fix: prevent bridge glance observation hangs

[Amplify-Logic]

Intent

Fix the Starship bridge glance page so the captain's phone never stays stuck on Loading. Field state: all four buckets showed Loading and /api/observation returned 503 bearings snapshot timed out on every call. The snapshot completed in about 2.6s with a full user environment but hung with zero output under the bridge server's scrubbed child environment (PATH limited to system dirs, no ~/.local/bin or nvm). Diagnose the hanging step and fix both layers: (1) Server: make the child environment sufficient by resolving needed tool dirs at server start from HOME and the real environment rather than hardcoding a version-specific nvm path, keep the env scrubbed otherwise with no secrets/vars leakage, and make the snapshot path fail fast when a required tool is missing (no silent hangs; a clear error within seconds). The live hang was herdr missing from the child PATH: every in-flight task is Herdr, and pane capture called server_ensure which backgrounded a missing herdr binary and polled 10s per task. Fail that immediately and use the read-only target existence check so observation never starts a herdr server. (2) Client: when /api/observation returns an error or the fetch fails, buckets must show the honest cannot-reach-the-desk state per the original design, never eternal Loading. A first failed observation overlays immediately; the 90s overlay remains only after a successful load if refreshes later stop. (3) Photo counter: Photos received today showed 0 right after real uploads landed in data/bridge-inbox; count today's sidecars correctly (UTC received_at, filename-date fallback) and still return photos_today on 503 so the counter does not depend on glance data loading. (4) Tests: scrubbed-env-shaped observation succeeds or fails fast with an honest error; client error-state rendering; counter counts today's sidecars correctly. Do not use --yes. After CI is green, report the PR URL.

What Changed

• Resolve required CLI directories into the bridge’s scrubbed child PATH, fail immediately when Herdr is unavailable, and keep passive observation from starting a Herdr server.
• Replace indefinite Loading states with an immediate unreachable-desk state on initial observation failures, while preserving delayed stale overlays after successful loads.
• Count today’s photo sidecars using UTC received_at or filename fallback, return the count on 503 responses, and add executable regression coverage and documentation for these behaviors.

Risk Assessment

✅ Low: The incremental commit closes the prior gap by executing the actual page script in a dependency-free Node VM and verifying the initial 503 transition, all four bucket states, overlay activation, and photo counter; the complete change remains well-bounded and conforms to the stated intent.

Testing

Both relevant automated suites passed, including scrubbed-environment PATH discovery, immediate missing-Herdr failure, client error rendering, and UTC/fallback photo counting. A live authenticated browser check confirmed all four buckets immediately showed “Cannot reach the desk” instead of “Loading,” the overlay appeared, and the 503-backed counter still showed two photos.

• Evidence: Authenticated Starship bridge after initial observation failure (local file: /var/folders/1g/hctp3vpn27b1zrlsn4nsfg680000gn/T/no-mistakes-evidence/01M0DGGN382KPB8DXTWWDMV4JZ/bridge-unreachable.png)

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 1 issue found → auto-fixed ✅

• ⚠️ tests/fm-bridge-view.test.sh:1058 - The required criterion “Tests: client error-state rendering” is not actually exercised. This test only checks that the served HTML contains markBucketsUnreachable and let lastSuccess = 0; it never executes refresh() with a failed fetch or asserts the resulting bucket/overlay DOM state, so broken or unreachable error-handling code could still pass. Add an executable client test that simulates the initial observation failure and verifies the rendered state.

🔧 Fix: Exercise client error rendering with executable DOM test
✅ Re-checked - no issues remain.

✅ **Test** - passed

✅ No issues found.

• Inspected git diff --stat 335876759482e4b1105d122326b5fb2710da1f56..2875a8301ef1d0dd9a8603bd7e167c39f5a6548f and target-specific tests.
• bash tests/fm-bridge-view.test.sh
• bash tests/fm-backend-herdr.test.sh
• Started an authenticated bridge with a snapshot fixture that immediately reports missing herdr, then opened http://bridge.localhost:18766/ in Chrome and captured the rendered failure state.
• Verified git status --short after testing.

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.