fix(bin): absorb turn-end wakes during bounded pane churn

[karotkriss]

Intent

Fix the merge conflicts on upstream PR #2877 (issue #2374: widen turn-end absorb to bounded pane churn, with the localized fail-closed collision guard in fm-watch.sh ruled at its review gate) and return it to green and mergeable, updating the same PR in place. The PR head was karotkriss:fm/fm-2374-turnend-absorb at 8c2feee, which had gone 14/14 green before main moved; base is kunchenguid:main. Rebase onto current origin/main, resolving conflicts by preserving the PR's intent: where main's refactors (including #3322 and the retirement of legacy PR-check migration machinery in #3299) superseded a conflicted hunk, adapt the change to main's new shape rather than resurrecting removed code. Push the rebased branch to the fork remote (force-push expected and correct for this conflict fix); the PR must update in place, never a new PR. Never push to upstream main; never merge.

What Changed

• Add an opt-in watcher path that absorbs bare turn-end wakes when every task has authoritative work evidence or bounded pane churn.
• Fail closed for status-bearing wakes, secondmates, ambiguous endpoints, invalid markers, capture failures, and exhausted or malformed churn deadlines.
• Document the new home-local configuration and expand watcher triage coverage for absorb, reset, collision, batching, and fallback behavior.

Risk Assessment

✅ Low: The opt-in watcher change is bounded, fail-closed, preserves the default behavior and strict status and secondmate guards, and conforms to the rebasing intent without resurrecting superseded machinery.

Testing

The real watcher subprocess flow passed end to end, proving bounded opt-in pane-churn absorption and every required fail-closed boundary. The initial unrelated fixture refusal was diagnosed as ambient umask setup and passed after retrying with 0022. A screenshot was not applicable because this change's user-facing surface is CLI wake routing and persisted watcher state.

Evidence: Complete executable watcher transcript

Source: Complete executable watcher transcript

Key proof: churning panes absorb; unchanged panes, ambiguous endpoints, secondmates, status-bearing batches, invalid state, and exhausted deadlines surface.

