Session Start Recovery

Session-start recovery

The digest itself makes no external-network call and never waits for one. Every network check a session start owes - GitHub auth, dead-secondmate relaunch, secondmate convergence, pending handoff delivery, and project clone refresh - runs off the digest's blocking path in a bounded worker owned by bin/fm-startup-network.sh and is reported in the digest's own NETWORK CHECKS section. The locked startup inactive-outcome scan joins that worker so a slow local current-state read cannot block the digest; its findings use the ordinary durable wake queue.

1. Lock - acquires the per-home session lock first, before anything mutates shared state, then starts the deferred startup stage above.
2. Bootstrap - detect-only checks (tool/version problems, the worktree-tangle check, harness override, dispatch-profile validation, backlog-backend status) always run, but routine confirmations stay silent by default. When the lock could not be acquired, the worktree-tangle check uses read-only advisory wording without a checkout repair command. Home-local stale Herdr projection cleanup and the six bootstrap MUTATING sweeps - same-home backlog reconciliation, fleet sync, secondmate convergence, secondmate liveness, pending remote handoff retry, and Relay artifact writes - run only when this session actually holds the lock from step 1; the four network ones among them run in the deferred stage rather than in this section. The secondmate liveness sweep deterministically accounts for every registered secondmate: it relaunches only from the recovery-grade dead or missing states, preserves ambiguous, unreadable, or unreachable remote targets, and reports skipped or failed guarantees as SECONDMATE_LIVENESS: lines (bin/fm-bootstrap.sh; bin/fm-backend.sh's fm_backend_agent_state; docs/remote-secondmates.md). Ordinary supervision continues the same guarantee through the watcher's cadence-gated liveness tick over the shared bin/fm-secondmate-liveness-lib.sh, so a mate that dies mid-session is relaunched without waiting for the next session start.
3. Wake queue - when locked, drains and presents the durable wake queue without running the inactive-outcome scan inline, and prints the raw records prominently as this turn's first work queue; a clearly labeled status-event annotation may follow a valid signal record and includes every status line still unread at the presentation cursor, but never replaces the raw record or current-state reconciliation, and a lapsed watcher chain still surfaces here via the same guard alarm. Presented records remain durable until the handling turn runs the generation-bound acknowledgement printed by the drain. Every locked drain also prints a bounded fleet-wide OPEN DECISIONS section when durable decision records remain open, including when the queue itself is empty; reconcile those entries before continuing. A main drain may also print a bounded, one-shot STATUS OUTCOME BACKSTOP when a task's newest captain-facing status event has no covering supervision-branch outcome; handle it as a recovered wake even when no queue row remains. The same drain prints every still-unread note: line and pending-reply resolution since the last presentation in an unbounded UNREAD STATUS section, so an answer buried under a later routine line is not dropped; those lines are not re-printed after that presentation. It also prints a bounded RECORD DIVERGENCE section naming every captain call the status log reads as resolved while its backlog task is still held; nothing is closed for you, and captain-hold-lifecycle owns the reconciliation. When the lock could not be acquired and verified, the queue is left untouched because no session mutation is authorized, and the guard's tangle/watcher-liveness alarms still print in read-only advisory mode without drain, supervision repair, or checkout repair commands.
4. Supervision operating instructions - after the wake queue and before both digests, the digest emits exactly one operating block for the detected primary harness, followed by the read-once contract that governs them. The script itself never starts supervision; the emitted harness protocol owns the exact wait or wake mechanism.
5. Fleet-state digest - after that read-once contract and ahead of the context digest, the compact backlog listing owned by bin/fm-session-start.sh; every state/<id>.meta; a bounded tail of each task's state/<id>.status (labeled as wake-EVENT history, not current state, with the full log path printed for a deeper read); the away or quiet posture (state/.afk-contract, plus the state/.afk daemon flag where a daemon runs); and one cheap alive/dead read of each task's recorded backend endpoint. That liveness line is a fast presence check only, not a full state read - when you need a crew's actual current state (a run-step, not just "is the pane there"), read it with bin/fm-crew-state.sh <id> as before; the digest deliberately skips that deeper, slower read for every task so it stays fast and bounded.
6. Network checks - after the fleet-state digest, the deferred stage's result, or an explicit statement of what it has not confirmed yet. A read-only session runs no network checks at all and says so.
7. Context digest and next step - last of the bulk sections, the full contents of data/projects.md, data/secondmates.md, data/captain.md, data/captain-shared.md, and data/learnings.md, each clearly delimited, followed by the closing reminder. A file that does not exist prints an explicit ABSENT marker, never confused with an empty-but-present file: absence is meaningful (captain.md absent means use the firstmate repo's built-in defaults, projects.md absent means rebuild it from the clones under projects/, etc.). The closing reminder points back to the emitted supervision block and preserves only the lock, afk, Relay, and read-once reminders.