b feat(watch): wake on Bridge inbox traffic (fix(fleet-sync): skip non-repo directories nested in enclosing repo #2)
• e623032 feat: add AXI-suite self-update and primary safety seatbelts (feat: configure Codex Graphify approval profile #1)

Push main to origin, or rebase your branch onto origin/main, before gating.

🔧 **Review** - 5 issues found → auto-fixed (2) ✅

• 🚨 bin/fm-bootstrap.sh:805 - The merge conflict resolution silently dropped functionality that the second parent (8a5fd11) added: the invocation of "$SCRIPT_DIR/fm-axi-suite.sh" inside the mutating block (was alongside secondmate_sync/x_mode_setup/fleet_sync at bin/fm-bootstrap.sh:805-810, now absent), and the four relay lines just before exit 0 that surfaced state/firstmate-update.available, .stuck, state/fork-sync.pending, and .stuck (verified via grep -n "axi-suite\|firstmate-update\|fork-sync" bin/fm-bootstrap.sh → zero matches in the script body). The header comment (lines 19-21) still documents AXI_SUITE_UPDATED/REVIEW/STUCK, FIRSTMATE_UPDATE_AVAILABLE/STUCK, and FORK_SYNC/FORK_SYNC_STUCK as things bootstrap prints, and docs/configuration.md:268 independently corroborates this was real intended wiring, not vestigial text. This contradicts the binding user intent's requirement to 'resolve overlapping shared instructions, scripts, skills, docs, and tests conservatively on merit, keeping additive functionality from both sides' — an entire feature (AXI-suite self-update via bootstrap, and surfacing of the firstmate-update/fork-sync diagnostics through bootstrap's detect output) was silently omitted rather than merged in.
• 🚨 AGENTS.md:106 - AGENTS.md — which the file itself calls 'your entire job description' — has zero mentions of the Bridge inbox feature after the merge (grep -i bridge AGENTS.md returns nothing), even though docs/architecture.md:47-48 and docs/configuration.md:368-372 fully document it and it's live, merged code in bin/fm-watch.sh. Specifically dropped from the second parent (8a5fd11): the config/bridge-vessel file-layout entry (was near the config/ block, AGENTS.md:63-75 in the merged file has no such row though .gitignore was updated with config/bridge-vessel), .bridge-* in the 'watcher internals; never touch' glob at AGENTS.md:106 (currently lists .hash-* .count-* .stale-* ... .heartbeat-streak but omits .bridge-*), an 'AXI-suite currency' subsection in section 3 covering the AXI_SUITE_STUCK escalation rule, and the 'Bridge inbox traffic' clause in section 8's check: wake-handling bullet (AGENTS.md:328 currently reads 'act on the named poll result, including merges and X-mode events' with no Bridge mention). This is dropped 'additive functionality' the intent requires be kept from both sides.
• ⚠️ docs/scripts.md:86 - The canonical script index table in docs/scripts.md is missing rows for 8 scripts that exist on disk under bin/: fm-axi-suite.sh, fm-firstmate-update-check.sh, fm-fork-sync-check.sh (added by the second parent, 8a5fd11) and fm-lint.sh, fm-install-shellcheck.sh, fm-cd-pretool-check.sh, fm-cd-command-policy.mjs, backends/herdr-eventwait.py (added by the first parent, b384c1b). Both sides added rows to this same table and the conflict resolution kept neither side's additions for these 8 entries (only fm-transition-lib.sh survived). This is dropped documentation the intent requires be preserved ('keeping additive functionality from both sides' explicitly includes 'docs').
• ⚠️ tests/fm-pi-watch-extension.test.sh:113 - The second parent (8a5fd11) added a fm_node_supports_ts_import helper to tests/lib.sh plus guard calls at 6 call sites across tests/fm-pi-watch-extension.test.sh (lines ~113, 191, 329, 372) and tests/fm-turnend-guard.test.sh (lines ~796, 862) to skip Pi-extension tests that exec .ts plugin files via node --input-type=module on Node runtimes lacking native TypeScript import support. The helper itself survived the merge into tests/lib.sh, but because both test files were resolved as pure first-parent (b384c1b) content, all 6 call sites were dropped — grep -rn fm_node_supports_ts_import . shows the helper is now defined but never invoked anywhere, i.e. dead code.
• ⚠️ tests/fm-cd-pretool-check.test.sh:437 - test_scripts_are_shellcheck_clean in tests/fm-cd-pretool-check.test.sh only checks command -v shellcheck before running shellcheck with no version pin or --norc. The second parent (8a5fd11) had fixed this to read the required version from bin/fm-lint.sh --required-version, skip with a clear message when the installed shellcheck doesn't match, and pass --norc — matching the convention bin/fm-lint.sh documents (REQUIRED_SHELLCHECK=0.11.0) and that tests/fm-lint.test.sh already follows. This fix was dropped when the file was resolved as pure first-parent content.