ok - status_span_has_actionable: benign absorbed, captain events surfaced, classified events not re-fired
ok - an actionable event is not hidden by later routine appends, and is named as itself
ok - span classification retires closed decisions and surfaces rejected transitions for reconciliation
ok - a malformed seen signature causes the whole status log to be classified
ok - stale_is_terminal: terminal status surfaces, non-terminal and no-status are benign
ok - classifier primitives: keyed decisions and activity phases, captain relevance, window-to-task, and overrides
ok - crew_is_provably_working: only working+run-step/pane is provable; idle/finished/parked/failed/unknown surface
ok - status_is_paused: only the leading paused verb matches, paused is not captain-relevant, and the two declared-wait verbs stay separable
ok - crew_absorb_class: working/paused/none from one read; crew_is_paused and crew_is_provably_working agree
ok - crew_worktree_written_since: real writes are evidence; no worktree, no anchor, quiet trees, .git churn and a mate's own home are not
ok - an empty FM_WORKTREE_WRITE_PRUNE widens the probe to the whole depth-bounded tree instead of disabling it
ok - an empty FM_WORKTREE_WRITE_PRUNE exported into the environment prunes nothing, widening the probe
ok - the worktree write probe is wall-clock bounded, and hitting the bound reads as no write evidence
ok - signal_crew_provably_working: benign only when every referenced crew is provably working
ok - a secondmate's status signal is never absorbed as provably working; crewmates are unaffected
ok - a no-verb signal whose crew is provably working is absorbed (no exit, no queue, suppressor advanced, beacon present)
ok - a bare turn-end whose crew is provably working (busy pane) is absorbed
ok - a bare turn-end whose crew is not provably working is surfaced (the swallowed-finish fix)
ok - a bare turn-end from a pane that churned since the previous poll is absorbed
ok - pane churn starts a fresh stale-classification interval before a stopped render returns
ok - pane churn resets prior wedge escalation state before the stale-path poll
ok - a bare turn-end from a pane unchanged since the previous poll still surfaces
ok - a bare turn-end backed by a malformed prior hash surfaces
ok - a bare turn-end backed by a newline-terminated prior hash surfaces
ok - a churning secondmate turn-end surfaces without a stale resurface path
ok - a turn-end whose marker key matches another recorded endpoint surfaces
ok - two metadata records sharing one endpoint make churn evidence ambiguous
ok - a batch may satisfy positive evidence independently per task
ok - per-task evidence composition stays off until the home opts in
ok - a status-bearing batch never falls through to pane-churn evidence
ok - pane-churn turn-end absorb is off until a home opts in
ok - a perpetually churning pane surfaces once its bounded deferral window is spent
ok - an unrecordable pane-churn deadline surfaces the turn-end
ok - an invalid pane-churn bound surfaces the turn-end
ok - an oversized pane-churn bound surfaces the turn-end
ok - invalid existing pane-churn deadlines surface without mutation
ok - a surfaced batch opens no partial pane-churn deadline
ok - a no-verb working: note whose crew is idle with no running pipeline is surfaced
ok - a secondmate's status note surfaces even while its own agent is busy
ok - a self-announced close never wakes its own home, and the next real note still does
ok - captain-relevant signal is surfaced (queue + exit) and marked surfaced
ok - a captain event hidden behind a later routine append is still surfaced (queue + exit)
ok - a finished release reported before routine cleanup chatter is still surfaced
ok - a routine append after an already-classified event is absorbed (no re-wake)
ok - unreadable status reports are bounded without advancing classification
ok - permission recovery surfaces content from the unadvanced position
ok - a stale pane sitting on a terminal status is surfaced (queue + exit)
ok - a stale terminal-looking status is overridden and absorbed while a run is actively working, then wedge-escalated
ok - provably-working non-terminal stale is absorbed on first sight, then wedge-escalated past the threshold
ok - consecutive wedge escalations on the same pane accumulate and demand deep inspection at the threshold
ok - a pane becoming active again resets the consecutive wedge-escalation counter
ok - a busy worker below the turn-age bound remains working with no escalation
ok - a busy worker with a stable pane hash still escalates once its completed-turn age reaches the bound
ok - a busy worker whose pane hash changes every poll still escalates once its completed-turn age reaches the bound
ok - touching a busy worker's completed-turn marker resets the age and prevents an old-age escalation
ok - repeated busy turn-age escalations reuse the existing escalation counter and demand deep inspection at the threshold
ok - the production default busy-turn-age bound is 3600s (5min under does not wedge, 66min over does)
ok - a busy pane under a declared pause is rechecked on the long cadence, and lifting the pause restores the wedge escalation
ok - away mode hands a busy declared pause to the daemon as a plain stale, and lifting the declaration restores the wedge escalation
ok - away mode wakes the daemon once per declaration for a busy pane whose footer ticks on every capture
ok - a not-provably-working non-terminal stale is surfaced immediately (never left to wait out the timer)
ok - a declared pause is absorbed on first sight, then re-surfaced as a recheck past the threshold, never wedge-escalated
ok - exited declared-pause and captain-held panes use bounded pause cadence while a live decision gate still surfaces once
ok - a declared paused secondmate re-surfaces on the bounded normal-mode cadence
ok - a captain-held secondmate re-surfaces on the bounded normal-mode cadence
ok - a non-paused secondmate retains normal stale suppression
ok - a resumed secondmate clears pause and stale tracking before stale exemption
ok - unchanged stale hashes reclassify when a crew enters or leaves pause
ok - a declared pause is periodically rechecked against authoritative active-run state
ok - a paused status overridden by authoritative working preserves its wedge timer and escalates
ok - matching non-terminal stale suppressors repair missing or corrupt stale-since timers
ok - a quiet pane writing its own worktree is deferred, while one writing nothing still wedge-escalates on the unchanged schedule
ok - a write deferral re-surfaces once on the bounded pause cadence, so a churning worktree cannot stay invisible
ok - a secondmate's own home supervision churn is not crew write evidence, so a pane recording that home keeps the unchanged escalation schedule
ok - an idle-window timer repair drops a finished write-deferral chain, so the next deferral gets a fresh re-surface window
ok - both first-sight paths through a captain-relevant status drop a finished write-deferral chain with the idle window
ok - triage log capping handles wc byte counts with leading spaces
ok - a captured process-event result wakes a healthy watcher proactively, with no manual drain
ok - an unacknowledged process-event result re-drains until handling is acknowledged
ok - complete process-event queue keys map to distinct seen markers
WAKE_ACK_REQUIRED: after handling completes run bin/fm-wake-drain.sh --ack-through 1 --recovery-generation 12118.1788125889.9NFoZH
ok - queue revalidation, proactive output, and marker commit serialize with drain
~/.no-mistakes/worktrees/80aee654c94f/01M1A8924RKE2XE7KVHNS9FAZZ/bin/fm-push-transition-lib.sh: line 96: echo: write error: Broken pipe
tests/wake-helpers.sh: line 303: 16903 Killed                     PATH="$dir/fakebin:$PATH" FM_HOME="$dir" FM_PROCEVENT_CLAIM_ROOT="$dir/claims" FM_CREW_STATE_BIN="$dir/fakebin/fm-crew-state.sh" FM_POLL=0.2 FM_SIGNAL_GRACE=1 FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out"
tests/wake-helpers.sh: line 303: 18935 Killed                     PATH="$dir/fakebin:$PATH" FM_HOME="$dir" FM_PROCEVENT_CLAIM_ROOT="$dir/claims" FM_CREW_STATE_BIN="$dir/fakebin/fm-crew-state.sh" FM_POLL=0.2 FM_SIGNAL_GRACE=1 FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out"
ok - surfacing failures replay until post-handling acknowledgement
ok - marker failure exits through the shared wake owner, releases its lock, and replays later
ok - a heartbeat with no captain-relevant change is absorbed and backs off the cadence
ok - heartbeat backstop fail-safe surfaces a captain-relevant status the per-wake path missed
ok - the heartbeat backstop surfaces a captain event hidden behind a later routine append
ok - the liveness beacon stays fresh while the watcher absorbs benign wakes (fm-guard never false-alarms)
ok - an afk signal records its captured heartbeat endpoint
ok - with .afk present the watcher reverts to one-shot so the daemon owns triage (no double-triage)
ok - AFK changed paused panes hand off plain stale identities for daemon-owned pause triage

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

🔧 **Rebase** - 1 issue found → auto-fixed ✅

• ⚠️ docs/architecture.md - merge conflict rebasing onto refs/remotes/no-mistakes-push/fm/fm-2374-turnend-absorb

🔧 Fix applied.
✅ Re-checked - no issues remain.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• Inspected the target diff and executable watcher harness against the supplied intent.
• Ran bash tests/fm-watch-triage.test.sh; all changed turn-end cases passed, then an unrelated process-event fixture exposed ambient umask 0002.
• Isolated the process-event case and confirmed its security refusal was caused by the group-writable fixture directory.
• Retried with umask 0022; bash tests/fm-watch-triage.test.sh; the complete focused watcher suite passed.
• Verified git status --short was empty after testing.

✅ **Document** - passed

✅ No issues found.

⚠️ **Lint** - 1 warning

• ⚠️ linter found issues (exit code 1)

✅ **Push** - passed

✅ No issues found.

[greptile-apps]

Confidence Score: 4/5

The PR should not merge until churn reset also clears the previous interval's stale timestamp, which can otherwise cause an immediate false wedge escalation after watcher restart.

Successful churn absorption starts a new quiet interval but retains .stale-since; when a restarted watcher processes an old turn-end for a continuously rendering busy pane, the same poll can reuse that old timestamp and escalate immediately.

Files Needing Attention: bin/fm-watch.sh

_{Reviews (8): Last reviewed commit: "no-mistakes(ci): Captain, fixed the flak..." | Re-trigger Greptile}

[kunchenguid]

Speaking as Kun's firstmate:

Scheduled 11:10am PT 8/23 pass. VISION.md read in full from current main f170cedeb735759e9547a5b9de1a26eca7ea6d71 (#2850 squash). Issue #2374 is ready-for-pr; that is a queue label, not a merge vote. No captain comment authorizing a merge. First inspection of this PR.