🔧 Fix: Restore dropped AXI-suite/Bridge/scripts.md/test-guard merge content
1 warning still open:

• ⚠️ AGENTS.md:75 - The newly restored config/bridge-vessel row states: 'falls back to FM_BRIDGE_VESSEL, and absent disables Bridge inbox scans' — this describes config/bridge-vessel as primary and FM_BRIDGE_VESSEL as its fallback. That's backwards. bin/fm-watch.sh:110-115 checks FM_BRIDGE_VESSEL first (if [ -n "${FM_BRIDGE_VESSEL:-}" ]; then ... elif [ -f "$FM_HOME/config/bridge-vessel" ]), and docs/configuration.md:370 (cross-referenced by this very line) already states it correctly: 'FM_BRIDGE_VESSEL selects the vessel and falls through to local config/bridge-vessel'. This exact sentence wasn't present in either original merge parent (8a5fd11's version of this line just said 'absent disables Bridge inbox scans' with no precedence claim) — the precedence wording is new text added by this fix commit itself, and it inverts the real resolution order right next to a correct cross-reference to the doc that says the opposite.

🔧 Fix: Fix inverted Bridge vessel config precedence in AGENTS.md
✅ Re-checked - no issues remain.

⚠️ **Test** - 1 warning

• ⚠️ User intent requires the reconciliation branch to be pushed to origin and a PR opened that Firstmate can later land with merge (not squash). As of target commit e59d3a0, git ls-remote origin fm/fm-recover-fork-drift returns nothing and gh-axi pr list shows no PR for this branch (only an unrelated open PR feat: add bootstrap and watcher drift checks #3). The merge/tree content itself is fully validated and correct, but this required delivery step of the intent is not yet done.
• command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; exit "$rc"
• git log -1 --format='%H %P %s' 6099e6a — confirmed two-parent merge, parents b384c1b and 8a5fd11c, exact subject 'Merge unlanded local commits predating a later origin advance'
• git rev-parse origin/fm/recover-unlanded-commits-jul19 vs merge's second parent — exact match
• git log --oneline b384c1b..8a5fd11c — exactly the 12 expected commits
• git merge-base --is-ancestor b384c1b origin/main — base is first-parent ancestor of origin/main
• grep -rn '^ |^ |^ ' across the tree — no leftover conflict markers
• bash tests/fm-cd-pretool-check.test.sh — pass, including restored shellcheck-required-version guard
• bash tests/fm-pi-watch-extension.test.sh — pass (some cases intentionally skip: Node lacks native .ts import support)
• bash tests/fm-session-start.test.sh — pass
• bash tests/fm-turnend-guard.test.sh — pass
• bash tests/fm-watch-bridge-inbox.test.sh — pass, including 'Bridge vessel resolution prefers a non-empty env value and falls back to per-home config'
• manual cross-check of AGENTS.md's corrected Bridge-vessel precedence text against bin/fm-watch.sh:110-113 logic — matches
• manual check that files referenced by the restored docs/scripts.md entries (fm-axi-suite.sh, fm-firstmate-update-check.sh, fm-fork-sync-check.sh, fm-lint.sh, fm-install-shellcheck.sh, fm-cd-pretool-check.sh, fm-cd-command-policy.mjs, backends/herdr-eventwait.py) actually exist in the tree
• partial rerun of full tests/*.test.sh suite (20/82 completed with 0 failures before stopping) as a spot-reconfirmation of the already-passing baseline
• git ls-remote origin fm/fm-recover-fork-drift and gh-axi pr list — branch not pushed, no PR opened for this change

⚠️ **Document** - 1 info

• ℹ️ docs/fork-patches.md:3 - The registry's own stated rule ('each fork-only, non-merge commit has one row') is broader than actual practice: only the original 4 pre-advance commits (e623032, 4939c5b, df159d2, 8f3190b) have rows, while later fork-only feature commits in this same change (notably c8496fb, which adds the fork-sync-check mechanism itself) have none; fix commits to already-tracked features (9053fc4, 8a5fd11) instead updated an existing row's rationale in place. This is a repeated, deliberate authorial choice (verified across three separate commits), not an accidental omission, so left as-is.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.