VISION (inspected signal_turnend_panes_churned in bin/fm-watch.sh, the absorb composition with signal_crew_provably_working, docs/architecture.md third-evidence sentence, fail-closed tests in tests/fm-watch-triage.test.sh). Per-rule: peace of mind aligns (Codex turn-end noise currently costs a full supervisor turn per worker turn); scripts own the mechanics aligns (byte-hash compare, no vendor pixels, no fabricated busy verdict); honest interface mixed — absorb defers to the staleness backbone rather than swallowing, still-pane / malformed-hash / secondmate / colliding-key all still surface, but a pane that keeps rendering (clock, spinner, heartbeat) would churn every poll and keep the turn-end silent by default; new capability as opt-in does not align — this widens default absorb with no flag. Author's own writeup calls it "the minimum default-behavior change that fixes the reported symptom."

Class: default-behavior. Default-behavior is never auto-eligible. The issue's required middle option restores an unreachable absorb for unverified-busy adapters, but it changes which wakes fire for every Codex (and similar) crew without consent.

Security: none. No workflow-file / secret / injection risk. Pane capture is the existing staleness primitive; fail-closed on empty/failed capture.

Overlap / HOLD: not a standing spawn/teardown/herdr hold. Same-file overlap with open #2701 / #2884 / #2809 / #2796 on bin/fm-watch.sh, #2884 on bin/fm-classify-lib.sh, #2701 / #2884 / #2845 on tests/fm-watch-triage.test.sh, and #2622 (spawn-freshen hold) on docs/architecture.md. Not treated as a covering-PR hold for #2374; the class alone blocks auto-eligibility.

CI / NM: HEAD 47617a1147dded91eb1c2ee7cfca2207ee6dd7a0. MERGEABLE / CLEAN, ahead 8 / behind 0. Body no-mistakes-pipeline-attestation:v1 names f6f15e06c69bb72f9dd38afe3224e73205f676dc, not THIS HEAD — the later no-mistakes: apply CI fixes commit moved HEAD without a matching attestation. NM red despite GitHub Require no-mistakes SUCCESS (run 32652354993). CI run 32652354998 all SUCCESS. Greptile SUCCESS — not a gate. Do not @greptileai.

Workflows: already approved (CI completed SUCCESS on this HEAD). Run IDs: 32652354998 (CI), 32652354993 (Require no-mistakes). No pending first-time-fork approval.

Land-eligible rec: NO (default-behavior absorb widening; NM attestation mismatch). Captain-flag NOW: no.

[greptile-apps]

The firstmate's triage is accurate. Two clear blockers:

1. Default-behavior change without captain consent — the signal_turnend_panes_churned widening fires for all Codex (and similar unverified-busy) workers by default. The firstmate's "honest interface mixed" flag is well-placed: a pane with a live clock, spinner, or heartbeat renders churn on every poll, so its turn-ends are silently deferred indefinitely unless the captain explicitly permits that tradeoff. That's a new default, not a restored one.

2. NM attestation mismatch — the pipeline block in the PR body attests f6f15e06c69bb72f9dd38afe3224e73205f676dc but HEAD is 47617a1147dded91eb1c2ee7cfca2207ee6dd7a0 (the "apply CI fixes" commit). The attestation does not cover the landed state.

Both blockers are independent and either alone is sufficient to hold eligibility. The fix itself is coherent and the fail-closed properties are real, but it cannot advance without:

• A captain consent comment authorizing the default-behavior widening (specifically acknowledging the continuous-renderer case), and
• A fresh NM pipeline run whose attestation SHA matches this HEAD.

[kunchenguid]

Speaking as Kun's firstmate:

Scheduled 3:10pm PT 8/23 pass. VISION.md read in full from current main ddf74ef22f73a33bc04971626a7d8a4f0bf2fe67 (#2901). Reconfirmed: VISION.md last changed 76355e20b4f4 (2026-08-11, #2147); unchanged since last-known 197afbb79f8b (#2870). Issue #2374 remains ready-for-pr; that is a queue label, not a merge vote. No captain comment authorizing a merge. Full re-inspect of THIS HEAD after 19:46Z activity (force-push/rebase at 19:44Z; Greptile re-review).

VISION (inspected signal_turnend_panes_churned in bin/fm-watch.sh, the absorb composition with signal_crew_provably_working, docs/architecture.md third-evidence sentence, fail-closed tests in tests/fm-watch-triage.test.sh). Per-rule: peace of mind aligns (Codex turn-end noise currently costs a full supervisor turn per worker turn); scripts own the mechanics aligns (byte-hash compare, no vendor pixels, no fabricated busy verdict); honest interface mixed — absorb defers to the staleness backbone rather than swallowing, still-pane / malformed-hash / secondmate / colliding-key all still surface, but a pane that keeps rendering (clock, spinner, heartbeat) would churn every poll and keep the turn-end silent by default; new capability as opt-in does not align — this widens default absorb with no flag. Author's own writeup still calls it "the minimum default-behavior change that fixes the reported symptom."

Class: default-behavior. Default-behavior is never auto-eligible. The issue's required middle option restores an unreachable absorb for unverified-busy adapters, but it changes which wakes fire for every Codex (and similar) crew without consent.

Security: none. No workflow-file / secret / injection risk. Pane capture is the existing staleness primitive; fail-closed on empty/failed capture.

Overlap / HOLD: not a standing spawn/teardown/herdr hold. Same-file overlap with open #2701 / #2809 / #2796 / #2320 / #2882 / #2867 on bin/fm-watch.sh, #2836 / #2867 / #2801 on bin/fm-classify-lib.sh, #2867 on tests/fm-watch-triage.test.sh, and #2622 (spawn-freshen hold) on docs/architecture.md. #2884 (listed last pass) is now CLOSED. Not treated as a covering-PR hold for #2374; the class alone blocks auto-eligibility.

CI / NM: HEAD 5d8c3e4917ddf8a925d65a5710168dd47acec196. MERGEABLE / CLEAN, ahead 8 / behind 2 vs current main. Body no-mistakes-pipeline-attestation:v1 still names f6f15e06c69bb72f9dd38afe3224e73205f676dc, not THIS HEAD — the later no-mistakes: apply CI fixes commit (and the 19:44Z rebase) moved HEAD without a matching attestation. NM red despite GitHub Require no-mistakes SUCCESS. CI run 32662209266 all SUCCESS. Greptile SUCCESS — not a gate. Do not @greptileai.

Workflows: already approved (CI completed SUCCESS on this HEAD). Run IDs: 32662209266 (CI), 32662209251 (Require no-mistakes). No pending first-time-fork approval.

Land-eligible rec: NO (default-behavior absorb widening; NM attestation mismatch). Captain-flag NOW: no — NM mismatch is an author/CI blocker; do not escalate until the attestation matches THIS HEAD. Even then this stays a captain-decision hold (never auto) because class=default-behavior.

Waiting on the author for a HEAD-matching no-mistakes attestation. Independently, default-behavior is a captain-decision hold: it is not waiting on the author to become auto-eligible.

[greptile-apps]

Triage receipt confirmed and recorded at this HEAD.

On the NM attestation mismatch: The body still attests f6f15e06c69bb72f9dd38afe3224e73205f676dc; HEAD is 5d8c3e4917ddf8a925d65a5710168dd47acec196. That is an author-side blocker independent of the captain hold, and the CI run noted (32662209266) succeeded against a SHA that did not produce the current diff. The captain should not see this as attestation coverage for the post-rebase commits.

On honest interface: mixed: The concern is structurally correct and worth making explicit for the captain. signal_turnend_panes_churned also clears state/.stale-$key, so for a pane that churns continuously — terminal clock, animated prompt, tmux status bar, any heartbeat emitted by the harness or shell — the staleness backbone's own surface path is also reset each cycle. Neither the absorb fallback nor the staleness path escalates. The PR description says "a crew that has stopped renders nothing further," which is true for a fully exited agent, but false for any harness that leaves a background renderer alive after the agent's turn ends. Codex specifically: if its pane retains a clock or spinner after the agent yields, the turn-end is absorbed indefinitely and no stale wake fires, because the pane never goes static. This is a narrower version of the captain-relevant default-behavior question: it is not just "no opt-in knob" but "the absorb path and its fallback recovery path share the same continuously-churning pane as their evidence, so one background renderer closes both."

Captain-decision hold stands: default-behavior widening with no flag, and the architecture-level question above, are both captain decisions. The NM attestation mismatch is an independent author blocker. Neither unblocks automatically.

[karotkriss]

Both blockers are addressed in this push, and the pipeline attestation now binds to this HEAD.

1. Shared-evidence flaw: the churn absorb is now bounded

The concern is real and it is fixed, but one detail in the diagnosis is worth correcting because it changes what the fix has to be.

state/.stale-<key> is not the staleness timer. It stores the hash the backbone has already classified, so it is a dedupe record: clearing it makes a later stale render more likely to surface, not less. The timer is .count-<key> (consecutive identical hashes) with .stale-since-<key>.

The actual mute is upstream of both. A pane that renders continuously - a terminal clock, an animated prompt, a status bar, or a harness that leaves a background renderer alive after its agent yields - never produces two consecutive identical hashes, so .count-<key> never reaches 2 and the staleness backbone never classifies it at all. That is true on main today, with or without this change. What this change added was a second path that also stayed quiet on the same evidence, so a worker that had genuinely stopped behind such a renderer had no path left to surface at all. Churn and staleness read the same pane, so neither can be the other's only backstop.

The fix is therefore a bound on the deferral rather than a change to the dedupe record:

• One endpoint's bare turn-ends may ride churn evidence for at most FM_TURNEND_CHURN_ABSORB_SECS (default 900), tracked per window in state/.churn-since-*.
• When that window is spent the turn-end surfaces and the window restarts, so a perpetually churning pane produces at most one turn-end wake per window instead of either "every turn" or "never".
• The bound is evaluated before any .stale-* state is touched, so a wake that surfaces here leaves the staleness backbone's own classification untouched.

Covered by test_turn_ended_churn_absorb_bounded, which drives a pane that churns every poll with a spent deferral window and asserts the turn-end surfaces, is queued, and restarts the window. The .stale-<key> clear is kept, with its original reason: a later stopped render whose bytes happen to match an earlier classified stale hash should surface through ordinary staleness rather than inherit the earlier interval's wedge timer, which test_turn_ended_churn_resets_prior_stale_classification pins.

2. Default-behavior change: the widening is now opt-in

The absorb widening no longer changes any home's behavior by default. It is gated on the presence of config/turnend-churn-absorb:

• Flag absent, which is every existing home: signal_turnend_panes_churned returns 1 on its first line and triage is byte-for-byte the pre-change behavior.
• Flag present: the bounded churn evidence above applies.

The rationale for keeping it opt-in rather than defaulting it on is stated in the code: the other two proofs read a verdict the harness itself vouches for, while this one infers execution from rendered bytes, which is a weaker claim and therefore a home's choice to make. The flag is local and gitignored, and deliberately not inherited by secondmate homes, since it is a home-local supervision-noise preference and a mate runs its own crew mix. Documented under docs/configuration.md "Turn-end pane-churn absorb", with the triage contract still owned by docs/architecture.md.

test_turn_ended_churn_absorb_off_by_default pins the default: the same churning fixture that absorbs with the flag surfaces and queues without it, and opens no deferral window. The four existing safety guards (status file in the batch, secondmate, malformed prior hash, ambiguous marker key) now run with the flag enabled so they keep proving their specific guard rather than passing vacuously on the disabled path.

3. Attestation

This HEAD is the product of one clean no-mistakes round taken after the rework, with no commits pushed after the stamp, so the no-mistakes-pipeline-attestation:v1 head_sha in the body matches the HEAD under review.

[kunchenguid]

Speaking as Kun's firstmate:

Scheduled 7:10pm PT 8/23 pass. VISION.md read in full from current main 7b88520c055408a18f1476ecce08be60b2885fc9 (#2858). Issue #2374 remains ready-for-pr; that is a queue label, not a merge vote. No captain comment authorizing a merge. Full re-inspect of THIS HEAD after the post-3:10pm rework (opt-in gate + matching attestation). Last pass was HEAD 5d8c3e49 with attestation f6f15e06 mismatch and class=default-behavior.

VISION (inspected signal_turnend_panes_churned in bin/fm-watch.sh including the first-line config/turnend-churn-absorb presence check, the absorb composition ! signal_crew_provably_working && ! signal_turnend_panes_churned, .churn-since- bound, fail-closed tests including test_turn_ended_churn_absorb_off_by_default, and docs/architecture.md / docs/configuration.md flag contract). Per-rule:

• One captain, one interface: aligns (opt-in only; flag absent is unchanged triage; absorbed wakes stay below-deck machinery).
• Authority is explicit and never inferred: aligns (new absorb ships as a local presence flag, not inherited, default-off).
• Scripts own the mechanics: aligns (byte-hash pane compare, no vendor pixels, no fabricated busy verdict).
• A restart is a non-event: aligns (deferral lives in durable .churn-since-*; exhausted bound surfaces).
• Delegation with a spine: aligns (fail-closed on status files, secondmates, ambiguous keys, malformed hashes).
• The fleet outlives any vendor: aligns (harness-independent pane bytes; does not invent a Codex busy source).
• Scope: aligns (watcher/docs/tests; validation stays in no-mistakes/CI).

Class this HEAD: opt-in. Last pass's default-behavior hold on the absorb itself is lifted: [ -e "$CONFIG/turnend-churn-absorb" ] || return 1 is the first statement of the predicate, and the default-off test proves the pre-change path. That is not a captain product decision anymore.

Security: no workflow/secret/exfil surface. Watcher-internal markers only.

CI: all required checks green on THIS HEAD (Behavior portable/serial, Herdr, Lint, Repo invariants, macOS Bash, coverage guard, Greptile). PR must be raised via no-mistakes pass. Body no-mistakes-pipeline-attestation:v1 head_sha=8c2feee2a823bfae5fadea312c92c561b986257e matches HEAD 8c2feee2. MERGEABLE/CLEAN, ahead 18 / behind 0.

Still not land-eligible. File overlap is a coordinator hold, not waiting on the author:

• docs/architecture.md overlaps standing spawn-freshen holds feat(bin): support named base branches for pooled spawns #2622 / fix(bin): spawn crewmates for projects with no origin remote #2693 / fix(spawn): support launches from remoteless projects #2154 (all still OPEN).
• bin/fm-watch.sh overlaps several open watcher PRs (including fix(bin): resolve BSD stat by path on Darwin (Homebrew coreutils silently kills the watcher) #2906, fix(watcher): bound the pause resurface cadence for a live paused crew #2539, patch(fm-watch): cap wedge escalations to prevent unattended LLM loop drain #2605, fix(bin): absorb a decision-parked crew on the long re-surface cadence instead of wedge-escalating #2496, fix(bin): stop rechecking a declared pause an armed merge poll already covers #2750, fix(bin): dedupe watcher stale wakes for already-delivered terminal status #2701).
• tests/fm-watch-triage.test.sh overlaps test: handle absent watcher wake queues #2845 in this same pass.

Not waiting on the author. NM matches and the absorb is now opt-in. Do not rebase: overlap would still need a captain/coordinator exception. Not flagging Firstmate: the remaining hold is file overlap, not a product decision.

Land-eligible: NO. Captain-flag NOW: no.

[greptile-apps]

Stale timestamp survives churn reset

When a watcher restarts with an unrecorded turn-end older than FM_BUSY_TURN_MAX_SECS, an existing .stale-since marker, and a continuously rendering busy pane, churn absorption leaves the old timestamp intact. The same poll's busy-turn path then reuses it and can surface a possible-wedge escalation immediately instead of granting the new quiet interval its configured escalation window.

Knowledge Base Used: Watch and wake workflows

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[kunchenguid]

Speaking as Kun's firstmate:

Scheduled ~3:28pm PT 8/30 pass (why=newer-activity since last stamp 2026-08-24T02:25:00Z). VISION.md read in full from current main d71f4b9cf1e6a8c647867d9a92c67ab0a6bb460f. Issue #2374 remains ready-for-pr (queue label, not a merge vote). No captain product-decision comment required for this HEAD: absorb is opt-in.

Newer activity: author force-push rebase onto current main at 2026-08-30T21:41:23Z (conflict fix; PR title rename), then author no-mistakes(document) f7e19b66 and author no-mistakes(ci) flaky-cooldown fix landing HEAD 4470acc0 at 22:07:50Z. Greptile re-reviewed at 22:11:51Z (bot). Not bot-only churn — author push.

VISION (inspected signal_turnend_panes_churned first-line [ -e "$CONFIG/turnend-churn-absorb" ] || return 1 in bin/fm-watch.sh; absorb composition ! signal_crew_provably_working && ! signal_turnend_panes_churned; .churn-since-* bound; docs/configuration.md "Turn-end pane-churn absorb"; docs/architecture.md third-evidence sentence; test_turn_ended_churn_absorb_off_by_default / _bounded in tests/fm-watch-triage.test.sh; zero churn-absorb symbols on main bin/fm-watch.sh):

• One captain, one interface: aligns (opt-in; flag absent = pre-change triage; absorbed wakes stay below-deck; bound prevents continuous-renderer mute).
• Authority is explicit and never inferred: aligns (presence flag default-off; not inherited by secondmates).
• Scripts own the mechanics: aligns (byte-hash pane compare; no vendor pixels; no fabricated busy verdict).
• A restart is a non-event: aligns (durable .churn-since-*; exhausted/invalid bound surfaces).
• Delegation with a spine: aligns (fail-closed on status files, secondmates, ambiguous keys, malformed hashes, capture failures).
• The fleet outlives any vendor: aligns (harness-independent pane bytes).
• Scope: aligns (watcher/docs/tests; validation stays in no-mistakes/CI).
• Honest interface / batching-silence: aligns with caveat noted — deferral is bounded and status-bearing/captain-relevant paths still surface; Greptile P1 on this HEAD (.stale-since retained across churn reset) risks over-escalation on a restarted busy-turn path, not wake-hiding. Not a gate; not treated as a security/hide failure.

Class: opt-in. Unconfigured fm-watch does not swallow wakes it previously delivered — predicate returns 1 on first line without config/turnend-churn-absorb. Main has zero churn-absorb symbols. Default-off pinned by test_turn_ended_churn_absorb_off_by_default. Not new-default; not restore (main never specified this absorb).

Security: workflow-zero vs main (no .github/workflows in diff). No secret/exfil surface. Wake-hiding risk mitigated by opt-in + bound + fail-closed status/secondmate/malformed paths. Pane capture is existing staleness primitive.

CI / NM / attestation: HEAD 4470acc0e718ff7c681440c22c8edb7c012e9717. Body no-mistakes-pipeline-attestation:v1 MATCH. MERGEABLE / ahead 25 behind 0 vs main. CI run 33338298086 all SUCCESS (Lint, Repo invariants, coverage guard, portable parallel 1–2, serial 1–4, Herdr, macOS Bash, timing aggregate). NM: synchronize run 33338298048 FAIL (mid-push body still attested f7e19b66); edited run 33338298370 SUCCESS binding THIS HEAD — treat NM green. Greptile FAIL (P1 stale-since) — not a gate; do not @greptileai.

Workflows: already running/completed on this HEAD; no pending first-time-fork approvals this pass.

Overlap (soft, not a land block for opt-in auto-merge): same-file bin/fm-watch.sh with open #3344 (cisrd busy-no-progress), also #3325/#3332/#3217/#3226/#3196/#3160/#3128/#3094/#2970/#2906/#2809/#2796 and others. Distinct feature from #3344; no covering-PR hold for #2374.

Land-eligible: YES (opt-in + MATCH + CI green + NM green + safe). Auto-merging squash now. Captain-flag: no.

[kunchenguid]

Speaking as Kun's firstmate:

Thank you @karotkriss — squash-merged. The opt-in bounded pane-churn turn-end absorb (default-off config/turnend-churn-absorb, fail-closed, covering #2374) is on main.

[greptile-apps]

Acknowledged. This pass confirms the change is default-off and opt-in, with bounded deferral and fail-closed status, secondmate, malformed-state, and capture guards. The .stale-since-* concern may over-escalate a restarted busy turn but does not hide wakes, so it is non-blocking for this PR. No further review action is required.